#include "Remap.h"
#include <Ntstrsafe.h>

Functions
NTSTATUS	BBBuildProcessRegionListForRange (IN PLIST_ENTRY pList, IN ULONG_PTR start, IN ULONG_PTR end, IN BOOLEAN mapSections)
	Enumerate committed, accessible, non-guarded memory regions More...

NTSTATUS	BBPrepareMDLList (IN PLIST_ENTRY pList)
	Walk region list and create MDL for each region More...

NTSTATUS	BBPrepareMDLListEntry (IN PMAP_ENTRY pEntry)
	Build MDL for memory region More...

NTSTATUS	BBMapRegionListIntoCurrentProcess (IN PLIST_ENTRY pList, IN BOOLEAN noWarning)
	Map locked physical pages into caller process More...

NTSTATUS	BBMapRegionIntoCurrentProcess (IN PMAP_ENTRY pEntry, IN PMAP_ENTRY pPrevEntry)
	Map locked physical pages into caller process More...

NTSTATUS	BBAllocateSharedPage (OUT PVOID pPage, OUT PMDL pResultMDL)
	Allocate kernel page from NonPaged pool and build MDL for it More...

NTSTATUS	BBMapSharedPage (IN PMDL pMDL, OUT PVOID *pResult)
	Map kernel page into current process address space More...

NTSTATUS	BBConsolidateRegionList (IN PLIST_ENTRY pList)
	Consolidate adjacent memory regions More...

NTSTATUS	BBHandleSharedRegion (IN PMAP_ENTRY pEntry)
	Process section object pages Function will attempt to trigger copy-on-write for underlying pages to convert them into private If copy-on-write fails, region will be then mapped as read-only More...

NTSTATUS	BBUnmapRegionEntry (IN PMAP_ENTRY pPageEntry, IN PPROCESS_MAP_ENTRY pFoundEntry)
	Unmap memory region, release corresponding MDL, and remove region form list More...

PMAP_ENTRY	BBFindPageEntry (IN PLIST_ENTRY pList, IN ULONG_PTR baseAddress, IN ULONG_PTR size)
	Find memory region containing at least one byte from specific region More...

VOID	BBCleanupPageList (IN BOOLEAN attached, IN PLIST_ENTRY pList)
	Unmap pages, destroy MDLs, remove entry from list More...

NTSTATUS	BBSafeHandleClose (IN PEPROCESS pProcess, IN HANDLE handle, IN KPROCESSOR_MODE mode)
	Close handle if process isn't in signaled state More...

RTL_GENERIC_COMPARE_RESULTS	AvlCompare (IN RTL_AVL_TABLE *Table, IN PVOID FirstStruct, IN PVOID SecondStruct)

PVOID	AvlAllocate (IN RTL_AVL_TABLE *Table, IN CLONG ByteSize)

VOID	AvlFree (IN RTL_AVL_TABLE *Table, IN PVOID Buffer)

NTSTATUS	BBPrepareMDLListEntry (IN OUT PMAP_ENTRY pEntry)
	Build MDL for memory region More...

NTSTATUS	BBMapMemory (IN PMAP_MEMORY pRemap, OUT PPROCESS_MAP_ENTRY *ppEntry)
	Map entire address space of target process into current Subsequent calls won't map any additional regions, only return info about existing mapping More...

NTSTATUS	BBMapMemoryRegion (IN PMAP_MEMORY_REGION pRegion, OUT PMAP_MEMORY_REGION_RESULT pResult)
	Map specific memory region More...

NTSTATUS	BBUnmapMemory (IN PUNMAP_MEMORY pUnmap)
	Unmap any mapped memory from host and target processes More...

NTSTATUS	BBUnmapMemoryRegion (IN PUNMAP_MEMORY_REGION pRegion)
	Unmap specific memory region More...

VOID	BBCleanupProcessEntry (IN PPROCESS_MAP_ENTRY pProcessEntry)
	Unmap all regions, delete MDLs, close handles, remove entry from table More...

VOID	BBCleanupHostProcess (IN PPROCESS_MAP_ENTRY pProcessEntry)
	Unmap any mapped pages from host process More...

VOID	BBCleanupProcessTable ()
	Clear global process map table More...

PPROCESS_MAP_ENTRY	BBLookupProcessEntry (IN HANDLE pid, IN BOOLEAN asHost)
	Search process entry in list by PID More...

NTSTATUS	BBGetRequiredRemapOutputSize (IN PLIST_ENTRY pList, OUT PULONG_PTR pSize)
	Calculate size required to store mapping info More...

Variables
RTL_AVL_TABLE	g_ProcessPageTables

KGUARDED_MUTEX	g_globalLock

Function Documentation

PVOID AvlAllocate	(	IN RTL_AVL_TABLE *	Table,
		IN CLONG	ByteSize
	)

RTL_GENERIC_COMPARE_RESULTS AvlCompare	(	IN RTL_AVL_TABLE *	Table,
		IN PVOID	FirstStruct,
		IN PVOID	SecondStruct
	)

VOID AvlFree	(	IN RTL_AVL_TABLE *	Table,
		IN PVOID	Buffer
	)

NTSTATUS BBAllocateSharedPage	(	OUT PVOID *	pPage,
		OUT PMDL *	pResultMDL
	)

Allocate kernel page from NonPaged pool and build MDL for it

Parameters

pPage	Resulting address
pResultMDL	Resulting MDL

Returns: Status code

NTSTATUS BBBuildProcessRegionListForRange	(	IN PLIST_ENTRY	pList,
		IN ULONG_PTR	start,
		IN ULONG_PTR	end,
		IN BOOLEAN	mapSections
	)

Enumerate committed, accessible, non-guarded memory regions

Parameters

pList	Region list
start	Region start
end	Region end
mapSections	If set to FALSE, section objects will be excluded from list

Returns: Status code

VOID BBCleanupHostProcess ( IN PPROCESS_MAP_ENTRY pProcessEntry )

Unmap any mapped pages from host process

Parameters

pProcessEntry Process entry

VOID BBCleanupPageList	(	IN BOOLEAN	attached,
		IN PLIST_ENTRY	pList
	)

Unmap pages, destroy MDLs, remove entry from list

Parameters

attached	TRUE indicates that function is executed in the context of host process and pages can be safely unmapped
pList	Region list

VOID BBCleanupProcessEntry ( IN PPROCESS_MAP_ENTRY pProcessEntry )

Unmap all regions, delete MDLs, close handles, remove entry from table

Parameters

pProcessEntry Process entry

VOID BBCleanupProcessTable ( )

Clear global process map table

NTSTATUS BBConsolidateRegionList ( IN PLIST_ENTRY pList )

Consolidate adjacent memory regions

Parameters

pList Region list

Returns: Status code

PMAP_ENTRY BBFindPageEntry	(	IN PLIST_ENTRY	pList,
		IN ULONG_PTR	baseAddress,
		IN ULONG_PTR	size
	)

Find memory region containing at least one byte from specific region

Parameters

pList	Region list to search in
baseAddress	Base of region to find
size	Size of the region to find

Returns: Status code

NTSTATUS BBGetRequiredRemapOutputSize	(	IN PLIST_ENTRY	pList,
		OUT PULONG_PTR	pSize
	)

Calculate size required to store mapping info

Parameters

pList	Mapped regions list
pSize	Resulting size

Returns: Status code

NTSTATUS BBHandleSharedRegion ( IN PMAP_ENTRY pEntry )

Process section object pages Function will attempt to trigger copy-on-write for underlying pages to convert them into private If copy-on-write fails, region will be then mapped as read-only

Parameters

pEntry Region data

Returns: Status code

PPROCESS_MAP_ENTRY BBLookupProcessEntry	(	IN HANDLE	pid,
		IN BOOLEAN	asHost
	)

Search process entry in list by PID

Parameters

pid	PID.
asHost	If set to TRUE, pid is treated as host PID

Returns: Found entry, NULL in not found

NTSTATUS BBMapMemory	(	IN PMAP_MEMORY	pRemap,
		OUT PPROCESS_MAP_ENTRY *	ppEntry
	)

Map entire address space of target process into current Subsequent calls won't map any additional regions, only return info about existing mapping

Map entire address space of target process into current

Parameters

pRemap	Mapping params
ppEntry	Mapped context

Returns: Status code

NTSTATUS BBMapMemoryRegion	(	IN PMAP_MEMORY_REGION	pRegion,
		OUT PMAP_MEMORY_REGION_RESULT	pResult
	)

Map specific memory region

Parameters

pRegion	Region data
pResult	Mapping results

Returns: Status code

NTSTATUS BBMapRegionIntoCurrentProcess	(	IN PMAP_ENTRY	pEntry,
		IN PMAP_ENTRY	pPrevEntry
	)

Map locked physical pages into caller process

Parameters

pEntry	Memory region
pPrevEntry	Last mapped region

Returns: Status code

NTSTATUS BBMapRegionListIntoCurrentProcess	(	IN PLIST_ENTRY	pList,
		IN BOOLEAN	noWarning
	)

Map locked physical pages into caller process

Map memory regions into caller process

Parameters

pList	Region list
noWarning	If set to FALSE, warning will be printed if region is already mapped

Returns: Status code

NTSTATUS BBMapSharedPage	(	IN PMDL	pMDL,
		OUT PVOID *	pResult
	)

Map kernel page into current process address space

Parameters

pMDL	Page MDL
pResult	Mapped address

Returns: Status code

NTSTATUS BBPrepareMDLList ( IN PLIST_ENTRY pList )

Walk region list and create MDL for each region

Parameters

pList Region list

Returns: Status code

NTSTATUS BBPrepareMDLListEntry ( IN PMAP_ENTRY pEntry )

Build MDL for memory region

Parameters

pEntry Region data

Returns: Status code

NTSTATUS BBPrepareMDLListEntry ( IN OUT PMAP_ENTRY pEntry )

Build MDL for memory region

Parameters

pEntry Region data

Returns: Status code

NTSTATUS BBSafeHandleClose	(	IN PEPROCESS	pProcess,
		IN HANDLE	handle,
		IN KPROCESSOR_MODE	mode
	)

Close handle if process isn't in signaled state

Parameters

pProcess	Process object
handle	Handle
mode	KernelMode or UserMode handle

Returns: Status code

NTSTATUS BBUnmapMemory ( IN PUNMAP_MEMORY pUnmap )

Unmap any mapped memory from host and target processes

Parameters

pUnmap Request params

Returns: Status code

NTSTATUS BBUnmapMemoryRegion ( IN PUNMAP_MEMORY_REGION pRegion )

Unmap specific memory region

Parameters

pRegion Region info

Returns: Status ode

NTSTATUS BBUnmapRegionEntry	(	IN PMAP_ENTRY	pPageEntry,
		IN PPROCESS_MAP_ENTRY	pFoundEntry
	)

Unmap memory region, release corresponding MDL, and remove region form list

Parameters

pPageEntry	Region data
pFoundEntry	Process data

Returns: Status code

Variable Documentation

KGUARDED_MUTEX g_globalLock

RTL_AVL_TABLE g_ProcessPageTables

Functions

Variables

Function Documentation

Variable Documentation