BlackBone
Windows memory hacking library
|
Functions | |
NTSTATUS | BBProtectVAD (IN PEPROCESS pProcess, IN ULONG_PTR address, IN ULONG prot) |
Change VAD protection flags More... | |
NTSTATUS | BBUnlinkVAD (IN PEPROCESS pProcess, IN ULONG_PTR address) |
Hide memory from NtQueryVirtualMemory More... | |
NTSTATUS | BBGetVadType (IN PEPROCESS pProcess, IN ULONG_PTR address, OUT PMI_VAD_TYPE pType) |
Get region VAD type More... | |
NTSTATUS | BBFindVAD (IN PEPROCESS pProcess, IN ULONG_PTR address, OUT PMMVAD_SHORT *pResult) |
Find VAD that describes target address More... | |
ULONG | BBConvertProtection (IN ULONG prot, IN BOOLEAN fromPTE) |
Convert protection flags More... | |
Variables | |
DYNAMIC_DATA | dynData |
ULONG | MmProtectToValue [32] |
ULONG BBConvertProtection | ( | IN ULONG | prot, |
IN BOOLEAN | fromPTE | ||
) |
Convert protection flags
prot | Protection flags. |
fromPTE | If TRUE - convert to PTE protection, if FALSE - convert to Win32 protection |
NTSTATUS BBFindVAD | ( | IN PEPROCESS | pProcess, |
IN ULONG_PTR | address, | ||
OUT PMMVAD_SHORT * | pResult | ||
) |
Find VAD that describes target address
pProcess | Target process object |
address | Address to find |
pResult | Found VAD. NULL if not found |
NTSTATUS BBGetVadType | ( | IN PEPROCESS | pProcess, |
IN ULONG_PTR | address, | ||
OUT PMI_VAD_TYPE | pType | ||
) |
Get region VAD type
pProcess | Target process object |
address | Target address |
pType | Resulting VAD type |
NTSTATUS BBProtectVAD | ( | IN PEPROCESS | pProcess, |
IN ULONG_PTR | address, | ||
IN ULONG | prot | ||
) |
Change VAD protection flags
pProcess | Target process object |
address | Target address |
prot | New protection flags |
NTSTATUS BBUnlinkVAD | ( | IN PEPROCESS | pProcess, |
IN ULONG_PTR | address | ||
) |
Hide memory from NtQueryVirtualMemory
pProcess | Target process object |
address | Target address |
DYNAMIC_DATA dynData |
ULONG MmProtectToValue[32] |