40 #define LIX_KERNEL_MAX_PAGES 16384 42 #define LIX_BANNER_START "Linux version " 44 #define LIX_MODULE_MAPPING_SPACE_START 0xffffffffa0000000 45 #define LIX_MODULE_MAPPING_SPACE_END 0xfffffffffeffffff 47 #define LIX_KAISER_ENABLED_PCP_OFFSET_CAP 0xE000UL 89 for (
DWORD i = 0; i < 3; i++)
92 while (end < BufferLength && Buffer[end])
95 if (
'.' == Buffer[end] ||
' ' == Buffer[end] ||
'-' == Buffer[end] ||
'+' == Buffer[end])
98 hasBackport =
'-' == Buffer[end];
101 else if (Buffer[end] <
'0' || Buffer[end] >
'9')
114 if (end - start >=
sizeof(c))
116 WARNING(
"[WARNING] Version number too big (%d/%zu)\n", end - start,
sizeof(c));
120 memcpy(c, &Buffer[start], end - start);
130 gLixGuest->
Version.Sublevel = v[2];
134 TRACE(
"[LIXGUEST] No backport info!");
136 gLixGuest->
Version.Backport = 0;
141 while (end < BufferLength && Buffer[end] >=
'0' && Buffer[end] <=
'9')
146 if (end - start >=
sizeof(c))
148 WARNING(
"[WARNING] Backport number too big (%d/%zu)\n", end - start,
sizeof(c));
150 gLixGuest->
Version.Backport = 0;
154 memset(c, 0,
sizeof(c));
155 memcpy(c, &Buffer[start], end - start);
161 TRACE(
"[LIXGUEST] We run kernel version %d.%d.%d-%d (%08x)\n",
242 ERROR(
"[ERROR] IntPhysMemMap failed for %016llx (%016llx): 0x%08x\n", tr.
PhysicalAddress, gva, status);
248 DWORD verMax = parsed;
256 TRACE(
"[LIXGUEST] Found a 'Linux version ' at %llx. The start of rodata is at %llx\n", gva + parsed, gva);
269 if (pPage[verMax] ==
'\0')
271 LOG(
"[LIXGUEST] Linux version complete: %s\n", &pPage[parsed]);
317 WARNING(
"[WARNING] Could not find kernel version! Retry ...");
355 ERROR(
"[ERROR] IntVirtMemMap failed for %016llx: %08x\n", kernelBase, status);
369 ERROR(
"[ERROR] IntVirtMemMap failed for %016llx: %08x\n", kernelBase, status);
378 ERROR(
"[ERROR] Failed finding the base of the kernel, bailing out...\n");
418 ERROR(
"[ERROR] Could not load dist sigs from update buffer.");
425 WARNING(
"[WARNING] IntLixGuestFindKernelVersionAndRo failed for syscall %llx: %08x\n", SyscallHandler, status);
457 QWORD funcStart, funcEnd;
460 QWORD addrs[2] = { 0 };
465 ERROR(
"[ERROR] IntKsymFindByName could not find search_exception_tables\n");
469 while (funcStart < funcEnd)
474 ERROR(
"[ERROR] IntDecDecodeInstruction failed: %08x\n", status);
478 funcStart += instrux.Length;
480 if (ND_INS_MOV != instrux.Instruction || ND_OP_IMM != instrux.Operands[1].Type)
487 addrs[0] =
SIGN_EX_32(instrux.Operands[1].Info.Immediate.Imm);
491 addrs[1] =
SIGN_EX_32(instrux.Operands[1].Info.Immediate.Imm);
502 gLixGuest->
Layout.
ExTableEnd = ((addrs[0] > addrs[1]) ? addrs[0] : addrs[1]);
522 const char *memoryFuncs[] =
559 ERROR(
"[ERROR] IntKsymFindByName could not find do_exit\n");
563 while (gva < ksymEnd)
570 ERROR(
"[ERROR] Failed decoding instruction at 0x%016llx: %08x\n", gva, status);
574 gva += instrux.Length;
576 if (instrux.Instruction == ND_INS_MOV &&
577 instrux.OperandsCount == 2 &&
578 instrux.Operands[1].Type == ND_OP_MEM &&
579 instrux.Seg == ND_PREFIX_G2_SEG_GS)
609 QWORD cpuNumberAddress;
612 if (!cpuNumberAddress)
614 QWORD gva, functionEnd;
617 LOG(
"[WARNING] Failed finding 'cpu_number' will try with xen_halt");
622 WARNING(
"[WARNING] IntKsymFindByName could not find xen_halt\n");
626 while (gva < functionEnd)
631 ERROR(
"[ERROR] IntDecDecodeInstruction failed at %llx: %08x\n", gva, status);
635 gva += instrux.Length;
637 if (instrux.Instruction == ND_INS_MOV &&
638 instrux.OperandsCount == 2 &&
639 instrux.Operands[1].Type == ND_OP_MEM &&
640 instrux.Seg == ND_PREFIX_G2_SEG_GS)
642 DWORD cpuNumberOffset = instrux.Displacement;
644 if (instrux.IsRipRelative)
646 cpuNumberOffset += (
DWORD)gva;
651 LOG(
"[OFFSETS] 'current cpu' gs offset: 0x%x\n", cpuNumberOffset);
687 ERROR(
"[ERROR] IntKsymFindByName could not find set_tls_desc\n");
691 while (gva < ksymEnd)
698 ERROR(
"[ERROR] IntDecDecodeInstruction failed at %llx: %08x\n", gva, status);
702 if (instrux.Instruction == ND_INS_ADD &&
703 instrux.OperandsCount == 3 &&
704 instrux.Operands[1].Type == ND_OP_IMM &&
705 instrux.Operands[0].Type == ND_OP_REG &&
706 instrux.Operands[0].Info.Register.Reg == NDR_RDI)
708 if (instrux.Operands[1].Info.Immediate.Imm <
PAGE_SIZE * 3)
711 LOG(
"[OFFSETS] 'thread_struct' offset (task_struct): 0x%x\n",
718 WARNING(
"[WARNING] Candidate 'thread_struct' offset (0x%lx) is bigger than 0x%x ...\n",
719 instrux.Operands[1].Info.Immediate.Imm,
PAGE_SIZE * 3);
723 gva += instrux.Length;
748 DWORD paramReg = NDR_RDI;
753 WARNING(
"[WARNING] IntKsymFindByName could not find get_mm_exe_file\n");
757 while (gva < ksymEnd)
764 ERROR(
"[ERROR] IntDecDecodeInstruction failed at %llx: %08x\n", gva, status);
769 if (instrux.Instruction == ND_INS_MOV &&
770 instrux.OperandsCount == 2 &&
771 instrux.Operands[0].Type == ND_OP_REG &&
772 instrux.Operands[1].Type == ND_OP_REG &&
773 (instrux.Operands[1].Info.Register.Reg == NDR_RDI ||
774 instrux.Operands[1].Info.Register.Reg == paramReg))
776 paramReg = instrux.Operands[0].Info.Register.Reg;
779 if (instrux.Instruction == ND_INS_MOV &&
780 instrux.OperandsCount == 2 &&
781 instrux.Operands[1].Type == ND_OP_MEM &&
782 instrux.Operands[1].Info.Memory.HasBase &&
783 instrux.Operands[1].Info.Memory.HasDisp &&
784 (instrux.Operands[1].Info.Memory.Base == NDR_RDI ||
785 instrux.Operands[1].Info.Memory.Base == paramReg) &&
786 instrux.Operands[1].Info.Memory.Disp <
PAGE_SIZE &&
787 instrux.Operands[0].Type == ND_OP_REG &&
788 instrux.Operands[0].Info.Register.Type == ND_REG_GPR &&
791 LIX_FIELD(MmStruct, ExeFile) = (
DWORD)instrux.Operands[1].Info.Memory.Disp;
792 LOG(
"[OFFSETS] mm_struct->exe_file offset: 0x%x\n",
LIX_FIELD(MmStruct, ExeFile));
797 gva += instrux.Length;
828 QWORD currentSyscallAddress;
829 QWORD foundSyscallAddress = 0;
831 *ProperSyscallAddress = 0;
833 if ((SyscallAddress >> 31) & 1)
838 currentSyscallAddress = SyscallAddress;
840 while (currentSyscallAddress - SyscallAddress <
PAGE_SIZE)
846 if (!ND_SUCCESS(status))
848 ERROR(
"[ERROR] IntDecDecodeInstruction failed with status 0x%08X", status);
852 if (instrux.Instruction == ND_INS_MOV &&
853 instrux.OperandsCount == 2 &&
854 instrux.Operands[0].Info.Register.Reg == NDR_RDI &&
855 instrux.Operands[1].Type == ND_OP_IMM &&
858 foundSyscallAddress = instrux.Operands[1].Info.Immediate.Imm;
860 else if (0 != foundSyscallAddress &&
861 ((instrux.Instruction == ND_INS_CALLNR &&
862 instrux.Operands[0].Type == ND_OP_OFFS &&
863 instrux.Operands[0].Info.RelativeOffset.Rel < 0x20) ||
864 (instrux.Instruction == ND_INS_JMPNI &&
865 instrux.Operands[0].Type == ND_OP_REG &&
866 instrux.Operands[0].Info.Register.Reg == NDR_RDI)))
868 *ProperSyscallAddress = foundSyscallAddress;
872 currentSyscallAddress += instrux.Length;
895 ERROR(
"[ERROR] IntLixResolveCurrentProcessOffset failed: 0x%08x\n", status);
902 WARNING(
"[WARNING] IntLixResolveCurrentCpuOffset failed: 0x%08x\n", status);
909 WARNING(
"[WARNING] IntLixResolveExeFileOffset failed: 0x%08x\n", status);
916 ERROR(
"[ERROR] IntLixResolveThreadStructOffset failed: 0x%08x\n", status);
960 ERROR(
"[ERROR] IntLixKernelWriteProtect failed: 0x%08x\n", status);
961 returnStatus = status;
970 ERROR(
"[ERROR] IntLixKernelReadProtect failed: 0x%08x\n", status);
971 returnStatus = status;
980 ERROR(
"[ERROR] IntLixVdsoProtect failed: 0x%08x\n", status);
981 returnStatus = status;
1000 ERROR(
"[ERROR] IntLixIdtProtectAll failed: 0x%08x\n", status);
1010 ERROR(
"[ERROR] IntMsrSyscallProtect failed: 0x%08x\n", status);
1011 returnStatus = status;
1020 ERROR(
"[ERROR] IntCr4Protect failed: 0x%08x\n", status);
1021 returnStatus = status;
1027 return returnStatus;
1069 ERROR(
"[ERROR] IntKernVirtMemRead failed for %llx: %08x\n", SyscallGva, status);
1073 for (
DWORD i = 0; i <
sizeof(pSyscall);)
1080 if (
sizeof(pSyscall) - i < ND_MAX_INSTRUCTION_LENGTH)
1085 ERROR(
"[ERROR] Invalid instruction in syscall @ %llx: %08x\n", SyscallGva, status);
1090 (instrux.Instruction == ND_INS_JMPNR &&
1091 instrux.Operands[0].Type == ND_OP_OFFS))
1093 LOG(
"[INFO] Found a JMP right after SWAPGS, skip until that (+%02x)\n", instrux.RelativeOffset);
1094 i += instrux.RelativeOffset;
1097 i += instrux.Length;
1099 if (instrux.Instruction == ND_INS_TEST &&
1100 instrux.Operands[0].Type == ND_OP_MEM &&
1101 instrux.Seg == ND_PREFIX_G2_SEG_GS)
1103 gsOffset = instrux.Displacement;
1106 if (instrux.Instruction == ND_INS_MOV_CR &&
1107 instrux.Operands[0].Type == ND_OP_REG &&
1108 instrux.Operands[0].Info.Register.Type == ND_REG_CR &&
1109 instrux.Operands[0].Info.Register.Reg == NDR_CR3 &&
1110 instrux.Operands[1].Type == ND_OP_REG &&
1111 instrux.Operands[1].Info.Register.Type == ND_REG_GPR)
1131 ERROR(
"[ERROR] The value of misplacement operand (0x%08x) from instruction 'TEST [GS:displacement], immediate' " 1140 ERROR(
"[ERROR] IntGsRead failed: %08x\n", status);
1153 WARNING(
"[WARNING] IntKernVirtMemFetchDword failed for %llx: %08x\n", gsBase + gsOffset, status);
1167 LOG(
"[LIXGUEST] KPTI cannot be reliable detected... Defer it!\n");
1195 QWORD gvaStart, gvaEnd;
1198 DWORD nrOfGvas = 0, iGva;
1204 ERROR(
"[ERROR] IntKsymFindByName failed for mark_rodata_ro\n");
1208 while (gvaStart < gvaEnd)
1213 WARNING(
"[WARNING] IntDecDecodeInstruction failed: %08x\n", status);
1217 gvaStart += instrux.Length;
1218 gva = instrux.Operands[1].Info.Immediate.Imm;
1220 if (!(instrux.Operands[0].Type == ND_OP_REG && instrux.Operands[1].Type == ND_OP_IMM) ||
1221 ((0xFFFFFFFF80000000 & gva) != 0xFFFFFFFF80000000))
1226 for (iGva = 0; iGva < nrOfGvas; iGva++)
1228 if (allGvas[iGva] == gva)
1234 if (nrOfGvas != iGva)
1239 for (iGva = nrOfGvas; (iGva > 0) && (allGvas[iGva - 1] > gva); iGva--)
1241 allGvas[iGva] = allGvas[iGva - 1];
1244 allGvas[iGva] = gva;
1263 for (iGva = 4; iGva < nrOfGvas; iGva++)
1313 QWORD ksymEnd, ksymEndAux;
1332 ERROR(
"[ERROR] IntKsymFindByName could not find arch_crash_save_vmcoreinfo\n");
1339 ERROR(
"[ERROR] IntKsymFindByName could not find vmcoreinfo_append_str\n");
1343 WORD funcCallCount = 0;
1344 while (ksymStart < ksymEnd)
1351 ERROR(
"[ERROR] IntDecDecodeInstruction failed at GVA %llx: 0x%08x.\n", ksymStart, status);
1356 if (instrux.Instruction == ND_INS_MOV &&
1357 instrux.Operands[0].Type == ND_OP_REG &&
1358 instrux.Operands[0].Info.Register.Reg == NDR_RDX &&
1359 instrux.Operands[1].Type == ND_OP_IMM)
1361 pgdAddr = instrux.Operands[1].Info.Immediate.Imm;
1364 if (instrux.Instruction == ND_INS_CALLNR)
1366 QWORD ksymRelAux = ksymStartAux - (ksymStart + 5);
1368 if (instrux.Operands[0].Info.RelativeOffset.Rel == ksymRelAux)
1373 if (funcCallCount == 2)
1380 ksymStart += instrux.Length;
1407 QWORD patchGva, address;
1417 list = gKernelDrivers.
Head;
1419 while (list != &gKernelDrivers)
1436 TRACE(
"[WARNING] Incoming patch at address 0x%llx with no corresponding driver. Will ignore!\n", patchGva);
1440 if (length >
sizeof(ActivePatch->Data))
1442 WARNING(
"[WARNING] Patch with size %d... We ignore it!\n", length);
1449 ERROR(
"[ERROR] IntKernVirtMemRead failed: 0x%08x. Patch at GVA 0x%llx will be ignored.\n", status, patchGva);
1453 ActivePatch->Gva = patchGva;
1454 ActivePatch->Length = length;
1520 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for %llx: %08x\n", jumpEntry, status);
1524 pActivePatch->
Gva = gva;
1525 pActivePatch->
Length = 5;
1555 ERROR(
"[ERROR] IntKsymInit failed: 0x%08x", status);
1562 ERROR(
"[ERROR] Failed finding '_etext' symbol\n");
1576 ERROR(
"[ERROR] IntKsymFindByName could not find _sinittext\n");
1583 ERROR(
"[ERROR] IntLixFindDataStart failed: %08x\n", status);
1590 WARNING(
"[WARNING] Could not find ex_table limits: 0x%08x\n", status);
1598 ERROR(
"[ERROR] IntKsymFindByName could not find _edata\n");
1605 ERROR(
"[ERROR] IntKsymFindByName could not find __start___ex_table\n");
1612 ERROR(
"[ERROR] IntKsymFindByName could not find __start_rodata\n");
1619 ERROR(
"[ERROR] IntKsymFindByName could not find __end_rodata\n");
1624 if (
LIX_FIELD(Info, HasAlternateSyscall))
1629 WARNING(
"[WARNING] Could not find proper syscall gva. Agent injection may fail!\n");
1637 TRACE(
"[LIXGUEST] .kernel : 0x%016llx - 0x%016llx (%4lld kB)\n",
1641 TRACE(
"[LIXGUEST] .text : 0x%016llx - 0x%016llx (%4lld kB)\n",
1644 TRACE(
"[LIXGUEST] .data : 0x%016llx - 0x%016llx (%4lld kB)\n",
1647 TRACE(
"[LIXGUEST] .rodata : 0x%016llx - 0x%016llx (%4lld kB)\n",
1654 ERROR(
"[ERROR] Failed initializing the linux kernel driver: 0x%08x\n", status);
1663 ERROR(
"[ERROR] IntLixGuestResolveOffsets failed: 0x%08x\n", status);
1695 ERROR(
"[ERROR] IntLixIdtUnprotectAll failed: 0x%08x\n", status);
1701 ERROR(
"[ERROR] IntCr4Unprotect failed: 0x%08x\n", status);
1719 TRACE(
"[INTRO-UNINIT] Uninit allocated guest memory ...\n");
1771 CHAR ksymbol[126] = { 0 };
1777 TRACE(
"[LIXGUEST] %s attempt on detour code from @0x%016llx (%s).\n",
1781 TRACE(
"[LIXGUEST] Instruction:");
1812 CHAR ksymbol[126] = { 0 };
1815 TRACE(
"[LIXGUEST] Write/Read attempt on agent content from @0x%016llx (%s).\n",
1818 TRACE(
"[LIXGUEST] Instruction:");
1866 if (
sizeof(*pHypercallPage) > gLixGuest->
MmAlloc.
Detour.Data.Length)
1868 ERROR(
"[ERROR] Linux hypercall page size exceed %d bytes", gLixGuest->
MmAlloc.
Detour.Data.Length);
1874 ERROR(
"[ERROR] Linux detours content size exceed %d bytes", gLixGuest->
MmAlloc.
Detour.Data.Length);
1880 ERROR(
"[ERROR] Linux agents content size exceed %d bytes", gLixGuest->
MmAlloc.
Detour.Data.Length);
1920 ERROR(
"[ERROR] IntKsymFindByName could not find 'd_path'\n");
1927 ERROR(
"[ERROR] IntKernVirtMemWrite failed: 0x%08x\n", status);
1931 TRACE(
"[LIXGUEST] Deployed agents @0x%016llx.", gLixGuest->
MmAlloc.
Agent.Address);
1936 ERROR(
"[ERROR] IntKernVirtMemWrite failed: 0x%08x\n", status);
1940 TRACE(
"[LIXGUEST] Deployed detours data @0x%016llx.", gLixGuest->
MmAlloc.
Detour.Data.Address);
1952 ERROR(
"[ERROR] IntMemClkCloakRegion failed for 0x%016llx (%d bytes) with status: 0x%08x\n",
1957 TRACE(
"[LIXGUEST] Deployed detours code @0x%016llx.", gLixGuest->
MmAlloc.
Detour.Code.Address);
1982 DWORD left = Length;
1992 ERROR(
"[ERROR] IntVirtMemMap failed for %llx: %08x\n", gva, status);
2002 }
while (gva < Gva + Length);
2025 ERROR(
"[ERROR] Failed to allocate guest virtual space for detours. Abort...\n");
2032 ERROR(
"[ERROR] The guest virtual address (0x%016llx) return by 'module_alloc' is not inside the module mapping " 2033 "region. Abort...\n", pRegs->
R8);
2041 TRACE(
"[LIXGUEST] Allocated guest virtual memory for detours data @ 0x%016llx (0x%x bytes)\n",
2047 TRACE(
"[LIXGUEST] Allocated guest virtual memory for detours code @ 0x%016llx (0x%x bytes)\n",
2054 TRACE(
"[LIXGUEST] Allocated guest virtual memory for agent code @ 0x%016llx (0x%x bytes)\n",
2062 ERROR(
"[ERROR] IntTranslateVirtualAddressEx failed with status: 0x%08x.\n", status);
2087 ERROR(
"[ERROR] IntHookObjectDestroy failed with status: 0x%08x\n", status);
2098 ERROR(
"[ERROR] IntMemClkUncloakRegion failed with status: 0x%08x\n", status);
2109 ERROR(
"[ERROR] IntHookObjectDestroy failed with status: 0x%08x\n", status);
2135 ERROR(
"[ERROR] IntHookObjectCreate failed: 0x%08x\n", status);
2150 ERROR(
"[ERROR] IntHookObjectHookRegion failed with status: 0x%x", status);
2165 ERROR(
"[ERROR] IntHookObjectHookRegion failed with status: 0x%x", status);
2172 ERROR(
"[ERROR] IntHookObjectCreate failed: 0x%08x\n", status);
2187 ERROR(
"[ERROR] IntHookObjectHookRegion failed with status: 0x%x", status);
2213 static QWORD sysStateStart = 0;
2230 return (
int)systemState;
2272 WARNING(
"[WARNING] Trying to deploy init agent without clearing the memory: %d %d\n",
2277 if (pHandler == NULL)
2279 ERROR(
"[ERROR] Requested to deploy the uninit agent, but none was found!\n");
2292 TRACE(
"[LIXGUEST] Change page (0x%llx) attributes: Clear -> 0x%llx Set -> 0x%llx\n",
2295 LOG(
"[LIXGUEST] Deploy the uninit agent...\n");
2300 ERROR(
"[ERROR] IntLixAgentInject failed with status: 0x%08x.", status);
2326 ERROR(
"[ERROR] IntLixGuestAllocateFill failed with status: %08x\n", status);
2333 ERROR(
"[ERROR] IntLixGuestAllocateHook failed with status: %08x\n", status);
2340 ERROR(
"[ERROR] IntLixGuestAllocateDeploy failed with status: %08x", status);
2375 ERROR(
"[ERROR] IntLixGuestAllocateInit failed with status: 0x%08x.", status);
2431 ERROR(
"[ERROR] IntVirtMemSet failed for gva 0x%016llx with status: 0x%08x\n", addr, status);
2437 ERROR(
"[ERROR] IntLixTaskIterateGuestTasks failed, status = 0x%08x\n", status);
2446 ERROR(
"[ERROR] IntLixDrvIterateList failed, status = 0x%08x\n", status);
2456 ERROR(
"[ERROR] IntLixHookAll failed with status: 0x%08x", status);
2463 ERROR(
"[ERROR] IntLixGuestActivateProtection failed: 0x%08x\n", status);
2470 ERROR(
"[ERROR] IntNotifyIntroActive failed: 0x%08x\n", status);
2501 if (pHandler == NULL)
2513 ERROR(
"[ERROR] IntLixAgentInject failed with status: 0x%08x.", status);
2517 TRACE(
"[LIXGUEST] Allocation agent injected...");
2539 TRACE(
"[LIXGUEST] Clear the allocated guest memory...\n");
2544 ERROR(
"[ERROR] IntLixGuestClearGuestMemory failed with status: 0x%08x. (detour data)", status);
2550 ERROR(
"[ERROR] IntLixGuestClearGuestMemory failed with status: 0x%08x. (agent content)", status);
2575 QWORD originalSyscall, syscallGva, properSyscallGva, initPgd;
2589 memzero(gLixGuest,
sizeof(*gLixGuest));
2597 ERROR(
"[ERROR] IntSyscallRead failed: 0x%08x\n", status);
2601 originalSyscall = syscallGva;
2603 TRACE(
"[INTRO-INIT] Found SYSCALL handler @ %llx\n", syscallGva);
2608 syscallGva = properSyscallGva;
2610 TRACE(
"[INTRO-INIT] Found SYSCALL handler @ %llx (the proper one)", syscallGva);
2616 ERROR(
"[ERROR] IntLixGuestIsKptiActive failed: 0x%08x\n", status);
2623 WARNING(
"[WARNING] Failed locating the kernel image in memory starting from syscall %llx: %08X\n",
2624 syscallGva, status);
2638 ERROR(
"[ERROR] Unsupported guest OS loaded, will NOT activate protection!\n");
2650 ERROR(
"[ERROR] IntLixGuestInit failed, status = 0x%08x\n", status);
2659 ERROR(
"[ERROR] IntLixGuestFindPgd failed with status: 0x%08x\n", status);
2664 ERROR(
"[ERROR] Failed getting the init_mm: 0x%08x\n", status);
2671 ERROR(
"[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n",
2672 initMmGva +
LIX_FIELD(MmStruct, Pgd), status);
2680 ERROR(
"[ERROR] Translating init PGD failed, status = 0x%08x\n", status);
2694 ERROR(
"[ERROR] CPU %d doesn't appear to be used, skipping IDT...\n", i);
2709 ERROR(
"[ERROR] IntLixGuestAllocate failed with status: 0x%08x.", status);
2750 DWORD startOfDistroName = 0;
2752 DWORD endOfDistroName = 0;
2758 if (sizeOfString >= FullStringSize)
2763 while (startOfDistroName < sizeOfString && count != 3)
2770 ++startOfDistroName;
2778 if (startOfDistroName >= sizeOfString)
2783 endOfDistroName = startOfDistroName;
2784 while (endOfDistroName < sizeOfString &&
2789 endOfDistroName += 1;
2792 if (endOfDistroName >= sizeOfString)
2799 count = snprintf(VersionString, VersionStringSize,
"Kernel: %d.%d.%d-%d distro: ",
2809 if ((
DWORD)count >= VersionStringSize)
2819 if (endOfDistroName - startOfDistroName >= VersionStringSize - count)
2826 if (strstr(FullString,
"el7uek"))
2828 snprintf(VersionString + count,
sizeof(
"Oracle"),
"%s",
"Oracle");
2832 snprintf(VersionString + count, endOfDistroName - startOfDistroName,
"%s", FullString + startOfDistroName);
struct _LIX_GUEST_OS_SPECIFIC::@265 File
#define INT_STATUS_GUEST_OS_NOT_SUPPORTED
Indicates that the guest operating system is not supported.
TIMER_FRIENDLY void IntDumpArchRegs(IG_ARCH_REGS const *Registers)
This function dumps the register values in a user friendly format.
void IntLixAgentDisablePendingAgents(void)
Disables all pending agents.
BOOLEAN IntDetIsPtrInRelocatedCode(QWORD Ptr, DETOUR_TAG *Tag)
Checks if a guest pointer is inside the modified prologue of a function.
QWORD PhysicalAddress
The physical address to which VirtualAddress translates to.
DWORD CurrentCpuOffset
The offset of the CPU from GS.
LIX_OPAQUE_FIELDS OsSpecificFields
OS-dependent and specific information.
LIST_HEAD gKernelDrivers
List of all the drivers currently loaded inside the guest.
INTSTATUS IntIdtFindBase(DWORD CpuNumber, QWORD *Base, WORD *Limit)
Returns the IDT base and limit for a guest CPU.
#define CONTAINING_RECORD(List, Type, Member)
#define ROUND_UP(what, to)
INTSTATUS IntLixMmGetInitMm(QWORD *InitMm)
Find the address of the "init_mm" variable inside the kernel.
int IntLixGuestGetSystemState(void)
Get the system state of the Linux guest.
void IntGuestSetIntroErrorState(INTRO_ERROR_STATE State, INTRO_ERROR_CONTEXT *Context)
Updates the value of the gErrorState and the value of the gErrorStateContext.
HOOK_HEADER Header
Hook header.
Describes the information about a Linux active-patch.
INTSTATUS IntVirtMemUnmap(void **HostPtr)
Unmaps a memory range previously mapped with IntVirtMemMap.
Describes a handlers that contains the data required by the agent.
struct _LIX_GUEST_OS_SPECIFIC::@263 Task
struct _LIX_AGENT_UNINIT_ARGS::@107 Attr
struct _LIX_GUEST_OS_SPECIFIC::@262 Mm
struct _LINUX_GUEST::@128 MmAlloc
static INTSTATUS IntLixGuestFindPgd(QWORD *Pgd)
Searches for the system CR3.
QWORD OriginalPagesAttr
The original page protection-attributes for the allocated region.
INTSTATUS IntLixDrvCreateKernel(void)
Create the KERNEL_DRIVER object for the operating system kernel and activate the protection for it...
struct _LINUX_GUEST::@128::@132 Agent
QWORD End
The end guest virtual address of ksym (exclusive).
static INTSTATUS IntLixResolveThreadStructOffset(void)
Decodes each instruction of the 'set_tls_desc' function and searches for 'MOV RDI, immediate' pattern in order to find the 'task_struct->thread_struct' offset.
struct _LINUX_GUEST::@128::@133 PerCpuData
QWORD ModuleAddress
The address of the allocated memory (module).
INTSTATUS IntKernVirtMemWrite(QWORD KernelGva, DWORD Length, void *Buffer)
Writes data to a guest kernel virtual memory range.
INTSTATUS IntHookObjectDestroy(HOOK_OBJECT_DESCRIPTOR **Object, DWORD Flags)
Destroy an entire hook object. All regions belonging to this object will be removed.
DWORD RoSize
The size of the .rodata (read-only).
IG_ARCH_REGS Regs
The current state of the guest registers.
LIX_ACTIVE_PATCH ActivePatch[lixActivePatchCount]
An array that contains information about the active-patches.
INTSTATUS IntIdtrProtect(void)
Enable IDTR protection.
INTSTATUS IntLixKernelReadProtect(void)
Activates kernel protection.
static INTSTATUS IntLixResolveCurrentCpuOffset(void)
Searches for the 'cpu_number' offset.
LIX_AGENT_HANDLER * IntLixAgentGetHandlerByTag(LIX_AGENT_TAG AgentTag)
Iterates through all agent handlers and search the entry that has the provided tag.
INTSTATUS IntLixTaskAdd(QWORD TaskGva, QWORD StaticDetected)
Creates and adds a Linux process in the internal list.
QWORD SystemCr3
The Cr3 used to map the kernel.
#define INT_STATUS_SUCCESS
#define PAGE_REMAINING(addr)
INT32 __cdecl strtol(const INT8 *nptr, INT8 **endptr, INT32 ibase)
static INTSTATUS IntLixResolveExeFileOffset(void)
Decodes each instruction of the 'get_mm_exe_file' function and searches for 'MOV REG, [RDI + Displacement]' pattern in order to find the 'mm_struct->exe_file' offset.
DWORD KernelSize
The size of the kernel.
#define INTRO_OPT_PROT_KM_LX
Enable kernel image protection (Linux only).
WORD IdtLimit
The current IDT limit.
struct _LIST_ENTRY * Flink
QWORD Start
The start guest virtual address of ksym.
QWORD RoDataStart
The guest virtual address where the read-only data starts.
INTSTATUS IntKsymFindByAddress(QWORD Gva, DWORD Length, char *SymName, QWORD *SymStart, QWORD *SymEnd)
Finds the symbol which is located at the given address.
static INTSTATUS IntLixGuestParseVersion(const char *Buffer, DWORD BufferLength)
Parses the 'linux_proc_banner' and searches for 'version.patch.sublevel-backport' pattern...
#define IN_RANGE_INCLUSIVE(x, start, end)
#define INT_SUCCESS(Status)
A critical structure was not found inside the guest kernel.
struct _LIST_ENTRY * Head
INTSTATUS IntResumeVcpus(void)
Resumes the VCPUs previously paused with IntPauseVcpus.
QWORD PerCpuAddress
The address of the allocated memory (per-CPU).
BOOLEAN ProtectionActivated
QWORD PerCpuLength
The per-CPU memory allocation size.
#define INTRO_OPT_PROT_KM_LX_TEXT_READS
Enable kernel '_text' section read protection (Linux only).
QWORD IntHookGetGlaFromGpaHook(HOOK_GPA const *Hook, QWORD Address)
Gets the GLA from a GPA hook.
WORD Length
The patch length.
BOOLEAN SafeToApplyOptions
True if the current options can be changed dynamically.
BYTE EptHookType
The type of the hook in EPT (see IG_EPT_HOOK_TYPE)
INTSTATUS IntLixGuestFindKernelVersionAndRo(QWORD StartGva)
Scans pages from guest memory, starting from the provided StartGva and tries to find the ...
unsigned int VmPrevOffset
#define INT_STATUS_NOT_NEEDED_HINT
Section will contain linux related information.
static INTSTATUS IntLixGuestResolveExTableLimits(void)
Decodes each instruction of the 'search_exception_tables' function and searches for 'MOV REG/RSI...
INTSTATUS IntLixAgentUninit(void)
Uninit the agents state.
struct _LIX_GUEST_OS_SPECIFIC::@260 Info
INTSTATUS IntLixGuestNew(void)
Starts the initialization and enable protection for a new Linux guest.
DWORD IntPatternMatch(const BYTE *Buffer, DWORD SigCount, const PATTERN_SIGNATURE *Sigs)
Matches one of the given signatures on the given buffer.
int INTSTATUS
The status data type.
static INTSTATUS IntLixResolveCurrentProcessOffset(void)
Decodes each instruction of the 'do_exit' function and searches for 'MOV REG/MEM, [gs:displacement]' ...
The operating system version is not supported.
QWORD CodeEnd
The guest virtual address where the code ends.
QWORD CodeStart
The guest virtual address where the code starts.
INTSTATUS IntMsrSyscallProtect(void)
Enable protection for all SYSCALL and SYSENTER MSRs.
#define PAGE_OFFSET_MASK_2M
DWORD OSVersion
Os version.
QWORD gEventId
The ID of the current event.
LIX_MODULE_LAYOUT CoreLayout
The layout of the core section.
#define LIX_MODULE_MAPPING_SPACE_END
The end of module mapping region.
#define INT_STATUS_NOT_FOUND
unsigned char gLixAgents[]
static INTSTATUS IntLixGuestAgentContentHandler(void **Context, void *Hook, QWORD Address, INTRO_ACTION *Action)
Dumps information about the read/write attempt.
static INTSTATUS IntLixGuestAllocateInit(void)
Initialize the required information about the allocated memory zone for detours/agents.
DWORD ThreadStructOffset
The offset of the thread_struct from task_struct.
QWORD IntroActiveEventId
The event ID on which introcore became active.
static void IntLixGuestSetOsVersion(void)
Computes the OS version number using the version, patch and sublevel.
#define TRFLG_NONE
No special options.
INTSTATUS IntLixGuestFindProperSyscall(QWORD SyscallAddress, QWORD *ProperSyscallAddress)
Decodes each instruction from the provided syscall handler address and searches for a pattern if the ...
struct _LIX_GUEST_OS_SPECIFIC::@266 Dentry
PVCPU_STATE VcpuArray
Array of the VCPUs assigned to this guest. The index in this array matches the VCPU number...
unsigned int DentryOffset
LIX_GUEST_OS_SPECIFIC OsSpecificFields
INTSTATUS IntCr4Unprotect(void)
Disables the CR4 protection.
INTSTATUS IntPauseVcpus(void)
Pauses all the guest VCPUs.
void IntLixVdsoUnprotect(void)
Remove protection for the vDSO image and VSYSCALL.
struct _LIX_AGENT_INIT_ARGS::@105 Allocate
#define INTRO_OPT_PROT_KM_IDT
INTRO_GUEST_TYPE OSType
The type of the guest.
INTSTATUS IntLixTextPokeHandler(void *Detour)
Handles the incoming 'text_poke' patches from the guest.
Will write the contents of the patched data inside the guest.
INTSTATUS IntNotifyIntroActive(void)
#define INTRO_OPT_PROT_KM_VDSO
Enable vDSO image protection (Linux only).
Section will contain information about a supported OS.
Describes a kernel driver.
INTSTATUS IntGdtrProtect(void)
Enable GDTR protection.
#define PAGE_BASE_MASK_2M
BOOLEAN KptiActive
True if KPTI is enabled on this guest, False if it is not.
#define INTRO_OPT_PROT_KM_MSR_SYSCALL
static INTSTATUS IntLixGuestFindKernel(QWORD SyscallHandler)
Finds the most things required by Introcore to be able to initialize completely.
QWORD ExTableStart
The guest virtual address where the ex-table starts.
static INTSTATUS IntLixGuestDetourDataHandler(void **Context, void *Hook, QWORD Address, INTRO_ACTION *Action)
Dumps information about the read/write attempt.
DWORD MappingsCount
The number of entries inside the MappingsTrace and MappingsEntries arrays.
Used for 'arch_jump_label_transform'.
struct _LINUX_GUEST::@128::@131 Detour
void IntLixGuestUninit(void)
Uninitialize the Linux guest.
struct _LIX_AGENT_UNINIT_ARGS::@106 Free
INTSTATUS IntLixTaskIterateGuestTasks(PFUNC_IterateListCallback Callback, QWORD Aux)
Iterates the guest process list and calls the provided callback for each process and thread found...
INTSTATUS IntVirtMemSet(QWORD VirtualAddress, DWORD Length, QWORD Cr3, BYTE Value)
INTSTATUS IntLixGuestAllocateHook(void)
Add EPT hooks for the detours and agents.
INTSTATUS IntLixIdtUnprotectAll(void)
Disable protection for IDT on all CPUs.
QWORD Flags
The entry that maps VirtualAddress to PhysicalAddress, together with all the control bits...
#define _In_reads_z_(expr)
INTSTATUS IntKernVirtMemFetchDword(QWORD GuestVirtualAddress, DWORD *Data)
Reads 4 bytes from the guest kernel memory.
INTSTATUS IntLixGuestIsKptiActive(QWORD SyscallGva)
Checks if the Linux guest has the KPTI active.
QWORD DataStart
The guest virtual address where the data starts.
unsigned int CurrentCpuOffset
static INTSTATUS IntLixGuestClearGuestMemory(QWORD Gva, DWORD Length)
Clear the provided memory zone.
#define IS_KERNEL_POINTER_LIX(p)
#define INT_STATUS_NOT_INITIALIZED
#define SIG_NOT_FOUND
Signals that a signature was not matched.
INTSTATUS IntKernVirtMemFetchQword(QWORD GuestVirtualAddress, QWORD *Data)
Reads 8 bytes from the guest kernel memory.
The kernel image was not found.
#define IG_CURRENT_VCPU
For APIs that take a VCPU number as a parameter, this can be used to specify that the current VCPU sh...
struct _LINUX_GUEST::@126 Layout
Used for 'text_poke'.
QWORD MappingsEntries[MAX_TRANSLATION_DEPTH]
Contains the entry in which paging table.
INTSTATUS IntGetVersionStringLinux(DWORD FullStringSize, DWORD VersionStringSize, CHAR *FullString, CHAR *VersionString)
Gets the version string for a Linux guest.
#define IN_RANGE(x, start, end)
BOOLEAN Guest64
True if this is a 64-bit guest, False if it is a 32-bit guest.
QWORD Current
The currently used options.
PATTERN_SIGNATURE * gLinuxDistSigs
An array that contains the distro signatures.
#define INTRO_OPT_PROT_KM_IDTR
Enable interrupt descriptor-table registers protection.
QWORD IdtBase
Original IDT base.
CHAR VersionString[MAX_VERSION_LENGTH]
The version string.
INTSTATUS IntLixVdsoProtect(void)
Activates protection for the vDSO image and VSYSCALL.
INTSTATUS IntTranslateVirtualAddress(QWORD Gva, QWORD Cr3, QWORD *PhysicalAddress)
Translates a guest virtual address to a guest physical address.
INTSTATUS IntDecDecodeInstructionFromBuffer(PBYTE Buffer, size_t BufferSize, IG_CS_TYPE CsType, void *Instrux)
Decode an instruction from the provided buffer.
BOOLEAN GuestInitialized
True if the OS-specific portion has been initialized.
static BOOLEAN IntLixGuestIsSupported(void)
Load OS information from CAMI if the guest is supported.
#define LIX_FIELD(Structure, Field)
Macro used to access fields inside the LIX_OPAQUE_FIELDS structure.
#define HpFreeAndNullWithTag(Add, Tag)
INTSTATUS IntGsRead(DWORD CpuNumber, QWORD *GsValue)
Reads the IA32_GS_BASE guest MSR.
unsigned int CurrentTaskOffset
#define INT_STATUS_INVALID_INTERNAL_STATE
INTSTATUS IntMemClkCloakRegion(QWORD VirtualAddress, QWORD Cr3, DWORD Size, DWORD Options, PBYTE OriginalData, PBYTE PatchedData, PFUNC_IntMemCloakWriteHandle WriteHandler, void **CloakHandle)
Hides a memory zone from the guest.
QWORD KernelVa
The guest virtual address at which the kernel image.
#define LIX_KERNEL_MAX_PAGES
The maximum number of pages of kernel that will be scanned.
QWORD MaskSet
The page attributes that must be set.
LINUX_GUEST * gLixGuest
Global variable holding the state of a Linux guest.
LIX_SYMBOL MemoryFunctions[5]
The guest virtual address of memcpy, __memcpy, memset, __memset, memmove.
BYTE WordSize
Guest word size. Will be 4 for 32-bit guests and 8 for 64-bit guests.
#define LIX_BANNER_START
The start of the 'linux_proc_banner' string.
void IntLixGuestUnhookGuestCode(void)
Remove the EPT hooks and memcloack from detours and agents.
Arguments of the uninit agent.
INTSTATUS IntKsymInit(void)
Initialize the kallsyms subsystem based on the os info provided by LIX_FIELD(Info, HasKsym*).
INTSTATUS IntTranslateVirtualAddressEx(QWORD Gva, QWORD Cr3, DWORD Flags, VA_TRANSLATION *Translation)
Translates a guest virtual address to a guest physical address.
struct _LIX_AGENT_HANDLER::@101 Args
static INTSTATUS IntLixGuestAllocate(void)
Injects the 'init' agent in order to allocate a memory zone inside the guest.
BOOLEAN IntLixGuestDeployUninitAgent(void)
Inject the 'uninit' agent to free the previously allocated memory for detours/agents.
LIX_KERNEL_MODULE Lix
Valid only for Linux guests.
struct _LIX_GUEST_OS_SPECIFIC::@264 Binprm
static INTSTATUS IntLixGuestResolveOffsets(void)
Finds the offsets required by Introcore.
LIX_FUNCTION * Functions
An array of LIX_FUNCTION to be hooked.
DWORD CpuCount
The number of logical CPUs.
#define LIX_KAISER_ENABLED_PCP_OFFSET_CAP
The max value of 'kaiser_enabled_pcp' offset (the maximum observed was 0xD040 on CentOS - kernel 3...
#define UNREFERENCED_PARAMETER(P)
unsigned int ProtectionBit
INTSTATUS IntLixApiHookAll(void)
Iterates through all APIs that can be hooked and sets requested hooks.
void IntDriverUninit(void)
Uninitializes the drivers submodule.
#define INT_STATUS_DATA_BUFFER_TOO_SMALL
static INTSTATUS IntLixPatchHandler(void *Detour, LIX_ACTIVE_PATCH *ActivePatch)
Handles the incoming patches (ftrace/text_poke) from the guest.
#define INT_STATUS_INVALID_DATA_VALUE
void IntLixAgentInit(void)
Initialize the agents state.
INTSTATUS IntLixDrvCreateFromAddress(QWORD DriverGva, QWORD StaticDetected)
Create the KERNEL_DRIVER object from the provided 'module struct' address and activate the protection...
INTSTATUS IntSyscallRead(DWORD CpuNumber, QWORD *SysStar, QWORD *SysLstar)
Queries the IA32_STAR, and IA32_LSTAR guest MSRs.
INTSTATUS IntLixGuestAllocateDeploy(void)
Deploys the content of Linux detours and the content of the Linux agents.
unsigned char gLixDetours[]
INTSTATUS IntLixFtraceHandler(void *Detour)
Handles the incoming 'text_poke' patches from the guest.
QWORD DataEnd
The guest virtual address where the data ends.
enum _INTRO_ACTION INTRO_ACTION
Event actions.
INTSTATUS IntLixAgentInject(LIX_AGENT_TAG Tag, PFUNC_AgentCallbackHypercall HypercallCallback, PFUNC_AgentCallbackCompletion CompletionCallback)
Schedule an agent injection inside the guest.
INTSTATUS IntLixDrvIterateList(PFUNC_IterateListCallback Callback, QWORD Aux)
Iterates the 'modules' list form the guest and activate protection for each driver that is initialize...
static INTSTATUS IntLixGuestAllocateFill(void)
Fill the required information about the allocated memory zone from the guest.
void IntLixFilesCacheUninit(void)
Removes and frees the entries of the dentry-cache.
QWORD RoDataEnd
The guest virtual address where the read-only data ends.
__must_check INTSTATUS IntVirtMemMap(QWORD Gva, DWORD Length, QWORD Cr3, DWORD Flags, void **HostPtr)
Maps a guest virtual memory range inside Introcore virtual address space.
#define LIX_MODULE_MAPPING_SPACE_START
The start of module mapping region.
void IntLixTaskUninit(void)
Uninitializes the Linux process subsystem.
MM Mm
Guest memory information, such as paging mode, system Cr3 value, etc.
static INTSTATUS IntLixGuestInitAgentHypercall(void *Context)
This callback is called when the 'init' agent has been allocated the memory zone from guest...
BOOLEAN IntLixTaskGuestTerminating(void)
Check whether the guest OS is terminating or not.
QWORD MaskClear
The page attributes that must be cleared.
void IntLixGuestUninitGuestCode(void)
Removes the EPT hooks from detours/agents memory zone and clears these memory zones.
GUEST_STATE gGuest
The current guest state.
void * Content
The content of the arguments.
unsigned int VmNextOffset
QWORD PageSize
The page size used for this translation.
#define STATIC_ASSERT(Cond, Msg)
INTSTATUS IntKernVirtMemRead(QWORD KernelGva, DWORD Length, void *Buffer, DWORD *RetLength)
Reads data from a guest kernel virtual memory range.
DWORD gLinuxDistSigsCount
The number of distro signatures from gLinuxDistSigs.
LINUX_GUEST _LinuxGuest
Linux specific information. Valid when OSType is introGuestLinux.
BOOLEAN KptiInstalled
True if KPTI was detected as installed (not necessarily active).
INTSTATUS IntHookObjectHookRegion(void *Object, QWORD Cr3, QWORD Gla, SIZE_T Length, BYTE Type, void *Callback, void *Context, DWORD Flags, HOOK_REGION_DESCRIPTOR **Region)
Hook a contiguous region of virtual memory inside the provided virtual address space.
__must_check INTSTATUS IntPhysMemMap(QWORD PhysAddress, DWORD Length, DWORD Flags, void **HostPtr)
Maps a guest physical address inside Introcore VA space.
INTSTATUS IntLixIdtProtectAll(void)
Activates protection for IDT on all CPUs.
Encapsulates information about a virtual to physical memory translation.
QWORD SyscallAddress
The guest virtual address of the syscall.
static INTSTATUS IntLixGuestFindKernelBase(QWORD StartGva)
Scans pages from guest memory, starting from the provided StartGva, until we find a signature that ma...
#define INT_STATUS_INVALID_PARAMETER_1
#define INT_STATUS_NOT_SUPPORTED
INTSTATUS IntMemClkUncloakRegion(void *CloakHandle, DWORD Options)
Removes a cloak region, making the original memory contents available again to the guest...
VCPU_STATE * gVcpu
The state of the current VCPU.
static INTSTATUS IntLixGuestActivateProtection(void)
Activates the protection for a Linux guest.
static INTSTATUS IntLixGuestInit(void)
Initializes a new Linux guest.
static INTSTATUS IntLixFindDataStart(void)
Decodes each instruction of the 'mark_rodata_ro' function and searches for end of ...
QWORD Base
The base GVA of the section.
Describes a signature that can be used for searching or matching guest contents.
DWORD ActiveCpuCount
The number of CPUs actually used by the guest.
#define INTRO_OPT_PROT_KM_CR4
Enable CR4.SMEP and CR4.SMAP protection.
void IntDisasmGva(QWORD Gva, DWORD Length)
This function disassembles a code buffer (given its GVA) and then dumps the instructions (textual dis...
Used for 'ftrace'.
Section will contain distribution signatures.
INTSTATUS IntLixJumpLabelHandler(void *Detour)
Handles the incoming read (arch_jmp_label_transform) from the guest.
BOOLEAN DisableOnReturn
Set to True if after returning from this event handler, introcore must be unloaded.
QWORD Gva
The start of the region which follows to be patched.
BYTE Version
The version field of the version string.
static void IntLixGuestResolveSymbols(void)
Searches for the 'memcpy', '__memcpy', 'memset', '__memset' and 'memmove' ksyms.
QWORD IntKsymFindByName(const char *Name, QWORD *SymEnd)
Searches the given Name in kallsyms and returns the Start & End offset.
INTSTATUS IntLixKernelWriteProtect(void)
Activates kernel protection.
INTSTATUS IntCr4Protect(void)
Activates the Cr4 protection.
DWORD CurrentTaskOffset
The offset of the current task from GS.
static INTSTATUS IntLixGuestInitAgentCompletion(void *Context)
This callback is called when the 'init' agent completed the execution and the protection can be activ...
INTSTATUS IntPhysMemUnmap(void **HostPtr)
Unmaps an address previously mapped with IntPhysMemMap.
INTSTATUS IntNotifyIntroDetectedOs(INTRO_GUEST_TYPE OsType, DWORD OsVersion, BOOLEAN Is64)
Wrapper over GLUE_IFACE.NotifyIntrospectionDetectedOs.
struct _LIX_GUEST_OS_SPECIFIC::@267 Inode
INTRO_PROT_OPTIONS CoreOptions
The activation and protection options for this guest.
INTSTATUS IntDecDecodeInstruction(IG_CS_TYPE CsType, QWORD Gva, void *Instrux)
Decode an instruction from the provided guest linear address.
QWORD ExTableEnd
The guest virtual address where the ex-table ends.
INTSTATUS IntHookObjectCreate(DWORD ObjectType, QWORD Cr3, void **Object)
Create a new hook object.
Arguments of the init agent.
QWORD PropperSyscallGva
The guest virtual address of the 'real' syscall.
#define INTRO_OPT_PROT_KM_GDTR
Enable global descriptor-table registers protection.
void IntLixAgentEnableInjection(void)
Enables agent injections.
INTSTATUS IntCamiLoadSection(DWORD CamiSectionHint)
Load CAMI objects from section with given hint.
struct _LIX_GUEST_OS_SPECIFIC::@261 Vma
#define INT_STATUS_INSUFFICIENT_RESOURCES