Bitdefender Hypervisor Memory Introspection
dumper.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
10 
11 #ifndef _DUMPER_H_
12 #define _DUMPER_H_
13 
14 #include "glue.h"
15 #include "bddisasm.h"
16 #include "wddefs.h"
17 
19 
21 __nonnull() void
23  _In_ IG_ARCH_REGS const *Registers
24  );
25 
27 __nonnull() void
29  _In_reads_bytes_(Length) const void *Buffer,
30  _In_opt_ QWORD Gva,
31  _In_ DWORD Length,
32  _In_opt_ DWORD RowLength,
33  _In_opt_ DWORD ElementLength,
34  _In_opt_ BOOLEAN LogHeader,
35  _In_opt_ BOOLEAN DumpAscii
36  );
37 
38 TIMER_FRIENDLY void
40  _In_ QWORD Gva,
41  _In_ DWORD Length,
42  _In_opt_ QWORD Cr3,
43  _In_opt_ DWORD RowLength,
44  _In_opt_ DWORD ElementLength,
45  _In_opt_ BOOLEAN LogHeader,
46  _In_opt_ BOOLEAN DumpAscii
47  );
48 
49 TIMER_FRIENDLY void
51  _In_ QWORD Gva,
52  _In_ DWORD Length,
53  _In_opt_ QWORD Cr3
54  );
55 
56 __nonnull() void
58  _In_ void *Buffer,
59  _In_ DWORD Length,
61  );
62 
63 void
65  _In_ QWORD Gva,
66  _In_ DWORD Length
67  );
68 
69 TIMER_FRIENDLY void
71  _In_ INSTRUX *Instruction,
72  _In_opt_ QWORD Rip
73  );
74 
75 __nonnull() void
77  _In_ const char *FunctionName
78  );
79 
80 __nonnull() void
82  _In_ BYTE *Page,
83  _In_ DWORD Offset,
84  _In_ IG_CS_TYPE CsType,
85  _In_ IG_ARCH_REGS *Registers
86  );
87 
88 __nonnull() INTSTATUS
90  _In_ QWORD Gva,
91  _In_ QWORD Gpa,
92  _In_ IG_ARCH_REGS *Registers
93  );
94 
95 void
97  _In_ LIX_TRAP_FRAME *TrapFrame
98  );
99 
100 void
102  _In_ KTRAP_FRAME64 *TrapFrame
103  );
104 
105 void
107  _In_ KTRAP_FRAME32 *TrapFrame
108  );
109 
110 #endif // _DUMPER_H_
TIMER_FRIENDLY void IntDumpArchRegs(IG_ARCH_REGS const *Registers)
This function dumps the register values in a user friendly format.
Definition: dumper.c:20
#define _In_opt_
Definition: intro_sal.h:16
_Bool BOOLEAN
Definition: intro_types.h:58
uint8_t BYTE
Definition: intro_types.h:47
#define _In_
Definition: intro_sal.h:21
void IntDumpLixUmTrapFrame(LIX_TRAP_FRAME *TrapFrame)
This function dumps a Linux UM trap frame.
Definition: dumper.c:741
void IntDisasmLixFunction(const char *FunctionName)
This function dumps a Linux function (textual disassembly) given its name.
Definition: dumper.c:614
void IntDumpWinTrapFrame32(KTRAP_FRAME32 *TrapFrame)
This function dumps a windows 64 guest trap frame.
Definition: dumper.c:789
int INTSTATUS
The status data type.
Definition: introstatus.h:24
INTSTATUS IntDumpCodeAndRegs(QWORD Gva, QWORD Gpa, IG_ARCH_REGS *Registers)
This function dumps an entire page (textual disassembly and opcodes) as well as the values of the reg...
Definition: dumper.c:692
IG_CS_TYPE
The type of the code segment.
Definition: glueiface.h:183
TIMER_FRIENDLY void IntDumpInstruction(INSTRUX *Instruction, QWORD Rip)
This function dumps a given instruction (textual disassembly).
Definition: dumper.c:583
unsigned long long QWORD
Definition: intro_types.h:53
TIMER_FRIENDLY void IntDumpBuffer(const void *Buffer, QWORD Gva, DWORD Length, DWORD RowLength, DWORD ElementLength, BOOLEAN LogHeader, BOOLEAN DumpAscii)
This function dumps a given buffer in a user friendly format.
Definition: dumper.c:48
#define TIMER_FRIENDLY
Definition: introdefs.h:83
void IntDumpWinTrapFrame64(KTRAP_FRAME64 *TrapFrame)
This function dumps a windows 64 guest trap frame.
Definition: dumper.c:765
void IntDumpCode(BYTE *Page, DWORD Offset, IG_CS_TYPE CsType, IG_ARCH_REGS *Registers)
This function dumps an entire page (textual disassembly and opcodes).
Definition: dumper.c:637
uint32_t DWORD
Definition: intro_types.h:49
TIMER_FRIENDLY void IntDumpGvaEx(QWORD Gva, DWORD Length, QWORD Cr3, DWORD RowLength, DWORD ElementLength, BOOLEAN LogHeader, BOOLEAN DumpAscii)
This function dumps a given GVA in a user friendly format. This function uses IntDumpBuffer to perfor...
Definition: dumper.c:204
#define _In_reads_bytes_(expr)
Definition: intro_sal.h:25
TIMER_FRIENDLY void IntDumpGva(QWORD Gva, DWORD Length, QWORD Cr3)
This function is a wrapper over IntDumpGvaEx (it uses RowLength = 16, ElementLength = 1...
Definition: dumper.c:273
VE_CACHE_LINE * Page
Mapped page inside Introspection virtual address space.
Definition: vecore.c:120
Contains definitions for structures and constants used by the Windows kernel.
Holds register state.
Definition: glueiface.h:30
void IntDisasmGva(QWORD Gva, DWORD Length)
This function disassembles a code buffer (given its GVA) and then dumps the instructions (textual dis...
Definition: dumper.c:432
void IntDisasmBuffer(void *Buffer, DWORD Length, QWORD Rip)
This function disassembles a given code buffer and then dumps the instructions (textual disassembly)...
Definition: dumper.c:294