Go to the source code of this file.
ULONG BBConvertProtection |
( |
IN ULONG |
prot, |
|
|
IN BOOLEAN |
fromPTE |
|
) |
| |
Convert protection flags
- Parameters
-
prot | Protection flags. |
fromPTE | If TRUE - convert to PTE protection, if FALSE - convert to Win32 protection |
- Returns
- Resulting protection flags
Find VAD that describes target address
- Parameters
-
pProcess | Target process object |
address | Address to find |
pResult | Found VAD. NULL if not found |
- Returns
- Status code
Get region VAD type
- Parameters
-
pProcess | Target process object |
address | Target address |
pType | Resulting VAD type |
- Returns
- Status code
NTSTATUS BBProtectVAD |
( |
IN PEPROCESS |
pProcess, |
|
|
IN ULONG_PTR |
address, |
|
|
IN ULONG |
prot |
|
) |
| |
Change VAD protection flags
- Parameters
-
pProcess | Target process object |
address | target address |
prot | New protection flags |
- Returns
- Status code
- Parameters
-
pProcess | Target process object |
address | Target address |
prot | New protection flags |
- Returns
- Status code
NTSTATUS BBUnlinkVAD |
( |
IN PEPROCESS |
pProcess, |
|
|
IN ULONG_PTR |
address |
|
) |
| |
Hide memory from NtQueryVirtualMemory
- Parameters
-
pProcess | Target process object |
address | Target address |
- Returns
- Status code