BlackBone
Windows memory hacking library
|
Functions | |
NTSTATUS | BBMapWorker (IN PVOID pArg) |
System worker thread that performs actual mapping More... | |
NTSTATUS | BBInitLdrData (IN PKLDR_DATA_TABLE_ENTRY pThisModule) |
Initialize loader stuff More... | |
PKLDR_DATA_TABLE_ENTRY | BBGetSystemModule (IN PUNICODE_STRING pName, IN PVOID pAddress) |
Get address of a system module Either 'pName' or 'pAddress' is required to perform search More... | |
PVOID | BBGetUserModuleBase (IN PEPROCESS pProcess, IN PUNICODE_STRING ModuleName, IN BOOLEAN isWow64) |
Get module base address by name More... | |
PVOID | BBGetModuleExport (IN PVOID pBase, IN PCCHAR name_ord) |
Get exported function address More... | |
NTSTATUS | BBResolveReferences (IN PVOID pImageBase) |
Resolve module references and fill the IAT More... | |
NTSTATUS | BBMMapDriver (IN PUNICODE_STRING pPath) |
Manually map driver into system space More... | |
Variables | |
PLIST_ENTRY | PsLoadedModuleList |
DYNAMIC_DATA | dynData |
PVOID BBGetModuleExport | ( | IN PVOID | pBase, |
IN PCCHAR | name_ord | ||
) |
Get exported function address
pBase | Module base |
name_ord | Function name or ordinal |
PKLDR_DATA_TABLE_ENTRY BBGetSystemModule | ( | IN PUNICODE_STRING | pName, |
IN PVOID | pAddress | ||
) |
Get address of a system module Either 'pName' or 'pAddress' is required to perform search
pName | Base name of the image (e.g. hal.dll) |
pAddress | Address inside module |
PVOID BBGetUserModuleBase | ( | IN PEPROCESS | pProcess, |
IN PUNICODE_STRING | ModuleName, | ||
IN BOOLEAN | isWow64 | ||
) |
Get module base address by name
pProcess | Target process |
ModuleName | Nodule name to search for |
isWow64 | If TRUE - search in 32-bit PEB |
NTSTATUS BBInitLdrData | ( | IN PKLDR_DATA_TABLE_ENTRY | pThisModule | ) |
Initialize loader stuff
pThisModule | Any valid system module |
NTSTATUS BBMapWorker | ( | IN PVOID | pArg | ) |
System worker thread that performs actual mapping
pArg | Path to the driver - PUNICODE_STRING type |
NTSTATUS BBMMapDriver | ( | IN PUNICODE_STRING | pPath | ) |
Manually map driver into system space
pPath | Fully qualified native path to the driver |
NTSTATUS BBResolveReferences | ( | IN PVOID | pImageBase | ) |
Resolve module references and fill the IAT
pImageBase | Image base to be processed |
DYNAMIC_DATA dynData |
PLIST_ENTRY PsLoadedModuleList |