mapping.h File Reference

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	_ENGSECTION
struct	_FILEVIEW
struct	_FONTFILEVIEW

Typedefs
typedef struct _ENGSECTION	ENGSECTION
typedef struct _ENGSECTION *	PENGSECTION
typedef struct _FILEVIEW	FILEVIEW
typedef struct _FILEVIEW *	PFILEVIEW
typedef struct _FONTFILEVIEW	FONTFILEVIEW
typedef struct _FONTFILEVIEW *	PFONTFILEVIEW

Enumerations
enum	{ FVF_SYSTEMROOT = 1 , FVF_READONLY = 2 , FVF_FONTFILE = 4 }

Functions
PVOID NTAPI	EngMapSectionView (_In_ HANDLE hSection, _In_ SIZE_T cjSize, _In_ ULONG cjOffset, _Out_ PHANDLE phSecure)
VOID NTAPI	EngUnmapSectionView (_In_ PVOID pvBits, _In_ ULONG cjOffset, _In_ HANDLE hSecure)
PVOID NTAPI	EngCreateSection (_In_ ULONG fl, _In_ SIZE_T cjSize, _In_ ULONG ulTag)
	_Success_ (return!=FALSE) BOOL APIENTRY EngMapSection(_In_ PVOID pvSection
_In_ BOOL _In_ HANDLE	_When_ (bMap, _Outptr_) PVOID *pvBaseAddress)
BOOL APIENTRY	EngFreeSectionMem (_In_opt_ PVOID pvSection, _In_opt_ PVOID pvMappedBase)
_Check_return_ PFILEVIEW NTAPI	EngLoadModuleEx (_In_z_ LPWSTR pwsz, _In_ ULONG cjSizeOfModule, _In_ FLONG fl)

Variables
_In_ BOOL	bMap
_In_ BOOL _In_ HANDLE	hProcess
_Check_return_ _In_ ULONG	fl
_Check_return_ _In_ ULONG _In_ SIZE_T	cjSize
_Check_return_ _In_ ULONG _In_ SIZE_T _In_ ULONG	ulTag

Typedef Documentation

ENGSECTION

typedef struct _ENGSECTION ENGSECTION

FILEVIEW

typedef struct _FILEVIEW FILEVIEW

FONTFILEVIEW

typedef struct _FONTFILEVIEW FONTFILEVIEW

PENGSECTION

typedef struct _ENGSECTION * PENGSECTION

PFILEVIEW

typedef struct _FILEVIEW * PFILEVIEW

PFONTFILEVIEW

typedef struct _FONTFILEVIEW * PFONTFILEVIEW

Enumeration Type Documentation

anonymous enum

anonymous enum

Enumerator
FVF_SYSTEMROOT
FVF_READONLY
FVF_FONTFILE

Definition at line 36 of file mapping.h.

{
    FVF_SYSTEMROOT = 1,
    FVF_READONLY = 2,
    FVF_FONTFILE = 4,
};

Function Documentation

_Success_()

_Success_

(

return!

= FALSE

)

_When_()

_In_ BOOL _In_ HANDLE _When_	(	bMap	,
		_Outptr_
	)

EngCreateSection()

PVOID NTAPI EngCreateSection	(	_In_ ULONG	fl,
		_In_ SIZE_T	cjSize,
		_In_ ULONG	ulTag
	)

Definition at line 91 of file mapping.c.

{
    NTSTATUS Status;
    PENGSECTION pSection;
    PVOID pvSectionObject;
    LARGE_INTEGER liSize;
 
    /* Allocate a section object */
    pSection = EngAllocMem(0, sizeof(ENGSECTION), 'stsU');
    if (!pSection) return NULL;
 
    liSize.QuadPart = cjSize;
    Status = MmCreateSection(&pvSectionObject,
                             SECTION_ALL_ACCESS,
                             NULL,
                             &liSize,
                             PAGE_READWRITE,
                             SEC_COMMIT,
                             NULL,
                             NULL);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to create a section Status=0x%x\n", Status);
        EngFreeMem(pSection);
        return NULL;
    }
 
    /* Set the fields of the section */
    pSection->ulTag = ulTag;
    pSection->pvSectionObject = pvSectionObject;
    pSection->pvMappedBase = NULL;
    pSection->cjViewSize = cjSize;
 
    return pSection;
}

EngFreeSectionMem()

BOOL APIENTRY EngFreeSectionMem	(	_In_opt_ PVOID	pvSection,
		_In_opt_ PVOID	pvMappedBase
	)

Definition at line 246 of file mapping.c.

{
    NTSTATUS Status;
    PENGSECTION pSection = pvSection;
    BOOL bResult = TRUE;
 
    /* Did the caller give us a mapping base? */
    if (pvMappedBase)
    {
        Status = MmUnmapViewInSessionSpace(pvMappedBase);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("MmUnmapViewInSessionSpace failed: 0x%lx\n", Status);
            bResult = FALSE;
        }
    }
 
    /* Check if we should free the section as well */
    if (pSection)
    {
        /* Dereference the kernel section */
        ObDereferenceObject(pSection->pvSectionObject);
 
        /* Finally free the section memory itself */
        EngFreeMem(pSection);
    }
 
    return bResult;
}

Referenced by _Success_(), SURFACE_AllocSurface(), and SURFACE_vCleanup().

EngLoadModuleEx()

_Check_return_ PFILEVIEW NTAPI EngLoadModuleEx	(	_In_z_ LPWSTR	pwsz,
		_In_ ULONG	cjSizeOfModule,
		_In_ FLONG	fl
	)

Definition at line 329 of file mapping.c.

{
    PFILEVIEW pFileView = NULL;
    OBJECT_ATTRIBUTES ObjectAttributes;
    HANDLE hRootDir;
    UNICODE_STRING ustrFileName;
    IO_STATUS_BLOCK IoStatusBlock;
    FILE_BASIC_INFORMATION FileInformation;
    HANDLE hFile;
    NTSTATUS Status;
    LARGE_INTEGER liSize;
 
    if (fl & FVF_FONTFILE)
    {
        pFileView = EngAllocMem(0, sizeof(FONTFILEVIEW), 'vffG');
    }
    else
    {
        pFileView = EngAllocMem(0, sizeof(FILEVIEW), 'liFg');
    }
 
    /* Check for success */
    if (!pFileView) return NULL;
 
    /* Check if the file is relative to system32 */
    if (fl & FVF_SYSTEMROOT)
    {
        hRootDir = ghSystem32Directory;
    }
    else
    {
        hRootDir = ghRootDirectory;
    }
 
    /* Initialize unicode string and object attributes */
    RtlInitUnicodeString(&ustrFileName, pwsz);
    InitializeObjectAttributes(&ObjectAttributes,
                               &ustrFileName,
                               OBJ_CASE_INSENSITIVE|OBJ_KERNEL_HANDLE,
                               hRootDir,
                               NULL);
 
    /* Now open the file */
    Status = ZwCreateFile(&hFile,
                          FILE_READ_DATA,
                          &ObjectAttributes,
                          &IoStatusBlock,
                          NULL,
                          FILE_ATTRIBUTE_NORMAL,
                          0,
                          FILE_OPEN,
                          FILE_NON_DIRECTORY_FILE,
                          NULL,
                          0);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to open file, hFile=%p, Status=0x%x\n", hFile, Status);
        EngFreeMem(pFileView);
        return NULL;
    }
 
    Status = ZwQueryInformationFile(hFile,
                                    &IoStatusBlock,
                                    &FileInformation,
                                    sizeof(FILE_BASIC_INFORMATION),
                                    FileBasicInformation);
    if (NT_SUCCESS(Status))
    {
        pFileView->LastWriteTime = FileInformation.LastWriteTime;
    }
 
    /* Create a section from the file */
    liSize.QuadPart = cjSizeOfModule;
    Status = MmCreateSection(&pFileView->pSection,
                             SECTION_ALL_ACCESS,
                             NULL,
                             &liSize,
                             fl & FVF_READONLY ? PAGE_EXECUTE_READ : PAGE_EXECUTE_READWRITE,
                             SEC_COMMIT,
                             hFile,
                             NULL);
 
    /* Close the file handle */
    ZwClose(hFile);
 
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Failed to create a section Status=0x%x\n", Status);
        EngFreeMem(pFileView);
        return NULL;
    }
 
 
    pFileView->pvKView = NULL;
    pFileView->pvViewFD = NULL;
    pFileView->cjView = 0;
 
    return pFileView;
}

Referenced by _Success_(), EngLoadModule(), and EngLoadModuleForWrite().

EngMapSectionView()

PVOID NTAPI EngMapSectionView	(	_In_ HANDLE	hSection,
		_In_ SIZE_T	cjSize,
		_In_ ULONG	cjOffset,
		_Out_ PHANDLE	phSecure
	)

Definition at line 19 of file mapping.c.

{
    LARGE_INTEGER liSectionOffset;
    PVOID pvBaseAddress;
    NTSTATUS Status;
 
    /* Check if the size is ok (for 64 bit) */
    if (cjSize > ULONG_MAX)
    {
        DPRINT1("chSize out of range: 0x%Id\n", cjSize);
        return NULL;
    }
 
    /* Align the offset at allocation granularity and compensate for the size */
    liSectionOffset.QuadPart = cjOffset & ~(MM_ALLOCATION_GRANULARITY - 1);
    cjSize += cjOffset & (MM_ALLOCATION_GRANULARITY - 1);
 
    /* Map the section */
    Status = ZwMapViewOfSection(hSection,
                                NtCurrentProcess(),
                                &pvBaseAddress,
                                0,
                                cjSize,
                                &liSectionOffset,
                                &cjSize,
                                ViewShare,
                                0,
                                PAGE_READWRITE);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("ZwMapViewOfSection failed (0x%lx)\n", Status);
        return NULL;
    }
 
    /* Secure the section memory */
    *phSecure = EngSecureMem(pvBaseAddress, (ULONG)cjSize);
    if (!*phSecure)
    {
        ZwUnmapViewOfSection(NtCurrentProcess(), pvBaseAddress);
        return NULL;
    }
 
    /* Return the address where the requested data starts */
    return (PUCHAR)pvBaseAddress + (cjOffset & (MM_ALLOCATION_GRANULARITY - 1));
}

EngUnmapSectionView()

VOID NTAPI EngUnmapSectionView	(	_In_ PVOID	pvBits,
		_In_ ULONG	cjOffset,
		_In_ HANDLE	hSecure
	)

Definition at line 71 of file mapping.c.

{
    NTSTATUS Status;
 
    /* Unsecure the memory */
    EngUnsecureMem(hSecure);
 
    /* Calculate the real start of the section view */
    pvBits = (PUCHAR)pvBits - (cjOffset & (MM_ALLOCATION_GRANULARITY - 1));
 
    /* Unmap the section view */
    Status = MmUnmapViewOfSection(PsGetCurrentProcess(), pvBits);
    ASSERT(NT_SUCCESS(Status));
}

Referenced by SURFACE_vCleanup().

Variable Documentation

bMap

_In_ BOOL bMap

Definition at line 70 of file mapping.h.

Referenced by _Success_().

cjSize

_Check_return_ _In_ ULONG _In_ SIZE_T cjSize

Definition at line 83 of file mapping.h.

fl

_Check_return_ _In_ ULONG fl

Definition at line 82 of file mapping.h.

hProcess

_In_ BOOL _In_ HANDLE hProcess

Definition at line 71 of file mapping.h.

Referenced by _DoDLLInjection(), _Success_(), _tWinMain(), CIconWatcher::AddIconToWatcher(), AllocateUserPhysicalPages(), AssignProcessToJobObject(), BaseCreateStack(), BaseFreeThreadStack(), CheckRemoteDebuggerPresent(), CloseProcess(), CloseProcessAndVerify_(), CreateRemoteThread(), CsrCreateProcess(), CsrGetProcessLuid(), CsrSbCreateSession(), CsrSetProcessSecurity(), DoDuplicateHandle(), DoSetPriority(), doSymEnumSymbols(), doSymSearch(), DumpEnum(), DumpType(), DumpUDT(), EmptyWorkingSet(), EnumDirTree(), EnumDirTreeW(), EnumerateLoadedModules(), EnumerateLoadedModules64(), EnumerateLoadedModulesW64(), EnumProcessModules(), ExecuteKill(), ExecutePipeline(), FindModule(), FlushInstructionCache(), FreeUserPhysicalPages(), getCommandLineFromProcess(), GetExitCodeProcess(), GetGuiResources(), CIconWatcher::GetListEntry(), GetMappedFileNameA(), GetMappedFileNameW(), GetModuleBaseNameA(), GetModuleBaseNameW(), GetModuleFileNameExA(), GetModuleFileNameExW(), GetModuleInformation(), GetPriorityClass(), GetProcessAffinityMask(), GetProcessExecutablePath(), GetProcessExecutablePathById(), GetProcessHandleCount(), GetProcessImageFileNameA(), GetProcessImageFileNameW(), GetProcessIoCounters(), GetProcessPriorityBoost(), GetProcessTimes(), GetProcessWorkingSetSize(), GetProcessWorkingSetSizeEx(), GetVersionFromProcess(), GetWsChanges(), Ghost_DestroyTarget(), ImageSymToVa(), InitDbgHelp(), InitializeProcessForWsWatch(), IntResolveDesktop(), IsCriticalProcess(), IsProcessRunning(), IsWow64Process(), LsapAddNotification(), main(), Main(), MiniDumpWriteDump(), MyDuplicateHandle(), NtOpenProcess(), NtUserGetGuiResources(), NtUserWaitForInputIdle(), PerfDataGetCommandLine(), PerfDataRefresh(), PNP_ReportLogOn(), PrintProcess(), process_find_by_handle(), process_invade_cb(), ProcessKeys(), ProcessList_Update(), ProcessPage_OnEndProcess(), ProcessPage_OnEndProcessTree(), ProcessPageShowContextMenu(), ProcessRunning(), PspCreateProcess(), QueryFullProcessImageNameA(), QueryFullProcessImageNameW(), QueryWorkingSet(), QueryWorkingSetEx(), read_mem(), read_mem64(), ReadProcessMemory(), reg_cb64to32(), RtlQueryProcessDebugInformation(), SaveProcessHandle(), SetPriorityClass(), SetProcessAffinityMask(), SetProcessPriorityBoost(), SetProcessWorkingSetSize(), SetProcessWorkingSetSizeEx(), StackWalk(), StackWalk64(), START_TEST(), sym_enum(), sym_register_cb(), SymAddSymbol(), SymAddSymbolW(), SymCleanup(), SymEnumerateModules(), SymEnumerateModules64(), SymEnumerateModulesW64(), SymEnumerateSymbols(), SymEnumerateSymbols64(), SymEnumLines(), SymEnumSourceFiles(), SymEnumSourceFilesW(), SymEnumSourceLines(), SymEnumSourceLinesW(), SymEnumSymbols(), SymEnumSymbolsW(), SymEnumTypes(), SymEnumTypesW(), SymFindFileInPath(), SymFindFileInPathW(), SymFromAddr(), SymFromAddrW(), SymFromIndex(), SymFromIndexW(), SymFromName(), SymFunctionTableAccess(), SymFunctionTableAccess64(), SymGetLineFromAddr(), SymGetLineFromAddr64(), SymGetLineFromAddrW64(), SymGetLineFromName(), SymGetLineFromName64(), SymGetLineFromNameW64(), SymGetLineNext(), SymGetLineNext64(), SymGetLinePrev(), SymGetLinePrev64(), SymGetModuleBase(), SymGetModuleBase64(), SymGetModuleInfo(), SymGetModuleInfo64(), SymGetModuleInfoW(), SymGetModuleInfoW64(), SymGetSearchPath(), SymGetSearchPathW(), SymGetSourceFileToken(), SymGetSourceFileTokenW(), SymGetSymFromAddr(), SymGetSymFromAddr64(), SymGetSymFromName(), SymGetSymFromName64(), SymGetSymNext(), SymGetSymNext64(), SymGetSymPrev(), SymGetSymPrev64(), SymGetTypeFromName(), SymGetTypeInfo(), SymInitialize(), SymInitializeW(), SymLoadModule(), SymLoadModule64(), SymLoadModuleEx(), SymLoadModuleExW(), SymRefreshModuleList(), SymRegisterCallback(), SymRegisterCallback64(), SymRegisterCallbackW64(), SymSearch(), SymSearchW(), SymSetContext(), SymSetHomeDirectory(), SymSetHomeDirectoryW(), SymSetScopeFromAddr(), SymSetSearchPath(), SymSetSearchPathW(), SymUnloadModule(), SymUnloadModule64(), TerminateProcess(), test_CreateRemoteThread(), test_NtMapViewOfSection(), test_pack_CREATE_PROCESS_DEBUG_INFO(), test_pack_PROCESS_INFORMATION(), test_QueryInformationJobObject(), test_shell_window(), test_VirtualAllocEx(), TestTerminateProcess(), Toolhelp32ReadProcessMemory(), ModuleData::Update(), UserpCaptureStringParameters(), UserpFormatMessages(), UserpGetClientFileName(), VirtualAllocEx(), VirtualFreeEx(), VirtualProtectEx(), VirtualQueryEx(), WaitForInputIdle(), WaitForSettingsDialog(), WlxAssignShellProtection(), WOWShellExecute(), WriteProcessMemory(), WSPDuplicateSocket(), and wWinMain().

ulTag

_Check_return_ _In_ ULONG _In_ SIZE_T _In_ ULONG ulTag

Definition at line 84 of file mapping.h.