intro_types.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#ifndef _INTRO_TYPES_H_
#define _INTRO_TYPES_H_

#include "env.h"

// Allow integrators to ignore the following typedefs if the following types are already defined
#ifndef INTROCORE_NOCOMPAT

#include <stddef.h>
#include <stdint.h>
#include <stdbool.h>

#ifndef TRUE
#define TRUE                    true
#endif

#ifndef FALSE
#define FALSE                   false
#endif

typedef uint8_t                 UINT8, *PUINT8;
typedef uint16_t                UINT16, *PUINT16;
typedef uint32_t                UINT32, *PUINT32;
typedef unsigned long long      UINT64, *PUINT64;

typedef int8_t                  INT8, *PINT8;
typedef int16_t                 INT16, *PINT16;
typedef int32_t                 INT32, *PINT32;
typedef long long               INT64, *PINT64;

typedef uint8_t                 BYTE, *PBYTE;
typedef uint16_t                WORD, *PWORD;
typedef uint32_t                DWORD, *PDWORD;

// If we don't define 64-bit types to `long long`, we have a problem with string formatting, since
// `%lx` should be used on gnu, and `%llx` on MSVC
typedef unsigned long long      QWORD, *PQWORD;

typedef unsigned char           UCHAR, *PUCHAR;
typedef char                    CHAR, *PCHAR;

typedef _Bool                   BOOLEAN;

typedef size_t                  SIZE_T;

#ifndef INT_COMPILER_MSVC
typedef uint16_t                WCHAR, *PWCHAR;
#include "intro_sal.h"
#else
typedef uint16_t                WCHAR, *PWCHAR;
typedef int64_t                 ssize_t;
#endif // !INT_COMPILER_MSVC

#endif // !INTROCORE_NOCOMPAT


#pragma pack(push, 8)


// Introspection alerts

typedef enum _INTRO_EVENT_TYPE
{
    introEventEptViolation = 1,
    introEventMsrViolation,
    introEventCrViolation,
    introEventXcrViolation,
    introEventIntegrityViolation,
    introEventTranslationViolation,
    introEventInjectionViolation,
    introEventDtrViolation,
    introEventMessage,
    introEventProcessEvent,
    introEventAgentEvent,
    introEventModuleEvent,
    introEventCrashEvent,
    introEventExceptionEvent,
    introEventConnectionEvent,
    introEventProcessCreationViolation,
    introEventModuleLoadViolation,
    introEventEnginesDetectionViolation
} INTRO_EVENT_TYPE;


typedef enum _INTRO_ENG_NOTIFICATION_TYPE
{
    introEngineNotificationCodeExecution = 1,
    introEngineNotificationCmdLine
} INTRO_ENG_NOTIF_TYPE;


typedef enum _INTRO_ACTION
{
    introGuestAllowed = 0,

    introGuestAllowedVirtual,

    introGuestAllowedPatched,

    introGuestNotAllowed,

    introGuestIgnore,

    introGuestRetry,
} INTRO_ACTION;


typedef enum _INTRO_ACTION_REASON
{
    introReasonAllowed = 0,
    introReasonAllowedFeedback,
    introReasonSignatureNotMatched,
    introReasonNoException,
    introReasonExtraChecksFailed,
    introReasonExceptionsNotLoaded,
    introReasonInternalError,
    introReasonValueCodeNotMatched,
    introReasonValueNotMatched,
    introReasonExportNotMatched,
    introReasonIdtNotMatched,
    introReasonVersionOsNotMatched,
    introReasonVersionIntroNotMatched,
    introReasonProcessCreationNotMatched,
    introReasonSameValue,

    introReasonUnknown
} INTRO_ACTION_REASON;


typedef enum _INTRO_OBJECT_TYPE
{
    introObjectTypeRaw = 1,                         
    introObjectTypeInternal,                        
    introObjectTypeSsdt,                            
    introObjectTypeFastIoDispatch,                  
    introObjectTypeDriverObject,                    
    introObjectTypeKmModule,                        
    introObjectTypeIdt,                             
    introObjectTypeGdt,                             
    introObjectTypeKmUnpack,                        
    introObjectTypeProcess,                         
    introObjectTypeUmInternal,                      
    introObjectTypeUmUnpack,                        
    introObjectTypeUmHeap,                          
    introObjectTypeUmStack,                         
    introObjectTypeUmGenericNxZone,                 
    introObjectTypeUmModule,                        
    introObjectTypeDetourRead,                      
    introObjectTypeTokenPtr,                        
    introObjectTypeCreds = introObjectTypeTokenPtr, 
    introObjectTypeHalDispatchTable,                
    introObjectTypeHalIntController,                
    introObjectTypeSelfMapEntry,                    
    introObjectTypeHalHeap,                         
    introObjectTypeVdso,                            
    introObjectTypeVsyscall,                        
    introObjectTypeExTable,                         
    introObjectTypeVeAgent,                         
    introObjectTypeIdtr,                            
    introObjectTypeGdtr,                            
    introObjectTypeProcessCreation,                 
    introObjectTypeExecSuspiciousDll,               
    introObjectTypeKmLoggerContext,                 
    introObjectTypeProcessCreationDpi,              
    introObjectTypeTokenPrivs,                      
    introObjectTypeSudExec,                         
    introObjectTypeHalPerfCounter,                  
    introObjectTypeHookedFunction,                  
    introObjectTypeSlackSpace,                      
    introObjectTypeSecDesc,                         
    introObjectTypeAcl,                             
    introObjectTypeSudIntegrity,                    
    introObjectTypeInterruptObject,                 

    introObjectTypeTest,

    //
    // If you need to add fields here, please consider how it interacts with other parts of Introcore
    // (below are just a few examples):
    // - EVENT_EPT_VIOLATION.Originator.Module and EVENT_EPT_VIOLATION.Originator.Module.ReturnModule
    //      - Should they be valid or invalid ?
    //      - If they are invalid, why ?
    //
    // - EVENT_EPT_VIOLATION.Victim.Module and EVENT_EPT_VIOLATION.Victim.Module.DriverObject:
    //      - Should they be valid or invalid ?
    //      - Must you add another structure in the Victim union ?
    //      - Should the integrator use a generic name based on the new type ?
    //
    // - Other alerts & fields, if that's the case
    //
} INTRO_OBJECT_TYPE;


typedef enum _INTRO_NET_AF
{
    introNetAfIpv4 = 0, 
    introNetAfIpv6,     

    introNetAfUnknown   
} INTRO_NET_AF;


typedef enum _INTRO_NET_STATE
{
    introNetStateEstablished = 0,
    introNetStateSynSent,
    introNetStateSynRecv,
    introNetStateFinWait,
    introNetStateFinWait2,
    introNetStateTimeWait,
    introNetStateClosed,
    introNetStateCloseWait,
    introNetStateLastAck,
    introNetStateListening,
    introNetStateClosing,
    introNetStateNewSynRecv,        
    introNetStateDeleteTcb,         

    introNetStateUnknown
} INTRO_NET_STATE;


//
// These masks are used to configure what protection policies should be applied per process
//


#define PROC_OPT_NONE                               0x00000000
#define PROC_OPT_PROT_CORE_HOOKS                    0x00000004
#define PROC_OPT_PROT_UNPACK                        0x00000008
#define PROC_OPT_PROT_WRITE_MEM                     0x00000010
#define PROC_OPT_PROT_WSOCK_HOOKS                   0x00000020
#define PROC_OPT_PROT_EXPLOIT                       0x00000040
#define PROC_OPT_PROT_SET_THREAD_CTX                0x00000080
#define PROC_OPT_PROT_PTRACE                        0x00000080
#define PROC_OPT_PROT_QUEUE_APC                     0x00000100
#define PROC_OPT_PROT_PREVENT_CHILD_CREATION        0x00000200
#define PROC_OPT_PROT_DOUBLE_AGENT                  0x00000400
#define PROC_OPT_PROT_SCAN_CMD_LINE                 0x00000800
#define PROC_OPT_PROT_INSTRUMENT                    0x00001000

#define PROC_OPT_REMEDIATE                          0x20000000
#define PROC_OPT_KILL_ON_EXPLOIT                    0x40000000
#define PROC_OPT_BETA                               0x80000000

#define PROC_OPT_PROT_INJECTION            (PROC_OPT_PROT_WRITE_MEM         |\
                                            PROC_OPT_PROT_SET_THREAD_CTX    |\
                                            PROC_OPT_PROT_PTRACE            |\
                                            PROC_OPT_PROT_QUEUE_APC         |\
                                            PROC_OPT_PROT_DOUBLE_AGENT      |\
                                            PROC_OPT_PROT_INSTRUMENT)

#define PROC_OPT_PROT_ALL                  (PROC_OPT_PROT_CORE_HOOKS                |\
                                            PROC_OPT_PROT_INJECTION                 |\
                                            PROC_OPT_PROT_WSOCK_HOOKS               |\
                                            PROC_OPT_PROT_EXPLOIT                   |\
                                            PROC_OPT_PROT_PREVENT_CHILD_CREATION    |\
                                            PROC_OPT_PROT_SCAN_CMD_LINE             |\
                                            PROC_OPT_KILL_ON_EXPLOIT)


//
// Granular protection flags.
//



#define INTRO_OPT_PROT_KM_NT                0x0000000000000001ull   
#define INTRO_OPT_PROT_KM_LX                0x0000000000000001ull   
#define INTRO_OPT_PROT_KM_HAL               0x0000000000000002ull   
#define INTRO_OPT_PROT_KM_SSDT              0x0000000000000004ull   
#define INTRO_OPT_PROT_KM_IDT               0x0000000000000008ull   
#define INTRO_OPT_PROT_KM_HAL_DISP_TABLE    0x0000000000000010ull
#define INTRO_OPT_PROT_KM_SYSTEM_CR3        0x0000000000000020ull   
#define INTRO_OPT_PROT_KM_TOKEN_PTR         0x0000000000000040ull   
#define INTRO_OPT_PROT_KM_CREDS             0x0000000000000040ull   
#define INTRO_OPT_PROT_KM_NT_DRIVERS        0x0000000000000080ull
#define INTRO_OPT_PROT_KM_LX_MODULES        0x0000000000000080ull
#define INTRO_OPT_PROT_KM_AV_DRIVERS        0x0000000000000100ull   
#define INTRO_OPT_PROT_KM_XEN_DRIVERS       0x0000000000000200ull   
#define INTRO_OPT_PROT_KM_DRVOBJ            0x0000000000000400ull
#define INTRO_OPT_PROT_KM_CR4               0x0000000000000800ull   
#define INTRO_OPT_PROT_KM_MSR_SYSCALL       0x0000000000001000ull   
#define INTRO_OPT_PROT_KM_IDTR              0x0000000000002000ull
#define INTRO_OPT_PROT_KM_HAL_HEAP_EXEC     0x0000000000004000ull
#define INTRO_OPT_PROT_KM_HAL_INT_CTRL      0x0000000000008000ull

#define INTRO_OPT_PROT_UM_MISC_PROCS        0x0000000000010000ull   
#define INTRO_OPT_PROT_UM_SYS_PROCS         0x0000000000020000ull
#define INTRO_OPT_PROT_KM_SELF_MAP_ENTRY    0x0000000000040000ull   
#define INTRO_OPT_PROT_KM_GDTR              0x0000000000080000ull

#define INTRO_OPT_EVENT_PROCESSES           0x0000000000100000ull
#define INTRO_OPT_EVENT_MODULES             0x0000000000200000ull
#define INTRO_OPT_EVENT_OS_CRASH            0x0000000000400000ull
#define INTRO_OPT_EVENT_PROCESS_CRASH       0x0000000000800000ull

#define INTRO_OPT_AGENT_INJECTION           0x0000000001000000ull   

#define INTRO_OPT_FULL_PATH                 0x0000000002000000ull
#define INTRO_OPT_KM_BETA_DETECTIONS        0x0000000004000000ull   
#define INTRO_OPT_NOTIFY_ENGINES            0x0000000008000000ull
#define INTRO_OPT_IN_GUEST_PT_FILTER        0x0000000010000000ull

#define INTRO_OPT_BUGCHECK_CLEANUP          0x0000000020000000ull
#define INTRO_OPT_PANIC_CLEANUP             0x0000000020000000ull
#define INTRO_OPT_SYSPROC_BETA_DETECTIONS   0x0000000040000000ull

#define INTRO_OPT_VE                        0x0000000080000000ull

#define INTRO_OPT_EVENT_CONNECTIONS         0x0000000100000000ull

#define INTRO_OPT_PROT_KM_LOGGER_CONTEXT    0x0000000200000000ull

#define INTRO_OPT_PROT_DPI_DEBUG            0x0000000400000000ull
#define INTRO_OPT_PROT_DPI_STACK_PIVOT      0x0000000800000000ull
#define INTRO_OPT_PROT_DPI_TOKEN_STEAL      0x0000001000000000ull
#define INTRO_OPT_PROT_DPI_HEAP_SPRAY       0x0000002000000000ull

#define INTRO_OPT_PROT_KM_NT_EAT_READS      0x0000004000000000ull
#define INTRO_OPT_PROT_KM_LX_TEXT_READS     0x0000008000000000ull
#define INTRO_OPT_PROT_KM_VDSO              0x0000010000000000ull   

#define INTRO_OPT_PROT_KM_SWAPGS            0x0000020000000000ull   

#define INTRO_OPT_PROT_KM_TOKEN_PRIVS       0x0000040000000000ull
#define INTRO_OPT_PROT_DPI_TOKEN_PRIVS      0x0000080000000000ull
#define INTRO_OPT_PROT_DPI_THREAD_SHELL     0x0000100000000000ull

#define INTRO_OPT_PROT_KM_SUD_EXEC          0x0000200000000000ull

#define INTRO_OPT_PROT_KM_HAL_PERF_CNT      0x0000400000000000ull

#define INTRO_OPT_PROT_KM_SD_ACL            0x0000800000000000ull
#define INTRO_OPT_PROT_DPI_SD_ACL           0x0001000000000000ull

#define INTRO_OPT_PROT_KM_SUD_INTEGRITY     0x0002000000000000ull

#define INTRO_OPT_PROT_KM_INTERRUPT_OBJ     0x0004000000000000ull

#define INTRO_OPT_PROT_DPI                  (INTRO_OPT_PROT_DPI_DEBUG       | \
                                            INTRO_OPT_PROT_DPI_STACK_PIVOT  | \
                                            INTRO_OPT_PROT_DPI_TOKEN_STEAL  | \
                                            INTRO_OPT_PROT_DPI_HEAP_SPRAY   | \
                                            INTRO_OPT_PROT_DPI_TOKEN_PRIVS  | \
                                            INTRO_OPT_PROT_DPI_THREAD_SHELL | \
                                            INTRO_OPT_PROT_DPI_SD_ACL)


#define INTRO_OPT_ENABLE_KM_PROTECTION      (INTRO_OPT_PROT_KM_NT           | \
                                            INTRO_OPT_PROT_KM_LX            | \
                                            INTRO_OPT_PROT_KM_HAL           | \
                                            INTRO_OPT_PROT_KM_SSDT          | \
                                            INTRO_OPT_PROT_KM_VDSO          | \
                                            INTRO_OPT_PROT_KM_NT_DRIVERS    | \
                                            INTRO_OPT_PROT_KM_LX_MODULES    | \
                                            INTRO_OPT_PROT_KM_NT_EAT_READS  | \
                                            INTRO_OPT_PROT_KM_DRVOBJ        | \
                                            INTRO_OPT_PROT_KM_HAL_HEAP_EXEC | \
                                            INTRO_OPT_PROT_KM_HAL_INT_CTRL  | \
                                            INTRO_OPT_PROT_KM_SELF_MAP_ENTRY| \
                                            INTRO_OPT_PROT_KM_SWAPGS        | \
                                            INTRO_OPT_PROT_KM_SUD_EXEC      | \
                                            INTRO_OPT_PROT_KM_HAL_PERF_CNT)

#define INTRO_OPT_ENABLE_UM_PROTECTION      (INTRO_OPT_PROT_UM_MISC_PROCS   | \
                                            INTRO_OPT_PROT_UM_SYS_PROCS     | \
                                            INTRO_OPT_PROT_DPI)

#define INTRO_OPT_ENABLE_AV_PROTECTION      (INTRO_OPT_PROT_KM_AV_DRIVERS)

#define INTRO_OPT_ENABLE_CR_PROTECTION      (INTRO_OPT_PROT_KM_CR4)

#define INTRO_OPT_ENABLE_MSR_PROTECTION     (INTRO_OPT_PROT_KM_MSR_SYSCALL)

#define INTRO_OPT_ENABLE_INTEGRITY_CHECKS   (INTRO_OPT_PROT_KM_IDT              | \
                                            INTRO_OPT_PROT_KM_HAL_DISP_TABLE    | \
                                            INTRO_OPT_PROT_KM_SYSTEM_CR3        | \
                                            INTRO_OPT_PROT_KM_TOKEN_PTR         | \
                                            INTRO_OPT_PROT_KM_CREDS             | \
                                            INTRO_OPT_PROT_KM_LOGGER_CONTEXT    | \
                                            INTRO_OPT_PROT_KM_TOKEN_PRIVS       | \
                                            INTRO_OPT_PROT_KM_SD_ACL            | \
                                            INTRO_OPT_PROT_KM_SUD_INTEGRITY     | \
                                            INTRO_OPT_PROT_KM_INTERRUPT_OBJ)

#define INTRO_OPT_ENABLE_DTR_PROTECTION     (INTRO_OPT_PROT_KM_IDTR | \
                                            INTRO_OPT_PROT_KM_GDTR)

#define INTRO_OPT_ENABLE_KM_BETA_DETECTIONS (INTRO_OPT_KM_BETA_DETECTIONS)

#define INTRO_OPT_ENABLE_FULL_PATH          (INTRO_OPT_FULL_PATH)

#define INTRO_OPT_ENABLE_XEN_PROTECTION     (INTRO_OPT_PROT_KM_XEN_DRIVERS)

#define INTRO_OPT_ENABLE_MANUAL_AGENT_INJ   (INTRO_OPT_AGENT_INJECTION)

#define INTRO_OPT_ENABLE_MISC_EVENTS        (INTRO_OPT_EVENT_PROCESSES  | \
                                            INTRO_OPT_EVENT_MODULES     | \
                                            INTRO_OPT_EVENT_OS_CRASH    | \
                                            INTRO_OPT_EVENT_PROCESS_CRASH)

#define INTRO_OPT_DYNAMIC_OPTIONS_MASK      (0xffffffffffffffff)

#define INTRO_OPT_DEFAULT_OPTIONS           (INTRO_OPT_ENABLE_KM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_UM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_AV_PROTECTION         |\
                                             INTRO_OPT_ENABLE_XEN_PROTECTION        |\
                                             INTRO_OPT_ENABLE_CR_PROTECTION         |\
                                             INTRO_OPT_ENABLE_MSR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_DTR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_KM_BETA_DETECTIONS    |\
                                             INTRO_OPT_ENABLE_INTEGRITY_CHECKS      |\
                                             INTRO_OPT_ENABLE_FULL_PATH             |\
                                             INTRO_OPT_IN_GUEST_PT_FILTER)

#define INTRO_OPT_DEFAULT_XEN_OPTIONS       (INTRO_OPT_ENABLE_KM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_UM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_AV_PROTECTION         |\
                                             INTRO_OPT_ENABLE_XEN_PROTECTION        |\
                                             INTRO_OPT_ENABLE_CR_PROTECTION         |\
                                             INTRO_OPT_ENABLE_MSR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_DTR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_INTEGRITY_CHECKS      |\
                                             INTRO_OPT_ENABLE_FULL_PATH             |\
                                             INTRO_OPT_ENABLE_MANUAL_AGENT_INJ      |\
                                             INTRO_OPT_ENABLE_MISC_EVENTS           |\
                                             INTRO_OPT_IN_GUEST_PT_FILTER)

#define INTRO_OPT_ONLY_KERNEL               (INTRO_OPT_ENABLE_KM_PROTECTION         |\
                                             INTRO_OPT_ENABLE_AV_PROTECTION         |\
                                             INTRO_OPT_ENABLE_XEN_PROTECTION        |\
                                             INTRO_OPT_ENABLE_MSR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_DTR_PROTECTION        |\
                                             INTRO_OPT_ENABLE_KM_BETA_DETECTIONS    |\
                                             INTRO_OPT_ENABLE_INTEGRITY_CHECKS      |\
                                             INTRO_OPT_ENABLE_FULL_PATH             |\
                                             INTRO_OPT_IN_GUEST_PT_FILTER)

#define POLICY_KM_BETA_FLAGS                                                                                        \
    (INTRO_OPT_PROT_KM_NT | INTRO_OPT_PROT_KM_HAL | INTRO_OPT_PROT_KM_SSDT | INTRO_OPT_PROT_KM_IDT                  \
     | INTRO_OPT_PROT_KM_HAL_DISP_TABLE | INTRO_OPT_PROT_KM_SYSTEM_CR3 | INTRO_OPT_PROT_KM_TOKEN_PTR                \
     | INTRO_OPT_PROT_KM_NT_DRIVERS | INTRO_OPT_PROT_KM_AV_DRIVERS | INTRO_OPT_PROT_KM_XEN_DRIVERS                  \
     | INTRO_OPT_PROT_KM_DRVOBJ | INTRO_OPT_PROT_KM_CR4 | INTRO_OPT_PROT_KM_MSR_SYSCALL | INTRO_OPT_PROT_KM_IDTR    \
     | INTRO_OPT_PROT_KM_HAL_HEAP_EXEC | INTRO_OPT_PROT_KM_HAL_INT_CTRL | INTRO_OPT_PROT_KM_SELF_MAP_ENTRY          \
     | INTRO_OPT_PROT_KM_GDTR | INTRO_OPT_PROT_KM_LX | INTRO_OPT_PROT_KM_VDSO | INTRO_OPT_PROT_KM_LX_MODULES        \
     | INTRO_OPT_PROT_KM_CREDS | INTRO_OPT_PROT_KM_TOKEN_PRIVS | INTRO_OPT_PROT_KM_SUD_EXEC                         \
     | INTRO_OPT_PROT_KM_LOGGER_CONTEXT | INTRO_OPT_PROT_KM_NT_EAT_READS | INTRO_OPT_PROT_KM_HAL_PERF_CNT           \
     | INTRO_OPT_PROT_KM_SD_ACL | INTRO_OPT_PROT_KM_SUD_INTEGRITY | INTRO_OPT_PROT_KM_INTERRUPT_OBJ)




#define ALERT_FLAG_BETA                 0x0000000000000001  
#define ALERT_FLAG_ANTIVIRUS            0x0000000000000002  
#define ALERT_FLAG_SYSPROC              0x0000000000000004  
#define ALERT_FLAG_NOT_RING0            0x0000000000000008  
#define ALERT_FLAG_ASYNC                0x0000000000000010  
#define ALERT_FLAG_LINUX                0x0000000000000020  
#define ALERT_FLAG_FROM_ENGINES         0x0000000000000040

#define ALERT_FLAG_FEEDBACK_ONLY        0x0000000000000080
#define ALERT_FLAG_DEP_VIOLATION        0x0000000000000100  
#define ALERT_FLAG_PROTECTED_VIEW       0x0000000000000200  
#define ALERT_FLAG_KM_UM                0x0000000000000400


//
// Misc size definitions.
//

#define ALERT_PATH_MAX_LEN              260u    
#define ALERT_IMAGE_NAME_LEN            16u     
#define ALERT_MAX_MESSAGE_SIZE          256u
#define ALERT_MAX_INSTRUX_LEN           128u    
#define ALERT_MAX_SECTION_NAME_LEN      8u
#define ALERT_MAX_FUNCTIONS             4u      
#define ALERT_MAX_FUNCTION_NAME_LEN     32u     
#define ALERT_MAX_INJ_DUMP_SIZE         512u    
#define ALERT_MAX_CODEBLOCKS            64u     
#define ALERT_CMDLINE_MAX_LEN           512u    
#define ALERT_EXCEPTION_SIZE            255u    
#define ALERT_MAX_DETECTION_NAME        128u
#define ALERT_MAX_ENGINES_VERSION       32u     

#define INTRO_SECURITY_DESCRIPTOR_SIZE    1024u

#define VICTIM_PROCESS_CREDENTIALS          u"Process Credentials"
#define VICTIM_DRIVER_OBJECT                u"Driver Object"
#define VICTIM_HAL_DISPATCH_TABLE           u"HalDispatchTable"
#define VICTIM_IDT                          u"IDT"
#define VICTIM_CIRCULAR_KERNEL_CTX_LOGGER   u"Circular Kernel Context Logger"
#define VICTIM_PROCESS_TOKEN                u"Process Token"
#define VICTIM_TOKEN_PRIVILEGES             u"Token privileges"
#define VICTIM_HAL_PERFORMANCE_COUNTER      u"HalPerformanceCounter"
#define VICTIM_PROCESS_SECURITY_DESCRIPTOR  u"Security Descriptor"
#define VICTIM_PROCESS_ACL                  u"Access Control List"
#define VICTIM_INTERRUPT_OBJECT             u"Interrupt Object"

typedef enum
{
    INTRO_EPT_NONE = 0, 
    INTRO_EPT_READ,     
    INTRO_EPT_WRITE,    
    INTRO_EPT_EXECUTE,  
} INTRO_EPT_ACCESS_TYPE;


typedef enum
{
    INTRO_MSR_READ = 1, 
    INTRO_MSR_WRITE = 2,
} INTRO_MSR_ACCESS_TYPE;


#define INTRO_VIOLATION_VERSION         1


typedef struct _INTRO_TOKEN_PRIVILEGES
{
    QWORD           Present;            
    QWORD           Enabled;            
    QWORD           EnabledByDefault;   
} INTRO_TOKEN_PRIVILEGES, *PINTRO_TOKEN_PRIVILEGES;


typedef struct _INTRO_ACL
{
    BYTE AclRevision;
    WORD AclSize;
    WORD AceCount;
} INTRO_ACL, *PINTRO_ACL;


typedef struct _INTRO_WIN_SID
{
    BYTE            Revision;               
    BYTE            SubAuthorityCount;      
    BYTE            IdentifierAuthority[6]; 

    DWORD           SubAuthority[1];        
} INTRO_WIN_SID, *PINTRO_WIN_SID;


#define INTRO_WIN_SID_MAX_SUB_AUTHORITIES       15

#define INTRO_WIN_SID_MAX_SIZE  \
      (sizeof(INTRO_WIN_SID) - sizeof(DWORD) + (INTRO_WIN_SID_MAX_SUB_AUTHORITIES * sizeof(DWORD)))

typedef struct _INTRO_SID_ATTRIBUTES
{
    BOOLEAN                 IsRestricted;
    DWORD                   Attributes;
    union
    {
        INTRO_WIN_SID       Sid;                                
        BYTE                RawBuffer[INTRO_WIN_SID_MAX_SIZE];  
    };
} INTRO_SID_ATTRIBUTES, *PINTRO_SID_ATTRIBUTES;

#define INTRO_SIDS_MAX_COUNT                4

typedef struct _INTRO_WIN_TOKEN
{
    BOOLEAN                 ImpersonationToken;
    INTRO_TOKEN_PRIVILEGES  Privileges;
    BYTE                    _padding[3];
    DWORD                   SidCount;
    INTRO_SID_ATTRIBUTES    SidsAndAttributes[INTRO_SIDS_MAX_COUNT];

    DWORD                   RestrictedSidCount;
    INTRO_SID_ATTRIBUTES    RestrictedSids[INTRO_SIDS_MAX_COUNT];

    BOOLEAN                 SidsBufferTooSmall;
    BOOLEAN                 RestrictedSIdsBufferTooSmall;
    BOOLEAN                 Valid;
} INTRO_WIN_TOKEN, *PINTRO_WIN_TOKEN;


typedef union _INTRO_TOKEN
{
    INTRO_WIN_TOKEN         WindowsToken;   
} INTRO_TOKEN, *PINTRO_TOKEN;

typedef struct _INTRO_PROCESS
{
    BOOLEAN     Valid;
    DWORD       Pid;                                
    QWORD       Cr3;                                
    QWORD       CreationTime;
    CHAR        ImageName[ALERT_IMAGE_NAME_LEN];    
    WCHAR       Path[ALERT_PATH_MAX_LEN];           
    INTRO_TOKEN SecurityInfo;
    CHAR        CmdLine[ALERT_CMDLINE_MAX_LEN];     
    QWORD       Context;                            
    BOOLEAN     Wow64;                              
} INTRO_PROCESS, *PINTRO_PROCESS;


typedef struct _INTRO_MODULE
{
    BOOLEAN     Valid;
    QWORD       Base;                       
    DWORD       Size;                       
    DWORD       TimeDateStamp;
    WCHAR       Name[ALERT_PATH_MAX_LEN];   
    WCHAR       Path[ALERT_PATH_MAX_LEN];   
} INTRO_MODULE, *PINTRO_MODULE;


typedef struct _INTRO_DRVOBJ
{
    BOOLEAN     Valid;
    QWORD       Address;
    WCHAR       Name[ALERT_PATH_MAX_LEN];       
    QWORD       Owner;                          
} INTRO_DRVOBJ, *PINTRO_DRVOBJ;


typedef struct _INTRO_CPUCTX
{
    BOOLEAN     Valid;
    DWORD       Cpu;                                
    QWORD       Rip;
    QWORD       Cr3;
    CHAR        Instruction[ALERT_MAX_INSTRUX_LEN]; 
} INTRO_CPUCTX, *PINTRO_CPUCTX;


typedef struct _INTRO_WRITE_INFO
{
    QWORD       OldValue[8];                        
    QWORD       NewValue[8];                        
    DWORD       Size;                               
} INTRO_WRITE_INFO, *PINTRO_WRITE_INFO;


typedef struct _INTRO_READ_INFO
{
    QWORD       Value[8];                           
    DWORD       Size;                               
} INTRO_READ_INFO, *PINTRO_READ_INFO;


typedef struct _INTRO_EXEC_INFO
{
    QWORD       Rsp;        
    QWORD       StackBase;  
    QWORD       StackLimit; 
    DWORD       Length;     
} INTRO_EXEC_INFO, *PINTRO_EXEC_INFO;


typedef struct _INTRO_SEC_DESC_INFO
{
    QWORD       OldAddress;         
    QWORD       NewAddress;         
    DWORD       NewSecDescHash;

    BYTE        OldSecDesc[INTRO_SECURITY_DESCRIPTOR_SIZE];
    DWORD       OldSecDescSize;

    BYTE        NewSecDesc[INTRO_SECURITY_DESCRIPTOR_SIZE];
    DWORD       NewSecDescSize;
} INTRO_SEC_DESC_INFO, *PINTRO_SEC_DESC_INFO;

typedef struct _INTRO_CODEBLOCKS
{
    BOOLEAN     Valid;          

    QWORD       StartAddress;   
    QWORD       Rip;            
    DWORD       RipCbIndex;     
    DWORD       Count;          

    struct _INTRO_CODE_BLOCK
    {
        WORD        Offset;
        BYTE        Pivot;      
        DWORD       Value;      
    } CodeBlocks[ALERT_MAX_CODEBLOCKS];

} INTRO_CODEBLOCKS, *PINTRO_CODEBLOCKS;


typedef struct _INTRO_VERSION_INFO
{
    WORD                ExceptionMajor;     
    WORD                ExceptionMinor;     
    DWORD               ExceptionBuild;     

    WORD                IntroMajor;         
    WORD                IntroMinor;         
    WORD                IntroRevision;      
    DWORD               IntroBuildNumber;   

    DWORD               CamiMajor;          
    DWORD               CamiMinor;          
    DWORD               CamiBuildNumber;    

    QWORD               OsVer;              
} INTRO_VERSION_INFO, *PINTRO_VERSION_INFO;


typedef struct _INTRO_GPRS
{
    QWORD RegRax;
    QWORD RegRcx;
    QWORD RegRdx;
    QWORD RegRbx;
    QWORD RegRsp;
    QWORD RegRbp;
    QWORD RegRsi;
    QWORD RegRdi;
    QWORD RegR8;
    QWORD RegR9;
    QWORD RegR10;
    QWORD RegR11;
    QWORD RegR12;
    QWORD RegR13;
    QWORD RegR14;
    QWORD RegR15;
    QWORD RegCr2;
    QWORD RegFlags;
    QWORD RegDr7;
    QWORD RegRip;
} INTRO_GPRS, *PINTRO_GPRS;


typedef struct _INTRO_EXEC_CONTEXT
{
    DWORD       CsType;             
    INTRO_GPRS  Registers;          
    BYTE        RipCode[0x1000];
} INTRO_EXEC_CONTEXT, *PINTRO_EXEC_CONTEXT;


typedef struct _INTRO_EXEC_DATA
{
    INTRO_PROCESS           Process;        
    INTRO_EXEC_CONTEXT      ExecContext;    
    INTRO_EXEC_INFO         StackInfo;      
    BOOLEAN                 Code64;         
} INTRO_EXEC_DATA, *PINTRO_EXEC_DATA;

typedef enum _MITRE_ID
{
    idCredDump = 1003,                  
    idRootkit = 1014,                   
    idSoftwarePacking = 1045,           
    idProcInject = 1055,                
    idScripting = 1064,                 
    idExploitPrivEsc = 1068,            
    idPowerShell = 1086,                
    idProcHollowing = 1093,             
    idExecApi = 1106,                   
    idExecModLoad = 1129,               
    idAccessToken = 1134,               
    idHooking = 1179,                   
    idEWMI = 1181,                      
    idProcDoppelganging = 1186,         
    idExploitClientExec = 1203,         
    idTrustedDevUtil = 1127,            
    idExploitRemote = 1210,             
    idKernModExt = 1215                 
} MITRE_ID;


#pragma pack(push, 1)

typedef struct _INTRO_ALERT_EXCEPTION_HEADER
{
    WORD        Version;        
    QWORD       ViolationFlags; 
    BOOLEAN     Valid;          

    BYTE        _Reserved1;     
    DWORD       _Reserved2;     
    DWORD       _Reserved3;     
} INTRO_ALERT_EXCEPTION_HEADER;

#pragma pack(pop)


typedef struct _INTRO_VIOLATION_HEADER
{
    DWORD               ViolationVersion;   
    INTRO_VERSION_INFO  VerInfo;
    INTRO_ACTION        Action;             
    INTRO_ACTION_REASON Reason;             
    INTRO_CPUCTX        CpuContext;         
    INTRO_PROCESS       CurrentProcess;     
    QWORD               Flags;              
    MITRE_ID            MitreID;            

    union
    {
        BYTE                            Exception[ALERT_EXCEPTION_SIZE];
        INTRO_ALERT_EXCEPTION_HEADER    ExHeader;   
    };
} INTRO_VIOLATION_HEADER, *PINTRO_VIOLATION_HEADER;


typedef struct _EVENT_EPT_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;         

    struct
    {
        INTRO_MODULE        Module;         
        INTRO_MODULE        ReturnModule;   
        INTRO_PROCESS       Process;        

        struct
        {
            BOOLEAN User : 1;               
            BOOLEAN Kernel : 1;             
        } Injection;
    } Originator;

    struct
    {
        INTRO_OBJECT_TYPE   Type;
        union
        {
            INTRO_MODULE    Module;
            INTRO_DRVOBJ    DriverObject;
        };
        BYTE                IdtEntry;
    } Victim;

    union
    {
        INTRO_WRITE_INFO    WriteInfo;

        INTRO_READ_INFO    ReadInfo;

        INTRO_EXEC_INFO     ExecInfo;
    };

    INTRO_CODEBLOCKS        CodeBlocks;     

    BYTE                    Violation;      

    QWORD                   HookStartVirtual;
    QWORD                   HookStartPhysical;

    QWORD                   VirtualPage;    
    QWORD                   PhysicalPage;   
    DWORD                   Offset;         

    QWORD                   ZoneTypes;      

    CHAR                    RipSectionName[ALERT_MAX_SECTION_NAME_LEN];

    QWORD                   ReturnRip;
    CHAR                    ReturnRipSectionName[ALERT_MAX_SECTION_NAME_LEN];

    CHAR                    ModifiedSectionName[ALERT_MAX_SECTION_NAME_LEN];
    CHAR                    FunctionName[ALERT_MAX_FUNCTION_NAME_LEN];
    DWORD                   FunctionNameHash;
    DWORD                   Delta;

    struct
    {
        char                Name[ALERT_MAX_FUNCTIONS][ALERT_MAX_FUNCTION_NAME_LEN];
        DWORD               Hash[ALERT_MAX_FUNCTIONS];
        DWORD               Delta;
    } Export;

    INTRO_EXEC_CONTEXT      ExecContext;
} EVENT_EPT_VIOLATION, *PEVENT_EPT_VIOLATION;


typedef struct _EVENT_MSR_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;         

    struct
    {
        INTRO_MODULE        Module;         
        INTRO_MODULE        ReturnModule;   
    } Originator;

    union
    {
        DWORD               Msr;            
    } Victim;

    INTRO_WRITE_INFO        WriteInfo;

    INTRO_CODEBLOCKS        CodeBlocks;     

    INTRO_EXEC_CONTEXT      ExecContext;    
} EVENT_MSR_VIOLATION, *PEVENT_MSR_VIOLATION;


typedef struct _EVENT_CR_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;         

    struct
    {
        INTRO_MODULE        Module;         
        INTRO_MODULE        ReturnModule;   
    } Originator;

    union
    {
        DWORD               Cr;             
    } Victim;


    INTRO_WRITE_INFO        WriteInfo;

    INTRO_CODEBLOCKS        CodeBlocks;     

    INTRO_EXEC_CONTEXT      ExecContext;    

} EVENT_CR_VIOLATION, *PEVENT_CR_VIOLATION;


typedef struct _EVENT_XCR_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;         

    struct
    {
        INTRO_MODULE        Module;         
        INTRO_MODULE        ReturnModule;   
    } Originator;

    union
    {
        DWORD               Xcr;            
    } Victim;

    INTRO_WRITE_INFO        WriteInfo;

    INTRO_CODEBLOCKS        CodeBlocks;     

    INTRO_EXEC_CONTEXT      ExecContext;    
} EVENT_XCR_VIOLATION, *PEVENT_XCR_VIOLATION;


typedef enum _MEMCOPY_VIOLATION_TYPE
{
    memCopyViolationWrite = 0,

    memCopyViolationRead,

    memCopyViolationSetContextThread,

    memCopyViolationQueueApcThread,

    memCopyViolationInstrument,

} MEMCOPY_VIOLATION_TYPE;


// another process.
typedef struct _EVENT_MEMCOPY_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;     

    struct
    {
        INTRO_PROCESS       Process;    
    } Originator;

    struct
    {
        INTRO_PROCESS       Process;
        INTRO_MODULE        Module;
    } Victim;

    QWORD                   SourceVirtualAddress;

    QWORD                   DestinationVirtualAddress;

    DWORD                   CopySize;

    MEMCOPY_VIOLATION_TYPE  ViolationType;

    BOOLEAN                 DumpValid;

    BYTE                    RawDump[ALERT_MAX_INJ_DUMP_SIZE];

    CHAR                    FunctionName[ALERT_MAX_FUNCTION_NAME_LEN];

    DWORD                   FunctionNameHash;

    DWORD                   Delta;

    struct
    {
        char                Name[ALERT_MAX_FUNCTIONS][ALERT_MAX_FUNCTION_NAME_LEN];

        DWORD               Hash[ALERT_MAX_FUNCTIONS];

        DWORD               Delta;
    } Export;
} EVENT_MEMCOPY_VIOLATION, *PEVENT_MEMCOPY_VIOLATION;

typedef enum _TRANS_VIOLATION_TYPE
{
    transViolationPageHash,
    transViolationProcessCr3,   
    transViolationSelfMap,      
    transViolationWatchdog,
    transViolationVeAgent       
} TRANS_VIOLATION_TYPE;

typedef struct _EVENT_TRANSLATION_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;         

    struct
    {
        INTRO_MODULE        Module;         
        INTRO_MODULE        ReturnModule;   
    } Originator;

    struct
    {
        QWORD               VirtualAddress; 
    } Victim;

    INTRO_WRITE_INFO        WriteInfo;

    TRANS_VIOLATION_TYPE    ViolationType;  
} EVENT_TRANSLATION_VIOLATION, *PEVENT_TRANSLATION_VIOLATION;

typedef struct _EVENT_INTEGRITY_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;         

    struct
    {
        INTRO_MODULE        Module;         
        INTRO_PROCESS       Process;        
    } Originator;

    struct
    {
        INTRO_MODULE        Module;         
    } Return;

    struct
    {
        INTRO_OBJECT_TYPE   Type;           
        WCHAR               Name[ALERT_PATH_MAX_LEN];
        union
        {
            INTRO_PROCESS   Process;
            INTRO_DRVOBJ    DriverObject;
            BYTE            IdtEntry;
        };
    } Victim;

    union
    {
        INTRO_WRITE_INFO        WriteInfo;
        INTRO_SEC_DESC_INFO     SecDescWriteInfo;
    };

    QWORD                   BaseAddress;
    QWORD                   VirtualAddress;
    DWORD                   Size;
} EVENT_INTEGRITY_VIOLATION, *PEVENT_INTEGRITY_VIOLATION;


typedef struct _EVENT_DTR_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;         

    struct
    {
        INTRO_MODULE        Module;         
        INTRO_MODULE        ReturnModule;   
    } Originator;

    struct
    {
        INTRO_OBJECT_TYPE   Type;           
    } Victim;

    INTRO_WRITE_INFO        WriteInfo;      

    INTRO_CODEBLOCKS        CodeBlocks;     

    INTRO_EXEC_CONTEXT      ExecContext;    
} EVENT_DTR_VIOLATION, *PEVENT_DTR_VIOLATION;


typedef enum
{
    INT_PC_VIOLATION_NORMAL_PROCESS_CREATION = 0,

    INT_PC_VIOLATION_DPI_DEBUG_FLAG = (1 << 0),

    INT_PC_VIOLATION_DPI_PIVOTED_STACK = (1 << 1),

    INT_PC_VIOLATION_DPI_STOLEN_TOKEN = (1 << 2),

    INT_PC_VIOLATION_DPI_HEAP_SPRAY = (1 << 3),

    INT_PC_VIOLATION_DPI_TOKEN_PRIVS = (1 << 4),

    INT_PC_VIOLATION_DPI_THREAD_START = (1 << 5),

    INT_PC_VIOLATION_DPI_SEC_DESC = (1 << 6),

    INT_PC_VIOLATION_DPI_ACL_EDIT = (1 << 7),
} INTRO_PC_VIOLATION_TYPE;


typedef union _INTRO_DPI_EXTRA_INFO
{
    struct
    {
        INTRO_PROCESS Debugger;             
    } DpiDebugFlag;

    struct
    {
        QWORD CurrentStack;                 
        QWORD StackBase;                    
        QWORD StackLimit;                   
        QWORD Wow64CurrentStack;            
        QWORD Wow64StackBase;               
        QWORD Wow64StackLimit;              
        BYTE TrapFrameContent[512];         
    } DpiPivotedStack;

    struct
    {
        INTRO_PROCESS StolenFrom;           
    } DpiStolenToken;

    struct
    {
        struct
        {
            DWORD Mapped : 1;               
            DWORD Detected : 1;
            DWORD HeapValCount : 11;
            DWORD Offset : 12;
            DWORD Executable : 1;           
            DWORD Reserved : 7;             
        } HeapPages[0xF];

        QWORD ShellcodeFlags;               

        BYTE DetectedPage[0x1000];          
        BYTE MaxHeapValPageContent[0x1000]; 
    } DpiHeapSpray;

    struct
    {
        QWORD OldEnabled;                   
        QWORD NewEnabled;
        QWORD OldPresent;                   
        QWORD NewPresent;
    } DpiTokenPrivs;

    struct
    {
        QWORD ShellcodeFlags;               
        QWORD StartAddress;                 
        BYTE StartPage[0x1000];             
    } DpiThreadStart;

    struct
    {
        INTRO_PROCESS SecDescStolenFrom;

        QWORD OldPointerValue;              
        QWORD NewPointerValue;              

        INTRO_ACL OldSacl;                  
        INTRO_ACL OldDacl;                  

        INTRO_ACL NewSacl;                  
        INTRO_ACL NewDacl;                  
    } DpiSecDescAcl;
} INTRO_DPI_EXTRA_INFO, *PINTRO_DPI_EXTRA_INFO;


typedef struct _EVENT_PROCESS_CREATION_VIOLATION
{
    INTRO_VIOLATION_HEADER          Header;     

    INTRO_PROCESS                   Victim;

    INTRO_PROCESS                   Originator;

    INTRO_PC_VIOLATION_TYPE         PcType;

    INTRO_DPI_EXTRA_INFO            DpiExtraInfo;
} EVENT_PROCESS_CREATION_VIOLATION, *PEVENT_PROCESS_CREATION_VIOLATION;


typedef struct _EVENT_MODULE_LOAD_VIOLATION
{
    INTRO_VIOLATION_HEADER  Header;     

    INTRO_PROCESS           Victim;     

    struct
    {
        INTRO_MODULE        Module;         
        INTRO_MODULE        ReturnModule;   
    } Originator;

    QWORD                   ReturnRip;

    CHAR                    ReturnRipSectionName[ALERT_MAX_SECTION_NAME_LEN];

    CHAR                    RipSectionName[ALERT_MAX_SECTION_NAME_LEN];
} EVENT_MODULE_LOAD_VIOLATION, *PEVENT_MODULE_LOAD_VIOLATION;

typedef struct _EVENT_ENGINES_DETECTION_VIOLATION
{
    INTRO_VIOLATION_HEADER      Header; 
    INTRO_ENG_NOTIF_TYPE        Type;   

    CHAR                        DetectionName[ALERT_MAX_DETECTION_NAME];
    CHAR                        EnginesVersion[ALERT_MAX_ENGINES_VERSION];

    union
    {
        INTRO_EXEC_DATA ExecViolation;

        struct
        {
            INTRO_PROCESS           Victim;
            INTRO_PROCESS           Originator;
        } CmdLineViolation;
    };
} EVENT_ENGINES_DETECTION_VIOLATION, *PEVENT_ENGINES_DETECTION_VIOLATION;


typedef struct _EVENT_INTROSPECTION_MESSAGE
{
    CHAR                    Message[ALERT_MAX_MESSAGE_SIZE];    
} EVENT_INTROSPECTION_MESSAGE, *PEVENT_INTROSPECTION_MESSAGE;


typedef struct _EVENT_PROCESS_EVENT
{
    BOOLEAN                 Created;
    BOOLEAN                 Protected;

    BOOLEAN                 Crashed;
    BOOLEAN                 Reserved;

    DWORD                   ExitStatus;

    INTRO_PROCESS           CurrentProcess;

    INTRO_PROCESS           Child;
    INTRO_PROCESS           Parent;
} EVENT_PROCESS_EVENT, *PEVENT_PROCESS_EVENT;


typedef struct _EVENT_MODULE_EVENT
{
    BOOLEAN                 Loaded;
    BOOLEAN                 Protected;
    BOOLEAN                 UserMode;

    INTRO_PROCESS           CurrentProcess;

    INTRO_MODULE            Module;
} EVENT_MODULE_EVENT, *PEVENT_MODULE_EVENT;


typedef struct _EVENT_CRASH_EVENT
{
    QWORD                   Reason; 
    QWORD                   Param1; 
    QWORD                   Param2; 
    QWORD                   Param3; 
    QWORD                   Param4; 

    INTRO_PROCESS           CurrentProcess; 
} EVENT_CRASH_EVENT, *PEVENT_CRASH_EVENT;


typedef struct _EVENT_EXCEPTION_EVENT
{
    QWORD                   ExceptionCode;
    QWORD                   Rip;
    BOOLEAN                 Continuable;

    INTRO_PROCESS           CurrentProcess;
} EVENT_EXCEPTION_EVENT, *PEVENT_EXCEPTION_EVENT;


typedef struct _EVENT_CONNECTION_EVENT
{
    INTRO_NET_AF            Family;     
    INTRO_NET_STATE         State;      

    union
    {
        BYTE                Ipv6[16];   
        DWORD               Ipv4;       
    } LocalAddress;

    union
    {
        BYTE                Ipv6[16];   
        DWORD               Ipv4;       
    } RemoteAddress;

    WORD                    LocalPort;  
    WORD                    RemotePort; 

    INTRO_PROCESS           Owner;      
} EVENT_CONNECTION_EVENT, *PEVENT_CONNECTION_EVENT;


//
// =====================================================================================================================
//


typedef enum
{
    introGuestUnknown,  
    introGuestWindows,  
    introGuestLinux     
} INTRO_GUEST_TYPE;

// Engines structures

typedef struct _ENG_NOTIFICATION_HEADER
{
    INTRO_ACTION            RequestedAction;
    INTRO_ENG_NOTIF_TYPE    Type;
    INTRO_GUEST_TYPE        OsType;
    CHAR                    DetectionName[ALERT_MAX_DETECTION_NAME];
    CHAR                    EnginesVersion[ALERT_MAX_ENGINES_VERSION];
} ENG_NOTIFICATION_HEADER, *PENG_NOTIFICATION_HEADER;

typedef struct _ENG_NOTIFICATION_CODE_EXEC
{
    ENG_NOTIFICATION_HEADER Header; 
    INTRO_EXEC_DATA ExecutionData;  
} ENG_NOTIFICATION_CODE_EXEC, *PENG_NOTIFICATION_CODE_EXEC;

typedef struct _ENG_NOTIFICATION_CMD_LINE
{
    ENG_NOTIFICATION_HEADER Header;         
    INTRO_PROCESS           Parent;         
    INTRO_PROCESS           Child;          
    BYTE *                  CmdLine;        
    DWORD                   CmdLineSize;    
} ENG_NOTIFICATION_CMD_LINE, *PENG_NOTIFICATION_CMD_LINE;

//
// =====================================================================================================================
//


typedef enum
{
    agentInjected = 0,  
    agentInitialized,   
    agentStarted,       
    agentTerminated,    
    agentMessage,       
    agentError,         

    agentInvalid = -1   
} AGENT_EVENT_TYPE;


// Remediation tool hypercall (x64/x86):
//
// RAX/EAX = 34
// RDI/EBX = 24
// RSI/ECX = 0
// RDX/EDX = AGENT_HCALL_REM_TOOL
// RBX/ESI = pointer to a remediation structure
#define AGENT_HCALL_REM_TOOL        100     

#define AGENT_HCALL_GATHER_TOOL     500     

#define AGENT_HCALL_KILLER_TOOL     600     

#define AGENT_HCALL_INTERNAL        753200  


//
// =====================================================================================================================
//

typedef enum
{
    remEventNone = 0,       
    remEventStart,          
    remEventDetection,      
    remEventDisinfection,   
    remEventProgress,       
    remEventReboot,         
    remEventFinish          
} AGENT_REM_EVENT_TYPE;

#define REM_MAX_OBJECT_PATH_LEN     512
#define REM_MAX_DETECTION_LEN       128

#define REM_EVENT_VERSION           0x00010000
#define REM_EVENT_SIZE              sizeof(AGENT_REM_EVENT)


typedef struct _AGENT_REM_EVENT_HEADER
{
    DWORD                   Version;    
    DWORD                   Size;       
    DWORD                   Reserved;   
    AGENT_REM_EVENT_TYPE    EventType;  
} AGENT_REM_EVENT_HEADER, *PAGENT_REM_EVENT_HEADER;

typedef struct _AGENT_REM_EVENT
{
    AGENT_REM_EVENT_HEADER Header;  

    union
    {
        struct
        {
            DWORD       ScanStatus; 
        } StartEvent;

        struct
        {
            DWORD       ScanResult;     
        } FinishEvent;

        struct
        {
            DWORD       Progress;       
        } ProgressEvent;

        struct
        {
            BOOLEAN     RebootNeeded;   
        } RebootEvent;

        struct
        {
            WCHAR       ObjectPath[REM_MAX_OBJECT_PATH_LEN];
            WCHAR       Detection[REM_MAX_DETECTION_LEN];
            DWORD       DetectionFlag;
            DWORD       ActionResult;
        } DetectionEvent;

        struct
        {
            WCHAR       ObjectPath[REM_MAX_OBJECT_PATH_LEN];
            WCHAR       Detection[REM_MAX_DETECTION_LEN];
            DWORD       DetectionFlag;
            DWORD       ActionResult;
        } DisinfectionEvent;
    };
} AGENT_REM_EVENT, *PAGENT_REM_EVENT;


//
// =====================================================================================================================
//

typedef enum
{
    lgtEventNone = 0,   
    lgtEventError,      
    lgtEventData        
} AGENT_LGT_EVENT_TYPE;

#define LGT_MAX_DATA_SIZE           4096

#define LGT_EVENT_VERSION           0x00010000
#define LGT_EVENT_SIZE              sizeof(AGENT_LGT_EVENT)

typedef struct _AGENT_LGT_EVENT_HEADER
{
    DWORD               Version;    
    DWORD               Size;       
    DWORD               Reserved1;  
    DWORD               EventType;  
} AGENT_LGT_EVENT_HEADER, *PAGENT_LGT_EVENT_HEADER;

typedef struct _AGENT_LGT_EVENT
{
    AGENT_LGT_EVENT_HEADER  Header; 

    union
    {
        struct
        {
            WCHAR                   FileName[REM_MAX_OBJECT_PATH_LEN];
            DWORD                   DataSize;
            BYTE                    Data[LGT_MAX_DATA_SIZE];
        } DataEvent;

        struct
        {
            DWORD                   ErrorCode;
        } ErrorEvent;
    };
} AGENT_LGT_EVENT, *PAGENT_LGT_EVENT;


//
// =====================================================================================================================
//

typedef enum
{
    INTRO_AGENT_TAG_DUMMY_TOOL  = 0,

    INTRO_AGENT_TAG_REMEDIATION_TOOL = 1,

    INTRO_AGENT_TAG_VISIBILITY_TOOL = 2,

    INTRO_AGENT_TAG_REMEDIATION_TOOL_LINUX = 3,

    INTRO_AGENT_TAG_LOG_GATHER_TOOL = 4,

    INTRO_AGENT_TAG_AGENT_KILLER_TOOL = 5,

    INTRO_AGENT_TAG_VE_DRIVER = 10,

    INTRO_AGENT_TAG_PT_DRIVER = 11,

    INTRO_AGENT_TAG_CUSTOM_TOOL = 100
} INTRO_DEP_AG_TAGS;

typedef struct _EVENT_AGENT_EVENT
{
    AGENT_EVENT_TYPE    Event;      
    DWORD               AgentTag;   
    DWORD               ErrorCode;  

    INTRO_PROCESS       CurrentProcess;

    union
    {
        AGENT_REM_EVENT RemediationEvent;
        AGENT_LGT_EVENT LogGatherEvent;
    };
} EVENT_AGENT_EVENT, *PEVENT_AGENT_EVENT;


typedef struct _GUEST_INFO
{
    INTRO_GUEST_TYPE    Type;           
    QWORD               BuildNumber;    
    BOOLEAN             Guest64;

    DWORD               OsVersion;      
    QWORD               StartupTime;

    QWORD               _Reserved[4];
} GUEST_INFO, *PGUEST_INFO;

typedef union _INT_VERSION_INFO
{
    struct
    {
        WORD        Build;      
        WORD        Revision;   
        WORD        Minor;      
        WORD        Major;      
    } VersionInfo;

    QWORD           Raw;        
} INT_VERSION_INFO, *PINT_VERSION_INFO;

typedef union _INTRO_ERROR_CONTEXT
{
    struct
    {
        INTRO_PROCESS   Process;    
        DWORD           Count;      
    } ProcessProtection;
} INTRO_ERROR_CONTEXT, *PINTRO_ERROR_CONTEXT;

typedef enum
{
    intErrNone = 0,                         
    intErrGuestNotIdentified,               
    intErrGuestNotSupported,                
    intErrGuestKernelNotFound,              
    intErrGuestApiNotFound,                 
    intErrGuestExportNotFound,              
    intErrGuestStructureNotFound,           
    intErrUpdateFileNotSupported,           
    
    intErrProcNotProtectedNoMemory,
    intErrProcNotProtectedInternalError,    
} INTRO_ERROR_STATE;

#pragma pack(pop)

#endif // _INTRO_TYPES_H_