alert_exceptions.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#ifndef _ALERT_EXCEPTIONS_H_
#define _ALERT_EXCEPTIONS_H_

#include "exceptions.h"

#pragma pack(push, 1)

#define ALERT_HASH_COUNT         6u

#define ALERT_CB_SIGNATURE_VERSION 1


typedef struct _ALERT_CB_SIGNATURE
{
    INTRO_ALERT_EXCEPTION_HEADER Header;    

    DWORD       Flags;                      

    BOOLEAN     Valid;                      
    BYTE        Score;                      
    BYTE        Count;                      
    BYTE        _Reserved;

    DWORD       CodeBlocks[ALERT_HASH_COUNT];
} ALERT_CB_SIGNATURE;


#define ALERT_IDT_SIGNATURE_VERSION 1

typedef struct _ALERT_IDT_SIGNATURE
{
    INTRO_ALERT_EXCEPTION_HEADER Header;    

    DWORD       Flags;                      

    BOOLEAN     Valid;                      
    BYTE        Entry;                      
    BYTE        _Reserved[2];
} ALERT_IDT_SIGNATURE;


#define ALERT_EXPORT_SIGNATURE_VERSION 1

typedef struct _ALERT_EXPORT_SIGNATURE
{
    INTRO_ALERT_EXCEPTION_HEADER Header;    

    DWORD       Flags;                      

    BOOLEAN     Valid;                      
    BYTE        _Reserved[3];

    DWORD       Library;                    
    DWORD       Function;                   
    WORD        Delta;                      
    BYTE        WriteSize;                  
    BYTE        _Reserved1;
} ALERT_EXPORT_SIGNATURE;


#define ALERT_PROCESS_CREATION_SIGNATURE_VERSION 1

typedef struct _ALERT_PROCESS_CREATION_SIGNATURE
{
    INTRO_ALERT_EXCEPTION_HEADER Header;    

    DWORD       Flags;                      

    BOOLEAN     Valid;                      

    DWORD       CreateMask;                 
    DWORD       _Reserved[3];
} ALERT_PROCESS_CREATION_SIGNATURE;


#define ALERT_KM_EXCEPTION_VERSION 1

typedef struct _ALERT_KM_EXCEPTION
{
    INTRO_ALERT_EXCEPTION_HEADER Header; 

    DWORD       Originator;             
    DWORD       Victim;                 

    DWORD       Flags;                  

    KM_EXCEPTION_OBJECT Type;           

    ALERT_CB_SIGNATURE  CodeBlocks;     
    ALERT_IDT_SIGNATURE Idt;            
} ALERT_KM_EXCEPTION;


#define ALERT_KUM_EXCEPTION_VERSION 1

typedef struct _ALERT_KUM_EXCEPTION
{
    INTRO_ALERT_EXCEPTION_HEADER Header; 

    DWORD       Originator;             
    DWORD       Victim;                 
    DWORD       Process;                

    DWORD       Flags;                  

    KUM_EXCEPTION_OBJECT Type;          

    ALERT_CB_SIGNATURE      CodeBlocks; 
} ALERT_KUM_EXCEPTION;

STATIC_ASSERT(sizeof(ALERT_KM_EXCEPTION) <= ALERT_EXCEPTION_SIZE,
              "The ALERT_KM_EXCEPTION structure exceeds ALERT_EXCEPTION_SIZE, possible buffer overflow!");

#define ALERT_UM_EXCEPTION_VERSION 1

typedef struct _ALERT_UM_EXCEPTION
{
    INTRO_ALERT_EXCEPTION_HEADER Header;        

    DWORD       Originator;                     
    DWORD       Victim;                         
    DWORD       Process;                        

    DWORD       Flags;                          

    UM_EXCEPTION_OBJECT Type;                   

    ALERT_CB_SIGNATURE               CodeBlocks;
    ALERT_EXPORT_SIGNATURE           Export;    
    ALERT_PROCESS_CREATION_SIGNATURE ProcessCreation;   
} ALERT_UM_EXCEPTION;

STATIC_ASSERT(sizeof(ALERT_UM_EXCEPTION) <= ALERT_EXCEPTION_SIZE,
              "The ALERT_UM_EXCEPTION structure exceeds ALERT_EXCEPTION_SIZE, possible buffer overflow!");

#pragma pack(pop)


INTSTATUS
IntAlertCreateException(
    _In_ const void *Event,
    _In_ INTRO_EVENT_TYPE Type,
    _In_ BOOLEAN LogErrors,
    _Inout_ void *Exception
    );

INTSTATUS
IntAlertCreateExceptionInEvent(
    _Inout_ void *Event,
    _In_ INTRO_EVENT_TYPE Type
    );

__forceinline BOOLEAN
IntAlertIsEventTypeViolation(
    _In_ INTRO_EVENT_TYPE Type
    )
{
    // Whenever a new violation is created, one must add here the violation type
    // in order to check when adding an exception from alert.
    return !(introEventEptViolation != Type &&
             introEventMsrViolation != Type &&
             introEventCrViolation != Type &&
             introEventDtrViolation != Type &&
             introEventIntegrityViolation != Type &&
             introEventInjectionViolation != Type &&
             introEventProcessCreationViolation != Type &&
             introEventModuleLoadViolation != Type);
}

#endif // _ALERT_EXCEPTIONS_H_