hook.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _HOOK_H_
#define _HOOK_H_

#include "introtypes.h"


enum _HOOK_TYPE
{
    hookTypeGpa = 1,    
    hookTypeGva,        
    hookTypePts,        
    hookTypePtsPt,      
    hookTypePtm,        
    hookTypePtmPt,      
    hookTypeRegion,     
};


#define HOOK_FLG_GLOBAL_MASK            0xFFFF0000

#define HOOK_FLG_INTERNAL_MASK          0x0000FFFF

// Global flags, used for each kind of hook. The lower 16 bits are used by each hook subsystem individually.

#define HOOK_FLG_REMOVE                 0x80000000
#define HOOK_FLG_DISABLED               0x40000000
#define HOOK_FLG_CHAIN_DELETE           0x20000000
#define HOOK_FLG_PAGING_STRUCTURE       0x08000000  
#define HOOK_FLG_PAE_ROOT               0x04000000  
#define HOOK_FLG_PT_UM_ROOT             0x02000000
#define HOOK_FLG_HIGH_PRIORITY          0x01000000

#define HOOK_PAGE_TABLE_FLAGS           (HOOK_FLG_PAGING_STRUCTURE|HOOK_FLG_PAE_ROOT|HOOK_FLG_PT_UM_ROOT)



typedef struct _HOOK_HEADER
{
    DWORD               Flags;          
    BYTE                HookType;       
    BYTE                EptHookType;    
    BYTE                _Reserved[2];

    void                *ParentHook;
    void                *Context;       
} HOOK_HEADER, *PHOOK_HEADER;


#include "hook_gpa.h"
#include "hook_ptm.h"
#include "hook_gva.h"
#include "hook_ptwh.h"
#include "hook_pts.h"
#include "hook_object.h"
#include "hook_ptwh.h"


typedef struct _HOOK_STATE
{
    HOOK_GPA_STATE          GpaHooks;           
    HOOK_GVA_STATE          GvaHooks;           
    HOOK_PTM_STATE          PtmHooks;           
    HOOK_PTS_STATE          PtsHooks;           
    HOOK_OBJECT_STATE       Objects;            
    BOOLEAN                 Dirty;              
} HOOK_STATE, *PHOOK_STATE;


extern HOOK_STATE *gHooks;

//
// API
//
INTSTATUS
IntHookCommitAllHooks(
    void
    );

INTSTATUS
IntHookRemoveChain(
    _In_ PHOOK_GPA HookGpa
    );

INTSTATUS
IntHookInit(
    void
    );

INTSTATUS
IntHookUninit(
    void
    );

QWORD
IntHookGetGlaFromGpaHook(
    _In_ HOOK_GPA const *Hook,
    _In_ QWORD Address
    );

#endif // _HOOK_H_