#pragma once
#include "Private.h"
#include "VadRoutines.h"
#include "BlackBoneDef.h"
typedef enum _ATTACHED_CONTEXT
{
ContextNone, // Running in system context
ContextHost, // Running in the context of host process
ContextTarget, // Running in the context of target process
} ATTACHED_CONTEXT;
///
/// Process-specific data
///
typedef struct _PROCESS_CONTEXT
{
HANDLE pid; // Process ID
PVOID sharedPage; // Address of kernel shared page
} PROCESS_CONTEXT, *PPROCESS_CONTEXT;
///
/// Target - host correspondence
///
typedef struct _PROCESS_MAP_ENTRY
{
PROCESS_CONTEXT host; // Hosting process context
PROCESS_CONTEXT target; // Target process context
PVOID pSharedPage; // Address of kernel-shared page allocated from non-paged pool
PMDL pMDLShared; // MDL of kernel-shared page
HANDLE targetPipe; // Hook pipe handle in target process
LIST_ENTRY pageList; // List of REMAP_ENTRY structures
} PROCESS_MAP_ENTRY, *PPROCESS_MAP_ENTRY;
///
/// Mapped memory region info
///
typedef struct _MAP_ENTRY
{
LIST_ENTRY link; // Linked list link
MEMORY_BASIC_INFORMATION mem; // Original memory info
ULONG_PTR newPtr; // Mapped memory address in host process
PMDL pMdl; // Region MDL entry
BOOLEAN locked; // MDL is locked
BOOLEAN shared; // Regions has shared pages
BOOLEAN readonly; // Region must be mapped as readonly
} MAP_ENTRY, *PMAP_ENTRY;
extern DYNAMIC_DATA dynData;
extern RTL_AVL_TABLE g_ProcessPageTables;
extern KGUARDED_MUTEX g_globalLock;
///
/// Map entire address space of target process into current
///
/// Mapping params
/// Mapped context
/// Status code
NTSTATUS BBMapMemory( IN PMAP_MEMORY pRemap, OUT PPROCESS_MAP_ENTRY* ppEntry );
///
/// Map specific memory region
///
/// Region data
/// Mapping results
/// Status code
NTSTATUS BBMapMemoryRegion( IN PMAP_MEMORY_REGION pRegion, OUT PMAP_MEMORY_REGION_RESULT pResult );
///
/// Unmap any mapped memory from host and target processes
///
/// Request params
/// Status code
NTSTATUS BBUnmapMemory( IN PUNMAP_MEMORY pUnmap );
///
/// Unmap specific memory region
///
/// Region info
/// Status ode
NTSTATUS BBUnmapMemoryRegion( IN PUNMAP_MEMORY_REGION pRegion );
///
/// Calculate size required to store mapping info
///
/// Mapped regions list
/// Resulting size
/// Status code
NTSTATUS BBGetRequiredRemapOutputSize( IN PLIST_ENTRY pList, OUT PULONG_PTR pSize );
///
/// Enumerate committed, accessible, non-guarded memory regions
///
/// Region list
/// Region start
/// Region end
/// If set to FALSE, section objects will be excluded from list
/// Status code
NTSTATUS BBBuildProcessRegionListForRange( IN PLIST_ENTRY pList, IN ULONG_PTR start, IN ULONG_PTR end, IN BOOLEAN mapSections );
///
/// Search process entry in list by PID
///
/// PID.
/// If set to TRUE, pid is treated as host PID
/// Found entry, NULL in not found
PPROCESS_MAP_ENTRY BBLookupProcessEntry( IN HANDLE pid, IN BOOLEAN asHost );
///
/// Unmap all regions, delete MDLs, close handles, remove entry from table
///
/// Process entry
VOID BBCleanupProcessEntry( IN PPROCESS_MAP_ENTRY pProcessEntry );
///
/// Clear global process map table
///
VOID BBCleanupProcessTable();
///
/// Unmap any mapped pages from host process
///
/// Process entry
VOID BBCleanupHostProcess( IN PPROCESS_MAP_ENTRY pProcessEntry );
//
// AVL table routines
//
RTL_GENERIC_COMPARE_RESULTS AvlCompare( IN RTL_AVL_TABLE *Table, IN PVOID FirstStruct, IN PVOID SecondStruct );
PVOID AvlAllocate( IN RTL_AVL_TABLE *Table, IN CLONG ByteSize );
VOID AvlFree( IN RTL_AVL_TABLE *Table, IN PVOID Buffer );