6 #define DPRINT(format, ...) DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, format, __VA_ARGS__)
11 #define BB_POOL_TAG 'enoB'
14 #define ObpAccessProtectCloseBit 0x2000000
19 #define MM_ZERO_ACCESS 0
22 #define MM_EXECUTE_READ 3
23 #define MM_READWRITE 4
24 #define MM_WRITECOPY 5
25 #define MM_EXECUTE_READWRITE 6
26 #define MM_EXECUTE_WRITECOPY 7
28 #define MM_PTE_VALID_MASK 0x1
29 #define MM_PTE_WRITE_MASK 0x800
30 #define MM_PTE_OWNER_MASK 0x4
31 #define MM_PTE_WRITE_THROUGH_MASK 0x8
32 #define MM_PTE_CACHE_DISABLE_MASK 0x10
33 #define MM_PTE_ACCESS_MASK 0x20
34 #define MM_PTE_DIRTY_MASK 0x42
35 #define MM_PTE_LARGE_PAGE_MASK 0x80
36 #define MM_PTE_GLOBAL_MASK 0x100
37 #define MM_PTE_COPY_ON_WRITE_MASK 0x200
38 #define MM_PTE_PROTOTYPE_MASK 0x400
39 #define MM_PTE_TRANSITION_MASK 0x800
41 #define VIRTUAL_ADDRESS_BITS 48
42 #define VIRTUAL_ADDRESS_MASK ((((ULONG_PTR)1) << VIRTUAL_ADDRESS_BITS) - 1)
44 #define THREAD_CREATE_FLAGS_CREATE_SUSPENDED 0x00000001
45 #define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH 0x00000002
46 #define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER 0x00000004
49 #define ObpDecodeGrantedAccess( Access ) \
50 ((Access)& ~ObpAccessProtectCloseBit)
52 #define ObpDecodeObject( Object ) (PVOID)(((LONG_PTR)Object >> 0x10) & ~(ULONG_PTR)0xF)
54 #define MiGetPxeOffset(va) \
55 ((ULONG)(((ULONG_PTR)(va) >> PXI_SHIFT) & PXI_MASK))
57 #define MiGetPxeAddress(va) \
58 ((PMMPTE)PXE_BASE + MiGetPxeOffset(va))
60 #define MiGetPpeAddress(va) \
61 ((PMMPTE)(((((ULONG_PTR)(va) & VIRTUAL_ADDRESS_MASK) >> PPI_SHIFT) << PTE_SHIFT) + PPE_BASE))
63 #define MiGetPdeAddress(va) \
64 ((PMMPTE)(((((ULONG_PTR)(va) & VIRTUAL_ADDRESS_MASK) >> PDI_SHIFT) << PTE_SHIFT) + PDE_BASE))
66 #define MiGetPteAddress(va) \
67 ((PMMPTE)(((((ULONG_PTR)(va) & VIRTUAL_ADDRESS_MASK) >> PTI_SHIFT) << PTE_SHIFT) + PTE_BASE))
69 #define VA_SHIFT (63 - 47) // address sign extend shift count
71 #define MiGetVirtualAddressMappedByPte(PTE) \
72 ((PVOID)((LONG_PTR)(((LONG_PTR)(PTE) - PTE_BASE) << (PAGE_SHIFT + VA_SHIFT - PTE_SHIFT)) >> VA_SHIFT))
74 #define MI_IS_PHYSICAL_ADDRESS(Va) \
75 ((MiGetPxeAddress(Va)->u.Hard.Valid == 1) && \
76 (MiGetPpeAddress(Va)->u.Hard.Valid == 1) && \
77 ((MiGetPdeAddress(Va)->u.Long & 0x81) == 0x81) || (MiGetPteAddress(Va)->u.Hard.Valid == 1))
112 typedef NTSTATUS( NTAPI* fnNtCreateThreadEx )
129 #if defined(_WIN8_) || defined (_WIN7_)
131 typedef NTSTATUS( NTAPI* fnNtProtectVirtualMemory )
134 IN PVOID* BaseAddress,
135 IN SIZE_T* NumberOfBytesToProtect,
136 IN ULONG NewAccessProtection,
137 OUT PULONG OldAccessProtection
144 IN PVOID* BaseAddress,
145 IN SIZE_T* NumberOfBytesToProtect,
146 IN ULONG NewAccessProtection,
147 OUT PULONG OldAccessProtection
157 IN PVOID* BaseAddress,
158 IN SIZE_T* NumberOfBytesToProtect,
159 IN ULONG NewAccessProtection,
160 OUT PULONG OldAccessProtection
Definition: NativeStructs.h:44
PLIST_ENTRY PsLoadedModuleList
Definition: Loader.c:7
OS-dependent stuff
Definition: Private.h:96
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG IN SIZE_T IN SIZE_T IN SIZE_T OUT PVOID lpBytesBuffer
Definition: Private.h:115
Definition: NativeStructs.h:58
ULONG Protection
Definition: Private.h:101
MMPTE ValidKernelPte
Definition: Private.c:15
Definition: NativeStructs.h:100
ULONG PrevMode
Definition: Private.h:106
PVOID GetSSDTBase()
Gets SSDT base - KiSystemServiceTable
Definition: Private.c:123
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG IN SIZE_T StackZeroBits
Definition: Private.h:115
typedef NTSTATUS(NTAPI *fnNtCreateThreadEx)(OUT PHANDLE hThread
ULONG NtProtectIndex
Definition: Private.h:104
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID lpParameter
Definition: Private.h:115
PHANDLE_TABLE_ENTRY ExpLookupHandleTableEntry(IN PHANDLE_TABLE HandleTable, IN EXHANDLE tHandle)
Lookup handle in the process handle table
Definition: Private.c:28
NTSYSAPI NTSTATUS NTAPI ZwProtectVirtualMemory(IN HANDLE ProcessHandle, IN PVOID *BaseAddress, IN SIZE_T *NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection)
ULONG ExitStatus
Definition: Private.h:107
ULONG NtThdIndex
Definition: Private.h:105
struct _DYNAMIC_DATA * PDYNAMIC_DATA
typedef PFN_NUMBER(NTAPI *fnMiAllocateDriverPage)(PMMPTE pPTE)
_WinVer
Definition: Private.h:82
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG IN SIZE_T IN SIZE_T IN SIZE_T SizeOfStackReserve
Definition: Private.h:115
PULONG PWIN32_PROTECTION_MASK
Definition: Private.h:80
IN ACCESS_MASK IN PVOID IN HANDLE ProcessHandle
Definition: Private.h:115
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID lpStartAddress
Definition: Private.h:115
Definition: NativeStructs81.h:24
ULONG VadRoot
Definition: Private.h:103
Definition: NativeStructs.h:281
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG Flags
Definition: Private.h:115
ULONG WIN32_PROTECTION_MASK
Definition: Private.h:79
ULONG MiAllocPage
Definition: Private.h:108
IN ACCESS_MASK IN PVOID ObjectAttributes
Definition: Private.h:115
PVOID GetSSDTEntry(IN ULONG index)
Gets the SSDT entry address by index.
Definition: Private.c:174
PMMPTE GetPTEForVA(IN PVOID pAddress)
Get page hardware PTE Address must be valid, otherwise bug check is imminent
Definition: Private.c:191
PVOID GetKernelBase()
Get ntoskrnl base address
Definition: Private.c:57
struct _DYNAMIC_DATA DYNAMIC_DATA
OS-dependent stuff
ULONG ObjTable
Definition: Private.h:102
Definition: NativeStructs7.h:101
WinVer ver
Definition: Private.h:98
IN ACCESS_MASK DesiredAccess
Definition: Private.h:115
IN ACCESS_MASK IN PVOID IN HANDLE IN PVOID IN PVOID IN ULONG IN SIZE_T IN SIZE_T SizeOfStackCommit
Definition: Private.h:115
ULONG KExecOpt
Definition: Private.h:100