Bitdefender Hypervisor Memory Introspection
hook_dtr.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
5 #ifndef _HOOK_DTR_H_
6 #define _HOOK_DTR_H_
7 
8 #include "introcpu.h"
9 #include "introtypes.h"
10 
11 
20 typedef INTSTATUS
21 (*PFUNC_DtrReadWriteHookCallback)(
22  _In_ DTR *OldDtr,
23  _In_ DTR *NewDtr,
24  _In_ DWORD Flags,
25  _Out_ INTRO_ACTION *Action
26  );
27 
28 
32 typedef struct _DTR_HOOK_STATE
33 {
34  LIST_HEAD DtrHooksList;
35  INT64 HooksCount;
36 } DTR_HOOK_STATE, *PDTR_HOOK_STATE;
37 
38 
42 typedef struct _HOOK_DTR
43 {
44  LIST_ENTRY Link;
45  DWORD Flags;
46  BOOLEAN Disabled;
47  PFUNC_DtrReadWriteHookCallback Callback;
48 } HOOK_DTR, *PHOOK_DTR;
49 
50 
51 //
52 // DTR hooks related API
53 //
54 INTSTATUS
55 IntHookDtrSetHook(
56  _In_ DWORD Flags,
57  _In_ PFUNC_DtrReadWriteHookCallback Callback,
58  _Out_opt_ void **Hook
59  );
60 
61 INTSTATUS
62 IntHookDtrRemoveHook(
63  _In_ HOOK_DTR *Hook
64  );
65 
66 INTSTATUS
67 IntHookDtrCommit(
68  void
69  );
70 
71 INTSTATUS
72 IntHookDtrInit(
73  void
74  );
75 
76 INTSTATUS
77 IntHookDtrUninit(
78  void
79  );
80 
81 #endif // _HOOK_DTR_H_
BOOLEAN
_Bool BOOLEAN
Definition: intro_types.h:58
_Out_
#define _Out_
Definition: intro_sal.h:22
_DTR_HOOK_STATE
Definition: hook_dtr.h:32
INT64
long long INT64
Definition: intro_types.h:45
_In_
#define _In_
Definition: intro_sal.h:21
_DTR_HOOK_STATE::HooksCount
INT64 HooksCount
The total number of DTR hooks.
Definition: hook_dtr.h:35
_HOOK_DTR::Link
LIST_ENTRY Link
List entry element.
Definition: hook_dtr.h:44
_HOOK_DTR::Flags
DWORD Flags
Hook flags, a combination of IG_DESC_ACCESS.
Definition: hook_dtr.h:45
IntHookDtrCommit
INTSTATUS IntHookDtrCommit(void)
Commit the descriptor registers hooks.
Definition: hook_dtr.c:165
_HOOK_DTR::Callback
PFUNC_DtrReadWriteHookCallback Callback
The callback.
Definition: hook_dtr.h:47
IntHookDtrSetHook
INTSTATUS IntHookDtrSetHook(DWORD Flags, PFUNC_DtrReadWriteHookCallback Callback, void **Hook)
Places a descriptor table register hook.
Definition: hook_dtr.c:11
INTSTATUS
int INTSTATUS
The status data type.
Definition: introstatus.h:24
PHOOK_DTR
struct _HOOK_DTR * PHOOK_DTR
DTR_HOOK_STATE
struct _DTR_HOOK_STATE DTR_HOOK_STATE
IntHookDtrUninit
INTSTATUS IntHookDtrUninit(void)
Uninit the descriptor registers hooks state.
Definition: hook_dtr.c:226
PDTR_HOOK_STATE
struct _DTR_HOOK_STATE * PDTR_HOOK_STATE
_Out_opt_
#define _Out_opt_
Definition: intro_sal.h:30
_HOOK_DTR
Definition: hook_dtr.h:42
HOOK_DTR
struct _HOOK_DTR HOOK_DTR
_DTR
A descriptor table register. Valid for IDTR and GDTR.
Definition: introcpu.h:71
DWORD
uint32_t DWORD
Definition: intro_types.h:49
INTRO_ACTION
enum _INTRO_ACTION INTRO_ACTION
Event actions.
PFUNC_DtrReadWriteHookCallback
INTSTATUS(* PFUNC_DtrReadWriteHookCallback)(DTR *OldDtr, DTR *NewDtr, DWORD Flags, INTRO_ACTION *Action)
Called when a descriptor table register is accessed.
Definition: hook_dtr.h:21
IntHookDtrInit
INTSTATUS IntHookDtrInit(void)
Initialize the descriptor registers hook state.
Definition: hook_dtr.c:203
_HOOK_DTR::Disabled
BOOLEAN Disabled
True if the hook has been removed/disabled.
Definition: hook_dtr.h:46
_LIST_ENTRY
Definition: introlists.h:16
IntHookDtrRemoveHook
INTSTATUS IntHookDtrRemoveHook(HOOK_DTR *Hook)
Remove a descriptor register hook.
Definition: hook_dtr.c:106
_DTR_HOOK_STATE::DtrHooksList
LIST_HEAD DtrHooksList
The list of DTR hooks.
Definition: hook_dtr.h:34