memory Namespace Reference

Classes
class	MemoryFactory
class	IMemory
struct	LinuxData
class	MemoryFactoryImpl
class	MemoryFile
class	MemoryOsSpecific
Functions
	DECLARE_EXCEPTION (MemoryException)
	Base class for all Memory operations.
	DECLARE_EXCEPTION_EX (AccessError, memory, MemoryException)
	DECLARE_EXCEPTION_EX (OutOfBounds, memory, MemoryException)
int	LoadNtdllFuncs (void)
HANDLE	OpenMemAccess (void)
int	CloseMemAccess (HANDLE hPhysMem)
int	MapMem (HANDLE hPhysMem, PVOID pBaseAddr, PDWORD pPhysAddr, PDWORD pSize)
int	UnMapMem (PVOID pBaseAddr)
static BOOL	setPrivilege (LPCTSTR privilegeName, BOOL enable)
void	readPhysicalMemoryMap (HANDLE hPhysMem, u8 *buffer, u64 offset, unsigned int length)
void	readPhysicalMemoryDebugSysctl (u8 *buffer, u64 offset, unsigned int length)
void	enumSystemFirmwareTables (u8 *buffer, u64 offset, unsigned int length)
	DEFINE_EXCEPTION_EX (AccessErrorImpl, memory, AccessError)
	DEFINE_EXCEPTION_EX (OutOfBoundsImpl, memory, OutOfBounds)
Variables
NtOpenSectionPtr	NtOpenSection = NULL
NtClosePtr	NtClose = NULL
NtMapViewOfSectionPtr	NtMapViewOfSection = NULL
NtUnmapViewOfSectionPtr	NtUnmapViewOfSection = NULL
RtlInitUnicodeStringPtr	RtlInitUnicodeString = NULL
ZwSystemDebugControlPtr	ZwSystemDebugControl = NULL
EnumSystemFirmwareTablesPtr	EnumSystemFirmwareTables = NULL
GetSystemFirmwareTablePtr	GetSystemFirmwareTable = NULL
u8 *	CBlockBuffer = NULL
u8 *	EBlockBuffer = NULL

---

Function Documentation

int memory::CloseMemAccess (  HANDLE  hPhysMem  )

Definition at line 97 of file Memory_Windows.cpp. References NT_SUCCESS, and NtClose.

memory::DECLARE_EXCEPTION (  MemoryException   )

Base class for all Memory operations.

memory::DECLARE_EXCEPTION_EX (  OutOfBounds  , memory  , MemoryException  )

memory::DECLARE_EXCEPTION_EX (  AccessError  , memory  , MemoryException  )

memory::DEFINE_EXCEPTION_EX (  OutOfBoundsImpl  , memory  , OutOfBounds  )

memory::DEFINE_EXCEPTION_EX (  AccessErrorImpl  , memory  , AccessError  )

void memory::enumSystemFirmwareTables (  u8 *  buffer, u64  offset, unsigned int  length )

Definition at line 253 of file Memory_Windows.cpp. References CBlockBuffer, EBlockBuffer, and EnumSystemFirmwareTables.

int memory::LoadNtdllFuncs (  void   )

Definition at line 49 of file Memory_Windows.cpp. References EnumSystemFirmwareTables, GetSystemFirmwareTable, NtClose, NtMapViewOfSection, NtOpenSection, NtUnmapViewOfSection, RtlInitUnicodeString, and cmos::ZwSystemDebugControl.

int memory::MapMem (  HANDLE  hPhysMem, PVOID  pBaseAddr, PDWORD  pPhysAddr, PDWORD  pSize )

Definition at line 111 of file Memory_Windows.cpp. References NT_SUCCESS, NtCurrentProcess, NtMapViewOfSection, and ViewShare. Referenced by readPhysicalMemoryMap().

HANDLE memory::OpenMemAccess (  void   )

Definition at line 78 of file Memory_Windows.cpp. References InitializeObjectAttributes, NT_SUCCESS, NtOpenSection, OBJ_CASE_INSENSITIVE, RtlInitUnicodeString, and SECTION_MAP_READ.

void memory::readPhysicalMemoryDebugSysctl (  u8 *  buffer, u64  offset, unsigned int  length )

Definition at line 227 of file Memory_Windows.cpp. References _, DebugSysReadPhysicalMemory, NT_SUCCESS, and cmos::ZwSystemDebugControl.

void memory::readPhysicalMemoryMap (  HANDLE  hPhysMem, u8 *  buffer, u64  offset, unsigned int  length )

Definition at line 171 of file Memory_Windows.cpp. References _, MapMem(), and UnMapMem().

static BOOL memory::setPrivilege (  LPCTSTR  privilegeName, BOOL  enable )  [static]

Definition at line 146 of file Memory_Windows.cpp.

int memory::UnMapMem (  PVOID  pBaseAddr  )

Definition at line 132 of file Memory_Windows.cpp. References NT_SUCCESS, NtCurrentProcess, and NtUnmapViewOfSection. Referenced by readPhysicalMemoryMap().

---

Variable Documentation

u8* CBlockBuffer = NULL

Definition at line 46 of file Memory_Windows.cpp. Referenced by enumSystemFirmwareTables().

u8* EBlockBuffer = NULL

Definition at line 47 of file Memory_Windows.cpp. Referenced by enumSystemFirmwareTables().

EnumSystemFirmwareTablesPtr EnumSystemFirmwareTables = NULL

Definition at line 44 of file Memory_Windows.cpp. Referenced by enumSystemFirmwareTables(), and LoadNtdllFuncs().

GetSystemFirmwareTablePtr GetSystemFirmwareTable = NULL

Definition at line 45 of file Memory_Windows.cpp. Referenced by LoadNtdllFuncs().

NtClosePtr NtClose = NULL

Definition at line 38 of file Memory_Windows.cpp. Referenced by CloseMemAccess(), and LoadNtdllFuncs().

NtMapViewOfSectionPtr NtMapViewOfSection = NULL

Definition at line 39 of file Memory_Windows.cpp. Referenced by LoadNtdllFuncs(), and MapMem().

NtOpenSectionPtr NtOpenSection = NULL

Definition at line 37 of file Memory_Windows.cpp. Referenced by LoadNtdllFuncs(), and OpenMemAccess().

NtUnmapViewOfSectionPtr NtUnmapViewOfSection = NULL

Definition at line 40 of file Memory_Windows.cpp. Referenced by LoadNtdllFuncs(), and UnMapMem().

RtlInitUnicodeStringPtr RtlInitUnicodeString = NULL

Definition at line 41 of file Memory_Windows.cpp. Referenced by LoadNtdllFuncs(), and OpenMemAccess().

ZwSystemDebugControlPtr ZwSystemDebugControl = NULL

Definition at line 42 of file Memory_Windows.cpp.

---