integrity.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "integrity.h"
#include "crc32.h"
#include "gpacache.h"
#include "guests.h"



static LIST_HEAD gIntegrityRegions = LIST_HEAD_INIT(gIntegrityRegions);

#define for_each_region(_var_name)      list_for_each(gIntegrityRegions, INTEGRITY_REGION, _var_name)


static BOOLEAN
IntIntegrityIsOverlappedRegions(
    _In_ INTEGRITY_REGION *Descriptor
    )
{
    for_each_region(pIntRegion)
    {
        if ((Descriptor->Gva >= pIntRegion->Gva &&
             Descriptor->Gva < pIntRegion->Gva + pIntRegion->Length) ||
            (Descriptor->Gva + Descriptor->Length > pIntRegion->Gva &&
             Descriptor->Gva + Descriptor->Length <= pIntRegion->Gva + pIntRegion->Length) ||
            (pIntRegion->Gva >= Descriptor->Gva &&
             pIntRegion->Gva < Descriptor->Gva + Descriptor->Length) ||
            (pIntRegion->Gva + pIntRegion->Length > Descriptor->Gva &&
             pIntRegion->Gva + pIntRegion->Length < Descriptor->Gva + Descriptor->Length))
        {
            WARNING("[WARNING] Found integrity regions overlapped @ %llx (0x%08X) - @ %llx (0x%08X)",
                    pIntRegion->Gva, pIntRegion->Length, Descriptor->Gva, Descriptor->Length);
            return TRUE;
        }
    }

    return FALSE;
}


INTSTATUS
IntIntegrityAddRegion(
    _In_ QWORD VirtualAddress,
    _In_ DWORD Length,
    _In_ INTRO_OBJECT_TYPE Type,
    _In_opt_ void *Context,
    _In_ PFUNC_IntegrityViolationCallback Callback,
    _In_ BOOLEAN CopyContent,
    _Out_ void **Descriptor
    )
{
    INTSTATUS status;
    INTEGRITY_REGION *pIntegrityRegion;
    BYTE *pOriginalContent = NULL;
    DWORD left = Length;
    DWORD crc32 = INITIAL_CRC_VALUE;
    QWORD gva = VirtualAddress;

    if (0 == Length)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    if (gGuest.OSType == introGuestWindows &&
        !IS_KERNEL_POINTER_WIN(gGuest.Guest64, VirtualAddress))
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (gGuest.OSType == introGuestLinux &&
        !IS_KERNEL_POINTER_LIX(VirtualAddress))
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    pIntegrityRegion = HpAllocWithTag(sizeof(*pIntegrityRegion), IC_TAG_ITGR);
    if (NULL == pIntegrityRegion)
    {
        return INT_STATUS_INSUFFICIENT_RESOURCES;
    }

    if (CopyContent)
    {
        pIntegrityRegion->OriginalContent = HpAllocWithTag(Length, IC_TAG_ITGR);
        if (NULL == pIntegrityRegion->OriginalContent)
        {
            HpFreeAndNullWithTag(&pIntegrityRegion, IC_TAG_ITGR);

            return INT_STATUS_INSUFFICIENT_RESOURCES;
        }

        pOriginalContent = pIntegrityRegion->OriginalContent;
    }

    do
    {
        void *p;
        DWORD size = MIN(left, PAGE_REMAINING(gva));

        // SystemCr3 is OK, since we only support integrity regions for kernel memory only.
        status = IntVirtMemMap(gva, size, gGuest.Mm.SystemCr3, 0, &p);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed mapping GVA 0x%016llx to host: 0x%08x\n", VirtualAddress, status);
            goto cleanup_and_leave;
        }

        crc32 = Crc32ComputeFast(p, size, crc32);

        if (pOriginalContent)
        {
            memcpy(pOriginalContent, p, size);
            pOriginalContent += size;
        }

        IntVirtMemUnmap(&p);

        // The next one will be page-aligned
        gva = gva + size;

        left -= size;
    } while (gva < VirtualAddress + Length);

    pIntegrityRegion->Gva = VirtualAddress;
    pIntegrityRegion->Length = Length;
    pIntegrityRegion->Type = Type;
    pIntegrityRegion->OriginalHash = crc32;
    pIntegrityRegion->ViolationCount = 0;
    pIntegrityRegion->Callback = Callback;
    pIntegrityRegion->Context = Context;
    pIntegrityRegion->Deleted = FALSE;

    IntIntegrityIsOverlappedRegions(pIntegrityRegion);

    InsertTailList(&gIntegrityRegions, &pIntegrityRegion->Link);

    TRACE("[INFO] Add integrity region @ %llx (%d).\n", pIntegrityRegion->Gva, pIntegrityRegion->Length);

    *Descriptor = pIntegrityRegion;

    status = INT_STATUS_SUCCESS;

cleanup_and_leave:
    if (!INT_SUCCESS(status))
    {
        if (NULL != pIntegrityRegion->OriginalContent)
        {
            HpFreeAndNullWithTag(&pIntegrityRegion->OriginalContent, IC_TAG_ITGR);
        }

        HpFreeAndNullWithTag(&pIntegrityRegion, IC_TAG_ITGR);
    }

    return status;
}


INTSTATUS
IntIntegrityRecalculate(
    _In_ INTEGRITY_REGION *IntegrityRegion
    )
{
    QWORD gva = IntegrityRegion->Gva;
    DWORD left = IntegrityRegion->Length;
    DWORD crc32 = INITIAL_CRC_VALUE;
    BYTE *pOriginalContent = IntegrityRegion->OriginalContent;
    INTSTATUS status = INT_STATUS_SUCCESS;

    do
    {
        DWORD size = MIN(left, PAGE_REMAINING(gva));
        void *p;

        // SystemCr3 is ok, since we support integrity regions for kernel memory only.
        status = IntVirtMemMap(gva, size, gGuest.Mm.SystemCr3, 0, &p);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed mapping GVA 0x%016llx to host: 0x%08x\n", IntegrityRegion->Gva, status);
            goto cleanup_and_exit;
        }

        crc32 = Crc32ComputeFast(p, size, crc32);

        if (NULL != pOriginalContent)
        {
            memcpy(pOriginalContent, p, size);
            pOriginalContent += size;
        }

        IntVirtMemUnmap(&p);

        // the next one will be page-aligned
        gva = gva + size;
        left -= size;
    } while (gva < IntegrityRegion->Gva + IntegrityRegion->Length);

    IntegrityRegion->OriginalHash = crc32;

    status = INT_STATUS_SUCCESS;

cleanup_and_exit:

    return status;
}


INTSTATUS
IntIntegrityRemoveRegion(
    _In_ void *Descriptor
    )
{
    INTEGRITY_REGION *pIntegrityRegion = Descriptor;

    TRACE("[INFO] Remove integrity region @ %llx (%d).", pIntegrityRegion->Gva, pIntegrityRegion->Length);

    RemoveEntryList(&pIntegrityRegion->Link);

    if (NULL != pIntegrityRegion->OriginalContent)
    {
        HpFreeAndNullWithTag(&pIntegrityRegion->OriginalContent, IC_TAG_ITGR);
    }

    HpFreeAndNullWithTag(&pIntegrityRegion, IC_TAG_ITGR);

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntIntegrityDeleteRegion(
    _In_ void *Descriptor
    )
{
    INTEGRITY_REGION *pIntegrityRegion = Descriptor;

    TRACE("[INFO] Deleting integrity region @ %llx (%d) after calling callbacks.", pIntegrityRegion->Gva,
          pIntegrityRegion->Length);

    pIntegrityRegion->Deleted = TRUE;

    return INT_STATUS_SUCCESS;
}


TIMER_FRIENDLY INTSTATUS
IntIntegrityCheckAll(
    void
    )
{
    // If introspection is disabled we skip all checks
    if (!gGuest.ProtectionActivated)
    {
        return INT_STATUS_SUCCESS;
    }

    for_each_region(pIntRegion)
    {
        QWORD gva = pIntRegion->Gva;
        DWORD left = pIntRegion->Length;
        BOOLEAN skipThis = FALSE;
        DWORD crc32 = INITIAL_CRC_VALUE;
        INTSTATUS status;

        if (pIntRegion->Deleted)
        {
            continue;
        }

        do
        {
            BYTE *p;
            QWORD gpa;
            DWORD size = MIN(left, PAGE_REMAINING(gva));

            status = IntTranslateVirtualAddress(gva & PAGE_MASK, gGuest.Mm.SystemCr3, &gpa);
            if (!INT_SUCCESS(status))
            {
                skipThis = TRUE;
                break;
            }

            status = IntGpaCacheFindAndAdd(gGuest.GpaCache, gpa, &p);
            if (!INT_SUCCESS(status))
            {
                // Do not show error messages since at sleep/hibernate the pages may not be present!
                // We could hook the pt and see when the pages swap-out but the performance impact is too visible
                skipThis = TRUE;
                break;
            }

            p += gva & PAGE_OFFSET;
            crc32 = Crc32ComputeFast(p, size, crc32);
            p -= gva & PAGE_OFFSET;

            IntGpaCacheRelease(gGuest.GpaCache, gpa);

            // the next one will be page-aligned
            gva += size;

            left -= size;
        } while (gva < pIntRegion->Gva + pIntRegion->Length);

        if (skipThis)
        {
            continue;
        }

        if (crc32 != pIntRegion->OriginalHash)
        {
            pIntRegion->ViolationCount++;

            if (NULL != pIntRegion->Callback)
            {
                // From here on, we can safely use any CPU state/virtual mem map functions/etc.
                status = pIntRegion->Callback(pIntRegion);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] Integrity violation callback failed with status: 0x%08x\n", status);
                }
            }
            else if (pIntRegion->ModifiedHash != crc32)
            {
                pIntRegion->ModifiedHash = crc32;
            }
        }
    }

    // Finally remove the regions that were deleted during calling the integrity callbacks
    for_each_region(pIntRegion)
    {
        if (pIntRegion->Deleted)
        {
            IntIntegrityRemoveRegion(pIntRegion);
        }
    }

    return INT_STATUS_SUCCESS;
}


void
IntIntegrityDump(
    void
    )
{
    for_each_region(pIntRegion)
    {
        LOG("Gva: 0x%016llx, Length: %d, OriginalContent: %p, Type: %d, OriginalHash: 0x%08x\n",
            pIntRegion->Gva, pIntRegion->Length, pIntRegion->OriginalContent, pIntRegion->Type,
            pIntRegion->OriginalHash);
    }
}


INTSTATUS
IntIntegrityUninit(
    void
    )
{
    for_each_region(pIntRegion)
    {
        LOG("[ERROR] There should be no regions remaining... Got one on %llx!\n", pIntRegion->Gva);

        IntIntegrityRemoveRegion(pIntRegion);
    }

    return INT_STATUS_SUCCESS;
}