guests.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _GUESTS_H_
#define _GUESTS_H_

#include "winguest.h"
#include "lixguest.h"
#include "bddisasm.h"
#include "bdshemu.h"
#include "vecommon.h"
#include "udlist.h"

typedef enum
{
    CPU_STATE_NONE = 0x00,            
    CPU_STATE_ACTIVE = 0x01,          
    CPU_STATE_EPT_VIOLATION = 0x02,   
    CPU_STATE_MSR_VIOLATION = 0x03,   
    CPU_STATE_VMCALL = 0x04,          
    CPU_STATE_CR_WRITE = 0x05,        
    CPU_STATE_DTR_LOAD = 0x06,        
    CPU_STATE_TIMER = 0x07,           
    CPU_STATE_XCR_WRITE = 0x08,       
    CPU_STATE_BREAKPOINT = 0x09,      
    CPU_STATE_EVENT_INJECTION = 0x0A, 
} CPU_STATE;

typedef struct _PATCH_BUFFER
{
    QWORD   Gla;                        
    DWORD   Size;                       
    BOOLEAN Valid;                      
    BYTE    Data[ND_MAX_REGISTER_SIZE]; 
} PATCH_BUFFER, *PPATCH_BUFFER;

typedef struct _PTEMU_BUFFER
{
    QWORD   Old;        
    QWORD   New;        
    BOOLEAN Valid;      
    BOOLEAN Emulated;   
    BOOLEAN Partial;    
} PTEMU_BUFFER, *PPTEMU_BUFFER;


typedef struct _PTWRITE_CACHE
{
    QWORD   PteAddress;
    QWORD   Value;
    BOOLEAN Valid;
} PTWRITE_CACHE, *PPTWRITE_CACHE;


#define SHEMU_SHELLCODE_SIZE   0x2000 
#define SHEMU_STACK_SIZE       0x2000 
#define SHEMU_MAX_INSTRUCTIONS 256    

//
// Per-CPU state structure.
//

typedef struct _VCPU_STATE
{
    INSTRUX         Instruction;
    IG_ARCH_REGS    Regs;
    QWORD           Ia32Efer;   
    QWORD           EventId;    
    QWORD           ExitGpa;    
    QWORD           ExitGla;    
    QWORD           ExitAccess; 
    QWORD           Gpa;        
    QWORD           Gla;        
    DWORD           AccessSize; 

    QWORD           PcrGla;

    QWORD           IdtBase;    
    WORD            IdtLimit;   
    QWORD           GdtBase;    

    QWORD           Xcr0;       

    INFO_UD_PENDING *CurrentUD;

    struct
    {
        BOOLEAN     Valid;
        BYTE        Vector;     
        DWORD       ErrorCode;  
        QWORD       Cr2;        
    } Exception;

    union
    {
        void        *IdtHookObject;
        void        *IdtIntegrityObject;
    };

    // TBD - Add any other VCPU-specific field here.

    QWORD           LixProcessGva;

    PATCH_BUFFER    PatchBuffer;    
    PTEMU_BUFFER    PtEmuBuffer;    
    PTWRITE_CACHE   PtWriteCache;   

    DWORD           Index;          
    CPU_STATE       State;          

    BOOLEAN         PtContext;

    BOOLEAN         VeContext;
    PVECPU          VeInfoPage;
    DWORD           EptpIndex;

    BOOLEAN         RepOptDisabled; 
    BOOLEAN         Initialized;    
    BOOLEAN         SingleStep;     
    BOOLEAN         AllowOnExec;    
    QWORD           AllowOnExecRip; 
    QWORD           AllowOnExecGpa; 
} VCPU_STATE, *PVCPU_STATE;

typedef struct _MM
{
    QWORD       SystemCr3;    
    QWORD       Cr4;            
    QWORD       Cr0;            
    QWORD       Efer;           
    QWORD       LastGpa;
    DWORD       SelfMapIndex;   
    PAGING_MODE Mode;           
} MM, *PMM;

typedef struct _INTRO_PROT_OPTIONS
{
    QWORD Original;
    QWORD Current;

    QWORD ForceOff;
    QWORD Beta;
    QWORD Feedback;
} INTRO_PROT_OPTIONS;

// Forward these declarations, makes it easy to use it directly when needed
typedef struct _MSR_HOOK_STATE MSR_HOOK_STATE;
typedef struct _XCR_HOOK_STATE XCR_HOOK_STATE;
typedef struct _CR_HOOK_STATE CR_HOOK_STATE;
typedef struct _DTR_HOOK_STATE DTR_HOOK_STATE;
typedef struct _KERNEL_DRIVER KERNEL_DRIVER;
typedef struct _EXCEPTIONS EXCEPTIONS;

typedef struct _GUEST_STATE
{
    INTRO_PROT_OPTIONS CoreOptions;     
    INTRO_PROT_OPTIONS ShemuOptions;    

    QWORD TimerCalls; 

    QWORD TscSpeed; 

    INTRO_GUEST_TYPE OSType; 
    DWORD CpuCount;          
    DWORD ActiveCpuCount;    
    DWORD OSVersion;         

    QWORD KernelVa;   
    DWORD KernelSize; 

    BOOLEAN Initialized;
    BOOLEAN Guest64;             
    BOOLEAN KptiActive;          
    BOOLEAN KptiInstalled;       
    BOOLEAN GuestInitialized;    
    BOOLEAN SafeToApplyOptions;  
    BOOLEAN PaeEnabled;          
    BOOLEAN LA57;                
    BOOLEAN ProtectionActivated; 
    BOOLEAN KernelBetaDetections;
    BOOLEAN SysprocBetaDetections;
    BOOLEAN ShutDown;    
    BOOLEAN Terminating; 
    BOOLEAN EnterHibernate;
    BOOLEAN UninitPrepared; 
    BOOLEAN DisableOnReturn;
    BOOLEAN BootstrapAgentAllocated;
    BOOLEAN BugCheckInProgress; 
    BOOLEAN PtFilterEnabled;
    BOOLEAN PtFilterWaiting;
    BOOLEAN VeAgentWaiting;
    BOOLEAN VeInitialized; 

    BOOLEAN SupportVE;     
    BOOLEAN SupportVMFUNC; 
    BOOLEAN SupportSPP;    
    BOOLEAN SupportDTR;    

    BOOLEAN PtFilterFlagRemoved;

    BYTE WordSize; 

    PVCPU_STATE VcpuArray;

    MM Mm; 

    QWORD IntroActiveEventId;

    DWORD RepOptsDisableCount; 

    KERNEL_DRIVER *KernelDriver; 

    MSR_HOOK_STATE *MsrHooks; 
    XCR_HOOK_STATE *XcrHooks; 
    CR_HOOK_STATE *CrHooks;   
    DTR_HOOK_STATE *DtrHooks; 

    EXCEPTIONS *Exceptions; 

    DWORD UntrustedEptIndex;
    DWORD ProtectedEptIndex;

    void *GpaCache;         
    void *InstructionCache; 

    SHEMU_CONTEXT Shemucontext; 
    
    BYTE ShemuShellcode[SHEMU_SHELLCODE_SIZE];
    BYTE ShemuStack[SHEMU_STACK_SIZE];
    BYTE ShemuInternal[SHEMU_SHELLCODE_SIZE + SHEMU_STACK_SIZE];

    union
    {
        LINUX_GUEST _LinuxGuest;     
        WINDOWS_GUEST _WindowsGuest; 
    };
} GUEST_STATE, *PGUEST_STATE;


extern GUEST_STATE gGuest;
extern WINDOWS_GUEST *gWinGuest;
extern LINUX_GUEST *gLixGuest;

extern VCPU_STATE *gVcpu;

typedef enum
{
    POST_COMMIT_MEM = 0x00000001,       
    POST_COMMIT_MSR = 0x00000002,       
    POST_COMMIT_CR = 0x00000004,        
    POST_COMMIT_XCR = 0x00000008,       
    POST_COMMIT_DTR = 0x00000010,       
    POST_INJECT_PF = 0x00000100,        
    POST_RETRY_PERFAGENT = 0x00000200,  
} PRE_RET_OPTIONS;

//
// GUESTS related API
//
INTSTATUS
IntGuestGetInfo(
    _Out_ PGUEST_INFO GuestInfo
    );

INTSTATUS
IntGuestPreReturnCallback(
    _In_ DWORD Options
    );

void
IntGuestUpdateCoreOptions(
    _In_ QWORD NewOptions
    );

void
IntGuestUpdateShemuOptions(
     _In_ QWORD NewOptions
     );

INTSTATUS
IntGuestInit(
    _In_ QWORD Options
    );

void
IntGuestPrepareUninit(
    void
    );

void
IntGuestUninit(
    void
    );

INTSTATUS
IntGuestDisableIntro(
    _In_ QWORD Flags
    );

INTSTATUS
IntGuestGetLastGpa(
    _Out_ QWORD *MaxGpa
    );

void
IntGuestSetIntroErrorState(
    _In_ INTRO_ERROR_STATE State,
    _In_opt_ INTRO_ERROR_CONTEXT *Context
    );

INTRO_ERROR_STATE
IntGuestGetIntroErrorState(
    void
    );

INTRO_ERROR_CONTEXT *
IntGuestGetIntroErrorStateContext(
    void
    );

BOOLEAN
IntGuestShouldNotifyErrorState(
    void
    );


__forceinline INTSTATUS
IntGuestGetIdtFromGla(
    _In_ QWORD Address,
    _Out_ QWORD *IdtBase,
    _Out_ QWORD *IdtLimit
    )
{
    for (DWORD cpuIndex = 0; cpuIndex < gGuest.CpuCount; cpuIndex++)
    {
        if (gGuest.VcpuArray[cpuIndex].IdtBase <= Address &&
            Address <= gGuest.VcpuArray[cpuIndex].IdtBase + gGuest.VcpuArray[cpuIndex].IdtLimit)
        {
            *IdtBase = gGuest.VcpuArray[cpuIndex].IdtBase;
            *IdtLimit = gGuest.VcpuArray[cpuIndex].IdtLimit;

            return INT_STATUS_SUCCESS;
        }
    }

    return INT_STATUS_NOT_FOUND;
}

#endif // _GUESTS_H_