Bitdefender Hypervisor Memory Introspection
hook_gva.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
5 #ifndef _HOOK_GVA_H_
6 #define _HOOK_GVA_H_
7 
8 #include "hook_gpa.h"
9 #include "hook_pts.h"
10 
11 typedef struct _HOOK_HEADER HOOK_HEADER;
12 
13 
18 typedef struct _HOOK_GVA
19 {
20  HOOK_HEADER Header;
21  LIST_ENTRY Link;
22  union
23  {
25  PFUNC_EptViolationCallback Access;
26  PFUNC_SwapCallback Swap;
27  } Callback;
28 
30  PHOOK_GPA GpaHook;
31  PHOOK_PTS PtsHook;
32  QWORD GvaPage;
33  WORD Offset;
34  WORD Length;
35  DWORD Hash;
39  BOOLEAN IsIntegrityOn;
40  BOOLEAN IsPageWritable;
41 } HOOK_GVA, *PHOOK_GVA;
42 
43 
47 typedef struct _HOOK_GVA_STATE
48 {
49  LIST_HEAD GvaHooks;
50  LIST_HEAD RemovedHooksList;
51  BOOLEAN HooksRemoved;
53 } HOOK_GVA_STATE, *PHOOK_GVA_STATE;
54 
55 
56 
57 //
58 // API
59 //
60 INTSTATUS
61 IntHookGvaSetHook(
62  _In_ QWORD Cr3,
63  _In_ QWORD Gva,
64  _In_ DWORD Length,
65  _In_ BYTE Type,
66  _In_ void *Callback,
67  _In_opt_ void *Context,
68  _In_opt_ void *ParentHook,
69  _In_opt_ DWORD Flags,
70  _Out_opt_ HOOK_GVA **GvaHook
71  );
72 
73 INTSTATUS
74 IntHookGvaRemoveHook(
75  _Inout_ HOOK_GVA **Hook,
76  _In_ DWORD Flags
77  );
78 
79 INTSTATUS
80 IntHookGvaDeleteHook(
81  _Inout_ HOOK_GVA **Hook,
82  _In_ DWORD Flags
83  );
84 
85 INTSTATUS
86 IntHookGvaCommitHooks(
87  void
88  );
89 
90 INTSTATUS
91 IntHookGvaInit(
92  void
93  );
94 
95 #endif // _HOOK_GVA_H_
_In_opt_
#define _In_opt_
Definition: intro_sal.h:16
PHOOK_GVA_STATE
struct _HOOK_GVA_STATE * PHOOK_GVA_STATE
BOOLEAN
_Bool BOOLEAN
Definition: intro_types.h:58
_HOOK_GVA::Length
WORD Length
Definition: hook_gva.h:34
_HOOK_GVA::IsPageWritable
BOOLEAN IsPageWritable
True if the page is writable, false otherwise.
Definition: hook_gva.h:40
BYTE
uint8_t BYTE
Definition: intro_types.h:47
_In_
#define _In_
Definition: intro_sal.h:21
_HOOK_GVA::Link
LIST_ENTRY Link
List entry element.
Definition: hook_gva.h:21
WORD
uint16_t WORD
Definition: intro_types.h:48
IntHookGvaDeleteHook
INTSTATUS IntHookGvaDeleteHook(HOOK_GVA **Hook, DWORD Flags)
Completely delete a GVA hook.
Definition: hook_gva.c:612
hook_pts.h
_HOOK_GVA::IsIntegrityOn
BOOLEAN IsIntegrityOn
True if integrity checks are enabled for this page. Integrity checks are enabled if the this is a wri...
Definition: hook_gva.h:39
_HOOK_GVA::Offset
WORD Offset
Offset inside the 4K page, interval [0, 4095].
Definition: hook_gva.h:33
_HOOK_GVA_STATE::RemovedHooksList
LIST_HEAD RemovedHooksList
IntHookGvaCommitHooks function is called.
Definition: hook_gva.h:50
HOOK_GVA
struct _HOOK_GVA HOOK_GVA
INTSTATUS
int INTSTATUS
The status data type.
Definition: introstatus.h:24
_HOOK_GVA::GvaPage
QWORD GvaPage
Guest virtual page base address, aligned to 4K.
Definition: hook_gva.h:32
PHOOK_GVA
struct _HOOK_GVA * PHOOK_GVA
_HOOK_GVA::Callback
union _HOOK_GVA::@85 Callback
IntHookGvaSetHook
INTSTATUS IntHookGvaSetHook(QWORD Cr3, QWORD Gva, DWORD Length, BYTE Type, void *Callback, void *Context, void *ParentHook, DWORD Flags, HOOK_GVA **GvaHook)
Set a read, write, execute or swap hook on a guest virtual address.
Definition: hook_gva.c:345
_HOOK_GVA_STATE
Definition: hook_gva.h:47
_HOOK_GVA
Definition: hook_gva.h:18
_HOOK_GPA
Definition: hook_gpa.h:41
_Inout_
#define _Inout_
Definition: intro_sal.h:20
hook_gpa.h
_Out_opt_
#define _Out_opt_
Definition: intro_sal.h:30
QWORD
unsigned long long QWORD
Definition: intro_types.h:53
_HOOK_GVA::Header
HOOK_HEADER Header
The hook header.
Definition: hook_gva.h:20
HOOK_GVA_STATE
struct _HOOK_GVA_STATE HOOK_GVA_STATE
PFUNC_SwapCallback
INTSTATUS(* PFUNC_SwapCallback)(void *Context, QWORD VirtualAddress, QWORD OldEntry, QWORD NewEntry, QWORD OldPageSize, QWORD NewPageSize)
Callback invoked on translation modifications.
Definition: hook_pts.h:41
_HOOK_GVA_STATE::GvaHooks
LIST_HEAD GvaHooks
The list of GVA hooks.
Definition: hook_gva.h:49
IntHookGvaRemoveHook
INTSTATUS IntHookGvaRemoveHook(HOOK_GVA **Hook, DWORD Flags)
Remove a GVA hook.
Definition: hook_gva.c:507
_HOOK_GVA::GpaHook
PHOOK_GPA GpaHook
The actual guest physical page hook. Valid as long as the page is mapped.
Definition: hook_gva.h:30
DWORD
uint32_t DWORD
Definition: intro_types.h:49
IntHookGvaCommitHooks
INTSTATUS IntHookGvaCommitHooks(void)
Commit all the modified GVA hooks.
Definition: hook_gva.c:657
_HOOK_GVA::Hash
DWORD Hash
Hash computed on the content of the page. Valid only if IsIntegrityOn is true.
Definition: hook_gva.h:36
PFUNC_EptViolationCallback
INTSTATUS(* PFUNC_EptViolationCallback)(void *Context, void *Hook, QWORD Address, INTRO_ACTION *Action)
EPT callback handler.
Definition: hook_gpa.h:30
_HOOK_GVA::Access
PFUNC_EptViolationCallback Access
The read/write/execute access callback. Valid if Type != IG_EPT_HOOK_NONE.
Definition: hook_gva.h:25
_HOOK_PTS
Definition: hook_pts.h:85
_HOOK_GVA::PtsHook
PHOOK_PTS PtsHook
The page tables hook.
Definition: hook_gva.h:31
IntHookGvaInit
INTSTATUS IntHookGvaInit(void)
Initialize the GVA hooks system.
Definition: hook_gva.c:714
_LIST_ENTRY
Definition: introlists.h:16
_HOOK_GVA::Swap
PFUNC_SwapCallback Swap
The swap callback. Valid if Type == IG_EPT_HOOK_NONE.
Definition: hook_gva.h:26
_HOOK_HEADER
Definition: hook.h:65