BlackBone
Windows memory hacking library
|
Macros | |
#define | CODE_OFFSET 0x000 |
#define | STRING_OFFSET 0x200 |
#define | MOD_OFFSET 0x1F0 |
#define | COMPLETE_OFFSET 0x1E0 |
#define | CALL_COMPLETE 0xC0371E7E |
Functions | |
PVOID | BBGetWow64Code (IN PVOID LdrLoadDll, IN PUNICODE_STRING pPath) |
Build injection code for wow64 process Must be running in target process context More... | |
PVOID | BBGetNativeCode (IN PVOID LdrLoadDll, IN PUNICODE_STRING pPath) |
Build injection code for native x64 process Must be running in target process context More... | |
NTSTATUS | BBApcInject (IN PVOID pUserBuf, IN HANDLE pid, IN ULONG initRVA, IN PCWCHAR InitArg) |
Inject dll using APC Must be running in target process context More... | |
NTSTATUS | BBLookupProcessThread (IN HANDLE pid, OUT PETHREAD *ppThread) |
Find first thread of the target process More... | |
VOID | KernelApcPrepareCallback (PKAPC, PKNORMAL_ROUTINE *, PVOID *, PVOID *, PVOID *) |
VOID | KernelApcInjectCallback (PKAPC, PKNORMAL_ROUTINE *, PVOID *, PVOID *, PVOID *) |
VOID | ApcWaitThread (IN PVOID pUserBuf) |
NTSTATUS | BBInjectDll (IN PINJECT_DLL pData) |
Inject dll into process More... | |
NTSTATUS | BBExecuteInNewThread (IN PVOID pBaseAddress, IN PVOID pParam, IN ULONG flags, IN BOOLEAN wait, OUT PNTSTATUS pExitStatus) |
Create new thread in the target process Must be running in target process context More... | |
NTSTATUS | BBQueueUserApc (IN PETHREAD pThread, IN PVOID pUserFunc, IN PVOID Arg1) |
Send user-mode APC to the target thread More... | |
Variables | |
DYNAMIC_DATA | dynData |
#define CALL_COMPLETE 0xC0371E7E |
#define CODE_OFFSET 0x000 |
#define COMPLETE_OFFSET 0x1E0 |
#define MOD_OFFSET 0x1F0 |
#define STRING_OFFSET 0x200 |
VOID ApcWaitThread | ( | IN PVOID | pUserBuf | ) |
NTSTATUS BBApcInject | ( | IN PVOID | pUserBuf, |
IN HANDLE | pid, | ||
IN ULONG | initRVA, | ||
IN PCWCHAR | InitArg | ||
) |
Inject dll using APC Must be running in target process context
pUserBuf | Injcetion code |
pid | Target process ID |
initRVA | Init routine RVA |
InitArg | Init routine argument |
NTSTATUS BBExecuteInNewThread | ( | IN PVOID | pBaseAddress, |
IN PVOID | pParam, | ||
IN ULONG | flags, | ||
IN BOOLEAN | wait, | ||
OUT PNTSTATUS | pExitStatus | ||
) |
Create new thread in the target process Must be running in target process context
Create new thread in the target process
pBaseAddress | Thread start address |
pParam | Thread argument |
flags | Thread creation flags |
wait | If set to TRUE - wait for thread completion |
pExitStatus | Thread exit status |
PVOID BBGetNativeCode | ( | IN PVOID | LdrLoadDll, |
IN PUNICODE_STRING | pPath | ||
) |
Build injection code for native x64 process Must be running in target process context
LdrLoadDll | LdrLoadDll address |
pPath | Path to the dll |
PVOID BBGetWow64Code | ( | IN PVOID | LdrLoadDll, |
IN PUNICODE_STRING | pPath | ||
) |
Build injection code for wow64 process Must be running in target process context
LdrLoadDll | LdrLoadDll address |
pPath | Path to the dll |
NTSTATUS BBInjectDll | ( | IN PINJECT_DLL | pData | ) |
Inject dll into process
pid | Target PID |
pPath | TFull-qualified dll path |
NTSTATUS BBLookupProcessThread | ( | IN HANDLE | pid, |
OUT PETHREAD * | ppThread | ||
) |
Find first thread of the target process
pid | Target PID. |
ppThread | Found thread. Thread object reference count is increased by 1 |
NTSTATUS BBQueueUserApc | ( | IN PETHREAD | pThread, |
IN PVOID | pUserFunc, | ||
IN PVOID | Arg1 | ||
) |
Send user-mode APC to the target thread
pThread | Target thread |
pUserFunc | APC function |
Arg1 | Argument 1 |
VOID KernelApcInjectCallback | ( | PKAPC | Apc, |
PKNORMAL_ROUTINE * | NormalRoutine, | ||
PVOID * | NormalContext, | ||
PVOID * | SystemArgument1, | ||
PVOID * | SystemArgument2 | ||
) |
VOID KernelApcPrepareCallback | ( | PKAPC | Apc, |
PKNORMAL_ROUTINE * | NormalRoutine, | ||
PVOID * | NormalContext, | ||
PVOID * | SystemArgument1, | ||
PVOID * | SystemArgument2 | ||
) |
DYNAMIC_DATA dynData |