3 #include "../../Include/Winheaders.h"
4 #include "../../PE/PEImage.h"
5 #include "../../Include/NativeStructures.h"
6 #include "../../Include/Macro.h"
20 ENUM_OPS( LdrRefFlags )
26 BLACKBONE_API NtLdr(
class Process& proc );
27 BLACKBONE_API ~NtLdr(
void );
33 BLACKBONE_API
bool Init();
45 BLACKBONE_API
bool CreateNTReference(
48 const std::wstring& DllBasePath,
50 LdrRefFlags flags = Ldr_All
59 BLACKBONE_API
bool AddStaticTLSEntry(
void* pModule, IMAGE_TLS_DIRECTORY *pTls );
69 BLACKBONE_API
bool InsertInvertedFunctionTable(
void* ModuleBase,
size_t ImageSize,
bool& safeseh );
77 BLACKBONE_API
bool Unlink( ptr_t baseAddress,
const std::wstring& name, eModType type );
82 BLACKBONE_API
inline size_t LdrpInvertedFunctionTable( )
const {
return _LdrpInvertedFunctionTable; }
83 BLACKBONE_API
inline size_t LdrKernel32PatchAddress()
const {
return _LdrKernel32PatchAddress; }
84 BLACKBONE_API
inline size_t APC64PatchAddress()
const {
return _APC64PatchAddress; }
92 bool FindLdrpHashTable();
98 bool FindLdrpModuleIndexBase();
124 const std::wstring& dllpath,
141 const std::wstring& dllpath,
157 void InsertHashNode(
size_t pNodeLink, ULONG hash );
164 void InsertMemModuleNode(
size_t pNodeMemoryOrderLink,
size_t pNodeLoadOrderLink,
size_t pNodeInitOrderLink );
171 void InsertTailList(
size_t ListHead,
size_t Entry );
178 ULONG HashString(
const std::wstring& str );
187 T* SetNode( T* ptr,
void* pModule );
195 ptr_t UnlinkFromLdr( ptr_t baseAddress,
const std::wstring& name );
206 ptr_t UnlinkListEntry(
_LIST_ENTRY_T<T> pListEntry, ptr_t head,
size_t ofst, ptr_t baseAddress );
209 void UnlinkListEntry( ptr_t pListLink );
216 ptr_t UnlinkTreeNode( ptr_t ldrEntry );
218 NtLdr(
const NtLdr& ) =
delete;
219 NtLdr& operator =(
const NtLdr&) =
delete;
224 size_t _LdrpHashTable = 0;
225 size_t _LdrpModuleIndexBase = 0;
226 size_t _LdrpModuleBase = 0;
227 size_t _LdrHeapBase = 0;
228 size_t _LdrKernel32PatchAddress = 0;
229 size_t _APC64PatchAddress = 0;
230 size_t _LdrpHandleTlsData = 0;
231 size_t _LdrpInvertedFunctionTable = 0;
232 size_t _RtlInsertInvertedFunctionTable = 0;
234 std::map<HMODULE, void*> _nodeMap;
Definition: Win8Specific.h:59
Definition: NativeStructures.h:29
Definition: NtLoader.h:23
Definition: Win7Specific.h:9
Definition: AsmHelper32.cpp:6