introcore.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _INTROCORE_H_
#define _INTROCORE_H_

#include "introcrt.h"
#include "dumper.h"
#include "stats.h"

#define INTRO_MATCH_TRUNCATED 0x00000001

extern void *gLock;
extern void *gIntHandle;

extern INTRO_ERROR_CONTEXT gErrorContext;

extern const QWORD gByteMaskToBitMask[256];

extern BOOLEAN gAbortLoad;

extern QWORD gEventId;


#define RB_TREE_INIT(Name, Free, Compare)       \
    {                                           \
        &((Name).Nil),                          \
        {                                       \
            &((Name).Nil),                      \
            &((Name).Nil),                      \
            &((Name).Nil),                      \
            ncBlack                             \
        },                                      \
        Free,                                   \
        Compare,                                \
        0                                       \
    }


#ifdef USER_MODE
# define MIN_HEAP_SIZE_PERCENT       (20)
#else
# define MIN_HEAP_SIZE_PERCENT       (30)
#endif

#define MAX_TRANSLATION_DEPTH     5 

typedef enum
{
    PAGING_NONE = 0,        
    PAGING_NORMAL_MODE,     
    PAGING_PAE_MODE,        
    PAGING_4_LEVEL_MODE,    
    PAGING_5_LEVEL_MODE,    
} PAGING_MODE;


#define TRFLG_NONE                      0x00000000  
#define TRFLG_CACHING_ATTR              0x00000001  
#define TRFLG_NORMAL_MODE               0x10000000  
#define TRFLG_PAE_MODE                  0x20000000  
#define TRFLG_4_LEVEL_MODE              0x30000000  
#define TRFLG_5_LEVEL_MODE              0x40000000  
#define TRFLG_MODE_MASK                 0xF0000000  
#define TRFLG_ALL                       (TRFLG_CACHING_ATTR)    

#define TRFLG_PG_MODE                   (gGuest.LA57 ? TRFLG_5_LEVEL_MODE : \
                                         gGuest.Guest64 ? TRFLG_4_LEVEL_MODE : \
                                         gGuest.PaeEnabled ? TRFLG_PAE_MODE : \
                                                             TRFLG_NORMAL_MODE)


typedef struct _VA_TRANSLATION
{
    QWORD               VirtualAddress;
    QWORD               PhysicalAddress;
    QWORD               MappingsTrace[MAX_TRANSLATION_DEPTH];
    QWORD               MappingsEntries[MAX_TRANSLATION_DEPTH];
    QWORD               Flags;

    QWORD               PageSize;       
    QWORD               Cr3;            
    DWORD               MappingsCount;  
    BOOLEAN             Pointer64;      
    BOOLEAN             IsUser;
    BOOLEAN             IsWritable;
    BOOLEAN             IsExecutable;
    PAGING_MODE         PagingMode;
    BYTE                CachingAttribute;
} VA_TRANSLATION, *PVA_TRANSLATION;

void
IntPreinit(
    void
    );

INTSTATUS
IntInit(
    _Inout_ GLUE_IFACE *GlueInterface,
    _In_ UPPER_IFACE const *UpperInterface
    );

INTSTATUS
IntUninit(
    void
    );

INTSTATUS
IntVirtMemRead(
    _In_ QWORD Gva,
    _In_ DWORD Length,
    _In_opt_ QWORD Cr3,
    _Out_writes_bytes_(Length) void *Buffer,
    _Out_opt_ DWORD *RetLength
    );

INTSTATUS
IntVirtMemWrite(
    _In_ QWORD Gva,
    _In_ DWORD Length,
    _In_opt_ QWORD Cr3,
    _In_reads_bytes_(Length) void *Buffer
    );

INTSTATUS
IntKernVirtMemRead(
    _In_ QWORD KernelGva,
    _In_ DWORD Length,
    _Out_writes_bytes_(Length) void *Buffer,
    _Out_opt_ DWORD *RetLength
    );

INTSTATUS
IntKernVirtMemWrite(
    _In_ QWORD KernelGva,
    _In_ DWORD Length,
    _In_reads_bytes_(Length) void *Buffer
    );

INTSTATUS
IntVirtMemSet(
    _In_ QWORD VirtualAddress,
    _In_ DWORD Length,
    _In_opt_ QWORD Cr3,
    _In_ BYTE Value
    );

INTSTATUS
IntPhysicalMemRead(
    _In_ QWORD PhysicalAddress,
    _In_ DWORD Length,
    _Out_writes_bytes_(Length) void *Buffer,
    _Out_opt_ DWORD *RetLength
    );

INTSTATUS
IntPhysicalMemWrite(
    _In_ QWORD PhysicalAddress,
    _In_ DWORD Length,
    _In_reads_bytes_(Length) void *Buffer
    );

INTSTATUS
IntPhysicalMemReadAnySize(
    _In_ QWORD PhysicalAddress,
    _In_ DWORD Length,
    _Out_writes_bytes_(Length) void *Buffer,
    _Out_opt_ DWORD *RetLength
    );

INTSTATUS
IntPhysicalMemWriteAnySize(
    _In_ QWORD PhysicalAddress,
    _In_ DWORD Length,
    _In_reads_bytes_(Length) void *Buffer
    );

INTSTATUS
IntKernVirtMemFetchQword(
    _In_ QWORD GuestVirtualAddress,
    _Out_ QWORD *Data
    );

INTSTATUS
IntKernVirtMemFetchDword(
    _In_ QWORD GuestVirtualAddress,
    _Out_ DWORD *Data
    );

INTSTATUS
IntKernVirtMemFetchWordSize(
    _In_ QWORD GuestVirtualAddress,
    _Out_ void *Data
    );

INTSTATUS
IntVirtMemFetchQword(
    _In_ QWORD GuestVirtualAddress,
    _In_opt_ QWORD Cr3,
    _Out_ QWORD *Data
    );

INTSTATUS
IntVirtMemFetchDword(
    _In_ QWORD GuestVirtualAddress,
    _In_opt_ QWORD Cr3,
    _Out_ DWORD *Data
    );

INTSTATUS
IntVirtMemFetchWordSize(
    _In_ QWORD GuestVirtualAddress,
    _In_opt_ QWORD Cr3,
    _Out_ void *Data
    );

INTSTATUS
IntKernVirtMemPatchQword(
    _In_ QWORD GuestVirtualAddress,
    _In_ QWORD Data
    );

INTSTATUS
IntKernVirtMemPatchDword(
    _In_ QWORD GuestVirtualAddress,
    _In_ DWORD Data
    );

INTSTATUS
IntKernVirtMemPatchWordSize(
    _In_ QWORD GuestVirtualAddress,
    _In_ QWORD Data
    );

INTSTATUS
IntVirtMemPatchQword(
    _In_ QWORD GuestVirtualAddress,
    _In_opt_ QWORD Cr3,
    _In_ QWORD Data
    );

INTSTATUS
IntVirtMemPatchDword(
    _In_ QWORD GuestVirtualAddress,
    _In_opt_ QWORD Cr3,
    _In_ DWORD Data
    );

INTSTATUS
IntVirtMemPatchWordSize(
    _In_ QWORD GuestVirtualAddress,
    _In_opt_ QWORD Cr3,
    _In_ QWORD Data
    );

INTSTATUS
IntVirtMemFetchString(
    _In_ QWORD Gva,
    _In_ DWORD MaxLength,
    _In_opt_ QWORD Cr3,
    _Out_writes_z_(MaxLength) void *Buffer
    );

INTSTATUS
IntTranslateVirtualAddressEx(
    _In_ QWORD Gva,
    _In_ QWORD Cr3,
    _In_ DWORD Flags,
    _Out_ VA_TRANSLATION *Translation
    );

INTSTATUS
IntTranslateVirtualAddress(
    _In_ QWORD Gva,
    _In_opt_ QWORD Cr3,
    _Out_ QWORD *PhysicalAddress
    );

__must_check
INTSTATUS
IntVirtMemMap(
    _In_ QWORD Gva,
    _In_ DWORD Length,
    _In_opt_ QWORD Cr3,
    _In_ DWORD Flags,
    _Outptr_result_bytebuffer_(Length) void **HostPtr
    );

INTSTATUS
IntVirtMemUnmap(
    _Inout_ _At_(*HostPtr, _Post_null_) void **HostPtr
    );

INTSTATUS
IntInjectExceptionInGuest(
    _In_ BYTE Vector,
    _In_ QWORD Cr2,
    _In_ DWORD ErrorCode,
    _In_ DWORD CpuNumber
    );

INTSTATUS
IntPauseVcpus(
    void
    );

INTSTATUS
IntResumeVcpus(
    void
    );

void
IntEnterDebugger2(
    _In_ PCHAR File,
    _In_ DWORD Line
    );

#define IntEnterDebugger()      IntEnterDebugger2(__FILE__, __LINE__)

void
IntDbgEnterDebugger2(
    _In_ PCHAR File,
    _In_ DWORD Line
    );

#define IntDbgEnterDebugger()   IntDbgEnterDebugger2(__FILE__, __LINE__)

INTSTATUS
IntGuestUninitOnBugcheck(
    _In_ void const *Detour
    );

//
// Internal API
//
BOOLEAN
IntMatchPatternUtf8(
    _In_z_ const CHAR *Pattern,
    _In_z_ const CHAR *String,
    _In_ DWORD Flags
    );

BOOLEAN
IntMatchPatternUtf16(
    _In_z_ const WCHAR *Pattern,
    _In_z_ const WCHAR *String,
    _In_ DWORD Flags
    );

BOOLEAN
IntPolicyProcIsBeta(
    _In_opt_ const void *Process,
    _In_ QWORD Flag
    );

BOOLEAN
IntPolicyCoreIsOptionBeta(
    _In_ QWORD Flag
    );

BOOLEAN
IntPolicyProcIsFeedback(
    _In_opt_ const void *Process,
    _In_ QWORD Flag
    );

QWORD
IntPolicyGetProcProt(
    _In_opt_ const void *Process
    );

BOOLEAN
IntPolicyCoreTakeAction(
    _In_ QWORD Flag,
    _Inout_ INTRO_ACTION *Action,
    _Inout_ INTRO_ACTION_REASON *Reason
    );

BOOLEAN
IntPolicyProcTakeAction(
    _In_ QWORD Flag,
    _In_ void const *Process,
    _Inout_ INTRO_ACTION *Action,
    _Inout_ INTRO_ACTION_REASON *Reason
    );

BOOLEAN
IntPolicyProcForceBetaIfNeeded(
    _In_ QWORD Flag,
    _In_ void *Process,
    _Inout_ INTRO_ACTION *Action
    );

BOOLEAN
IntPolicyCoreForceBetaIfNeeded(
    _In_ QWORD Flag,
    _Inout_ INTRO_ACTION *Action
    );

BOOLEAN
IntPolicyIsCoreOptionFeedback(
    _In_ QWORD Flag
    );

char *
utf16_for_log(
    _In_z_ const WCHAR *WString
    );


INTSTATUS
IntReadString(
    _In_ QWORD StrGva,
    _In_ DWORD MinimumLength,
    _In_ BOOLEAN AnsiOnly,
    _Inout_ char **String,
    _Out_opt_ DWORD *StringLength
    );

#endif // _INTROCORE_H_