Bitdefender Hypervisor Memory Introspection
|
#include "handlers.h"
#include <stdint.h>
#include <signal.h>
#include <stddef.h>
#include <stdbool.h>
#include <errno.h>
Go to the source code of this file.
Macros | |
#define | __fn_aligned __attribute__((aligned(16))) |
#define | __fn_save_all __attribute__((no_caller_saved_registers)) |
#define | __section(S) __attribute__((section (S))) |
#define | __default_fn_attr __fn_save_all __fn_aligned |
#define | __fn_naked __attribute__((naked)) |
#define | BIT(x) (1ULL << (x)) |
#define | UNUSED_PARAMETER(P) ((void)(P)) |
#define | PAGE_SIZE 0x1000 |
#define | get_jump_back_offset(fn_name) |
#define | get_detour_enable_offset(fn_name) |
#define | GNUASM_DEFINE_STR(SYMBOL, STR) asm volatile ("#define " SYMBOL " " #STR); |
#define | GNUASM_DEFINE_VAL(SYMBOL, VALUE) asm volatile ("#define " SYMBOL " %0" :: "n"(VALUE)) |
#define | def_detour_asm_vars(fn_name) GNUASM_DEFINE_VAL(#fn_name "_jmp", get_jump_back_offset(fn_name)) |
#define | def_detour_hijack_asm_vars(fn_name, hijack_fn_name) GNUASM_DEFINE_VAL(#fn_name "_" # hijack_fn_name "_jmp", get_jump_back_offset(fn_name ## _ ## hijack_fn_name)) |
#define | def_detour_vars(fn_name) extern void *fn_name ## _trampoline; extern void *fn_name ## _reloc |
#define | def_detour_hijack_vars(fn_name, fn_hijack_name) extern void *fn_name ## _ ## fn_hijack_name ## _trampoline; extern void *fn_name ## _ ## fn_hijack_name ## _reloc |
#define | init_detour_field(fn_name) |
#define | init_detour_hijack_field(fn_name, hijack_fn_name) |
#define | __vmcall_param_1(param) register size_t __p1 asm("r8") = (size_t)(param); asm volatile("" :: "r" (__p1)); |
#define | __vmcall_param_2(param) register size_t __p2 asm("r9") = (size_t)(param); asm volatile("" :: "r" (__p2)); |
#define | __vmcall_param_3(param) register size_t __p3 asm("r10") = (size_t)(param); asm volatile("" :: "r" (__p3)); |
#define | __vmcall_param_4(param) register size_t __p4 asm("r11") = (size_t)(param); asm volatile("" :: "r" (__p4)); |
#define | __vmcall_param_5(param) register size_t __p5 asm("r12") = (size_t)(param); asm volatile("" :: "r" (__p5)); |
#define | __vmcall_param_6(param) register size_t __p6 asm("r13") = (size_t)(param); asm volatile("" :: "r" (__p6)); |
#define | __vmcall_param_7(param) register size_t __p7 asm("r14") = (size_t)(param); asm volatile("" :: "r" (__p7)); |
#define | __vmcall_param_8(param) register size_t __p8 asm("r15") = (size_t)(param); asm volatile("" :: "r" (__p8)); |
#define | vmcall_1(id, p1) |
#define | vmcall_2(id, p1, p2) |
#define | vmcall_3(id, p1, p2, p3) |
#define | vmcall_4(id, p1, p2, p3, p4) |
#define | vmcall_5(id, p1, p2, p3, p4, p5) |
#define | vmcall_6(id, p1, p2, p3, p4, p5, p6) |
#define | __read_reg(reg) |
#define __default_fn_attr __fn_save_all __fn_aligned |
#define __fn_save_all __attribute__((no_caller_saved_registers)) |
#define __read_reg | ( | reg | ) |
Definition at line 153 of file common.h.
Referenced by store_regs().
#define __vmcall_param_1 | ( | param | ) | register size_t __p1 asm("r8") = (size_t)(param); asm volatile("" :: "r" (__p1)); |
#define __vmcall_param_2 | ( | param | ) | register size_t __p2 asm("r9") = (size_t)(param); asm volatile("" :: "r" (__p2)); |
#define __vmcall_param_3 | ( | param | ) | register size_t __p3 asm("r10") = (size_t)(param); asm volatile("" :: "r" (__p3)); |
#define __vmcall_param_4 | ( | param | ) | register size_t __p4 asm("r11") = (size_t)(param); asm volatile("" :: "r" (__p4)); |
#define __vmcall_param_5 | ( | param | ) | register size_t __p5 asm("r12") = (size_t)(param); asm volatile("" :: "r" (__p5)); |
#define __vmcall_param_6 | ( | param | ) | register size_t __p6 asm("r13") = (size_t)(param); asm volatile("" :: "r" (__p6)); |
#define __vmcall_param_7 | ( | param | ) | register size_t __p7 asm("r14") = (size_t)(param); asm volatile("" :: "r" (__p7)); |
#define __vmcall_param_8 | ( | param | ) | register size_t __p8 asm("r15") = (size_t)(param); asm volatile("" :: "r" (__p8)); |
#define def_detour_asm_vars | ( | fn_name | ) | GNUASM_DEFINE_VAL(#fn_name "_jmp", get_jump_back_offset(fn_name)) |
Definition at line 45 of file common.h.
Referenced by __asm_defines().
#define def_detour_hijack_asm_vars | ( | fn_name, | |
hijack_fn_name | |||
) | GNUASM_DEFINE_VAL(#fn_name "_" # hijack_fn_name "_jmp", get_jump_back_offset(fn_name ## _ ## hijack_fn_name)) |
Definition at line 48 of file common.h.
Referenced by __asm_defines().
#define def_detour_hijack_vars | ( | fn_name, | |
fn_hijack_name | |||
) | extern void *fn_name ## _ ## fn_hijack_name ## _trampoline; extern void *fn_name ## _ ## fn_hijack_name ## _reloc |
#define def_detour_vars | ( | fn_name | ) | extern void *fn_name ## _trampoline; extern void *fn_name ## _reloc |
#define get_detour_enable_offset | ( | fn_name | ) |
#define get_jump_back_offset | ( | fn_name | ) |
#define GNUASM_DEFINE_STR | ( | SYMBOL, | |
STR | |||
) | asm volatile ("#define " SYMBOL " " #STR); |
#define GNUASM_DEFINE_VAL | ( | SYMBOL, | |
VALUE | |||
) | asm volatile ("#define " SYMBOL " %0" :: "n"(VALUE)) |
#define init_detour_field | ( | fn_name | ) |
#define init_detour_hijack_field | ( | fn_name, | |
hijack_fn_name | |||
) |
#define vmcall_1 | ( | id, | |
p1 | |||
) |
Definition at line 97 of file common.h.
Referenced by module_param_sysfs_remove(), and module_param_sysfs_setup().
#define vmcall_2 | ( | id, | |
p1, | |||
p2 | |||
) |
Definition at line 104 of file common.h.
Referenced by __vma_link_rb(), arch_jump_label_transform(), arch_ptrace(), change_protection(), commit_creds(), do_exit(), do_munmap_rb_erase(), mprotect_fixup_vma_wants_writenotify(), process_vm_rw_core(), vma_adjust_rb_erase(), vma_rb_erase(), and wake_up_new_task().
#define vmcall_3 | ( | id, | |
p1, | |||
p2, | |||
p3 | |||
) |
Definition at line 112 of file common.h.
Referenced by begin_new_exec(), complete_signal(), expand_downwards(), flush_old_exec(), ftrace_write(), and text_poke().
#define vmcall_4 | ( | id, | |
p1, | |||
p2, | |||
p3, | |||
p4 | |||
) |
Definition at line 121 of file common.h.
Referenced by vma_adjust().
#define vmcall_5 | ( | id, | |
p1, | |||
p2, | |||
p3, | |||
p4, | |||
p5 | |||
) |
Definition at line 131 of file common.h.
Referenced by __access_remote_vm().