88 ERROR(
"[ERROR] Failed translating GVA 0x%016llx (reported GLA 0x%016llx, GPA 0x%016llx). " 89 "Int entry: 0x%016llx, Real entry: 0x%016llx, error: 0x%08x\n",
103 ERROR(
"[ERROR] Translation mismatch for GVA 0x%016llx, translated GPA 0x%016llx " 104 "(reported GLA 0x%016llx, GPA 0x%016llx)!\n",
136 CHAR text[ND_MIN_BUF_SIZE];
139 if (NULL != eptEntry)
167 ERROR(
"[ERROR] IntGetEPTPageProtection failed for 0x%016llx: 0x%08x\n", PhysicalAddress, status);
174 WARNING(
"[WARNING] GPA 0x%016llx, GLA 0x%016llx, was accessed with type %c%c%c, but no hooks exist on it: %c%c%c! " 175 "CR3 0x%016llx RIP 0x%016llx %s\n",
176 PhysicalAddress, LinearAddress,
180 r ?
'R' :
'-', w ?
'W' :
'-', x ?
'X' :
'-',
183 if (!!(Access & IG_EPT_HOOK_EXECUTE))
188 if (!!(Access & IG_EPT_HOOK_WRITE))
193 if (!!(Access & IG_EPT_HOOK_READ))
198 TRACE(
"[INFO] New access rights: %c%c%c\n", r ?
'R' :
'-', w ?
'W' :
'-', x ?
'X' :
'-');
210 ERROR(
"[ERROR] IntSetEPTPageProtection failed for 0x%016llx: 0x%08x\n", PhysicalAddress, status);
217 ERROR(
"[ERROR] IntSetEPTPageProtection failed for 0x%016llx: 0x%08x\n", PhysicalAddress, status);
248 CHAR text[ND_MIN_BUF_SIZE];
255 WARNING(
"[WARNING] GPA 0x%016llx, GLA 0x%016llx, was accessed with type %d, but no hooks exist on it! " 256 "CR3 0x%016llx RIP 0x%016llx %s\n",
262 ERROR(
"[ERROR] IntGetEPTPageProtection failed for 0x%016llx: 0x%08x\n", PhysicalAddress, status);
266 TRACE(
"[INFO] Old access rights: %c%c%c\n", r ?
'R' :
'-', w ?
'W' :
'-', x ?
'X' :
'-');
283 TRACE(
"[INFO] New access rights: %c%c%c\n", r ?
'R' :
'-', w ?
'W' :
'-', x ?
'X' :
'-');
295 ERROR(
"[ERROR] IntSetEPTPageProtection failed for 0x%016llx: 0x%08x\n", PhysicalAddress, status);
302 ERROR(
"[ERROR] IntSetEPTPageProtection failed for 0x%016llx: 0x%08x\n", PhysicalAddress, status);
376 *CallbackFound =
FALSE;
389 AccessType &= ~IG_EPT_HOOK_EXECUTE;
395 AccessType &= ~IG_EPT_HOOK_READ;
401 AccessType &= ~IG_EPT_HOOK_WRITE;
434 while (list != hooks)
438 if (pHook->
GpaPage == physPage)
443 if ((pHook->
GpaPage + pHook->
Offset >= PhysicalAddress + Length) ||
451 #ifdef CFG_DEBUG_EPT_VIOLATIONS 452 TRACE(
"[DEBUG] Calling EPT handler for GPA 0x%016llx, hook address: 0x%016llx, callback 0x%016llx\n",
453 PhysicalAddress, pHook, pHook->
Callback);
456 #ifdef CHECK_PAGE_RIGHTS 459 ERROR(
"[ERROR] IntValidateTranslation failed: GLA 0x%016llx, GPA 0x%016llx!\n",
460 LinearAddress, PhysicalAddress);
466 *CallbackFound =
TRUE;
485 QWORD oldValue, newValue;
490 ERROR(
"[ERROR] IntHookPtwEmulateWrite failed: 0x%08x\n", status);
501 (0 == ((oldValue &
PT_P) + (newValue & PT_P)))))
516 ERROR(
"[ERROR] EPT callback failed: 0x%08x\n", status);
529 ERROR(
"[ERROR] IntHookRemoveChain failed: 0x%08x\n", status2);
546 finalAction =
MAX(action, finalAction);
569 goto handle_next_access;
573 if (!(*CallbackFound) && *PageHooked && (access == IG_EPT_HOOK_READ))
607 *Action =
MAX(*Action, finalAction);
634 DWORD cbread = 0, csType, ring;
641 if (cbread > 0 && cbread < 16)
650 ERROR(
"[ERROR] IntGetCurrentMode failed: 0x%08x\n", status);
658 ERROR(
"[ERROR] IntGetCurrentRing failed: 0x%08x\n", status);
669 ndstatus = NdDecodeEx(&instrux, code, cbread,
672 if (ND_STATUS_BUFFER_TOO_SMALL == ndstatus)
682 ERROR(
"[ERROR] IntInjectExceptionInGuest failed: 0x%08x\n", status);
686 TRACE(
"[INFO] Fetch retry at GLA 0x%016llx, CR3 0x%016llx\n", rip, cr3);
728 if (0 == (ND_ACCESS_ANY_WRITE & AccessType))
736 ERROR(
"[ERROR] IntGetCurrentRing failed: 0x%08x\n", status);
750 ERROR(
"[ERROR] IntTranslateVirtualAddressEx failed: 0x%08x\n", status);
778 ERROR(
"[ERROR] IntInjectExceptionInGuest failed: 0x%08x\n", status);
782 TRACE(
"[INFO] Xen workaround at GLA 0x%016llx/0x%016llx, CR3 0x%016llx\n", Gla, Gla, cr3);
813 if ((Gla & 0xFFF) <= ((Gla + AccessSize - 1) & 0xFFF))
818 secpg = (Gla + AccessSize - 1) &
PAGE_MASK;
826 _In_ void *GuestHandle,
891 DWORD glacount, glaidx, pgcnt, pgidx, tsize, asize;
893 BOOLEAN cbkFound, probe, pageHooked, cacheuse, cachehit, cacheadd, fetchfail;
903 if (GuestHandle == NULL)
914 glacount = glaidx = pgcnt = pgidx = tsize = 0;
930 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 934 #ifdef CFG_DEBUG_EPT_VIOLATIONS 935 TRACE(
"[DEBUG] EPT violation for GPA 0x%016llx, GLA 0x%016llx, on CPU %d, type %d\n",
936 PhysicalAddress, LinearAddress, CpuNumber, AccessType);
948 ERROR(
"[ERROR] An EPT exit came for cpu %d, but we have only %d\n", CpuNumber,
gGuest.
CpuCount);
961 ERROR(
"[ERROR] IntGetGprs failed: 0x%08x\n", status);
962 goto _exit_stop_count;
969 ERROR(
"[ERROR] IntGetCurrentEptIndex failed: 0x%08x\n", status);
970 goto _exit_stop_count;
982 &cachehit, &cacheadd);
985 TRACE(
"[INFO] The page containing the RIP %llx has been swapped out; will retry the instruction.\n",
995 ERROR(
"[ERROR] IntDecDecodeInstructionAtRipWithCache failed: 0x%08x\n", status);
996 goto _exit_stop_count;
1006 LOG(
"[WARNING] We are in reexecute context: RIP = 0x%016llx, GLA = 0x%016llx, GPA = 0x%016llx, ACC = %d\n",
1007 gVcpu->
Regs.
Rip, LinearAddress, PhysicalAddress, AccessType);
1018 #ifdef CHECK_PAGE_RIGHTS 1028 if (cacheuse && cacheadd && !cachehit)
1048 if ((ND_ACCESS_READ | ND_ACCESS_WRITE) == (
gVcpu->
Instruction.MemoryAccess & (ND_ACCESS_READ | ND_ACCESS_WRITE)))
1068 TRACE(
"[INFO] The instruction at RIP seems to have been modified, will retry the instruction.\n");
1080 TRACE(
"[INFO] The instruction at RIP seems to have been relocated, will retry the instruction.\n");
1128 ERROR(
"[ERROR] IntVeHandleEPTViolationInProtectedView failed: 0x%08x\n", status);
1131 goto done_handling_instruction;
1140 &action, &cbkFound, &pageHooked,
FALSE, IG_EPT_HOOK_EXECUTE);
1143 ERROR(
"[ERROR] IntHandleMemAccess failed for 0x%016llx/0x%016llx with size 0x%x for type %d: %08x\n",
1144 PhysicalAddress, LinearAddress, Length, AccessType, status);
1151 goto done_handling_instruction;
1159 ERROR(
"[ERROR] IntDecGetAccessedMemCount failed: 0x%x\n", status);
1161 goto _exit_stop_count;
1168 goto done_handling_instruction;
1170 else if ((glacount == 1) && !(AccessType & IG_EPT_HOOK_EXECUTE))
1176 glas[0].
Gla = LinearAddress;
1178 glas[0].
Access = AccessType;
1185 char text[ND_MIN_BUF_SIZE];
1187 ERROR(
"[ERROR] IntDecDecodeAccessSize failed: 0x%08x for instruction '%s' " 1188 "with access %d GLA = 0x%016llx, GPA = 0x%016llx\n",
1200 goto _exit_stop_count;
1203 if (0 == glas[0].Size)
1205 char text[ND_MIN_BUF_SIZE];
1207 WARNING(
"[WARNING] Access size 0 returned for instruction '%s' " 1208 "with access %d GLA = 0x%016llx, GPA = 0x%016llx\n",
1217 goto done_handling_instruction;
1229 ERROR(
"[ERROR] IntDecGetAccessedMem failed: 0x%x\n", status);
1231 goto _exit_stop_count;
1236 for (glaidx = 0; glaidx < glacount; glaidx++)
1245 tgla = glas[glaidx].
Gla;
1246 tsize = glas[glaidx].
Size;
1261 goto done_handling_instruction;
1267 pages[pgidx].gla = tgla;
1268 pages[pgidx].size = tsize;
1293 goto done_handling_instruction;
1307 if (glas[glaidx].Access & ND_ACCESS_ANY_READ)
1312 if (glas[glaidx].Access & ND_ACCESS_ANY_WRITE)
1318 for (pgidx = 0; pgidx < pgcnt; pgidx++)
1321 &action, &cbkFound, &pageHooked, probe, access);
1324 ERROR(
"[ERROR] IntHandleMemAccess failed for 0x%016llx/0x%016llx with size 0x%x for type %d: %08x\n",
1325 pages[pgidx].gpa, glas[glaidx].Gla, glas[glaidx].Size, access, status);
1330 if (probe && cbkFound)
1340 goto done_handling_instruction;
1346 done_handling_instruction:
1363 ERROR(
"[ERROR] IntDecEmulateRead failed: 0x%08x\n", status);
1370 #endif // !USER_MODE 1375 ERROR(
"[ERROR] IntSetIntroEmulatorContext failed: 0x%08x\n", status);
1377 goto _exit_stop_count;
1383 #endif // !USER_MODE 1387 ERROR(
"[ERROR] IntroGuestAllowedPatched is requested, but the patch buffer is not valid!\n");
1390 goto _exit_stop_count;
1417 goto _bail_out_of_next_emu;
1424 goto _bail_out_of_next_emu;
1432 goto _bail_out_of_next_emu;
1439 goto _bail_out_of_next_emu;
1449 if ((nextGla & ~7ull) != (LinearAddress & ~7ull))
1451 goto _bail_out_of_next_emu;
1457 LinearAddress = nextGla;
1460 goto _process_again;
1463 _bail_out_of_next_emu:
1476 AccessType == IG_EPT_HOOK_EXECUTE &&
1498 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
1516 ERROR(
"[ERROR] EPT callback set DisableOnReturn... We will try to disable introcore...\n");
1523 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 1537 _In_ void *GuestHandle,
1573 if (GuestHandle == NULL)
1591 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 1604 ERROR(
"[ERROR] A MSR exit came for cpu %d, but we have only %d\n", CpuNumber,
gGuest.
CpuCount);
1615 ERROR(
"[ERROR] IntGetGprs failed: 0x%08x\n", status);
1623 if (Msr == pHook->Msr)
1627 if (pHook->Disabled)
1632 status = pHook->Callback(Msr, Flags, Action, pHook->Context, OriginalValue, NewValue);
1639 ERROR(
"[ERROR] IntHookMsrRemoveHook failed: 0x%08x\n", status);
1646 reinjectPerfAgent = (
IG_IA32_LSTAR == Msr) && (0 == OriginalValue) && (NULL != NewValue) && (0 != *NewValue);
1657 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
1674 ERROR(
"[ERROR] MSR callback set DisableOnReturn... We will try to disable introcore...\n");
1681 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 1693 _In_ void *GuestHandle,
1725 if (GuestHandle == NULL)
1744 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 1757 ERROR(
"[ERROR] A CR exit came for cpu %d, but we have only %d\n", CpuNumber,
gGuest.
CpuCount);
1768 ERROR(
"[ERROR] IntGetGprs failed: 0x%08x\n", status);
1776 if (Cr == pHook->Cr)
1780 if (pHook->Disabled)
1785 status = pHook->Callback(pHook->Context, Cr, OldValue, NewValue, &action);
1792 ERROR(
"[ERROR] IntHookCrRemoveHook failed: 0x%08x\n", status);
1796 if (action > *Action)
1808 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
1825 ERROR(
"[ERROR] CR%d callback set DisableOnReturn... We will try to disable introcore...\n", Cr);
1832 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 1868 found = hooked =
FALSE;
1889 ERROR(
"[ERROR] IntHandleEptViolation failed: 0x%08x\n", status);
1899 ERROR(
"[ERROR] IntPtsInt3CacheAdd failed for 0x%016llx: 0x%08x\n",
gVcpu->
Gpa, status);
1940 BOOLEAN found, hooked, paused;
1941 QWORD eptvGpa, eptvGla;
1942 DWORD violType, mode;
1947 found = hooked = paused =
FALSE;
1961 ERROR(
"[ERROR] #VE is supported only on Windows, how did we end up here?\n");
1965 TRACE(
"[#VE] Handling special user-mode page-walk, CR3 0x%016llx, GLA 0x%016llx\n",
1982 ERROR(
"[ERROR] IntGpaCacheFindAndAdd failed for GPA 0x%016llx: 0x%08x\n",
1991 if (0 != (oldVal &
PML4_P))
1995 newVal = oldVal |
PML4_A;
2047 else if (violType & 2)
2060 ERROR(
"[ERROR] IntGetCurrentMode failed: 0x%08x\n", status);
2061 goto cleanup_and_exit;
2068 ERROR(
"[ERROR] IntDecDecodeInstructionFromBuffer failed: 0x%08x\n", status);
2069 goto cleanup_and_exit;
2088 ERROR(
"[ERROR] IntGpaCachePatchAndAdd failed: 0x%08x\n", status);
2089 goto cleanup_and_exit;
2098 ERROR(
"[ERROR] IntHandleEptViolation failed: 0x%08x\n", status);
2099 goto cleanup_and_exit;
2141 _In_ void *GuestHandle,
2174 BOOLEAN bFound, bRaiseEptPt, bRaiseEptVe;
2176 bFound = bRaiseEptPt = bRaiseEptVe =
FALSE;
2178 if (NULL == GuestHandle)
2187 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 2200 ERROR(
"[ERROR] A VMCALL exit came for cpu %d, but we have only %d\n", CpuNumber,
gGuest.
CpuCount);
2211 ERROR(
"[ERROR] IntGetGprs failed: 0x%08x\n", status);
2227 ERROR(
"[ERROR] IntVeHandleHypercall failed: 0x%08x\n", status);
2265 ERROR(
"[ERROR] IntDetourCallCallback failed: 0x%08x\n", status);
2280 ERROR(
"[ERROR] IntAgentHandleVmcall failed: 0x%08x\n", status);
2295 ERROR(
"[ERROR] IntDispatchPtAsEpt failed: 0x%08x\n", status);
2298 else if (bRaiseEptVe)
2305 ERROR(
"[ERROR] IntDispatchVeAsEpt failed: 0x%08x\n", status);
2315 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
2332 ERROR(
"[ERROR] VMCALL callback set DisableOnReturn... We will try to disable introcore...\n");
2341 LOG(
"[INFO] VMCALL callback set BugCheckInProgress... We will try to disable introcore...\n");
2348 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 2360 _In_ void *GuestHandle
2396 if (NULL == GuestHandle)
2405 #if defined(CFG_PAUSE_VCPUS_ON_EVENTS) 2413 goto release_and_exit;
2421 goto release_and_exit;
2444 ERROR(
"[ERROR] IntWinInfHookProtect failed: 0x%08x\n", status);
2452 ERROR(
"[ERROR] IntIntegrityCheckAll failed: 0x%08x\n", status);
2460 ERROR(
"[ERROR] IntWinTokenCheckIntegrity failed: 0x%x\n", status);
2468 ERROR(
"[ERROR] IntWinSDCheckIntegrity failed: 0x%x\n", status);
2475 ERROR(
"[ERROR] IntWinProcValidateSystemCr3 failed: 0x%08x\n", status);
2482 ERROR(
"[ERROR] IntWinProcValidateSelfMapEntries failed: 0x%08x\n", status);
2489 ERROR(
"[ERROR] IntWinSudCheckIntegrity failed: 0x%08x\n", status);
2513 ERROR(
"[ERROR] IntHookPtsCheckIntegrity failed: 0x%08x\n", status);
2523 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
2569 #if defined(CFG_PAUSE_VCPUS_ON_EVENTS) 2581 _In_ void *GuestHandle,
2609 if (GuestHandle == NULL)
2627 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 2640 ERROR(
"[ERROR] A XCR exit came for cpu %d, but we have only %d\n", CpuNumber,
gGuest.
CpuCount);
2651 ERROR(
"[ERROR] IntGetGprs failed: 0x%08x\n", status);
2666 if (xcr == pHook->Xcr)
2670 if (pHook->Disabled)
2675 status = pHook->Callback(pHook->Context, xcr, &action);
2682 ERROR(
"[ERROR] IntHookXcrRemoveHook failed: 0x%08x\n", status);
2686 if (action > *Action)
2699 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
2716 ERROR(
"[ERROR] XCR callback set DisableOnReturn... We will try to disable introcore...\n");
2723 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 2735 _In_ void *GuestHandle,
2771 BOOLEAN found, emulated, noemu;
2775 if (GuestHandle == NULL)
2780 found = emulated = noemu =
FALSE;
2786 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 2799 WARNING(
"[WARNING] A BP exit came for cpu %d while the guest was not initialized. Will ignore.\n", CpuNumber);
2807 ERROR(
"[ERROR] A BP exit came for cpu %d, but we have only %d\n", CpuNumber,
gGuest.
CpuCount);
2818 ERROR(
"[ERROR] IntGetGprs failed: 0x%08x\n", status);
2843 ERROR(
"[ERROR] IntDetCallCallback failed: 0x%08x\n", status);
2867 ERROR(
"[ERROR] IntAgentHandleInt3 failed: 0x%08x\n", status);
2891 ERROR(
"[ERROR] IntAgentHandleInt3 failed: 0x%08x\n", status);
2908 if (instrux.Instruction == ND_INS_INT3 || (instrux.Instruction == ND_INS_INT && instrux.Immediate1 == 3))
2911 TRACE(
"[INFO] We have a breakpoint exit with instruction %s at RIP %llx, will reinject\n",
2912 instrux.Mnemonic, regs->
Rip);
2917 TRACE(
"[INFO] We have a breakpoint exit with instruction %s at RIP %llx, will ignore\n",
2918 instrux.Mnemonic, regs->
Rip);
2919 found = noemu =
TRUE;
2925 if (found && !emulated && !noemu)
2932 ERROR(
"[ERROR] IntSetGprs failed: 0x%08x\n", status);
2942 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
2959 ERROR(
"[ERROR] BP callback set DisableOnReturn... We will try to disable introcore...\n");
2968 ERROR(
"[ERROR] BP callback set BugCheckInProgress... We will try to disable introcore...\n");
2975 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 2987 _In_ void *GuestHandle,
3017 if (GuestHandle == NULL)
3026 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 3039 ERROR(
"[ERROR] A VMCALL exit came for cpu %d, but we have only %d\n", CpuNumber,
gGuest.
CpuCount);
3050 ERROR(
"[ERROR] IntGetGprs failed: 0x%08x\n", status);
3054 TRACE(
"[INFO] Injected vector 0x%02x, CR2 0x%016llx, ErrorCode %llx, CPU %d\n", Vector, Cr2, ErrorCode, CpuNumber);
3061 WARNING(
"[WARNING] IntHandleEventInjection was called, but no injection was done!\n");
3075 ERROR(
"[ERROR] UD INFO is NULL\n");
3096 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
3105 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 3117 _In_ void *GuestHandle,
3151 PINSTRUX instruction;
3152 QWORD gla, gpa, gla2, base;
3153 DTR newDtr = {0}, oldDtr = {0};
3154 BOOLEAN cacheuse, cbkfound, pagefound;
3157 if (NULL == GuestHandle)
3170 cbkfound = pagefound =
FALSE;
3176 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 3188 ERROR(
"[ERROR] A dtr violation came for cpu %d, but we have only %d\n", CpuNumber,
gGuest.
CpuCount);
3201 ERROR(
"[ERROR] IntGetGprs failed: 0x%08x\n", status);
3202 goto done_handling_dtr_violation;
3215 TRACE(
"[INFO] The page containing the RIP has been swapped out; will retry the instruction.\n");
3218 goto done_handling_dtr_violation;
3222 ERROR(
"[ERROR] IntDecDecodeInstructionAtRipWithCache failed: 0x%08x\n", status);
3223 goto done_handling_dtr_violation;
3228 if (instruction->Instruction != ND_INS_LIDT && instruction->Instruction != ND_INS_SIDT &&
3229 instruction->Instruction != ND_INS_LGDT && instruction->Instruction != ND_INS_SGDT &&
3230 instruction->Instruction != ND_INS_LLDT && instruction->Instruction != ND_INS_SLDT &&
3231 instruction->Instruction != ND_INS_LTR && instruction->Instruction != ND_INS_STR)
3233 ERROR(
"[ERROR] We have a DTR exit, but the instruction is not appropriate: %s\n", instruction->Mnemonic);
3235 goto done_handling_dtr_violation;
3240 if (instruction->Operands[0].Type != ND_OP_MEM)
3242 goto done_handling_dtr_violation;
3250 ERROR(
"[ERROR] IntDecComputeLinearAddress failed: 0x%08x\n", status);
3251 goto done_handling_dtr_violation;
3259 goto done_handling_dtr_violation;
3262 if (
IntHandlePageBoundaryCow(gla, instruction->Operands[0].Size, instruction->Operands[0].Access.Access, CpuNumber))
3267 goto done_handling_dtr_violation;
3273 ERROR(
"[ERROR] IntTranslateVirtualAddress failed: 0x%08x\n", status);
3274 goto done_handling_dtr_violation;
3281 ERROR(
"[ERROR] IntHandleMemAccess failed: 0x%08x\n", status);
3282 goto done_handling_dtr_violation;
3285 if (((gla + instruction->Operands[0].Size) & PAGE_MASK) != (gla & PAGE_MASK))
3288 gla2 = (gla + instruction->Operands[0].Size) & PAGE_MASK;
3293 ERROR(
"[ERROR] IntTranslateVirtualAddress failed: 0x%08x\n", status);
3294 goto done_handling_dtr_violation;
3298 (instruction->Operands[0].Access.Write ?
IG_EPT_HOOK_WRITE : IG_EPT_HOOK_READ));
3301 ERROR(
"[ERROR] IntHandleMemAccess failed: 0x%08x\n", status);
3302 goto done_handling_dtr_violation;
3309 LOG(
"[INFO] The memory handling callback returned action %d for instruction %s!\n",
3311 instruction->Mnemonic);
3313 goto done_handling_dtr_violation;
3317 if (ND_INS_LIDT != instruction->Instruction && ND_INS_LGDT != instruction->Instruction)
3320 goto done_handling_dtr_violation;
3324 if (ND_INS_LIDT == instruction->Instruction)
3329 ERROR(
"[ERROR] IntIdtFindBase failed: 0x%08x\n", status);
3330 goto done_handling_dtr_violation;
3333 else if (ND_INS_LGDT == instruction->Instruction)
3338 ERROR(
"[ERROR] IntGdtFindBase failed: 0x%08x\n", status);
3339 goto done_handling_dtr_violation;
3344 WARNING(
"[WARNING] Unknown instruction on DTR violation callback. Instruction code: %04d. Rip: 0x%016llx\n",
3345 instruction->Instruction, regs->
Rip);
3346 goto done_handling_dtr_violation;
3350 oldDtr.Limit = limit;
3355 ERROR(
"[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
3356 goto done_handling_dtr_violation;
3361 if ((0 == oldDtr.Base && 0 != newDtr.
Base) ||
3362 (oldDtr.Base == newDtr.
Base && oldDtr.Limit == newDtr.
Limit))
3364 goto done_handling_dtr_violation;
3371 if (pHook->Disabled)
3378 if (pHook->Flags == Flags)
3380 status = pHook->Callback(&oldDtr, &newDtr, Flags, Action);
3387 ERROR(
"[ERROR] IntHookIdtrRemoveHook failed: 0x%08x\n", status);
3395 done_handling_dtr_violation:
3402 ERROR(
"[ERROR] IntGuestPreReturnCallback failed: 0x%08x\n", status);
3408 ERROR(
"[ERROR] DTR callback set DisableOnReturn... We will try to disable introcore...\n");
3415 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 3427 _In_ void *GuestHandle,
3453 if (NULL == GuestHandle)
3458 if (NULL == EngineNotification)
3467 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 3474 goto done_handling_engine_result;
3485 ERROR(
"[ERROR] IntHandleExecCallback failed: 0x%08x\n", status);
3497 ERROR(
"[ERROR] IntWinHandleCmdLineCallback failed: 0x%08x\n", status);
3505 ERROR(
"[ERROR] IntLixCmdLineHandleCallback failed: 0x%08x\n", status);
3511 ERROR(
"[ERROR] Unknown engine notification type, value:%x\n", EngineNotification->Type);
3514 done_handling_engine_result:
3516 #ifdef CFG_PAUSE_VCPUS_ON_EVENTS 3546 ERROR(
"[ERROR] IntRegisterVmxTimerHandler failed: 0x%08x\n", status);
3553 ERROR(
"[ERROR] IntRegisterIntroCallHandler failed: 0x%08x\n", status);
3560 ERROR(
"[ERROR] IntRegisterEventInjectionHandler failed: 0x%08x\n", status);
3567 ERROR(
"[ERROR] IntRegisterEnginesResultCallback failed: 0x%08x\n", status);
BOOLEAN IntPtiIsPtrInAgent(QWORD Ptr, THS_PTR_TYPE Type)
Check if an address points inside the PT filter. Ignore non-executable sections when doing so...
TIMER_FRIENDLY void IntDumpArchRegs(IG_ARCH_REGS const *Registers)
This function dumps the register values in a user friendly format.
#define INT_STATUS_PAGE_NOT_PRESENT
Indicates that a virtual address is not present.
INTSTATUS IntDecGetAccessedMem(PINSTRUX Instrux, PIG_ARCH_REGS Registers, PIG_XSAVE_AREA XsaveArea, MEMADDR *Gla, DWORD *Count)
Decode each accessed address by an instruction.
QWORD PhysicalAddress
The physical address to which VirtualAddress translates to.
#define DEC_OPT_NO_CACHE
Flag used to hint the instruction decoder to not use the instruction cache.
INTSTATUS IntIdtFindBase(DWORD CpuNumber, QWORD *Base, WORD *Limit)
Returns the IDT base and limit for a guest CPU.
DWORD EptpIndex
The index of the current loaded EPT.
#define CONTAINING_RECORD(List, Type, Member)
QWORD OldValue
Old page-table entry.
INTSTATUS IntDecEmulateRead(PINSTRUX Instrux, BYTE *SrcValueBuffer)
Emulate a read access.
#define INTRO_OPT_VE
Enable the Virtualization exception page table access pre-filtering agent (64-bit Windows only)...
HOOK_HEADER Header
Hook header.
DWORD ReadCount
Number of read EPT hooks.
struct _ENG_NOTIFICATION_CMD_LINE * PENG_NOTIFICATION_CMD_LINE
void * gLock
A lock that ensures that all the events are serialized inside introcore.
void * Context
User-defined data that will be supplied to the callback.
LIST_HEAD GpaHooksWrite[GPA_HOOK_TABLE_SIZE]
Hash table of write hooks.
#define INT_STATUS_SKIP_OTHER_CALLBACKS
Commit all the MSR hooks.
#define GPA_HOOK_ID(addr)
INTSTATUS IntPtiRemoveInstruction(QWORD Rip)
Remove the hook on a monitored instruction.
BYTE Instruction[16]
Current instruction bytes.
BOOLEAN SingleStep
True if th VCPU is currently single-stepping the current instruction.
BYTE Vector
The injected exception number.
BOOLEAN PtContext
Set to True if we are in the context of a PT filter VMCALL.
INTSTATUS IntHookRemoveChain(PHOOK_GPA HookGpa)
Removes a hook chain, starting with the given GPA hook.
QWORD EatReadCount
The number of EAT reads that took place from withing known drivers.
IG_ARCH_REGS Regs
The current state of the guest registers.
INTSTATUS IntMtblCheckAccess(void)
Check if the current instruction is like a switch-case table access instruction.
DWORD Index
The VCPU number.
Measures CR violation exits.
QWORD GuestPhysicalAddress
Same as the GPA field provided on EPT Violations.
#define INT_STATUS_INSTRUCTION_PATCHED
Indicates that an instruction was patched.
INTSTATUS IntGuestDisableIntro(QWORD Flags)
Disables and unloads the introspection engine.
Handling an event injection.
#define CLEAN_PHYS_ADDRESS64(x)
QWORD SystemCr3
The Cr3 used to map the kernel.
#define INT_STATUS_SUCCESS
#define PAGE_REMAINING(addr)
WIN_KERNEL_DRIVER Win
Valid only for Windows guests.
BOOLEAN IsWritable
True if this page is writable.
INTSTATUS IntHandleMsrViolation(void *GuestHandle, DWORD Msr, IG_MSR_HOOK_TYPE Flags, INTRO_ACTION *Action, QWORD OriginalValue, QWORD *NewValue, DWORD CpuNumber)
Handle a model specific register violation.
INTSTATUS IntHandleExecCallback(PENG_NOTIFICATION_CODE_EXEC ExecNotification)
Handle the code execution scan result provided by the engines.
INTSTATUS IntCallbacksInit(void)
Initialize the callbacks.
INTSTATUS IntGetGprs(DWORD CpuNumber, PIG_ARCH_REGS Regs)
Get the current guest GPR state.
void IntVeDumpStats(void)
Dump VE statistics.
CR_HOOK_STATE * CrHooks
CR hook state.
void IntSpinLockRelease(void *SpinLock)
struct _LIST_ENTRY * Flink
static INTSTATUS IntDispatchVeAsEpt(void)
Dispatch a VE as an EPT violation.
Measures XCR violation exits.
INTSTATUS IntHandleDtrViolation(void *GuestHandle, DWORD Flags, DWORD CpuNumber, INTRO_ACTION *Action)
Handle GDTR, IDTR, LDTR, TR accesses.
QWORD AllowOnExecRip
The RIP which was allowed to execute on an exec violation.
QWORD Qualification
Same as the exit qualification provided on VM Exits.
Describes a memory address, as used in an instruction.
BOOLEAN RepOptDisabled
The state of the rep optimization feature.
BOOLEAN Initialized
True if this structure was initialized and can be used.
INTSTATUS IntVeHandleHypercall(DWORD CpuNumber)
Handles hyper calls initiated by the VE agent.
INTSTATUS IntWinInfHookProtect(void)
This function initializes protection against infinity hook mechanism.
BOOLEAN ShutDown
True if the system process protection is in beta (log-only) mode.
#define INT_SUCCESS(Status)
#define HOOK_FLG_DISABLED
If flag is set, the hook is disabled, therefore ignored on EPT violations.
QWORD NewValue
New page-table entry.
INTSTATUS IntHandleEptViolation(void *GuestHandle, QWORD PhysicalAddress, DWORD Length, QWORD LinearAddress, DWORD CpuNumber, INTRO_ACTION *Action, IG_EPT_ACCESS AccessType)
Handle an EPT violation.
INTSTATUS IntResumeVcpus(void)
Resumes the VCPUs previously paused with IntPauseVcpus.
Measures all EPT violations.
QWORD ExitAccess
The access type for which the EPT violation was generated.
DWORD WrittenMask
Bit mask indicating which bytes inside the page-table entry have been written.
BOOLEAN IntUpdateAreExceptionsLoaded(void)
Checks if the exceptions are loaded.
DWORD WriteCount
Number of write EPT hooks.
QWORD Cr3
Virtual address space where the address is monitored.
INTSTATUS IntRegisterVmxTimerHandler(PFUNC_IntIntroTimerCallback Callback)
BYTE EptHookType
The type of the hook in EPT (see IG_EPT_HOOK_TYPE)
REGISTERS Registers
Offset 0x30 - 0x200, general purpose registers.
INTSTATUS IntDecDecodeInstructionAtRip(DWORD CpuNumber, IG_ARCH_REGS *Registers, IG_SEG_REGS *Segments, INSTRUX *Instrux)
Decode an instruction at current RIP on the provided VCPU.
static BOOLEAN IntHandleCowOnPage(QWORD Gla, DWORD CpuNumber, BYTE AccessType)
Handle copy-on-write on a page.
QWORD Gla
The guest linear address for which the buffer is filled.
Measures the DTR violation exits.
INTSTATUS IntLixHandleCmdLineCallback(ENG_NOTIFICATION_CMD_LINE *EngineNotification)
Send a command line violation event.
BOOLEAN IntVeIsCurrentRipInAgent(void)
Check if the current RIP points inside the VE agent.
INTSTATUS IntCallbacksUnInit(void)
Uninit all the Introcore callbacks.
void IntSwapMemCancelPendingPF(QWORD VirtualAddress)
Cancel a pending PF.
static INTSTATUS IntDispatchPtAsEpt(void)
Dispatch a VMCALL issued by the PT filter as an EPT violation.
int INTSTATUS
The status data type.
QWORD GvaPage
Guest virtual page base address, aligned to 4K.
BOOLEAN Partial
True if the write is partial and not the entire page table entry is modified.
INTSTATUS IntDecComputeLinearAddress(PINSTRUX Instrux, PND_OPERAND Operand, PIG_ARCH_REGS Registers, QWORD *LinearAddress)
Given an instruction and a memory operand, it will compute the guest linear address encoded by that o...
QWORD gEventId
The ID of the current event.
INTSTATUS IntWinHandleCmdLineCallback(PENG_NOTIFICATION_CMD_LINE EngineNotification)
Handle a command line scan response.
BOOLEAN AllowOnExec
True if we returned introGuestAllowed on an execution alert.
BYTE Access
Access (read, write, or a combination).
INTSTATUS IntUnregisterVmxTimerHandler(void)
#define INT_STATUS_NOT_FOUND
struct _HOOK_GVA * PHOOK_GVA
HOOK_STATE * gHooks
Global hooks state.
static INTSTATUS IntHandleEventInjection(void *GuestHandle, DWORD Vector, QWORD ErrorCode, QWORD Cr2, DWORD CpuNumber)
Handle event injections inside the guest.
BOOLEAN IntMtblInsRelocated(QWORD Rip)
Check if the instruction at the provided RIP is instrumented.
INTSTATUS IntInjectExceptionInGuest(BYTE Vector, QWORD Cr2, DWORD ErrorCode, DWORD CpuNumber)
Injects an exception inside the guest.
#define TRFLG_NONE
No special options.
PVCPU_STATE VcpuArray
Array of the VCPUs assigned to this guest. The index in this array matches the VCPU number...
Measures the EPT violations for which the instruction does a read and a write.
INTSTATUS IntFlushEPTPermissions(void)
INTSTATUS IntHandleXcrWrite(void *GuestHandle, DWORD CpuNumber, INTRO_ACTION *Action)
Handle extended control registers writes.
BOOLEAN Valid
True if Data is valid, False if it is not.
INTSTATUS IntPauseVcpus(void)
Pauses all the guest VCPUs.
static BOOLEAN IntValidateTranslation(PHOOK_GPA Hook)
Checks if the given GPA hook points to a valid GVA hook with a correct translation.
INTRO_GUEST_TYPE OSType
The type of the guest.
INSTRUX Instruction
The current instruction, pointed by the guest RIP.
Commit all the memory hooks.
BOOLEAN Emulated
True if the access was already emulated; False if it was not emulated.
Measures event injections.
PVECPU VeInfoPage
Pointer to the VEINFO page used for this VCPU.
static BOOLEAN IntHandleFetchRetryOnPageBoundary(DWORD CpuNumber)
Handle instruction fetch at page boundary, if an EPT execute violation has been generated.
INTSTATUS IntEnginesResultCallback(void *GuestHandle, PENG_NOTIFICATION_HEADER EngineNotification)
Handler called by the integrator as soon as the engines report a scan result for a buffer...
INTSTATUS IntWinProcValidateSystemCr3(void)
This function checks if the system CR3 value was modified and if GUEST_STATE::KernelBetaDetections is...
Measures the handling of VMCALL exits.
MSR_HOOK_STATE * MsrHooks
MSR hook state.
DWORD AccessSize
The size of the memory access. Valid only for EPT exits.
INTSTATUS IntSetEPTPageProtection(DWORD EptIndex, QWORD Gpa, BYTE Read, BYTE Write, BYTE Execute)
Measures the execution of EPT violation handlers.
QWORD Cr3
Process PDBR. Includes PCID.
BYTE HookType
The type of the hook structure (see _HOOK_TYPE)
Exposes the functions used to schedule an asynchronous code execution scan and receives its result...
INTSTATUS IntGetCurrentMode(DWORD CpuNumber, DWORD *Mode)
Read the current CS type.
QWORD Gla
The guest linear address.
Command line notification for scan engines.
LIST_HEAD GpaHooksRead[GPA_HOOK_TABLE_SIZE]
Hash table of read hooks.
INTSTATUS IntGpaCacheRelease(PGPA_CACHE Cache, QWORD Gpa)
Release a previously used cached entry.
static int8_t _InterlockedCompareExchange8(int8_t volatile *Destination, int8_t Exchange, int8_t Comparand)
PHOOK_EPT_ENTRY IntHookGpaGetExistingEptEntry(QWORD GpaPage)
Get the EPT entry associated with the provided guest physical page.
TIMER_FRIENDLY void IntDumpInstruction(INSTRUX *Instruction, QWORD Rip)
This function dumps a given instruction (textual disassembly).
INTSTATUS IntRtlpVirtualUnwindCheckAccess(void)
Check if a memory read operation was issued by RtlpVirtualUnwind or friends and update the cache...
#define IG_TIMER_FREQUENCY
The timer frequency (1 call per second).
QWORD Flags
The entry that maps VirtualAddress to PhysicalAddress, together with all the control bits...
void IntHookGpaDump(void)
Dump the entire contents of the GPA hook system, listing each hook.
QWORD AllowOnExecGpa
The GPA which was allowed to execute on an exec violation.
#define INT_STATUS_NOT_INITIALIZED
INTSTATUS IntRegisterEnginesResultCallback(PFUNC_IntEventEnginesResultCallback Callback)
Thin wrapper over the optional GLUE_IFACE.RegisterEnginesResultCallback API.
INTSTATUS IntGuestPreReturnCallback(DWORD Options)
Handles all the operations that must be done before returning from a VMEXIT event handler...
INTSTATUS IntWinSelfMapValidateSelfMapEntries(void)
Validates the self map entries for every process in the system.
BOOLEAN PaeEnabled
True if Physical Address Extension is enabled.
INTSTATUS IntHookXcrRemoveHook(HOOK_XCR *Hook)
Remove an extended control register hook.
__noreturn void IntBugCheck(void)
QWORD New
The new, to be written, value of the page table entry.
XCR_HOOK_STATE * XcrHooks
XCR hook state.
static BOOLEAN gForceActionOnBeta
CPU_STATE State
The state of this VCPU. Describes what action is the VCPU currently doing.
Reinject the #VE or PT filtering agent, based on the active options.
BOOLEAN Guest64
True if this is a 64-bit guest, False if it is a 32-bit guest.
Measures EPT violations generated while the guest was in kernel mode.
QWORD Current
The currently used options.
QWORD Old
The old, original, value of the written page table entry.
PTWRITE_CACHE PtWriteCache
The last written PT entry.
Handling a breakpoint (int3).
struct _HOOK_HEADER * PHOOK_HEADER
void * ParentHook
The parent hook. For a GPA hook, for example, a GVA hook or a PagedHook will be the parent hook...
QWORD UserCr3
Process user PDBR. Includes PCID.
static INTSTATUS IntHandleMemAccess(QWORD LinearAddress, QWORD PhysicalAddress, DWORD Length, INTRO_ACTION *Action, BOOLEAN *CallbackFound, BOOLEAN *PageHooked, BOOLEAN ProbeOnly, IG_EPT_ACCESS AccessType)
Handle a memory access to a guest linear address.
INTSTATUS IntDecGetAccessedMemCount(PINSTRUX Instrux, DWORD *Count)
Decode the number of memory locations accessed by an instruction.
WORD Offset
The offset within the page where the hook starts. 0-4095 valid.
INTSTATUS IntTranslateVirtualAddress(QWORD Gva, QWORD Cr3, QWORD *PhysicalAddress)
Translates a guest virtual address to a guest physical address.
void * GpaCache
The currently used GPA cache.
QWORD GpaPage
The page where the hook is set.
static BOOLEAN IntHandlePageBoundaryCow(QWORD Gla, DWORD AccessSize, BYTE AccessType, DWORD CpuNumber)
Check if we have a copy-on-write condition at a page boundary.
BOOLEAN gInjectVeUnloader
#define INT_STATUS_INVALID_PARAMETER_4
INTSTATUS IntDecDecodeInstructionFromBuffer(PBYTE Buffer, size_t BufferSize, IG_CS_TYPE CsType, void *Instrux)
Decode an instruction from the provided buffer.
Measures the decoding of instructions that generate EPT violations.
INTSTATUS IntSetIntroEmulatorContext(DWORD CpuNumber, QWORD VirtualAddress, DWORD BufferSize, BYTE *Buffer)
Execution notification for scan engines.
BOOLEAN GuestInitialized
True if the OS-specific portion has been initialized.
QWORD Gpa
The accessed guest physical address. Valid only for EPT exits.
static BOOLEAN IntValidatePageRightsEx(QWORD LinearAddress, QWORD PhysicalAddress, DWORD Access)
Check if the access rights for the provided PhysicalAddress are up-to-date in the EPT...
INFO_UD_PENDING * CurrentUD
The currently pending #UD injection on this CPU.
PWIN_PROCESS_OBJECT IntWinProcFindObjectByCr3(QWORD Cr3)
Finds a process by its kernel CR3.
INTSTATUS IntHandleCrWrite(void *GuestHandle, DWORD Cr, DWORD CpuNumber, QWORD OldValue, QWORD NewValue, INTRO_ACTION *Action)
Handle a control register violation.
#define INT_STATUS_INVALID_PARAMETER_5
Measures EPT violations generated while the guest was in user mode.
#define INT_STATUS_INVALID_INTERNAL_STATE
INTSTATUS IntAgentHandleInt3(QWORD Rip, DWORD CpuNumber)
Dispatch a breakpoint event to the Windows or Linux agent breakpoint handler.
INTSTATUS IntHookCrRemoveHook(HOOK_CR *Hook)
Remove a control register hook.
Contains information about the patch buffer.
QWORD ExitGpa
The accessed guest physical address, for which the EPT violation was generated.
INTSTATUS IntHookPtwEmulateWrite(QWORD Address)
Emulate a write that took place on page table entry at Address.
INTSTATUS IntAgentHandleVmcall(QWORD Rip)
Dispatch a VMCALL event to the Windows or Linux agent VMCALL handler.
Measures the INT3 events.
struct _ENG_NOTIFICATION_CODE_EXEC * PENG_NOTIFICATION_CODE_EXEC
BYTE WordSize
Guest word size. Will be 4 for 32-bit guests and 8 for 64-bit guests.
DWORD RepOptsDisableCount
The number of times the rep optimizations have been disabled.
QWORD GuestLinearAddress
Same as the GLA field provided on EPT Violations.
INTSTATUS IntTranslateVirtualAddressEx(QWORD Gva, QWORD Cr3, DWORD Flags, VA_TRANSLATION *Translation)
Translates a guest virtual address to a guest physical address.
#define INT_STATUS_NO_DETOUR_EMU
Signals that no emulation is needed for this event.
QWORD Cr2
The Cr2. Valid only if Vector is 14 (Page Fault)
INTSTATUS IntHookMsrRemoveHook(HOOK_MSR *Hook)
Remove a model specific register hook.
#define INT_STATUS_UNINIT_BUGCHECK
Indicates that the guest crashed and Introcore must be deactivated.
QWORD Xcr0
The value of XCR0. Updated by IntHandleXcrWrite.
INTSTATUS IntDetCallCallback(void)
Calls the appropriate detour handler for hypercall.
LIST_HEAD MsrHooksList
The list of MSR hooks.
Command line scan results.
INTSTATUS IntUnregisterEventInjectionHandler(void)
INTSTATUS IntWinSDCheckIntegrity(void)
This function checks the integrity of the security descriptor for all the processes inside gWinProces...
HOOK_GPA_STATE GpaHooks
GPA hooks state.
INTSTATUS IntVeHandleEPTViolationInProtectedView(IG_EPT_ACCESS AccessType, INTRO_ACTION *Action)
Handle an EPT violation inside the protected EPT view.
void IntSpinLockAcquire(void *SpinLock)
INTSTATUS IntPtiCacheAdd(QWORD Gpa)
Add a guest-physical address to the PT filter cache of entries for which an exit is not required...
DTR_HOOK_STATE * DtrHooks
DTR hook state.
A descriptor table register. Valid for IDTR and GDTR.
DWORD CpuCount
The number of logical CPUs.
#define UNREFERENCED_PARAMETER(P)
void IntStatsDumpAll(void)
Prints all the non-zero stats.
Exposes the functions used to schedule an asynchronous command line scan and receives its result...
void * InstructionCache
The currently used instructions cache.
INTSTATUS IntRegisterIntroCallHandler(PFUNC_IntIntroCallCallback Callback)
Measures the timer events.
Measures the VMCALL exists generated by the page table filtering agent.
DWORD ProtectedEptIndex
The EPTP index of the trusted EPT.
IG_MSR_HOOK_TYPE
The type of the MSR access.
#define INT_STATUS_INVALID_PARAMETER_6
enum _INTRO_ACTION INTRO_ACTION
Event actions.
PHOOK_PTS_ENTRY Parent
The leaf page-table entry hook associated with this address.
WORD Length
The length, in bytes, of the hook. 1-4096 valid.
INTSTATUS IntPtiHandleInt3(void)
This function is the main INT3 handler.
static void IntValidatePageRights(QWORD LinearAddress, QWORD PhysicalAddress, DWORD Access)
Check if the access rights for the provided PhysicalAddress are up-to-date in the EPT...
INTSTATUS IntSetGprs(DWORD CpuNumber, PIG_ARCH_REGS Regs)
Sets the values of the guest GPRs.
INTSTATUS IntGetEPTPageProtection(DWORD EptIndex, QWORD Gpa, BYTE *Read, BYTE *Write, BYTE *Execute)
#define IntDbgEnterDebugger()
INTSTATUS IntHookPtsCheckIntegrity(void)
Checks the integrity of the existing page-table hooks. Used for debugging the PT filter.
INTSTATUS IntHandleBreakpoint(void *GuestHandle, QWORD GuestPhysicalAddress, DWORD CpuNumber)
Handle guest breakpoints.
#define INT_STATUS_FATAL_ERROR
An unrecoverable error was detected. Introcore must be unloaded.
void IntUDRemoveEntry(INFO_UD_PENDING **InfoUD)
Remove a pending UD entry.
MM Mm
Guest memory information, such as paging mode, system Cr3 value, etc.
Measures MSR violation exits.
PATCH_BUFFER PatchBuffer
The patch buffer used to emulate reads.
GUEST_STATE gGuest
The current guest state.
BOOLEAN VeContext
Set to True if we are in the context of the #VE agent.
QWORD ExitGla
The accessed guest linear address, for which the EPT violation was generated.
Execution attempt result.
INTSTATUS IntVirtMemRead(QWORD Gva, DWORD Length, QWORD Cr3, void *Buffer, DWORD *RetLength)
Reads data from a guest virtual memory range.
Measures write EPT violations.
LIST_HEAD GpaHooksExecute[GPA_HOOK_TABLE_SIZE]
Hash table of execute hooks.
static int64_t _InterlockedCompareExchange64(int64_t volatile *Destination, int64_t Exchange, int64_t Comparand)
enum _STAT_ID STAT_ID
Stat IDs.
TIMER_FRIENDLY void IntDumpGva(QWORD Gva, DWORD Length, QWORD Cr3)
This function is a wrapper over IntDumpGvaEx (it uses RowLength = 16, ElementLength = 1...
INTSTATUS IntDecDecodeAccessSize(PINSTRUX Instrux, PIG_ARCH_REGS Registers, QWORD Gla, BYTE AccessType, DWORD *AccessSize)
Decode the memory access size of a given instruction.
QWORD TimerCalls
The number of times the timer callback has been invoked.
struct _VCPU_STATE::@80 Exception
The exception to be injected in guest.
INTSTATUS IntDecDecodeDestinationLinearAddressFromInstruction(PINSTRUX Instrux, PIG_ARCH_REGS Registers, QWORD *LinearAddress)
Decode the destination memory linear address.
void IntSwapMemReinjectFailedPF(void)
Reinject timed-out PFs.
INTSTATUS IntHandleTimer(void *GuestHandle)
Periodically called by the integrator, once every second.
INTSTATUS IntGpaCacheFindAndAdd(PGPA_CACHE Cache, QWORD Gpa, void **Hva)
Search for an entry in the GPA cache, and add it, if it wasn't found.
Commit all the XCR hooks.
#define INT_STATUS_RAISE_EPT
Raises an EPT event. Can be used to treat another event as an EPT violation.
#define INT_STATUS_NO_MAPPING_STRUCTURES
Indicates that not all mapping structures of a virtual address are present.
HOOK_PTEWS WriteState
Write state.
#define INT_STATUS_REMOVE_AND_SKIP
DWORD ExecuteCount
Number of execute EPT hooks.
PHOOK_PTS PtsHook
The page tables hook.
#define HOOK_PTS_MONITORED_BITS
BOOLEAN IntVeIsAgentRemapped(QWORD Gla)
Checks if a given guest linear address belongs to the VE agent.
#define INT_STATUS_NOT_INITIALIZED_HINT
DWORD Size
The valid size of the Data buffer.
Encapsulates information about a virtual to physical memory translation.
KERNEL_DRIVER * KernelDriver
Points to the driver object that describes the kernel image.
#define INT_STATUS_INVALID_PARAMETER_8
Measures the look-up of EPT violation handlers.
BOOLEAN Valid
True if the fields are valid; False if they are not.
PFUNC_EptViolationCallback Callback
The callback for this hook.
#define INT_STATUS_INVALID_PARAMETER_1
LIST_HEAD XcrHooksList
The list of XCR hooks.
#define INT_STATUS_NOT_SUPPORTED
VCPU_STATE * gVcpu
The state of the current VCPU.
#define INT_STATUS_FORCE_ACTION_ON_BETA
LIST_HEAD CrHooksList
The list of CR hooks.
INTSTATUS IntGpaCachePatchAndAdd(PGPA_CACHE Cache, QWORD Gpa, DWORD Size, PBYTE Buffer)
Patch data in a cached entry, or add it to the cache, of not already present.
TIMER_FRIENDLY INTSTATUS IntWinTokenCheckIntegrity(void)
This function checks the integrity of the security token for all the processes inside gWinProcesses...
INTSTATUS IntUnregisterIntroCallHandler(void)
INTSTATUS IntGdtFindBase(DWORD CpuNumber, QWORD *GdtBase, WORD *GdtLimit)
Returns the GDT base and limit for a guest CPU.
void IntGuestUpdateCoreOptions(QWORD NewOptions)
Updates Introcore options.
INTSTATUS IntDecDecodeInstructionAtRipWithCache(void *Cache, DWORD CpuNumber, PIG_ARCH_REGS Registers, PINSTRUX Instrux, DWORD Options, BOOLEAN *CacheHit, BOOLEAN *Added)
Decode an instruction using the cache.
INTSTATUS IntGetCurrentEptIndex(DWORD CpuNumber, DWORD *EptpIndex)
Get the EPTP index of the currently loaded EPT.
BOOLEAN BugCheckInProgress
INTSTATUS IntGetCurrentRing(DWORD CpuNumber, DWORD *Ring)
Read the current protection level.
DWORD Flags
Generic flags. Check out EPT Hook flags.
BOOLEAN Valid
True if the information in this structure is valid; False it it is not.
BOOLEAN DisableOnReturn
Set to True if after returning from this event handler, introcore must be unloaded.
INTSTATUS IntRegisterEventInjectionHandler(PFUNC_IntEventInjectionCallback Callback)
unsigned long long * PQWORD
INTSTATUS IntIntegrityCheckAll(void)
The function which is called once every second and checks all the integrity regions.
#define INTRO_OPT_IN_GUEST_PT_FILTER
Enable in-guest page-table filtering (64-bit Windows only).
TIMER_FRIENDLY INTSTATUS IntWinSudCheckIntegrity(void)
This function checks the integrity of protected fields from SharedUserData, described in gProtFields...
#define list_for_each(_head, _struct_type, _var)
Measures execute EPT violations.
PTEMU_BUFFER PtEmuBuffer
The page table write emulator buffer.
#define INT_STATUS_REMOVE_HOOK_ON_RET
Can be used by hook callbacks in order to signal that the hook should be removed. ...
#define HOOK_PAGE_TABLE_FLAGS
Any of these flags set indicates that we are dealing with a page table page.
INTSTATUS IntToggleRepOptimization(BOOLEAN Enable)
BYTE Data[ND_MAX_REGISTER_SIZE]
The actual contents of the buffer.
#define INT_STATUS_INVALID_PARAMETER_2
INTRO_PROT_OPTIONS CoreOptions
The activation and protection options for this guest.
QWORD Gla
The accessed guest virtual address. Valid only for EPT exits.
Measures read EPT violations.
INTSTATUS IntUnregisterBreakpointHandler(void)
INTSTATUS IntHandleIntroCall(void *GuestHandle, QWORD Rip, DWORD CpuNumber)
Handle a VMCALL issued inside the guest.
Notification header for scan engines alerts.
INTSTATUS IntUnregisterEnginesResultCalback(void)
Thin wrapper over the optional GLUE_IFACE.UnregisterEnginesResultCalback API.
Inject pending page faults.
void IntHookPtsDump(void)
Prints all the page table hooks.
Commit all the DTR hooks.
#define HOOK_FLG_REMOVE
If flag is set, the hook has been removed, and waits the next commit to be actually deleted...
INTSTATUS IntHookDtrRemoveHook(HOOK_DTR *Hook)
Remove a descriptor register hook.
Exposes the functions used to schedule an asynchronous command line scan and receives its result...
#define INT_STATUS_INVALID_PARAMETER_7
LIST_HEAD DtrHooksList
The list of DTR hooks.
This structure describes a running process inside the guest.
#define INT_STATUS_INVALID_PARAMETER_3