Bitdefender Hypervisor Memory Introspection
lixfiles.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
5 #ifndef LIX_FILES_H_
6 #define LIX_FILES_H_
7 
8 #include "lixprocess.h"
9 
13 typedef struct _LIX_QSTR
14 {
15  union
16  {
17  struct
18  {
21  };
22 
24  };
25 
28 
29 
33 #define LIX_MAX_PATH 256u
34 
38 #define LIX_MAX_DENTRY_DEPTH 30
39 
43 #ifdef INT_COMPILER_MSVC
44 #define LIX_FILE_HAS_SUID(mode) ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)))
45 #else
46 #define LIX_FILE_HAS_SUID(mode) \
47  ({ __auto_type mode_suid_ = (mode); \
48  ((mode_suid_ & S_ISUID) || ((mode_suid_ & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))); })
49 #endif
50 
53  _In_ QWORD File,
54  _Out_ QWORD *Dentry
55  );
56 
59  _In_ QWORD Dentry,
60  _Outptr_ char **FileName,
61  _Out_opt_ DWORD *NameLength
62  );
63 
66  _In_ QWORD FileStruct,
67  _Outptr_ char **FileName,
68  _Out_opt_ DWORD *NameLength,
69  _Out_opt_ QWORD *DentryGva
70  );
71 
74  _In_ QWORD FileStructGva,
75  _Out_ char **Path,
77  );
78 
79 void
81  void
82  );
83 
84 #endif // LIX_FILES_H_
#define _Out_
Definition: intro_sal.h:22
#define _In_
Definition: intro_sal.h:21
#define _Outptr_
Definition: intro_sal.h:19
int INTSTATUS
The status data type.
Definition: introstatus.h:24
struct _LIX_QSTR * PLIX_QSTR
#define _Out_opt_
Definition: intro_sal.h:30
DWORD Hash
Unused by introcore.
Definition: lixfiles.h:19
unsigned long long QWORD
Definition: intro_types.h:53
INTSTATUS IntLixDentryGetName(QWORD Dentry, char **FileName, DWORD *NameLength)
Gets the file-name that corresponds to the provided Dentry (guest virtual address).
Definition: lixfiles.c:227
struct _LIX_QSTR LIX_QSTR
Describes a string used for paths by the linux kernel (quick string).
QWORD HashLen
The union between the Hash and the Length.
Definition: lixfiles.h:23
INTSTATUS IntLixFileGetDentry(QWORD File, QWORD *Dentry)
Reads the value of the dentry field of the 'struct file'.
Definition: lixfiles.c:195
DWORD Length
The length of the string.
Definition: lixfiles.h:20
uint32_t DWORD
Definition: intro_types.h:49
void IntLixFilesCacheUninit(void)
Removes and frees the entries of the dentry-cache.
Definition: lixfiles.c:86
INTSTATUS IntLixGetFileName(QWORD FileStruct, char **FileName, DWORD *NameLength, QWORD *DentryGva)
Gets the file-name that corresponds to the provided FileStruct (guest virtual address).
Definition: lixfiles.c:565
QWORD Name
A pointer to the string.
Definition: lixfiles.h:26
Describes a string used for paths by the linux kernel (quick string).
Definition: lixfiles.h:13
INTSTATUS IntLixFileGetPath(QWORD FileStructGva, char **Path, DWORD *Length)
Gets the path that corresponds to the provided FileStructGva (guest virtual address of the 'struct fi...
Definition: lixfiles.c:352