drivers.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "drivers.h"
#include "guests.h"

LIST_HEAD gKernelDrivers = LIST_HEAD_INIT(gKernelDrivers);

#define for_each_driver(_var_name) list_for_each (gKernelDrivers, KERNEL_DRIVER, _var_name)

#define MAX_DRIVER_EXPORT_CACHE_ENTRIES 10

typedef struct _DRIVER_EXPORT_CACHE
{
    WORD                        CurrentEntry;
    DRIVER_EXPORT_CACHE_ENTRY   Entry[MAX_DRIVER_EXPORT_CACHE_ENTRIES];
} DRIVER_EXPORT_CACHE, *PDRIVER_EXPORT_CACHE;

static DRIVER_EXPORT_CACHE gDriverExportCache = {0};


INTSTATUS
IntDriverLoadHandler(
    _In_ void const *Detour
    )
{
    INTSTATUS status;
    IG_ARCH_REGS const *pRegs = &gVcpu->Regs;

    UNREFERENCED_PARAMETER(Detour);

    if (gGuest.OSType == introGuestLinux)
    {
        status = IntLixDrvCreateFromAddress(pRegs->R8, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixDrvCreateFromAddress failed for module 0x%016llx: 0x%08x\n", pRegs->Rdi, status);
            IntDbgEnterDebugger();
        }
    }
    else
    {
        QWORD args[2];
        QWORD ldrAddress;
        DWORD load;

        status = IntDetGetArguments(Detour, 2, args);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntDetGetArguments failed: 0x%08x\n", status);
            return status;
        }

        ldrAddress = args[0];
        load = (args[1] & 0xFFFFFFFF) > 0;

        // The module is unloading, we are not interested in this, we already caught that...
        if (!load)
        {
            return INT_STATUS_SUCCESS;
        }

        status = IntWinDrvCreateFromAddress(ldrAddress, FLAG_DYNAMIC_DETECTION);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinDrvCreateFromAddress failed for GVA 0x%016llx: 0x%08x\n", ldrAddress, status);
            IntDbgEnterDebugger();
        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntDriverUnloadHandler(
    _In_ void const *Detour
    )
{
    INTSTATUS status;
    IG_ARCH_REGS const *pRegs = &gVcpu->Regs;

    UNREFERENCED_PARAMETER(Detour);

    if (gGuest.OSType == introGuestLinux)
    {
        status = IntLixDrvRemoveFromAddress(pRegs->R8);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixDrvRemoveFromAddress failed for GVA 0x%016llx: 0x%08x\n", pRegs->Rdi, status);
            IntDbgEnterDebugger();
        }
    }
    else
    {
        QWORD ldrAddress = 0;

        status = IntDetGetArgument(Detour, 0, NULL, 0, &ldrAddress);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntDetGetArgument failed: 0x%08x\n", status);
            return status;
        }

        status = IntWinDrvRemoveFromAddress(ldrAddress);
        if (!INT_SUCCESS(status) && (INT_STATUS_NOT_FOUND != status))
        {
            ERROR("[ERROR] IntWinDrvRemoveFromAddress failed for GVA 0x%016llx: 0x%08x\n", ldrAddress, status);
            IntDbgEnterDebugger();
        }
    }

    return INT_STATUS_SUCCESS;
}


KERNEL_DRIVER *
IntDriverFindByAddress(
    _In_ QWORD Gva
    )
{
    for_each_driver(pDriver)
    {
        if (pDriver->BaseVa <= Gva && pDriver->BaseVa + pDriver->Size > Gva)
        {
            return pDriver;
        }
    }

    if (gGuest.OSType == introGuestWindows)
    {
        return NULL;
    }

    for_each_driver(pDriver)
    {
        if (pDriver->Lix.Initialized)
        {
            continue;
        }

        if (IN_RANGE_LEN(Gva, pDriver->Lix.InitLayout.Base, pDriver->Lix.InitLayout.Size))
        {
            return pDriver;
        }
    }

    return NULL;
}


KERNEL_DRIVER *
IntDriverFindByBase(
    _In_ QWORD Gva
    )
{
    for_each_driver(pDriver)
    {
        if (pDriver->BaseVa == Gva)
        {
            return pDriver;
        }
    }

    return NULL;
}


KERNEL_DRIVER *
IntDriverFindByLoadOrder(
    _In_ DWORD LoadOrder
    )
{
    DWORD currentPosition = 0;

    for_each_driver(pDriver)
    {
        if (LoadOrder == currentPosition)
        {
            return pDriver;
        }

        currentPosition++;
    }

    return NULL;
}


KERNEL_DRIVER *
IntDriverFindByName(
    _In_ const void *Name
    )
{
    if (NULL == Name)
    {
        return NULL;
    }

    for_each_driver(pDriver)
    {
        int cmp = 1;

        if (NULL == pDriver->Name)
        {
            continue;
        }

        if (gGuest.OSType == introGuestWindows)
        {
            cmp = wstrcasecmp(Name, pDriver->Name);
        }
        else
        {
            cmp = strcmp(pDriver->Name, Name);
        }

        if (0 == cmp)
        {
            return pDriver;
        }
    }

    return NULL;
}


KERNEL_DRIVER *
IntDriverFindByPath(
    _In_ const WCHAR *Path
    )
{
    // We have no path on Linux, so no need for it
    if (introGuestLinux == gGuest.OSType)
    {
        return NULL;
    }

    if (NULL == Path)
    {
        return NULL;
    }

    for_each_driver(pDriver)
    {
        if (NULL == pDriver->Win.Path)
        {
            continue;
        }

        if (0 == wstrcasecmp(Path, pDriver->Win.Path))
        {
            return pDriver;
        }
    }

    return NULL;
}


void
IntDriverUninit(
    void
    )
{
    for_each_driver(pDriver)
    {
        INTSTATUS status;

        RemoveEntryList(&pDriver->Link);

        if (gGuest.OSType == introGuestLinux)
        {
            status = IntLixDrvRemoveEntry(pDriver);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntLixDrvRemoveEntry failed: 0x%08x\n", status);
            }
        }
        else
        {
            status = IntWinDrvRemoveEntry(pDriver);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntWinDrvRemoveEntry failed: 0x%08x\n", status);
            }
        }
    }
}


void
IntDriverDump(
    void
    )
{
    DWORD i = 0;

    for_each_driver(pDriver)
    {
        if (gGuest.OSType == introGuestLinux)
        {
            LOG("  #%03d I: %d, Core: 0x%016llx, CoreSize: 0x%08llx, CoreTextSize: 0x%08x, "
                "CoreRoSize: 0x%08x, Name: '%s'\n",
                i++,
                pDriver->Lix.Initialized,
                pDriver->BaseVa,
                pDriver->Size,
                pDriver->Lix.CoreLayout.TextSize,
                pDriver->Lix.CoreLayout.RoSize,
                (char *)pDriver->Name);
        }
        else
        {
            LOG("  #%03d Base: 0x%016llx, Size: 0x%08llx, PathHash: 0x%08x, NameHash: 0x%08x, Name: '%s'\n",
                i++, pDriver->BaseVa, pDriver->Size, pDriver->Win.PathHash,
                pDriver->NameHash, utf16_for_log(pDriver->Name));

            if (pDriver->Win.DriverObject)
            {
                LOG("------> 0x%016llx : %s\n",
                    pDriver->Win.DriverObject->DriverObjectGva,
                    utf16_for_log(((PWIN_DRIVER_OBJECT)pDriver->Win.DriverObject)->Name));
            }
        }
    }
}


void
IntDriverCacheCreateExport(
    _In_ const QWORD Rip
    )
{
    if (gDriverExportCache.CurrentEntry == MAX_DRIVER_EXPORT_CACHE_ENTRIES)
    {
        gDriverExportCache.CurrentEntry = 0;
    }

    memzero(&gDriverExportCache.Entry[gDriverExportCache.CurrentEntry], sizeof(DRIVER_EXPORT_CACHE_ENTRY));

    gDriverExportCache.Entry[gDriverExportCache.CurrentEntry].Rip = Rip;
    gDriverExportCache.Entry[gDriverExportCache.CurrentEntry].Type.Export = 1;

    gDriverExportCache.CurrentEntry++;
}


void
IntDriverCacheCreateUnknown(
    _In_ const QWORD Rip
    )
{
    if (gDriverExportCache.CurrentEntry == MAX_DRIVER_EXPORT_CACHE_ENTRIES)
    {
        gDriverExportCache.CurrentEntry = 0;
    }

    memzero(&gDriverExportCache.Entry[gDriverExportCache.CurrentEntry], sizeof(DRIVER_EXPORT_CACHE_ENTRY));

    gDriverExportCache.Entry[gDriverExportCache.CurrentEntry].Rip = Rip;
    gDriverExportCache.Entry[gDriverExportCache.CurrentEntry].Type.Unknown = 1;

    gDriverExportCache.CurrentEntry++;
}


DRIVER_EXPORT_CACHE_ENTRY *
IntDriverCacheExportFind(
    _In_ const QWORD Rip
    )
{
    for (DWORD index = 0; index < ARRAYSIZE(gDriverExportCache.Entry); index++)
    {
        if (Rip == gDriverExportCache.Entry[index].Rip)
        {
            return &gDriverExportCache.Entry[index];
        }
    }

    return NULL;
}


void
IntDriverCacheInv(
    _In_ const QWORD BaseAddress,
    _In_ const QWORD Length
    )
{
    for (DWORD index = 0; index < ARRAYSIZE(gDriverExportCache.Entry); index++)
    {
        if (IN_RANGE_LEN(gDriverExportCache.Entry[index].Rip, BaseAddress, Length))
        {
            memzero(&gDriverExportCache.Entry[index], sizeof(DRIVER_EXPORT_CACHE_ENTRY));
        }
    }
}