Method InjectKernel

src/InjectionCore.cpp:699–727

Kernel-mode injection Injection context Target image Init function RVA

/// <param name="img">Target image</param>
/// <param name="initRVA">Init function RVA</param>
NTSTATUS InjectionCore::InjectKernel(
    InjectContext& context,
    const blackbone::pe::PEImage& img,
    uint32_t initRVA /*= 0*/
    )
{
    if (context.cfg.injectMode == Kernel_MMap)
    {
        return blackbone::Driver().MmapDll(
            context.pid,
            img.path(),
            (KMmapFlags)context.cfg.mmapFlags,
            initRVA,
            context.cfg.initArgs
            );
    }
    else
    {
        return blackbone::Driver().InjectDll(
            context.pid,
            img.path(),
            (context.cfg.injectMode == Kernel_Thread ? IT_Thread : IT_Apc),
            initRVA,
            context.cfg.initArgs,
            context.cfg.unlink,
            context.cfg.erasePE
            );
    }
}

/// <summary>
/// Manually map another system driver into system space