hook_object.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _HOOK_STRUCTURE_H_
#define _HOOK_STRUCTURE_H_

#include "guests.h"

typedef struct _HOOK_HEADER HOOK_HEADER;


typedef struct _HOOK_OBJECT_DESCRIPTOR
{
    LIST_ENTRY          Link;           
    LIST_HEAD           Regions;        
    LIST_HEAD           RemovedRegions;
    DWORD               ObjectType;     
    QWORD               Cr3;            
    DWORD               Flags;          

    BOOLEAN             RegionsRemoved;
} HOOK_OBJECT_DESCRIPTOR, *PHOOK_OBJECT_DESCRIPTOR;


typedef struct _HOOK_REGION_DESCRIPTOR
{
    HOOK_HEADER             Header;         
    LIST_ENTRY              Link;           
    QWORD                   HookStart;      
    QWORD                   HookLength;     
    DWORD                   HooksCount;     
    void                    **Hooks;        

    PHOOK_OBJECT_DESCRIPTOR Object;
} HOOK_REGION_DESCRIPTOR, *PHOOK_REGION_DESCRIPTOR;


typedef struct _HOOK_OBJECTS_STATE
{
    LIST_HEAD           Objects;        
    BOOLEAN             ObjectsRemoved; 
} HOOK_OBJECT_STATE, *PHOOK_OBJECT_STATE;


//
// API
//
INTSTATUS
IntHookObjectCreate(
    _In_ DWORD ObjectType,
    _In_ QWORD Cr3,
    _Out_ void **Object
    );

INTSTATUS
IntHookObjectHookRegion(
    _In_ void *Object,
    _In_ QWORD Cr3,
    _In_ QWORD Gla,
    _In_ SIZE_T Length,
    _In_ BYTE Type,
    _In_ void *Callback,
    _In_opt_ void *Context,
    _In_opt_ DWORD Flags,
    _Out_opt_ HOOK_REGION_DESCRIPTOR **Region
    );

INTSTATUS
IntHookObjectRemoveRegion(
    _Inout_ HOOK_REGION_DESCRIPTOR **Region,
    _In_ DWORD Flags
    );

INTSTATUS
IntHookObjectDestroy(
    _Inout_ HOOK_OBJECT_DESCRIPTOR **Object,
    _In_ DWORD Flags
    );

void *
IntHookObjectFindRegion(
    _In_ QWORD Gva,
    _In_ void *HookObject,
    _In_ BYTE HookType
    );

INTSTATUS
IntHookObjectCommit(
    void
    );

INTSTATUS
IntHookObjectInit(
    void
    );

INTSTATUS
IntHookObjectUninit(
    void
    );

#endif // _HOOK_STRUCTURE_H_