lixguest.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _LIXGUEST_H_
#define _LIXGUEST_H_

#include "detours.h"

// According to Documentation/x86/x86_64/mm.txt
#define IS_KERNEL_POINTER_LIX(p) (((p) >= 0xFFFF800000000000) && ((p) < 0xffffffffffe00000))


typedef struct _LIX_PROTECTED_PROCESS
{
    LIST_ENTRY  Link;                   

    CHAR        CommPattern[16];
    QWORD       Flags;                  
    PCHAR       NamePattern;            
    PCHAR       CommFullPattern;        
    QWORD       Context;                

    struct
    {
        QWORD   Original;               
        QWORD   Current;                

        QWORD   Beta;                   
        QWORD   Feedback;               
    } Protection;
} LIX_PROTECTED_PROCESS, *PLIX_PROTECTED_PROCESS;


#define LIX_MAX_HOOKED_FN_COUNT         512
#define LIX_MAX_VERSION_STRINGS         3

#define MAX_VERSION_LENGTH              256


typedef struct _LIX_FUNCTION
{
    DWORD       NameHash;       
    DWORD       HookHandler;    
    BOOLEAN     SkipOnBoot;     
} LIX_FUNCTION;


typedef enum LIX_STRUCTURE
{
    lixStructureInfo = 0,           
    lixStructureModule,             
    lixStructureBinprm,             
    lixStructureVma,                
    lixStructureDentry,             
    lixStructureMmStruct,           
    lixStructureTaskStruct,         
    lixStructureFs,                 
    lixStructureFdTable,            
    lixStructureFiles,              
    lixStructureInode,              
    lixStructureSocket,             
    lixStructureSock,               
    lixStructureCred,               
    lixStructureNsProxy,            
    lixStructureUngrouped,          
    lixStructureEnd                 
} LIX_STRUCTURE;


typedef enum _LIX_FIELD_INFO
{
    lixFieldInfoThreadSize = 0,         
    lixFieldInfoHasModuleLayout,        
    lixFieldInfoHasVdsoImageStruct,     
    lixFieldInfoHasSmallSlack,          
    lixFieldInfoHasKsymRelative,
    lixFieldInfoHasKsymAbsolutePercpu,
    lixFieldInfoHasKsymSize,
    lixFieldInfoHasAlternateSyscall,    
    lixFieldInfoHasVmaAdjustExpand,     
    lixFieldInfoHasVdsoFixed,           
    lixFieldInfoHasKsymReducedSize,     
    lixFieldInfoHasSlackInt3,           
    lixFieldInfoCredAltered,            
    lixFieldInfoEnd                     
} LIX_FIELD_INFO;


typedef enum _LIX_FIELD_MODULE
{
    lixFieldModuleSizeof = 0,           
    lixFieldModuleList,                 
    lixFieldModuleName,                 
    lixFieldModuleSymbols,              
    lixFieldModuleNumberOfSymbols,      
    lixFieldModuleGplSymbols,           
    lixFieldModuleNumberOfGplSymbols,   
    lixFieldModuleInit,                 
    lixFieldModuleModuleInit,           
    lixFieldModuleModuleCore,           
    lixFieldModuleInitSize,             
    lixFieldModuleCoreSize,             
    lixFieldModuleInitTextSize,         
    lixFieldModuleCoreTextSize,         
    lixFieldModuleInitRoSize,           
    lixFieldModuleCoreRoSize,           
    lixFieldModuleCoreLayout,           
    lixFieldModuleInitLayout,           
    lixFieldModuleState,                
    lixFieldModuleEnd                   
} LIX_FIELD_MODULE;


typedef enum _LIX_FIELD_BINPRM
{
    lixFieldBinprmSizeof = 0,           
    lixFieldBinprmMm,                   
    lixFieldBinprmFile,                 
    lixFieldBinprmCred,                 
    lixFieldBinprmFilename,             
    lixFieldBinprmInterp,               
    lixFieldBinprmVma,                  
    lixFieldBinprmArgc,                 
    lixFieldBinprmEnd                   
} LIX_FIELD_BINPRM;


typedef enum _LIX_FIELD_VMA
{
    lixFieldVmaVmaStart = 0,            
    lixFieldVmaVmaEnd,                  
    lixFieldVmaVmNext,                  
    lixFieldVmaVmPrev,                  
    lixFieldVmaMm,                      
    lixFieldVmaFlags,                   
    lixFieldVmaFile,                    
    lixFieldVmaRbNode,                  
    lixFieldVmaEnd                      
} LIX_FIELD_VMA;


typedef enum _LIX_FIELD_DENTRY
{
    lixFieldDentryParent = 0,           
    lixFieldDentryName,                 
    lixFieldDentryDiname,               
    lixFieldDentryInode,                
    lixFieldDentryHashList,             
    lixFieldDentryEnd                   
} LIX_FIELD_DENTRY;


typedef enum _LIX_FIELD_MMSTRUCT
{
    lixFieldMmStructPgd = 0,            
    lixFieldMmStructMmUsers,            
    lixFieldMmStructMmCount,            
    lixFieldMmStructMmList,             
    lixFieldMmStructStartCode,          
    lixFieldMmStructEndCode,            
    lixFieldMmStructStartData,          
    lixFieldMmStructEndData,            
    lixFieldMmStructFlags,              
    lixFieldMmStructExeFile,            
    lixFieldMmStructVma,                
    lixFieldMmStructStartStack,         
    lixFieldMmStructRbNode,             
    lixFieldMmStructVdsoAddress,        
    lixFieldMmStructEnd                 
} LIX_FIELD_MMSTRUCT;


typedef enum _LIX_FIELD_TASKSTRUCT
{
    lixFieldTaskStructStack = 0,        
    lixFieldTaskStructUsage,            
    lixFieldTaskStructFlags,            
    lixFieldTaskStructTasks,            
    lixFieldTaskStructPid,              
    lixFieldTaskStructTgid,             
    lixFieldTaskStructRealParent,       
    lixFieldTaskStructParent,           
    lixFieldTaskStructMm,               
    lixFieldTaskStructStartTime,        
    lixFieldTaskStructComm,             
    lixFieldTaskStructSignal,           
    lixFieldTaskStructExitCode,         
    lixFieldTaskStructThreadNode,       
    lixFieldTaskStructThreadGroup,      
    lixFieldTaskStructCred,             
    lixFieldTaskStructFs,               
    lixFieldTaskStructFiles,            
    lixFieldTaskStructNsProxy,          
    lixFieldTaskStructGroupLeader,      
    lixFieldTaskStructExitSignal,       
    lixFieldTaskStructInExecve,         
    lixFieldTaskStructInExecveBit,      
    lixFieldTaskStructThreadStructSp,   
    lixFieldTaskStructAltStackSp,       
    lixFieldTaskStructEnd               
} LIX_FIELD_TASKSTRUCT;


typedef enum _LIX_FIELD_FS
{
    lixFieldFsSizeof = 0,               
    lixFieldFsRoot,                     
    lixFieldFsPwd,                      
    lixFieldFsEnd                       
} LIX_FIELD_FS;


typedef enum _LIX_FIELD_FDTABLE
{
    lixFieldFdTableMaxFds = 0,          
    lixFieldFdTableFd,                  
    lixFieldFdTableEnd                  
} LIX_FIELD_FDTABLE;


typedef enum _LIX_FIELD_FILES
{
    lixFieldFilesSizeof = 0,            
    lixFieldFilesFdt,                   
    lixFieldFilesEnd                    
} LIX_FIELD_FILES;


typedef enum _LIX_FIELD_INODE
{
    lixFieldInodeSizeof = 0,            
    lixFieldInodeImode,                 
    lixFieldInodeUid,                   
    lixFieldInodeGid,                   
    lixFieldInodeEnd                    
} LIX_FIELD_INODE;


typedef enum _LIX_FIELD_SOCKET
{
    lixFieldSocketState = 0,            
    lixFieldSocketType,                 
    lixFieldSocketFlags,                
    lixFieldSocketSk,                   
    lixFieldSocketEnd                   
} LIX_FIELD_SOCKET;


typedef enum _LIX_FIELD_SOCK
{
    lixFieldSockSizeof = 0,             
    lixFieldSockNum,                    
    lixFieldSockDport,                  
    lixFieldSockDaddr,                  
    lixFieldSockRcvSaddr,               
    lixFieldSockFamily,                 
    lixFieldSockState,                  
    lixFieldSockProto,                  
    lixFieldSockV6Daddr,                
    lixFieldSockV6RcvSaddr,             
    lixFieldSockEnd                     
} LIX_FIELD_SOCK;


typedef enum _LIX_FIELD_CRED
{
    lixFieldCredSizeof = 0,             
    lixFieldCredUsage,                  
    lixFieldCredRcu,                    
    lixFieldCredEnd                     
} LIX_FIELD_CRED;


typedef enum _LIX_FIELD_NSPROXY
{
    lixFieldNsProxyCount = 0,           
    lixFieldNsProxyUts,                 
    lixFieldNsProxyIpc,                 
    lixFieldNsProxyMnt,                 
    lixFieldNsProxyPid,                 
    lixFieldNsProxyNet,                 
    lixFieldNsProxyEnd                  
} LIX_FIELD_NSPROXY;


typedef enum _LIX_FIELD_UNGROUPED
{
    lixFieldUngroupedFileDentry = 0,        
    lixFieldUngroupedProtoName,             
    lixFieldUngroupedSignalListHead,        
    lixFieldUngroupedSocketAllocVfsInode,
    lixFieldUngroupedRunning,               
    lixFieldUngroupedFilePath,              
    lixFieldUngroupedSignalNrThreads,       
    lixFieldUngroupedEnd                    
} LIX_FIELD_UNGROUPED;


typedef struct _LIX_OPAQUE_FIELDS
{
    DWORD               HooksId;                    

    DWORD               FunctionsCount;             
    LIX_FUNCTION        *Functions;                 

    struct
    {
        DWORD Info[lixFieldInfoEnd];                
        DWORD Module[lixFieldModuleEnd];            
        DWORD Binprm[lixFieldBinprmEnd];            
        DWORD Vma[lixFieldVmaEnd];                  
        DWORD Dentry[lixFieldDentryEnd];            
        DWORD MmStruct[lixFieldMmStructEnd];        
        DWORD TaskStruct[lixFieldTaskStructEnd];    
        DWORD Fs[lixFieldFsEnd];                    
        DWORD FdTable[lixFieldFdTableEnd];          
        DWORD Files[lixFieldFilesEnd];              
        DWORD Inode[lixFieldInodeEnd];              
        DWORD Socket[lixFieldSocketEnd];            
        DWORD Sock[lixFieldSockEnd];                
        DWORD Cred[lixFieldCredEnd];                
        DWORD NsProxy[lixFieldNsProxyEnd];          
        DWORD Ungrouped[lixFieldUngroupedEnd];      
    } OpaqueFields;

    DWORD               CurrentTaskOffset;          
    DWORD               CurrentCpuOffset;           
    DWORD               ThreadStructOffset;         

} LIX_OPAQUE_FIELDS, *PLIX_OPAQUE_FIELDS;


#define LIX_FIELD(Structure, Field)      gLixGuest->OsSpecificFields.OpaqueFields.Structure[lixField##Structure##Field]


typedef struct _LIX_SYMBOL
{
    QWORD       Start;      
    QWORD       End;        
} LIX_SYMBOL, *PLIX_SYMBOL;


typedef enum _LIX_ACTIVE_PATCH_TYPE
{
    lixActivePatchTextPoke = 0,     
    lixActivePatchFtrace,           
    lixActivePatchJmpLabel,         

    lixActivePatchCount             
} LIX_ACTIVE_PATCH_TYPE;


typedef struct _LIX_ACTIVE_PATCH
{
    QWORD       Gva;                
    WORD        Length;             
    BYTE        Data[32];           

    BOOLEAN     IsDetour;           
    DETOUR_TAG  DetourTag;
} LIX_ACTIVE_PATCH;


typedef struct _LINUX_GUEST
{
    union
    {
        DWORD Value;            

        struct
        {
            WORD Sublevel;      
            BYTE Patch;         
            BYTE Version;       
            WORD Backport;      
        };
    } Version;

    CHAR    VersionString[MAX_VERSION_LENGTH];              

    // WARNING: These may not be page aligned!
    struct
    {
        QWORD           CodeStart;              
        QWORD           CodeEnd;                

        QWORD           DataStart;              
        QWORD           DataEnd;                

        QWORD           RoDataStart;            
        QWORD           RoDataEnd;              

        QWORD           ExTableStart;           
        QWORD           ExTableEnd;             
    } Layout;

    BOOLEAN             Initialized;                    

    LIX_SYMBOL          MemoryFunctions[5];

    struct
    {
        QWORD           Vsyscall;               

        QWORD           VdsoStart;              
        QWORD           VdsoEnd;                

        QWORD           Vdso32Start;            
        QWORD           Vdso32End;              
    } Vdso;

    LIX_ACTIVE_PATCH    ActivePatch[lixActivePatchCount];

    QWORD               SyscallAddress;         
    QWORD               PropperSyscallGva;      

    void                *InitProcessObj;        

    struct
    {
        struct
        {
            BOOLEAN Initialized;                
            BOOLEAN Cleared;                    

            struct
            {
                QWORD Address;                  
                DWORD Length;                   

                void  *HookObject;              
            } Code;

            struct
            {
                QWORD Address;                  
                DWORD Length;                   

                void  *HookObject;              
            } Data;
        } Detour;

        struct
        {
            BOOLEAN Initialized;                
            BOOLEAN Cleared;                    

            QWORD   Address;                    
            DWORD   Length;                     


            void    *HookObject;                
        } Agent;

        struct
        {
            QWORD PerCpuAddress;                
            DWORD PerCpuLength;                 
        } PerCpuData;

        QWORD OriginalPagesAttr;                
    } MmAlloc;

    LIX_OPAQUE_FIELDS   OsSpecificFields;       
} LINUX_GUEST, *PLINUX_GUEST;

#define LIX_SYMBOL_NAME_LEN       128


#define LIX_GET_VERSION(Version)                  ((Version) >> 24)
#define LIX_GET_PATCH(Version)                    (((Version) & 0x00ff0000) >> 16)
#define LIX_GET_SUBLEVEL(Version)                 (((Version) & 0x0000ffff))

#define LIX_CREATE_VERSION(K, Patch, Sublevel)    ((Sublevel) | ((Patch) << 16) | ((K) << 24))

extern const LIX_FN_DETOUR gLixHookHandlersx64[];

INTSTATUS
IntLixTextPokeHandler(
    _In_ void *Detour
    );

INTSTATUS
IntLixFtraceHandler(
    _In_ void *Detour
    );

INTSTATUS
IntLixJumpLabelHandler(
    _In_ void *Detour
    );

INTSTATUS
IntLixGuestIsKptiActive(
    _In_ QWORD SyscallGva
    );

INTSTATUS
IntLixGuestNew(
    void
    );

void
IntLixGuestUninit(
    void
    );

int
IntLixGuestGetSystemState(
    void
    );

void
IntLixGuestUninitGuestCode(
    void
    );

BOOLEAN
IntLixGuestDeployUninitAgent(
    void
    );

INTSTATUS
IntGetVersionStringLinux(
    _In_  DWORD FullStringSize,
    _In_  DWORD VersionStringSize,
    _Out_ CHAR *FullString,
    _Out_ CHAR *VersionString
    );

#endif