Bitdefender Hypervisor Memory Introspection
hook_xcr.c File Reference
#include "hook_xcr.h"
#include "callbacks.h"
#include "guests.h"

Go to the source code of this file.

Functions

INTSTATUS IntHookXcrSetHook (DWORD Xcr, DWORD Flags, PFUNC_XcrWriteHookCallback Callback, void *Context, HOOK_XCR **Hook)
 Set an extended control register write hook. More...
 
static INTSTATUS IntHookXcrDeleteHook (HOOK_XCR *Hook)
 Permanently delete an extended control register hook. More...
 
INTSTATUS IntHookXcrRemoveHook (HOOK_XCR *Hook)
 Remove an extended control register hook. More...
 
static void IntHookXcrRemoveAllHooks (void)
 Remove all extended control register write hooks. More...
 
INTSTATUS IntHookXcrCommit (void)
 Commit the extended control register hooks. More...
 
INTSTATUS IntHookXcrInit (void)
 Initialize the extended control registers hook state. More...
 
INTSTATUS IntHookXcrUninit (void)
 Uninit the extended control register hooks state. More...
 

Function Documentation

◆ IntHookXcrCommit()

INTSTATUS IntHookXcrCommit ( void  )

Commit the extended control register hooks.

This function will iterate the list of XCR hooks, and it will delete all the hooks that were flagged for removal.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_NOT_INITIALIZEDIf the XCR hooks state is not initialized.

Definition at line 169 of file hook_xcr.c.

Referenced by IntGuestPreReturnCallback().

◆ IntHookXcrDeleteHook()

static INTSTATUS IntHookXcrDeleteHook ( HOOK_XCR Hook)
static

Permanently delete an extended control register hook.

NOTE: When the last XCR hook is removed, the XCR notifications callback will be unregistered from the integrator.

Parameters
[in]HookThe XCR hook to be deleted.
Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INVALID_PARAMETERIf an invalid parameter is supplied.

Definition at line 79 of file hook_xcr.c.

Referenced by IntHookXcrCommit(), and IntHookXcrRemoveHook().

◆ IntHookXcrInit()

INTSTATUS IntHookXcrInit ( void  )

Initialize the extended control registers hook state.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INSUFFICIENT_RESOURCESIf a memory alloc fails.

Definition at line 207 of file hook_xcr.c.

Referenced by IntGuestInit().

◆ IntHookXcrRemoveAllHooks()

static void IntHookXcrRemoveAllHooks ( void  )
static

Remove all extended control register write hooks.

Definition at line 150 of file hook_xcr.c.

Referenced by IntHookXcrUninit().

◆ IntHookXcrRemoveHook()

INTSTATUS IntHookXcrRemoveHook ( HOOK_XCR Hook)

Remove an extended control register hook.

Removes an XCR write hook. First of all, this function will mark the hook as being disabled (the callback will never be called again). If we are currently in the context of a XCR violation, we will wait for the commit phase to permanently delete the hook. Otherwise, the hook will be deleted immediately.

Parameters
[in]HookThe hook to be removed.
Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INVALID_PARAMETERIf an invalid parameter is supplied.

Definition at line 110 of file hook_xcr.c.

Referenced by IntHandleXcrWrite(), and IntHookXcrRemoveAllHooks().

◆ IntHookXcrSetHook()

INTSTATUS IntHookXcrSetHook ( DWORD  Xcr,
DWORD  Flags,
PFUNC_XcrWriteHookCallback  Callback,
void *  Context,
HOOK_XCR **  Hook 
)

Set an extended control register write hook.

This function will place an XCR write hook. Currently, only XCR0 is defined by Intel. When the first XCR hook is set, the notification callback will be registered to the integrator.

Parameters
[in]XcrThe intercepted XCR.
[in]FlagsFlags. Can be used by the caller.
[in]CallbackThe callback to be called when the indicated XCR is written.
[in]ContextOptional context.
[out]HookA handle to the newly placed hook.
Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INVALID_PARAMETERIf an invalid parameter is supplied.
INT_STATUS_INSUFFICIENT_RESOURCESIf a memory alloc failed.

Definition at line 11 of file hook_xcr.c.

◆ IntHookXcrUninit()

INTSTATUS IntHookXcrUninit ( void  )

Uninit the extended control register hooks state.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_NOT_INITIALIZED_HINTIf the XCR hooks state is not initialized.

Definition at line 230 of file hook_xcr.c.

Referenced by IntGuestUninit().