Memory Manager Functions

Module Description

_NtAllocateUserPhysicalPages et cetera...

Functions
_NTFN_EXTERN NTSTATUS	_NtAllocateUserPhysicalPages (IN HANDLE ProcessHandle, INOUT PULONG_PTR NumberOfPages, INOUT PULONG_PTR UserPfnArray)
_NTFN_EXTERN NTSTATUS	_NtFreeUserPhysicalPages (IN HANDLE ProcessHandle, INOUT PULONG_PTR NumberOfPages, INOUT PULONG_PTR UserPfnArray)
_NTFN_EXTERN NTSTATUS	_NtMapUserPhysicalPages (IN PVOID VirtualAddresses, IN ULONG_PTR NumberOfPages, INOUT PULONG_PTR UserPfnArray)
_NTFN_EXTERN NTSTATUS	_NtMapUserPhysicalPagesScatter (IN PVOID *VirtualAddresses, IN ULONG_PTR NumberOfPages, INOUT PULONG_PTR UserPfnArray)
_NTFN_EXTERN NTSTATUS	_NtAllocateVirtualMemory (IN HANDLE ProcessHandle, INOUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, INOUT PSIZE_T RegionSize, IN ULONG AllocationType, IN ULONG Protect)
_NTFN_EXTERN NTSTATUS	_NtFreeVirtualMemory (IN HANDLE ProcessHandle, INOUT PVOID *BaseAddress, INOUT PSIZE_T RegionSize, IN ULONG FreeType)
_NTFN_EXTERN NTSTATUS	_NtQueryVirtualMemory (IN HANDLE ProcessHandle, IN PVOID Address, IN MEMORY_INFORMATION_CLASS VirtualMemoryInformationClass, OUT PVOID VirtualMemoryInformation, IN SIZE_T Length, OPTOUT PSIZE_T ResultLength)
_NTFN_EXTERN NTSTATUS	_NtReadVirtualMemory (IN HANDLE ProcessHandle, IN PVOID BaseAddress, OUT PVOID Buffer, IN SIZE_T NumberOfBytesToRead, OPTOUT PSIZE_T NumberOfBytesRead)
_NTFN_EXTERN NTSTATUS	_NtWriteVirtualMemory (IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN PVOID Buffer, IN SIZE_T NumberOfBytesToWrite, OPTOUT PSIZE_T NumberOfBytesWritten)
_NTFN_EXTERN NTSTATUS	_NtLockVirtualMemory (IN HANDLE ProcessHandle, INOUT PVOID *BaseAddress, INOUT PSIZE_T NumberOfBytesToLock, IN ULONG LockType)
_NTFN_EXTERN NTSTATUS	_NtUnlockVirtualMemory (IN HANDLE ProcessHandle, INOUT PVOID *BaseAddress, INOUT PSIZE_T NumberOfBytesToUnlock, IN ULONG LockType)
_NTFN_EXTERN NTSTATUS	_NtFlushVirtualMemory (IN HANDLE ProcessHandle, INOUT PVOID *BaseAddress, INOUT PSIZE_T RegionSize, OUT PIO_STATUS_BLOCK IoStatus)
_NTFN_EXTERN NTSTATUS	_NtProtectVirtualMemory (IN HANDLE ProcessHandle, INOUT PVOID *BaseAddress, INOUT SIZE_T *NumberOfBytesToProtect, IN ULONG NewAccessProtection, OUT PULONG OldAccessProtection)
_NTFN_EXTERN NTSTATUS	_NtCreateSection (OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, OPTIN POBJECT_ATTRIBUTES ObjectAttributes, OPTIN PLARGE_INTEGER MaximumSize, IN ULONG SectionPageProtection, IN ULONG AllocationAttributes, OPTIN HANDLE FileHandle)
_NTFN_EXTERN NTSTATUS	_NtOpenSection (OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes)
_NTFN_EXTERN NTSTATUS	_NtQuerySection (IN HANDLE SectionHandle, IN SECTION_INFORMATION_CLASS SectionInformationClass, OUT PVOID SectionInformation, IN SIZE_T Length, OUT PSIZE_T ResultLength)
_NTFN_EXTERN NTSTATUS	_NtExtendSection (IN HANDLE SectionHandle, IN PLARGE_INTEGER NewMaximumSize)
_NTFN_EXTERN NTSTATUS	_NtMapViewOfSection (IN HANDLE SectionHandle, IN HANDLE ProcessHandle, INOUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, INOUT PLARGE_INTEGER SectionOffset OPTIONAL, INOUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG AccessProtection)
_NTFN_EXTERN NTSTATUS	_NtUnmapViewOfSection (IN HANDLE ProcessHandle, IN PVOID BaseAddress)
_NTFN_EXTERN NTSTATUS	_NtGetWriteWatch (IN HANDLE ProcessHandle, IN ULONG Flags, IN PVOID BaseAddress, IN SIZE_T RegionSize, IN PVOID *UserAddressArray, OUT PULONG_PTR EntriesInUserAddressArray, OUT PULONG Granularity)
_NTFN_EXTERN NTSTATUS	_NtResetWriteWatch (IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN SIZE_T RegionSize)
_NTFN_EXTERN NTSTATUS	_NtCreatePagingFile (IN PUNICODE_STRING FileName, IN PLARGE_INTEGER InitialSize, IN PLARGE_INTEGER MaxiumSize, IN ULONG Reserved)
_NTFN_EXTERN NTSTATUS	_NtAreMappedFilesTheSame (IN PVOID File1MappedAsAnImage, IN PVOID File2MappedAsFile)
_NTFN_EXTERN NTSTATUS	_NtFlushInstructionCache (IN HANDLE ProcessHandle, IN PVOID BaseAddress, IN SIZE_T NumberOfBytesToFlush)

Function Documentation

_NtAllocateUserPhysicalPages()

_NTFN_EXTERN NTSTATUS _NtAllocateUserPhysicalPages	(	IN HANDLE	ProcessHandle,
		INOUT PULONG_PTR	NumberOfPages,
		INOUT PULONG_PTR	UserPfnArray
	)

_NtFreeUserPhysicalPages()

_NTFN_EXTERN NTSTATUS _NtFreeUserPhysicalPages	(	IN HANDLE	ProcessHandle,
		INOUT PULONG_PTR	NumberOfPages,
		INOUT PULONG_PTR	UserPfnArray
	)

_NtMapUserPhysicalPages()

_NTFN_EXTERN NTSTATUS _NtMapUserPhysicalPages	(	IN PVOID	VirtualAddresses,
		IN ULONG_PTR	NumberOfPages,
		INOUT PULONG_PTR	UserPfnArray
	)

_NtMapUserPhysicalPagesScatter()

_NTFN_EXTERN NTSTATUS _NtMapUserPhysicalPagesScatter	(	IN PVOID *	VirtualAddresses,
		IN ULONG_PTR	NumberOfPages,
		INOUT PULONG_PTR	UserPfnArray
	)

_NtAllocateVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtAllocateVirtualMemory	(	IN HANDLE	ProcessHandle,
		INOUT PVOID *	BaseAddress,
		IN ULONG_PTR	ZeroBits,
		INOUT PSIZE_T	RegionSize,
		IN ULONG	AllocationType,
		IN ULONG	Protect
	)

_NtFreeVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtFreeVirtualMemory	(	IN HANDLE	ProcessHandle,
		INOUT PVOID *	BaseAddress,
		INOUT PSIZE_T	RegionSize,
		IN ULONG	FreeType
	)

_NtQueryVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtQueryVirtualMemory	(	IN HANDLE	ProcessHandle,
		IN PVOID	Address,
		IN MEMORY_INFORMATION_CLASS	VirtualMemoryInformationClass,
		OUT PVOID	VirtualMemoryInformation,
		IN SIZE_T	Length,
		OPTOUT PSIZE_T	ResultLength
	)

_NtReadVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtReadVirtualMemory	(	IN HANDLE	ProcessHandle,
		IN PVOID	BaseAddress,
		OUT PVOID	Buffer,
		IN SIZE_T	NumberOfBytesToRead,
		OPTOUT PSIZE_T	NumberOfBytesRead
	)

_NtWriteVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtWriteVirtualMemory	(	IN HANDLE	ProcessHandle,
		IN PVOID	BaseAddress,
		IN PVOID	Buffer,
		IN SIZE_T	NumberOfBytesToWrite,
		OPTOUT PSIZE_T	NumberOfBytesWritten
	)

_NtLockVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtLockVirtualMemory	(	IN HANDLE	ProcessHandle,
		INOUT PVOID *	BaseAddress,
		INOUT PSIZE_T	NumberOfBytesToLock,
		IN ULONG	LockType
	)

Note

NtLockVirtualMemory requires "SeLockMemoryPrivilege".

_NtUnlockVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtUnlockVirtualMemory	(	IN HANDLE	ProcessHandle,
		INOUT PVOID *	BaseAddress,
		INOUT PSIZE_T	NumberOfBytesToUnlock,
		IN ULONG	LockType
	)

_NtFlushVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtFlushVirtualMemory	(	IN HANDLE	ProcessHandle,
		INOUT PVOID *	BaseAddress,
		INOUT PSIZE_T	RegionSize,
		OUT PIO_STATUS_BLOCK	IoStatus
	)

_NtProtectVirtualMemory()

_NTFN_EXTERN NTSTATUS _NtProtectVirtualMemory	(	IN HANDLE	ProcessHandle,
		INOUT PVOID *	BaseAddress,
		INOUT SIZE_T *	NumberOfBytesToProtect,
		IN ULONG	NewAccessProtection,
		OUT PULONG	OldAccessProtection
	)

Parameters

BaseAddress	In: Addr to protect, Out: Addr actually ptotected.
NumberOfBytesToProtect	In: Size to protect, Out: Size actually ptotected.

_NtCreateSection()

_NTFN_EXTERN NTSTATUS _NtCreateSection	(	OUT PHANDLE	SectionHandle,
		IN ACCESS_MASK	DesiredAccess,
		OPTIN POBJECT_ATTRIBUTES	ObjectAttributes,
		OPTIN PLARGE_INTEGER	MaximumSize,
		IN ULONG	SectionPageProtection,
		IN ULONG	AllocationAttributes,
		OPTIN HANDLE	FileHandle
	)

_NtOpenSection()

_NTFN_EXTERN NTSTATUS _NtOpenSection	(	OUT PHANDLE	SectionHandle,
		IN ACCESS_MASK	DesiredAccess,
		IN POBJECT_ATTRIBUTES	ObjectAttributes
	)

_NtQuerySection()

_NTFN_EXTERN NTSTATUS _NtQuerySection	(	IN HANDLE	SectionHandle,
		IN SECTION_INFORMATION_CLASS	SectionInformationClass,
		OUT PVOID	SectionInformation,
		IN SIZE_T	Length,
		OUT PSIZE_T	ResultLength
	)

_NtExtendSection()

_NTFN_EXTERN NTSTATUS _NtExtendSection	(	IN HANDLE	SectionHandle,
		IN PLARGE_INTEGER	NewMaximumSize
	)

_NtMapViewOfSection()

_NTFN_EXTERN NTSTATUS _NtMapViewOfSection	(	IN HANDLE	SectionHandle,
		IN HANDLE	ProcessHandle,
		INOUT PVOID *	BaseAddress,
		IN ULONG_PTR	ZeroBits,
		IN SIZE_T	CommitSize,
		INOUT PLARGE_INTEGER SectionOffset	OPTIONAL,
		INOUT PSIZE_T	ViewSize,
		IN SECTION_INHERIT	InheritDisposition,
		IN ULONG	AllocationType,
		IN ULONG	AccessProtection
	)

_NtUnmapViewOfSection()

_NTFN_EXTERN NTSTATUS _NtUnmapViewOfSection	(	IN HANDLE	ProcessHandle,
		IN PVOID	BaseAddress
	)

_NtGetWriteWatch()

_NTFN_EXTERN NTSTATUS _NtGetWriteWatch	(	IN HANDLE	ProcessHandle,
		IN ULONG	Flags,
		IN PVOID	BaseAddress,
		IN SIZE_T	RegionSize,
		IN PVOID *	UserAddressArray,
		OUT PULONG_PTR	EntriesInUserAddressArray,
		OUT PULONG	Granularity
	)

_NtResetWriteWatch()

_NTFN_EXTERN NTSTATUS _NtResetWriteWatch	(	IN HANDLE	ProcessHandle,
		IN PVOID	BaseAddress,
		IN SIZE_T	RegionSize
	)

_NtCreatePagingFile()

_NTFN_EXTERN NTSTATUS _NtCreatePagingFile	(	IN PUNICODE_STRING	FileName,
		IN PLARGE_INTEGER	InitialSize,
		IN PLARGE_INTEGER	MaxiumSize,
		IN ULONG	Reserved
	)

_NtAreMappedFilesTheSame()

_NTFN_EXTERN NTSTATUS _NtAreMappedFilesTheSame	(	IN PVOID	File1MappedAsAnImage,
		IN PVOID	File2MappedAsFile
	)

_NtFlushInstructionCache()

_NTFN_EXTERN NTSTATUS _NtFlushInstructionCache	(	IN HANDLE	ProcessHandle,
		IN PVOID	BaseAddress,
		IN SIZE_T	NumberOfBytesToFlush
	)