Bitdefender Hypervisor Memory Introspection
memcloak.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
5 #ifndef _MEMCLOAK_H_
6 #define _MEMCLOAK_H_
7 
26 
27 #include "introtypes.h"
28 
41 typedef INTSTATUS (*PFUNC_IntMemCloakWriteHandle)(
42  _In_ void *Hook,
43  _In_ QWORD Address,
44  _In_ QWORD RegionVirtualAddress,
45  _In_ void *CloakHandle,
46  _Out_ INTRO_ACTION *Action);
47 
51 typedef enum
52 {
53  MEMCLOAK_OPT_ALLOW_INTERNAL = 0x00000001,
54  MEMCLOAK_OPT_APPLY_PATCH = 0x00000002,
55 } MEMCLOAK_OPTIONS;
56 
57 
58 //
59 // API
60 //
61 INTSTATUS
62 IntMemClkCloakRegion(
63  _In_ QWORD VirtualAddress,
64  _In_ QWORD Cr3,
65  _In_ DWORD Size,
66  _In_ DWORD Options,
67  _In_opt_ PBYTE OriginalData,
68  _In_opt_ PBYTE PatchedData,
69  _In_opt_ PFUNC_IntMemCloakWriteHandle WriteHandler,
70  _Out_ void **CloakHandle
71  );
72 
73 INTSTATUS
74 IntMemClkModifyOriginalData(
75  _In_ void *CloakHandle,
76  _In_ DWORD Offset,
77  _In_ DWORD Size,
78  _In_ void *Data
79  );
80 
81 INTSTATUS
82 IntMemClkModifyPatchedData(
83  _In_ void *CloakHandle,
84  _In_ DWORD Offset,
85  _In_ DWORD Size,
86  _In_opt_ const void *Data
87  );
88 
89 INTSTATUS
90 IntMemClkUncloakRegion(
91  _In_ void *CloakHandle,
92  _In_ DWORD Options
93  );
94 
95 INTSTATUS
96 IntMemClkHashRegion(
97  _In_ QWORD VirtualAddress,
98  _In_ QWORD PhysicalAddress,
99  _In_ DWORD Size,
100  _Out_ DWORD *Crc32
101  );
102 
103 BOOLEAN
104 IntMemClkIsPtrInCloak(
105  _In_ const void *Cloak,
106  _In_ QWORD Ptr
107  );
108 
109 INTSTATUS
110 IntMemClkGetOriginalData(
111  _In_ void *CloakHandle,
112  _Out_ BYTE **OriginalData,
113  _Out_ DWORD *Length
114  );
115 
116 INTSTATUS
117 IntMemClkUnInit(
118  void
119  );
120 
121 void
122 IntMemClkDump(
123  void
124  );
125 
127 
128 #endif // _MEMCLOAK_H_
_In_opt_
#define _In_opt_
Definition: intro_sal.h:16
BOOLEAN
_Bool BOOLEAN
Definition: intro_types.h:58
_Out_
#define _Out_
Definition: intro_sal.h:22
_LIX_TASK_OBJECT::Cr3
QWORD Cr3
The CR3 for this process.
Definition: lixprocess.h:70
BYTE
uint8_t BYTE
Definition: intro_types.h:47
_In_
#define _In_
Definition: intro_sal.h:21
PFUNC_IntMemCloakWriteHandle
INTSTATUS(* PFUNC_IntMemCloakWriteHandle)(void *Hook, QWORD Address, QWORD RegionVirtualAddress, void *CloakHandle, INTRO_ACTION *Action)
The type of custom write handlers that can be used by cloak regions.
Definition: memcloak.h:41
IntMemClkModifyPatchedData
INTSTATUS IntMemClkModifyPatchedData(void *CloakHandle, DWORD Offset, DWORD Size, const void *Data)
Modifies the patched data inside the guest memory.
Definition: memcloak.c:795
IntMemClkIsPtrInCloak
BOOLEAN IntMemClkIsPtrInCloak(const void *Cloak, QWORD Ptr)
Checks if a guest virtual address is located inside a cloak region.
Definition: memcloak.c:1089
INTSTATUS
int INTSTATUS
The status data type.
Definition: introstatus.h:24
IntMemClkUnInit
INTSTATUS IntMemClkUnInit(void)
Uninits the memory cloak subsystem.
Definition: memcloak.c:1169
MEMCLOAK_OPT_APPLY_PATCH
Will write the contents of the patched data inside the guest.
Definition: memcloak.h:54
MEMCLOAK_OPT_ALLOW_INTERNAL
Allows the code inside the region to modify the region.
Definition: memcloak.h:53
PBYTE
uint8_t * PBYTE
Definition: intro_types.h:47
IntMemClkGetOriginalData
INTSTATUS IntMemClkGetOriginalData(void *CloakHandle, BYTE **OriginalData, DWORD *Length)
Returns the original data of a cloaked region.
Definition: memcloak.c:1121
QWORD
unsigned long long QWORD
Definition: intro_types.h:53
IntMemClkModifyOriginalData
INTSTATUS IntMemClkModifyOriginalData(void *CloakHandle, DWORD Offset, DWORD Size, void *Data)
Modifies the internal copy of the original data buffer held by a cloak region.
Definition: memcloak.c:734
IntMemClkCloakRegion
INTSTATUS IntMemClkCloakRegion(QWORD VirtualAddress, QWORD Cr3, DWORD Size, DWORD Options, PBYTE OriginalData, PBYTE PatchedData, PFUNC_IntMemCloakWriteHandle WriteHandler, void **CloakHandle)
Hides a memory zone from the guest.
Definition: memcloak.c:548
IntMemClkDump
void IntMemClkDump(void)
Dumps all the active cloak regions.
Definition: memcloak.c:1218
DWORD
uint32_t DWORD
Definition: intro_types.h:49
INTRO_ACTION
enum _INTRO_ACTION INTRO_ACTION
Event actions.
IntMemClkUncloakRegion
INTSTATUS IntMemClkUncloakRegion(void *CloakHandle, DWORD Options)
Removes a cloak region, making the original memory contents available again to the guest...
Definition: memcloak.c:970
IntMemClkHashRegion
INTSTATUS IntMemClkHashRegion(QWORD VirtualAddress, QWORD PhysicalAddress, DWORD Size, DWORD *Crc32)
Hashes the contents of a cloaked memory page.
Definition: memcloak.c:1005
MEMCLOAK_OPTIONS
MEMCLOAK_OPTIONS
Options that control the way a cloaked memory region is handled.
Definition: memcloak.h:51