Files

400 lines
20 KiB
HTML

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/xhtml;charset=UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=9"/>
<meta name="generator" content="Doxygen 1.8.8"/>
<title>BlackBone: C:/Users/Ton/Documents/Visual Studio 2013/Projects/BlackBone/src/BlackBoneDrv/Loader.c File Reference</title>
<link href="tabs.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="jquery.js"></script>
<script type="text/javascript" src="dynsections.js"></script>
<link href="navtree.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="resize.js"></script>
<script type="text/javascript" src="navtree.js"></script>
<script type="text/javascript">
$(document).ready(initResizable);
$(window).load(resizeHeight);
</script>
<link href="search/search.css" rel="stylesheet" type="text/css"/>
<script type="text/javascript" src="search/search.js"></script>
<script type="text/javascript">
$(document).ready(function() { searchBox.OnSelectItem(0); });
</script>
<link href="doxygen.css" rel="stylesheet" type="text/css" />
</head>
<body>
<div id="top"><!-- do not remove this div, it is closed by doxygen! -->
<div id="titlearea">
<table cellspacing="0" cellpadding="0">
<tbody>
<tr style="height: 56px;">
<td style="padding-left: 0.5em;">
<div id="projectname">BlackBone
</div>
<div id="projectbrief">Windows memory hacking library</div>
</td>
</tr>
</tbody>
</table>
</div>
<!-- end header part -->
<!-- Generated by Doxygen 1.8.8 -->
<script type="text/javascript">
var searchBox = new SearchBox("searchBox", "search",false,'Search');
</script>
<div id="navrow1" class="tabs">
<ul class="tablist">
<li><a href="index.html"><span>Main&#160;Page</span></a></li>
<li><a href="annotated.html"><span>Data&#160;Structures</span></a></li>
<li class="current"><a href="files.html"><span>Files</span></a></li>
<li>
<div id="MSearchBox" class="MSearchBoxInactive">
<span class="left">
<img id="MSearchSelect" src="search/mag_sel.png"
onmouseover="return searchBox.OnSearchSelectShow()"
onmouseout="return searchBox.OnSearchSelectHide()"
alt=""/>
<input type="text" id="MSearchField" value="Search" accesskey="S"
onfocus="searchBox.OnSearchFieldFocus(true)"
onblur="searchBox.OnSearchFieldFocus(false)"
onkeyup="searchBox.OnSearchFieldChange(event)"/>
</span><span class="right">
<a id="MSearchClose" href="javascript:searchBox.CloseResultsWindow()"><img id="MSearchCloseImg" border="0" src="search/close.png" alt=""/></a>
</span>
</div>
</li>
</ul>
</div>
<div id="navrow2" class="tabs2">
<ul class="tablist">
<li><a href="files.html"><span>File&#160;List</span></a></li>
<li><a href="globals.html"><span>Globals</span></a></li>
</ul>
</div>
</div><!-- top -->
<div id="side-nav" class="ui-resizable side-nav-resizable">
<div id="nav-tree">
<div id="nav-tree-contents">
<div id="nav-sync" class="sync"></div>
</div>
</div>
<div id="splitbar" style="-moz-user-select:none;"
class="ui-resizable-handle">
</div>
</div>
<script type="text/javascript">
$(document).ready(function(){initNavTree('_loader_8c.html','');});
</script>
<div id="doc-content">
<!-- window showing the filter options -->
<div id="MSearchSelectWindow"
onmouseover="return searchBox.OnSearchSelectShow()"
onmouseout="return searchBox.OnSearchSelectHide()"
onkeydown="return searchBox.OnSearchSelectKey(event)">
<a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(0)"><span class="SelectionMark">&#160;</span>All</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(1)"><span class="SelectionMark">&#160;</span>Data Structures</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(2)"><span class="SelectionMark">&#160;</span>Files</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(3)"><span class="SelectionMark">&#160;</span>Functions</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(4)"><span class="SelectionMark">&#160;</span>Variables</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(5)"><span class="SelectionMark">&#160;</span>Typedefs</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(6)"><span class="SelectionMark">&#160;</span>Enumerations</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(7)"><span class="SelectionMark">&#160;</span>Enumerator</a><a class="SelectItem" href="javascript:void(0)" onclick="searchBox.OnSelectItem(8)"><span class="SelectionMark">&#160;</span>Macros</a></div>
<!-- iframe showing the search results (closed by default) -->
<div id="MSearchResultsWindow">
<iframe src="javascript:void(0)" frameborder="0"
name="MSearchResults" id="MSearchResults">
</iframe>
</div>
<div class="header">
<div class="summary">
<a href="#func-members">Functions</a> &#124;
<a href="#var-members">Variables</a> </div>
<div class="headertitle">
<div class="title">Loader.c File Reference</div> </div>
</div><!--header-->
<div class="contents">
<div class="textblock"><code>#include &quot;<a class="el" href="_private_8h_source.html">Private.h</a>&quot;</code><br />
<code>#include &quot;<a class="el" href="_loader_8h_source.html">Loader.h</a>&quot;</code><br />
<code>#include &lt;Ntstrsafe.h&gt;</code><br />
</div><table class="memberdecls">
<tr class="heading"><td colspan="2"><h2 class="groupheader"><a name="func-members"></a>
Functions</h2></td></tr>
<tr class="memitem:a433fb08e81c29e16bb97a09c6ac9e231"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_private_8h.html#afa7140c76ae020a5271b3181ccb8b512">NTSTATUS</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#a433fb08e81c29e16bb97a09c6ac9e231">BBMapWorker</a> (IN PVOID pArg)</td></tr>
<tr class="memdesc:a433fb08e81c29e16bb97a09c6ac9e231"><td class="mdescLeft">&#160;</td><td class="mdescRight">System worker thread that performs actual mapping <a href="#a433fb08e81c29e16bb97a09c6ac9e231">More...</a><br /></td></tr>
<tr class="separator:a433fb08e81c29e16bb97a09c6ac9e231"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:ad58dba8a31f0db044f654c9f8a928a8a"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_private_8h.html#afa7140c76ae020a5271b3181ccb8b512">NTSTATUS</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#ad58dba8a31f0db044f654c9f8a928a8a">BBInitLdrData</a> (IN <a class="el" href="_native_structs_8h.html#ac491bb1a57d794effb79f30a37ace3cb">PKLDR_DATA_TABLE_ENTRY</a> pThisModule)</td></tr>
<tr class="memdesc:ad58dba8a31f0db044f654c9f8a928a8a"><td class="mdescLeft">&#160;</td><td class="mdescRight">Initialize loader stuff <a href="#ad58dba8a31f0db044f654c9f8a928a8a">More...</a><br /></td></tr>
<tr class="separator:ad58dba8a31f0db044f654c9f8a928a8a"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a0f480402673fa85e5efd11f2de760ba9"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_native_structs_8h.html#ac491bb1a57d794effb79f30a37ace3cb">PKLDR_DATA_TABLE_ENTRY</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#a0f480402673fa85e5efd11f2de760ba9">BBGetSystemModule</a> (IN PUNICODE_STRING pName, IN PVOID pAddress)</td></tr>
<tr class="memdesc:a0f480402673fa85e5efd11f2de760ba9"><td class="mdescLeft">&#160;</td><td class="mdescRight">Get address of a system module Either 'pName' or 'pAddress' is required to perform search <a href="#a0f480402673fa85e5efd11f2de760ba9">More...</a><br /></td></tr>
<tr class="separator:a0f480402673fa85e5efd11f2de760ba9"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a390ed9e940e4afd22ca0b82b3145394f"><td class="memItemLeft" align="right" valign="top">PVOID&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#a390ed9e940e4afd22ca0b82b3145394f">BBGetUserModuleBase</a> (IN PEPROCESS pProcess, IN PUNICODE_STRING ModuleName, IN BOOLEAN isWow64)</td></tr>
<tr class="memdesc:a390ed9e940e4afd22ca0b82b3145394f"><td class="mdescLeft">&#160;</td><td class="mdescRight">Get module base address by name <a href="#a390ed9e940e4afd22ca0b82b3145394f">More...</a><br /></td></tr>
<tr class="separator:a390ed9e940e4afd22ca0b82b3145394f"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a04e18e8b7773f1a4c32ad9fee0e6717c"><td class="memItemLeft" align="right" valign="top">PVOID&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#a04e18e8b7773f1a4c32ad9fee0e6717c">BBGetModuleExport</a> (IN PVOID pBase, IN PCCHAR name_ord)</td></tr>
<tr class="memdesc:a04e18e8b7773f1a4c32ad9fee0e6717c"><td class="mdescLeft">&#160;</td><td class="mdescRight">Get exported function address <a href="#a04e18e8b7773f1a4c32ad9fee0e6717c">More...</a><br /></td></tr>
<tr class="separator:a04e18e8b7773f1a4c32ad9fee0e6717c"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a60c721a39629feecef7fc6f64c440c37"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_private_8h.html#afa7140c76ae020a5271b3181ccb8b512">NTSTATUS</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#a60c721a39629feecef7fc6f64c440c37">BBResolveReferences</a> (IN PVOID pImageBase)</td></tr>
<tr class="memdesc:a60c721a39629feecef7fc6f64c440c37"><td class="mdescLeft">&#160;</td><td class="mdescRight">Resolve module references and fill the IAT <a href="#a60c721a39629feecef7fc6f64c440c37">More...</a><br /></td></tr>
<tr class="separator:a60c721a39629feecef7fc6f64c440c37"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a56cd407ebacf8fcfbce76a6ff1e01c78"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_private_8h.html#afa7140c76ae020a5271b3181ccb8b512">NTSTATUS</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#a56cd407ebacf8fcfbce76a6ff1e01c78">BBMMapDriver</a> (IN PUNICODE_STRING pPath)</td></tr>
<tr class="memdesc:a56cd407ebacf8fcfbce76a6ff1e01c78"><td class="mdescLeft">&#160;</td><td class="mdescRight">Manually map driver into system space <a href="#a56cd407ebacf8fcfbce76a6ff1e01c78">More...</a><br /></td></tr>
<tr class="separator:a56cd407ebacf8fcfbce76a6ff1e01c78"><td class="memSeparator" colspan="2">&#160;</td></tr>
</table><table class="memberdecls">
<tr class="heading"><td colspan="2"><h2 class="groupheader"><a name="var-members"></a>
Variables</h2></td></tr>
<tr class="memitem:a921919ecbd45a31fc4593d1c8067113c"><td class="memItemLeft" align="right" valign="top">PLIST_ENTRY&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#a921919ecbd45a31fc4593d1c8067113c">PsLoadedModuleList</a></td></tr>
<tr class="separator:a921919ecbd45a31fc4593d1c8067113c"><td class="memSeparator" colspan="2">&#160;</td></tr>
<tr class="memitem:a6151ff00e6a88b1ffdf4c6a6fc1924c7"><td class="memItemLeft" align="right" valign="top"><a class="el" href="_private_8h.html#a3c82361783384ad388af4ad2f95c54e6">DYNAMIC_DATA</a>&#160;</td><td class="memItemRight" valign="bottom"><a class="el" href="_loader_8c.html#a6151ff00e6a88b1ffdf4c6a6fc1924c7">dynData</a></td></tr>
<tr class="separator:a6151ff00e6a88b1ffdf4c6a6fc1924c7"><td class="memSeparator" colspan="2">&#160;</td></tr>
</table>
<h2 class="groupheader">Function Documentation</h2>
<a class="anchor" id="a04e18e8b7773f1a4c32ad9fee0e6717c"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname">PVOID BBGetModuleExport </td>
<td>(</td>
<td class="paramtype">IN PVOID&#160;</td>
<td class="paramname"><em>pBase</em>, </td>
</tr>
<tr>
<td class="paramkey"></td>
<td></td>
<td class="paramtype">IN PCCHAR&#160;</td>
<td class="paramname"><em>name_ord</em>&#160;</td>
</tr>
<tr>
<td></td>
<td>)</td>
<td></td><td></td>
</tr>
</table>
</div><div class="memdoc">
<p>Get exported function address </p>
<dl class="params"><dt>Parameters</dt><dd>
<table class="params">
<tr><td class="paramname">pBase</td><td>Module base</td></tr>
<tr><td class="paramname">name_ord</td><td>Function name or ordinal</td></tr>
</table>
</dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>Found address, NULL if not found</dd></dl>
</div>
</div>
<a class="anchor" id="a0f480402673fa85e5efd11f2de760ba9"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname"><a class="el" href="_native_structs_8h.html#ac491bb1a57d794effb79f30a37ace3cb">PKLDR_DATA_TABLE_ENTRY</a> BBGetSystemModule </td>
<td>(</td>
<td class="paramtype">IN PUNICODE_STRING&#160;</td>
<td class="paramname"><em>pName</em>, </td>
</tr>
<tr>
<td class="paramkey"></td>
<td></td>
<td class="paramtype">IN PVOID&#160;</td>
<td class="paramname"><em>pAddress</em>&#160;</td>
</tr>
<tr>
<td></td>
<td>)</td>
<td></td><td></td>
</tr>
</table>
</div><div class="memdoc">
<p>Get address of a system module Either 'pName' or 'pAddress' is required to perform search </p>
<dl class="params"><dt>Parameters</dt><dd>
<table class="params">
<tr><td class="paramname">pName</td><td>Base name of the image (e.g. hal.dll)</td></tr>
<tr><td class="paramname">pAddress</td><td>Address inside module</td></tr>
</table>
</dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>Found loader entry. NULL if nothing found</dd></dl>
</div>
</div>
<a class="anchor" id="a390ed9e940e4afd22ca0b82b3145394f"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname">PVOID BBGetUserModuleBase </td>
<td>(</td>
<td class="paramtype">IN PEPROCESS&#160;</td>
<td class="paramname"><em>pProcess</em>, </td>
</tr>
<tr>
<td class="paramkey"></td>
<td></td>
<td class="paramtype">IN PUNICODE_STRING&#160;</td>
<td class="paramname"><em>ModuleName</em>, </td>
</tr>
<tr>
<td class="paramkey"></td>
<td></td>
<td class="paramtype">IN BOOLEAN&#160;</td>
<td class="paramname"><em>isWow64</em>&#160;</td>
</tr>
<tr>
<td></td>
<td>)</td>
<td></td><td></td>
</tr>
</table>
</div><div class="memdoc">
<p>Get module base address by name </p>
<dl class="params"><dt>Parameters</dt><dd>
<table class="params">
<tr><td class="paramname">pProcess</td><td>Target process</td></tr>
<tr><td class="paramname">ModuleName</td><td>Nodule name to search for</td></tr>
<tr><td class="paramname">isWow64</td><td>If TRUE - search in 32-bit PEB</td></tr>
</table>
</dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>Found address, NULL if not found</dd></dl>
</div>
</div>
<a class="anchor" id="ad58dba8a31f0db044f654c9f8a928a8a"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname"><a class="el" href="_private_8h.html#afa7140c76ae020a5271b3181ccb8b512">NTSTATUS</a> BBInitLdrData </td>
<td>(</td>
<td class="paramtype">IN <a class="el" href="_native_structs_8h.html#ac491bb1a57d794effb79f30a37ace3cb">PKLDR_DATA_TABLE_ENTRY</a>&#160;</td>
<td class="paramname"><em>pThisModule</em></td><td>)</td>
<td></td>
</tr>
</table>
</div><div class="memdoc">
<p>Initialize loader stuff </p>
<dl class="params"><dt>Parameters</dt><dd>
<table class="params">
<tr><td class="paramname">pThisModule</td><td>Any valid system module</td></tr>
</table>
</dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>Status code</dd></dl>
</div>
</div>
<a class="anchor" id="a433fb08e81c29e16bb97a09c6ac9e231"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname"><a class="el" href="_private_8h.html#afa7140c76ae020a5271b3181ccb8b512">NTSTATUS</a> BBMapWorker </td>
<td>(</td>
<td class="paramtype">IN PVOID&#160;</td>
<td class="paramname"><em>pArg</em></td><td>)</td>
<td></td>
</tr>
</table>
</div><div class="memdoc">
<p>System worker thread that performs actual mapping </p>
<dl class="params"><dt>Parameters</dt><dd>
<table class="params">
<tr><td class="paramname">pArg</td><td>Path to the driver - PUNICODE_STRING type</td></tr>
</table>
</dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>Status code</dd></dl>
</div>
</div>
<a class="anchor" id="a56cd407ebacf8fcfbce76a6ff1e01c78"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname"><a class="el" href="_private_8h.html#afa7140c76ae020a5271b3181ccb8b512">NTSTATUS</a> BBMMapDriver </td>
<td>(</td>
<td class="paramtype">IN PUNICODE_STRING&#160;</td>
<td class="paramname"><em>pPath</em></td><td>)</td>
<td></td>
</tr>
</table>
</div><div class="memdoc">
<p>Manually map driver into system space </p>
<dl class="params"><dt>Parameters</dt><dd>
<table class="params">
<tr><td class="paramname">pPath</td><td>Fully qualified native path to the driver</td></tr>
</table>
</dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>Status code</dd></dl>
</div>
</div>
<a class="anchor" id="a60c721a39629feecef7fc6f64c440c37"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname"><a class="el" href="_private_8h.html#afa7140c76ae020a5271b3181ccb8b512">NTSTATUS</a> BBResolveReferences </td>
<td>(</td>
<td class="paramtype">IN PVOID&#160;</td>
<td class="paramname"><em>pImageBase</em></td><td>)</td>
<td></td>
</tr>
</table>
</div><div class="memdoc">
<p>Resolve module references and fill the IAT </p>
<dl class="params"><dt>Parameters</dt><dd>
<table class="params">
<tr><td class="paramname">pImageBase</td><td>Image base to be processed</td></tr>
</table>
</dd>
</dl>
<dl class="section return"><dt>Returns</dt><dd>Status code</dd></dl>
</div>
</div>
<h2 class="groupheader">Variable Documentation</h2>
<a class="anchor" id="a6151ff00e6a88b1ffdf4c6a6fc1924c7"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname"><a class="el" href="_private_8h.html#a3c82361783384ad388af4ad2f95c54e6">DYNAMIC_DATA</a> dynData</td>
</tr>
</table>
</div><div class="memdoc">
</div>
</div>
<a class="anchor" id="a921919ecbd45a31fc4593d1c8067113c"></a>
<div class="memitem">
<div class="memproto">
<table class="memname">
<tr>
<td class="memname">PLIST_ENTRY PsLoadedModuleList</td>
</tr>
</table>
</div><div class="memdoc">
</div>
</div>
</div><!-- contents -->
</div><!-- doc-content -->
<!-- start footer part -->
<div id="nav-path" class="navpath"><!-- id is needed for treeview function! -->
<ul>
<li class="navelem"><a class="el" href="dir_1be4885ae0f8fc825ada64c048101ff4.html">Visual Studio 2013</a></li><li class="navelem"><a class="el" href="dir_cff6504ebdd213a64976c6fc552b82ee.html">Projects</a></li><li class="navelem"><a class="el" href="dir_b716da8d3aa0fe4ae2f6139a1f666f87.html">BlackBone</a></li><li class="navelem"><a class="el" href="dir_ad2d131fed674adc088bc470bbb2e438.html">src</a></li><li class="navelem"><a class="el" href="dir_ddc31af3ab12d58410e17a5b1105cec8.html">BlackBoneDrv</a></li><li class="navelem"><a class="el" href="_loader_8c.html">Loader.c</a></li>
<li class="footer">Generated on Tue Sep 23 2014 11:50:44 for BlackBone by
<a href="http://www.doxygen.org/index.html">
<img class="footer" src="doxygen.png" alt="doxygen"/></a> 1.8.8 </li>
</ul>
</div>
</body>
</html>