hook_gpa.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _HOOK_GPA_H_
#define _HOOK_GPA_H_

#include "queue.h"

typedef struct _HOOK_HEADER HOOK_HEADER;

typedef INTSTATUS
(*PFUNC_EptViolationCallback)(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    );


typedef struct _HOOK_GPA
{
    HOOK_HEADER                 Header;         
    LIST_ENTRY                  Link;           

    QWORD                       GpaPage;        
    WORD                        Offset;         
    WORD                        Length;         

    PFUNC_EptViolationCallback  Callback;       

    QUEUE_ENTRY                 LinkRemoved;    
} HOOK_GPA, *PHOOK_GPA;


typedef struct _HOOK_SPP_ENTRY
{
    QWORD               OldSpp;         
    QWORD               CurSpp;         
    DWORD               SppCount[32];   
} HOOK_SPP_ENTRY, *PHOOK_SPP_ENTRY;


typedef struct _HOOK_EPT_ENTRY
{
    LIST_ENTRY          Link;           
    QWORD               GpaPage;        

    DWORD               ReadCount;      
    DWORD               WriteCount;     
    DWORD               ExecuteCount;   
    DWORD               PtCount;        
    DWORD               ConvCount;      
    HOOK_SPP_ENTRY      *Spp;
} HOOK_EPT_ENTRY, *PHOOK_EPT_ENTRY;


#define GPA_HOOK_TABLE_SIZE             1024    
#define GPA_HOOK_ID(addr)               (((addr) >> 12) & (GPA_HOOK_TABLE_SIZE - 1))

#define GPA_EPT_TABLE_SIZE              4096    
#define GPA_EPT_ID(addr)                (((addr) >> 12) & (GPA_EPT_TABLE_SIZE - 1))

#define GPA_REF_COUNT(epte)             (((QWORD)((epte)->ReadCount) + \
                                        (QWORD)((epte)->WriteCount) + \
                                        ((QWORD)(epte)->ExecuteCount) + \
                                        ((QWORD)(epte)->PtCount)))

#define MAX_HOOK_COUNT                  UINT32_MAX  


typedef struct _HOOK_GPA_STATE
{
    LIST_HEAD           GpaHooksWrite[GPA_HOOK_TABLE_SIZE];     
    LIST_HEAD           GpaHooksRead[GPA_HOOK_TABLE_SIZE];      
    LIST_HEAD           GpaHooksExecute[GPA_HOOK_TABLE_SIZE];   

    QUEUE_HEAD          RemovedHooksWrite;              
    QUEUE_HEAD          RemovedHooksRead;               
    QUEUE_HEAD          RemovedHooksExecute;            

    LIST_HEAD           EptEntries[GPA_EPT_TABLE_SIZE];

    INT64               HooksCount;                     

    BOOLEAN             HooksRemoved;                   
    BOOLEAN             VeEnabled;                      
    BOOLEAN             PtCacheEnabled;                 
    BOOLEAN             SppEnabled;                     
} HOOK_GPA_STATE, *PHOOK_GPA_STATE;


//
// API
//
PHOOK_EPT_ENTRY
IntHookGpaGetExistingEptEntry(
    _In_ QWORD GpaPage
    );

INTSTATUS
IntHookGpaSetHook(
    _In_ QWORD Gpa,
    _In_ DWORD Length,
    _In_ BYTE  Type,
    _In_ PFUNC_EptViolationCallback Callback,
    _In_opt_ void *Context,
    _In_opt_ void *ParentHook,
    _In_opt_ DWORD Flags,
    _Out_opt_ HOOK_GPA **Hook
    );

INTSTATUS
IntHookGpaRemoveHook(
    _Inout_ HOOK_GPA **Hook,
    _In_ DWORD Flags
    );

INTSTATUS
IntHookGpaDeleteHook(
    _In_ HOOK_GPA **Hook,
    _In_ DWORD Flags
    );

INTSTATUS
IntHookGpaDisableHook(
    _In_ HOOK_GPA *Hook
    );

INTSTATUS
IntHookGpaEnableHook(
    _In_ HOOK_GPA *Hook
    );

INTSTATUS
IntHookGpaCommitHooks(
    void
    );

INTSTATUS
IntHookGpaIsPageHooked(
    _In_ QWORD Gpa,
    _Out_ BYTE *Read,
    _Out_ BYTE *Write,
    _Out_ BYTE *Execute
    );

INTSTATUS
IntHookGpaEnableVe(
    void
    );

INTSTATUS
IntHookGpaDisableVe(
    void
    );

INTSTATUS
IntHookGpaInit(
    void
    );

void
IntHookGpaDump(
    void
    );

INTSTATUS
IntHookGpaEnablePtCache(
    void
    );

INTSTATUS
IntHookGpaDisablePtCache(
    void
    );

INTSTATUS
IntHookGpaGetEPTPageProtection(
    _In_ DWORD EptIndex,
    _In_ QWORD Address,
    _Out_ BYTE *Read,
    _Out_ BYTE *Write,
    _Out_ BYTE *Execute
    );

INTSTATUS
IntHookGpaFindConvertible(
    void
    );

#endif // _HOOK_GPA_H_