Bitdefender Hypervisor Memory Introspection
agent.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
5 #include "agent.h"
6 #include "winagent.h"
7 #include "lixagent.h"
8 #include "guests.h"
9 
10 
13  _In_ QWORD Rip,
14  _In_ DWORD CpuNumber
15  )
25 {
27  {
28  return IntWinAgentHandleInt3(Rip, CpuNumber);
29  }
30  else if (gGuest.OSType == introGuestLinux)
31  {
32  return IntLixAgentHandleInt3(Rip);
33  }
34  else
35  {
37  }
38 }
39 
40 
43  _In_ QWORD Rip
44  )
53 {
55  {
56  return IntLixAgentHandleVmcall(Rip);
57  }
58  else if (gGuest.OSType == introGuestWindows)
59  {
60  return IntWinAgentHandleVmcall(Rip);
61  }
62  else
63  {
65  }
66 }
67 
68 
71  void
72  )
80 {
82  {
84  }
85 
87  {
89  }
90  else if (gGuest.OSType == introGuestLinux)
91  {
93  }
94  else
95  {
97  }
98 }
99 
100 
101 void
103  void
104  )
108 {
110  {
112  }
113  else if (gGuest.OSType == introGuestLinux)
114  {
116  }
117 }
118 
119 
122  _Out_opt_ DWORD *Tag
123  )
131 {
133  {
134  return IntWinAgentGetState(Tag);
135  }
136  else if (gGuest.OSType == introGuestLinux)
137  {
138  return IntLixAgentGetState(Tag);
139  }
140  else
141  {
142  if (Tag != NULL)
143  {
144  *Tag = 0;
145  }
146  return agNone;
147  }
148 }
149 
150 
151 INTSTATUS
153  void
154  )
161 {
163  {
165  }
166  else if (gGuest.OSType == introGuestLinux)
167  {
169 
170  return INT_STATUS_SUCCESS;
171  }
172  else
173  {
175  }
176 }
177 
178 
179 BOOLEAN
181  _In_ QWORD Ptr,
182  _In_ THS_PTR_TYPE Type
183  )
192 {
194  {
195  return IntWinAgentIsPtrInTrampoline(Ptr, Type);
196  }
197 
198  return FALSE;
199 }
void IntLixAgentDisablePendingAgents(void)
Disables all pending agents.
Definition: lixagent.c:1844
AG_WAITSTATE IntWinAgentGetState(DWORD *Tag)
Gets the global agents state.
Definition: winagent.c:3245
_Bool BOOLEAN
Definition: intro_types.h:58
INTSTATUS IntWinAgentHandleInt3(QWORD Rip, DWORD CpuNumber)
Handle a breakpoint that was initiated inside the guest.
Definition: winagent.c:2273
No active/pending agents.
Definition: agent.h:15
#define _In_
Definition: intro_sal.h:21
INTSTATUS IntLixAgentHandleVmcall(QWORD Rip)
Handle a VMCALL that was executed inside the guest.
Definition: lixagent.c:1760
#define INT_STATUS_SUCCESS
Definition: introstatus.h:54
INTSTATUS IntWinAgentEnableInjection(void)
enables agent injections.
Definition: winagent.c:3010
INTSTATUS IntAgentHandleVmcall(QWORD Rip)
Dispatch a VMCALL event to the Windows or Linux agent VMCALL handler.
Definition: agent.c:42
void IntWinAgentDisablePendingAgents(void)
Disables all pending agents.
Definition: winagent.c:3291
int INTSTATUS
The status data type.
Definition: introstatus.h:24
void IntAgentDisablePendingAgents(void)
Disable the Windows or Linux pending agents.
Definition: agent.c:102
INTRO_GUEST_TYPE OSType
The type of the guest.
Definition: guests.h:278
INTSTATUS IntLixAgentActivatePendingAgent(void)
Activates a pending agent that waits to be injected.
Definition: lixagent.c:1082
INTSTATUS IntAgentHandleInt3(QWORD Rip, DWORD CpuNumber)
Dispatch a breakpoint event to the Windows or Linux agent breakpoint handler.
Definition: agent.c:12
#define _Out_opt_
Definition: intro_sal.h:30
unsigned long long QWORD
Definition: intro_types.h:53
INTSTATUS IntLixAgentHandleInt3(QWORD Rip)
Called when a INT3 instruction from the current running agent is executed.
Definition: lixagent.c:1573
INTSTATUS IntAgentEnableInjection(void)
Enable Windows or Linux agent injection.
Definition: agent.c:152
uint32_t DWORD
Definition: intro_types.h:49
GUEST_STATE gGuest
The current guest state.
Definition: guests.c:50
THS_PTR_TYPE
The type of pointer to be checked.
BOOLEAN IntAgentIsPtrInTrampoline(QWORD Ptr, THS_PTR_TYPE Type)
Check if the provided pointer points inside the Windows trampoline code.
Definition: agent.c:180
INTSTATUS IntWinAgentHandleVmcall(QWORD Rip)
Handle a VMCALL that was executed inside the guest.
Definition: winagent.c:2397
#define INT_STATUS_NOT_INITIALIZED_HINT
Definition: introstatus.h:320
#define INT_STATUS_NOT_SUPPORTED
Definition: introstatus.h:287
INTSTATUS IntAgentActivatePendingAgent(void)
Activate a pending Windows or Linux agent.
Definition: agent.c:70
AG_WAITSTATE IntLixAgentGetState(DWORD *Tag)
Gets the global agents state.
Definition: lixagent.c:1804
enum _AG_WAITSTATE AG_WAITSTATE
BOOLEAN IntWinAgentIsPtrInTrampoline(QWORD Ptr, THS_PTR_TYPE Type)
Check if the provided address points inside the agent trampoline.
Definition: winagent.c:3219
AG_WAITSTATE IntAgentGetState(DWORD *Tag)
Get the current Windows or Linux agent state.
Definition: agent.c:121
void IntLixAgentEnableInjection(void)
Enables agent injections.
Definition: lixagent.c:1964
INTSTATUS IntWinAgentActivatePendingAgent(void)
Activates a pending agent that waits to be injected.
Definition: winagent.c:920
#define FALSE
Definition: intro_types.h:34