hook.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "hook.h"


HOOK_STATE *gHooks = NULL; 


INTSTATUS
IntHookCommitAllHooks(
    void
    )
{
    INTSTATUS status;

    if (NULL == gHooks)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if (!gHooks->Dirty)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    STATS_ENTER(statsHookCommit);

    status = IntHookObjectCommit();
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookObjectCommit failed: 0x%08x\n", status);
        goto cleanup_and_exit;
    }

    status = IntHookGvaCommitHooks();
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookGvaCommitHooks failed: 0x%08x\n", status);
        goto cleanup_and_exit;
    }

    status = IntHookPtsCommitHooks();
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookPtsCommitHooks failed: 0x%08x\n", status);
        goto cleanup_and_exit;
    }

    status = IntHookPtmCommitHooks();
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookPtmCommitHooks failed: 0x%08x\n", status);
        goto cleanup_and_exit;
    }

    status = IntHookGpaCommitHooks();
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookGpaCommitHooks failed: 0x%08x\n", status);
        goto cleanup_and_exit;
    }

#ifdef DEBUG_CHECK_HOOKS
    IntDbgCheckHooks();
#endif


cleanup_and_exit:
    if (gHooks->GpaHooks.HooksRemoved || gHooks->GvaHooks.HooksRemoved ||
        gHooks->PtsHooks.HooksRemoved || gHooks->Objects.ObjectsRemoved ||
        gHooks->PtmHooks.HooksRemoved)
    {
        // There are hooks uncommitted. We don't want to reset the dirt marker,
        // so we have a chance to commit them on next run.
    }
    else
    {
        gHooks->Dirty = FALSE;
    }

    STATS_EXIT(statsHookCommit);

    return status;
}


INTSTATUS
IntHookRemoveChain(
    _In_ PHOOK_GPA HookGpa
    )
{
    PHOOK_HEADER pHook;

    if (NULL == HookGpa)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    // Find the most upper level hook.
    pHook = &HookGpa->Header;
    while (pHook->ParentHook)
    {
        pHook = (PHOOK_HEADER)pHook->ParentHook;
    }

    // Remove the most upper level hook.
    switch (pHook->HookType)
    {
    case hookTypeGpa:
        return IntHookGpaRemoveHook((HOOK_GPA **)&pHook, 0);

    case hookTypeGva:
        return IntHookGvaRemoveHook((HOOK_GVA **)&pHook, 0);

    case hookTypePts:
        return IntHookPtsRemoveHook((HOOK_PTS **)&pHook, 0);

    case hookTypePtm:
        return IntHookPtmRemoveHook((HOOK_PTM **)&pHook, 0);

    case hookTypeRegion:
        return IntHookObjectRemoveRegion((PHOOK_REGION_DESCRIPTOR *)&pHook, 0);

    default:
        ERROR("[ERROR] Unknown hook type %d!\n", pHook->HookType);
        return INT_STATUS_NOT_SUPPORTED;
    }
}


INTSTATUS
IntHookInit(
    void
    )
{
    INTSTATUS status;

    if (NULL != gHooks)
    {
        ERROR("[ERROR] Trying to do IntHookInit multiple times!\n");
        return INT_STATUS_ALREADY_INITIALIZED;
    }

    gHooks = HpAllocWithTag(sizeof(*gHooks), IC_TAG_HOOKS);
    if (NULL == gHooks)
    {
        return INT_STATUS_INSUFFICIENT_RESOURCES;
    }

    status = IntHookGpaInit();
    if (!INT_SUCCESS(status))
    {
        goto cleanup_and_exit;
    }

    status = IntHookPtmInit();
    if (!INT_SUCCESS(status))
    {
        goto cleanup_and_exit;
    }

    status = IntHookPtsInit();
    if (!INT_SUCCESS(status))
    {
        goto cleanup_and_exit;
    }

    status = IntHookGvaInit();
    if (!INT_SUCCESS(status))
    {
        goto cleanup_and_exit;
    }

    status = IntHookObjectInit();
    if (!INT_SUCCESS(status))
    {
        goto cleanup_and_exit;
    }

    return  INT_STATUS_SUCCESS;

cleanup_and_exit:
    IntHookObjectUninit();

    if (NULL != gHooks)
    {
        HpFreeAndNullWithTag(&gHooks, IC_TAG_HOOKS);
    }

    return status;
}


INTSTATUS
IntHookUninit(
    void
    )
{
    INTSTATUS status;

    if (NULL == gHooks)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    status = IntHookCommitAllHooks();
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookCommitAllHooks failed: 0x%08x\n", status);
    }

    status = IntHookObjectUninit();
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookObjectUninit: 0x%08x\n", status);
    }

    HpFreeAndNullWithTag(&gHooks, IC_TAG_HOOKS);

    gHooks = NULL;

    return INT_STATUS_SUCCESS;
}


QWORD
IntHookGetGlaFromGpaHook(
    _In_ HOOK_GPA const *Hook,
    _In_ QWORD Address
    )
{
    HOOK_GVA const *pGva = Hook->Header.ParentHook;

    if ((NULL == pGva) || (pGva->Header.HookType != hookTypeGva))
    {
        ERROR("[ERROR] The GPA hook for address 0x%016llx does not point to a valid GVA hook: %p, type %d",
              Hook->GpaPage, pGva, pGva ? pGva->Header.HookType : 0);
        IntBugCheck();
    }

    return pGva->GvaPage + (Address & 0xFFF);
}