3 #define BLACKBONE_DEVICE_NAME L"BlackBone"
4 #define BLACKBONE_DEVICE_FILE L"\\\\.\\" ## BLACKBONE_DEVICE_NAME
6 #define FILE_DEVICE_BLACKBONE 0x00008005
23 #define IOCTL_BLACKBONE_DISABLE_DEP (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x800, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
40 #define IOCTL_BLACKBONE_SET_PROTECTION (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x801, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
57 #define IOCTL_BLACKBONE_GRANT_ACCESS (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x802, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
74 #define IOCTL_BLACKBONE_COPY_MEMORY (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x803, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
91 #define IOCTL_BLACKBONE_ALLOCATE_FREE_MEMORY (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x804, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
108 #define IOCTL_BLACKBONE_PROTECT_MEMORY (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x805, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
127 #define IOCTL_BLACKBONE_MAP_MEMORY (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x806, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
144 #define IOCTL_BLACKBONE_MAP_REGION (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x807, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
161 #define IOCTL_BLACKBONE_UNMAP_MEMORY (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x808, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
178 #define IOCTL_BLACKBONE_UNMAP_REGION (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x809, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
195 #define IOCTL_BLACKBONE_HIDE_VAD (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x80A, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
212 #define IOCTL_BLACKBONE_INJECT_DLL (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x80B, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
230 #define IOCTL_BLACKBONE_MAP_DRIVER (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x80C, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)
ULONGLONG pipeHandle
Definition: BlackBoneDef.h:331
ULONGLONG newPtr
Definition: BlackBoneDef.h:322
ULONGLONG hostPage
Definition: BlackBoneDef.h:333
ULONG initRVA
Definition: BlackBoneDef.h:405
struct _INJECT_DLL * PINJECT_DLL
ULONG pid
Definition: BlackBoneDef.h:368
struct _HIDE_VAD * PHIDE_VAD
struct _HIDE_VAD HIDE_VAD
Input for IOCTL_BLACKBONE_HIDE_VAD
ULONGLONG newPtr
Definition: BlackBoneDef.h:357
struct _MAP_MEMORY * PMAP_MEMORY
struct _MAP_MEMORY_RESULT MAP_MEMORY_RESULT
Output for IOCTL_BLACKBONE_REMAP_REGION
ULONGLONG originalPtr
Definition: BlackBoneDef.h:356
Input for IOCTL_BLACKBONE_HIDE_VAD
Definition: BlackBoneDef.h:385
ULONGLONG localbuf
Definition: BlackBoneDef.h:265
wchar_t initArg[512]
Definition: BlackBoneDef.h:404
ULONGLONG size
Definition: BlackBoneDef.h:292
ULONG removedSize
Definition: BlackBoneDef.h:360
Definition: BlackBoneDef.h:395
ULONG pid
Definition: BlackBoneDef.h:406
struct _PROTECT_MEMORY * PPROTECT_MEMORY
Input for IOCTL_BLACKBONE_REMAP_REGION
Definition: BlackBoneDef.h:344
ULONGLONG targetPage
Definition: BlackBoneDef.h:332
struct _COPY_MEMORY COPY_MEMORY
Input for IOCTL_BLACKBONE_COPY_MEMORY
struct _ALLOCATE_FREE_MEMORY_RESULT * PALLOCATE_FREE_MEMORY_RESULT
ULONG size
Definition: BlackBoneDef.h:323
BOOLEAN mapSections
Definition: BlackBoneDef.h:313
struct _INJECT_DLL INJECT_DLL
Input for IOCTL_BLACKBONE_INJECT_DLL
ULONGLONG address
Definition: BlackBoneDef.h:291
struct _MMAP_DRIVER * PMMAP_DRIVER
struct _MAP_MEMORY_RESULT * PMAP_MEMORY_RESULT
ULONG count
Definition: BlackBoneDef.h:335
ULONG pid
Definition: BlackBoneDef.h:377
struct _MAP_MEMORY_REGION_RESULT MAP_MEMORY_REGION_RESULT
Output for IOCTL_BLACKBONE_REMAP_REGION
_InjectType
Definition: BlackBoneDef.h:392
struct _HANDLE_GRANT_ACCESS * PHANDLE_GRANT_ACCESS
struct _UNMAP_MEMORY * PUNMAP_MEMORY
ULONG size
Definition: BlackBoneDef.h:378
Input for IOCTL_BLACKBONE_COPY_MEMORY
Definition: BlackBoneDef.h:263
ULONG access
Definition: BlackBoneDef.h:257
Input for IOCTL_BLACKBONE_GRANT_ACCESS
Definition: BlackBoneDef.h:253
ULONG pid
Definition: BlackBoneDef.h:268
Input for IOCTL_BLACKBONE_UNMAP_MEMORY
Definition: BlackBoneDef.h:366
wchar_t FullPath[512]
Definition: BlackBoneDef.h:416
BOOLEAN allocate
Definition: BlackBoneDef.h:282
struct _ALLOCATE_FREE_MEMORY_RESULT ALLOCATE_FREE_MEMORY_RESULT
Output for IOCTL_BLACKBONE_ALLOCATE_FREE_MEMORY
ULONGLONG size
Definition: BlackBoneDef.h:267
BOOLEAN write
Definition: BlackBoneDef.h:269
Input for IOCTL_BLACKBONE_PROTECT_MEMORY
Definition: BlackBoneDef.h:298
ULONG size
Definition: BlackBoneDef.h:348
Output for IOCTL_BLACKBONE_ALLOCATE_FREE_MEMORY
Definition: BlackBoneDef.h:289
struct _HANDLE_GRANT_ACCESS HANDLE_GRANT_ACCESS
Input for IOCTL_BLACKBONE_GRANT_ACCESS
Definition: BlackBoneDef.h:394
struct _UNMAP_MEMORY UNMAP_MEMORY
Input for IOCTL_BLACKBONE_UNMAP_MEMORY
ULONG size
Definition: BlackBoneDef.h:359
ULONG pid
Definition: BlackBoneDef.h:347
wchar_t pipeName[32]
Definition: BlackBoneDef.h:312
ULONGLONG removedPtr
Definition: BlackBoneDef.h:358
ULONGLONG base
Definition: BlackBoneDef.h:300
BOOLEAN wait
Definition: BlackBoneDef.h:407
ULONGLONG size
Definition: BlackBoneDef.h:301
Output for IOCTL_BLACKBONE_REMAP_REGION
Definition: BlackBoneDef.h:354
wchar_t FullDllPath[512]
Definition: BlackBoneDef.h:403
struct _PROTECT_MEMORY PROTECT_MEMORY
Input for IOCTL_BLACKBONE_PROTECT_MEMORY
struct _MAP_MEMORY_RESULT_ENTRY * PMAP_MEMORY_RESULT_ENTRY
ULONGLONG size
Definition: BlackBoneDef.h:278
ULONGLONG originalPtr
Definition: BlackBoneDef.h:321
ULONG newProtection
Definition: BlackBoneDef.h:303
BOOLEAN physical
Definition: BlackBoneDef.h:283
Input for IOCTL_BLACKBONE_REMAP_MEMORY
Definition: BlackBoneDef.h:309
ULONGLONG targetPtr
Definition: BlackBoneDef.h:266
MAP_MEMORY_RESULT_ENTRY entries[1]
Definition: BlackBoneDef.h:338
ULONG pid
Definition: BlackBoneDef.h:302
struct _COPY_MEMORY * PCOPY_MEMORY
ULONGLONG size
Definition: BlackBoneDef.h:388
ULONGLONG base
Definition: BlackBoneDef.h:376
Input for IOCTL_BLACKBONE_ALLOCATE_FREE_MEMORY
Definition: BlackBoneDef.h:275
struct _UNMAP_MEMORY_REGION UNMAP_MEMORY_REGION
Input for IOCTL_BLACKBONE_UNMAP_REGION
ULONGLONG handle
Definition: BlackBoneDef.h:255
struct _DISABLE_DEP * PDISABLE_DEP
Input for IOCTL_BLACKBONE_DISABLE_DEP
Definition: BlackBoneDef.h:236
struct _MAP_MEMORY_REGION_RESULT * PMAP_MEMORY_REGION_RESULT
struct _MAP_MEMORY MAP_MEMORY
Input for IOCTL_BLACKBONE_REMAP_MEMORY
Output for IOCTL_BLACKBONE_REMAP_REGION
Definition: BlackBoneDef.h:329
ULONGLONG base
Definition: BlackBoneDef.h:387
ULONG pid
Definition: BlackBoneDef.h:246
struct _UNMAP_MEMORY_REGION * PUNMAP_MEMORY_REGION
struct _ALLOCATE_FREE_MEMORY ALLOCATE_FREE_MEMORY
Input for IOCTL_BLACKBONE_ALLOCATE_FREE_MEMORY
Input for IOCTL_BLACKBONE_SET_PROTECTION
Definition: BlackBoneDef.h:244
Input for IOCTL_BLACKBONE_UNMAP_REGION
Definition: BlackBoneDef.h:374
ULONGLONG base
Definition: BlackBoneDef.h:346
ULONG pid
Definition: BlackBoneDef.h:311
struct _SET_PROC_PROTECTION * PSET_PROC_PROTECTION
ULONG pid
Definition: BlackBoneDef.h:256
ULONG protection
Definition: BlackBoneDef.h:280
InjectType type
Definition: BlackBoneDef.h:408
ULONG pid
Definition: BlackBoneDef.h:279
struct _SET_PROC_PROTECTION SET_PROC_PROTECTION
Input for IOCTL_BLACKBONE_SET_PROTECTION
ULONG pid
Definition: BlackBoneDef.h:389
ULONG pid
Definition: BlackBoneDef.h:238
Input for IOCTL_BLACKBONE_MAP_DRIVER
Definition: BlackBoneDef.h:414
struct _ALLOCATE_FREE_MEMORY * PALLOCATE_FREE_MEMORY
struct _MMAP_DRIVER MMAP_DRIVER
Input for IOCTL_BLACKBONE_MAP_DRIVER
struct _MAP_MEMORY_REGION MAP_MEMORY_REGION
Input for IOCTL_BLACKBONE_REMAP_REGION
Input for IOCTL_BLACKBONE_INJECT_DLL
Definition: BlackBoneDef.h:401
BOOLEAN enableState
Definition: BlackBoneDef.h:247
struct _MAP_MEMORY_RESULT_ENTRY MAP_MEMORY_RESULT_ENTRY
Remapped region info
struct _MAP_MEMORY_REGION * PMAP_MEMORY_REGION
struct _DISABLE_DEP DISABLE_DEP
Input for IOCTL_BLACKBONE_DISABLE_DEP
enum _InjectType InjectType
ULONGLONG base
Definition: BlackBoneDef.h:277
Remapped region info
Definition: BlackBoneDef.h:319
ULONG type
Definition: BlackBoneDef.h:281