lixmodule.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _LIXMODULE_H_
#define _LIXMODULE_H_

#include "introtypes.h"


#define LIX_MODULE_NAME_LEN             56  
#define LIX_ACTIVE_PATCH_SIZE           27  

typedef struct _LIX_MODULE_LAYOUT
{
    QWORD       Base;               
    DWORD       Size;               
    DWORD       TextSize;           
    DWORD       RoSize;             
} LIX_MODULE_LAYOUT, *PLIX_MODULE_LAYOUT;


typedef struct _LIX_KERNEL_MODULE
{
    void                *InitSwapHook;              

    DWORD               SymbolsCount;               
    DWORD               GplSymbolsCount;            

    QWORD               KernelSymbols;              
    QWORD               GplSymbols;                 

    LIX_MODULE_LAYOUT   InitLayout;                 
    LIX_MODULE_LAYOUT   CoreLayout;                 

    void                *HookObjectRead;

    BOOLEAN             Initialized;                
} LIX_KERNEL_MODULE, *PLIX_KERNEL_MODULE;


typedef struct _KERNEL_DRIVER KERNEL_DRIVER, *PKERNEL_DRIVER;
typedef struct _LIX_ACTIVE_PATCH LIX_ACTIVE_PATCH, *PLIX_ACTIVE_PATCH;

typedef struct _LIX_KERNEL_PATCH
{
    LIST_ENTRY  Link;                           

    QWORD       Gva;                            
    WORD        Length;                         
    WORD        PatchedLength;                  

    BYTE        Patch[LIX_ACTIVE_PATCH_SIZE];   

    BOOLEAN     CodeValid;
} LIX_KERNEL_PATCH, *PLIX_KERNEL_PATCH;


INTSTATUS
IntLixDrvFindList(
    _Out_ QWORD *Drivers
    );

INTSTATUS
IntLixDrvRemoveEntry(
    _In_ KERNEL_DRIVER *Driver
    );

void
IntLixDrvGetSecName(
    _In_ KERNEL_DRIVER *Driver,
    _In_ QWORD Gva,
    _Out_writes_(8) CHAR *SectionName
    );

INTSTATUS
IntLixDrvIsLegitimateTextPoke(
    _In_ void *Hook,
    _In_ QWORD Address,
    _In_ LIX_ACTIVE_PATCH *ActivePatch,
    _Out_ INTRO_ACTION *Action
    );

INTSTATUS
IntLixDrvHandleWrite(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    );

INTSTATUS
IntLixDrvIterateList(
    _In_ PFUNC_IterateListCallback Callback,
    _In_ QWORD Aux
    );

INTSTATUS
IntLixDrvCreateFromAddress(
    _In_ QWORD DriverGva,
    _In_ QWORD StaticDetected
    );

INTSTATUS
IntLixDrvRemoveFromAddress(
    _In_ QWORD DriverGva
    );

INTSTATUS
IntLixDrvCreateKernel(
    void
    );

void
IntLixDrvUpdateProtection(
    void
    );

#endif // _LIXMODULE_H_