drivers.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _DRIVER_H_
#define _DRIVER_H_

#include "lixmodule.h"
#include "windriver.h"

typedef struct _DRIVER_EXPORT_CACHE_ENTRY
{
    QWORD Rip;              

    struct
    {
        BYTE Unknown : 1;   
        BYTE Export  : 1;   
    } Type;
} DRIVER_EXPORT_CACHE_ENTRY, *PDRIVER_EXPORT_CACHE_ENTRY;

typedef struct _KERNEL_DRIVER
{
    LIST_ENTRY  Link;

    QWORD       ObjectGva;
    QWORD       BaseVa;
    QWORD       Size;
    QWORD       EntryPoint;
    QWORD       ProtectionFlag;

    void        *Name;
    SIZE_T      NameLength;

    DWORD       NameHash;

    void        *HookObject;

    BOOLEAN     Protected;

    union
    {
        WIN_KERNEL_DRIVER   Win;  
        LIX_KERNEL_MODULE   Lix;  
    };
} KERNEL_DRIVER, *PKERNEL_DRIVER;


INTSTATUS
IntDriverLoadHandler(
    _In_ void const *Detour
    );

INTSTATUS
IntDriverUnloadHandler(
    _In_ void const *Detour
    );

KERNEL_DRIVER *
IntDriverFindByAddress(
    _In_ QWORD Gva
    );

KERNEL_DRIVER *
IntDriverFindByBase(
    _In_ QWORD Gva
    );

KERNEL_DRIVER *
IntDriverFindByLoadOrder(
    _In_ DWORD LoadOrder
    );

KERNEL_DRIVER *
IntDriverFindByName(
    _In_ const void *Name
    );

KERNEL_DRIVER *
IntDriverFindByPath(
    _In_ const WCHAR *Path
    );

void
IntDriverUninit(
    void
    );

void
IntDriverDump(
    void
    );

void
IntDriverCacheCreateExport(
    _In_ const QWORD Rip
    );

void
IntDriverCacheCreateUnknown(
    _In_ const QWORD Rip
    );

DRIVER_EXPORT_CACHE_ENTRY *
IntDriverCacheExportFind(
    _In_ const QWORD Rip
    );

void
IntDriverCacheInv(
    _In_ const QWORD BaseAddress,
    _In_ const QWORD Length
    );

#endif // _DRIVER_H_