mmfuncs.h File Reference

#include <umtypes.h>
#include <mmtypes.h>

Include dependency graph for mmfuncs.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
NTSTATUS NTAPI	MmCreateSection (_Out_ PVOID *SectionObject, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_ PLARGE_INTEGER MaximumSize, _In_ ULONG SectionPageProtection, _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle, _In_opt_ PFILE_OBJECT File)
NTSTATUS NTAPI	MmMapViewOfSection (_In_ PVOID SectionObject, _In_ PEPROCESS Process, _Inout_ PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ SECTION_INHERIT InheritDisposition, _In_ ULONG AllocationType, _In_ ULONG Protect)
NTSTATUS NTAPI	MmUnmapViewOfSection (_In_ struct _EPROCESS *Process, _In_ PVOID BaseAddress)
NTSYSCALLAPI NTSTATUS NTAPI	NtAreMappedFilesTheSame (_In_ PVOID File1MappedAsAnImage, _In_ PVOID File2MappedAsFile)
NTSTATUS NTAPI	NtAllocateUserPhysicalPages (_In_ HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, _Inout_ PULONG_PTR UserPfnArray)
_Must_inspect_result_ _At_ *	BaseAddress (Mem)) __kernel_entryNTSYSCALLAPINTSTATUSNTAPINtAllocateVirtualMemory(_In_ HANDLE ProcessHandle, _Inout_ _Outptr_result_buffer_(*RegionSize) PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _Inout_ PSIZE_T RegionSize, _In_ ULONG AllocationType, _In_ ULONG Protect
NTSYSCALLAPI NTSTATUS NTAPI	NtCreatePagingFile (_In_ PUNICODE_STRING FileName, _In_ PLARGE_INTEGER InitialSize, _In_ PLARGE_INTEGER MaxiumSize, _In_ ULONG Reserved)
_Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI	NtCreateSection (_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes, _In_opt_ PLARGE_INTEGER MaximumSize, _In_ ULONG SectionPageProtection, _In_ ULONG AllocationAttributes, _In_opt_ HANDLE FileHandle)
NTSYSCALLAPI NTSTATUS NTAPI	NtExtendSection (_In_ HANDLE SectionHandle, _In_ PLARGE_INTEGER NewMaximumSize)
NTSYSCALLAPI NTSTATUS NTAPI	NtFlushInstructionCache (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ SIZE_T NumberOfBytesToFlush)
NTSYSCALLAPI NTSTATUS NTAPI	NtFlushVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T RegionSize, _Out_ PIO_STATUS_BLOCK IoStatus)
NTSTATUS NTAPI	NtFreeUserPhysicalPages (_In_ HANDLE ProcessHandle, _Inout_ PULONG_PTR NumberOfPages, _Inout_ PULONG_PTR UserPfnArray)
__kernel_entry	_IRQL_requires_max_ (PASSIVE_LEVEL) NTSYSCALLAPI NTSTATUS NTAPI NtFreeVirtualMemory(_In_ HANDLE ProcessHandle
__kernel_entry _Inout_	__drv_freesMem (Mem) PVOID *BaseAddress
NTSTATUS NTAPI	NtGetWriteWatch (_In_ HANDLE ProcessHandle, _In_ ULONG Flags, _In_ PVOID BaseAddress, _In_ SIZE_T RegionSize, _In_ PVOID *UserAddressArray, _Out_ PULONG_PTR EntriesInUserAddressArray, _Out_ PULONG Granularity)
NTSYSCALLAPI NTSTATUS NTAPI	NtLockVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T NumberOfBytesToLock, _In_ ULONG MapType)
NTSTATUS NTAPI	NtMapUserPhysicalPages (_In_ PVOID VirtualAddresses, _In_ ULONG_PTR NumberOfPages, _Inout_ PULONG_PTR UserPfnArray)
NTSTATUS NTAPI	NtMapUserPhysicalPagesScatter (_In_ PVOID *VirtualAddresses, _In_ ULONG_PTR NumberOfPages, _Inout_ PULONG_PTR UserPfnArray)
NTSYSCALLAPI NTSTATUS NTAPI	NtMapViewOfSection (_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize, _Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize, _In_ SECTION_INHERIT InheritDisposition, _In_ ULONG AllocationType, _In_ ULONG AccessProtection)
NTSYSCALLAPI NTSTATUS NTAPI	NtOpenSection (_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSCALLAPI NTSTATUS NTAPI	NtProtectVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID *BaseAddress, _In_ SIZE_T *NumberOfBytesToProtect, _In_ ULONG NewAccessProtection, _Out_ PULONG OldAccessProtection)
NTSYSCALLAPI NTSTATUS NTAPI	NtQuerySection (_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_ PSIZE_T ResultLength)
NTSYSCALLAPI NTSTATUS NTAPI	NtQueryVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID Address, _In_ MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass, _Out_ PVOID VirtualMemoryInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
NTSYSCALLAPI NTSTATUS NTAPI	NtReadVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToRead, _Out_opt_ PSIZE_T NumberOfBytesRead)
NTSTATUS NTAPI	NtResetWriteWatch (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ SIZE_T RegionSize)
NTSYSCALLAPI NTSTATUS NTAPI	NtUnlockVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T NumberOfBytesToUnlock, _In_ ULONG MapType)
NTSYSCALLAPI NTSTATUS NTAPI	NtUnmapViewOfSection (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress)
NTSYSCALLAPI NTSTATUS NTAPI	NtWriteVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ PSIZE_T NumberOfBytesWritten)
NTSYSAPI NTSTATUS NTAPI	ZwAreMappedFilesTheSame (_In_ PVOID File1MappedAsAnImage, _In_ PVOID File2MappedAsFile)
NTSYSAPI NTSTATUS NTAPI	ZwCreatePagingFile (_In_ PUNICODE_STRING FileName, _In_ PLARGE_INTEGER InitialSize, _In_ PLARGE_INTEGER MaxiumSize, _In_ ULONG Reserved)
	_IRQL_requires_max_ (APC_LEVEL) NTSYSAPI NTSTATUS NTAPI ZwCreateSection(_Out_ PHANDLE SectionHandle
NTSYSAPI NTSTATUS NTAPI	ZwExtendSection (_In_ HANDLE SectionHandle, _In_ PLARGE_INTEGER NewMaximumSize)
NTSYSAPI NTSTATUS NTAPI	ZwLockVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T NumberOfBytesToLock, _In_ ULONG MapType)
NTSYSAPI NTSTATUS NTAPI	ZwOpenSection (_Out_ PHANDLE SectionHandle, _In_ ACCESS_MASK DesiredAccess, _In_ POBJECT_ATTRIBUTES ObjectAttributes)
NTSYSAPI NTSTATUS NTAPI	ZwProtectVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID *BaseAddress, _In_ SIZE_T *NumberOfBytesToProtect, _In_ ULONG NewAccessProtection, _Out_ PULONG OldAccessProtection)
NTSYSAPI NTSTATUS NTAPI	ZwQuerySection (_In_ HANDLE SectionHandle, _In_ SECTION_INFORMATION_CLASS SectionInformationClass, _Out_ PVOID SectionInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
NTSYSAPI NTSTATUS NTAPI	ZwQueryVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID Address, _In_ MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass, _Out_ PVOID VirtualMemoryInformation, _In_ SIZE_T Length, _Out_opt_ PSIZE_T ResultLength)
NTSYSAPI NTSTATUS NTAPI	ZwReadVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToRead, _Out_opt_ PSIZE_T NumberOfBytesRead)
NTSYSAPI NTSTATUS NTAPI	ZwUnlockVirtualMemory (_In_ HANDLE ProcessHandle, _Inout_ PVOID *BaseAddress, _Inout_ PSIZE_T NumberOfBytesToUnlock, _In_ ULONG MapType)
NTSYSAPI NTSTATUS NTAPI	ZwWriteVirtualMemory (_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _In_ PVOID Buffer, _In_ SIZE_T NumberOfBytesToWrite, _Out_opt_ PSIZE_T NumberOfBytesWritten)

Variables
__kernel_entry _Inout_ _Inout_ PSIZE_T	RegionSize
__kernel_entry _Inout_ _Inout_ PSIZE_T _In_ ULONG	FreeType
_In_ ACCESS_MASK	DesiredAccess
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER	MaximumSize
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG	SectionPageProtection
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG	AllocationAttributes
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_opt_ HANDLE	FileHandle
_In_ HANDLE	ProcessHandle
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID *	BaseAddress
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR	ZeroBits
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T	CommitSize
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER	SectionOffset
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T	ViewSize
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT	InheritDisposition
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG	AllocationType
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG _In_ ULONG	Win32Protect

Function Documentation

__drv_freesMem()

_IRQL_requires_same_ _In_ __drv_freesMem

(

Mem

)

_IRQL_requires_max_() [1/2]

__kernel_entry _IRQL_requires_max_

(

PASSIVE_LEVEL

)

Definition at line 64 of file Messaging.c.

{
    PFLT_SERVER_PORT_OBJECT PortObject;
    NTSTATUS Status;

    /* The caller must allow at least one connection */
    if (MaxConnections == 0)
    {
        return STATUS_INVALID_PARAMETER;
    }

    /* The request must be for a kernel handle */
    if (!(ObjectAttributes->Attributes & OBJ_KERNEL_HANDLE))
    {
        return STATUS_INVALID_PARAMETER;
    }

    /*
     * Get rundown protection on the target to stop the owner
     * from unloading whilst this port object is open. It gets
     * removed in the FltpServerPortClose callback
     */
    Status = FltObjectReference(Filter);
    if (!NT_SUCCESS(Status))
    {
        return Status;
    }

    /* Create the server port object for this filter */
    Status = ObCreateObject(KernelMode,
                            ServerPortObjectType,
                            ObjectAttributes,
                            KernelMode,
                            NULL,
                            sizeof(FLT_SERVER_PORT_OBJECT),
                            0,
                            0,
                            (PVOID *)&PortObject);
    if (NT_SUCCESS(Status))
    {
        /* Zero out the struct */
        RtlZeroMemory(PortObject, sizeof(FLT_SERVER_PORT_OBJECT));

        /* Increment the ref count on the target filter */
        FltpObjectPointerReference((PFLT_OBJECT)Filter);

        /* Setup the filter port object */
        PortObject->Filter = Filter;
        PortObject->ConnectNotify = ConnectNotifyCallback;
        PortObject->DisconnectNotify = DisconnectNotifyCallback;
        PortObject->MessageNotify = MessageNotifyCallback;
        PortObject->Cookie = ServerPortCookie;
        PortObject->MaxConnections = MaxConnections;

        /* Insert the object */
        Status = ObInsertObject(PortObject,
                                NULL,
                                STANDARD_RIGHTS_ALL | FILE_READ_DATA,
                                0,
                                NULL,
                                (PHANDLE)ServerPort);
        if (NT_SUCCESS(Status))
        {
            /* Lock the connection list */
            ExAcquireFastMutex(&Filter->ConnectionList.mLock);

            /* Add the new port object to the connection list and increment the count */
            InsertTailList(&Filter->ConnectionList.mList, &PortObject->FilterLink);
            Filter->ConnectionList.mCount++;

            /* Unlock the connection list*/
            ExReleaseFastMutex(&Filter->ConnectionList.mLock);
        }
    }

    if (!NT_SUCCESS(Status))
    {
        /* Allow the filter to be cleaned up */
        FltObjectDereference(Filter);
    }

    return Status;
}

_IRQL_requires_max_() [2/2]

_IRQL_requires_max_

(

APC_LEVEL

)

BaseAddress()

_Must_inspect_result_ _At_* BaseAddress

(

Mem

)

MmCreateSection()

NTSTATUS NTAPI MmCreateSection	(	_Out_ PVOID *	SectionObject,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_ PLARGE_INTEGER	MaximumSize,
		_In_ ULONG	SectionPageProtection,
		_In_ ULONG	AllocationAttributes,
		_In_opt_ HANDLE	FileHandle,
		_In_opt_ PFILE_OBJECT	File
	)

MmMapViewOfSection()

NTSTATUS NTAPI MmMapViewOfSection	(	_In_ PVOID	SectionObject,
		_In_ PEPROCESS	Process,
		_Inout_ PVOID *	BaseAddress,
		_In_ ULONG_PTR	ZeroBits,
		_In_ SIZE_T	CommitSize,
		_Inout_opt_ PLARGE_INTEGER	SectionOffset,
		_Inout_ PSIZE_T	ViewSize,
		_In_ SECTION_INHERIT	InheritDisposition,
		_In_ ULONG	AllocationType,
		_In_ ULONG	Protect
	)

MmUnmapViewOfSection()

NTSTATUS NTAPI MmUnmapViewOfSection	(	_In_ struct _EPROCESS *	Process,
		_In_ PVOID	BaseAddress
	)

NtAllocateUserPhysicalPages()

NTSTATUS NTAPI NtAllocateUserPhysicalPages	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PULONG_PTR	NumberOfPages,
		_Inout_ PULONG_PTR	UserPfnArray
	)

NtAreMappedFilesTheSame()

NTSYSCALLAPI NTSTATUS NTAPI NtAreMappedFilesTheSame	(	_In_ PVOID	File1MappedAsAnImage,
		_In_ PVOID	File2MappedAsFile
	)

NtCreatePagingFile()

NTSYSCALLAPI NTSTATUS NTAPI NtCreatePagingFile	(	_In_ PUNICODE_STRING	FileName,
		_In_ PLARGE_INTEGER	InitialSize,
		_In_ PLARGE_INTEGER	MaxiumSize,
		_In_ ULONG	Reserved
	)

NtCreateSection()

_Must_inspect_result_ __kernel_entry NTSYSCALLAPI NTSTATUS NTAPI NtCreateSection	(	_Out_ PHANDLE	SectionHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_opt_ POBJECT_ATTRIBUTES	ObjectAttributes,
		_In_opt_ PLARGE_INTEGER	MaximumSize,
		_In_ ULONG	SectionPageProtection,
		_In_ ULONG	AllocationAttributes,
		_In_opt_ HANDLE	FileHandle
	)

NtExtendSection()

NTSYSCALLAPI NTSTATUS NTAPI NtExtendSection	(	_In_ HANDLE	SectionHandle,
		_In_ PLARGE_INTEGER	NewMaximumSize
	)

NtFlushInstructionCache()

NTSYSCALLAPI NTSTATUS NTAPI NtFlushInstructionCache	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_In_ SIZE_T	NumberOfBytesToFlush
	)

NtFlushVirtualMemory()

NTSYSCALLAPI NTSTATUS NTAPI NtFlushVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	RegionSize,
		_Out_ PIO_STATUS_BLOCK	IoStatus
	)

NtFreeUserPhysicalPages()

NTSTATUS NTAPI NtFreeUserPhysicalPages	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PULONG_PTR	NumberOfPages,
		_Inout_ PULONG_PTR	UserPfnArray
	)

NtGetWriteWatch()

NTSTATUS NTAPI NtGetWriteWatch	(	_In_ HANDLE	ProcessHandle,
		_In_ ULONG	Flags,
		_In_ PVOID	BaseAddress,
		_In_ SIZE_T	RegionSize,
		_In_ PVOID *	UserAddressArray,
		_Out_ PULONG_PTR	EntriesInUserAddressArray,
		_Out_ PULONG	Granularity
	)

NtLockVirtualMemory()

NTSYSCALLAPI NTSTATUS NTAPI NtLockVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	NumberOfBytesToLock,
		_In_ ULONG	MapType
	)

NtMapUserPhysicalPages()

NTSTATUS NTAPI NtMapUserPhysicalPages	(	_In_ PVOID	VirtualAddresses,
		_In_ ULONG_PTR	NumberOfPages,
		_Inout_ PULONG_PTR	UserPfnArray
	)

NtMapUserPhysicalPagesScatter()

NTSTATUS NTAPI NtMapUserPhysicalPagesScatter	(	_In_ PVOID *	VirtualAddresses,
		_In_ ULONG_PTR	NumberOfPages,
		_Inout_ PULONG_PTR	UserPfnArray
	)

NtMapViewOfSection()

NTSYSCALLAPI NTSTATUS NTAPI NtMapViewOfSection	(	_In_ HANDLE	SectionHandle,
		_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_In_ ULONG_PTR	ZeroBits,
		_In_ SIZE_T	CommitSize,
		_Inout_opt_ PLARGE_INTEGER	SectionOffset,
		_Inout_ PSIZE_T	ViewSize,
		_In_ SECTION_INHERIT	InheritDisposition,
		_In_ ULONG	AllocationType,
		_In_ ULONG	AccessProtection
	)

NtOpenSection()

NTSYSCALLAPI NTSTATUS NTAPI NtOpenSection	(	_Out_ PHANDLE	SectionHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

NtProtectVirtualMemory()

NTSYSCALLAPI NTSTATUS NTAPI NtProtectVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID *	BaseAddress,
		_In_ SIZE_T *	NumberOfBytesToProtect,
		_In_ ULONG	NewAccessProtection,
		_Out_ PULONG	OldAccessProtection
	)

NtQuerySection()

NTSYSCALLAPI NTSTATUS NTAPI NtQuerySection	(	_In_ HANDLE	SectionHandle,
		_In_ SECTION_INFORMATION_CLASS	SectionInformationClass,
		_Out_ PVOID	SectionInformation,
		_In_ SIZE_T	Length,
		_Out_ PSIZE_T	ResultLength
	)

NtQueryVirtualMemory()

NTSYSCALLAPI NTSTATUS NTAPI NtQueryVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	Address,
		_In_ MEMORY_INFORMATION_CLASS	VirtualMemoryInformationClass,
		_Out_ PVOID	VirtualMemoryInformation,
		_In_ SIZE_T	Length,
		_Out_opt_ PSIZE_T	ResultLength
	)

NtReadVirtualMemory()

NTSYSCALLAPI NTSTATUS NTAPI NtReadVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_Out_ PVOID	Buffer,
		_In_ SIZE_T	NumberOfBytesToRead,
		_Out_opt_ PSIZE_T	NumberOfBytesRead
	)

NtResetWriteWatch()

NTSTATUS NTAPI NtResetWriteWatch	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_In_ SIZE_T	RegionSize
	)

NtUnlockVirtualMemory()

NTSYSCALLAPI NTSTATUS NTAPI NtUnlockVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	NumberOfBytesToUnlock,
		_In_ ULONG	MapType
	)

NtUnmapViewOfSection()

NTSYSCALLAPI NTSTATUS NTAPI NtUnmapViewOfSection	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress
	)

NtWriteVirtualMemory()

NTSYSCALLAPI NTSTATUS NTAPI NtWriteVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_In_ PVOID	Buffer,
		_In_ SIZE_T	NumberOfBytesToWrite,
		_Out_opt_ PSIZE_T	NumberOfBytesWritten
	)

ZwAreMappedFilesTheSame()

NTSYSAPI NTSTATUS NTAPI ZwAreMappedFilesTheSame	(	_In_ PVOID	File1MappedAsAnImage,
		_In_ PVOID	File2MappedAsFile
	)

Referenced by LdrpCheckForLoadedDll().

ZwCreatePagingFile()

NTSYSAPI NTSTATUS NTAPI ZwCreatePagingFile	(	_In_ PUNICODE_STRING	FileName,
		_In_ PLARGE_INTEGER	InitialSize,
		_In_ PLARGE_INTEGER	MaxiumSize,
		_In_ ULONG	Reserved
	)

ZwExtendSection()

NTSYSAPI NTSTATUS NTAPI ZwExtendSection	(	_In_ HANDLE	SectionHandle,
		_In_ PLARGE_INTEGER	NewMaximumSize
	)

ZwLockVirtualMemory()

NTSYSAPI NTSTATUS NTAPI ZwLockVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	NumberOfBytesToLock,
		_In_ ULONG	MapType
	)

ZwOpenSection()

NTSYSAPI NTSTATUS NTAPI ZwOpenSection	(	_Out_ PHANDLE	SectionHandle,
		_In_ ACCESS_MASK	DesiredAccess,
		_In_ POBJECT_ATTRIBUTES	ObjectAttributes
	)

Referenced by CmpInitializeMachineDependentConfiguration(), IntVideoPortMapPhysicalMemory(), SystemProcessWorker(), TestPhysicalMemorySection(), and VdmpInitialize().

ZwProtectVirtualMemory()

NTSYSAPI NTSTATUS NTAPI ZwProtectVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID *	BaseAddress,
		_In_ SIZE_T *	NumberOfBytesToProtect,
		_In_ ULONG	NewAccessProtection,
		_Out_ PULONG	OldAccessProtection
	)

Referenced by LdrpSetProtection(), RtlpCreateUserStack(), and RtlpDphProtectVm().

ZwQuerySection()

NTSYSAPI NTSTATUS NTAPI ZwQuerySection	(	_In_ HANDLE	SectionHandle,
		_In_ SECTION_INFORMATION_CLASS	SectionInformationClass,
		_Out_ PVOID	SectionInformation,
		_In_ SIZE_T	Length,
		_Out_opt_ PSIZE_T	ResultLength
	)

Referenced by LdrpCreateDllSection(), and RtlCreateUserProcess().

ZwQueryVirtualMemory()

NTSYSAPI NTSTATUS NTAPI ZwQueryVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	Address,
		_In_ MEMORY_INFORMATION_CLASS	VirtualMemoryInformationClass,
		_Out_ PVOID	VirtualMemoryInformation,
		_In_ SIZE_T	Length,
		_Out_opt_ PSIZE_T	ResultLength
	)

Referenced by RtlCreateHeap(), RtlDebugCreateHeap(), and RtlpDphCoalesceNodeIntoAvailable().

ZwReadVirtualMemory()

NTSYSAPI NTSTATUS NTAPI ZwReadVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_Out_ PVOID	Buffer,
		_In_ SIZE_T	NumberOfBytesToRead,
		_Out_opt_ PSIZE_T	NumberOfBytesRead
	)

ZwUnlockVirtualMemory()

NTSYSAPI NTSTATUS NTAPI ZwUnlockVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_Inout_ PVOID *	BaseAddress,
		_Inout_ PSIZE_T	NumberOfBytesToUnlock,
		_In_ ULONG	MapType
	)

ZwWriteVirtualMemory()

NTSYSAPI NTSTATUS NTAPI ZwWriteVirtualMemory	(	_In_ HANDLE	ProcessHandle,
		_In_ PVOID	BaseAddress,
		_In_ PVOID	Buffer,
		_In_ SIZE_T	NumberOfBytesToWrite,
		_Out_opt_ PSIZE_T	NumberOfBytesWritten
	)

Referenced by RtlInitializeContext(), and RtlpInitEnvironment().

Variable Documentation

AllocationAttributes

_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG AllocationAttributes

Definition at line 360 of file mmfuncs.h.

Referenced by MiCreatePagingFileMap(), MmCreateArm3Section(), MmCreateCacheSection(), MmCreateDataFileSection(), MmCreateImageSection(), MmCreatePageFileSection(), MmCreateSection(), MmGetFileNameForSection(), MmSelectMappingAddress(), and NtCreateSection().

AllocationType

_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG AllocationType

Definition at line 404 of file mmfuncs.h.

Referenced by _MiMapViewOfSegment(), KmtInitTestContext(), MiInsertVadEx(), MiMapViewOfDataSection(), MmMapViewOfArm3Section(), MmMapViewOfSection(), MmMapViewOfSegment(), NtAllocateVirtualMemory(), NtMapViewOfSection(), and StressTesting().

BaseAddress

_Inout_ PVOID * BaseAddress

Definition at line 404 of file mmfuncs.h.

Referenced by $endif(), __RtlImageDirectoryEntryToData(), __RtlImageRvaToVa(), _IRQL_requires_max_(), _MiFlushMappedSection(), _MiMapViewOfSegment(), AdvancedErrorChecks(), AVrfpIsVerifierProviderDll(), AVrfpLdrGetProcedureAddress(), BehaviorChecks(), BiosDiskService(), BiosMiscService(), BiosMouseEnable(), BlImgLoadImageWithProgress2(), CalcCheckSum(), can_enumerate(), CcCopyData(), CcPerformReadAhead(), CcPreparePinWrite(), CcpUnpinData(), CcRosGetVacb(), CcRosMapVacbInKernelSpace(), CcRosRequestVacb(), CheckAdjacentVADs(), CheckAlignment(), CheckSize(), CheckSomeDefaultAddresses(), CheckSumMappedFile(), CmpInitializeMachineDependentConfiguration(), CpuExceptionFilter(), CreateProcessInternalW(), DbgkMapViewOfSection(), DbgkUnMapViewOfSection(), DECLARE_INTERFACE_(), DiskBios32Post(), DosBIOSInitialize(), DosClonePsp(), DosCreatePsp(), DosInt21h(), DosLoadExecutableInternal(), DosMouseCleanup(), DosMouseDisable(), DosMouseEnable(), DosMouseInitialize(), DosTerminateProcess(), ExLockUserBuffer(), ExpComputePartialHashForAddress(), FAT12CountAvailableClusters(), FAT12FindAndMarkAvailableCluster(), FAT12GetNextCluster(), FAT12WriteCluster(), FAT16CountAvailableClusters(), FAT16FindAndMarkAvailableCluster(), FAT16GetNextCluster(), FAT16WriteCluster(), FAT32CountAvailableClusters(), FAT32FindAndMarkAvailableCluster(), FAT32GetNextCluster(), FAT32WriteCluster(), FileSectionViewPermissionCheck(), find_entry(), FlushViewOfFile(), GetEbdaLocation(), GetProcessVersion(), HalpMapPhysicalMemory64Vista(), HandlePageFault(), IMAGEHLP_RecalculateChecksum(), InitializeBiosInt32(), InitializeModeTable(), IntAgpCommitVirtual(), IntAgpFreeVirtual(), IntVideoPortImageDirectoryEntryToData(), IopLoadServiceModule(), IopLoadUnloadDriver(), is_data_file_module(), KdpSysReadControlSpace(), KdpSysWriteControlSpace(), Ke386SetGdtEntryBase(), KeSweepICache(), LdrAccessResource(), LdrAddRefDll(), LdrDisableThreadCalloutsForDll(), LdrFindResource_U(), LdrFindResourceDirectory_U(), LdrGetProcedureAddress(), LdrLoadDll(), LdrpAccessResource(), LdrpAllocateDataTableEntry(), LdrpCallInitRoutine(), LdrPEGetExportByName(), LdrpFetchAddressOfSecurityCookie(), LdrpGetProcedureAddress(), LdrpLoadDll(), LdrRelocateImage(), LdrRelocateImageWithBias(), LdrUnloadDll(), LdrVerifyMappedImageMatchesChecksum(), LlbAllocateMemoryEntry(), LoadModule(), LoadOle32Export(), main(), MapFileAndCheckSumA(), MapFileAndCheckSumW(), MemCleanup(), MemInitialize(), MiAddHalIoMappings(), MiAllocateContiguousMemory(), MiBuildPfnDatabaseFromPages(), MiCacheImageSymbols(), MiCheckForContiguousMemory(), MiCheckVadsForLockOperation(), MiCreateArm3StaticMemoryArea(), MiCreatePebOrTeb(), MiFindContiguousMemory(), MiFreeContiguousMemory(), MiInsertVadEx(), MiLoadUserSymbols(), MiLockVirtualMemory(), MiMapLockedPagesInUserSpace(), MiMapViewOfDataSection(), MiProtectVirtualMemory(), MiQueryMemoryBasicInformation(), MiQueryMemorySectionName(), MiReadPage(), MiRemoveMappedPtes(), MiRosCleanupMemoryArea(), MiRosProtectVirtualMemory(), MiRosUnmapViewOfSection(), MiUnlockVirtualMemory(), MiUnmapLockedPagesInUserSpace(), MiUnmapViewOfSection(), MmAllocateNonCachedMemory(), MmAlterRegion(), MmAlterViewAttributes(), MmCreateKernelStack(), MmCreateMemoryArea(), MmFindRegion(), MmFreeContiguousMemory(), MmFreeContiguousMemorySpecifyCache(), MmFreeNonCachedMemory(), MmMapIoSpace(), MmMapLockedPagesSpecifyCache(), MmMapViewOfArm3Section(), MmMapViewOfSection(), MmMapViewOfSegment(), MmPapAllocatePagesInRange(), MmPapAllocatePhysicalPagesInRange(), MmProtectSectionView(), MmUnloadSystemImage(), MmUnmapIoSpace(), MmUnmapLockedPages(), MmUnmapVideoDisplay(), MmUnmapViewOfCacheSegment(), MmUnmapViewOfSection(), MmUnmapViewOfSegment(), MmVerifyImageIsOkForMpUse(), NtFlushInstructionCache(), NtFlushVirtualMemory(), NtGetVersionResource(), NtGetWriteWatch(), NtLockVirtualMemory(), NtMapViewOfSection(), NtProtectVirtualMemory(), NtQueryVirtualMemory(), NtReadVirtualMemory(), NtResetWriteWatch(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtWriteVirtualMemory(), OpenAndMapFile(), PageFileBehaviorChecks(), PcMemGetBiosMemoryMap(), PpcGetMemoryMap(), PropertyLengthAsVariant(), RamdiskCreateDiskDevice(), RamdiskGetPartitionInfo(), RamdiskReadWriteReal(), RamdiskSetPartitionInfo(), RamdiskUnmapPages(), ReadWriteOrZero(), ReserveMemory(), RtlConvertPropertyToVariant(), RtlConvertVariantToProperty(), RtlDebugGetUserInfoHeap(), RtlDebugSetUserFlagsHeap(), RtlDebugSetUserValueHeap(), RtlDestroyHeap(), RtlFindMessage(), RtlGetUserInfoHeap(), RtlImageDirectoryEntryToData(), RtlImageRvaToVa(), RtlpDebugPageHeapValidate(), RtlpDestroyHeapSegment(), RtlpDphNormalHeapValidate(), RtlpInitEnvironment(), RtlpPageHeapGetUserInfo(), RtlpPageHeapSetUserFlags(), RtlpPageHeapSetUserValue(), RtlpPageHeapSize(), RtlSetUserFlagsHeap(), RtlSetUserValueHeap(), ScrCreate(), ScrLoadFontTable(), SE_IsShimDll(), SeiCheckComPlusImage(), SeiCreateShimModuleInfo(), SeiFindHookModuleInfo(), SeiGetShimModuleInfo(), SeiInit(), SerialDetectUartType(), SetMemory(), SimpleErrorChecks(), START_TEST(), supports_rsym(), SystemProcessWorker(), Test_ImageSection2(), test_pack_MEMORY_BASIC_INFORMATION(), Test_PageFileSection(), Test_SectionContents(), test_SymFromAddr(), test_SymFromName(), test_SymRegCallback(), Test_Truncate(), TestMap(), UnMapFile(), VbeGetVideoMemoryBaseAddress(), VbeSetMode(), VdmpInitialize(), VidBiosDrawGlyph(), VidBiosPost(), VidBiosSetVideoMode(), VidBiosVideoService(), VideoPortLockBuffer(), VirtualLock(), VirtualUnlock(), and Write().

CommitSize

_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T CommitSize

Definition at line 404 of file mmfuncs.h.

Referenced by _Function_class_(), MiMapViewOfDataSection(), MmMapViewOfArm3Section(), MmMapViewOfSection(), NtMapViewOfSection(), RtlCreateHeap(), RtlDebugCreateHeap(), RtlpCreateUnCommittedRange(), RtlpExtendHeap(), and RtlpPageHeapCreate().

DesiredAccess

_In_ ACCESS_MASK DesiredAccess

Definition at line 360 of file mmfuncs.h.

FileHandle

_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG _In_ ULONG _In_opt_ HANDLE FileHandle

Definition at line 360 of file mmfuncs.h.

FreeType

_Inout_ _Inout_ PSIZE_T _In_ ULONG FreeType

Definition at line 172 of file mmfuncs.h.

Referenced by DnsFree(), NtFreeVirtualMemory(), and Test_NtFreeVirtualMemory_Parameters().

InheritDisposition

_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT InheritDisposition

Definition at line 404 of file mmfuncs.h.

Referenced by MiMapViewOfDataSection(), MmMapViewOfArm3Section(), MmMapViewOfSection(), and NtMapViewOfSection().

MaximumSize

_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER MaximumSize

Definition at line 360 of file mmfuncs.h.

Referenced by AdvancedErrorChecks(), BehaviorChecks(), FileSectionViewPermissionCheck(), FrLdrHeapCreate(), IoEnumerateRegisteredFiltersList(), MiCreatePagingFileMap(), MmCreateCacheSection(), MmCreateDataFileSection(), MmCreatePageFileSection(), MmCreateSection(), NtCreatePagingFile(), NtCreateSection(), SimpleErrorChecks(), SmpMakeSystemManagedPagingFileDescriptor(), START_TEST(), StorPortLogSystemEvent(), Test_BasedSection(), Test_ImageSection2(), Test_PageFileSection(), and TestCreateSection().

ObjectAttributes

_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES ObjectAttributes

Definition at line 360 of file mmfuncs.h.

ProcessHandle

_In_ HANDLE ProcessHandle

Definition at line 403 of file mmfuncs.h.

Referenced by BaseCheckForVDM(), BasepReplaceProcessThreadTokens(), BasePushProcessParameters(), ConDrvCreateScreenBuffer(), CreateProcessInternalW(), CSR_API(), GetProcessVersion(), GRAPHICS_BUFFER_Initialize(), IntAgpReserveVirtual(), IntVideoPortMapMemory(), IsProcessInJob(), LsapCheckLogonProcess(), LsapEnumLogonSessions(), LsapGetLogonSessionData(), MiQueryMemoryBasicInformation(), MiQueryMemorySectionName(), NtAllocateVirtualMemory(), NtAssignProcessToJobObject(), NtCreateProcess(), NtCreateProcessEx(), NtCreateThread(), NtDebugActiveProcess(), NtFlushInstructionCache(), NtFlushVirtualMemory(), NtFreeVirtualMemory(), NtGetWriteWatch(), NtIsProcessInJob(), NtLockVirtualMemory(), NtMapViewOfSection(), NtOpenProcess(), NtOpenProcessToken(), NtOpenProcessTokenEx(), NtProtectVirtualMemory(), NtQueryInformationProcess(), NtQueryVirtualMemory(), NtReadVirtualMemory(), NtRemoveProcessDebug(), NtResetWriteWatch(), NtResumeProcess(), NtSetInformationProcess(), NtSuspendProcess(), NtTerminateProcess(), NtUnlockVirtualMemory(), NtUnmapViewOfSection(), NtUserProcessConnect(), NtUserResolveDesktop(), NtWriteVirtualMemory(), OpenProcess(), OpenProcessToken(), ProcessIdToSessionId(), PsaEnumerateProcessModules(), PsCreateSystemProcess(), PsCreateSystemThread(), PsOpenTokenOfProcess(), PspCreateProcess(), PspCreateThread(), RtlCreateUserThread(), RtlFreeUserThreadStack(), RtlInitializeContext(), RtlpInitEnvironment(), RtlpQueryRemoteProcessModules(), SmpExecPgm(), SmpGetProcessMuSessionId(), SmpHandleConnectionRequest(), SmpInit(), SmpSetProcessMuSessionId(), StuffStdHandle(), TEXTMODE_BUFFER_Initialize(), WahOpenCurrentThread(), and wait_process_handle().

RegionSize

_Inout_ PVOID _Inout_ PSIZE_T RegionSize

Definition at line 172 of file mmfuncs.h.

Referenced by BaseCreateVDMEnvironment(), CopyLoop(), CreateProcessInternalW(), CustomBaseAllocation(), KmtInitTestContext(), MiCheckVadsForLockOperation(), MiLockVirtualMemory(), MiUnlockVirtualMemory(), MiUnmapViewOfSection(), MmAlterViewAttributes(), MmMdRemoveRegionFromMdlEx(), NtGetWriteWatch(), NtResetWriteWatch(), RtlCreateEnvironment(), SetupCopyFile(), SimpleAllocation(), SimpleErrorChecks(), StressTesting(), test_pack_MEMORY_BASIC_INFORMATION(), VirtualLock(), VirtualUnlock(), Write(), and WriteProcessMemory().

SectionOffset

_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER SectionOffset

Definition at line 404 of file mmfuncs.h.

Referenced by AdvancedErrorChecks(), BehaviorChecks(), DIB_CreateDIBSection(), ExpInitNls(), MapViewOfFileEx(), MiLoadImageSection(), MiMapViewOfDataSection(), MmCreatePeb(), MmMapViewOfArm3Section(), MmMapViewOfSection(), NtAcceptConnectPort(), NtMapViewOfSection(), NtSecureConnectPort(), PageFileBehaviorChecks(), SimpleErrorChecks(), SystemProcessWorker(), Test_BasedSection(), Test_ImageSection2(), Test_PageFileSection(), and Test_SectionContents().

SectionPageProtection

_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_opt_ PLARGE_INTEGER _In_ ULONG SectionPageProtection

Definition at line 360 of file mmfuncs.h.

Referenced by MiArm3GetCorrectFileAccessMask(), MiIsProtectionCompatible(), MmCreateArm3Section(), MmCreateCacheSection(), MmCreateDataFileSection(), MmCreateImageSection(), MmCreatePageFileSection(), MmCreateSection(), NtCreateSection(), and OpenAndMapFile().

ViewSize

_Must_inspect_result_ _Outptr_result_bytebuffer_ ViewSize PVOID _Inout_ PSIZE_T ViewSize

Definition at line 404 of file mmfuncs.h.

Referenced by _Function_class_(), _MiMapViewOfSegment(), AdvancedErrorChecks(), BasepLoadLibraryAsDatafile(), BehaviorChecks(), CcpMapData(), CmpInitializeMachineDependentConfiguration(), ConDrvGetConsoleScreenBufferInfo(), CSR_API(), CsrSrvAttachSharedSection(), CsrSrvCreateSharedSection(), ExpInitNls(), FileSectionViewPermissionCheck(), GRAPHICS_BUFFER_Initialize(), GuiApplyUserSettings(), GuiConsoleShowConsoleProperties(), Heap32ListFirst(), Heap32ListNext(), IntGdiAddFontResource(), IntMapDesktopView(), IntUserHeapCreate(), LdrpCheckForLoadedDll(), LdrpMapDll(), LdrVerifyImageMatchesChecksum(), MapGlobalUserHeap(), MapViewOfFileEx(), MiInsertVadEx(), MiLoadImageSection(), MiMapViewInSystemSpace(), MiMapViewOfDataSection(), MmCheckSystemImage(), MmCommitSessionMappedView(), MmCreatePeb(), MmInitializeProcessAddressSpace(), MmMapCacheViewInSystemSpaceAtOffset(), MmMapViewInSessionSpace(), MmMapViewInSystemSpace(), MmMapViewOfArm3Section(), MmMapViewOfSection(), MmMapViewOfSegment(), Module32FirstW(), Module32NextW(), NtMapViewOfSection(), OpenAndMapFile(), PageFileBehaviorChecks(), Process32FirstW(), Process32NextW(), PspMapSystemDll(), RtlCreateQueryDebugBuffer(), RtlDestroyQueryDebugBuffer(), SimpleErrorChecks(), SystemProcessWorker(), Test_BasedSection(), Test_ImageSection(), Test_ImageSection2(), Test_PageFileSection(), Test_SectionContents(), Test_Truncate(), TestPhysicalMemorySection(), TH32CreateSnapshotSectionInitialize(), Thread32First(), Thread32Next(), and VdmpInitialize().

Win32Protect

_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T _In_ SECTION_INHERIT _In_ ULONG _In_ ULONG Win32Protect

Definition at line 404 of file mmfuncs.h.

ZeroBits

_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR ZeroBits

Definition at line 404 of file mmfuncs.h.

Referenced by MiMapViewOfDataSection(), MmMapViewOfArm3Section(), MmMapViewOfSection(), NtAllocateVirtualMemory(), NtMapViewOfSection(), and Test_PageFileSection().