Functions — github.com/0xflux/Hells-Hollow

CodeHub MCPcopy Create free account

hub / github.com/0xflux/Hells-Hollow / functions

Functions21 in github.com/0xflux/Hells-Hollow

⨍ Functions 21 ◇ Types & classes 10

↓ 2 callersFunctionget_module_base_and_sz

src/utils.rs:52

↓ 2 callersFunctionthread_to_process_name

(thread: *mut _KTHREAD)

src/utils.rs:122

↓ 1 callersFunctioneprocess_to_process_name

(process: *mut _EPROCESS)

src/utils.rs:133

↓ 1 callersFunctionget_process_name

src/alt_syscalls.rs:505

↓ 1 callersFunctionhells_hollow_poc

src/alt_syscalls.rs:87

↓ 1 callersFunctioninitialise_driver

(driver: &mut DRIVER_OBJECT, registry_path: PCUNICODE_STRING)

↓ 1 callersFunctionlookup_global_table_address

Get the address of the non-exported kernel symbol: `PspServiceDescriptorGroupTable`

src/alt_syscalls.rs:457

↓ 1 callersFunctionscan_module_for_byte_pattern

Scan a loaded module for a particular sequence of bytes, this will most commonly be used to resolve a pointer to an unexported function we wish to use

src/utils.rs:95

↓ 1 callersFunctionset_thread_creation_callback

Instructs the driver to register the thread creation callback routine.

src/thread.rs:14

↓ 1 callersFunctionthread_reg_alt_callbacks

src/thread.rs:28

Methodconfigure_process_for_alt_syscalls

(p_k_thread: PKTHREAD)

src/alt_syscalls.rs:262

Methodconfigure_thread_for_alt_syscalls

Sets the required context bits in memory on thread and KTHREAD.

src/alt_syscalls.rs:219

Functiondriver_entry

( driver: &mut DRIVER_OBJECT, registry_path: PCUNICODE_STRING, )

Functiondriver_exit

(_driver: PDRIVER_OBJECT)

Functiondrv_create_close

(_device: *mut DEVICE_OBJECT, pirp: PIRP)

Methodinitialise_for_system

Initialises the required tables in memory. This function should only be called once until it is disabled.

src/alt_syscalls.rs:128

Functionsyscall_handler

The callback routine which we control to run when a system call is dispatched via alt syscalls. It follows here, that we are able to use Hells Hollow

src/alt_syscalls.rs:433

Functionthread_callback

( pid: *mut c_void, thread_id: *mut c_void, create: BOOLEAN, )

src/thread.rs:20

Methoduninstall

Uninstall the Alt Syscall handlers from the kernel.

src/alt_syscalls.rs:285

Methodwalk_active_processes_and_set_bits

Walk all processes and threads, and set the bits on the process & thread to either enable or disable the alt syscall method. # Args: - `status`: Whet

src/alt_syscalls.rs:299