Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- NTSTATUS KphValidateAddressForSystemModules(
- _In_ PVOID Address,
- _In_ SIZE_T Length
- );
- NTSTATUS KphGetProcessMappedFileName(
- _In_ HANDLE ProcessHandle,
- _In_ PVOID BaseAddress,
- _Out_ PUNICODE_STRING *FileName
- );
- // verify
- NTSTATUS KphHashFile(
- _In_ PUNICODE_STRING FileName,
- _Out_ PVOID *Hash,
- _Out_ PULONG HashSize
- );
- NTSTATUS KphVerifyFile(
- _In_ PUNICODE_STRING FileName,
- _In_reads_bytes_(SignatureSize) PUCHAR Signature,
- _In_ ULONG SignatureSize
- );
- VOID KphVerifyClient(
- _Inout_ PKPH_CLIENT Client,
- _In_ PVOID CodeAddress,
- _In_reads_bytes_(SignatureSize) PUCHAR Signature,
- _In_ ULONG SignatureSize
- );
- NTSTATUS KpiVerifyClient(
- _In_ PVOID CodeAddress,
- _In_reads_bytes_(SignatureSize) PUCHAR Signature,
- _In_ ULONG SignatureSize,
- _In_ PKPH_CLIENT Client
- );
- VOID KphGenerateKeysClient(
- _Inout_ PKPH_CLIENT Client
- );
- NTSTATUS KphRetrieveKeyViaApc(
- _Inout_ PKPH_CLIENT Client,
- _In_ KPH_KEY_LEVEL KeyLevel,
- _Inout_ PIRP Irp
- );
- NTSTATUS KphValidateKey(
- _In_ KPH_KEY_LEVEL RequiredKeyLevel,
- _In_opt_ KPH_KEY Key,
- _In_ PKPH_CLIENT Client,
- _In_ KPROCESSOR_MODE AccessMode
- );
- // vm
- NTSTATUS KphCopyVirtualMemory(
- _In_ PEPROCESS FromProcess,
- _In_ PVOID FromAddress,
- _In_ PEPROCESS ToProcess,
- _In_ PVOID ToAddress,
- _In_ SIZE_T BufferLength,
- _In_ KPROCESSOR_MODE AccessMode,
- _Out_ PSIZE_T ReturnLength
- );
- NTSTATUS KpiReadVirtualMemoryUnsafe(
- _In_opt_ HANDLE ProcessHandle,
- _In_ PVOID BaseAddress,
- _Out_writes_bytes_(BufferSize) PVOID Buffer,
- _In_ SIZE_T BufferSize,
- _Out_opt_ PSIZE_T NumberOfBytesRead,
- _In_opt_ KPH_KEY Key,
- _In_ PKPH_CLIENT Client,
- _In_ KPROCESSOR_MODE AccessMode
- );
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement