Bitdefender Hypervisor Memory Introspection
hook_xcr.h File Reference
#include "introtypes.h"

Go to the source code of this file.

Data Structures

struct  _XCR_HOOK_STATE
 
struct  _HOOK_XCR
 

Typedefs

typedef INTSTATUS(* PFUNC_XcrWriteHookCallback) (void *Context, DWORD Xcr, INTRO_ACTION *Action)
 Extended control register write callback. More...
 
typedef struct _XCR_HOOK_STATE XCR_HOOK_STATE
 
typedef struct _XCR_HOOK_STATEPXCR_HOOK_STATE
 
typedef struct _HOOK_XCR HOOK_XCR
 
typedef struct _HOOK_XCRPHOOK_XCR
 

Functions

INTSTATUS IntHookXcrSetHook (DWORD Xcr, DWORD Flags, PFUNC_XcrWriteHookCallback Callback, void *Context, HOOK_XCR **Hook)
 Set an extended control register write hook. More...
 
INTSTATUS IntHookXcrRemoveHook (HOOK_XCR *Hook)
 Remove an extended control register hook. More...
 
INTSTATUS IntHookXcrCommit (void)
 Commit the extended control register hooks. More...
 
INTSTATUS IntHookXcrInit (void)
 Initialize the extended control registers hook state. More...
 
INTSTATUS IntHookXcrUninit (void)
 Uninit the extended control register hooks state. More...
 

Typedef Documentation

◆ HOOK_XCR

typedef struct _HOOK_XCR HOOK_XCR

Describes an XCR hook.

◆ PFUNC_XcrWriteHookCallback

typedef INTSTATUS(* PFUNC_XcrWriteHookCallback) (void *Context, DWORD Xcr, INTRO_ACTION *Action)

Extended control register write callback.

Parameters
[in]ContextThe optional context, as passed to the XCR set hook function.
[in]XcrThe written XCR.
[out]ActionDesired action.

Definition at line 19 of file hook_xcr.h.

◆ PHOOK_XCR

typedef struct _HOOK_XCR * PHOOK_XCR

◆ PXCR_HOOK_STATE

typedef struct _XCR_HOOK_STATE * PXCR_HOOK_STATE

◆ XCR_HOOK_STATE

Global XCR hooks state.

Function Documentation

◆ IntHookXcrCommit()

INTSTATUS IntHookXcrCommit ( void  )

Commit the extended control register hooks.

This function will iterate the list of XCR hooks, and it will delete all the hooks that were flagged for removal.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_NOT_INITIALIZEDIf the XCR hooks state is not initialized.

Definition at line 169 of file hook_xcr.c.

Referenced by IntGuestPreReturnCallback().

◆ IntHookXcrInit()

INTSTATUS IntHookXcrInit ( void  )

Initialize the extended control registers hook state.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INSUFFICIENT_RESOURCESIf a memory alloc fails.

Definition at line 207 of file hook_xcr.c.

Referenced by IntGuestInit().

◆ IntHookXcrRemoveHook()

INTSTATUS IntHookXcrRemoveHook ( HOOK_XCR Hook)

Remove an extended control register hook.

Removes an XCR write hook. First of all, this function will mark the hook as being disabled (the callback will never be called again). If we are currently in the context of a XCR violation, we will wait for the commit phase to permanently delete the hook. Otherwise, the hook will be deleted immediately.

Parameters
[in]HookThe hook to be removed.
Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INVALID_PARAMETERIf an invalid parameter is supplied.

Definition at line 110 of file hook_xcr.c.

Referenced by IntHandleXcrWrite(), and IntHookXcrRemoveAllHooks().

◆ IntHookXcrSetHook()

INTSTATUS IntHookXcrSetHook ( DWORD  Xcr,
DWORD  Flags,
PFUNC_XcrWriteHookCallback  Callback,
void *  Context,
HOOK_XCR **  Hook 
)

Set an extended control register write hook.

This function will place an XCR write hook. Currently, only XCR0 is defined by Intel. When the first XCR hook is set, the notification callback will be registered to the integrator.

Parameters
[in]XcrThe intercepted XCR.
[in]FlagsFlags. Can be used by the caller.
[in]CallbackThe callback to be called when the indicated XCR is written.
[in]ContextOptional context.
[out]HookA handle to the newly placed hook.
Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_INVALID_PARAMETERIf an invalid parameter is supplied.
INT_STATUS_INSUFFICIENT_RESOURCESIf a memory alloc failed.

Definition at line 11 of file hook_xcr.c.

◆ IntHookXcrUninit()

INTSTATUS IntHookXcrUninit ( void  )

Uninit the extended control register hooks state.

Return values
INT_STATUS_SUCCESSOn success.
INT_STATUS_NOT_INITIALIZED_HINTIf the XCR hooks state is not initialized.

Definition at line 230 of file hook_xcr.c.

Referenced by IntGuestUninit().