BlackBone
Windows memory hacking library
|
Functions | |
PHANDLE_TABLE_ENTRY | ExpLookupHandleTableEntry (IN PHANDLE_TABLE HandleTable, IN EXHANDLE tHandle) |
Lookup handle in the process handle table More... | |
PVOID | GetKernelBase () |
Get ntoskrnl base address More... | |
PVOID | GetSSDTBase () |
Gets SSDT base - KiServiceTable More... | |
PVOID | GetSSDTEntry (IN ULONG index) |
Gets the SSDT entry address by index. More... | |
PMMPTE | GetPTEForVA (IN PVOID pAddress) |
Get page hardware PTE Address must be valid, otherwise bug check is imminent More... | |
NTSTATUS NTAPI | ZwCreateThreadEx (OUT PHANDLE hThread, IN ACCESS_MASK DesiredAccess, IN PVOID ObjectAttributes, IN HANDLE ProcessHandle, IN PVOID lpStartAddress, IN PVOID lpParameter, IN ULONG Flags, IN SIZE_T StackZeroBits, IN SIZE_T SizeOfStackCommit, IN SIZE_T SizeOfStackReserve, IN PNT_PROC_THREAD_ATTRIBUTE_LIST AttributeList) |
Variables | |
DYNAMIC_DATA | dynData |
PVOID | g_KernelBase = NULL |
PVOID | g_SSDT = NULL |
MMPTE | ValidKernelPte |
PHANDLE_TABLE_ENTRY ExpLookupHandleTableEntry | ( | IN PHANDLE_TABLE | HandleTable, |
IN EXHANDLE | tHandle | ||
) |
Lookup handle in the process handle table
HandleTable | Handle table |
tHandle | Handle to search for |
PVOID GetKernelBase | ( | ) |
Get ntoskrnl base address
PMMPTE GetPTEForVA | ( | IN PVOID | pAddress | ) |
Get page hardware PTE Address must be valid, otherwise bug check is imminent
pAddress | Target address |
PVOID GetSSDTBase | ( | ) |
Gets SSDT base - KiServiceTable
Gets SSDT base - KiSystemServiceTable
PVOID GetSSDTEntry | ( | IN ULONG | index | ) |
Gets the SSDT entry address by index.
index | Service index |
NTSTATUS NTAPI ZwCreateThreadEx | ( | OUT PHANDLE | hThread, |
IN ACCESS_MASK | DesiredAccess, | ||
IN PVOID | ObjectAttributes, | ||
IN HANDLE | ProcessHandle, | ||
IN PVOID | lpStartAddress, | ||
IN PVOID | lpParameter, | ||
IN ULONG | Flags, | ||
IN SIZE_T | StackZeroBits, | ||
IN SIZE_T | SizeOfStackCommit, | ||
IN SIZE_T | SizeOfStackReserve, | ||
IN PNT_PROC_THREAD_ATTRIBUTE_LIST | AttributeList | ||
) |
DYNAMIC_DATA dynData |
PVOID g_KernelBase = NULL |
PVOID g_SSDT = NULL |
MMPTE ValidKernelPte |