Holds information about a Windows guest. More...

#include <winguest.h>

Data Fields
QWORD	PsCreateSystemThread
	Guest virtual address of the PsCreateSystemThread kernel function. More...

QWORD	ExAllocatePoolWithTag
	Guest virtual address of the ExAllocatePoolWithTag kernel function. More...

QWORD	ExFreePoolWithTag
	Guest virtual address of the ExFreePoolWithTag kernel function. More...

QWORD	SyscallAddress
	Guest virtual address of the SYSCALL/SYSENTER handler. More...

DWORD	NtBuildNumberValue
	The value of the NtBuildNumber kernel variable. More...

QWORD	KeServiceDescriptorTable
	Guest virtual address of the KeServiceDescriptorTable variable. More...

QWORD	Ssdt
	Guest virtual address of the SSDT structure inside the kernel. More...

DWORD	NumberOfServices
	The number of entries in the SSDT. More...

QWORD	HalpInterruptControllerGva
	Guest virtual address of the HalpInterruptController (owned by hal.dll). More...

QWORD	PropperSyscallGva
	Guest virtual address of the KiSystemServiceUser function. More...

PCHAR	NtBuildLabString

PCHAR	VersionString
	A NULL terminated string containing Windows version information. More...

PCHAR	ServerVersionString
	A NULL terminated string containing Windows server version information. More...

WIN_PRODUCT_TYPE	ProductType
	The product type. Obtained directly from the guest during initialization. More...

QWORD	PsActiveProcessHead
	Guest virtual address of the PsActiveProcessHead kernel variable. More...

QWORD	PsLoadedModuleList
	Guest virtual address of the PsLoadedModuleList kernel variable. More...

QWORD	MmPfnDatabase
	Guest virtual address of the PFN data base. More...

QWORD	ObpRootDirectoryObject
	Guest virtual address of the ObpRootDirectoryObject. More...

QWORD	DriverDirectory
	Guest virtual address of the Driver namespace directory. More...

QWORD	FileSystemDirectory
	Guest virtual address of the FileSystem namespace directory. More...

BYTE *	KernelBuffer
	A buffer containing the entire kernel image. More...

DWORD	KernelBufferSize
	The size of the KernelBuffer. More...

DWORD	RemainingSections
	The number of kernel sections not yet read into KernelBuffer. More...

LIST_HEAD	InitSwapHandles
	A list of swap handles used to read KernelBuffer. More...

WIN_OPAQUE_FIELDS	OsSpecificFields
	OS-dependent and specific information (variables, offsets, etc). More...

Detailed Description

Holds information about a Windows guest.

Definition at line 810 of file winguest.h.

Field Documentation

◆ DriverDirectory

QWORD _WINDOWS_GUEST::DriverDirectory

Guest virtual address of the Driver namespace directory.

Definition at line 839 of file winguest.h.

Referenced by IntWinObjCheckDrvDirSearchState(), and IntWinObjParseDriverDirectory().

◆ ExAllocatePoolWithTag

QWORD _WINDOWS_GUEST::ExAllocatePoolWithTag

Guest virtual address of the ExAllocatePoolWithTag kernel function.

Definition at line 813 of file winguest.h.

Referenced by IntWinAgentInject(), and IntWinGuestResolveImports().

◆ ExFreePoolWithTag

QWORD _WINDOWS_GUEST::ExFreePoolWithTag

Guest virtual address of the ExFreePoolWithTag kernel function.

Definition at line 814 of file winguest.h.

Referenced by IntWinAgentInject(), and IntWinGuestResolveImports().

◆ FileSystemDirectory

QWORD _WINDOWS_GUEST::FileSystemDirectory

Guest virtual address of the FileSystem namespace directory.

Definition at line 840 of file winguest.h.

Referenced by IntWinObjCheckDrvDirSearchState(), and IntWinObjParseDriverDirectory().

◆ HalpInterruptControllerGva

QWORD _WINDOWS_GUEST::HalpInterruptControllerGva

Guest virtual address of the HalpInterruptController (owned by hal.dll).

Definition at line 820 of file winguest.h.

◆ InitSwapHandles

LIST_HEAD _WINDOWS_GUEST::InitSwapHandles

A list of swap handles used to read KernelBuffer.

Definition at line 855 of file winguest.h.

Referenced by IntWinGuestCancelKernelRead(), IntWinGuestNew(), and IntWinGuestReadKernel().

◆ KernelBuffer

BYTE* _WINDOWS_GUEST::KernelBuffer

A buffer containing the entire kernel image.

It can be used instead of reading from the guest memory when values from non-writable parts of the kernel are needed. This boosts performance, as it can save us from quite a lot of GVA to GPA translations and GPA mappings inside the host. Because certain parts of the kernel may be swapped out, this buffer is filled using IntSwapMemRead, with IntWinGuestSectionInMemory as the swap in handler. This means that it is not necessarily read in a sequential manner. While RemainingSections is not 0, the buffer is not yet filled and no hooks are placed inside the guest. It is guaranteed that the buffer is fully read after IntWinGuestFinishInit is called.

Definition at line 851 of file winguest.h.

Referenced by IntAlertEptFillFromVictimZone(), IntDetSetHook(), IntExceptWinKernelGetOriginator(), IntPeFindKernelExport(), IntPtiMonitorAllPtWriteCandidates(), IntSlackAllocWindows(), IntSwapgsStartMitigation(), IntWinAgentFindSyscallLinkage(), IntWinApiFindFunctionRva(), IntWinGuestFindDriversNamespace(), IntWinGuestFindKernelObjectsInternal(), IntWinGuestReadKernel(), IntWinGuestSectionInMemory(), IntWinGuestUninit(), IntWinHalFindPerformanceCounterInternal(), IntWinInfHookGetEtwpDebuggerData(), and IntWinStackTraceGet64().