BlackBoneDef.h

Go to the documentation of this file.

#pragma once

#define BLACKBONE_DEVICE_NAME           L"BlackBone"
#define BLACKBONE_DEVICE_FILE           L"\\\\.\\" ## BLACKBONE_DEVICE_NAME

#define FILE_DEVICE_BLACKBONE           0x00008005

/*
    Disable process DEP

    Input:
        DISABLE_DEP

    Input size: 
        sizeof(DISABLE_DEP)

    Output:
        void

    Output size:
        0
*/
#define IOCTL_BLACKBONE_DISABLE_DEP  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x800, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Change process protection state

    Input:
       SET_PROC_PROTECTION

    Input size: 
        sizeof(SET_PROC_PROTECTION)

    Output:
        void

    Output size:
        0
*/
#define IOCTL_BLACKBONE_SET_PROTECTION  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x801, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Change handle access rights

    Input:
       GRANT_ACCESS

    Input size: 
        sizeof(GRANT_ACCESS)

    Output:
        void

    Output size:
        0
*/
#define IOCTL_BLACKBONE_GRANT_ACCESS   (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x802, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Read or write virtual memory of target process

    Input:
       COPY_MEMORY

    Input size: 
        sizeof(COPY_MEMORY)

    Output:
        void

    Output size:
        0
*/
#define IOCTL_BLACKBONE_COPY_MEMORY  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x803, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Allocate or free memory

    Input:
       ALLOCATE_FREE_MEMORY

    Input size: 
        sizeof(ALLOCATE_FREE_MEMORY)

    Output:
        ALLOCATE_FREE_MEMORY_RESULT

    Output size:
        sizeof(ALLOCATE_FREE_MEMORY_RESULT)
*/
#define IOCTL_BLACKBONE_ALLOCATE_FREE_MEMORY  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x804, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Change protection of memory region

    Input:
       PROTECT_MEMORY

    Input size: 
        sizeof(PROTECT_MEMORY)

    Output:
        void

    Output size:
        0
*/
#define IOCTL_BLACKBONE_PROTECT_MEMORY  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x805, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Map entire address space of target process into calling process

    Input:
       MAP_MEMORY

    Input size: 
        sizeof(MAP_MEMORY)

    Output:
        ULONG sizeRequired - if output buffer isn't large enough to hold output data
        MAP_MEMORY_REGION_RESULT result - if buffer is large enough to hold output data

    Output size:
        sizeof(ULONG) - if output buffer isn't large enough to hold output data
        >= sizeof(MAP_MEMORY_REGION_RESULT) - if buffer is large enough to hold output data
*/
#define IOCTL_BLACKBONE_MAP_MEMORY  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x806, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Map single memory region into calling process

    Input:
       MAP_MEMORY_REGION

    Input size: 
        sizeof(MAP_MEMORY_REGION)

    Output:
        MAP_MEMORY_REGION_RESULT

    Output size:
        sizeof(MAP_MEMORY_REGION_RESULT) 
*/
#define IOCTL_BLACKBONE_MAP_REGION  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x807, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Unmap all mapped memory from calling process

    Input:
       UNMAP_MEMORY

    Input size: 
        sizeof(UNMAP_MEMORY)

    Output:
        void

    Output size:
        0
*/
#define IOCTL_BLACKBONE_UNMAP_MEMORY  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x808, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Unmap single memory region from calling process

    Input:
       UNMAP_MEMORY_REGION

    Input size: 
        sizeof(UNMAP_MEMORY_REGION)

    Output:
        UNMAP_MEMORY_REGION_RESULT

    Output size:
        sizeof(UNMAP_MEMORY_REGION_RESULT)
*/
#define IOCTL_BLACKBONE_UNMAP_REGION  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x809, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Unlink target VAD from process VAD tree

    Input:
       HIDE_VAD

    Input size: 
        sizeof(HIDE_VAD)

    Output:
        NULL

    Output size:
        0
*/
#define IOCTL_BLACKBONE_HIDE_VAD  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x80A, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)

/*
    Inject dll into arbitrary process

    Input:
       INJECT_DLL

    Input size: 
        sizeof(INJECT_DLL)

    Output:
        NULL

    Output size:
        0
*/
#define IOCTL_BLACKBONE_INJECT_DLL  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x80B, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)


/*
    Manually map system driver

    Input:
       MMAP_DRIVER

    Input size: 
        sizeof(MMAP_DRIVER)

    Output:
        NULL

    Output size:
        0
*/
#define IOCTL_BLACKBONE_MAP_DRIVER  (ULONG)CTL_CODE(FILE_DEVICE_BLACKBONE, 0x80C, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)


typedef struct _DISABLE_DEP
{
    ULONG   pid;            // Process ID
} DISABLE_DEP, *PDISABLE_DEP;

typedef struct _SET_PROC_PROTECTION
{
    ULONG   pid;            // Process ID
    BOOLEAN enableState;    // TRUE to enable, FALSE to disable
} SET_PROC_PROTECTION, *PSET_PROC_PROTECTION;

typedef struct _HANDLE_GRANT_ACCESS
{
    ULONGLONG  handle;      // Handle to modify
    ULONG      pid;         // Process ID
    ULONG      access;      // Access flags to grant
} HANDLE_GRANT_ACCESS, *PHANDLE_GRANT_ACCESS;

typedef struct _COPY_MEMORY
{
    ULONGLONG localbuf;         // Buffer address
    ULONGLONG targetPtr;        // Target address
    ULONGLONG size;             // Buffer size
    ULONG     pid;              // Target process id
    BOOLEAN   write;            // TRUE if write operation, FALSE if read
} COPY_MEMORY, *PCOPY_MEMORY;

typedef struct _ALLOCATE_FREE_MEMORY
{
    ULONGLONG base;             // Region base address
    ULONGLONG size;             // Region size
    ULONG     pid;              // Target process id
    ULONG     protection;       // Memory protection for allocation
    ULONG     type;             // MEM_RESERVE/MEM_COMMIT/MEM_DECOMMIT/MEM_RELEASE
    BOOLEAN   allocate;         // TRUE if allocation, FALSE is freeing
    BOOLEAN   physical;         // If set to TRUE, physical pages will be directly mapped into UM space
} ALLOCATE_FREE_MEMORY, *PALLOCATE_FREE_MEMORY;

typedef struct _ALLOCATE_FREE_MEMORY_RESULT
{
    ULONGLONG address;          // Address of allocation
    ULONGLONG size;             // Allocated size
} ALLOCATE_FREE_MEMORY_RESULT, *PALLOCATE_FREE_MEMORY_RESULT;

typedef struct _PROTECT_MEMORY
{
    ULONGLONG base;             // Region base address
    ULONGLONG size;             // Region size
    ULONG     pid;              // Target process id
    ULONG     newProtection;    // New protection value
} PROTECT_MEMORY, *PPROTECT_MEMORY;

typedef struct _MAP_MEMORY
{
    ULONG   pid;                // Target process id
    wchar_t pipeName[32];       // Hook pipe name
    BOOLEAN mapSections;        // Set to TRUE to map sections
} MAP_MEMORY, *PMAP_MEMORY;

typedef struct _MAP_MEMORY_RESULT_ENTRY
{
    ULONGLONG originalPtr;      // Address in target process
    ULONGLONG newPtr;           // Mapped address in host process
    ULONG size;                 // Region size
} MAP_MEMORY_RESULT_ENTRY, *PMAP_MEMORY_RESULT_ENTRY;

typedef struct _MAP_MEMORY_RESULT
{
    ULONGLONG pipeHandle;       // Pipe handle in target process
    ULONGLONG targetPage;       // Address of shared page in target process
    ULONGLONG hostPage;         // Address of shared page in host process

    ULONG count;                // Number of REMAP_MEMORY_RESULT_ENTRY entries

    // List of remapped regions (variable-sized array)
    MAP_MEMORY_RESULT_ENTRY entries[1];
} MAP_MEMORY_RESULT, *PMAP_MEMORY_RESULT;

typedef struct _MAP_MEMORY_REGION
{
    ULONGLONG base;             // Region base address
    ULONG     pid;              // Target process id
    ULONG     size;             // Region size
} MAP_MEMORY_REGION, *PMAP_MEMORY_REGION;

typedef struct _MAP_MEMORY_REGION_RESULT
{
    ULONGLONG originalPtr;      // Address in target process
    ULONGLONG newPtr;           // Mapped address in host process
    ULONGLONG removedPtr;       // Unmapped region base, in case of conflicting region
    ULONG     size;             // Mapped region size
    ULONG     removedSize;      // Unmapped region size
} MAP_MEMORY_REGION_RESULT, *PMAP_MEMORY_REGION_RESULT;

typedef struct _UNMAP_MEMORY
{
    ULONG     pid;              // Target process ID
} UNMAP_MEMORY, *PUNMAP_MEMORY;

typedef struct _UNMAP_MEMORY_REGION
{
    ULONGLONG base;             // Region base address
    ULONG     pid;              // Target process ID
    ULONG     size;             // Region size
} UNMAP_MEMORY_REGION, *PUNMAP_MEMORY_REGION;


typedef struct _HIDE_VAD
{
    ULONGLONG base;             // Region base address
    ULONGLONG size;             // Region size
    ULONG pid;                  // Target process ID
} HIDE_VAD, *PHIDE_VAD;

typedef enum _InjectType
{
    IT_Thread,      // CreateThread into LdrLoadDll
    IT_Apc,         // Force user APC into LdrLoadDll
} InjectType;

typedef struct _INJECT_DLL
{
    wchar_t    FullDllPath[512];    // Fully-qualified path to the target dll
    wchar_t    initArg[512];        // Init routine argument
    ULONG      initRVA;             // Init routine RVA, if 0 - no init routine
    ULONG      pid;                 // Target process ID
    BOOLEAN    wait;                // Wait on injection thread
    InjectType type;                // Type of injection
} INJECT_DLL, *PINJECT_DLL;

typedef struct _MMAP_DRIVER
{
    wchar_t    FullPath[512];    // Fully-qualified path to the driver
} MMAP_DRIVER, *PMMAP_DRIVER;