lixmm.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "lixmm.h"
#include "alerts.h"
#include "hook.h"
#include "lixfiles.h"
#include "lixnet.h"
#include "scan_engines.h"
#include "shellcode.h"
#include "lixksym.h"
#include "lixfastread.h"

#define LIX_VMA_VDSO_FLAGS      (VM_READ | VM_EXEC | VM_DONTEXPAND | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)

#define LIX_VMA_PROT_MASK       BIT(63)

#define LIX_VMA_IS_VDSO(Vma)    (((((Vma)->Flags & LIX_VMA_VDSO_FLAGS) == LIX_VMA_VDSO_FLAGS) && (0 == (Vma)->File) && (IntLixVmaGetPageCount(Vma) <= 2)))

#define LIX_VMA_MAX_GUEST       (10 * 4096)

#define for_each_vad(Process, _var_name)        list_for_each((Process)->Vmas, LIX_VMA, _var_name)


static INTSTATUS
IntLixVmaFill(
    _In_ QWORD VmaGva,
    _In_opt_ LIX_TASK_OBJECT *Process,
    _Out_ LIX_VMA *Vma
    );


static inline size_t
IntLixVmaGetPageCount(
    _In_ const LIX_VMA *Vma
    )
{
#ifdef DEBUG
    if (Vma->Start >= Vma->End)
    {
        ERROR("[ERROR] Invalid VMA [%llx - %llx]\n", Vma->Start, Vma->End);
        IntDumpGva(Vma->Gva, 0x100, gGuest.Mm.SystemCr3);

        return 0;
    }
#endif

    return (Vma->End - Vma->Start) / PAGE_SIZE;
}


INTSTATUS
IntLixMmGetInitMm(
    _Out_ QWORD *InitMm
    )
{
    INTSTATUS status;
    QWORD startGva;

    if (NULL == InitMm)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    // It should be there, except on Debian
    startGva = IntKsymFindByName("init_mm", NULL);
    if (startGva)
    {
        *InitMm = startGva;
        return INT_STATUS_SUCCESS;
    }

    for (startGva = gLixGuest->Layout.DataStart & PAGE_MASK;
         startGva < gLixGuest->Layout.DataEnd;
         startGva += PAGE_SIZE)
    {
        BYTE *p;
        BOOLEAN found = FALSE;

        status = IntVirtMemMap(startGva, PAGE_SIZE, gGuest.Mm.SystemCr3, 0, &p);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntVirtMemMap failed for 0x%016llx: 0x%08x\n", startGva, status);
            continue;
        }

        for (QWORD mm = startGva; mm < startGva + PAGE_SIZE; mm += sizeof(QWORD))
        {
            QWORD pgd, next, prev;
            QWORD startCode, endCode, startData, endData;
            DWORD offset = mm & PAGE_OFFSET;

            // 1. init_mm.pgd inside .data
            if (offset + LIX_FIELD(MmStruct, Pgd) >= PAGE_SIZE)
            {
                status = IntKernVirtMemFetchQword(mm + LIX_FIELD(MmStruct, Pgd), &pgd);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntKernVirtMemFetchQword failed for 0x%016llx: 0x%08x\n",
                          mm + LIX_FIELD(MmStruct, Pgd), status);
                    continue;
                }
            }
            else
            {
                pgd = *(QWORD *)(p + offset + LIX_FIELD(MmStruct, Pgd));
            }

            if (pgd < gLixGuest->Layout.DataStart || pgd > gLixGuest->Layout.DataEnd)
            {
                continue;
            }

            // 2. init_mm.mmlist it's a list
            // init_mm.mmlist->next->prev = init_mm
            // init_mm.mmlist->prev->next = init_mm
            if (offset + LIX_FIELD(MmStruct, MmList) + 8 >= PAGE_SIZE)
            {
                status = IntKernVirtMemFetchQword(mm + LIX_FIELD(MmStruct, MmList), &next);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntKernVirtMemFetchQword failed for 0x%016llx: 0x%08x\n",
                          mm + LIX_FIELD(MmStruct, MmList), status);
                    continue;
                }

                status = IntKernVirtMemFetchQword(mm + LIX_FIELD(MmStruct, MmList) + 8, &prev);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntVirtMemFetchQword failed for 0x%016llx: 0x%08x\n",
                          mm + LIX_FIELD(MmStruct, MmList) + 8, status);
                    continue;
                }
            }
            else
            {
                next = *(QWORD *)(p + offset + LIX_FIELD(MmStruct, MmList));
                prev = *(QWORD *)(p + offset + LIX_FIELD(MmStruct, MmList) + 8);
            }

            if (!IS_KERNEL_POINTER_LIX(prev) ||
                !IS_KERNEL_POINTER_LIX(next) ||
                prev == 0xffffffffffffffff || next == 0xffffffffffffffff)
            {
                continue;
            }

            if (prev != mm + LIX_FIELD(MmStruct, MmList) + 8)
            {
                QWORD prevNext;

                status = IntKernVirtMemFetchQword(prev, &prevNext);
                if (!INT_SUCCESS(status))
                {
                    continue;
                }

                if (prevNext != mm + LIX_FIELD(MmStruct, MmList))
                {
                    continue;
                }
            }

            if (next != mm + LIX_FIELD(MmStruct, MmList))
            {
                QWORD nextPrev;

                status = IntKernVirtMemFetchQword(next + 8, &nextPrev);
                if (!INT_SUCCESS(status))
                {
                    continue;
                }

                if (nextPrev != mm + LIX_FIELD(MmStruct, MmList))
                {
                    continue;
                }
            }

            // 3. init_mm.start_code = _stext
            if (offset + LIX_FIELD(MmStruct, StartCode) >= PAGE_SIZE)
            {
                status = IntKernVirtMemFetchQword(mm + LIX_FIELD(MmStruct, StartCode), &startCode);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntKernVirtMemFetchQword failed for 0x%016llx: 0x%08x\n",
                          mm + LIX_FIELD(MmStruct, StartCode), status);
                    continue;
                }
            }
            else
            {
                startCode = *(QWORD *)(p + offset + LIX_FIELD(MmStruct, StartCode));
            }

            if (startCode != gLixGuest->Layout.CodeStart)
            {
                continue;
            }

            // 4. init_mm.end_code = _etext
            if (offset + LIX_FIELD(MmStruct, EndCode) >= PAGE_SIZE)
            {
                status = IntKernVirtMemFetchQword(mm + LIX_FIELD(MmStruct, EndCode), &endCode);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntKernVirtMemFetchQword failed for 0x%016llx: 0x%08x\n",
                          mm + LIX_FIELD(MmStruct, EndCode), status);
                    continue;
                }
            }
            else
            {
                endCode = *(QWORD *)(p + offset + LIX_FIELD(MmStruct, EndCode));
            }

            if (endCode != gLixGuest->Layout.CodeEnd)
            {
                continue;
            }

            // 5. init_mm.start_data = 0 || _etext
            if (offset + LIX_FIELD(MmStruct, StartData) >= PAGE_SIZE)
            {
                status = IntKernVirtMemFetchQword(mm + LIX_FIELD(MmStruct, StartData), &startData);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntKernVirtMemFetchQword failed for 0x%016llx: 0x%08x\n",
                          mm + LIX_FIELD(MmStruct, StartData), status);
                    continue;
                }
            }
            else
            {
                startData = *(QWORD *)(p + offset + LIX_FIELD(MmStruct, StartData));
            }

            if (startData != 0 && startData != gLixGuest->Layout.DataStart)
            {
                continue;
            }

            // 6. init_mm.start_data = 0 || _etext
            if (offset + LIX_FIELD(MmStruct, StartData) >= PAGE_SIZE)
            {
                status = IntKernVirtMemFetchQword(mm + LIX_FIELD(MmStruct, StartData), &startData);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntKernVirtMemFetchQword failed for 0x%016llx: 0x%08x\n",
                          mm + LIX_FIELD(MmStruct, StartData), status);
                    continue;
                }
            }
            else
            {
                startData = *(QWORD *)(p + offset + LIX_FIELD(MmStruct, StartData));
            }

            if (startData != 0 && startData != gLixGuest->Layout.DataStart)
            {
                continue;
            }

            // 6. init_mm.end_data = 0 || _edata
            if (offset + LIX_FIELD(MmStruct, EndData) >= PAGE_SIZE)
            {
                status = IntKernVirtMemFetchQword(mm + LIX_FIELD(MmStruct, EndData), &endData);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntKernVirtMemFetchQword failed for 0x%016llx: 0x%08x\n",
                          mm + LIX_FIELD(MmStruct, EndData), status);
                    continue;
                }
            }
            else
            {
                endData = *(QWORD *)(p + offset + LIX_FIELD(MmStruct, EndData));
            }

            // There are some cases when we can't get the real _edata, and we have to approximate
            if (endData && (endData > gLixGuest->Layout.DataEnd || endData < gLixGuest->Layout.DataStart))

            {
                continue;
            }

            TRACE("[LIXMM] Found init_mm @ 0x%016llx\n", mm);

            *InitMm = mm;

            found = TRUE;

            break;
        }

        IntVirtMemUnmap(&p);

        if (found)
        {
            return INT_STATUS_SUCCESS;
        }
    }

    return INT_STATUS_NOT_FOUND;
}


static INTSTATUS
IntLixMmFindVmaInLinkedList(
    _In_ QWORD MmGva,
    _In_ QWORD Address,
    _Out_ QWORD *VmaGva,
    _In_ BOOLEAN Backward
    )
{
    INTSTATUS status;
    DWORD maxIterations = LIX_VMA_MAX_GUEST;
    QWORD currentVma;
    DWORD offset;

    if (Backward)
    {
        offset = LIX_FIELD(Vma, VmPrev);
    }
    else
    {
        offset = LIX_FIELD(Vma, VmNext);
    }

    status = IntKernVirtMemFetchQword(MmGva + LIX_FIELD(MmStruct, Vma), &currentVma);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemFetchQword failed for 0x%llx: 0x%08x\n", MmGva + LIX_FIELD(MmStruct, Vma), status);
        return status;
    }

    while (IS_KERNEL_POINTER_LIX(currentVma) && maxIterations > 0)
    {
        QWORD nextVma = 0;
        QWORD start, end;

        status = IntLixFsrInitMap(currentVma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixFsrInitMap failed for vma 0x%llx: 0x%08x\n", currentVma, status);
            return status;
        }

        status = IntLixFsrRead(currentVma, LIX_FIELD(Vma, VmaEnd), sizeof(end), &end);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to read from vma 0x%llx at offset 0x%x. Status: 0x%08x\n",
                  currentVma, LIX_FIELD(Vma, VmaEnd), status);
            goto _done_unmap;
        }

        status = IntLixFsrRead(currentVma, LIX_FIELD(Vma, VmaStart), sizeof(start), &start);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to read from vma 0x%llx at offset 0x%x. Status: 0x%08x\n",
                  currentVma, LIX_FIELD(Vma, VmaStart), status);

            goto _done_unmap;
        }

        if (IN_RANGE(Address, start, end))
        {
            *VmaGva = currentVma;

            status = INT_STATUS_SUCCESS;

            goto _done_unmap;
        }

        status = IntLixFsrRead(currentVma, offset, sizeof(nextVma), &nextVma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to read next vma from 0x%llx at offset 0x%x. Status: 0x%08x\n",
                  currentVma, offset, status);

            goto _done_unmap;
        }

        IntLixFsrUninitMap();

        currentVma = nextVma;
        maxIterations--;
    }

    return INT_STATUS_NOT_FOUND;

_done_unmap:

    IntLixFsrUninitMap();

    return status;
}


INTSTATUS
IntLixMmFindVmaInRbTree(
    _In_ QWORD MmGva,
    _In_ QWORD Address,
    _Out_ QWORD *VmaGva
    )
{
    INTSTATUS status;
    QWORD rbGva, vmaGva;
    LIX_RB_NODE node;
    QWORD vmaStart, vmaEnd;
    QWORD maxIterations = 64;

    vmaStart = vmaEnd = rbGva = 0;

    status = IntKernVirtMemFetchQword(MmGva + LIX_FIELD(MmStruct, RbNode), &rbGva);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed to read rb_node for mm 0x%llx. Status: 0x%08x\n", MmGva, status);
        return status;
    }

    while (rbGva)
    {
        if (!maxIterations--)
        {
            ERROR("[ERROR] Max iterations limit reached!\n");
            return INT_STATUS_NOT_FOUND;
        }

        vmaGva = rbGva - LIX_FIELD(Vma, RbNode);

        status = IntLixFsrInitMap(vmaGva);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to map vma 0x%llx. Status: 0x%08x\n", vmaGva, status);
            return status;
        }

        status = IntLixFsrRead(vmaGva, LIX_FIELD(Vma, VmaEnd), sizeof(vmaEnd), &vmaEnd);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to read from vma 0x%llx at offset 0x%x. Status: 0x%08x\n",
                  vmaGva, LIX_FIELD(Vma, VmaEnd), status);

            goto _done_unmap;
        }

        status = IntLixFsrRead(vmaGva, LIX_FIELD(Vma, RbNode), sizeof(node), &node);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to read from vma 0x%llx at offset 0x%x. Status: 0x%08x\n",
                  vmaGva, LIX_FIELD(Vma, RbNode), status);

            goto _done_unmap;
        }

        if (vmaEnd > Address)
        {
            status = IntLixFsrRead(vmaGva, LIX_FIELD(Vma, VmaStart), sizeof(vmaStart), &vmaStart);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] Failed to read from vma 0x%llx at offset 0x%x. Status: 0x%08x\n",
                      vmaGva, LIX_FIELD(Vma, VmaStart), status);
                goto _done_unmap;
            }

            if (vmaStart <= Address)
            {
                *VmaGva = vmaGva;

                status = INT_STATUS_SUCCESS;

                goto _done_unmap;
            }

            rbGva = node.Left;
        }
        else
        {
            rbGva = node.Right;
        }

        IntLixFsrUninitMap();
    }

    return INT_STATUS_NOT_FOUND;

_done_unmap:

    IntLixFsrUninitMap();

    return status;
}


INTSTATUS
IntLixMmFetchVma(
    _In_ LIX_TASK_OBJECT *Task,
    _In_ QWORD Address,
    _Out_ LIX_VMA *Vma
    )
{
    INTSTATUS status;
    QWORD vmaGva;

    if (Task == NULL)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == Vma)
    {
        return INT_STATUS_INVALID_PARAMETER_3;
    }

    status = IntLixMmFindVmaInRbTree(Task->MmGva, Address, &vmaGva);
    if (INT_SUCCESS(status))
    {
        goto _fill;
    }

    WARNING("[WARNING] Failed to find addr 0x%llx in rbtree for task %s (%d, 0x%llx), mm 0x%llx. Status: 0x%08x\n",
            Address, Task->Comm, Task->Pid, Task->Gva, Task->MmGva, status);

    status = IntLixMmFindVmaInLinkedList(Task->MmGva, Address, &vmaGva, FALSE);
    if (INT_SUCCESS(status))
    {
        goto _fill;
    }

    status = IntLixMmFindVmaInLinkedList(Task->MmGva, Address, &vmaGva, TRUE);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed to find addr in linked list\n");
        return INT_STATUS_NOT_FOUND;
    }

_fill:

    return IntLixVmaFill(vmaGva, Task, Vma);
}


INTSTATUS
IntLixMmFindVmaRange(
    _In_ QWORD Gva,
    _In_ LIX_TASK_OBJECT *Task,
    _Out_ QWORD *VmaStart,
    _Out_ QWORD *VmaEnd
    )
{
    LIX_VMA vad;
    INTSTATUS status;

    if (IS_KERNEL_POINTER_LIX(Gva))
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == Task)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    if (NULL == VmaStart)
    {
        return INT_STATUS_INVALID_PARAMETER_3;
    }

    if (NULL == VmaEnd)
    {
        return INT_STATUS_INVALID_PARAMETER_4;
    }

    *VmaStart = *VmaEnd = 0;

    status = IntLixMmFetchVma(Task, Gva, &vad);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixMmFetchVma failed for task %s(%d, 0x%llx) gva 0x%llx, mm 0x%llx. Status: 0x%08x\n",
              Task->Comm, Task->Pid, Task->Gva, Gva, Task->MmGva, status);
        return status;
    }

    *VmaStart = vad.Start;
    *VmaEnd = vad.End;

    return INT_STATUS_SUCCESS;
}


LIX_VMA *
IntLixMmFindVmaByRange(
    _In_ const LIX_TASK_OBJECT *Process,
    _In_ QWORD Address
    )
{
    for_each_vad(Process, pVma)
    {
        if (Address >= pVma->Start && Address < pVma->End)
        {
            return pVma;
        }
    }

    return NULL;
}


static LIX_VMA *
IntLixVmaFindByGva(
    _In_ const LIX_TASK_OBJECT *Process,
    _In_ QWORD Vma
    )
{
    for_each_vad(Process, pVma)
    {
        if (Vma == pVma->Gva)
        {
            return pVma;
        }
    }

    return NULL;
}


static INTSTATUS
IntLixVmaFill(
    _In_ QWORD VmaGva,
    _In_opt_ LIX_TASK_OBJECT *Process,
    _Out_ LIX_VMA *Vma
    )
{
    INTSTATUS status;

    memzero(Vma, sizeof(*Vma));

    status = IntLixFsrInitMap(VmaGva);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixFsrInitMap failed for vma %llx: 0x%08x\n", VmaGva, status);
        return status;
    }

    Vma->Gva = VmaGva;

    status = IntLixFsrRead(VmaGva, LIX_FIELD(Vma, VmaStart), sizeof(Vma->Start), &Vma->Start);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed reading vm_area_struct->vm_start: %08x\n", status);
        goto _done;
    }

    status = IntLixFsrRead(VmaGva, LIX_FIELD(Vma, VmaEnd), sizeof(Vma->End), &Vma->End);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed reading vm_area_struct->vm_end: %08x\n", status);
        goto _done;
    }

    status = IntLixFsrRead(VmaGva, LIX_FIELD(Vma, Flags), sizeof(Vma->Flags), &Vma->Flags);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed reading vm_area_struct->vm_flags: %08x\n", status);
        goto _done;
    }

    status = IntLixFsrRead(VmaGva, LIX_FIELD(Vma, File), sizeof(Vma->File), &Vma->File);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed reading vm_area_struct->vm_file: %08x\n", status);
        goto _done;
    }

    Vma->Process = Process;

    status = INT_STATUS_SUCCESS;

_done:
    IntLixFsrUninitMap();

    return status;
}


INTSTATUS
IntLixVmaCreate(
    _In_ QWORD VmaGva,
    _In_ LIX_TASK_OBJECT *Process,
    _Out_ LIX_VMA **Vma
    )
{
    INTSTATUS status;
    LIX_VMA *pVma;

    *Vma = NULL;

    pVma = HpAllocWithTag(sizeof(*pVma), IC_TAG_VMA);
    if (NULL == pVma)
    {
        return INT_STATUS_INSUFFICIENT_RESOURCES;
    }

    status = IntLixVmaFill(VmaGva, Process, pVma);
    if (!INT_SUCCESS(status))
    {
        goto _free_vad;
    }

    InsertTailList(&Process->Vmas, &pVma->Link);

    *Vma = pVma;

    status = INT_STATUS_SUCCESS;

_free_vad:
    if (!INT_SUCCESS(status))
    {
        HpFreeAndNullWithTag(&pVma, IC_TAG_VMA);
    }

    return status;
}


LIX_VMA *
IntLixMmFindVma(
    _In_ LIX_TASK_OBJECT *Task,
    _In_ QWORD Vma
    )
{
    for_each_vad(Task, pVma)
    {
        if (pVma->Gva == Vma)
        {
            return pVma;
        }
    }

    return NULL;
}


static INTSTATUS
IntVmaMarkProtection(
    _In_ LIX_VMA *Vma,
    _In_ BOOLEAN Protected
    )
{
    INTSTATUS status;
    QWORD newFlags = 0, oldFlags = 0;

    status = IntKernVirtMemFetchQword(Vma->Gva + LIX_FIELD(Vma, Flags), &oldFlags);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemFetchQword IntVirtMemFetchQwordUnmapV GVA 0x%016llx: %08x\n",
              Vma->Gva + LIX_FIELD(Vma, Flags), status);
        return status;
    }

    if (Protected)
    {
        newFlags = oldFlags | LIX_VMA_PROT_MASK;
    }
    else
    {
        newFlags = oldFlags & (~LIX_VMA_PROT_MASK);
    }

    if (oldFlags == newFlags)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    // NOTE: IntVirtMemSafeWrite should be used instead, but it will induce significant performance penalty.
    status = IntKernVirtMemPatchQword(Vma->Gva + LIX_FIELD(Vma, Flags), newFlags);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemPatchQword failed for GVA 0x%016llx: %08x\n",
              Vma->Gva + LIX_FIELD(Vma, Flags), status);
        return status;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntLixVmaRemoveProtection(
    _In_ LIX_VMA *Vma,
    _In_ BOOLEAN Mark
    )
{
    INTSTATUS status = INT_STATUS_NOT_NEEDED_HINT;

    if (Vma->Hook)
    {
        status = IntHookObjectRemoveRegion((HOOK_REGION_DESCRIPTOR **)&Vma->Hook, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookObjectRemoveRegion failed: %08x\n", status);
        }
    }

    if (Mark)
    {
        status = IntVmaMarkProtection(Vma, FALSE);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntVmaMarkProtection failed: %08x\n", status);
            return status;
        }
    }

    return status;
}


static void
IntLixVmaDestroy(
    _Inout_ LIX_VMA *Vma
    )
{
    IntLixVmaRemoveProtection(Vma, TRUE);

    RemoveEntryList(&Vma->Link);
    HpFreeAndNullWithTag(&Vma, IC_TAG_VMA);
}


void
IntLixMmDestroyVmas(
    _In_ LIX_TASK_OBJECT *Task
    )
{
    for_each_vad(Task, pVma)
    {
        IntLixVmaDestroy(pVma);
    }

    InitializeListHead(&Task->Vmas);
}


static INTSTATUS
IntLixVmaHandlePageExecution(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;
    LIX_VMA *pVma, *pStackVma;
    LIX_TASK_OBJECT *pTask;
    IG_ARCH_REGS *regs;
    INSTRUX *instrux;
    BOOLEAN bRspOut, bIsStack;
    QWORD rip;
    QWORD scflags;
    BOOLEAN detected, feedback, excepted;
    INTRO_ACTION action = introGuestNotAllowed;
    INTRO_ACTION_REASON reason = introReasonUnknown;
    INFO_UD_PENDING *entryPendingUD = NULL;
    EXCEPTION_UM_ORIGINATOR originator = {0};
    EXCEPTION_VICTIM_ZONE victim = {0};

    UNREFERENCED_PARAMETER(Hook);

    *Action = introGuestAllowed;
    detected = excepted = feedback = FALSE;

    regs = &gVcpu->Regs;
    instrux = &gVcpu->Instruction;
    rip = gVcpu->Gla;

    pVma = (LIX_VMA *)Context;
    pTask = pVma->Process;

    entryPendingUD = IntUDGetEntry(regs->Cr3, regs->Rip, pTask->Gva);
    if (NULL != entryPendingUD)
    {
        goto _retry_inject_ud;
    }

    bIsStack = (pVma->Flags & VM_GROWSDOWN) != 0;

    pStackVma = IntLixMmFindVmaByRange(pTask, regs->Rsp);
    if (pStackVma)
    {
        bIsStack = ((rip >= pStackVma->Start) && (rip < pStackVma->End));
    }

    bRspOut = FALSE;

    status = IntShcIsSuspiciousCode(rip, Address, IG_CS_TYPE_INVALID, regs, &scflags);
    if (!INT_SUCCESS(status))
    {
        scflags = 0;
    }

    if (bRspOut || bIsStack)
    {
        // Pivoted stack or executions on the stack trigger detection directly.
        detected = TRUE;
    }
    else if (0 != scflags)
    {
        detected = TRUE;

        // Shellcode flags (as set by the shellcode emulator) may be overridden via CAMI. A flag marked for feedback
        // will cause the alert to be logged & sent, but no actual detection will appear. Note that we force feedback
        // for shellcode flags if and only if all the reported flags are marked as feedback. If there is a single
        // shellcode flag set that is not feedback, a normal detection will be generated.
        if ((scflags & gGuest.ShemuOptions.Feedback) == scflags)
        {
            feedback = TRUE;
        }
    }

    // We did not find malicious activity, send context to the scan engine if we have the options set.
    if (!detected && !!(gGuest.CoreOptions.Current & INTRO_OPT_NOTIFY_ENGINES))
    {
        INTRO_EXEC_INFO executionInfo = { 0 };
        INTSTATUS status2;

        // We could fail the entire EPT callback because of this.
        status2 = IntLixTaskGetUserStack(pTask, NULL, &executionInfo.StackBase, &executionInfo.StackLimit);
        if (!INT_SUCCESS(status2))
        {
            ERROR("[ERROR] Failed to get user mode stack for process %s (%d, 0x%llx). Status: 0x%08x\n",
                  pTask->Comm, pTask->Pid, pTask->Gva, status);
        }

        executionInfo.Rsp = regs->Rsp;
        executionInfo.Length = instrux->Length;

        status2 = IntLixEngExecSendNotification(pTask, regs, &executionInfo);
        if (!INT_SUCCESS(status2))
        {
            WARNING("[WARNING] IntLixEngExecSendNotification failed: 0x%08x\n", status2);
        }
    }

    if (detected)
    {
        status = IntExceptUserGetExecOriginator(pTask, &originator);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed getting originator: 0x%08x\n", status);
            goto _send_notification;
        }

        status = IntExceptGetVictimEpt(pTask,
                                       gVcpu->Gpa,
                                       gVcpu->Gla,
                                       introObjectTypeUmGenericNxZone,
                                       ZONE_EXECUTE,
                                       &victim);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed getting modified zone: 0x%08x\n", status);
            goto _send_notification;
        }

        IntExcept(&victim, &originator, exceptionTypeUm, &action, &reason, introEventEptViolation);

        if (action == introGuestAllowed)
        {
            excepted = TRUE;
        }
        else if (action == introGuestNotAllowed && feedback)
        {
            action = introGuestAllowed;
            reason = introReasonAllowedFeedback;
        }
    }

_send_notification:
    if (detected && (!excepted)) // 0x7f6e0000
    {
        PEVENT_EPT_VIOLATION pEptViol = NULL;
        char text[ND_MIN_BUF_SIZE] = { 0 };

        status = NdToText(instrux, rip, ND_MIN_BUF_SIZE, text);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] NdToText failed: 0x%08x\n", status);
            snprintf(text, sizeof(text), "<invalid>");
        }

        LOG("[VMANX] [CPU %d] EXPLOIT detected! Execution attempted at 0x%016llx! Instruction: %s\n",
            gVcpu->Index, rip, text);

        LOG("[VMANX] Current address: %llx, current stack: %llx, known stack: %llx/%llx\n",
            rip, regs->Rsp, pStackVma ? pStackVma->End : 0, pStackVma ? pStackVma->Start : 0);

        IntDumpCodeAndRegs(regs->Rip, Address, regs);

        pEptViol = &gAlert.Ept;

        memset(pEptViol, 0, sizeof(*pEptViol));

        pEptViol->Header.Action = action;
        pEptViol->Header.Reason = reason;
        pEptViol->Header.MitreID = idExploitClientExec;

        pEptViol->Header.Flags = IntAlertProcGetFlags(PROC_OPT_PROT_EXPLOIT, pTask, reason, 0);

        IntAlertFillCpuContext(TRUE, &pEptViol->Header.CpuContext);
        IntAlertFillLixProcess(pTask, &pEptViol->Header.CurrentProcess);

        IntAlertFillVersionInfo(&pEptViol->Header);
        IntAlertEptFillFromVictimZone(&victim, pEptViol);

        IntAlertFillExecContext(regs->Cr3, &pEptViol->ExecContext);

        status = IntNotifyIntroEvent(introEventEptViolation, pEptViol, sizeof(*pEptViol));
        if (!INT_SUCCESS(status))
        {
            WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
        }

        status = IntLixNetSendTaskConnections(pTask);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixNetSendTaskConnections failed: %08x\n", status);
        }

        // Override the status returned by IntNotifyIntroEvent.
        status = INT_STATUS_SUCCESS;

        // Block by default.
        *Action = introGuestNotAllowed;
    }

    IntPolicyProcForceBetaIfNeeded(PROC_OPT_PROT_EXPLOIT, pTask, Action);

    // Remove the exec hook if we allow the action.
    if (introGuestAllowed == *Action)
    {
        // Remove the hook on this region, only if we didn't block anything. If we did, we will maintain the hook in
        // order to block further execution attempts. We also remove the hook if we're in BETA mode - otherwise,
        // there will be lots & lots of alerts, that may end up hanging the process.
        status = IntLixVmaRemoveProtection(pVma, FALSE);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixVmaRemoveProtection failed for vad [%llx - %llx]: %08x\n",
                  pVma->Start, pVma->End, status);
        }

        // Since we remove the exec-hook, we can simply retry the execution of the instruction. This way, we don't
        // have to emulate or single step the instruction.
        *Action = introGuestRetry;
    }

_retry_inject_ud:
    // Terminate the process, if needed.
    if ((INT_SUCCESS(status) && (introGuestNotAllowed == *Action) &&
         (0 != (pTask->Protection.Mask & PROC_OPT_KILL_ON_EXPLOIT))) ||
        NULL != entryPendingUD)
    {
        INTSTATUS status2;

        pTask->MustKill = TRUE;

        // If we already injected the same entry, there's no need for another injection, most probably causing an error
        if (entryPendingUD != NULL && gVcpu->CurrentUD == entryPendingUD)
        {
            goto _skip_inject;
        }

        status2 = IntInjectExceptionInGuest(VECTOR_UD, 0, NO_ERRORCODE, gVcpu->Index);
        if (!INT_SUCCESS(status2))
        {
            ERROR("[ERROR] IntInjectExceptionInGuest failed, process will not be killed: %08x\n", status2);
        }
        else
        {
            if (NULL == entryPendingUD)
            {
                // If not already pending, add to the list of pending UDs and store the allocated address in entryPendingUD
                status = IntUDAddToPendingList(regs->Cr3, regs->Rip, pTask->Gva, &entryPendingUD);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntVadAddToPendingUDList failed: %08x\n", status);
                }
            }

            // Set gVcpu->CurrentUD pointer to the allocated address for the tuple
            gVcpu->CurrentUD = entryPendingUD;
        }
_skip_inject:
        *Action = introGuestRetry;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntLixVmaProtect(
    _In_ LIX_VMA *Vma
    )
{
    INTSTATUS status;

    if (0 == (Vma->End - Vma->Start))
    {
        WARNING("[WARNING] Vma %llx [%llx - %llx] can't be protected!\n", Vma->Gva, Vma->Start, Vma->End);
        return INT_STATUS_INVALID_OBJECT_TYPE;
    }

    if ((Vma->File && IntLixVmaGetPageCount(Vma) >= 2) || (0 == (Vma->Flags & VM_EXEC)))
    {
        // No need to log anything. This is a valid use case where we really need re-monitor some changes.
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    if (Vma->Hook)
    {
        LOG("[ERROR] [VMA] Special case when protecting an already protected vad [%llx - %llx]\n",
            Vma->Start, Vma->End);

        status = IntLixVmaRemoveProtection(Vma, TRUE);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixVmaRemoveProtection failed for vad [%llx - %llx]: %08x\n",
                  Vma->Start, Vma->End, status);
        }
    }

    if (__unlikely((Vma->End - Vma->Start) > ONE_GIGABYTE))
    {
        WARNING("[WARNING] Big vad  [%llx - %llx] (%ld pages) in process '%s' (%d)\n",
                Vma->Start, Vma->End, IntLixVmaGetPageCount(Vma), Vma->Process->ProcName, Vma->Process->Pid);
        goto _mark_protection;
    }

    status = IntHookObjectHookRegion(Vma->Process->HookObject,
                                     Vma->Process->Cr3,
                                     Vma->Start,
                                     Vma->End - Vma->Start,
                                     IG_EPT_HOOK_EXECUTE,
                                     IntLixVmaHandlePageExecution,
                                     Vma,
                                     0,
                                     (HOOK_REGION_DESCRIPTOR **)&Vma->Hook);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookObjectHookRegion failed for [%llx - %llx]: %08x\n",
              Vma->Start, Vma->End, status);
        return status;
    }

_mark_protection:
    status = IntVmaMarkProtection(Vma, TRUE);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntVmaMarkProtection failed: %08x\n", status);
        return status;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntLixMmPopulateVmasInternal(
    _In_ LIX_TASK_OBJECT *Process,
    _In_ BOOLEAN Backward
    )
{
    INTSTATUS status;
    QWORD currentVma;
    DWORD offset;
    DWORD maxIterations;

    status = IntKernVirtMemFetchQword(Process->MmGva + LIX_FIELD(MmStruct, Vma), &currentVma);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n", Process->MmGva, status);
        return status;
    }

    if (Backward)
    {
        QWORD prevVma = 0;

        status = IntKernVirtMemFetchQword(currentVma + LIX_FIELD(Vma, VmPrev), &prevVma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n", Process->MmGva, status);
            return status;
        }

        currentVma = prevVma;
    }

    maxIterations = LIX_VMA_MAX_GUEST;
    if (Backward)
    {
        offset = LIX_FIELD(Vma, VmPrev);
    }
    else
    {
        offset = LIX_FIELD(Vma, VmNext);
    }

    while (IS_KERNEL_POINTER_LIX(currentVma) && maxIterations > 0)
    {
        QWORD nextVma = 0;
        LIX_VMA *pVma = NULL;
        LIX_VMA vad;
        BOOLEAN shouldProtect;

        status = IntLixVmaFill(currentVma, Process, &vad);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixVmaFill failed for vma %llx: %08x\n", currentVma, status);
            return status;
        }

        shouldProtect = (0 == vad.File && (vad.Flags & VM_EXEC));

        if (LIX_VMA_IS_VDSO(&vad))
        {
            // This is the VDSO, don't protect it for now (we will protect it globally)
            shouldProtect = FALSE;
        }

        if (shouldProtect)
        {
            status = IntLixVmaCreate(currentVma, Process, &pVma);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntLixVmaCreate failed for vma %llx: %08x\n", currentVma, status);
                return status;
            }

            status = IntLixVmaProtect(pVma);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntLixVmaProtect failed for vad [%llx - %llx] flags %08llx, 0x%016llx: %08x\n",
                      pVma->Start, pVma->End, pVma->Flags, pVma->Gva, status);

                IntLixVmaDestroy(pVma);
            }
        }

        status = IntKernVirtMemFetchQword(currentVma + offset, &nextVma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemFetchQword failed for vma %llx: %08x\n", currentVma, status);
            return status;
        }

        currentVma = nextVma;
        --maxIterations;
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntLixMmPopulateVmas(
    _In_ LIX_TASK_OBJECT *Task
    )
{
    INTSTATUS status;

    if (NULL == Task)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    status = IntLixMmPopulateVmasInternal(Task, FALSE);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixMmPopulateVmasInternal failed for forward parsing: %08x\n", status);
        goto _free_and_exit;
    }

    status = IntLixMmPopulateVmasInternal(Task, TRUE);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixMmPopulateVmasInternal failed for backward parsing: %08x\n", status);
        goto _free_and_exit;
    }

    return INT_STATUS_SUCCESS;

_free_and_exit:
    IntLixMmDestroyVmas(Task);

    return status;
}


static void
IntLixMmListVmasInternal(
    _In_ QWORD Mm,
    _In_ LIX_TASK_OBJECT *Process,
    _In_ BOOLEAN Backward
    )
{
    INTSTATUS status;
    QWORD currentVma;
    DWORD offset;
    DWORD maxIterations;

    status = IntKernVirtMemFetchQword(Mm + LIX_FIELD(MmStruct, Vma), &currentVma);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n", Mm + LIX_FIELD(MmStruct, Vma), status);
        return;
    }

    if (Backward)
    {
        QWORD prevVma = 0;

        status = IntKernVirtMemFetchQword(currentVma + LIX_FIELD(Vma, VmPrev), &prevVma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemFetchQword failed for %llx: 0x%08x\n", Mm, status);
            return;
        }

        currentVma = prevVma;
    }

    maxIterations = LIX_VMA_MAX_GUEST;

    if (Backward)
    {
        offset = LIX_FIELD(Vma, VmPrev);
    }
    else
    {
        offset = LIX_FIELD(Vma, VmNext);
    }

    while (IS_KERNEL_POINTER_LIX(currentVma) && maxIterations > 0)
    {
        QWORD nextVma = 0;
        LIX_VMA vma;
        char *fileName = NULL;

        status = IntLixVmaFill(currentVma, NULL, &vma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixVmaFill failed for vma 0x%016llx: %08x\n", currentVma, status);
            return;
        }

        status = IntLixGetFileName(vma.File, &fileName, NULL, NULL);
        if (!INT_SUCCESS(status))
        {
            fileName = NULL;
        }

        LOG("  [%016llx -> %016llx] : %08llx @ 0x%016llx Hooked=%d (%c%c%c) => %06ld pages '%s'\n",
            vma.Start, vma.End, vma.Flags, vma.Gva, vma.Hook ? 1 : 0,
            (vma.Flags & VM_EXEC) ? 'X' : '-',
            (vma.Flags & VM_WRITE) ? 'W' : '-',
            (vma.Flags & VM_READ) ? 'R' : '-',
            IntLixVmaGetPageCount(&vma),
            fileName);

        DWORD presentPages = 0;
        for (size_t i = 0; i < IntLixVmaGetPageCount(&vma); i++)
        {
            QWORD physAddress;

            status = IntTranslateVirtualAddress(vma.Start + (i * PAGE_SIZE), Process->Cr3, &physAddress);
            if (!INT_SUCCESS(status))
            {
                continue;
            }

            presentPages++;
        }

        LOG("-----> %d/%ld present pages\n", presentPages, IntLixVmaGetPageCount(&vma));

        if (fileName)
        {
            HpFreeAndNullWithTag(&fileName, IC_TAG_NAME);
        }

        status = IntKernVirtMemFetchQword(currentVma + offset, &nextVma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemFetchQword failed for vma %llx: %08x\n", currentVma, status);
            return;
        }

        currentVma = nextVma;
        --maxIterations;
    }

}


void
IntLixMmListVmas(
    _In_ QWORD Mm,
    _In_ LIX_TASK_OBJECT *Process)
{
    if (!Mm)
    {
        return;
    }

    IntLixMmListVmasInternal(Mm, Process, FALSE);
    IntLixMmListVmasInternal(Mm, Process, TRUE);
}


INTSTATUS
IntLixVmaInsert(
    _In_ void *Detour
    )
{
    INTSTATUS status;
    QWORD vma = gVcpu->Regs.R8;
    QWORD mm = gVcpu->Regs.R9;
    LIX_VMA *pVma;

    UNREFERENCED_PARAMETER(Detour);

    LIX_TASK_OBJECT *pTask = IntLixTaskFindByMm(mm);
    if (__unlikely((NULL == pTask) || !(pTask->Protection.Mask & PROC_OPT_PROT_EXPLOIT)))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    pVma = IntLixMmFindVma(pTask, vma);
    if (pVma)
    {
        // It was already created by vma_adjust, no need to do anything
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    status = IntLixVmaCreate(vma, pTask, &pVma);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixVmaCreate failed: %08x\n", status);
        return status;
    }

    if (LIX_VMA_IS_VDSO(pVma))
    {
        IntLixVmaDestroy(pVma);

        return INT_STATUS_SUCCESS;
    }

    status = IntLixVmaProtect(pVma);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixVmaProtect failed: 0x%08x\n", status);
        IntLixVmaDestroy(pVma);
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntLixVmaChangeProtection(
    _In_ void *Detour
    )
{
    INTSTATUS status;
    QWORD vma = gVcpu->Regs.R8;
    QWORD mm = gVcpu->Regs.R9;
    QWORD newFlags = 0;
    LIX_TASK_OBJECT *pTask;
    LIX_VMA *pVma;

    UNREFERENCED_PARAMETER(Detour);

    pTask = IntLixTaskFindByMm(mm);
    if (__unlikely((NULL == pTask) || !(pTask->Protection.Mask & PROC_OPT_PROT_EXPLOIT)))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    pVma = IntLixMmFindVma(pTask, vma);

    status = IntKernVirtMemFetchQword(vma + LIX_FIELD(Vma, Flags), &newFlags);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemFetchQword failed: 0x%08x\n", status);
        return status;
    }

    newFlags &= ~LIX_VMA_PROT_MASK;

    if (newFlags & VM_EXEC)
    {
        BOOLEAN newlyCreated = FALSE;

        if (NULL == pVma)
        {
            newlyCreated = TRUE;

            status = IntLixVmaCreate(vma, pTask, &pVma);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntLixVmaCreate failed for vma %llx: %08x\n", vma, status);
                return status;
            }
        }

        pVma->Flags = newFlags & (~LIX_VMA_PROT_MASK);

        if (newlyCreated || (newFlags != pVma->Flags))
        {
            status = IntLixVmaProtect(pVma);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntLixVmaProtect failed for vad [%llx - %llx] flags %08llx, 0x%016llx: %08x\n",
                      pVma->Start, pVma->End, pVma->Flags, pVma->Gva, status);

                IntLixVmaDestroy(pVma);

                return status;
            }
        }
    }
    else if (pVma)
    {
        IntLixVmaDestroy(pVma);
        pVma = NULL;
    }

    if (pVma)
    {
        pVma->Flags = newFlags;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntLixVmaIntervalChanged(
    _In_ LIX_VMA *AdjustedVma,
    _In_opt_ QWORD InsertVma
    )
{
    INTSTATUS status;

    // We must remove the old protection first
    status = IntLixVmaRemoveProtection(AdjustedVma, FALSE);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixVmaRemoveProtection failed for vad [%llx - %llx]: %08x\n",
              AdjustedVma->Start, AdjustedVma->End, status);
        return status;
    }

    status = IntLixVmaProtect(AdjustedVma);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixVmaProtect failed: 0x%08x\n", status);
        return status;
    }

    if (InsertVma)
    {
        LIX_VMA *pInsVma;

        status = IntLixVmaCreate(InsertVma, AdjustedVma->Process, &pInsVma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixVmaCreate failed: 0x%08x\n", status);
            return status;
        }

        status = IntLixVmaProtect(pInsVma);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixVmaProtect failed: 0x%08x\n", status);

            IntLixVmaDestroy(pInsVma);

            return status;
        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntLixVmaExpandDownwards(
    _In_ void *Detour
    )
{
    INTSTATUS status;
    QWORD mm;
    QWORD vma = gVcpu->Regs.R8;
    QWORD address = gVcpu->Regs.R9;
    LIX_TASK_OBJECT *pTask;
    LIX_VMA *pVma;

    UNREFERENCED_PARAMETER(Detour);

    status = IntKernVirtMemFetchQword(vma + LIX_FIELD(Vma, Mm), &mm);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemFetchQword failed for vma %llx: %08x\n", vma, status);
        return status;
    }

    pTask = IntLixTaskFindByMm(mm);
    if (__unlikely((NULL == pTask) || !(pTask->Protection.Mask & PROC_OPT_PROT_EXPLOIT)))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    pVma = IntLixMmFindVma(pTask, vma);
    if (NULL == pVma)
    {
        return INT_STATUS_SUCCESS;
    }

    if (address < pVma->Start)
    {
        QWORD oldStart = pVma->Start;

        pVma->Start = address;

        status = IntLixVmaIntervalChanged(pVma, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixVmaIntervalChanged failed for vad [%llx/%llx - %llx/%llx] flags %08llx, 0x%016llx: %08x\n",
                  pVma->Start, oldStart, pVma->End, pVma->End, pVma->Flags, pVma->Gva, status);

            IntLixVmaDestroy(pVma);
        }
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntLixVmaAdjustInternal(
    _In_ LIX_TASK_OBJECT *Task,
    _In_ QWORD Vma
    )
{
    INTSTATUS status;
    LIX_VMA *pVma;
    QWORD oldStart, oldEnd;
    QWORD addr = 0;

    if (NULL == Task || 0 == Vma)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    pVma = IntLixMmFindVma(Task, Vma);
    if (NULL == pVma)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    oldStart = pVma->Start;
    oldEnd = pVma->End;
    addr = pVma->Gva;

    status = IntLixFsrInitMap(addr);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixFsrInitMap failed for Vma 0x%llx: 0x%08x\n", pVma->Gva, status);
        return status;
    }

    status = IntLixFsrRead(addr, LIX_FIELD(Vma, VmaStart), sizeof(QWORD), &pVma->Start);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed to read from Vma 0x%llx at offset 0x%x. Status: 0x%08x\n",
              pVma->Gva, LIX_FIELD(Vma, VmaStart), status);

        goto _done_unmap;
    }

    status = IntLixFsrRead(addr, LIX_FIELD(Vma, VmaEnd), sizeof(QWORD), &pVma->End);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed to read from Vma 0x%llx at offset 0x%x. Status: 0x%08x\n",
              pVma->Gva, LIX_FIELD(Vma, VmaEnd), status);

        goto _done_unmap;
    }

    if (oldStart != pVma->Start || oldEnd != pVma->End)
    {
        status = IntLixVmaIntervalChanged(pVma, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntLixVmaIntervalChanged failed for vad [%llx/%llx - %llx/%llx] flags %08llx, 0x%016llx: %08x\n",
                  pVma->Start, oldStart, pVma->End, oldEnd, pVma->Flags, pVma->Gva, status);

            IntLixVmaDestroy(pVma);
        }
    }

    status = INT_STATUS_SUCCESS;

_done_unmap:

    IntLixFsrUninitMap();

    return status;
}


INTSTATUS
IntLixVmaAdjust(
    _In_ void *Detour
    )
{
    INTSTATUS status;

    QWORD vma = gVcpu->Regs.R8;
    QWORD mm = gVcpu->Regs.R9;

    QWORD next = gVcpu->Regs.R10;
    QWORD prev = gVcpu->Regs.R11;

    LIX_TASK_OBJECT *pTask;

    UNREFERENCED_PARAMETER(Detour);

    pTask = IntLixTaskFindByMm(mm);
    if (__unlikely((NULL == pTask) || !(pTask->Protection.Mask & PROC_OPT_PROT_EXPLOIT)))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    status = IntLixVmaAdjustInternal(pTask, vma);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixVmaAdjustInternal failed for vma 0x%llx (mm gva: 0x%llx) from task %s (%d 0x%llx). Status: 0x%08x\n",
              vma, pTask->MmGva, pTask->Comm, pTask->Pid, pTask->Gva, status);
    }

    status = IntLixVmaAdjustInternal(pTask, next);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixVmaAdjustInternal failed for vma 0x%llx (mm gva: 0x%llx) from task %s (%d 0x%llx). Status: 0x%08x\n",
              next, pTask->MmGva, pTask->Comm, pTask->Pid, pTask->Gva, status);
    }

    status = IntLixVmaAdjustInternal(pTask, prev);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntLixVmaAdjustInternal failed for vma 0x%llx (mm gva: 0x%llx) from task %s (%d 0x%llx). Status: 0x%08x\n",
              prev, pTask->MmGva, pTask->Comm, pTask->Pid, pTask->Gva, status);
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntLixVmaRemove(
    _In_ void *Detour
    )
{
    QWORD vma = gVcpu->Regs.R8;
    QWORD mm = gVcpu->Regs.R9;

    LIX_TASK_OBJECT *pTask;
    LIX_VMA *pVma;

    UNREFERENCED_PARAMETER(Detour);

    pTask = IntLixTaskFindByMm(mm);
    if (__unlikely((NULL == pTask) || !(pTask->Protection.Mask & PROC_OPT_PROT_EXPLOIT)))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    pVma = IntLixMmFindVma(pTask, vma);
    if (NULL == pVma)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    IntLixVmaDestroy(pVma);

    return INT_STATUS_SUCCESS;
}