Routines.c File Reference

#include "BlackBoneDrv.h"
#include "Routines.h"
#include <Ntstrsafe.h>

Functions
NTSTATUS	BBAllocateFreePhysical (IN PEPROCESS pProcess, IN PALLOCATE_FREE_MEMORY pAllocFree, OUT PALLOCATE_FREE_MEMORY_RESULT pResult)
	Allocate kernel memory and map into User space. Or free previously allocated memory More...
PMEM_PHYS_ENTRY	BBLookupPhysMemEntry (IN PLIST_ENTRY pList, IN PVOID pBase)
	Find allocated memory region entry More...
NTSTATUS	BBDisableDEP (IN PDISABLE_DEP pData)
	Disable process DEP Has no effect on native x64 process More...
NTSTATUS	BBSetProtection (IN PSET_PROC_PROTECTION pProtection)
	Enable/disable process protection flag More...
NTSTATUS	BBGrantAccess (IN PHANDLE_GRANT_ACCESS pAccess)
	Change handle granted access More...
NTSTATUS	BBCopyMemory (IN PCOPY_MEMORY pCopy)
	Read/write process memory More...
NTSTATUS	BBAllocateFreeMemory (IN PALLOCATE_FREE_MEMORY pAllocFree, OUT PALLOCATE_FREE_MEMORY_RESULT pResult)
	Allocate/Free process memory More...
NTSTATUS	BBProtectMemory (IN PPROTECT_MEMORY pProtect)
	Change process memory protection More...
NTSTATUS	BBHideVAD (IN PHIDE_VAD pData)
	Hide VAD containing target address More...
PMEM_PHYS_PROCESS_ENTRY	BBLookupPhysProcessEntry (IN HANDLE pid)
	Find memory allocation process entry More...
void	BBCleanupPhysMemEntry (IN PMEM_PHYS_ENTRY pEntry, BOOLEAN attached)
void	BBCleanupProcessPhysEntry (IN PMEM_PHYS_PROCESS_ENTRY pEntry, BOOLEAN attached)
void	BBCleanupProcessPhysList ()

Variables
LIST_ENTRY	g_PhysProcesses

Function Documentation

NTSTATUS BBAllocateFreeMemory	(	IN PALLOCATE_FREE_MEMORY	pAllocFree,
		OUT PALLOCATE_FREE_MEMORY_RESULT	pResult
	)

Allocate/Free process memory

Parameters

pAllocFree	Request params.
pResult	Allocated region info.

Returns

Status code

NTSTATUS BBAllocateFreePhysical	(	IN PEPROCESS	pProcess,
		IN PALLOCATE_FREE_MEMORY	pAllocFree,
		OUT PALLOCATE_FREE_MEMORY_RESULT	pResult
	)

Allocate kernel memory and map into User space. Or free previously allocated memory

Parameters

pProcess	Target process object
pAllocFree	Request params.
pResult	Allocated region info.

Returns

Status code

void BBCleanupPhysMemEntry	(	IN PMEM_PHYS_ENTRY	pEntry,
		BOOLEAN	attached
	)

void BBCleanupProcessPhysEntry	(	IN PMEM_PHYS_PROCESS_ENTRY	pEntry,
		BOOLEAN	attached
	)

void BBCleanupProcessPhysList

(

)

NTSTATUS BBCopyMemory

(

IN PCOPY_MEMORY

pCopy

)

Read/write process memory

Parameters

pCopy

Request params

Returns

Status code

NTSTATUS BBDisableDEP

(

IN PDISABLE_DEP

pData

)

Disable process DEP Has no effect on native x64 process

Parameters

pData

Request params

Returns

Status code

NTSTATUS BBGrantAccess

(

IN PHANDLE_GRANT_ACCESS

pAccess

)

Change handle granted access

Parameters

pAccess

Request params

Returns

Status code

NTSTATUS BBHideVAD

(

IN PHIDE_VAD

pData

)

Hide VAD containing target address

Parameters

pData

Address info

Returns

Status code

PMEM_PHYS_ENTRY BBLookupPhysMemEntry	(	IN PLIST_ENTRY	pList,
		IN PVOID	pBase
	)

Find allocated memory region entry

Parameters

pList	Region list
pBase	Region base

Returns

Found entry, NULL if not found

PMEM_PHYS_PROCESS_ENTRY BBLookupPhysProcessEntry

(

IN HANDLE

pid

)

Find memory allocation process entry

Parameters

pid	Target PID

Returns

Found entry, NULL if not found

NTSTATUS BBProtectMemory

(

IN PPROTECT_MEMORY

pProtect

)

Change process memory protection

Parameters

pProtect

Request params

Returns

Status code

NTSTATUS BBSetProtection

(

IN PSET_PROC_PROTECTION

pProtection

)

Enable/disable process protection flag

Parameters

pProtection

Request params

Returns

Status code

Variable Documentation

LIST_ENTRY g_PhysProcesses