slack.h File Reference

#include "introtypes.h"

Go to the source code of this file.

Functions
INTSTATUS	IntSlackAlloc (QWORD ModuleBase, BOOLEAN Pageable, DWORD Size, QWORD *Buffer, QWORD SecHint)
	Allocate slack inside the guest. More...
INTSTATUS	IntSlackFree (QWORD Buffer)
	Free slack space. More...
void	IntSlackUninit (void)
	Uninit the slack system. Must be called only during uninit. More...

Function Documentation

IntSlackAlloc()

INTSTATUS IntSlackAlloc	(	QWORD	ModuleBase,
		BOOLEAN	Pageable,
		DWORD	Size,
		QWORD *	Buffer,
		QWORD	SecHint
	)

Allocate slack inside the guest.

Please see the description of the IntSlackAllocWindows function for Windows, and IntSlackAllocLinux for Linux. This function is just a wrapper for them.

Parameters

[in]	Pageable	If true, the slack space can be allocated inside a pageable section.
[in]	ModuleBase	The kernel module in which we wish to allocate slack space.
[in]	Size	Size to be allocated.
[out]	Buffer	Will contain, upon successful return, the guest virtual address of the allocated slack buffer inside the given module.
[in]	SecHint	Optional section hint - if provided (non-zero), slack will be allocated inside the given section (note that this is a section name, not index).

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is supplied.
INT_STATUS_INSUFFICIENT_RESOURCES	If a memory alloc fails or if enough slack space was not found inside the given module.

Definition at line 437 of file slack.c.

Referenced by IntDetSetHook(), IntLixAgentAllocate(), IntMtblPatchInstruction(), IntSwapgsInstallHandler(), IntWinAgentInjectTrampoline(), and IntWinAgentSelectBootstrapAddress().

IntSlackFree()

INTSTATUS IntSlackFree

(

QWORD

Buffer

)

Free slack space.

Will free the given buffer allocated inside a loaded modules' slack space.

Parameters

[in]

Buffer

The allocate slack address.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_NOT_FOUND	If the given slack was not found among the valid allocations.
INT_STATUS_INVALID_PARAMETER	If an invalid parameter is used.

Definition at line 499 of file slack.c.

Referenced by IntDetRemoveHandler(), IntLixAgentFree(), IntWinAgentInjectTrampoline(), and IntWinAgentReleaseBootstrapAddress().

IntSlackUninit()

void IntSlackUninit

(

void

)

Uninit the slack system. Must be called only during uninit.

Definition at line 536 of file slack.c.

Referenced by IntGuestUninit().