hook_pts.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _HOOK_PTS_H_
#define _HOOK_PTS_H_

#include "hook_ptwh.h"


//
// Definitions, flags & constants.
//
#define HOOK_PTS_FLG_DELETE_PT_HOOK     0x00000100
#define HOOK_PTS_FLG_DELETE_PD_HOOK     0x00000200

#define HOOK_PTS_MONITORED_BITS         (PT_P | PD_PS | PT_US | PT_RW | 0x000FFFFFFFFFF000)

#define HOOK_PT_HASH_SIZE               64
#define HOOK_PT_HASH_ID(x)              (((x) >> 12) & (HOOK_PT_HASH_SIZE - 1))
#define HOOK_PT_PAE_ROOT_HASH_ID(x)     (((x) >>  5) & (HOOK_PT_HASH_SIZE - 1))


typedef INTSTATUS
(*PFUNC_SwapCallback)(
    _In_ void *Context,
    _In_ QWORD VirtualAddress,
    _In_ QWORD OldEntry,
    _In_ QWORD NewEntry,
    _In_ QWORD OldPageSize,
    _In_ QWORD NewPageSize
    );


typedef struct _HOOK_PTS_ENTRY
{
    HOOK_HEADER         Header;         
    PHOOK_PTM           PtPaHook;       
    QWORD               PtPaAddress;
    BOOLEAN             PtPaHookSet;    
    BOOLEAN             IsLeaf;         
    BOOLEAN             IsValid;
    BOOLEAN             IsPs;           
    BYTE                EntrySize;      
    BYTE                Level;          
    HOOK_PTEWS          WriteState;     
    LIST_ENTRY          Link;           
    LIST_HEAD           ChildrenEntries;
    LIST_HEAD           ContextEntries; 
    DWORD               RefCount;       
    WORD                EntryOffset;    
} HOOK_PTS_ENTRY, *PHOOK_PTS_ENTRY;


typedef struct _HOOK_PTS
{
    HOOK_HEADER         Header;         
    QWORD               Cr3;            
    QWORD               VirtualAddress; 
    QWORD               CurEntry;       
    QWORD               OldEntry;       
    QWORD               CurPageSize;    
    QWORD               OldPageSize;    
    LIST_ENTRY          Link;           
    LIST_ENTRY          PtsLink;        
    PHOOK_PTS_ENTRY     Parent;         
    PFUNC_SwapCallback  Callback;       
    BOOLEAN             IntegrityCheckFailed;   
} HOOK_PTS, *PHOOK_PTS;


typedef struct _HOOK_PTS_STATE
{
    LIST_HEAD           *CallbacksList; 
    LIST_HEAD           HooksPtsList;   
    LIST_HEAD           HooksRootList[HOOK_PT_HASH_SIZE];   
    LIST_HEAD           RemovedHooksRootList;   
    LIST_HEAD           RemovedHooksPtsList;    
    LIST_HEAD           RemovedHooksPtList;     
    LIST_HEAD           RemovedHooksPdList;     
    LIST_HEAD           RemovedHooksPdpList;    
    LIST_HEAD           RemovedHooksPml4List;   
    LIST_HEAD           RemovedHooksPml5List;   
    BOOLEAN             HooksRemoved;           
} HOOK_PTS_STATE, *PHOOK_PTS_STATE;



//
// API
//
INTSTATUS
IntHookPtsSetHook(
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress,
    _In_ PFUNC_SwapCallback Callback,
    _In_opt_ void *Context,
    _In_opt_ void *Parent,
    _In_ DWORD Flags,
    _Out_ PHOOK_PTS *Hook
    );

INTSTATUS
IntHookPtsRemoveHook(
    _Inout_ HOOK_PTS **Hook,
    _In_ DWORD Flags
    );

INTSTATUS
IntHookPtsDeleteHook(
    _Inout_ HOOK_PTS **Hook,
    _In_ DWORD Flags
    );

INTSTATUS
IntHookPtsCommitHooks(
    void
    );

INTSTATUS
IntHookPtsInit(
    void
    );

INTSTATUS
IntHookPtsWriteEntry(
    _In_ PHOOK_PTS_ENTRY Entry,
    _In_ QWORD OldValue,
    _In_ QWORD NewValue
    );

INTSTATUS
IntHookPtsCheckIntegrity(
    void
    );

void
IntHookPtsDump(
    void
    );

#endif // _HOOK_PTS_H