glueiface.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#ifndef _GLUEIFACE_H_
#define _GLUEIFACE_H_

#ifdef __cplusplus
extern "C" {
#endif

#include "intro_types.h"
#include "upperiface.h"

#pragma pack(push)
#pragma pack(8)

typedef struct _IG_ARCH_REGS
{
    QWORD Rax;
    QWORD Rcx;
    QWORD Rdx;
    QWORD Rbx;
    QWORD Rsp;
    QWORD Rbp;
    QWORD Rsi;
    QWORD Rdi;
    QWORD R8;
    QWORD R9;
    QWORD R10;
    QWORD R11;
    QWORD R12;
    QWORD R13;
    QWORD R14;
    QWORD R15;
    QWORD Cr2;
    QWORD Flags;
    QWORD Dr7;
    QWORD Rip;
    QWORD Cr0;
    QWORD Cr4;
    QWORD Cr3;
    QWORD Cr8;
    QWORD IdtBase;
    QWORD IdtLimit;
    QWORD GdtBase;
    QWORD GdtLimit;

} IG_ARCH_REGS, *PIG_ARCH_REGS;

typedef struct _IG_SEG_REGS
{
    QWORD       CsBase;
    QWORD       CsLimit;
    QWORD       CsSelector;
    QWORD       CsAr;
    QWORD       SsBase;
    QWORD       SsLimit;
    QWORD       SsSelector;
    QWORD       SsAr;
    QWORD       DsBase;
    QWORD       DsLimit;
    QWORD       DsSelector;
    QWORD       DsAr;
    QWORD       EsBase;
    QWORD       EsLimit;
    QWORD       EsSelector;
    QWORD       EsAr;
    QWORD       FsBase;
    QWORD       FsLimit;
    QWORD       FsSelector;
    QWORD       FsAr;
    QWORD       GsBase;
    QWORD       GsLimit;
    QWORD       GsSelector;
    QWORD       GsAr;
} IG_SEG_REGS, *PIG_SEG_REGS;

typedef struct _IG_XSAVE_AREA
{
    WORD            Fcw;
    WORD            Fsw;
    BYTE            Ftw;
    BYTE            Rsvd1;
    WORD            Fop;
    QWORD           Fip;

    QWORD           Fdp;
    DWORD           Mxcsr;
    DWORD           MxcsrMask;

    QWORD           Mm0[2];
    QWORD           Mm1[2];
    QWORD           Mm2[2];
    QWORD           Mm3[2];
    QWORD           Mm4[2];
    QWORD           Mm5[2];
    QWORD           Mm6[2];
    QWORD           Mm7[2];
    QWORD           Xmm0[2];
    QWORD           Xmm1[2];
    QWORD           Xmm2[2];
    QWORD           Xmm3[2];
    QWORD           Xmm4[2];
    QWORD           Xmm5[2];
    QWORD           Xmm6[2];
    QWORD           Xmm7[2];
    QWORD           Xmm8[2];
    QWORD           Xmm9[2];
    QWORD           Xmm10[2];
    QWORD           Xmm11[2];
    QWORD           Xmm12[2];
    QWORD           Xmm13[2];
    QWORD           Xmm14[2];
    QWORD           Xmm15[2];
    BYTE            Rsvd2[96];
    BYTE            ExtendedArea[3584];
} IG_XSAVE_AREA, *PIG_XSAVE_AREA;


//
// MSR definitions
//
#define IG_IA32_SYSENTER_CS         0x00000174
#define IG_IA32_SYSENTER_ESP        0x00000175
#define IG_IA32_SYSENTER_EIP        0x00000176
#define IG_IA32_MISC_ENABLE         0x000001A0
#define IG_IA32_PAT                 0x00000277
#define IG_IA32_MC0_CTL             0x00000400
#define IG_IA32_EFER                0xC0000080
#define IG_IA32_STAR                0xC0000081
#define IG_IA32_LSTAR               0xC0000082
#define IG_IA32_FS_BASE             0xC0000100
#define IG_IA32_GS_BASE             0xC0000101
#define IG_IA32_KERNEL_GS_BASE      0xC0000102
#define IG_IA32_LBR_TOS             0x000001C9
#define IG_IA32_DEBUGCTL            0x000001D9


typedef enum
{
    IG_MEM_UC = 0x0,        
    IG_MEM_WC = 0x1,        
    IG_MEM_WT = 0x4,        
    IG_MEM_WP = 0x5,        
    IG_MEM_WB = 0x6,        
    IG_MEM_UC_MINUS = 0x7,
    IG_MEM_UNKNOWN = 0xFF,  
} IG_MEMTYPE;

typedef enum
{
    IG_MSR_HOOK_READ = 1,   
    IG_MSR_HOOK_WRITE,      
    IG_MSR_HOOK_BOTH = (IG_MSR_HOOK_READ | IG_MSR_HOOK_WRITE),  
} IG_MSR_HOOK_TYPE;



typedef enum
{
    IG_CS_TYPE_INVALID = 0, 
    IG_CS_TYPE_16B,         
    IG_CS_TYPE_32B,         
    IG_CS_TYPE_64B,         
} IG_CS_TYPE;


typedef enum
{
    IG_CS_RING_0 = 0,
    IG_CS_RING_1,
    IG_CS_RING_2,
    IG_CS_RING_3,
} IG_CS_RING;


typedef struct _IG_QUERY_MSR
{
    DWORD MsrId;    
    QWORD Value;    
} IG_QUERY_MSR, *PIG_QUERY_MSR;


typedef enum
{
    IG_QUERY_INFO_CLASS_REGISTER_STATE = 0,

    IG_QUERY_INFO_CLASS_READ_MSR,

    IG_QUERY_INFO_CLASS_IDT,

    IG_QUERY_INFO_CLASS_GDT,

    IG_QUERY_INFO_CLASS_CPU_COUNT,

    IG_QUERY_INFO_CLASS_SET_REGISTERS,

    IG_QUERY_INFO_CLASS_TSC_SPEED,

    IG_QUERY_INFO_CLASS_CURRENT_TID,

    IG_QUERY_INFO_CLASS_REGISTER_STATE_GPRS,

    IG_QUERY_INFO_CLASS_CS_TYPE,

    IG_QUERY_INFO_CLASS_CS_RING,

    IG_QUERY_INFO_CLASS_SEG_REGISTERS,

    IG_QUERY_INFO_CLASS_XSAVE_SIZE,

    IG_QUERY_INFO_CLASS_XSAVE_AREA,

    IG_QUERY_INFO_CLASS_EPTP_INDEX,

    IG_QUERY_INFO_CLASS_MAX_GPFN,

    IG_QUERY_INFO_CLASS_SET_XSAVE_AREA,

    IG_QUERY_INFO_CLASS_GET_XCR0,

    IG_QUERY_INFO_CLASS_VE_SUPPORT = 100,

    IG_QUERY_INFO_CLASS_VMFUNC_SUPPORT,

    IG_QUERY_INFO_CLASS_SPP_SUPPORT,

    IG_QUERY_INFO_CLASS_DTR_SUPPORT,
} IG_QUERY_INFO_CLASS;


typedef enum _IG_EPT_HOOK_TYPE
{
    IG_EPT_HOOK_NONE = 0,       
    IG_EPT_HOOK_READ = 1,       
    IG_EPT_HOOK_WRITE = 2,      
    IG_EPT_HOOK_EXECUTE = 4,    
} IG_EPT_HOOK_TYPE;

typedef BYTE IG_EPT_ACCESS;

typedef enum _IG_DESC_ACCESS
{
    IG_DESC_ACCESS_IDTR = 0x01,     
    IG_DESC_ACCESS_GDTR = 0x02,     
    IG_DESC_ACCESS_TR = 0x04,       
    IG_DESC_ACCESS_LDTR = 0x08,     

    IG_DESC_ACCESS_READ = 0x10,     
    IG_DESC_ACCESS_WRITE = 0x20,    
} IG_DESC_ACCESS;


#define IG_CURRENT_VCPU                     0xFFFFFFFF

#define IG_CURRENT_EPT                      0xFFFFFFFF

#define IG_INVALID_TIME                     0xFFFFFFFFFFFFFFFF


typedef enum
{
    IG_AGENT_TAG_DUMMY_TOOL = INTRO_AGENT_TAG_DUMMY_TOOL,

    IG_AGENT_TAG_REMEDIATION_TOOL = INTRO_AGENT_TAG_REMEDIATION_TOOL,

    IG_AGENT_TAG_REMEDIATION_TOOL_LINUX = INTRO_AGENT_TAG_REMEDIATION_TOOL_LINUX,

    IG_AGENT_TAG_LOG_GATHER_TOOL = INTRO_AGENT_TAG_LOG_GATHER_TOOL,

    IG_AGENT_TAG_AGENT_KILLER_TOOL = INTRO_AGENT_TAG_AGENT_KILLER_TOOL,

    IG_AGENT_TAG_VE_DRIVER = INTRO_AGENT_TAG_VE_DRIVER,

    IG_AGENT_TAG_PT_DRIVER = INTRO_AGENT_TAG_PT_DRIVER,

    IG_AGENT_TAG_CUSTOM_TOOL = INTRO_AGENT_TAG_CUSTOM_TOOL,
} IG_AGENT_TAG;


#define IG_DISABLE_IGNORE_SAFENESS          0x02

#define IG_PHYSMAP_NO_CACHE                 0x00000001

#define IG_TIMER_FREQUENCY                  1


typedef enum _IG_GUEST_POWER_STATE
{
    intGuestPowerStateResume = 1,   
    intGuestPowerStateSleep,        
    intGuestPowerStateShutDown,     
    intGuestPowerStateTerminating,  
} IG_GUEST_POWER_STATE;


typedef enum _IG_LOG_LEVEL
{
    intLogLevelDebug,       
    intLogLevelInfo,        
    intLogLevelWarning,     
    intLogLevelError,       
    intLogLevelCritical,    
} IG_LOG_LEVEL;


//
// GLUE INTERFACE callbacks
//

//
// Callbacks registered from INTRO to the HV
//


typedef INTSTATUS
(*PFUNC_IntEPTViolationCallback)(
    _In_ void *GuestHandle,
    _In_ QWORD PhysicalAddress,
    _In_ DWORD Length,
    _In_opt_ QWORD VirtualAddress,
    _In_ DWORD CpuNumber,
    _Out_ INTRO_ACTION *Action,
    _In_ IG_EPT_ACCESS Type
    );

typedef INTSTATUS
(*PFUNC_IntMSRViolationCallback)(
    _In_ void *GuestHandle,
    _In_ DWORD Msr,
    _In_ IG_MSR_HOOK_TYPE Flags,
    _Out_ INTRO_ACTION *Action,
    _In_opt_ QWORD OriginalValue,
    _Out_ QWORD *NewValue,
    _In_ DWORD CpuNumber
    );

typedef INTSTATUS
(*PFUNC_IntIntroCallCallback)(
    _In_ void *GuestHandle,
    _In_ QWORD Rip,
    _In_ DWORD Cpu
    );

typedef INTSTATUS
(*PFUNC_IntIntroTimerCallback)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntIntroDescriptorTableCallback)(
    _In_ void *GuestHandle,
    _In_ DWORD Flags,
    _In_ DWORD CpuNumber,
    _Out_ INTRO_ACTION *Action
    );

typedef INTSTATUS
(*PFUNC_IntCrWriteCallback)(
    _In_ void *GuestHandle,
    _In_ DWORD Cr,
    _In_ DWORD CpuNumber,
    _In_ QWORD OldValue,
    _In_ QWORD NewValue,
    _Out_ INTRO_ACTION *Action
    );

typedef INTSTATUS
(*PFUNC_IntXcrWriteCallback)(
    _In_ void *GuestHandle,
    _In_ DWORD CpuNumber,
    _Out_ INTRO_ACTION *Action
    );

typedef INTSTATUS
(*PFUNC_IntBreakpointCallback)(
    _In_ void *GuestHandle,
    _In_ QWORD PhysicalAddress,
    _In_ DWORD CpuNumber
    );

typedef INTSTATUS
(*PFUNC_IntEventInjectionCallback)(
    _In_ void *GuestHandle,
    _In_ DWORD Vector,
    _In_ QWORD ErrorCode,
    _In_ QWORD Cr2,
    _In_ DWORD CpuNumber
    );

typedef INTSTATUS
(*PFUNC_IntEventEnginesResultCallback)(
    _In_ void *GuestHandle,
    _In_ PENG_NOTIFICATION_HEADER EngineNotification
    );


//
// API exposed by the HV to the introspection
//

typedef INTSTATUS
(*PFUNC_IntQueryGuestInfo)(
    _In_ void *GuestHandle,
    _In_ DWORD InfoClass,
    _In_opt_ void *InfoParam,
    _When_(InfoClass == IG_QUERY_INFO_CLASS_SET_REGISTERS, _In_reads_bytes_(BufferLength))
    _When_(InfoClass != IG_QUERY_INFO_CLASS_SET_REGISTERS, _Out_writes_bytes_(BufferLength))
    void *Buffer,
    _In_ DWORD BufferLength
    );

typedef INTSTATUS
(*PFUNC_IntNotifyIntroAlert)(
    _In_ void *GuestHandle,
    _In_ DWORD EventClass,
    _In_opt_ void *Parameters,
    _In_ size_t EventSize
    );

typedef INTSTATUS
(*PFUNC_IntNotifyEngines)(
    _In_ void *GuestHandle,
    _Inout_ void *Parameters
    );

typedef INTSTATUS
(*PFUNC_IntGpaToHpa)(
    _In_ void *GuestHandle,
    _In_ QWORD Gpa,
    _Out_ QWORD *Hpa
    );

typedef INTSTATUS
(*PFUNC_IntPhysMemMapToHost)(
    _In_ void *GuestHandle,
    _In_ QWORD PhysAddress,
    _In_ DWORD Length,
    _In_ DWORD Flags,
    _Outptr_result_bytebuffer_(Length) void **HostPtr
    );

typedef INTSTATUS
(*PFUNC_IntPhysMemUnmap)(
    _In_ void *GuestHandle,
    _Inout_ _At_(*HostPtr, _Post_null_) void **HostPtr
    );

typedef INTSTATUS
(*PFUNC_IntGetPhysicalPageTypeFromMtrrs)(
    _In_ void *GuestHandle,
    _In_ QWORD Gpa,
    _Out_ IG_MEMTYPE *MemType
    );

typedef INTSTATUS
(*PFUNC_IntGetEPTPageProtection)(
    _In_ void *GuestHandle,
    _In_ DWORD EptIndex,
    _In_ QWORD Address,
    _Out_ BYTE *Read,
    _Out_ BYTE *Write,
    _Out_ BYTE *Execute
    );

typedef INTSTATUS
(*PFUNC_IntSetEPTPageProtection)(
    _In_ void *GuestHandle,
    _In_ DWORD EptIndex,
    _In_ QWORD Address,
    _In_ BYTE Read,
    _In_ BYTE Write,
    _In_ BYTE Execute
    );

typedef INTSTATUS
(*PFUNC_IntGetSPPPageProtection)(
    _In_ void *GuestHandle,
    _In_ QWORD Address,
    _Out_ QWORD *SppValue
    );

typedef INTSTATUS
(*PFUNC_IntSetSPPPageProtection)(
    _In_ void *GuestHandle,
    _In_ QWORD Address,
    _In_ QWORD SppValue
    );

typedef INTSTATUS
(*PFUNC_IntRegisterEPTHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntEPTViolationCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterEPTHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntEnableMsrExit)(
    _In_ void *GuestHandle,
    _In_ DWORD Msr,
    _Out_ BOOLEAN *OldValue
    );

typedef INTSTATUS
(*PFUNC_IntDisableMsrExit)(
    _In_ void *GuestHandle,
    _In_ DWORD Msr,
    _Out_ BOOLEAN *OldValue
    );

typedef INTSTATUS
(*PFUNC_IntRegisterMSRHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntMSRViolationCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterMSRHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRegisterIntroCallHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntIntroCallCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterIntroCallHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRegisterVmxTimerHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntIntroTimerCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterVmxTimerHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRegisterDescriptorTableHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntIntroDescriptorTableCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterDescriptorTableHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntEnableCrWriteExit)(
    _In_ void *GuestHandle,
    _In_ DWORD Cr
    );

typedef INTSTATUS
(*PFUNC_IntDisableCrWriteExit)(
    _In_ void *GuestHandle,
    _In_ DWORD Cr
    );

typedef INTSTATUS
(*PFUNC_IntRegisterCrWriteHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntCrWriteCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterCrWriteHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRegisterXcrWriteHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntXcrWriteCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterXcrWriteHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRegisterBreakpointHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntBreakpointCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterBreakpointHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRegisterEventInjectionHandler)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntEventInjectionCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterEventInjectionHandler)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRegisterEnginesResultCallback)(
    _In_ void *GuestHandle,
    _In_ PFUNC_IntEventEnginesResultCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntUnregisterEnginesResultCalback)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRequestVcpusPause)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRequestVcpusResume)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntReserveVaSpaceWithPt)(
    _In_ void *GuestHandle,
    _Outptr_ void **FirstPageBase,
    _Out_ DWORD *PagesCount,
    _Outptr_ void **PtBase
    );

typedef INTSTATUS
(*PFUNC_IntInjectTrap)(
    _In_ void *GuestHandle,
    _In_ DWORD CpuNumber,
    _In_ BYTE TrapNumber,
    _In_ DWORD ErrorCode,
    _In_opt_ QWORD Cr2
    );

typedef INTSTATUS
(*PFUNC_IntNotifyIntrospectionDetectedOs)(
    _In_ void *GuestHandle,
    _In_ PGUEST_INFO GuestInfo
    );

typedef INTSTATUS
(*PFUNC_IntNotifyIntrospectionErrorState)(
    _In_ void *GuestHandle,
    _In_ INTRO_ERROR_STATE Error,
    _In_opt_ PINTRO_ERROR_CONTEXT Context
    );

typedef INTSTATUS
(*PFUNC_IntNotifyIntrospectionActivated)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntNotifyIntrospectionDeactivated)(
    _In_ void *GuestHandle
    );


typedef INTSTATUS
(*PFUNC_IntSetIntroEmulatorContext)(
    _In_ void *GuestHandle,
    _In_ DWORD CpuNumber,
    _In_ QWORD VirtualAddress,
    _In_ DWORD BufferSize,
    _In_reads_bytes_(BufferSize) PBYTE Buffer
    );

typedef INTSTATUS
(*PFUNC_IntGetAgentContent)(
    _In_ void *GuestHandle,
    _In_ DWORD AgentTag,
    _In_ BOOLEAN Is64,
    _Out_ DWORD *Size,
    _Outptr_ PBYTE *Content
    );

typedef INTSTATUS (*PFUNC_IntReleaseBuffer)(
    _In_ void *GuestHandle,
    _In_ void *Buffer,
    _In_ DWORD Size
    );

typedef INTSTATUS
(*PFUNC_IntToggleRepOptimization)(
    _In_ void *GuestHandle,
    _In_ BOOLEAN Enable
    );

//
// These functions are exposed by the introspection engine for the HV
//

typedef INTSTATUS
(*PFUNC_IntNotifyNewGuest)(
    _In_ void *GuestHandle,
    _In_ QWORD Options,
    _In_reads_(BufferLength) PBYTE UpdateBuffer,
    _In_ DWORD BufferLength
    );

typedef INTSTATUS
(*PFUNC_IntDisableIntro)(
    _In_ void *GuestHandle,
    _In_ QWORD Flags
    );


typedef INTSTATUS
(*PFUNC_IntUpdateExceptions)(
    _In_ void *GuestHandle,
    _In_reads_(Length) PBYTE Buffer,
    _In_ DWORD Length,
    _In_ DWORD Flags
    );

typedef INTSTATUS
(*PFUNC_IntUpdateSupport)(
    _In_ void *GuestHandle,
    _In_reads_(Length) PBYTE Buffer,
    _In_ DWORD Length
    );

typedef INTSTATUS
(*PFUNC_IntGetSupportVersion)(
    _In_ void *GuestHandle,
    _Out_ DWORD *MajorVersion,
    _Out_ DWORD *MinorVersion,
    _Out_ DWORD *BuildNumber
    );

typedef INTSTATUS
(*PFUNC_IntGetExceptionsVersion)(
    _In_ void *GuestHandle,
    _Out_ WORD *Major,
    _Out_ WORD *Minor,
    _Out_ DWORD *BuildNumber
    );

typedef INTSTATUS
(*PFUNC_IntGetGuestInfo)(
    _In_ void *GuestHandle,
    _Out_ PGUEST_INFO GuestInfo
    );

typedef INTSTATUS
(*PFUNC_IntAddExceptionFromAlert)(
    _In_ void *GuestHandle,
    _In_ const void *Event,
    _In_ INTRO_EVENT_TYPE Type,
    _In_ BOOLEAN Exception,
    _In_ QWORD Context
    );

typedef INTSTATUS
(*PFUNC_IntFlushAlertExceptions)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntRemoveException)(
    _In_ void *GuestHandle,
    _In_opt_ QWORD Context
    );

typedef INTSTATUS
(*PFUNC_IntAddRemoveProtectedProcessUtf16)(
    _In_ void *GuestHandle,
    _In_z_ const WCHAR *FullPath,
    _In_ DWORD ProtectionMask,
    _In_ BOOLEAN Add,
    _In_ QWORD Context
    );

typedef INTSTATUS
(*PFUNC_IntAddRemoveProtectedProcessUtf8)(
    _In_ void *GuestHandle,
    _In_z_ const CHAR *FullPath,
    _In_ DWORD ProtectionMask,
    _In_ BOOLEAN Add,
    _In_ QWORD Context
    );


typedef INTSTATUS (*PFUNC_IntSetIntroAbortStatus)(
    _In_ void *GuestHandle,
    _In_ BOOLEAN Abort
    );

typedef INTSTATUS
(*PFUNC_IntRemoveAllProtectedProcesses)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntNotifyGuestPowerStateChange)(
    _In_ void *GuestHandle,
    _In_ IG_GUEST_POWER_STATE PowerState
    );

#define IG_MAX_COMMAND_LINE_LENGTH  1024
#define IG_MAX_AGENT_NAME_LENGTH    32

typedef INTSTATUS
(*PFUNC_IntInjectProcessAgent)(
    _In_ void *GuestHandle,
    _In_ DWORD AgentTag,
    _In_opt_ PBYTE AgentContent,
    _In_opt_ DWORD AgentSize,
    _In_z_ const CHAR *Name,
    _In_opt_z_ const CHAR *Args
    );

typedef INTSTATUS
(*PFUNC_IntInjectFileAgent)(
    _In_ void *GuestHandle,
    _In_opt_ PBYTE FileContent,
    _In_ DWORD FileSize,
    _In_z_ const CHAR *Name
    );

typedef INTSTATUS
(*PFUNC_IntGetCurrentInstructionLength)(
    _In_ void *GuestHandle,
    _In_ DWORD CpuNumber,
    _Out_ BYTE *Length
    );

typedef INTSTATUS
(*PFUNC_IntGetCurrentInstructionMnemonic)(
    _In_ void *GuestHandle,
    _In_ DWORD CpuNumber,
    _Out_ CHAR *Mnemonic
    );

typedef INTSTATUS
(*PFUNC_VirtualAddressSpaceCallback)(
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress,
    _In_ QWORD Entry,
    _In_ QWORD PageSize
    );

typedef INTSTATUS
(*PFUNC_IntIterateVaSpace)(
    _In_ void *GuestHandle,
    _In_ QWORD Cr3,
    _In_ PFUNC_VirtualAddressSpaceCallback Callback
    );

typedef INTSTATUS
(*PFUNC_IntModifyDynamicOptions)(
    _In_ void *GuestHandle,
    _In_ QWORD NewDynamicOptions
    );

typedef INTSTATUS
(*PFUNC_IntFlushGpaCache)(
    _In_ void *GuestHandle
    );

typedef INTSTATUS
(*PFUNC_IntGetCurrentIntroOptions)(
    _In_  void *GuestHandle,
    _Out_ QWORD *IntroOptions
    );

typedef INTSTATUS
(*PFUNC_IntSetLogLevel)(
    _In_ void *GuestHandle,
    _In_ IG_LOG_LEVEL LogLevel
    );

typedef INTSTATUS
(*PFUNC_IntGetVersionString)(
      _In_  DWORD FullStringSize,
      _In_  DWORD VersionStringSize,
      _Out_ CHAR *FullString,
      _Out_ CHAR *VersionString
      );


//
// Debug facilities
//

typedef INTSTATUS
(*PFUNC_IntDebugProcessCommand)(
    _In_ void *GuestHandle,
    _In_ DWORD CpuNumber,
    _In_ DWORD Argc,
    _In_ CHAR *Argv[]
    );


//
// #VE related API, exposed by the integrator
//

typedef INTSTATUS
(*PFUNC_IntSetVeInfoPage)(
    _In_ void *GuestHandle,
    _In_ DWORD CpuNumber,
    _In_ QWORD VeInfoGpa
    );

typedef INTSTATUS
(*PFUNC_IntCreateEPT)(
    _In_ void *GuestHandle,
    _Out_ DWORD *EptIndex
    );

typedef INTSTATUS
(*PFUNC_IntDestroyEPT)(
    _In_ void *GuestHandle,
    _In_ DWORD EptIndex
    );

typedef INTSTATUS
(*PFUNC_IntSwitchEPT)(
    _In_ void *GuestHandle,
    _In_ DWORD NewEptIndex
    );

typedef INTSTATUS
(*PFUNC_IntGetEPTPageConvertible)(
    _In_ void *GuestHandle,
    _In_ DWORD EptIndex,
    _In_ QWORD Address,
    _Out_ BOOLEAN *Convertible
    );

typedef INTSTATUS
(*PFUNC_IntSetEPTPageConvertible)(
    _In_ void *GuestHandle,
    _In_ DWORD EptIndex,
    _In_ QWORD Address,
    _In_ BOOLEAN Convertible
    );


typedef INTSTATUS
(*PFUNC_IntFlushEPTPermissions)(
    _In_ void* GuestHandle
    );

typedef struct _GLUE_IFACE
{
    DWORD                                       Version;
    DWORD                                       Size;
    QWORD                                       Reserved;

    //
    // following functions have semantics of introspection library -> hypervisor
    //

    PFUNC_IntQueryGuestInfo                     QueryGuestInfo;

    PFUNC_IntGpaToHpa                           GpaToHpa;

    PFUNC_IntPhysMemMapToHost                   PhysMemMapToHost;
    PFUNC_IntPhysMemUnmap                       PhysMemUnmap;
    PFUNC_IntGetPhysicalPageTypeFromMtrrs       PhysMemGetTypeFromMtrrs;

    PFUNC_IntGetEPTPageProtection               GetEPTPageProtection;
    PFUNC_IntSetEPTPageProtection               SetEPTPageProtection;
    PFUNC_IntGetSPPPageProtection               GetSPPPageProtection;
    PFUNC_IntSetSPPPageProtection               SetSPPPageProtection;
    PFUNC_IntRegisterEPTHandler                 RegisterEPTHandler;
    PFUNC_IntUnregisterEPTHandler               UnregisterEPTHandler;

    PFUNC_IntEnableMsrExit                      EnableMSRExit;
    PFUNC_IntDisableMsrExit                     DisableMSRExit;
    PFUNC_IntRegisterMSRHandler                 RegisterMSRHandler;
    PFUNC_IntUnregisterMSRHandler               UnregisterMSRHandler;

    PFUNC_IntRequestVcpusPause                  PauseVcpus;
    PFUNC_IntRequestVcpusResume                 ResumeVcpus;

    // VMCALL handler for introspection specific calls.
    PFUNC_IntRegisterIntroCallHandler           RegisterIntroCallHandler;
    PFUNC_IntUnregisterIntroCallHandler         UnregisterIntroCallHandler;

    // VMX-Preemption timer callback - allows to do periodic stuff, like integrity checking.
    PFUNC_IntRegisterVmxTimerHandler            RegisterIntroTimerHandler;
    PFUNC_IntUnregisterVmxTimerHandler          UnregisterIntroTimerHandler;

    // GDTR/IDTR access
    PFUNC_IntRegisterDescriptorTableHandler     RegisterDtrHandler;
    PFUNC_IntUnregisterDescriptorTableHandler   UnregisterDtrHandler;

    PFUNC_IntEnableCrWriteExit                  EnableCrWriteExit;
    PFUNC_IntDisableCrWriteExit                 DisableCrWriteExit;
    PFUNC_IntRegisterCrWriteHandler             RegisterCrWriteHandler;
    PFUNC_IntUnregisterCrWriteHandler           UnregisterCrWriteHandler;

    // XCR write handler.
    PFUNC_IntRegisterXcrWriteHandler            RegisterXcrWriteHandler;
    PFUNC_IntUnregisterXcrWriteHandler          UnregisterXcrWriteHandler;

    // Breakpoint handler.
    PFUNC_IntRegisterBreakpointHandler          RegisterBreakpointHandler;
    PFUNC_IntUnregisterBreakpointHandler        UnregisterBreakpointHandler;

    // Event injection handler.
    PFUNC_IntRegisterEventInjectionHandler      RegisterEventInjectionHandler;
    PFUNC_IntUnregisterEventInjectionHandler    UnregisterEventInjectionHandler;

    PFUNC_IntInjectTrap                         InjectTrap;

    PFUNC_IntSetIntroEmulatorContext            SetIntroEmulatorContext;

    //
    // From here on, these functions are optional (until HV - Intro interface)
    //

    PFUNC_IntReserveVaSpaceWithPt               ReserveVaSpaceWithPt;

    PFUNC_IntNotifyIntrospectionActivated       NotifyIntrospectionActivated;
    PFUNC_IntNotifyIntrospectionDeactivated     NotifyIntrospectionDeactivated;
    PFUNC_IntNotifyIntrospectionDetectedOs      NotifyIntrospectionDetectedOs;
    void                                        *_I_H_Reserved1;
    PFUNC_IntNotifyIntrospectionErrorState      NotifyIntrospectionErrorState;
    PFUNC_IntNotifyIntroAlert                   NotifyIntrospectionAlert;
    PFUNC_IntNotifyEngines                      NotifyScanEngines;

    PFUNC_IntGetAgentContent                    GetAgentContent;
    PFUNC_IntReleaseBuffer                      ReleaseBuffer;
    PFUNC_IntToggleRepOptimization              ToggleRepOptimization;

    //
    // #VE related API (Optional)
    //
    PFUNC_IntSetVeInfoPage                      SetVeInfoPage;
    PFUNC_IntCreateEPT                          CreateEPT;
    PFUNC_IntDestroyEPT                         DestroyEPT;
    PFUNC_IntSwitchEPT                          SwitchEPT;
    PFUNC_IntGetEPTPageConvertible              GetEPTPageConvertible;
    PFUNC_IntSetEPTPageConvertible              SetEPTPageConvertible;

    // Asynchronous callback used by the engines to provide a scan result.
    PFUNC_IntRegisterEnginesResultCallback      RegisterEnginesResultCallback;
    PFUNC_IntUnregisterEnginesResultCalback     UnregisterEnginesResultCalback;

    PFUNC_IntFlushEPTPermissions                FlushEPTPermissions;

    void                                        *_I_H_Reserved2;
    void                                        *_I_H_Reserved3;

    //
    // following functions have semantics of hypervisor -> introspection library.
    // the below function pointers must be populated by the introspection library at initialization
    // the hypervisor expects that, if IntInit was successful, the below pointers are valid
    //
    PFUNC_IntNotifyNewGuest                     NewGuestNotification;
    PFUNC_IntDisableIntro                       DisableIntro;
    PFUNC_IntNotifyGuestPowerStateChange        NotifyGuestPowerStateChange;

    PFUNC_IntDebugProcessCommand                DebugProcessCommand;
    void                                        *_H_I_Reserved1;
    PFUNC_IntUpdateExceptions                   UpdateExceptions;
    PFUNC_IntGetExceptionsVersion               GetExceptionsVersion;
    PFUNC_IntGetGuestInfo                       GetGuestInfo;
    PFUNC_IntInjectProcessAgent                 InjectProcessAgent;
    PFUNC_IntInjectFileAgent                    InjectFileAgent;
    PFUNC_IntSetIntroAbortStatus                SetIntroAbortStatus;
    PFUNC_IntAddExceptionFromAlert              AddExceptionFromAlert;
    PFUNC_IntRemoveException                    RemoveException;
    PFUNC_IntFlushAlertExceptions               FlushAlertExceptions;
    PFUNC_IntAddRemoveProtectedProcessUtf16     AddRemoveProtectedProcessUtf16;
    PFUNC_IntAddRemoveProtectedProcessUtf8      AddRemoveProtectedProcessUtf8;
    PFUNC_IntRemoveAllProtectedProcesses        RemoveAllProtectedProcesses;
    PFUNC_IntGetCurrentInstructionLength        GetCurrentInstructionLength;
    PFUNC_IntGetCurrentInstructionMnemonic      GetCurrentInstructionMnemonic;
    PFUNC_IntIterateVaSpace                     IterateVirtualAddressSpace;
    PFUNC_IntModifyDynamicOptions               ModifyDynamicOptions;
    PFUNC_IntFlushGpaCache                      FlushGpaCache;
    PFUNC_IntGetCurrentIntroOptions             GetCurrentIntroOptions;
    PFUNC_IntUpdateSupport                      UpdateSupport;
    PFUNC_IntGetSupportVersion                  GetSupportVersion;

    PFUNC_IntSetLogLevel                        SetLogLevel;

    PFUNC_IntGetVersionString                   GetVersionString;
    void                                        *_H_I_Reserved2;
    void                                        *_H_I_Reserved3;
    void                                        *_H_I_Reserved4;

} GLUE_IFACE, *PGLUE_IFACE;

#define GLUE_IFACE_VERSION_1            0x00010111
#define GLUE_IFACE_VERSION_1_SIZE       sizeof(GLUE_IFACE)

#define GLUE_IFACE_VERSION_LATEST       GLUE_IFACE_VERSION_1
#define GLUE_IFACE_VERSION_LATEST_SIZE  GLUE_IFACE_VERSION_1_SIZE


//
// The following functions are NOT directly part of the interface, but needs to be
// implemented by any GLUE library (NAPOCA, VMWARE, CITRIX, and so on)
//

typedef void
(*PFUNC_IntPreinit)(
    void
    );

typedef INTSTATUS
(*PFUNC_IntInit)(
    _In_ PGLUE_IFACE GlueInterface,
    _In_ PUPPER_IFACE UpperInterface
    );

typedef INTSTATUS
(*PFUNC_IntUninit)(
    void
    );

typedef BOOLEAN
(*PFUNC_IntCheckCompatibility)(
    _In_ DWORD IntegratorMajor,
    _In_ DWORD IntegratorMinor,
    _In_ DWORD IntegratorRevision,
    _In_ DWORD IntegratorBuild,
    _Out_ DWORD *IntroMajor,
    _Out_ DWORD *IntroMinor,
    _Out_ DWORD *IntroRevision,
    _Out_ DWORD *IntroBuild,
    _In_ DWORD Reserved
    );

#pragma pack(pop)

#ifdef __cplusplus
}
#endif

#endif // _GLUEIFACE_H_