Bitdefender Hypervisor Memory Introspection
ptfilter.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
5 #ifndef _PTWRITES_H_
6 #define _PTWRITES_H_
7 
8 #include "thread_safeness.h"
9 
10 INTSTATUS
11 IntPtiHandleInt3(
12  void
13  );
14 
15 void
16 IntPtiDumpStats(
17  void
18  );
19 
20 BOOLEAN
21 IntPtiIsPtrInAgent(
22  _In_ QWORD Ptr,
23  _In_ THS_PTR_TYPE Type
24  );
25 
26 INTSTATUS
27 IntPtiCacheRemove(
28  _In_ QWORD Gpa
29  );
30 
31 INTSTATUS
32 IntPtiCacheAdd(
33  _In_ QWORD Gpa
34  );
35 
36 INTSTATUS
37 IntPtiInjectPtFilter(
38  void
39  );
40 
41 INTSTATUS
42 IntPtiRemovePtFilter(
43  _In_ DWORD AgOpts
44  );
45 
46 QWORD
47 IntPtiGetAgentAddress(
48  void
49  );
50 
51 QWORD
52 IntPtiAllocMemtableSpace(
53  _In_ QWORD Rip,
54  _In_ DWORD Size
55  );
56 
57 void
58 IntPtiHandleGuestResumeFromSleep(
59  void
60  );
61 
62 INTSTATUS
63 IntPtiRemoveInstruction(
64  _In_ QWORD Rip
65  );
66 
67 #endif // _PTWRITES_H_
IntPtiIsPtrInAgent
BOOLEAN IntPtiIsPtrInAgent(QWORD Ptr, THS_PTR_TYPE Type)
Check if an address points inside the PT filter. Ignore non-executable sections when doing so...
Definition: ptfilter.c:1813
IntPtiInjectPtFilter
INTSTATUS IntPtiInjectPtFilter(void)
Inject the PT filter inside the guest.
Definition: ptfilter.c:1676
BOOLEAN
_Bool BOOLEAN
Definition: intro_types.h:58
IntPtiRemoveInstruction
INTSTATUS IntPtiRemoveInstruction(QWORD Rip)
Remove the hook on a monitored instruction.
Definition: ptfilter.c:792
_In_
#define _In_
Definition: intro_sal.h:21
IntPtiCacheRemove
INTSTATUS IntPtiCacheRemove(QWORD Gpa)
Remove a guest physical page from the PT filter cache.
Definition: ptfilter.c:1863
INTSTATUS
int INTSTATUS
The status data type.
Definition: introstatus.h:24
QWORD
unsigned long long QWORD
Definition: intro_types.h:53
IntPtiGetAgentAddress
QWORD IntPtiGetAgentAddress(void)
Get the guest virtual address where the PT filter resides.
Definition: ptfilter.c:1974
thread_safeness.h
IntPtiCacheAdd
INTSTATUS IntPtiCacheAdd(QWORD Gpa)
Add a guest-physical address to the PT filter cache of entries for which an exit is not required...
Definition: ptfilter.c:1912
DWORD
uint32_t DWORD
Definition: intro_types.h:49
IntPtiDumpStats
void IntPtiDumpStats(void)
Dump PT filtering statistics.
Definition: ptfilter.c:907
IntPtiHandleInt3
INTSTATUS IntPtiHandleInt3(void)
This function is the main INT3 handler.
Definition: ptfilter.c:859
IntPtiHandleGuestResumeFromSleep
void IntPtiHandleGuestResumeFromSleep(void)
Sets PtFilterWaiting to true if PT filtering was enabled, or to false otherwise.
Definition: ptfilter.c:2064
THS_PTR_TYPE
THS_PTR_TYPE
The type of pointer to be checked.
Definition: thread_safeness.h:28
IntPtiRemovePtFilter
INTSTATUS IntPtiRemovePtFilter(DWORD AgOpts)
Removes the PT filter.
Definition: ptfilter.c:1736
IntPtiAllocMemtableSpace
QWORD IntPtiAllocMemtableSpace(QWORD Rip, DWORD Size)
Allocate space for a mem-table.
Definition: ptfilter.c:1988