#include "serializers.h"
#include "guests.h"
#include "lixmm.h"
#include "winprocesshp.h"
#include "codeblocks.h"
#include "crc32.h"
#include "lixfiles.h"

Go to the source code of this file.

Data Structures
struct	_SERIALIZER_HEADER
	Describes the header of the serializer buffer. More...

struct	_SERIALIZER_OBJECT_HEADER
	Describes the header for each serialized item. More...

struct	_SERIALIZER_STRING
	Describes a serialized string. More...

struct	_SERIALIZER_EXCEPTION_KM_ORIGINATOR
	Describes a serialized intObjKmOriginator object. More...

struct	_SERIALIZER_EXCEPTION_UM_ORIGINATOR
	Describes a serialized intObjUmOriginator object. More...

struct	_SERIALIZER_EXCEPTION_VICTIM
	Describes a serialized intObjVictim object. More...

struct	_SERIALIZER_EPT
	Describes a serialized intObjEpt object. More...

struct	_SERIALIZER_MSR
	Describes a serialized intObjMsr object. More...

struct	_SERIALIZER_CR
	Describes a serialized intObjCr object. More...

struct	_SERIALIZER_DTR
	Describes a serialized intObjDtr object. More...

struct	_SERIALIZER_IDT
	Describes a serialized intObjIdt object. More...

struct	_SERIALIZER_INJECTION
	Describes a serialized intObjInjection object. More...

struct	_SERIALIZER_LIX_PROCESS
	Describes a serialized intObjLixProcess object. More...

struct	_SERIALIZER_WIN_PROCESS
	Describes a serialized intObjWinProcess object. More...

struct	_SERIALIZER_LIX_VMA
	Describes a serialized intObjLixVma object. More...

struct	_SERIALIZER_WIN_VAD
	Describes a serialized intObjWinVad object. More...

struct	_SERIALIZER_KERNEL_DRIVER
	Describes a serialized intObjKernelDriver object. More...

struct	_SERIALIZER_WIN_KERNEL_DRIVER
	Describes a serialized intObjWinKernelDriver object. More...

struct	_SERIALIZER_LIX_KERNEL_MODULE
	Describes a serialized intObjLixKernelModule object. More...

struct	_SERIALIZER_KERNEL_DRV_OBJECT
	Describes a serialized intObjKernelDrvObject object. More...

struct	_SERIALIZER_WIN_MODULE
	Describes a serialized intObjWinModule object. More...

struct	_SERIALIZER_INSTRUX
	Describes a serialized intObjInstrux object. More...

struct	_SERIALIZER_ARCH_REGS
	Describes a serialized intObjArchRegs object. More...

struct	_SERIALIZER_WRITE_INFO
	Describes a serialized intObjWriteInfo object. More...

struct	_SERIALIZER_READ_INFO
	Describes a serialized intObjExecInfo object. More...

struct	_SERIALIZER_EXEC_INFO
	Describes a serialized intObjExecInfo object. More...

struct	_SERIALIZER_CODE_BLOCKS
	Describes a serialized intObjCodeBlocks object. More...

struct	_SERIALIZER_RIP_CODE
	Describes a serialized intObjRipCode object. More...

struct	_SERIALIZER_RAW_DUMP
	Describes a serialized intObjRawDump object. More...

struct	_SERIALIZER_EXPORT
	Describes a serialized intObjExport object. More...

struct	_SERIALIZER_DPI_WIN_DEBUG
	Describes a serialized intObjDpiWinDebug. More...

struct	_SERIALIZER_DPI_WIN_STOLEN_TOKEN
	Describes a serialized intObjDpiWinStolenToken. More...

struct	_SERIALIZER_DPI_WIN_HEAP_SPRAY
	Describes a serialized intObjDpiWinHeapSpray. More...

struct	_SERIALIZER_DPI_WIN_THREAD_START
	Describes a serialized intObjDpiWinThreadStart. More...

struct	_SERIALIZER_DPI_WIN_TOKEN_PRIVS
	Describes a serialized intObjDpiWinTokenPrivs. More...

struct	_SERIALIZER_DPI_PIVOTED_STACK
	Describes a serialized intObjDpiPivotedStack. More...

struct	_SERIALIZER_DPI_WIN_SEC_DESC
	Describes a serialized intObjDpiWinSecDesc. More...

struct	_SERIALIZER_DPI_WIN_ACL_EDIT
	Describes a serialized intObjDpiWinAclEdit. More...

struct	_SERIALIZER_DPI
	Describes a serialized intObjDpi object. More...

Macros
#define	MAX_SERIALIZER_LENGTH (16 * ONE_KILOBYTE)

#define	Base64EncSize(Length) (((((Length) + 2) / 3) * 4) + 1)

#define	VICTIM_SERIALIZER_EPT_VERSION 1

#define	VICTIM_SERIALIZER_CR_VERSION 1

#define	VICTIM_SERIALIZER_IDT_VERSION 1

#define	VICTIM_SERIALIZER_MSR_VERSION 1

#define	VICTIM_SERIALIZER_DTR_VERSION 1

#define	VICTIM_SERIALIZER_INJECTION_VERSION 1

#define	WIN_PROCESS_SERIALIZER_VERSION 1

#define	LIX_PROCESS_SERIALIZER_VERSION 1

#define	WIN_VAD_SERIALIZER_VERSION 1

#define	LIX_VMA_SERIALIZER_VERSION 1

#define	WIN_KERNEL_DRIVER_SERIALIZER_VERSION 1

#define	LIX_KERNEL_MODULE_SERIALIZER_VERSION 1

#define	KERNEL_DRV_OBJECT_SERIALIZER_VERSION 1

#define	KERNEL_DRIVER_SERIALIZER_VERSION 1

#define	WIN_PROCESS_MODULE_SERIALIZER_VERSION 1

#define	INSTRUX_SERIALIZER_VERSION 1

#define	WRITE_INFO_SERIALIZER_VERSION 1

#define	READ_INFO_SERIALIZER_VERSION 1

#define	EXEC_INFO_SERIALIZER_VERSION 1

#define	RAW_DUMP_SERIALIZER_VERSION 1

#define	RIP_CODE_SERIALIZER_VERSION 1

#define	CODE_BLOCKS_SERIALIZER_VERSION 1

#define	ARCH_REGS_SERIALIZER_VERSION 1

#define	DPI_WIN_DEBUG_SERIALIZER_VERSION 1

#define	DPI_WIN_PIVOTET_STACK_SERIALIZER_VERSION 1

#define	DPI_WIN_STOLEN_TOKEN_SERIALIZER_VERSION 1

#define	DPI_WIN_HEAP_SPRAY_SERIALIZER_VERSION 1

#define	DPI_WIN_TOKEN_PRIVS_SERIALIZER_VERSION 1

#define	DPI_WIN_THREAD_START_SERIALIZER_VERSION 1

#define	DPI_WIN_SEC_DESC_SERIALIZER_VERSION 1

#define	DPI_WIN_ACL_SERIALIZER_VERSION 1

#define	DPI_SERIALIZER_VERSION 1

#define	EXPORT_SERIALIZER_VERSION 1

#define	START_ORIGINATOR_SERIALZIER_VERSION 1

#define	END_ORIGINATOR_SERIALZIER_VERSION 1

#define	LIX_VICTIM_SERIALIZER_VERSION 1

#define	WIN_VICTIM_SERIALIZER_VERSION 1

#define	START_MISC_SERIALZIER_VERSION 1

#define	END_MISC_SERIALZIER_VERSION 1

#define	START_VICTIM_SERIALZIER_VERSION 1

#define	END_VICTIM_SERIALZIER_VERSION 1

#define	KM_ORIGINATOR_SERIALZIER_VERSION 1

#define	KM_ORIGINATOR_SERIALZIER_VERSION 1

#define	WIN_KM_VICTIM_SERIALIZER_VERSION 1

#define	LIX_KM_VICTIM_SERIALIZER_VERSION 1

#define	START_MISC_SERIALZIER_VERSION 1

#define	END_MISC_SERIALZIER_VERSION 1

Typedefs
typedef enum _SERIALIZER_EXCEPTION_TYPE	SERIALIZER_EXCEPTION_TYPE
	Describes the serialized exception type. More...

typedef struct _SERIALIZER_HEADER	SERIALIZER_HEADER
	Describes the header of the serializer buffer. More...

typedef struct _SERIALIZER_OBJECT_HEADER	SERIALIZER_OBJECT_HEADER
	Describes the header for each serialized item. More...

typedef struct _SERIALIZER_STRING	SERIALIZER_STRING
	Describes a serialized string. More...

typedef struct _SERIALIZER_STRING *	PSERIALIZER_STRING

typedef struct _SERIALIZER_EXCEPTION_KM_ORIGINATOR	SERIALIZER_EXCEPTION_KM_ORIGINATOR
	Describes a serialized intObjKmOriginator object. More...

typedef struct _SERIALIZER_EXCEPTION_KM_ORIGINATOR *	PSERIALIZER_EXCEPTION_KM_ORIGINATOR

typedef struct _SERIALIZER_EXCEPTION_UM_ORIGINATOR	SERIALIZER_EXCEPTION_UM_ORIGINATOR
	Describes a serialized intObjUmOriginator object. More...

typedef struct _SERIALIZER_EXCEPTION_UM_ORIGINATOR *	PSERIALIZER_EXCEPTION_UM_ORIGINATOR

typedef struct _SERIALIZER_EXCEPTION_VICTIM	SERIALIZER_EXCEPTION_VICTIM
	Describes a serialized intObjVictim object. More...

typedef struct _SERIALIZER_EXCEPTION_VICTIM *	PSERIALIZER_EXCEPTION_VICTIM

typedef struct _SERIALIZER_EPT	SERIALIZER_EPT
	Describes a serialized intObjEpt object. More...

typedef struct _SERIALIZER_EPT *	PSERIALIZER_EPT

typedef struct _SERIALIZER_MSR	SERIALIZER_MSR
	Describes a serialized intObjMsr object. More...

typedef struct _SERIALIZER_MSR *	PSERIALIZER_MSR

typedef struct _SERIALIZER_CR	SERIALIZER_CR
	Describes a serialized intObjCr object. More...

typedef struct _SERIALIZER_CR *	PSERIALIZER_CR

typedef struct _SERIALIZER_DTR	SERIALIZER_DTR
	Describes a serialized intObjDtr object. More...

typedef struct _SERIALIZER_DTR *	PSERIALIZER_DTR

typedef struct _SERIALIZER_IDT	SERIALIZER_IDT
	Describes a serialized intObjIdt object. More...

typedef struct _SERIALIZER_IDT *	PSERIALIZER_IDT

typedef struct _SERIALIZER_INJECTION	SERIALIZER_INJECTION
	Describes a serialized intObjInjection object. More...

typedef struct _SERIALIZER_INJECTION *	PSERIALIZER_INJECTION

typedef struct _SERIALIZER_LIX_PROCESS	SERIALIZER_LIX_PROCESS
	Describes a serialized intObjLixProcess object. More...

typedef struct _SERIALIZER_LIX_PROCESS *	PSERIALIZER_LIX_PROCESS

typedef struct _SERIALIZER_WIN_PROCESS	SERIALIZER_WIN_PROCESS
	Describes a serialized intObjWinProcess object. More...

typedef struct _SERIALIZER_WIN_PROCESS *	PSERIALIZER_WIN_PROCESS

typedef struct _SERIALIZER_LIX_VMA	SERIALIZER_LIX_VMA
	Describes a serialized intObjLixVma object. More...

typedef struct _SERIALIZER_LIX_VMA *	PSERIALIZER_LIX_VMA

typedef struct _SERIALIZER_WIN_VAD	SERIALIZER_WIN_VAD
	Describes a serialized intObjWinVad object. More...

typedef struct _SERIALIZER_WIN_VAD *	PSERIALIZER_WIN_VAD

typedef struct _SERIALIZER_KERNEL_DRIVER	SERIALIZER_KERNEL_DRIVER
	Describes a serialized intObjKernelDriver object. More...

typedef struct _SERIALIZER_KERNEL_DRIVER *	PSERIALIZER_KERNEL_DRIVER

typedef struct _SERIALIZER_WIN_KERNEL_DRIVER	SERIALIZER_WIN_KERNEL_DRIVER
	Describes a serialized intObjWinKernelDriver object. More...

typedef struct _SERIALIZER_WIN_KERNEL_DRIVER *	PSERIALIZER_WIN_KERNEL_DRIVER

typedef struct _SERIALIZER_LIX_KERNEL_MODULE	SERIALIZER_LIX_KERNEL_MODULE
	Describes a serialized intObjLixKernelModule object. More...

typedef struct _SERIALIZER_LIX_KERNEL_MODULE *	PSERIALIZER_LIX_KERNEL_MODULE

typedef struct _SERIALIZER_KERNEL_DRV_OBJECT	SERIALIZER_KERNEL_DRV_OBJECT
	Describes a serialized intObjKernelDrvObject object. More...

typedef struct _SERIALIZER_KERNEL_DRV_OBJECT *	PSERIALIZER_KERNEL_DRV_OBJECT

typedef struct _SERIALIZER_WIN_MODULE	SERIALIZER_WIN_MODULE
	Describes a serialized intObjWinModule object. More...

typedef struct _SERIALIZER_WIN_MODULE *	PSERIALIZER_WIN_MODULE

typedef struct _SERIALIZER_INSTRUX	SERIALIZER_INSTRUX
	Describes a serialized intObjInstrux object. More...

typedef struct _SERIALIZER_INSTRUX *	PSERIALIZER_INSTRUX

typedef struct _SERIALIZER_ARCH_REGS	SERIALIZER_ARCH_REGS
	Describes a serialized intObjArchRegs object. More...

typedef struct _SERIALIZER_ARCH_REGS *	PSERIALIZER_ARCH_REGS

typedef struct _SERIALIZER_WRITE_INFO	SERIALIZER_WRITE_INFO
	Describes a serialized intObjWriteInfo object. More...

typedef struct _SERIALIZER_WRITE_INFO *	PSERIALIZER_WRITE_INFO

typedef struct _SERIALIZER_READ_INFO	SERIALIZER_READ_INFO
	Describes a serialized intObjExecInfo object. More...

typedef struct _SERIALIZER_READ_INFO *	PSERIALIZER_READ_INFO

typedef struct _SERIALIZER_EXEC_INFO	SERIALIZER_EXEC_INFO
	Describes a serialized intObjExecInfo object. More...

typedef struct _SERIALIZER_EXEC_INFO *	PSERIALIZER_EXEC_INFO

typedef struct _SERIALIZER_CODE_BLOCKS	SERIALIZER_CODE_BLOCKS
	Describes a serialized intObjCodeBlocks object. More...

typedef struct _SERIALIZER_CODE_BLOCKS *	PSERIALIZER_CODE_BLOCKS

typedef struct _SERIALIZER_RIP_CODE	SERIALIZER_RIP_CODE
	Describes a serialized intObjRipCode object. More...

typedef struct _SERIALIZER_RIP_CODE *	PSERIALIZER_RIP_CODE

typedef struct _SERIALIZER_RAW_DUMP	SERIALIZER_RAW_DUMP
	Describes a serialized intObjRawDump object. More...

typedef struct _SERIALIZER_RAW_DUMP *	PSERIALIZER_RAW_DUMP

typedef struct _SERIALIZER_EXPORT	SERIALIZER_EXPORT
	Describes a serialized intObjExport object. More...

typedef struct _SERIALIZER_EXPORT *	PSERIALIZER_EXPORT

typedef struct _SERIALIZER_DPI_WIN_DEBUG	SERIALIZER_DPI_WIN_DEBUG
	Describes a serialized intObjDpiWinDebug. More...

typedef struct _SERIALIZER_DPI_WIN_DEBUG *	PSERIALIZER_DPI_WIN_DEBUG

typedef struct _SERIALIZER_DPI_WIN_STOLEN_TOKEN	SERIALIZER_DPI_WIN_STOLEN_TOKEN
	Describes a serialized intObjDpiWinStolenToken. More...

typedef struct _SERIALIZER_DPI_WIN_STOLEN_TOKEN *	PSERIALIZER_DPI_WIN_STOLEN_TOKEN

typedef struct _SERIALIZER_DPI_WIN_HEAP_SPRAY	SERIALIZER_DPI_WIN_HEAP_SPRAY
	Describes a serialized intObjDpiWinHeapSpray. More...

typedef struct _SERIALIZER_DPI_WIN_HEAP_SPRAY *	PSERIALIZER_DPI_WIN_HEAP_SPRAY

typedef struct _SERIALIZER_DPI_WIN_THREAD_START	SERIALIZER_DPI_WIN_THREAD_START
	Describes a serialized intObjDpiWinThreadStart. More...

typedef struct _SERIALIZER_DPI_WIN_THREAD_START *	PSERIALIZER_DPI_WIN_THREAD_START

typedef struct _SERIALIZER_DPI_WIN_TOKEN_PRIVS	SERIALIZER_DPI_WIN_TOKEN_PRIVS
	Describes a serialized intObjDpiWinTokenPrivs. More...

typedef struct _SERIALIZER_DPI_WIN_TOKEN_PRIVS *	PSERIALIZER_DPI_WIN_TOKEN_PRIVS

typedef struct _SERIALIZER_DPI_PIVOTED_STACK	SERIALIZER_DPI_PIVOTED_STACK
	Describes a serialized intObjDpiPivotedStack. More...

typedef struct _SERIALIZER_DPI_PIVOTED_STACK *	PSERIALIZER_DPI_PIVOTED_STACK

typedef struct _SERIALIZER_DPI_WIN_SEC_DESC	SERIALIZER_DPI_WIN_SEC_DESC
	Describes a serialized intObjDpiWinSecDesc. More...

typedef struct _SERIALIZER_DPI_WIN_SEC_DESC *	PSERIALIZER_DPI_WIN_SEC_DESC

typedef struct _SERIALIZER_DPI_WIN_ACL_EDIT	SERIALIZER_DPI_WIN_ACL_EDIT
	Describes a serialized intObjDpiWinAclEdit. More...

typedef struct _SERIALIZER_DPI_WIN_ACL_EDIT *	PSERIALIZER_DPI_WIN_ACL_EDIT

typedef struct _SERIALIZER_DPI	SERIALIZER_DPI
	Describes a serialized intObjDpi object. More...

typedef struct _SERIALIZER_DPI *	PSERIALIZER_DPI

Enumerations
enum	_SERIALIZER_EXCEPTION_TYPE { serializerExceptionTypeKm = 0, serializerExceptionTypeUm = 1, serializerExceptionTypeKmUm = 2 }
	Describes the serialized exception type. More...

enum	{ intObjNone = 0, intObjStartOriginator, intObjEndOriginator, intObjStartVictim, intObjEndVictim, intObjStartMisc, intObjEndMisc, intObjVictim, intObjEpt, intObjMsr, intObjCr, intObjDtr, intObjIdt, intObjIntegrity, intObjInjection, intObjWinProcess, intObjWinProcessParent, intObjLixProcess, intObjLixProcessParent, intObjKernelDriver, intObjKernelDriverReturn, intObjWinKernelDriver, intObjWinKernelDriverReturn, intObjLixKernelModule, intObjLixKernelModuleReturn, intObjKernelDrvObject, intObjWinVad, intObjLixVma, intObjWinModule, intObjWinModuleReturn, intObjInstrux, intObjWriteInfo, intObjReadInfo, intObjExecInfo, intObjArchRegs, intObjCodeBlocks, intObjRipCode, intObjRawDump, intObjExport, intObjDpi, intObjDpiWinDebug, intObjDpiWinPivotedStack, intObjDpiWinStolenToken, intObjDpiWinTokenPrivs, intObjDpiWinThreadStart, intObjDpiWinHeapSpray, intObjDpiWinSecDesc, intObjDpiWinAclEdit }
	Describes the type of a serialize object. More...

enum	{ stringEncodeUtf8 = 0, stringEncodeUtf16 }
	Describes the encoding type of a string. More...

Functions
static void	IntSerializeBlockToBase64 (const BYTE In, BYTE Out, size_t Length)
	Converts the provided binary buffer to base64. More...

static char *	IntSerializerBase64Get (DWORD *Length)
	Converts the serialized buffer to base64. More...

static DWORD	IntSerializeCurrentOffset (void)
	Get the current offset (length) of the serialized buffer. More...

static void	IntSerializeIncrementCurrentPtr (const DWORD Size)
	Increment the current pointer to the serializer buffer with the provided size. More...

static QWORD	IntSerializeCurrentId (void)
	Increment the current serializer alert ID and returns it. More...

static void	IntSerializeIncrementCurrentId (void)
	Increment the current serializer alert ID. More...

static void	IntSerializeDump (void)
	Dumps the serialized buffer (base64 format). More...

static BOOLEAN	IntSerializeValidObjectSize (DWORD Size)
	Checks if the serializer buffer overflows. More...

static void *	IntSerializeCurrentPtr (DWORD Size)
	Returns the current pointer to serializer buffer and checks for overflows. More...

static SERIALIZER_OBJECT_HEADER *	IntSerializeObjectHeader (const DWORD Version, const DWORD Type)
	Creates a SERIALIZER_OBJECT_HEADER object and fill the fields with the provided parameters. More...

static BOOLEAN	IntSerializeStringIsWcharAscii (const void *String, DWORD Size)
	Checks if the provided string contains WCHARS. More...

static void	IntSerializeString (const void String, DWORD Size, DWORD Encode, SERIALIZER_OBJECT_HEADER Header)
	Serialize the provided string. More...

static void	IntSerializeEpt (const EXCEPTION_VICTIM_EPT Ept, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the provided EPT object. More...

static void	IntSerializeCr (const EXCEPTION_VICTIM_CR *Cr)
	Serialize the provided CR object. More...

static void	IntSerializeIdt (const EXCEPTION_VICTIM_ZONE *Victim)
	Serialize the provided IDT object. More...

static void	IntSerializeMsr (const EXCEPTION_VICTIM_MSR *Msr)
	Serialize the provided MSR object. More...

static void	IntSerializeDtr (const EXCEPTION_VICTIM_DTR *Dtr)
	Serialize the provided DTR object. More...

static void	IntSerializeInjection (const EXCEPTION_VICTIM_INJECTION Injection, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the provided Injection object. More...

static void	IntSerializeWinProcess (const WIN_PROCESS_OBJECT *Process, const DWORD ObjectType)
	Serialize the provided WIN_PROCESS_OBJECT object. More...

static void	IntSerializeLixProcess (const LIX_TASK_OBJECT *Process, const DWORD ObjectType)
	Serialize the provided LIX_TASK_OBJECT object. More...

static void	IntSerializeProcess (void *Process, const DWORD ObjectType)
	Serialize the provided process object. More...

void	IntSerializeWinVad (const VAD *Vad)
	Serialize the provided VAD object. More...

static void	IntSerializeLixVma (const LIX_VMA *Vma)
	Serialize the provided LIX_VMA object. More...

static void	IntSerializeVad (const void *Vad)
	Serialize the provided VAD/vma object. More...

static void	IntSerializeWinKernelDriver (const KERNEL_DRIVER *Driver, DWORD ObjectType)
	Serialize the provided KERNEL_DRIVER object. More...

static void	IntSerializeLixKernelModule (const KERNEL_DRIVER *Driver, DWORD ObjecType)
	Serialize the provided KERNEL_DRIVER object. More...

static void	IntSerializeKernelDrvObject (const WIN_DRIVER_OBJECT *DrvObject)
	Serialize the provided WIN_DRIVER_OBJECT object. More...

static void	IntSerializeKernelDriver (const EXCEPTION_KM_ORIGINATOR Originator, const KERNEL_DRIVER Driver, const DWORD ObjectType)
	Serialize the provided KERNEL_DRIVER object. More...

static void	IntSerializeWinModule (const WIN_PROCESS_MODULE *Module, const DWORD ObjectType)
	Serialize the provided WIN_PROCESS_MODULE object. More...

void	IntSerializeInstruction (INSTRUX *Instruction, const QWORD Rip)
	Serialize the provided INSTRUX object. More...

static void	IntSerializeWriteInfo (const EXCEPTION_VICTIM_ZONE *Victim)
	Serialize the write violation information. More...

static void	IntSerializeReadInfo (const EXCEPTION_VICTIM_ZONE *Victim)
	Serialize the read violation information. More...

static void	IntSerializeExecInfo (const EXCEPTION_VICTIM_ZONE *Victim)
	Serialize the execution violation information. More...

static void	IntSerializeAccessInfo (const EXCEPTION_VICTIM_ZONE *Victim)
	Serialize the read/write/exec violation information. More...

static void	IntSerializeRawDump (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the raw dump for the injection violation. More...

static void	IntSerializeRipCode (void)
	Serialize the guest memory page that contains the RIP at which the violation attempt was detected. More...

static void	IntSerializeCodeBlocksGetExtractRange (QWORD Rip, BOOLEAN Execute, DWORD Start, DWORD End)
	Computes the range from which the code-blocks should be extracted. More...

static CB_EXTRACT_LEVEL	IntSerializeCodeBlocksGetExtractLevel (QWORD Rip)
	Get the code-blocks extraction level. More...

static void	IntSerializeCodeBlocksPattern (CODE_BLOCK CodeBlocks, DWORD Count, QWORD Rip, BOOLEAN Execute, SERIALIZER_CODE_BLOCKS Object)
	Iterates through all extracted code-blocks patterns and serialize the patterns. More...

static INTSTATUS	IntSerializeExtractCodeBlocks (QWORD Rip, QWORD Cr3, BOOLEAN Execute, SERIALIZER_CODE_BLOCKS *Object)
	Extract the code-blocks for the current exception. More...

static void	IntSerializeCodeBlocks (QWORD Rip, QWORD Cr3, BOOLEAN Execute)
	Serialize the extracted code-blocks for the current exception. More...

static void	IntSerializeArchRegs (void)
	Serialize the guest registers. More...

static void	IntSerializeDpiWinDebug (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI debug flags info (Windows). More...

static void	IntSerializeDpiWinPivotedStack (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI pivoted stack info (Windows). More...

static void	IntSerializeDpiWinStolenToken (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI stolen token info (Windows). More...

static void	IntSerializeDpiWinHeapSpray (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI heap spray info (Windows). More...

static void	IntSerializeDpiWinTokenPrivs (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI token privs info (Windows). More...

static void	IntSerializeDpiWinThreadStart (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI start thread info (Windows). More...

static void	IntSerializeDpiWinSecDesc (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI altered Security Descriptor info (Windows). More...

static void	IntSerializeDpiWinAclEdit (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI ACL edit info (Windows). More...

static void	IntSerializeWinDpiInfo (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the DPI extra information. More...

static void	IntSerializeDpi (const EXCEPTION_UM_ORIGINATOR *Originator)
	Serialize the DPI flags. More...

static void	IntSerializeExport (const EXCEPTION_VICTIM_ZONE *Victim)
	Serialize the modified exports. More...

static void	IntSerializeWinUmOriginator (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about windows user-mode originator. More...

void	IntSerializeLixUmOriginator (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about Linux user-mode originator. More...

static void	IntSerializeUmOriginator (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about user-mode originator. More...

static void	IntSerializeLixUmVictim (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about Linux user-mode victim. More...

static void	IntSerializeWinUmVictim (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about user-mode windows victim. More...

static void	IntSerializeWinUmMisc (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the misc information for windows user-mode alert. More...

static void	IntSerializeLixUmMisc (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the misc information for Linux user-mode alert. More...

static void	IntSerializeUmMisc (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the misc information for user-mode alert. More...

static void	IntSerializeUmVictim (const EXCEPTION_UM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about user-mode victim. More...

void	IntSerializeWinKmOriginator (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about windows kernel-mode originator. More...

void	IntSerializeLixKmOriginator (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about Linux kernel-mode originator. More...

void	IntSerializeKmOriginator (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about kernel-mode originator. More...

static void	IntSerializeWinKmVictim (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about Windows kernel-mode victim. More...

static void	IntSerializeLixKmVictim (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about Linux kernel-mode victim. More...

static void	IntSerializeKmVictim (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the information about kernel-mode victim. More...

static void	IntSerializeLixKmMisc (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the misc information for Linux kernel-mode alert. More...

static void	IntSerializeWinKmMisc (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the misc information for windows kernel-mode alert. More...

static void	IntSerializeKmMisc (const EXCEPTION_KM_ORIGINATOR Originator, const EXCEPTION_VICTIM_ZONE Victim)
	Serialize the misc information for kernel-mode alert. More...

static void	IntSerializeHeader (SERIALIZER_EXCEPTION_TYPE SerializerType, INTRO_EVENT_TYPE EventClass)
	Serialize the header of the serializer buffer. More...

static void	IntSerializeKmException (const void Originator, const void Victim, INTRO_EVENT_TYPE EventClass)
	Serialize the kernel-mode exception. More...

static void	IntSerializeUmException (const void Originator, const void Victim, INTRO_EVENT_TYPE EventClass)
	Serialize the user-mode exception. More...

static void	IntSerializeKernelUserException (const void Originator, const void Victim, INTRO_EVENT_TYPE EventClass)
	Serialize the kernel-user mode exception. More...

void	IntSerializeStart (void)
	Set the current serializer pointer to the beginning of the buffer and generated a new alert-ID. More...

void	IntSerializeException (void Victim, void Originator, DWORD Type, INTRO_ACTION Action, INTRO_ACTION_REASON Reason, INTRO_EVENT_TYPE EventClass)
	The entry point of the serializer; will serialize the provided exception if the violation is blocked or the feedback flag is set. More...

Variables
static BYTE	gSerializerBuffer [MAX_SERIALIZER_LENGTH] = { 0 }

static BYTE *	gCurrentPtr = NULL

static QWORD	gSerializerCurrentId = 0

static CODE_BLOCK_PATTERN	gCodeBlocksPattern [PAGE_SIZE/sizeof(CODE_BLOCK_PATTERN)]

static DWORD	gCodeBlocksPatternLength = 0

static CODE_BLOCK	gCodeBlocks [PAGE_SIZE/sizeof(CODE_BLOCK)]

const char	gBase64Chars [] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

static char	gBase64Buffer [Base64EncSize(sizeof(gSerializerBuffer))] = {0}

Macro Definition Documentation

◆ ARCH_REGS_SERIALIZER_VERSION

#define ARCH_REGS_SERIALIZER_VERSION 1

◆ Base64EncSize

#define Base64EncSize ( Length ) (((((Length) + 2) / 3) * 4) + 1)

Definition at line 626 of file serializers.c.

Referenced by IntSerializerBase64Get().

◆ CODE_BLOCKS_SERIALIZER_VERSION

#define CODE_BLOCKS_SERIALIZER_VERSION 1

Referenced by IntSerializeCodeBlocks().

◆ DPI_SERIALIZER_VERSION

#define DPI_SERIALIZER_VERSION 1

Referenced by IntSerializeDpi().

◆ DPI_WIN_ACL_SERIALIZER_VERSION

#define DPI_WIN_ACL_SERIALIZER_VERSION 1

Referenced by IntSerializeDpiWinAclEdit().

◆ DPI_WIN_DEBUG_SERIALIZER_VERSION

#define DPI_WIN_DEBUG_SERIALIZER_VERSION 1

Referenced by IntSerializeDpiWinDebug().

◆ DPI_WIN_HEAP_SPRAY_SERIALIZER_VERSION

#define DPI_WIN_HEAP_SPRAY_SERIALIZER_VERSION 1

Referenced by IntSerializeDpiWinHeapSpray().

◆ DPI_WIN_PIVOTET_STACK_SERIALIZER_VERSION

#define DPI_WIN_PIVOTET_STACK_SERIALIZER_VERSION 1

Referenced by IntSerializeDpiWinPivotedStack().

◆ DPI_WIN_SEC_DESC_SERIALIZER_VERSION

#define DPI_WIN_SEC_DESC_SERIALIZER_VERSION 1

Referenced by IntSerializeDpiWinSecDesc().

◆ DPI_WIN_STOLEN_TOKEN_SERIALIZER_VERSION

#define DPI_WIN_STOLEN_TOKEN_SERIALIZER_VERSION 1

Referenced by IntSerializeDpiWinStolenToken().

◆ DPI_WIN_THREAD_START_SERIALIZER_VERSION

#define DPI_WIN_THREAD_START_SERIALIZER_VERSION 1

Referenced by IntSerializeDpiWinThreadStart().

◆ DPI_WIN_TOKEN_PRIVS_SERIALIZER_VERSION

#define DPI_WIN_TOKEN_PRIVS_SERIALIZER_VERSION 1

Referenced by IntSerializeDpiWinTokenPrivs().

◆ END_MISC_SERIALZIER_VERSION [1/2]

#define END_MISC_SERIALZIER_VERSION 1

Referenced by IntSerializeKmMisc(), and IntSerializeUmMisc().

◆ END_MISC_SERIALZIER_VERSION [2/2]

#define END_MISC_SERIALZIER_VERSION 1

◆ END_ORIGINATOR_SERIALZIER_VERSION

#define END_ORIGINATOR_SERIALZIER_VERSION 1

Referenced by IntSerializeKmOriginator(), and IntSerializeUmOriginator().

◆ END_VICTIM_SERIALZIER_VERSION

#define END_VICTIM_SERIALZIER_VERSION 1

Referenced by IntSerializeKmVictim(), and IntSerializeUmVictim().

◆ EXEC_INFO_SERIALIZER_VERSION

#define EXEC_INFO_SERIALIZER_VERSION 1

Referenced by IntSerializeExecInfo().

◆ EXPORT_SERIALIZER_VERSION

#define EXPORT_SERIALIZER_VERSION 1

Referenced by IntSerializeExport().

◆ INSTRUX_SERIALIZER_VERSION

#define INSTRUX_SERIALIZER_VERSION 1

Referenced by IntSerializeInstruction().

◆ KERNEL_DRIVER_SERIALIZER_VERSION

#define KERNEL_DRIVER_SERIALIZER_VERSION 1

Referenced by IntSerializeKernelDriver().

◆ KERNEL_DRV_OBJECT_SERIALIZER_VERSION

#define KERNEL_DRV_OBJECT_SERIALIZER_VERSION 1

Referenced by IntSerializeKernelDrvObject().

◆ KM_ORIGINATOR_SERIALZIER_VERSION [1/2]

#define KM_ORIGINATOR_SERIALZIER_VERSION 1

◆ KM_ORIGINATOR_SERIALZIER_VERSION [2/2]

#define KM_ORIGINATOR_SERIALZIER_VERSION 1

◆ LIX_KERNEL_MODULE_SERIALIZER_VERSION

#define LIX_KERNEL_MODULE_SERIALIZER_VERSION 1

Referenced by IntSerializeLixKernelModule().

◆ LIX_KM_VICTIM_SERIALIZER_VERSION

#define LIX_KM_VICTIM_SERIALIZER_VERSION 1

Referenced by IntSerializeLixKmVictim().

◆ LIX_PROCESS_SERIALIZER_VERSION

#define LIX_PROCESS_SERIALIZER_VERSION 1

Referenced by IntSerializeLixProcess().

◆ LIX_VICTIM_SERIALIZER_VERSION

#define LIX_VICTIM_SERIALIZER_VERSION 1

Referenced by IntSerializeLixUmVictim().

◆ LIX_VMA_SERIALIZER_VERSION

#define LIX_VMA_SERIALIZER_VERSION 1

Referenced by IntSerializeLixVma().

◆ MAX_SERIALIZER_LENGTH

#define MAX_SERIALIZER_LENGTH (16 * ONE_KILOBYTE)

Definition at line 614 of file serializers.c.

◆ RAW_DUMP_SERIALIZER_VERSION

#define RAW_DUMP_SERIALIZER_VERSION 1

Referenced by IntSerializeRawDump().

◆ READ_INFO_SERIALIZER_VERSION

#define READ_INFO_SERIALIZER_VERSION 1

Referenced by IntSerializeReadInfo().

◆ RIP_CODE_SERIALIZER_VERSION

#define RIP_CODE_SERIALIZER_VERSION 1

Referenced by IntSerializeArchRegs(), and IntSerializeRipCode().

◆ START_MISC_SERIALZIER_VERSION [1/2]

#define START_MISC_SERIALZIER_VERSION 1

Referenced by IntSerializeKmMisc(), and IntSerializeUmMisc().

◆ START_MISC_SERIALZIER_VERSION [2/2]

#define START_MISC_SERIALZIER_VERSION 1

◆ START_ORIGINATOR_SERIALZIER_VERSION

#define START_ORIGINATOR_SERIALZIER_VERSION 1

Referenced by IntSerializeKmOriginator(), and IntSerializeUmOriginator().

◆ START_VICTIM_SERIALZIER_VERSION

#define START_VICTIM_SERIALZIER_VERSION 1

Referenced by IntSerializeKmVictim(), and IntSerializeUmVictim().

◆ VICTIM_SERIALIZER_CR_VERSION

#define VICTIM_SERIALIZER_CR_VERSION 1

Referenced by IntSerializeCr().

◆ VICTIM_SERIALIZER_DTR_VERSION

#define VICTIM_SERIALIZER_DTR_VERSION 1

Referenced by IntSerializeDtr().

◆ VICTIM_SERIALIZER_EPT_VERSION

#define VICTIM_SERIALIZER_EPT_VERSION 1

Referenced by IntSerializeEpt().

◆ VICTIM_SERIALIZER_IDT_VERSION

#define VICTIM_SERIALIZER_IDT_VERSION 1

Referenced by IntSerializeIdt().

◆ VICTIM_SERIALIZER_INJECTION_VERSION

#define VICTIM_SERIALIZER_INJECTION_VERSION 1

Referenced by IntSerializeInjection().

◆ VICTIM_SERIALIZER_MSR_VERSION

#define VICTIM_SERIALIZER_MSR_VERSION 1

Referenced by IntSerializeMsr().

◆ WIN_KERNEL_DRIVER_SERIALIZER_VERSION

#define WIN_KERNEL_DRIVER_SERIALIZER_VERSION 1

Referenced by IntSerializeWinKernelDriver().

◆ WIN_KM_VICTIM_SERIALIZER_VERSION

#define WIN_KM_VICTIM_SERIALIZER_VERSION 1

Referenced by IntSerializeWinKmVictim().

◆ WIN_PROCESS_MODULE_SERIALIZER_VERSION

#define WIN_PROCESS_MODULE_SERIALIZER_VERSION 1

Referenced by IntSerializeWinModule().

◆ WIN_PROCESS_SERIALIZER_VERSION

#define WIN_PROCESS_SERIALIZER_VERSION 1

Referenced by IntSerializeWinProcess().

◆ WIN_VAD_SERIALIZER_VERSION

#define WIN_VAD_SERIALIZER_VERSION 1

Referenced by IntSerializeWinVad().

◆ WIN_VICTIM_SERIALIZER_VERSION

#define WIN_VICTIM_SERIALIZER_VERSION 1

Referenced by IntSerializeWinUmVictim().

◆ WRITE_INFO_SERIALIZER_VERSION

#define WRITE_INFO_SERIALIZER_VERSION 1

Referenced by IntSerializeWriteInfo().

Typedef Documentation

◆ PSERIALIZER_ARCH_REGS

typedef struct _SERIALIZER_ARCH_REGS * PSERIALIZER_ARCH_REGS

◆ PSERIALIZER_CODE_BLOCKS

typedef struct _SERIALIZER_CODE_BLOCKS * PSERIALIZER_CODE_BLOCKS

◆ PSERIALIZER_CR

typedef struct _SERIALIZER_CR * PSERIALIZER_CR

◆ PSERIALIZER_DPI

typedef struct _SERIALIZER_DPI * PSERIALIZER_DPI

◆ PSERIALIZER_DPI_PIVOTED_STACK

typedef struct _SERIALIZER_DPI_PIVOTED_STACK * PSERIALIZER_DPI_PIVOTED_STACK

◆ PSERIALIZER_DPI_WIN_ACL_EDIT

typedef struct _SERIALIZER_DPI_WIN_ACL_EDIT * PSERIALIZER_DPI_WIN_ACL_EDIT

◆ PSERIALIZER_DPI_WIN_DEBUG

typedef struct _SERIALIZER_DPI_WIN_DEBUG * PSERIALIZER_DPI_WIN_DEBUG

◆ PSERIALIZER_DPI_WIN_HEAP_SPRAY

typedef struct _SERIALIZER_DPI_WIN_HEAP_SPRAY * PSERIALIZER_DPI_WIN_HEAP_SPRAY

◆ PSERIALIZER_DPI_WIN_SEC_DESC

typedef struct _SERIALIZER_DPI_WIN_SEC_DESC * PSERIALIZER_DPI_WIN_SEC_DESC

◆ PSERIALIZER_DPI_WIN_STOLEN_TOKEN

typedef struct _SERIALIZER_DPI_WIN_STOLEN_TOKEN * PSERIALIZER_DPI_WIN_STOLEN_TOKEN

◆ PSERIALIZER_DPI_WIN_THREAD_START

typedef struct _SERIALIZER_DPI_WIN_THREAD_START * PSERIALIZER_DPI_WIN_THREAD_START

◆ PSERIALIZER_DPI_WIN_TOKEN_PRIVS

typedef struct _SERIALIZER_DPI_WIN_TOKEN_PRIVS * PSERIALIZER_DPI_WIN_TOKEN_PRIVS

◆ PSERIALIZER_DTR

typedef struct _SERIALIZER_DTR * PSERIALIZER_DTR

◆ PSERIALIZER_EPT

typedef struct _SERIALIZER_EPT * PSERIALIZER_EPT

◆ PSERIALIZER_EXCEPTION_KM_ORIGINATOR

typedef struct _SERIALIZER_EXCEPTION_KM_ORIGINATOR * PSERIALIZER_EXCEPTION_KM_ORIGINATOR

◆ PSERIALIZER_EXCEPTION_UM_ORIGINATOR

typedef struct _SERIALIZER_EXCEPTION_UM_ORIGINATOR * PSERIALIZER_EXCEPTION_UM_ORIGINATOR

◆ PSERIALIZER_EXCEPTION_VICTIM

typedef struct _SERIALIZER_EXCEPTION_VICTIM * PSERIALIZER_EXCEPTION_VICTIM

◆ PSERIALIZER_EXEC_INFO

typedef struct _SERIALIZER_EXEC_INFO * PSERIALIZER_EXEC_INFO

◆ PSERIALIZER_EXPORT

typedef struct _SERIALIZER_EXPORT * PSERIALIZER_EXPORT

◆ PSERIALIZER_IDT

typedef struct _SERIALIZER_IDT * PSERIALIZER_IDT

◆ PSERIALIZER_INJECTION

typedef struct _SERIALIZER_INJECTION * PSERIALIZER_INJECTION

◆ PSERIALIZER_INSTRUX

typedef struct _SERIALIZER_INSTRUX * PSERIALIZER_INSTRUX

◆ PSERIALIZER_KERNEL_DRIVER

typedef struct _SERIALIZER_KERNEL_DRIVER * PSERIALIZER_KERNEL_DRIVER

◆ PSERIALIZER_KERNEL_DRV_OBJECT

typedef struct _SERIALIZER_KERNEL_DRV_OBJECT * PSERIALIZER_KERNEL_DRV_OBJECT

◆ PSERIALIZER_LIX_KERNEL_MODULE

typedef struct _SERIALIZER_LIX_KERNEL_MODULE * PSERIALIZER_LIX_KERNEL_MODULE

◆ PSERIALIZER_LIX_PROCESS

typedef struct _SERIALIZER_LIX_PROCESS * PSERIALIZER_LIX_PROCESS

◆ PSERIALIZER_LIX_VMA

typedef struct _SERIALIZER_LIX_VMA * PSERIALIZER_LIX_VMA

◆ PSERIALIZER_MSR

typedef struct _SERIALIZER_MSR * PSERIALIZER_MSR

◆ PSERIALIZER_RAW_DUMP

typedef struct _SERIALIZER_RAW_DUMP * PSERIALIZER_RAW_DUMP

◆ PSERIALIZER_READ_INFO

typedef struct _SERIALIZER_READ_INFO * PSERIALIZER_READ_INFO

◆ PSERIALIZER_RIP_CODE

typedef struct _SERIALIZER_RIP_CODE * PSERIALIZER_RIP_CODE

◆ PSERIALIZER_STRING

typedef struct _SERIALIZER_STRING * PSERIALIZER_STRING

◆ PSERIALIZER_WIN_KERNEL_DRIVER

typedef struct _SERIALIZER_WIN_KERNEL_DRIVER * PSERIALIZER_WIN_KERNEL_DRIVER

◆ PSERIALIZER_WIN_MODULE

typedef struct _SERIALIZER_WIN_MODULE * PSERIALIZER_WIN_MODULE

◆ PSERIALIZER_WIN_PROCESS

typedef struct _SERIALIZER_WIN_PROCESS * PSERIALIZER_WIN_PROCESS

◆ PSERIALIZER_WIN_VAD

typedef struct _SERIALIZER_WIN_VAD * PSERIALIZER_WIN_VAD

◆ PSERIALIZER_WRITE_INFO

typedef struct _SERIALIZER_WRITE_INFO * PSERIALIZER_WRITE_INFO

◆ SERIALIZER_ARCH_REGS

typedef struct _SERIALIZER_ARCH_REGS SERIALIZER_ARCH_REGS

Describes a serialized intObjArchRegs object.

◆ SERIALIZER_CODE_BLOCKS

typedef struct _SERIALIZER_CODE_BLOCKS SERIALIZER_CODE_BLOCKS

Describes a serialized intObjCodeBlocks object.

◆ SERIALIZER_CR

typedef struct _SERIALIZER_CR SERIALIZER_CR

Describes a serialized intObjCr object.

◆ SERIALIZER_DPI

typedef struct _SERIALIZER_DPI SERIALIZER_DPI

Describes a serialized intObjDpi object.

◆ SERIALIZER_DPI_PIVOTED_STACK

typedef struct _SERIALIZER_DPI_PIVOTED_STACK SERIALIZER_DPI_PIVOTED_STACK

Describes a serialized intObjDpiPivotedStack.

◆ SERIALIZER_DPI_WIN_ACL_EDIT

typedef struct _SERIALIZER_DPI_WIN_ACL_EDIT SERIALIZER_DPI_WIN_ACL_EDIT

Describes a serialized intObjDpiWinAclEdit.

◆ SERIALIZER_DPI_WIN_DEBUG

typedef struct _SERIALIZER_DPI_WIN_DEBUG SERIALIZER_DPI_WIN_DEBUG

Describes a serialized intObjDpiWinDebug.

◆ SERIALIZER_DPI_WIN_HEAP_SPRAY

typedef struct _SERIALIZER_DPI_WIN_HEAP_SPRAY SERIALIZER_DPI_WIN_HEAP_SPRAY

Describes a serialized intObjDpiWinHeapSpray.

◆ SERIALIZER_DPI_WIN_SEC_DESC

typedef struct _SERIALIZER_DPI_WIN_SEC_DESC SERIALIZER_DPI_WIN_SEC_DESC

Describes a serialized intObjDpiWinSecDesc.

◆ SERIALIZER_DPI_WIN_STOLEN_TOKEN

typedef struct _SERIALIZER_DPI_WIN_STOLEN_TOKEN SERIALIZER_DPI_WIN_STOLEN_TOKEN

Describes a serialized intObjDpiWinStolenToken.

◆ SERIALIZER_DPI_WIN_THREAD_START

typedef struct _SERIALIZER_DPI_WIN_THREAD_START SERIALIZER_DPI_WIN_THREAD_START

Describes a serialized intObjDpiWinThreadStart.

◆ SERIALIZER_DPI_WIN_TOKEN_PRIVS

typedef struct _SERIALIZER_DPI_WIN_TOKEN_PRIVS SERIALIZER_DPI_WIN_TOKEN_PRIVS

Describes a serialized intObjDpiWinTokenPrivs.

◆ SERIALIZER_DTR

typedef struct _SERIALIZER_DTR SERIALIZER_DTR

Describes a serialized intObjDtr object.

◆ SERIALIZER_EPT

typedef struct _SERIALIZER_EPT SERIALIZER_EPT

Describes a serialized intObjEpt object.

◆ SERIALIZER_EXCEPTION_KM_ORIGINATOR

typedef struct _SERIALIZER_EXCEPTION_KM_ORIGINATOR SERIALIZER_EXCEPTION_KM_ORIGINATOR

Describes a serialized intObjKmOriginator object.

◆ SERIALIZER_EXCEPTION_TYPE

typedef enum _SERIALIZER_EXCEPTION_TYPE SERIALIZER_EXCEPTION_TYPE

Describes the serialized exception type.

◆ SERIALIZER_EXCEPTION_UM_ORIGINATOR

typedef struct _SERIALIZER_EXCEPTION_UM_ORIGINATOR SERIALIZER_EXCEPTION_UM_ORIGINATOR

Describes a serialized intObjUmOriginator object.

◆ SERIALIZER_EXCEPTION_VICTIM

typedef struct _SERIALIZER_EXCEPTION_VICTIM SERIALIZER_EXCEPTION_VICTIM

Describes a serialized intObjVictim object.

◆ SERIALIZER_EXEC_INFO

typedef struct _SERIALIZER_EXEC_INFO SERIALIZER_EXEC_INFO

Describes a serialized intObjExecInfo object.

◆ SERIALIZER_EXPORT

typedef struct _SERIALIZER_EXPORT SERIALIZER_EXPORT

Describes a serialized intObjExport object.

◆ SERIALIZER_HEADER

typedef struct _SERIALIZER_HEADER SERIALIZER_HEADER

Describes the header of the serializer buffer.

◆ SERIALIZER_IDT

typedef struct _SERIALIZER_IDT SERIALIZER_IDT

Describes a serialized intObjIdt object.

◆ SERIALIZER_INJECTION

typedef struct _SERIALIZER_INJECTION SERIALIZER_INJECTION

Describes a serialized intObjInjection object.

◆ SERIALIZER_INSTRUX

typedef struct _SERIALIZER_INSTRUX SERIALIZER_INSTRUX

Describes a serialized intObjInstrux object.

◆ SERIALIZER_KERNEL_DRIVER

typedef struct _SERIALIZER_KERNEL_DRIVER SERIALIZER_KERNEL_DRIVER

Describes a serialized intObjKernelDriver object.

◆ SERIALIZER_KERNEL_DRV_OBJECT

typedef struct _SERIALIZER_KERNEL_DRV_OBJECT SERIALIZER_KERNEL_DRV_OBJECT

Describes a serialized intObjKernelDrvObject object.

◆ SERIALIZER_LIX_KERNEL_MODULE

typedef struct _SERIALIZER_LIX_KERNEL_MODULE SERIALIZER_LIX_KERNEL_MODULE

Describes a serialized intObjLixKernelModule object.

◆ SERIALIZER_LIX_PROCESS

typedef struct _SERIALIZER_LIX_PROCESS SERIALIZER_LIX_PROCESS

Describes a serialized intObjLixProcess object.

◆ SERIALIZER_LIX_VMA

typedef struct _SERIALIZER_LIX_VMA SERIALIZER_LIX_VMA

Describes a serialized intObjLixVma object.

◆ SERIALIZER_MSR

typedef struct _SERIALIZER_MSR SERIALIZER_MSR

Describes a serialized intObjMsr object.

◆ SERIALIZER_OBJECT_HEADER

typedef struct _SERIALIZER_OBJECT_HEADER SERIALIZER_OBJECT_HEADER

Describes the header for each serialized item.

◆ SERIALIZER_RAW_DUMP

typedef struct _SERIALIZER_RAW_DUMP SERIALIZER_RAW_DUMP

Describes a serialized intObjRawDump object.

◆ SERIALIZER_READ_INFO

typedef struct _SERIALIZER_READ_INFO SERIALIZER_READ_INFO

Describes a serialized intObjExecInfo object.

◆ SERIALIZER_RIP_CODE

typedef struct _SERIALIZER_RIP_CODE SERIALIZER_RIP_CODE

Describes a serialized intObjRipCode object.

◆ SERIALIZER_STRING

typedef struct _SERIALIZER_STRING SERIALIZER_STRING

Describes a serialized string.

◆ SERIALIZER_WIN_KERNEL_DRIVER

typedef struct _SERIALIZER_WIN_KERNEL_DRIVER SERIALIZER_WIN_KERNEL_DRIVER

Describes a serialized intObjWinKernelDriver object.

◆ SERIALIZER_WIN_MODULE

typedef struct _SERIALIZER_WIN_MODULE SERIALIZER_WIN_MODULE

Describes a serialized intObjWinModule object.

◆ SERIALIZER_WIN_PROCESS

typedef struct _SERIALIZER_WIN_PROCESS SERIALIZER_WIN_PROCESS

Describes a serialized intObjWinProcess object.

◆ SERIALIZER_WIN_VAD

typedef struct _SERIALIZER_WIN_VAD SERIALIZER_WIN_VAD

Describes a serialized intObjWinVad object.

◆ SERIALIZER_WRITE_INFO

typedef struct _SERIALIZER_WRITE_INFO SERIALIZER_WRITE_INFO

Describes a serialized intObjWriteInfo object.

Enumeration Type Documentation

◆ anonymous enum

anonymous enum

Describes the type of a serialize object.

Enumerator
intObjNone
intObjStartOriginator	Used to notify the deserializer that the next objects contains the originator.
intObjEndOriginator	Used to notify the deserializer that the all the originator's objects has been parsed.
intObjStartVictim	Used to notify the deserializer that the next objects contains the victim.
intObjEndVictim	Used to notify the deserializer that the all the victim's objects has been parsed.
intObjStartMisc	Used to notify the deserializer that the next objects contains the misc.
intObjEndMisc	Used to notify the deserializer that the all the misc objects has been parsed.
intObjVictim	Used for the victim object.
intObjEpt	Used for the EPT object.
intObjMsr	Used for the MSR object.
intObjCr	Used for the CR object.
intObjDtr	Used for the DTR object.
intObjIdt	Used for the IDT object.
intObjIntegrity	Used for the Integrity object.
intObjInjection	Used for the Injection object.
intObjWinProcess	Used for the windows process object.
intObjWinProcessParent	Used for the windows parent process object.
intObjLixProcess	Used for the Linux task object.
intObjLixProcessParent	Used for the Linux parent task object.
intObjKernelDriver	Used for the kernel driver object.
intObjKernelDriverReturn	Used for the return kernel driver object.
intObjWinKernelDriver	Used for the windows kernel driver object.
intObjWinKernelDriverReturn	Used for the windows kernel driver object.
intObjLixKernelModule	Used for the Linux kernel module object.
intObjLixKernelModuleReturn	Used for the Linux kernel module object.
intObjKernelDrvObject	Used for the windows driver obj object.
intObjWinVad	Used for the windows VAD object.
intObjLixVma	Used for the Linux VMA object.
intObjWinModule	Used for the windows module object.
intObjWinModuleReturn	Used for the windows return module object.
intObjInstrux	Used for the instruction object.
intObjWriteInfo	Used for the write info object.
intObjReadInfo	Used for the read info object.
intObjExecInfo	Used for the execution info object.
intObjArchRegs	Used for the registers object.
intObjCodeBlocks	Used for the code-blocks object.
intObjRipCode	Used for the code object.
intObjRawDump	Used for the injection raw dump object.
intObjExport	Used for the export object.
intObjDpi	Used for the DPI object.
intObjDpiWinDebug	Used for the DPI debug object.
intObjDpiWinPivotedStack	Used for the DPI pivoted stack object.
intObjDpiWinStolenToken	Used for the DPI stolen token object.
intObjDpiWinTokenPrivs	Used for the DPI token privs object.
intObjDpiWinThreadStart	Used for the DPI thread start object.
intObjDpiWinHeapSpray	Used for the DPI heap spray object.
intObjDpiWinSecDesc	Used for the DPI security descriptor objects.
intObjDpiWinAclEdit	Used for the DPI ACL objects.

Definition at line 538 of file serializers.c.

◆ anonymous enum

anonymous enum

Describes the encoding type of a string.

Enumerator
stringEncodeUtf8	The string encoding type 'utf-8'.
stringEncodeUtf16	The string encoding type 'utf-16'.

Definition at line 608 of file serializers.c.

◆ _SERIALIZER_EXCEPTION_TYPE

enum _SERIALIZER_EXCEPTION_TYPE

Describes the serialized exception type.

Enumerator
serializerExceptionTypeKm	Used for kernel-mode exceptions.
serializerExceptionTypeUm	Used for user-mode exceptions.
serializerExceptionTypeKmUm	Used for kernel-user mode exceptions.

Definition at line 19 of file serializers.c.

Function Documentation

◆ IntSerializeAccessInfo()

static void IntSerializeAccessInfo ( const EXCEPTION_VICTIM_ZONE * Victim )

static

Serialize the read/write/exec violation information.

Parameters

[in] Victim The victim object. `

Definition at line 1879 of file serializers.c.

Referenced by IntSerializeLixKmMisc(), IntSerializeLixUmMisc(), IntSerializeWinKmMisc(), and IntSerializeWinUmMisc().

◆ IntSerializeArchRegs()

static void IntSerializeArchRegs ( void )

static

Serialize the guest registers.

Definition at line 2385 of file serializers.c.

Referenced by IntSerializeLixKmMisc(), and IntSerializeWinKmMisc().

◆ IntSerializeBlockToBase64()

static void IntSerializeBlockToBase64	(	const BYTE *	In,
		BYTE *	Out,
		size_t	Length
	)

static

Converts the provided binary buffer to base64.

Parameters

[in]	In	The input buffer.
[out]	Out	The output buffer.
[in]	Length	The length of the input buffer.

Definition at line 633 of file serializers.c.

Referenced by IntSerializerBase64Get().

◆ IntSerializeCodeBlocks()

static void IntSerializeCodeBlocks	(	QWORD	Rip,
		QWORD	Cr3,
		BOOLEAN	Execute
	)

static

Serialize the extracted code-blocks for the current exception.

Parameters

[in]	Rip	The value of the guest RIP at the moment of the alert.
[in]	Cr3	The value
[in]	Execute	If the alert is an execution attempt.

Definition at line 2339 of file serializers.c.

Referenced by IntSerializeLixKmMisc(), IntSerializeLixUmMisc(), IntSerializeLixUmOriginator(), IntSerializeWinKmMisc(), and IntSerializeWinUmMisc().

◆ IntSerializeCodeBlocksGetExtractLevel()

static CB_EXTRACT_LEVEL IntSerializeCodeBlocksGetExtractLevel ( QWORD Rip )

static

Get the code-blocks extraction level.

Parameters

[in] Rip The value of the guest RIP at the moment of the alert.

Definition at line 2051 of file serializers.c.

Referenced by IntSerializeExtractCodeBlocks().

◆ IntSerializeCodeBlocksGetExtractRange()

static void IntSerializeCodeBlocksGetExtractRange	(	QWORD	Rip,
		BOOLEAN	Execute,
		DWORD *	Start,
		DWORD *	End
	)

static

Computes the range from which the code-blocks should be extracted.

For execute violation the end offset may be in the next page.

Parameters

[in]	Rip	The value of the guest RIP at the moment of the alert.
[in]	Execute	If the alert is an execution attempt.
[out]	Start	The start offset relative to the RIP's page.
[out]	End	The end offset relative to the RIP's page.

Definition at line 1996 of file serializers.c.

Referenced by IntSerializeExtractCodeBlocks().

◆ IntSerializeCodeBlocksPattern()

static void IntSerializeCodeBlocksPattern	(	CODE_BLOCK *	CodeBlocks,
		DWORD	Count,
		QWORD	Rip,
		BOOLEAN	Execute,
		SERIALIZER_CODE_BLOCKS *	Object
	)

static

Iterates through all extracted code-blocks patterns and serialize the patterns.

Parameters

[in]	CodeBlocks	An array of code-blocks pattern.
[in]	Count	The number of code-blocks pattern from CodeBlocks.
[in]	Rip	The value of the guest RIP at the moment of the alert.
[in]	Execute	If the alert is an execution attempt.
[in]	Object	The serializer header object.

Definition at line 2088 of file serializers.c.

Referenced by IntSerializeExtractCodeBlocks().

◆ IntSerializeCr()

static void IntSerializeCr ( const EXCEPTION_VICTIM_CR * Cr )

static

Serialize the provided CR object.

Parameters

[in] Cr The CR violation.

Definition at line 1022 of file serializers.c.

Referenced by IntSerializeLixKmVictim(), and IntSerializeWinKmVictim().

◆ IntSerializeCurrentId()

static QWORD IntSerializeCurrentId ( void )

static

Increment the current serializer alert ID and returns it.

Return values

The	current serializer alert ID.

Definition at line 717 of file serializers.c.

Referenced by IntSerializeDump().

◆ IntSerializeCurrentOffset()

static DWORD IntSerializeCurrentOffset ( void )

static

Get the current offset (length) of the serialized buffer.

Return values

The	current offset (length) of the serialized buffer.

Definition at line 689 of file serializers.c.

◆ IntSerializeCurrentPtr()

static void* IntSerializeCurrentPtr ( DWORD Size )

static

Returns the current pointer to serializer buffer and checks for overflows.

Parameters

[in] Size The size of the object.

Return values

A	pointer inside the gSerializerBuffer, otherwise, if the buffer overflows, a null pointer.

Definition at line 795 of file serializers.c.

◆ IntSerializeDpi()

static void IntSerializeDpi ( const EXCEPTION_UM_ORIGINATOR * Originator )

static

Serialize the DPI flags.

Parameters

[in] Originator The originator object.

Definition at line 2869 of file serializers.c.

Referenced by IntSerializeLixUmMisc(), and IntSerializeWinUmMisc().

◆ IntSerializeDpiWinAclEdit()

static void IntSerializeDpiWinAclEdit	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI ACL edit info (Windows).

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2774 of file serializers.c.

Referenced by IntSerializeWinDpiInfo().

◆ IntSerializeDpiWinDebug()

static void IntSerializeDpiWinDebug	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI debug flags info (Windows).

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2414 of file serializers.c.

Referenced by IntSerializeWinDpiInfo().

◆ IntSerializeDpiWinHeapSpray()

static void IntSerializeDpiWinHeapSpray	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI heap spray info (Windows).

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2551 of file serializers.c.

Referenced by IntSerializeWinDpiInfo().

◆ IntSerializeDpiWinPivotedStack()

static void IntSerializeDpiWinPivotedStack	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI pivoted stack info (Windows).

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2456 of file serializers.c.

Referenced by IntSerializeWinDpiInfo().

◆ IntSerializeDpiWinSecDesc()

static void IntSerializeDpiWinSecDesc	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI altered Security Descriptor info (Windows).

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2721 of file serializers.c.

Referenced by IntSerializeWinDpiInfo().

◆ IntSerializeDpiWinStolenToken()

static void IntSerializeDpiWinStolenToken	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI stolen token info (Windows).

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2508 of file serializers.c.

Referenced by IntSerializeWinDpiInfo().

◆ IntSerializeDpiWinThreadStart()

static void IntSerializeDpiWinThreadStart	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI start thread info (Windows).

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2676 of file serializers.c.

Referenced by IntSerializeWinDpiInfo().

◆ IntSerializeDpiWinTokenPrivs()

static void IntSerializeDpiWinTokenPrivs	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI token privs info (Windows).

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2631 of file serializers.c.

Referenced by IntSerializeWinDpiInfo().

◆ IntSerializeDtr()

static void IntSerializeDtr ( const EXCEPTION_VICTIM_DTR * Dtr )

static

Serialize the provided DTR object.

Parameters

[in] Dtr The DTR violation.

Definition at line 1119 of file serializers.c.

Referenced by IntSerializeLixKmVictim(), and IntSerializeWinKmVictim().

◆ IntSerializeDump()

static void IntSerializeDump ( void )

static

Dumps the serialized buffer (base64 format).

Definition at line 743 of file serializers.c.

Referenced by IntSerializeException().

◆ IntSerializeEpt()

static void IntSerializeEpt	(	const EXCEPTION_VICTIM_EPT *	Ept,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the provided EPT object.

Parameters

[in]	Ept	The EPT violation.
[in]	Victim	The victim object.

Definition at line 973 of file serializers.c.

Referenced by IntSerializeLixKmVictim(), IntSerializeLixUmMisc(), IntSerializeWinKmMisc(), IntSerializeWinKmVictim(), and IntSerializeWinUmMisc().

◆ IntSerializeException()

void IntSerializeException	(	void *	Victim,
		void *	Originator,
		DWORD	Type,
		INTRO_ACTION	Action,
		INTRO_ACTION_REASON	Reason,
		INTRO_EVENT_TYPE	EventClass
	)

The entry point of the serializer; will serialize the provided exception if the violation is blocked or the feedback flag is set.

The base64 buffer is logged.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.
[in]	Type	The type of the exception (user-mode/kernel-mode).
[in]	Action	The action that was taken as the result of this alert.
[in]	Reason	The reason for which Action was taken.
[in]	EventClass	The type of event.

Definition at line 3713 of file serializers.c.

◆ IntSerializeExecInfo()

static void IntSerializeExecInfo ( const EXCEPTION_VICTIM_ZONE * Victim )

static

Serialize the execution violation information.

Parameters

[in] Victim The victim object.

Definition at line 1840 of file serializers.c.

Referenced by IntSerializeAccessInfo().

◆ IntSerializeExport()

static void IntSerializeExport ( const EXCEPTION_VICTIM_ZONE * Victim )

static

Serialize the modified exports.

Parameters

[in] Victim The victim object.

Definition at line 2900 of file serializers.c.

Referenced by IntSerializeWinKmMisc(), and IntSerializeWinUmMisc().

◆ IntSerializeExtractCodeBlocks()

static INTSTATUS IntSerializeExtractCodeBlocks	(	QWORD	Rip,
		QWORD	Cr3,
		BOOLEAN	Execute,
		SERIALIZER_CODE_BLOCKS *	Object
	)

static

Extract the code-blocks for the current exception.

This function calls the _IntSerializeCodeBlocksPattern to serialize the extracted code-blocks.

Parameters

[in]	Rip	The value of the guest RIP at the moment of the alert.
[in]	Cr3	The value
[in]	Execute	If the alert is an execution attempt.
[in]	Object	The serializer header object.

Return values

INT_STATUS_SUCCESS	On success.
INT_STATUS_DATA_BUFFER_TOO_SMALL	If the we could not extract enough code-blocks.

Definition at line 2177 of file serializers.c.

Referenced by IntSerializeCodeBlocks().

◆ IntSerializeHeader()

static void IntSerializeHeader	(	SERIALIZER_EXCEPTION_TYPE	SerializerType,
		INTRO_EVENT_TYPE	EventClass
	)

static

Serialize the header of the serializer buffer.

Parameters

[in]	SerializerType	The type of the serializer exception.
[in]	EventClass	The type of event.

Definition at line 3607 of file serializers.c.

Referenced by IntSerializeKernelUserException(), IntSerializeKmException(), and IntSerializeUmException().

◆ IntSerializeIdt()

static void IntSerializeIdt ( const EXCEPTION_VICTIM_ZONE * Victim )

static

Serialize the provided IDT object.

Parameters

[in] Victim The victim object.

Definition at line 1054 of file serializers.c.

Referenced by IntSerializeWinKmVictim().

◆ IntSerializeIncrementCurrentId()

static void IntSerializeIncrementCurrentId ( void )

static

Increment the current serializer alert ID.

Definition at line 731 of file serializers.c.

Referenced by IntSerializeStart().

◆ IntSerializeIncrementCurrentPtr()

static void IntSerializeIncrementCurrentPtr ( const DWORD Size )

static

Increment the current pointer to the serializer buffer with the provided size.

Parameters

[in] Size The size to increment with.

Definition at line 703 of file serializers.c.

◆ IntSerializeInjection()

static void IntSerializeInjection	(	const EXCEPTION_VICTIM_INJECTION *	Injection,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the provided Injection object.

Parameters

[in]	Injection	The injection violation.
[in]	Victim	The victim object.

Definition at line 1151 of file serializers.c.

Referenced by IntSerializeLixUmMisc(), and IntSerializeWinUmMisc().

◆ IntSerializeInstruction()

void IntSerializeInstruction	(	INSTRUX *	Instruction,
		const QWORD	Rip
	)

Serialize the provided INSTRUX object.

Parameters

[in]	Instruction	The instruction object.
[in]	Rip	The value of the guest RIP register when the event was generated

Definition at line 1726 of file serializers.c.

Referenced by IntSerializeLixKmMisc(), IntSerializeLixKmOriginator(), IntSerializeLixUmOriginator(), IntSerializeWinKmMisc(), and IntSerializeWinUmMisc().

◆ IntSerializeKernelDriver()

static void IntSerializeKernelDriver	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const KERNEL_DRIVER *	Driver,
		const DWORD	ObjectType
	)

static

Serialize the provided KERNEL_DRIVER object.

Parameters

[in]	Originator	The originator object.
[in]	Driver	The kernel-driver object.
[in]	ObjectType	The type of the kernel-driver (intObjKernelDriver, intObjKernelDriverReturn).

Definition at line 1590 of file serializers.c.

Referenced by IntSerializeLixKmOriginator(), IntSerializeLixKmVictim(), IntSerializeWinKmOriginator(), and IntSerializeWinKmVictim().

◆ IntSerializeKernelDrvObject()

static void IntSerializeKernelDrvObject ( const WIN_DRIVER_OBJECT * DrvObject )

static

Serialize the provided WIN_DRIVER_OBJECT object.

Parameters

[in] DrvObject The windows drv-obj object.

Definition at line 1550 of file serializers.c.

Referenced by IntSerializeWinKmVictim().

◆ IntSerializeKernelUserException()

static void IntSerializeKernelUserException	(	const void *	Originator,
		const void *	Victim,
		INTRO_EVENT_TYPE	EventClass
	)

static

Serialize the kernel-user mode exception.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.
[in]	EventClass	The type of event.

Definition at line 3679 of file serializers.c.

Referenced by IntSerializeException().

◆ IntSerializeKmException()

static void IntSerializeKmException	(	const void *	Originator,
		const void *	Victim,
		INTRO_EVENT_TYPE	EventClass
	)

static

Serialize the kernel-mode exception.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.
[in]	EventClass	The type of event.

Definition at line 3635 of file serializers.c.

Referenced by IntSerializeException().

◆ IntSerializeKmMisc()

static void IntSerializeKmMisc	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the misc information for kernel-mode alert.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3574 of file serializers.c.

Referenced by IntSerializeKernelUserException(), and IntSerializeKmException().

◆ IntSerializeKmOriginator()

void IntSerializeKmOriginator	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

Serialize the information about kernel-mode originator.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3314 of file serializers.c.

Referenced by IntSerializeKernelUserException(), and IntSerializeKmException().

◆ IntSerializeKmVictim()

static void IntSerializeKmVictim	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the information about kernel-mode victim.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3492 of file serializers.c.

Referenced by IntSerializeKmException().

◆ IntSerializeLixKernelModule()

static void IntSerializeLixKernelModule	(	const KERNEL_DRIVER *	Driver,
		DWORD	ObjecType
	)

static

Serialize the provided KERNEL_DRIVER object.

Parameters

[in]	Driver	The Linux kernel-module object.
[in]	ObjecType	The type of serializer object.

Definition at line 1508 of file serializers.c.

Referenced by IntSerializeKernelDriver().

◆ IntSerializeLixKmMisc()

static void IntSerializeLixKmMisc	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the misc information for Linux kernel-mode alert.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3520 of file serializers.c.

Referenced by IntSerializeKmMisc().

◆ IntSerializeLixKmOriginator()

void IntSerializeLixKmOriginator	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

Serialize the information about Linux kernel-mode originator.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3291 of file serializers.c.

Referenced by IntSerializeKmOriginator().

◆ IntSerializeLixKmVictim()

static void IntSerializeLixKmVictim	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the information about Linux kernel-mode victim.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3420 of file serializers.c.

Referenced by IntSerializeKmVictim().

◆ IntSerializeLixProcess()

static void IntSerializeLixProcess	(	const LIX_TASK_OBJECT *	Process,
		const DWORD	ObjectType
	)

static

Serialize the provided LIX_TASK_OBJECT object.

Parameters

[in]	Process	The process object.
[in]	ObjectType	The type of the provided process (intObjLixProcess, intObjLixProcessParent).

Definition at line 1266 of file serializers.c.

Referenced by IntSerializeProcess().

◆ IntSerializeLixUmMisc()

static void IntSerializeLixUmMisc	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the misc information for Linux user-mode alert.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3175 of file serializers.c.

Referenced by IntSerializeUmMisc().

◆ IntSerializeLixUmOriginator()

void IntSerializeLixUmOriginator	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

Serialize the information about Linux user-mode originator.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2979 of file serializers.c.

Referenced by IntSerializeUmOriginator().

◆ IntSerializeLixUmVictim()

static void IntSerializeLixUmVictim	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the information about Linux user-mode victim.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3032 of file serializers.c.

Referenced by IntSerializeUmVictim().

◆ IntSerializeLixVma()

static void IntSerializeLixVma ( const LIX_VMA * Vma )

static

Serialize the provided LIX_VMA object.

Parameters

[in] Vma The Linux VMA object.

Definition at line 1393 of file serializers.c.

Referenced by IntSerializeVad().

◆ IntSerializeMsr()

static void IntSerializeMsr ( const EXCEPTION_VICTIM_MSR * Msr )

static

Serialize the provided MSR object.

Parameters

[in] Msr The MSR violation.

Definition at line 1087 of file serializers.c.

Referenced by IntSerializeLixKmVictim(), and IntSerializeWinKmVictim().

◆ IntSerializeObjectHeader()

static SERIALIZER_OBJECT_HEADER* IntSerializeObjectHeader	(	const DWORD	Version,
		const DWORD	Type
	)

static

Creates a SERIALIZER_OBJECT_HEADER object and fill the fields with the provided parameters.

Parameters

[in]	Version	The version of the header object.
[in]	Type	The type of the header object.

Return values

A	pointer to the newly created object.
NULL	if the gSerializerBuffer overflows.

Definition at line 816 of file serializers.c.

◆ IntSerializeProcess()

static void IntSerializeProcess	(	void *	Process,
		const DWORD	ObjectType
	)

static

Serialize the provided process object.

Parameters

[in]	Process	The process object.
[in]	ObjectType	The type of the provided process.

Definition at line 1321 of file serializers.c.

Referenced by IntSerializeLixUmOriginator(), IntSerializeLixUmVictim(), IntSerializeWinUmOriginator(), and IntSerializeWinUmVictim().

◆ IntSerializeRawDump()

static void IntSerializeRawDump	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the raw dump for the injection violation.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 1904 of file serializers.c.

Referenced by IntSerializeLixUmMisc(), and IntSerializeWinUmMisc().

◆ IntSerializerBase64Get()

static char* IntSerializerBase64Get ( DWORD * Length )

static

Converts the serialized buffer to base64.

Parameters

[out] Length The length of the base64 buffer.

Return values

A	pointer to the beginning of the base64 buffer.

Definition at line 654 of file serializers.c.

Referenced by IntSerializeDump().

◆ IntSerializeReadInfo()

static void IntSerializeReadInfo ( const EXCEPTION_VICTIM_ZONE * Victim )

static

Serialize the read violation information.

Parameters

[in] Victim The victim object.

Definition at line 1803 of file serializers.c.

Referenced by IntSerializeAccessInfo().

◆ IntSerializeRipCode()

static void IntSerializeRipCode ( void )

static

Serialize the guest memory page that contains the RIP at which the violation attempt was detected.

Definition at line 1956 of file serializers.c.

Referenced by IntSerializeLixKmMisc(), IntSerializeLixUmMisc(), IntSerializeWinKmMisc(), and IntSerializeWinUmMisc().

◆ IntSerializeStart()

void IntSerializeStart ( void )

Set the current serializer pointer to the beginning of the buffer and generated a new alert-ID.

Definition at line 3700 of file serializers.c.

Referenced by IntSerializeException().

◆ IntSerializeString()

static void IntSerializeString	(	const void *	String,
		DWORD	Size,
		DWORD	Encode,
		SERIALIZER_OBJECT_HEADER *	Header
	)

static

Serialize the provided string.

Parameters

[in]	String	A string.
[in]	Size	The size of the string.
[in]	Encode	The encode type of string.
[out]	Header	The header of the serialized object.

Definition at line 876 of file serializers.c.

Referenced by IntSerializeExport(), IntSerializeKernelDriver(), IntSerializeKernelDrvObject(), IntSerializeLixKernelModule(), IntSerializeLixProcess(), IntSerializeLixVma(), IntSerializeWinKernelDriver(), IntSerializeWinModule(), IntSerializeWinProcess(), and IntSerializeWinVad().

◆ IntSerializeStringIsWcharAscii()

static BOOLEAN IntSerializeStringIsWcharAscii	(	const void *	String,
		DWORD	Size
	)

static

Checks if the provided string contains WCHARS.

Parameters

[in]	String	A string.
[in]	Size	The size of the string.

Return values

True	if the provided string contains WCHARs, otherwise false.

Definition at line 848 of file serializers.c.

Referenced by IntSerializeString().

◆ IntSerializeUmException()

static void IntSerializeUmException	(	const void *	Originator,
		const void *	Victim,
		INTRO_EVENT_TYPE	EventClass
	)

static

Serialize the user-mode exception.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.
[in]	EventClass	The type of event.

Definition at line 3657 of file serializers.c.

Referenced by IntSerializeException().

◆ IntSerializeUmMisc()

static void IntSerializeUmMisc	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the misc information for user-mode alert.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3210 of file serializers.c.

Referenced by IntSerializeUmException().

◆ IntSerializeUmOriginator()

static void IntSerializeUmOriginator	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the information about user-mode originator.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3001 of file serializers.c.

Referenced by IntSerializeUmException().

◆ IntSerializeUmVictim()

static void IntSerializeUmVictim	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the information about user-mode victim.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3240 of file serializers.c.

Referenced by IntSerializeKernelUserException(), and IntSerializeUmException().

◆ IntSerializeVad()

static void IntSerializeVad ( const void * Vad )

static

Serialize the provided VAD/vma object.

Parameters

[in] Vad The VAD/vma object.

Definition at line 1447 of file serializers.c.

Referenced by IntSerializeLixUmVictim(), and IntSerializeWinUmVictim().

◆ IntSerializeValidObjectSize()

static BOOLEAN IntSerializeValidObjectSize ( DWORD Size )

static

Checks if the serializer buffer overflows.

Parameters

[in] Size The size of the object.

Return values

True	if the buffer doesn't overflows, otherwise false.

Definition at line 768 of file serializers.c.

Referenced by IntSerializeCurrentPtr(), and IntSerializeExtractCodeBlocks().

◆ IntSerializeWinDpiInfo()

static void IntSerializeWinDpiInfo	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the DPI extra information.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2817 of file serializers.c.

Referenced by IntSerializeWinUmMisc().

◆ IntSerializeWinKernelDriver()

static void IntSerializeWinKernelDriver	(	const KERNEL_DRIVER *	Driver,
		DWORD	ObjectType
	)

static

Serialize the provided KERNEL_DRIVER object.

Parameters

[in]	Driver	The windows kernel-driver object.
[in]	ObjectType	The type of serializer object.

Definition at line 1468 of file serializers.c.

Referenced by IntSerializeKernelDriver().

◆ IntSerializeWinKmMisc()

static void IntSerializeWinKmMisc	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the misc information for windows kernel-mode alert.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3543 of file serializers.c.

Referenced by IntSerializeKmMisc().

◆ IntSerializeWinKmOriginator()

void IntSerializeWinKmOriginator	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

Serialize the information about windows kernel-mode originator.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3270 of file serializers.c.

Referenced by IntSerializeKmOriginator().

◆ IntSerializeWinKmVictim()

static void IntSerializeWinKmVictim	(	const EXCEPTION_KM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the information about Windows kernel-mode victim.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3341 of file serializers.c.

Referenced by IntSerializeKmVictim().

◆ IntSerializeWinModule()

static void IntSerializeWinModule	(	const WIN_PROCESS_MODULE *	Module,
		const DWORD	ObjectType
	)

static

Serialize the provided WIN_PROCESS_MODULE object.

Parameters

[in]	Module	The windows module object.
[in]	ObjectType	The type of the windows module. (intObjWinModule, intObjWinModuleReturn).

Definition at line 1685 of file serializers.c.

Referenced by IntSerializeWinUmOriginator(), and IntSerializeWinUmVictim().

◆ IntSerializeWinProcess()

static void IntSerializeWinProcess	(	const WIN_PROCESS_OBJECT *	Process,
		const DWORD	ObjectType
	)

static

Serialize the provided WIN_PROCESS_OBJECT object.

Parameters

[in]	Process	The process object.
[in]	ObjectType	The type of the provided process (intObjWinProcess, intObjWinProcessParent).

Definition at line 1212 of file serializers.c.

Referenced by IntSerializeDpiWinDebug(), IntSerializeDpiWinSecDesc(), IntSerializeDpiWinStolenToken(), and IntSerializeProcess().

◆ IntSerializeWinUmMisc()

static void IntSerializeWinUmMisc	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the misc information for windows user-mode alert.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3127 of file serializers.c.

Referenced by IntSerializeUmMisc().

◆ IntSerializeWinUmOriginator()

static void IntSerializeWinUmOriginator	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the information about windows user-mode originator.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 2953 of file serializers.c.

Referenced by IntSerializeUmOriginator().

◆ IntSerializeWinUmVictim()

static void IntSerializeWinUmVictim	(	const EXCEPTION_UM_ORIGINATOR *	Originator,
		const EXCEPTION_VICTIM_ZONE *	Victim
	)

static

Serialize the information about user-mode windows victim.

Parameters

[in]	Originator	The originator object.
[in]	Victim	The victim object.

Definition at line 3074 of file serializers.c.

Referenced by IntSerializeUmVictim().

◆ IntSerializeWinVad()

void IntSerializeWinVad ( const VAD * Vad )

Serialize the provided VAD object.

Parameters

[in] Vad The windows VAD object.

Definition at line 1344 of file serializers.c.

Referenced by IntSerializeVad().

◆ IntSerializeWriteInfo()

static void IntSerializeWriteInfo ( const EXCEPTION_VICTIM_ZONE * Victim )

static

Serialize the write violation information.

Parameters

[in] Victim The victim object.

Definition at line 1765 of file serializers.c.

Referenced by IntSerializeAccessInfo().

Variable Documentation

◆ gBase64Buffer

char gBase64Buffer[Base64EncSize(sizeof(gSerializerBuffer))] = {0}

static

Definition at line 628 of file serializers.c.

Referenced by IntSerializerBase64Get().

◆ gBase64Chars

const char gBase64Chars[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

Definition at line 624 of file serializers.c.

Referenced by IntSerializeBlockToBase64().

◆ gCodeBlocks

CODE_BLOCK gCodeBlocks[PAGE_SIZE/sizeof(CODE_BLOCK)]

static

Definition at line 622 of file serializers.c.

Referenced by IntAlertFillCodeBlocks(), IntSerializeCodeBlocksPattern(), and IntSerializeExtractCodeBlocks().

◆ gCodeBlocksPattern

CODE_BLOCK_PATTERN gCodeBlocksPattern[PAGE_SIZE/sizeof(CODE_BLOCK_PATTERN)]

static

Definition at line 620 of file serializers.c.

Referenced by IntSerializeExtractCodeBlocks().

◆ gCodeBlocksPatternLength

DWORD gCodeBlocksPatternLength = 0

static

Definition at line 621 of file serializers.c.

Referenced by IntSerializeExtractCodeBlocks().

◆ gCurrentPtr

BYTE* gCurrentPtr = NULL

static

Definition at line 617 of file serializers.c.

Referenced by IntSerializeCurrentOffset(), IntSerializeCurrentPtr(), IntSerializeIncrementCurrentPtr(), IntSerializerBase64Get(), IntSerializeStart(), and IntSerializeValidObjectSize().

◆ gSerializerBuffer

BYTE gSerializerBuffer[MAX_SERIALIZER_LENGTH] = { 0 }

static

Definition at line 616 of file serializers.c.

Referenced by IntSerializeCurrentOffset(), IntSerializerBase64Get(), IntSerializeStart(), and IntSerializeValidObjectSize().

◆ gSerializerCurrentId

QWORD gSerializerCurrentId = 0

static

Definition at line 618 of file serializers.c.

Referenced by IntSerializeCurrentId(), and IntSerializeIncrementCurrentId().

Data Structures

Macros

Typedefs

Enumerations

Functions

Variables

Macro Definition Documentation

◆ ARCH_REGS_SERIALIZER_VERSION

◆ Base64EncSize

◆ CODE_BLOCKS_SERIALIZER_VERSION

◆ DPI_SERIALIZER_VERSION

◆ DPI_WIN_ACL_SERIALIZER_VERSION

◆ DPI_WIN_DEBUG_SERIALIZER_VERSION

◆ DPI_WIN_HEAP_SPRAY_SERIALIZER_VERSION

◆ DPI_WIN_PIVOTET_STACK_SERIALIZER_VERSION

◆ DPI_WIN_SEC_DESC_SERIALIZER_VERSION

◆ DPI_WIN_STOLEN_TOKEN_SERIALIZER_VERSION

◆ DPI_WIN_THREAD_START_SERIALIZER_VERSION

◆ DPI_WIN_TOKEN_PRIVS_SERIALIZER_VERSION

◆ END_MISC_SERIALZIER_VERSION [1/2]

◆ END_MISC_SERIALZIER_VERSION [2/2]

◆ END_ORIGINATOR_SERIALZIER_VERSION

◆ END_VICTIM_SERIALZIER_VERSION

◆ EXEC_INFO_SERIALIZER_VERSION

◆ EXPORT_SERIALIZER_VERSION

◆ INSTRUX_SERIALIZER_VERSION

◆ KERNEL_DRIVER_SERIALIZER_VERSION

◆ KERNEL_DRV_OBJECT_SERIALIZER_VERSION

◆ KM_ORIGINATOR_SERIALZIER_VERSION [1/2]

◆ KM_ORIGINATOR_SERIALZIER_VERSION [2/2]

◆ LIX_KERNEL_MODULE_SERIALIZER_VERSION

◆ LIX_KM_VICTIM_SERIALIZER_VERSION

◆ LIX_PROCESS_SERIALIZER_VERSION

◆ LIX_VICTIM_SERIALIZER_VERSION

◆ LIX_VMA_SERIALIZER_VERSION

◆ MAX_SERIALIZER_LENGTH

◆ RAW_DUMP_SERIALIZER_VERSION

◆ READ_INFO_SERIALIZER_VERSION

◆ RIP_CODE_SERIALIZER_VERSION

◆ START_MISC_SERIALZIER_VERSION [1/2]

◆ START_MISC_SERIALZIER_VERSION [2/2]

◆ START_ORIGINATOR_SERIALZIER_VERSION

◆ START_VICTIM_SERIALZIER_VERSION

◆ VICTIM_SERIALIZER_CR_VERSION

◆ VICTIM_SERIALIZER_DTR_VERSION

◆ VICTIM_SERIALIZER_EPT_VERSION

◆ VICTIM_SERIALIZER_IDT_VERSION

◆ VICTIM_SERIALIZER_INJECTION_VERSION

◆ VICTIM_SERIALIZER_MSR_VERSION

◆ WIN_KERNEL_DRIVER_SERIALIZER_VERSION

◆ WIN_KM_VICTIM_SERIALIZER_VERSION

◆ WIN_PROCESS_MODULE_SERIALIZER_VERSION

◆ WIN_PROCESS_SERIALIZER_VERSION

◆ WIN_VAD_SERIALIZER_VERSION

◆ WIN_VICTIM_SERIALIZER_VERSION

◆ WRITE_INFO_SERIALIZER_VERSION

Typedef Documentation

◆ PSERIALIZER_ARCH_REGS

◆ PSERIALIZER_CODE_BLOCKS

◆ PSERIALIZER_CR

◆ PSERIALIZER_DPI

◆ PSERIALIZER_DPI_PIVOTED_STACK

◆ PSERIALIZER_DPI_WIN_ACL_EDIT

◆ PSERIALIZER_DPI_WIN_DEBUG

◆ PSERIALIZER_DPI_WIN_HEAP_SPRAY

◆ PSERIALIZER_DPI_WIN_SEC_DESC

◆ PSERIALIZER_DPI_WIN_STOLEN_TOKEN

◆ PSERIALIZER_DPI_WIN_THREAD_START

◆ PSERIALIZER_DPI_WIN_TOKEN_PRIVS

◆ PSERIALIZER_DTR

◆ PSERIALIZER_EPT

◆ PSERIALIZER_EXCEPTION_KM_ORIGINATOR

◆ PSERIALIZER_EXCEPTION_UM_ORIGINATOR

◆ PSERIALIZER_EXCEPTION_VICTIM

◆ PSERIALIZER_EXEC_INFO

◆ PSERIALIZER_EXPORT

◆ PSERIALIZER_IDT

◆ PSERIALIZER_INJECTION

◆ PSERIALIZER_INSTRUX

◆ PSERIALIZER_KERNEL_DRIVER