Bitdefender Hypervisor Memory Introspection
Macros
pgtable.h File Reference
#include "intro_types.h"

Go to the source code of this file.

Macros

#define PAGE_SIZE_4K   4096u
 
#define PAGE_OFFSET_MASK_4K   (PAGE_SIZE_4K - 1)
 
#define PAGE_MAX_OFFSET_4K   PAGE_OFFSET_MASK_4K
 
#define PAGE_BASE_MASK_4K   (0xFFFFFFFFFFFFFFFFULL - PAGE_MAX_OFFSET_4K)
 
#define PAGE_SIZE_2M   (2 * ONE_MEGABYTE)
 
#define PAGE_OFFSET_MASK_2M   (PAGE_SIZE_2M - 1)
 
#define PAGE_MAX_OFFSET_2M   PAGE_OFFSET_MASK_2M
 
#define PAGE_BASE_MASK_2M   (0xFFFFFFFFFFFFFFFFULL - PAGE_MAX_OFFSET_2M)
 
#define PAGE_SIZE_4M   (4 * ONE_MEGABYTE)
 
#define PAGE_OFFSET_MASK_4M   (PAGE_SIZE_4M - 1)
 
#define PAGE_MAX_OFFSET_4M   PAGE_OFFSET_MASK_4M
 
#define PAGE_BASE_MASK_4M   (0xFFFFFFFFFFFFFFFFULL - PAGE_MAX_OFFSET_4M)
 
#define PAGE_SIZE_1G   (ONE_GIGABYTE)
 
#define PAGE_OFFSET_MASK_1G   (PAGE_SIZE_1G - 1)
 
#define PAGE_MAX_OFFSET_1G   PAGE_OFFSET_MASK_1G
 
#define PAGE_BASE_MASK_1G   (0xFFFFFFFFFFFFFFFFULL - PAGE_MAX_OFFSET_1G)
 
#define PAGE_SIZE   PAGE_SIZE_4K
 
#define PAGE_OFFSET_MASK   PAGE_OFFSET_MASK_4K
 
#define PAGE_OFFSET   PAGE_OFFSET_MASK
 
#define PAGE_MAX_OFFSET   PAGE_MAX_OFFSET_4K
 
#define PAGE_BASE_MASK   PAGE_BASE_MASK_4K
 
#define PAGE_MASK   PAGE_BASE_MASK
 
#define PHYS_PAGE_MASK   0x000FFFFFFFFFF000ULL
 
#define PML5_P   BIT(0)
 
#define PML5_RW   BIT(1)
 
#define PML5_US   BIT(2)
 
#define PML5_PWT   BIT(3)
 
#define PML5_PCD   BIT(4)
 
#define PML5_A   BIT(5)
 
#define PML5_PS   BIT(7)
 
#define PML5_LNK   BIT(9)
 
#define PML5_USED   BIT(10)
 
#define PML4_P   BIT(0)
 
#define PML4_RW   BIT(1)
 
#define PML4_US   BIT(2)
 
#define PML4_PWT   BIT(3)
 
#define PML4_PCD   BIT(4)
 
#define PML4_A   BIT(5)
 
#define PML4_PS   BIT(7)
 
#define PML4_LNK   BIT(9)
 
#define PML4_USED   BIT(10)
 
#define PDP_P   BIT(0)
 
#define PDP_RW   BIT(1)
 
#define PDP_US   BIT(2)
 
#define PDP_PWT   BIT(3)
 
#define PDP_PCD   BIT(4)
 
#define PDP_A   BIT(5)
 
#define PDP_PS   BIT(7)
 
#define PDP_LNK   BIT(9)
 
#define PDP_USED   BIT(10)
 
#define PD_P   BIT(0)
 
#define PD_RW   BIT(1)
 
#define PD_US   BIT(2)
 
#define PD_PWT   BIT(3)
 
#define PD_PCD   BIT(4)
 
#define PD_A   BIT(5)
 
#define PD_D   BIT(6)
 
#define PD_PS   BIT(7)
 
#define PD_G   BIT(8)
 
#define PD_LNK   BIT(9)
 
#define PD_USED   BIT(10)
 
#define PT_P   BIT(0)
 
#define PT_RW   BIT(1)
 
#define PT_US   BIT(2)
 
#define PT_PWT   BIT(3)
 
#define PT_PCD   BIT(4)
 
#define PT_A   BIT(5)
 
#define PT_D   BIT(6)
 
#define PT_PAT   BIT(7)
 
#define PT_G   BIT(8)
 
#define PT_XD   BIT(63)
 
#define PML5_INDEX(a)   (DWORD)(((a) & 0x01ff000000000000) >> 48)
 
#define PML4_INDEX(a)   (DWORD)(((a) & 0x0000ff8000000000) >> 39)
 
#define PDP_INDEX(a)   (DWORD)(((a) & 0x0000007fc0000000) >> 30)
 
#define PD_INDEX(a)   (DWORD)(((a) & 0x000000003fe00000) >> 21)
 
#define PT_INDEX(a)   (DWORD)(((a) & 0x00000000001ff000) >> 12)
 
#define PDPPAE_INDEX(a)   (DWORD)(((a) & 0x00000000c0000000) >> 30)
 
#define PDPAE_INDEX(a)   (DWORD)(((a) & 0x000000003fe00000) >> 21)
 
#define PTPAE_INDEX(a)   (DWORD)(((a) & 0x00000000001ff000) >> 12)
 
#define PD32_INDEX(a)   (DWORD)(((a) & 0x00000000ffc00000) >> 22)
 
#define PT32_INDEX(a)   (DWORD)(((a) & 0x00000000003ff000) >> 12)
 
#define CR3_LEGACY_PAE_MASK   0x00000000FFFFFFE0
 
#define CR3_LEGACY_NON_PAE_MASK   0x00000000FFFFF000
 
#define CR3_LONG_MODE_MASK   PHYS_PAGE_MASK
 
#define CLEAN_PHYS_ADDRESS64(x)   ((x) & CR3_LONG_MODE_MASK)
 
#define CLEAN_PHYS_ADDRESS32(x)   ((x) & CR3_LEGACY_NON_PAE_MASK)
 
#define CLEAN_PHYS_ADDRESS32PAE(x)   ((x) & CR3_LONG_MODE_MASK)
 
#define CLEAN_PHYS_ADDRESS32PAE_ROOT(x)   ((x) & CR3_LEGACY_PAE_MASK)
 
#define PAGE_SX(addr)   (((addr) & 0x800000000000) ? ((addr) | 0xFFFF000000000000) : (addr))
 
#define PAGE_SPLIT(p, s)   (((p) & PAGE_OFFSET) > (((p) + (s) - 1) & PAGE_OFFSET))
 
#define PAGE_REMAINING(addr)   (PAGE_SIZE_4K - ((addr) & PAGE_OFFSET_MASK_4K))
 
#define PAGE_OFFSET_4K(addr)   ((addr) & PAGE_OFFSET_MASK_4K)
 
#define PAGE_FRAME_NUMBER_4K(addr)   ((addr) >> 12ULL)
 
#define PAGE_COUNT_4K(addr, bytes)   (PAGE_FRAME_NUMBER_4K(PAGE_OFFSET_4K(addr) + (bytes) + PAGE_MAX_OFFSET_4K))
 
#define PAGE_FRAME_NUMBER(addr)   PAGE_FRAME_NUMBER_4K(addr)
 
#define PAGE_COUNT(addr, bytes)   PAGE_COUNT_4K(addr, bytes)
 

Macro Definition Documentation

◆ CLEAN_PHYS_ADDRESS32

#define CLEAN_PHYS_ADDRESS32 (   x)    ((x) & CR3_LEGACY_NON_PAE_MASK)

Clears any reserved bits from a 32-bit physical address.

Parameters
[in]xPhysical address to clean.
Returns
x, but with all the reserved bits set to 0.

Definition at line 126 of file pgtable.h.

Referenced by IntHookPtsSetHook(), IntTranslateVa32(), and IntWinPfnHandleTranslationChange().

◆ CLEAN_PHYS_ADDRESS32PAE

#define CLEAN_PHYS_ADDRESS32PAE (   x)    ((x) & CR3_LONG_MODE_MASK)

Clears any reserved bits from a 32-bit PAE physical address.

Parameters
[in]xPhysical address to clean.
Returns
x, but with all the reserved bits set to 0.

Definition at line 133 of file pgtable.h.

Referenced by IntTranslateVa32Pae(), and IntWinPfnHandleTranslationChange().

◆ CLEAN_PHYS_ADDRESS32PAE_ROOT

#define CLEAN_PHYS_ADDRESS32PAE_ROOT (   x)    ((x) & CR3_LEGACY_PAE_MASK)

Clears any reserved bits from PAE root-table entry.

Parameters
[in]xPhysical address to clean.
Returns
x, but with all the reserved bits set to 0.

Definition at line 140 of file pgtable.h.

Referenced by IntHookPtsSetHook(), and IntTranslateVa32Pae().

◆ CLEAN_PHYS_ADDRESS64

#define CLEAN_PHYS_ADDRESS64 (   x)    ((x) & CR3_LONG_MODE_MASK)

Clears any reserved bits from a long-mode physical address.

Parameters
[in]xPhysical address to clean.
Returns
x, but with all the reserved bits set to 0.

Definition at line 119 of file pgtable.h.

Referenced by IntDispatchVeAsEpt(), IntHookGvaHandleSwap(), IntHookPtsCreateEntry(), IntHookPtsHandleModification(), IntHookPtsSetHook(), IntLixTaskFindByCr3(), IntMemClkHandleSwap(), IntTranslateVa64(), IntTranslateVa64La57(), IntVasPageTableWriteCallback(), IntVeHandleSwap(), IntWinPfnHandleTranslationChange(), and IntWinSelfMapHandleCr3SelfMapWrite().

◆ CR3_LEGACY_NON_PAE_MASK

#define CR3_LEGACY_NON_PAE_MASK   0x00000000FFFFF000

Definition at line 111 of file pgtable.h.

Referenced by IntGuestHandleCr3Write().

◆ CR3_LEGACY_PAE_MASK

#define CR3_LEGACY_PAE_MASK   0x00000000FFFFFFE0

Definition at line 110 of file pgtable.h.

Referenced by IntGuestHandleCr3Write().

◆ CR3_LONG_MODE_MASK

#define CR3_LONG_MODE_MASK   PHYS_PAGE_MASK

Definition at line 112 of file pgtable.h.

Referenced by IntGuestHandleCr3Write(), and IntLixGetKernelCr3().

◆ PAGE_BASE_MASK

#define PAGE_BASE_MASK   PAGE_BASE_MASK_4K

Definition at line 34 of file pgtable.h.

◆ PAGE_BASE_MASK_1G

#define PAGE_BASE_MASK_1G   (0xFFFFFFFFFFFFFFFFULL - PAGE_MAX_OFFSET_1G)

Definition at line 28 of file pgtable.h.

◆ PAGE_BASE_MASK_2M

#define PAGE_BASE_MASK_2M   (0xFFFFFFFFFFFFFFFFULL - PAGE_MAX_OFFSET_2M)

Definition at line 18 of file pgtable.h.

Referenced by IntLixFindDataStart().

◆ PAGE_BASE_MASK_4K

#define PAGE_BASE_MASK_4K   (0xFFFFFFFFFFFFFFFFULL - PAGE_MAX_OFFSET_4K)

Definition at line 13 of file pgtable.h.

◆ PAGE_BASE_MASK_4M

#define PAGE_BASE_MASK_4M   (0xFFFFFFFFFFFFFFFFULL - PAGE_MAX_OFFSET_4M)

Definition at line 23 of file pgtable.h.

◆ PAGE_COUNT

#define PAGE_COUNT (   addr,
  bytes 
)    PAGE_COUNT_4K(addr, bytes)

Obtains the number of 4KB in which a memory range is split.

Parameters
[in]addrBase virtual address.
[in]bytesThe length of the memory range.
Returns
The number of 4KB pages used to map the given memory range.

Definition at line 189 of file pgtable.h.

Referenced by _IntLixTaskRead(), IntLixCredInitMap(), IntLixFsrRead(), IntPhysMemMap(), and IntPhysMemReadWrite().

◆ PAGE_COUNT_4K

#define PAGE_COUNT_4K (   addr,
  bytes 
)    (PAGE_FRAME_NUMBER_4K(PAGE_OFFSET_4K(addr) + (bytes) + PAGE_MAX_OFFSET_4K))

Obtains the number of 4KB in which a memory range is split.

Parameters
[in]addrBase virtual address.
[in]bytesThe length of the memory range.
Returns
The number of 4KB pages used to map the given memory range.

Definition at line 174 of file pgtable.h.

Referenced by IntDecEmulateRead(), and IntVirtMemMap().

◆ PAGE_FRAME_NUMBER

#define PAGE_FRAME_NUMBER (   addr)    PAGE_FRAME_NUMBER_4K(addr)

Obtains the 4KB page frame number for virtual address.

Parameters
[in]addrAddress for which to get the page frame number.
Returns
The page frame number for the given address.

Definition at line 181 of file pgtable.h.

Referenced by _IntLixTaskRead(), IntExceptVerifyCodeBlocksSig(), IntKsymFindIndexesTableStart(), IntKsymFindMarkersTableEnd(), IntKsymFindNamesTableEnd(), IntLixFsrRead(), and IntLixKernelHandleRead().

◆ PAGE_FRAME_NUMBER_4K

#define PAGE_FRAME_NUMBER_4K (   addr)    ((addr) >> 12ULL)

Definition at line 166 of file pgtable.h.

◆ PAGE_MASK

#define PAGE_MASK   PAGE_BASE_MASK

Definition at line 35 of file pgtable.h.

Referenced by _IntLixTaskRead(), IntAlertEptFillFromVictimZone(), IntAlertFillCodeBlocks(), IntAlertFillDpiExtraInfo(), IntAlertFillExecContext(), IntDecDecodeInstruction(), IntDetSetHook(), IntExceptDumpSignatures(), IntExceptGetVictimEpt(), IntExceptInvCbCacheByGva(), IntExceptUserLogWindowsInformation(), IntExceptVerifyCodeBlocksSig(), IntExceptVerifyValueCodeSig(), IntHandleDtrViolation(), IntHandleEptViolation(), IntHandleEventInjection(), IntHandleFetchRetryOnPageBoundary(), IntHandleMemAccess(), IntHandlePageBoundaryCow(), IntHookGpaGetEPTPageProtection(), IntHookGpaIsPageHooked(), IntHookGpaSetHook(), IntHookGvaSetHook(), IntHookPtwEmulateWrite(), IntIcAddInstruction(), IntIcAddInvdForInstruction(), IntIcFlushGvaPage(), IntIntegrityCheckAll(), IntKsymInitAbsolute(), IntKsymRelativeFindOffsetTableStart(), IntLixCredInitMap(), IntLixDrvFindList(), IntLixFindDataStart(), IntLixFsrRead(), IntLixGetInitTask(), IntLixGuestFindKernelBase(), IntLixGuestFindKernelVersionAndRo(), IntLixMmGetInitMm(), IntLixStackTraceGet(), IntLixVdsoDynamicProtectRelocate(), IntLixVdsoHandleWriteCommon(), IntLogCriticalStructureCoruption(), IntMemClkCloakRegion(), IntMemClkHandleSwap(), IntMemClkHashRegion(), IntPeFindExportByRva(), IntPeFindFunctionStart(), IntPeGetRuntimeFunction(), IntPhysMemUnmap(), IntReadString(), IntSerializeCodeBlocksPattern(), IntSerializeDpiWinHeapSpray(), IntSerializeDpiWinThreadStart(), IntSerializeExtractCodeBlocks(), IntSerializeRipCode(), IntShcIsSuspiciousCode(), IntSwapMemCancelPendingPF(), IntSwapMemReadData(), IntThrSafeIsStackPtrInIntro(), IntThrSafeMoveReturn(), IntThrSafeWinInspectRunningThreadOnCpu(), IntValidateRangeForWrite(), IntVirtMemSafeWrite(), IntWinCrashHandleDepViolation(), IntWinDpiGetViolationAddress(), IntWinDpiValidateHeapSpray(), IntWinDpiValidateThreadStart(), IntWinDrvCreateFromAddress(), IntWinDrvHandleRead(), IntWinDrvHeadersInMemory(), IntWinGuestFindBuildNumber(), IntWinGuestFindKernel(), IntWinGuestValidateKernel(), IntWinHalHandleDispatchTableWrite(), IntWinHalHandleHalHeapExec(), IntWinModPolyHandler(), IntWinNetCheckPartition(), IntWinNetFillTcpStruct(), IntWinNetFindTcpBitmap(), IntWinNetFindTcpPartition(), IntWinNetSearchForAlloc(), IntWinObjFindRootDirectory(), IntWinPfnFindByGva(), IntWinPfnLockAddress(), IntWinPfnMoveLock(), IntWinPfnUnlockAddress(), IntWinProcHandleInstrument(), IntWinStackHandleUserStackPagedOut(), IntWinStackTraceGet32(), IntWinStackTraceGet64(), IntWinStackTraceGetUser32(), IntWinTokenPrivsShouldHook(), IntWinTokenProtectPrivsInternal(), IntWinVadAdjustRange(), IntWinVadFetchByRange(), IntWinVadFindAndUpdateIfNecessary(), IntWinVadHandleCommit(), IntWinVadHandleDeleteVaRange(), IntWinVadHandleFinishVadDeletion(), IntWinVadHandleProtectGeneric(), IntWinVadHandleVirtualProtect(), IntWinVadProcImportMainModuleVad(), and IntWinVadRemoveRange().

◆ PAGE_MAX_OFFSET

#define PAGE_MAX_OFFSET   PAGE_MAX_OFFSET_4K

Definition at line 33 of file pgtable.h.

◆ PAGE_MAX_OFFSET_1G

#define PAGE_MAX_OFFSET_1G   PAGE_OFFSET_MASK_1G

Definition at line 27 of file pgtable.h.

◆ PAGE_MAX_OFFSET_2M

#define PAGE_MAX_OFFSET_2M   PAGE_OFFSET_MASK_2M

Definition at line 17 of file pgtable.h.

◆ PAGE_MAX_OFFSET_4K

#define PAGE_MAX_OFFSET_4K   PAGE_OFFSET_MASK_4K

Definition at line 12 of file pgtable.h.

◆ PAGE_MAX_OFFSET_4M

#define PAGE_MAX_OFFSET_4M   PAGE_OFFSET_MASK_4M

Definition at line 22 of file pgtable.h.

◆ PAGE_OFFSET

#define PAGE_OFFSET   PAGE_OFFSET_MASK

Definition at line 32 of file pgtable.h.

Referenced by _IntLixTaskRead(), IntAlertEptFillFromVictimZone(), IntAlertFillCodeBlocks(), IntDecEmulatePTWrite(), IntDumpCodeAndRegs(), IntEngDumpCodeAndRegs(), IntExceptDumpSignatures(), IntExceptVerifyCodeBlocksSig(), IntFragDumpBlocks(), IntGpaCacheFetchAndAdd(), IntGpaCachePatchAndAdd(), IntHandleEptViolation(), IntHookGpaSetHook(), IntHookGvaSetHook(), IntHookPtsCreateEntry(), IntIcFlushGvaPage(), IntIntegrityCheckAll(), IntIterateVirtualAddressSpace(), IntKsymFindIndexesTableStart(), IntKsymFindMarkersTableEnd(), IntKsymFindNamesTableEnd(), IntKsymRelativeFindOffsetTableEnd(), IntLixCredCalculateCrc32Region(), IntLixDrvHandleWrite(), IntLixDrvIsLegitimateTextPoke(), IntLixDrvSendViolationEvent(), IntLixFsrRead(), IntLixGetInitTask(), IntLixKernelHandleRead(), IntLixMmGetInitMm(), IntLixStackTraceGet(), IntLixTaskFetchCmdLine(), IntLixVdsoHandleWriteCommon(), IntMemClkCloakRegion(), IntMemClkHandleRead(), IntMemClkHashRegion(), IntPeFindExportByRva(), IntPeFindFunctionStart(), IntPeFindFunctionStartInBuffer(), IntPeGetRuntimeFunction(), IntPeValidateHeader(), IntPhysMemFastMap(), IntPtiMonitorAllPtWriteCandidates(), IntSerializeCodeBlocksGetExtractRange(), IntSerializeCodeBlocksPattern(), IntShcIsSuspiciousCode(), IntSlackAllocWindows(), IntThrSafeWinInspectWaitingThread(), IntUnpPageExecuteCallback(), IntVasPageTableWriteCallback(), IntVeHandleAccess(), IntVeHandleEPTViolationInProtectedView(), IntWinDrvIsListHead(), IntWinDrvObjHandleWrite(), IntWinGuestFindDriversNamespaceNoBuffer(), IntWinGuestFindKernelCr3(), IntWinGuestFindKernelObjectsInternal(), IntWinGuestValidateKernel(), IntWinHalHandleHalHeapExec(), IntWinModPolyHandler(), IntWinNetFillTcpStruct(), IntWinNetFindTcpPartition(), IntWinNetGetTcpPortPool(), IntWinNetGetTcpPortPoolFromCompartment(), IntWinNetSearchForAlloc(), IntWinStackTraceGet64(), IntWinTokenPrivsHandleWrite(), and IntWinTokenPrivsShouldHook().

◆ PAGE_OFFSET_4K

#define PAGE_OFFSET_4K (   addr)    ((addr) & PAGE_OFFSET_MASK_4K)

Definition at line 165 of file pgtable.h.

◆ PAGE_OFFSET_MASK

#define PAGE_OFFSET_MASK   PAGE_OFFSET_MASK_4K

Definition at line 31 of file pgtable.h.

◆ PAGE_OFFSET_MASK_1G

#define PAGE_OFFSET_MASK_1G   (PAGE_SIZE_1G - 1)

Definition at line 26 of file pgtable.h.

◆ PAGE_OFFSET_MASK_2M

#define PAGE_OFFSET_MASK_2M   (PAGE_SIZE_2M - 1)

Definition at line 16 of file pgtable.h.

Referenced by IntLixFindDataStart().

◆ PAGE_OFFSET_MASK_4K

#define PAGE_OFFSET_MASK_4K   (PAGE_SIZE_4K - 1)

Definition at line 11 of file pgtable.h.

◆ PAGE_OFFSET_MASK_4M

#define PAGE_OFFSET_MASK_4M   (PAGE_SIZE_4M - 1)

Definition at line 21 of file pgtable.h.

◆ PAGE_REMAINING

#define PAGE_REMAINING (   addr)    (PAGE_SIZE_4K - ((addr) & PAGE_OFFSET_MASK_4K))

Computes the size of the memory range between a given address and the end of the 4KB memory page that maps that address.

Parameters
[in]addrMemory address for which to do the computation.
Returns
The size of the portion between addr and the end of the page.

Definition at line 163 of file pgtable.h.

Referenced by _IntLixTaskRead(), _IntLixTaskStartMap(), DbgDumpCodeblocks(), IntDecDecodeInstruction(), IntExceptVerifyValueCodeSig(), IntHandleEptViolation(), IntHookObjectHookRegion(), IntIntegrityAddRegion(), IntIntegrityCheckAll(), IntIntegrityRecalculate(), IntKsymFindIndexesTableStart(), IntKsymFindMarkersReducedTableEnd(), IntKsymFindMarkersTableEnd(), IntKsymFindNamesTableEnd(), IntLixCredCalculateCrc32Region(), IntLixCredInitMap(), IntLixDrvIsLegitimateTextPoke(), IntLixDumpStacktrace(), IntLixFsrInitMap(), IntLixFsrRead(), IntLixGuestClearGuestMemory(), IntLixPatchSwapgs(), IntMemClkCloakRegion(), IntMemClkHandleSwap(), IntPeGetRuntimeFunction(), IntPhysMemReadWrite(), IntPhysMemReadWriteAnySize(), IntReadString(), IntSlackAllocLinux(), IntSlackAllocWindows(), IntSwapMemReadData(), IntThrSafeIsStackPtrInIntro(), IntThrSafeMoveReturn(), IntThrSafeWinInspectWaitingThread(), IntVirtMemReadWrite(), IntVirtMemSafeWrite(), IntVirtMemSet(), IntWinGuestValidateKernel(), IntWinStackTraceGet32(), IntWinStackTraceGetUser32(), and IntWinStackTraceGetUser64().

◆ PAGE_SIZE

#define PAGE_SIZE   PAGE_SIZE_4K

Definition at line 30 of file pgtable.h.

◆ PAGE_SIZE_1G

#define PAGE_SIZE_1G   (ONE_GIGABYTE)

Definition at line 25 of file pgtable.h.

Referenced by IntHookPtsGetPageSize(), IntIterateVirtualAddressSpaceRec(), IntTranslateVa64(), IntTranslateVa64La57(), and IntVasGetPageSize().

◆ PAGE_SIZE_2M

#define PAGE_SIZE_2M   (2 * ONE_MEGABYTE)

Definition at line 15 of file pgtable.h.

Referenced by IntHookPtsGetPageSize(), IntIterateVirtualAddressSpaceRec(), IntLixDepDeployFileHypercall(), IntTranslateVa32Pae(), IntTranslateVa64(), IntTranslateVa64La57(), and IntVasGetPageSize().

◆ PAGE_SIZE_4K

#define PAGE_SIZE_4K   4096u

Definition at line 10 of file pgtable.h.

Referenced by IntDecEmulateRead(), IntHookGpaSetHook(), IntHookPtsGetPageSize(), IntIterateVirtualAddressSpaceRec(), IntSwapMemReadData(), IntTranslateVa32(), IntTranslateVa32Pae(), IntTranslateVa64(), IntTranslateVa64La57(), IntVasGetPageSize(), IntVirtMemMap(), IntVirtMemMapMultiPage(), IntWinPfnHandleTranslationChange(), and IntWinPfnLockAddress().

◆ PAGE_SIZE_4M

#define PAGE_SIZE_4M   (4 * ONE_MEGABYTE)

Definition at line 20 of file pgtable.h.

Referenced by IntHookPtsGetPageSize(), IntIterateVirtualAddressSpaceRec(), IntTranslateVa32(), and IntVasGetPageSize().

◆ PAGE_SPLIT

#define PAGE_SPLIT (   p,
  s 
)    (((p) & PAGE_OFFSET) > (((p) + (s) - 1) & PAGE_OFFSET))

Checks if a memory range is split across multiple 4KB pages.

Parameters
[in]pThe base of the memory range.
[in]sThe size of the memory range.
Returns
True if the memory range [p, p + s) is split across multiple 4KB pages; False if it is not split.

Definition at line 155 of file pgtable.h.

◆ PAGE_SX

#define PAGE_SX (   addr)    (((addr) & 0x800000000000) ? ((addr) | 0xFFFF000000000000) : (addr))

Checks if a memory address is sign-extended.

Parameters
[in]addrMemory address to check.
Returns
True if the address has the sign bits set; False if it does not.

Definition at line 147 of file pgtable.h.

Referenced by IntIterateVirtualAddressSpaceRec().

◆ PD32_INDEX

#define PD32_INDEX (   a)    (DWORD)(((a) & 0x00000000ffc00000) >> 22)

Definition at line 107 of file pgtable.h.

Referenced by IntHookPtsSetHook(), IntSplitVirtualAddress(), and IntTranslateVa32().

◆ PD_A

#define PD_A   BIT(5)

Definition at line 76 of file pgtable.h.

◆ PD_D

#define PD_D   BIT(6)

Definition at line 77 of file pgtable.h.

◆ PD_G

#define PD_G   BIT(8)

Definition at line 79 of file pgtable.h.

◆ PD_INDEX

#define PD_INDEX (   a)    (DWORD)(((a) & 0x000000003fe00000) >> 21)

Definition at line 97 of file pgtable.h.

Referenced by IntHookPtsSetHook(), IntSplitVirtualAddress(), IntTranslateVa64(), IntTranslateVa64La57(), and IntVeIsAgentRemapped().

◆ PD_LNK

#define PD_LNK   BIT(9)

Definition at line 80 of file pgtable.h.

◆ PD_P

#define PD_P   BIT(0)

Definition at line 71 of file pgtable.h.

Referenced by IntLixDrvInitVfreeHandler(), IntTranslateVa32(), IntTranslateVa32Pae(), IntTranslateVa64(), IntTranslateVa64La57(), and IntVasPageTableWriteCallback().

◆ PD_PCD

#define PD_PCD   BIT(4)

Definition at line 75 of file pgtable.h.

◆ PD_PS

#define PD_PS   BIT(7)

Definition at line 78 of file pgtable.h.

Referenced by IntHookPtsCreateEntry(), IntHookPtsHandleModification(), IntIterateVirtualAddressSpaceRec(), IntTranslateVa32(), IntTranslateVa32Pae(), IntTranslateVa64(), IntTranslateVa64La57(), IntVasHookTables(), and IntVasPageTableWriteCallback().

◆ PD_PWT

#define PD_PWT   BIT(3)

Definition at line 74 of file pgtable.h.

◆ PD_RW

#define PD_RW   BIT(1)

Definition at line 72 of file pgtable.h.

Referenced by IntLixDrvInitVfreeHandler().

◆ PD_US

#define PD_US   BIT(2)

Definition at line 73 of file pgtable.h.

◆ PD_USED

#define PD_USED   BIT(10)

Definition at line 81 of file pgtable.h.

◆ PDP_A

#define PDP_A   BIT(5)

Definition at line 66 of file pgtable.h.

◆ PDP_INDEX

#define PDP_INDEX (   a)    (DWORD)(((a) & 0x0000007fc0000000) >> 30)

Definition at line 96 of file pgtable.h.

Referenced by IntHookPtsSetHook(), IntSplitVirtualAddress(), IntTranslateVa64(), IntTranslateVa64La57(), and IntVeIsAgentRemapped().

◆ PDP_LNK

#define PDP_LNK   BIT(9)

Definition at line 68 of file pgtable.h.

◆ PDP_P

#define PDP_P   BIT(0)

Definition at line 61 of file pgtable.h.

Referenced by IntHookPtsSetHook(), and IntTranslateVa32Pae().

◆ PDP_PCD

#define PDP_PCD   BIT(4)

Definition at line 65 of file pgtable.h.

◆ PDP_PS

#define PDP_PS   BIT(7)

Definition at line 67 of file pgtable.h.

Referenced by IntHookPtsSetHook(), IntIterateVirtualAddressSpaceRec(), IntTranslateVa64(), IntTranslateVa64La57(), and IntVasHookTables().

◆ PDP_PWT

#define PDP_PWT   BIT(3)

Definition at line 64 of file pgtable.h.

◆ PDP_RW

#define PDP_RW   BIT(1)

Definition at line 62 of file pgtable.h.

◆ PDP_US

#define PDP_US   BIT(2)

Definition at line 63 of file pgtable.h.

◆ PDP_USED

#define PDP_USED   BIT(10)

Definition at line 69 of file pgtable.h.

◆ PDPAE_INDEX

#define PDPAE_INDEX (   a)    (DWORD)(((a) & 0x000000003fe00000) >> 21)

Definition at line 103 of file pgtable.h.

Referenced by IntTranslateVa32Pae().

◆ PDPPAE_INDEX

#define PDPPAE_INDEX (   a)    (DWORD)(((a) & 0x00000000c0000000) >> 30)

Definition at line 102 of file pgtable.h.

Referenced by IntHookPtsSetHook(), and IntTranslateVa32Pae().

◆ PHYS_PAGE_MASK

#define PHYS_PAGE_MASK   0x000FFFFFFFFFF000ULL

Definition at line 38 of file pgtable.h.

Referenced by DbgVaSpaceIterationCallback(), DbgVaSpaceIterationCallbackCount(), IntAlertEptFillFromVictimZone(), IntDumpCodeAndRegs(), IntGpaCacheAddEntry(), IntGpaCacheLookupEntry(), IntGpaCacheRelease(), IntHandleEptViolation(), IntHandleMemAccess(), IntHookGpaGetEptEntry(), IntHookGpaGetExistingEptEntry(), IntHookPtmAddTable(), IntIcAddInvdForInstruction(), IntIcFlushGpaPage(), IntIterateVirtualAddressSpaceRec(), IntMemClkHashRegion(), IntPhysMemFastMap(), IntPtiCacheAdd(), IntPtiCacheRemove(), IntShcIsSuspiciousCode(), IntSwapMemPageSwappedIn(), IntValidateTranslation(), IntVasHookTables(), IntVasPageTableWriteCallback(), IntWinCrashHandleDepViolation(), IntWinGuestFindSelfMapIndex(), IntWinGuestIsSystemCr3(), IntWinHalFindHalHeapAndInterruptController(), and IntWinPfnFindByGpa().

◆ PML4_A

#define PML4_A   BIT(5)

Definition at line 56 of file pgtable.h.

Referenced by IntDispatchVeAsEpt().

◆ PML4_INDEX

#define PML4_INDEX (   a)    (DWORD)(((a) & 0x0000ff8000000000) >> 39)

Definition at line 95 of file pgtable.h.

Referenced by IntDispatchVeAsEpt(), IntHookPtsSetHook(), IntSplitVirtualAddress(), IntTranslateVa64(), IntTranslateVa64La57(), and IntVeIsAgentRemapped().

◆ PML4_LNK

#define PML4_LNK   BIT(9)

Definition at line 58 of file pgtable.h.

◆ PML4_P

#define PML4_P   BIT(0)

Definition at line 51 of file pgtable.h.

Referenced by IntDispatchVeAsEpt().

◆ PML4_PCD

#define PML4_PCD   BIT(4)

Definition at line 55 of file pgtable.h.

◆ PML4_PS

#define PML4_PS   BIT(7)

Definition at line 57 of file pgtable.h.

◆ PML4_PWT

#define PML4_PWT   BIT(3)

Definition at line 54 of file pgtable.h.

◆ PML4_RW

#define PML4_RW   BIT(1)

Definition at line 52 of file pgtable.h.

◆ PML4_US

#define PML4_US   BIT(2)

Definition at line 53 of file pgtable.h.

◆ PML4_USED

#define PML4_USED   BIT(10)

Definition at line 59 of file pgtable.h.

◆ PML5_A

#define PML5_A   BIT(5)

Definition at line 46 of file pgtable.h.

◆ PML5_INDEX

#define PML5_INDEX (   a)    (DWORD)(((a) & 0x01ff000000000000) >> 48)

Definition at line 94 of file pgtable.h.

Referenced by IntHookPtsSetHook(), IntSplitVirtualAddress(), and IntTranslateVa64La57().

◆ PML5_LNK

#define PML5_LNK   BIT(9)

Definition at line 48 of file pgtable.h.

◆ PML5_P

#define PML5_P   BIT(0)

Definition at line 41 of file pgtable.h.

◆ PML5_PCD

#define PML5_PCD   BIT(4)

Definition at line 45 of file pgtable.h.

◆ PML5_PS

#define PML5_PS   BIT(7)

Definition at line 47 of file pgtable.h.

◆ PML5_PWT

#define PML5_PWT   BIT(3)

Definition at line 44 of file pgtable.h.

◆ PML5_RW

#define PML5_RW   BIT(1)

Definition at line 42 of file pgtable.h.

◆ PML5_US

#define PML5_US   BIT(2)

Definition at line 43 of file pgtable.h.

◆ PML5_USED

#define PML5_USED   BIT(10)

Definition at line 49 of file pgtable.h.

◆ PT32_INDEX

#define PT32_INDEX (   a)    (DWORD)(((a) & 0x00000000003ff000) >> 12)

Definition at line 108 of file pgtable.h.

Referenced by IntHookPtsSetHook(), IntSplitVirtualAddress(), and IntTranslateVa32().

◆ PT_A

#define PT_A   BIT(5)

Definition at line 88 of file pgtable.h.

Referenced by IntDecEmulatePageWalk().

◆ PT_D

#define PT_D   BIT(6)

Definition at line 89 of file pgtable.h.

Referenced by DbgVaSpaceIterationCallbackCount(), and IntDecEmulatePageWalk().

◆ PT_G

#define PT_G   BIT(8)

Definition at line 91 of file pgtable.h.

◆ PT_INDEX

#define PT_INDEX (   a)    (DWORD)(((a) & 0x00000000001ff000) >> 12)

Definition at line 98 of file pgtable.h.

Referenced by IntHookPtsSetHook(), IntSplitVirtualAddress(), IntTranslateVa64(), IntTranslateVa64La57(), and IntVeIsAgentRemapped().

◆ PT_P

#define PT_P   BIT(0)

Definition at line 83 of file pgtable.h.

Referenced by IntDecEmulatePageWalk(), IntHandleCowOnPage(), IntHandleMemAccess(), IntHookGvaHandleSwap(), IntHookGvaSetHook(), IntHookPtsCheckIntegrity(), IntHookPtsSetHook(), IntHookPtsWriteCallback(), IntLixGuestFindKernelVersionAndRo(), IntSwapMemInjectPendingPF(), IntSwapMemPageSwappedIn(), IntSwapMemReadData(), IntTranslateVa32Pae(), IntTranslateVirtualAddress(), IntValidateRangeForWrite(), IntValidateTranslation(), IntVeHandleSwap(), IntVirtMemMap(), IntVirtMemSafeWrite(), IntWinDpiValidateHeapSpray(), IntWinDrvObjIsValidDriverObject(), IntWinGuestIsSystemCr3(), IntWinPfnHandleTranslationChange(), IntWinPfnIsMmPfnDatabase(), IntWinPfnLockAddress(), IntWinProcValidateSystemCr3(), IntWinSDFetchSecDescAddress(), IntWinSDReadSecDesc(), IntWinSelfMapHandleCr3SelfMapWrite(), and IntWinTokenFetchTokenAddress().

◆ PT_PAT

#define PT_PAT   BIT(7)

Definition at line 90 of file pgtable.h.

Referenced by IntTranslateVirtualAddressEx().

◆ PT_PCD

#define PT_PCD   BIT(4)

Definition at line 87 of file pgtable.h.

Referenced by IntTranslateVirtualAddressEx(), and IntWinDrvObjIsValidDriverObject().

◆ PT_PWT

#define PT_PWT   BIT(3)

Definition at line 86 of file pgtable.h.

Referenced by IntTranslateVirtualAddressEx().

◆ PT_RW

#define PT_RW   BIT(1)

Definition at line 84 of file pgtable.h.

Referenced by DbgVaSpaceIterationCallbackCount(), IntDecEmulatePageWalk(), IntHookGvaHandleSwap(), IntLixGuestDeployUninitAgent(), IntTranslateVa32(), IntTranslateVa32Pae(), IntTranslateVa64(), and IntTranslateVa64La57().

◆ PT_US

#define PT_US   BIT(2)

Definition at line 85 of file pgtable.h.

Referenced by IntTranslateVa32(), IntTranslateVa32Pae(), IntTranslateVa64(), IntTranslateVa64La57(), IntVasPageTableWriteCallback(), IntWinDrvObjIsValidDriverObject(), IntWinSelfMapCheckSelfMapEntry(), IntWinSelfMapGetAndCheckSelfMapEntry(), IntWinSelfMapHandleCr3SelfMapModification(), and IntWinSelfMapHandleCr3SelfMapWrite().

◆ PT_XD

#define PT_XD   BIT(63)

Definition at line 92 of file pgtable.h.

Referenced by IntLixGuestDeployUninitAgent(), IntSwapMemPageSwappedIn(), IntSwapMemReadData(), IntTranslateVa32Pae(), IntTranslateVa64(), and IntTranslateVa64La57().

◆ PTPAE_INDEX

#define PTPAE_INDEX (   a)    (DWORD)(((a) & 0x00000000001ff000) >> 12)

Definition at line 104 of file pgtable.h.

Referenced by IntTranslateVa32Pae().