101 IN PVOID pBaseAddress,
105 OUT PNTSTATUS pExitStatus
LIST_ENTRY g_PhysProcesses
Definition: Routines.c:5
Per-process list of physical regions
Definition: Routines.h:22
VOID BBProcessNotify(IN HANDLE ParentId, IN HANDLE ProcessId, IN BOOLEAN Create)
Process termination handler
Definition: NotifyRoutine.c:14
LIST_ENTRY pVadList
Definition: Routines.h:26
NTSTATUS BBSetProtection(IN PSET_PROC_PROTECTION pProtection)
Enable/disable process protection flag
Definition: Routines.c:85
HANDLE pid
Definition: Routines.h:25
PVOID ptr
Definition: Routines.h:16
struct _MEM_PHYS_PROCESS_ENTRY * PMEM_PHYS_PROCESS_ENTRY
Input for IOCTL_BLACKBONE_HIDE_VAD
Definition: BlackBoneDef.h:385
NTSTATUS BBInjectDll(IN PINJECT_DLL pData)
Inject dll into process
Definition: Inject.c:40
NTSTATUS BBQueueUserApc(IN PETHREAD pThread, IN PVOID pUserFunc, IN PVOID Arg1)
Send user-mode APC to the target thread
Definition: Inject.c:399
PMDL pMDL
Definition: Routines.h:15
ULONG_PTR size
Definition: Routines.h:13
typedef NTSTATUS(NTAPI *fnNtCreateThreadEx)(OUT PHANDLE hThread
PMEM_PHYS_PROCESS_ENTRY BBLookupPhysProcessEntry(IN HANDLE pid)
Find memory allocation process entry
Definition: Routines.c:524
NTSTATUS BBHideVAD(IN PHIDE_VAD pData)
Hide VAD containing target address
Definition: Routines.c:502
struct _MEM_PHYS_PROCESS_ENTRY MEM_PHYS_PROCESS_ENTRY
Per-process list of physical regions
NTSTATUS BBCopyMemory(IN PCOPY_MEMORY pCopy)
Read/write process memory
Definition: Routines.c:189
PVOID pMapped
Definition: Routines.h:14
NTSTATUS BBDisableDEP(IN PDISABLE_DEP pData)
Disable process DEP Has no effect on native x64 process
Definition: Routines.c:45
Input for IOCTL_BLACKBONE_COPY_MEMORY
Definition: BlackBoneDef.h:263
NTSTATUS BBAllocateFreeMemory(IN PALLOCATE_FREE_MEMORY pAllocFree, OUT PALLOCATE_FREE_MEMORY_RESULT pResult)
Allocate/Free process memory
Definition: Routines.c:245
Input for IOCTL_BLACKBONE_GRANT_ACCESS
Definition: BlackBoneDef.h:253
Input for IOCTL_BLACKBONE_PROTECT_MEMORY
Definition: BlackBoneDef.h:298
Output for IOCTL_BLACKBONE_ALLOCATE_FREE_MEMORY
Definition: BlackBoneDef.h:289
LIST_ENTRY link
Definition: Routines.h:24
NTSTATUS BBGrantAccess(IN PHANDLE_GRANT_ACCESS pAccess)
Change handle granted access
Definition: Routines.c:146
void BBCleanupProcessPhysEntry(IN PMEM_PHYS_PROCESS_ENTRY pEntry, BOOLEAN attached)
Definition: Routines.c:579
LIST_ENTRY link
Definition: Routines.h:12
NTSTATUS BBExecuteInNewThread(IN PVOID pBaseAddress, IN PVOID pParam, IN ULONG flags, IN BOOLEAN wait, OUT PNTSTATUS pExitStatus)
Create new thread in the target process
Definition: Inject.c:161
NTSTATUS BBProtectMemory(IN PPROTECT_MEMORY pProtect)
Change process memory protection
Definition: Routines.c:440
Input for IOCTL_BLACKBONE_ALLOCATE_FREE_MEMORY
Definition: BlackBoneDef.h:275
Allocated physical region entry
Definition: Routines.h:10
Input for IOCTL_BLACKBONE_DISABLE_DEP
Definition: BlackBoneDef.h:236
typedef VOID(NTAPI *PKNORMAL_ROUTINE)(PVOID NormalContext
Input for IOCTL_BLACKBONE_SET_PROTECTION
Definition: BlackBoneDef.h:244
void BBCleanupPhysMemEntry(IN PMEM_PHYS_ENTRY pEntry, BOOLEAN attached)
Definition: Routines.c:563
void BBCleanupProcessPhysList()
Definition: Routines.c:592
Input for IOCTL_BLACKBONE_INJECT_DLL
Definition: BlackBoneDef.h:401
struct _MEM_PHYS_ENTRY MEM_PHYS_ENTRY
Allocated physical region entry
struct _MEM_PHYS_ENTRY * PMEM_PHYS_ENTRY