lixprocess.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _LIXPROCESS_H_
#define _LIXPROCESS_H_

#include "introtypes.h"
#include "update_guests.h"
#include "lixagent.h"
#include "lixddefs.h"

#define LIX_COMM_SIZE                       16u   

#define LIX_PROCESSES_MAX_COUNT             65536 

typedef struct _LIX_CREDS       LIX_CREDS;

typedef struct _LIX_TASK_PATH
{
    LIST_ENTRY  Link;       

    char        *Path;      
    char        *Name;      

    QWORD       DentryGva;  

    size_t      PathLength; 
    size_t      NameLength; 

    DWORD       RefCount;   
} LIX_TASK_PATH;


typedef struct _LIX_TASK_OBJECT
{
    LIST_ENTRY  Link;                   

    QWORD       Gva;                    

    char        Comm[LIX_COMM_SIZE];    

    char        *Interpreter;           

    char        *CmdLine;               

    LIX_TASK_PATH *Path;                

    char        *ProcName;

    QWORD       RealParent;             
    QWORD       Parent;                 
    QWORD       ActualParent;           

    QWORD       ExeFileDentry;          

    SIZE_T      ProcNameLength;         
    DWORD       InterpLength;           
    DWORD       CmdLineLength;          
    DWORD       CommHash;               

    LIST_ENTRY  ExploitProtProcLink;    

    QWORD       MmGva;                  
    QWORD       Cr3;                    

    DWORD       Pid;                    
    DWORD       Tgid;                   

    QWORD       CreationTime;           

    //
    // Introspection-specific fields
    //
    LIST_HEAD       Vmas;               

    struct
    {
        QWORD       Mask;               
        QWORD       Beta;               
        QWORD       Feedback;           
    } Protection;                       

    QWORD           RootProtectionMask; 
    QWORD           Context;            

    void            *HookObject;        

    DWORD           StaticDetected: 1;  
    DWORD           Exec: 1;            
    DWORD           IsThread: 1;        
    DWORD           KernelMode: 1;      
    DWORD           IsPreviousAgent: 1; 
    DWORD           Protected: 1;       
    DWORD           ReExecToSelf: 1;    
    DWORD           MustKill: 1;        

    LIX_AGENT_TAG   AgentTag;           

    LIX_CREDS       *Creds;             

    struct
    {
        QWORD       Base;               
        QWORD       Limit;              
        BOOLEAN     Valid;              
    } UserStack;                        

    struct
    {
        BOOLEAN     IsPivoted;          
        BOOLEAN     StolenTokens;       
    } Dpi;                              

} LIX_TASK_OBJECT;


static __forceinline QWORD
IntLixProcGetProtOption(
    _In_ const LIX_TASK_OBJECT *Process
    )
{
    UNREFERENCED_PARAMETER(Process);

    return INTRO_OPT_PROT_UM_MISC_PROCS;
}

static __forceinline BOOLEAN
IntLixProcPolicyIsBeta(
    _In_ const LIX_TASK_OBJECT *Process,
    _In_ QWORD Flag
    )
{
    return (Process->Protection.Mask & PROC_OPT_BETA) != 0 ||
           IntPolicyCoreIsOptionBeta(IntLixProcGetProtOption(Process)) ||
           (Process->Protection.Beta & Flag) != 0;
}

static __forceinline BOOLEAN
IntLixProcPolicyIsFeedback(
    _In_ const LIX_TASK_OBJECT *Process,
    _In_ QWORD Flag
    )
{
    return ((Process->Protection.Feedback & Flag) ||
            (IntPolicyIsCoreOptionFeedback(IntLixProcGetProtOption(Process))));
}

typedef INTSTATUS
(*PFUNC_LixTaskIterateTasks)(
    _In_ LIX_TASK_OBJECT *Task
    );

INTSTATUS
IntLixTaskGetUserStack(
    _In_ LIX_TASK_OBJECT *Task,
    _Out_opt_ QWORD *StackPointer,
    _Out_opt_ QWORD *StackBase,
    _Out_opt_ QWORD *StackLimit
    );

INTSTATUS
IntLixGetInitTask(
    _Out_ QWORD *InitTask
    );

LIX_TASK_OBJECT *
IntLixTaskGetCurrent(
    _In_ DWORD CpuNumber
    );

INTSTATUS
IntLixTaskGetCurrentTaskStruct(
    _In_ DWORD CpuNumber,
    _Out_ QWORD *TaskStruct
    );

QWORD
IntLixGetKernelCr3(
    _In_ QWORD Cr3
    );

LIX_TASK_OBJECT *
IntLixTaskFindByCr3(
    _In_ QWORD Cr3
    );

LIX_TASK_OBJECT *
IntLixTaskFindByGva(
    _In_ QWORD TaskStruct
    );

LIX_TASK_OBJECT *
IntLixTaskProtFindByMm(
    _In_ QWORD MmGva
    );

LIX_TASK_OBJECT *
IntLixTaskFindByMm(
    _In_ QWORD MmGva
    );

LIX_TASK_OBJECT *
IntLixTaskFindByPid(
    _In_ DWORD Pid
    );

INTSTATUS
IntLixTaskGetTrapFrame(
    _In_ const LIX_TASK_OBJECT *Task,
    _Out_ LIX_TRAP_FRAME *TrapFrame
    );

DWORD
IntLixTaskGetExecCount(
    void
    );

INTSTATUS
IntLixTaskHandleFork(
    _In_ void *Detour
    );

INTSTATUS
IntLixTaskHandlePtrace(
    _In_ void *Detour
    );

INTSTATUS
IntLixTaskHandleVmRw(
    _In_ void *Detour
    );

INTSTATUS
IntLixTaskHandleExec(
    _In_ void *Detour
    );

INTSTATUS
IntLixTaskHandleDoExit(
    _In_ void *Detour
    );

INTSTATUS
IntLixTaskIterateGuestTasks(
    _In_ PFUNC_IterateListCallback Callback,
    _In_ QWORD Aux
    );

INTSTATUS
IntLixTaskAdd(
    _In_ QWORD TaskGva,
    _In_ QWORD StaticDetected
    );

INTSTATUS
IntLixTaskAddProtected(
    _In_ const char *ProcessName,
    _In_ QWORD ProtectionMask,
    _In_ QWORD Context
    );

INTSTATUS
IntLixTaskRemoveProtected(
    _In_ const char *ProcessName
    );

void
IntLixTaskUpdateProtection(
    void
    );

INTSTATUS
IntLixTaskGetAgentsAsCli(
    _Out_writes_bytes_(Length) char *CommandLine,
    _In_ DWORD Length
    );

void
IntLixTaskUninit(
    void
    );

void
IntLixTaskDumpAsTree(
    void
    );

void
IntLixTaskDump(
    void
    );

void
IntLixTaskDumpProtected(
    void
    );

INTSTATUS
IntLixTaskIterateTasks(
    _In_ PFUNC_LixTaskIterateTasks Callback
    );

void
IntLixTaskEnum(
    _Out_ DWORD *Pids,
    _In_ DWORD BufferSize
    );

BOOLEAN
IntLixTaskGuestTerminating(
    void
    );

void
IntLixProcUpdateProtectedProcess(
    _In_ const void *Name,
    _In_ const CAMI_STRING_ENCODING Encoding,
    _In_ const CAMI_PROT_OPTIONS *Options
    );

INTSTATUS
IntLixAccessRemoteVmHandler(
    _In_ void *Detour
    );

INTSTATUS
IntLixTaskIsUserStackPivoted(
    _In_ LIX_TASK_OBJECT *Task,
    _In_ QWORD Ptr,
    _Out_ BOOLEAN *IsPivoted
    );

#endif // _LIXPROCESS_H_