Loader.c File Reference

#include "Private.h"
#include "Loader.h"
#include <Ntstrsafe.h>

Functions
NTSTATUS	BBMapWorker (IN PVOID pArg)
	System worker thread that performs actual mapping More...
NTSTATUS	BBInitLdrData (IN PKLDR_DATA_TABLE_ENTRY pThisModule)
	Initialize loader stuff More...
PKLDR_DATA_TABLE_ENTRY	BBGetSystemModule (IN PUNICODE_STRING pName, IN PVOID pAddress)
	Get address of a system module Either 'pName' or 'pAddress' is required to perform search More...
PVOID	BBGetUserModuleBase (IN PEPROCESS pProcess, IN PUNICODE_STRING ModuleName, IN BOOLEAN isWow64)
	Get module base address by name More...
PVOID	BBGetModuleExport (IN PVOID pBase, IN PCCHAR name_ord)
	Get exported function address More...
NTSTATUS	BBResolveReferences (IN PVOID pImageBase)
	Resolve module references and fill the IAT More...
NTSTATUS	BBMMapDriver (IN PUNICODE_STRING pPath)
	Manually map driver into system space More...

Variables
PLIST_ENTRY	PsLoadedModuleList
DYNAMIC_DATA	dynData

Function Documentation

PVOID BBGetModuleExport	(	IN PVOID	pBase,
		IN PCCHAR	name_ord
	)

Get exported function address

Parameters

pBase	Module base
name_ord	Function name or ordinal

Returns

Found address, NULL if not found

PKLDR_DATA_TABLE_ENTRY BBGetSystemModule	(	IN PUNICODE_STRING	pName,
		IN PVOID	pAddress
	)

Get address of a system module Either 'pName' or 'pAddress' is required to perform search

Parameters

pName	Base name of the image (e.g. hal.dll)
pAddress	Address inside module

Returns

Found loader entry. NULL if nothing found

PVOID BBGetUserModuleBase	(	IN PEPROCESS	pProcess,
		IN PUNICODE_STRING	ModuleName,
		IN BOOLEAN	isWow64
	)

Get module base address by name

Parameters

pProcess	Target process
ModuleName	Nodule name to search for
isWow64	If TRUE - search in 32-bit PEB

Returns

Found address, NULL if not found

NTSTATUS BBInitLdrData

(

IN PKLDR_DATA_TABLE_ENTRY

pThisModule

)

Initialize loader stuff

Parameters

pThisModule

Any valid system module

Returns

Status code

NTSTATUS BBMapWorker

(

IN PVOID

pArg

)

System worker thread that performs actual mapping

Parameters

pArg	Path to the driver - PUNICODE_STRING type

Returns

Status code

NTSTATUS BBMMapDriver

(

IN PUNICODE_STRING

pPath

)

Manually map driver into system space

Parameters

pPath

Fully qualified native path to the driver

Returns

Status code

NTSTATUS BBResolveReferences

(

IN PVOID

pImageBase

)

Resolve module references and fill the IAT

Parameters

pImageBase

Image base to be processed

Returns

Status code

Variable Documentation

DYNAMIC_DATA dynData

PLIST_ENTRY PsLoadedModuleList