38 if (NULL == Registers)
45 memset(agentEvent, 0,
sizeof(*agentEvent));
46 memset(&header, 0,
sizeof(header));
49 dataAddr =
gGuest.
Guest64 ? Registers->Rbx : (Registers->Rsi & 0xFFFFFFFF);
53 ERROR(
"[ERROR] Data address is 0!\n");
81 ERROR(
"[ERROR] IntVirtMemRead failed: 0x%08x\n", status);
102 ERROR(
"[ERROR] IntVirtMemRead failed: 0x%08x\n", status);
103 goto resume_and_exit;
110 goto resume_and_exit;
117 TRACE(
"[REMTOOL] Detection: %s infected with %s, flags %d\n",
123 TRACE(
"[REMTOOL] Disinfection: %s infected with %s, status %d\n",
129 TRACE(
"[REMTOOL] Scan start: %d\n",
133 TRACE(
"[REMTOOL] Scan finish: %d\n",
137 TRACE(
"[REMTOOL] Progress: %d\n",
141 TRACE(
"[REMTOOL] Reboot: %d\n",
158 ERROR(
"[ERROR] IntNotifyIntroEvent failed: 0x%08x\n", status);
DWORD Version
Event version. Must match REM_EVENT_VERSION.
#define INT_STATUS_SUCCESS
AGENT_EVENT_TYPE Event
The type of the agent.
#define REM_EVENT_SIZE
Remediation event size.
#define INT_SUCCESS(Status)
struct _AGENT_REM_EVENT::@325::@328 FinishEvent
Finish event. Valid if Header.EventType is remEventFinish.
INTSTATUS IntResumeVcpus(void)
Resumes the VCPUs previously paused with IntPauseVcpus.
Event structure for agent injection and termination.
The remediation tool agent.
int INTSTATUS
The status data type.
#define INT_STATUS_NOT_FOUND
INTRO_PROCESS CurrentProcess
The agent process.
INTSTATUS IntPauseVcpus(void)
Pauses all the guest VCPUs.
INTRO_GUEST_TYPE OSType
The type of the guest.
DWORD ErrorCode
The error code of the event. Success is 0.
GENERIC_ALERT gAlert
Global alert buffer.
A remediation tool event.
#define REM_EVENT_VERSION
Remediation event version.
INTSTATUS IntNotifyIntroEvent(INTRO_EVENT_TYPE EventClass, void *Param, size_t EventSize)
Notifies the integrator about an introspection alert.
BOOLEAN Guest64
True if this is a 64-bit guest, False if it is a 32-bit guest.
struct _AGENT_REM_EVENT::@325::@331 DetectionEvent
Detection event. Valid if Header.EventType is remEventDetection.
Informational event sent when the remediation tool is injected or terminated. See EVENT_AGENT_EVENT...
DWORD AgentTag
Unique agent tag. See INTRO_DEP_AG_TAGS.
void IntAlertFillWinProcessCurrent(INTRO_PROCESS *EventProcess)
Saves information about the current Windows process inside an alert.
struct _AGENT_REM_EVENT::@325::@330 RebootEvent
Reboot event. Valid if Header.EventType is remEventReboot.
#define UNREFERENCED_PARAMETER(P)
The agent sent a message.
struct _AGENT_REM_EVENT::@325::@329 ProgressEvent
Progress event. Valid if Header.EventType is remEventProgress.
Common header for all remediation tool events.
GUEST_STATE gGuest
The current guest state.
INTSTATUS IntVirtMemRead(QWORD Gva, DWORD Length, QWORD Cr3, void *Buffer, DWORD *RetLength)
Reads data from a guest virtual memory range.
DWORD Size
Event size. Must match REM_EVENT_SIZE.
AGENT_REM_EVENT_HEADER Header
Event header.
char * utf16_for_log(const WCHAR *WString)
Converts a UTF-16 to a UTF-8 string to be used inside logging macros.
#define INT_STATUS_NOT_SUPPORTED
struct _AGENT_REM_EVENT::@325::@327 StartEvent
Start event. Valid if Header.EventType is remEventStart.
void IntAlertFillLixCurrentProcess(INTRO_PROCESS *EventProcess)
Saves the current Linux process inside an event.
AGENT_REM_EVENT RemediationEvent
Remediation tool event.
AGENT_REM_EVENT_TYPE EventType
Event type.
#define INT_STATUS_INVALID_DATA_SIZE
#define INT_STATUS_INVALID_PARAMETER_3