codeblocks.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _CODEBLOCKS_H_
#define _CODEBLOCKS_H_

#include "exceptions.h"


typedef enum
{
    cbLevelNormal = 1,  
    cbLevelMedium,      
} CB_EXTRACT_LEVEL;


typedef enum
{
    codeInsInvalid = 0,         
    codeInsJc,                  
    codeInsJmp,                 
    codeInsCall,                
    codeInsRet,                 
    codeInsStr,                 
    codeInsXchg,                
    codeInsBt,                  
    codeInsMovReg,              
    codeInsMovMem,              
    codeInsMovImm,              
    codeInsMovFsGs,             
    codeInsFlags,               
} CODE_INS;


#define CODE_BLOCK_CHUNKS_COUNT             8


typedef struct _CODE_BLOCK
{
    DWORD           OffsetStart;        
    DWORD           Hash;               
    WORD            Size;               
    BYTE            PivotInstruction;   
    BYTE            Chunks[CODE_BLOCK_CHUNKS_COUNT];
} CODE_BLOCK, *PCODE_BLOCK;


#pragma pack(push)
#pragma pack(1)

typedef struct _CODE_BLOCK_PATTERN
{
    DWORD Offset;   
    BYTE  Value;    
} CODE_BLOCK_PATTERN, *PCODE_BLOCK_PATTERN;
#pragma pack(pop)


//
// API
//
INTSTATUS
IntFragExtractPattern(
    _In_reads_(MaxBufferSize) BYTE *Buffer,
    _In_ DWORD MaxBufferSize,
    _In_ IG_CS_TYPE CsType,
    _In_ CB_EXTRACT_LEVEL ExtractLevel,
    _In_ DWORD PatternSize,
    _Out_writes_to_(PatternSize, *TotalExtracted) BYTE *Pattern,
    _Out_ DWORD *TotalExtracted,
    _Inout_ DWORD *TotalParsed
    );

INTSTATUS
IntFragExtractCodeBlocks(
    _In_reads_(MaxBufferSize) BYTE *Buffer,
    _In_ DWORD MaxBufferSize,
    _In_ IG_CS_TYPE CsType,
    _In_ CB_EXTRACT_LEVEL ExtractLevel,
    _Inout_ DWORD *HashesCount,
    _Out_writes_(*HashesCount) DWORD *Hashes
    );

__pure INTSTATUS
IntFragMatchSignature(
    _In_ const DWORD *Hashes,
    _In_ DWORD CodeBlocksCount,
    _In_ const SIG_CODEBLOCKS *ExceptionSignature
    );

INTSTATUS
IntFragExtractCodePattern(
    _In_ PBYTE Buffer,
    _In_ DWORD StartOffset,
    _In_ DWORD MaxBufferSize,
    _In_ IG_CS_TYPE CsType,
    _In_ CB_EXTRACT_LEVEL ExtractLevel,
    _In_ DWORD PatternSize,
    _Out_writes_to_(PatternSize, *TotalExtracted) CODE_BLOCK_PATTERN *Pattern,
    _Out_ DWORD *TotalExtracted
    );

INTSTATUS
IntFragDumpBlocks(
    _In_ PBYTE Buffer,
    _In_ QWORD StartAddress,
    _In_ DWORD MaxBufferSize,
    _In_ IG_CS_TYPE CsType,
    _In_ CB_EXTRACT_LEVEL ExtractLevel,
    _In_ QWORD Rip,
    _In_ BOOLEAN ReturnRip
    );

#endif // _CODEBLOCKS_H_