unpacker.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "unpacker.h"
#include "decoder.h"
#include "hook.h"




#define UNPACK_STATE_NONE           0x00  
#define UNPACK_STATE_DIRTY          0x01  
#define UNPACK_STATE_EXEC           0x02  


typedef struct _UNPACK_PAGE
{
    LIST_ENTRY      Link;               
    QWORD           Cr3;                
    QWORD           VirtualAddress;     
    WORD            WriteCount;         
    BYTE            State;              
    PFUNC_PageUnpackedCallback UnpackCallback;  
    PFUNC_PageIsWriteValid WriteCheckCallback;   
    void           *CallbackContext;    
    void           *WriteHook;          
    void           *ExecHook;           
} UNPACK_PAGE, *PUNPACK_PAGE;


static LIST_HEAD gUnpckPages = LIST_HEAD_INIT(gUnpckPages);



static PUNPACK_PAGE
IntUnpFindPage(
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress
    )
{
    LIST_ENTRY *list;

    list = gUnpckPages.Flink;
    while (list != &gUnpckPages)
    {
        PUNPACK_PAGE pPage = CONTAINING_RECORD(list, UNPACK_PAGE, Link);
        list = list->Flink;

        if ((pPage->VirtualAddress == VirtualAddress) && (pPage->Cr3 == Cr3))
        {
            return pPage;
        }
    }

    return NULL;
}


static INTSTATUS
IntUnpUnWatchPageInternal(
    _In_ PUNPACK_PAGE Page
    )
{
    INTSTATUS status;

    if (NULL == Page)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL != Page->WriteHook)
    {
        status = IntHookGvaRemoveHook((HOOK_GVA **)&Page->WriteHook, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookGvaRemoveHook failed: 0x%08x\n", status);
        }
    }

    if (NULL != Page->ExecHook)
    {
        status = IntHookGvaRemoveHook((HOOK_GVA **)&Page->ExecHook, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookGvaRemoveHook failed: 0x%08x\n", status);
        }
    }

    RemoveEntryList(&Page->Link);

    HpFreeAndNullWithTag(&Page, IC_TAG_UNPG);

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntUnpPageExecuteCallback(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    )
{
    INTSTATUS status;
    PUNPACK_PAGE pPage;
    PFUNC_PageUnpackedCallback cbk;
    QWORD cr3, va;
    void *cbkCtxt;
    INSTRUX instrux;

    UNREFERENCED_PARAMETER(Hook);

    if (NULL == Context)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == Action)
    {
        return INT_STATUS_INVALID_PARAMETER_5;
    }

    cbk = NULL;
    cbkCtxt = NULL;
    va = 0;
    cr3 = 0;

    pPage = (PUNPACK_PAGE)Context;

    pPage->State |= UNPACK_STATE_EXEC;

    if (pPage->State & UNPACK_STATE_DIRTY)
    {
        // Decode the designated instruction.
        status = IntDecDecodeInstructionAtRip(gVcpu->Index, &gVcpu->Regs, NULL, &instrux);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntDecDecodeInstructionAtRip failed: 0x%08x\n", status);

            memset(&instrux, 0, sizeof(instrux));
        }

        if (NULL != pPage->UnpackCallback)
        {
            cbk = pPage->UnpackCallback;
            cr3 = pPage->Cr3;
            va = pPage->VirtualAddress + (Address & PAGE_OFFSET);
            cbkCtxt = pPage->CallbackContext;
        }
    }

    // Done, remove the hook from this page.
    IntUnpUnWatchPageInternal(pPage);

    if (NULL != cbk)
    {
        status = cbk(cr3, va, &instrux, cbkCtxt);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Unpacker callback failed: 0x%08x\n", status);
        }
    }

    *Action = introGuestAllowed;

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntUnpPageWriteCallback(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    )
{
    INTSTATUS status;
    PUNPACK_PAGE pPage;
    BOOLEAN bValid;

    UNREFERENCED_PARAMETER(Address);
    UNREFERENCED_PARAMETER(Hook);

    if (NULL == Context)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == Action)
    {
        return INT_STATUS_INVALID_PARAMETER_4;
    }


    pPage = (PUNPACK_PAGE)Context;

    // Check if the write is valid (example, it is an IAT).
    if (NULL != pPage->WriteCheckCallback)
    {
        bValid = pPage->WriteCheckCallback(pPage->Cr3,
                                           pPage->VirtualAddress + (Address & 0xFFF),
                                           pPage->CallbackContext);
    }
    else
    {
        bValid = FALSE;
    }

    if (!bValid)
    {
        pPage->State |= UNPACK_STATE_DIRTY;
        pPage->WriteCount++;
    }

    if (pPage->WriteCount >= 32)
    {
        if (NULL != pPage->WriteHook)
        {
            status = IntHookGvaRemoveHook((HOOK_GVA **)&pPage->WriteHook, 0);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntHookGvaRemoveHook failed: 0x%08x\n", status);
            }
        }

        status = IntHookGvaSetHook(pPage->Cr3,
                                   pPage->VirtualAddress,
                                   PAGE_SIZE,
                                   IG_EPT_HOOK_EXECUTE,
                                   IntUnpPageExecuteCallback,
                                   pPage,
                                   NULL,
                                   0,
                                   (PHOOK_GVA *)&pPage->ExecHook);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookGvaSetHook failed: 0x%08x\n", status);
            pPage->ExecHook = NULL;
            goto cleanup_and_exit;
        }
    }

cleanup_and_exit:

    // We will always allow the actions, but we won't send any notifications.
    *Action = introGuestAllowed;

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntUnpWatchPage(
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress,
    _In_ PFUNC_PageUnpackedCallback UnpackCallback,
    _In_ PFUNC_PageIsWriteValid WriteCheckCallback,
    _In_opt_ void *CallbackContext
    )
{
    INTSTATUS status;

    UNPACK_PAGE *pPage = HpAllocWithTag(sizeof(*pPage), IC_TAG_UNPG);
    if (NULL == pPage)
    {
        return INT_STATUS_INSUFFICIENT_RESOURCES;
    }

    pPage->Cr3 = Cr3;
    pPage->VirtualAddress = VirtualAddress;
    pPage->State = UNPACK_STATE_NONE;
    pPage->UnpackCallback = UnpackCallback;
    pPage->WriteCheckCallback = WriteCheckCallback;
    pPage->CallbackContext = CallbackContext;
    pPage->WriteHook = NULL;
    pPage->ExecHook = NULL;

    InsertTailList(&gUnpckPages, &pPage->Link);

    status = IntHookGvaSetHook(Cr3,
                               VirtualAddress,
                               PAGE_SIZE,
                               IG_EPT_HOOK_WRITE,
                               IntUnpPageWriteCallback,
                               pPage,
                               NULL,
                               0,
                               (PHOOK_GVA *)&pPage->WriteHook);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookGvaSetHook failed: 0x%08x\n", status);
        pPage->WriteHook = NULL;
        goto cleanup_and_exit;
    }

    status = INT_STATUS_SUCCESS;

cleanup_and_exit:
    if (!INT_SUCCESS(status))
    {
        if (NULL != pPage)
        {
            IntUnpUnWatchPageInternal(pPage);
        }
    }

    return status;
}


INTSTATUS
IntUnpUnWatchPage(
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress
    )
{
    INTSTATUS status;
    LIST_ENTRY *list;

    list = gUnpckPages.Flink;
    while (list != &gUnpckPages)
    {
        PUNPACK_PAGE pPage = CONTAINING_RECORD(list, UNPACK_PAGE, Link);
        list = list->Flink;

        if ((pPage->VirtualAddress == VirtualAddress) && (pPage->Cr3 == Cr3))
        {
            status = IntUnpUnWatchPageInternal(pPage);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntUnpUnWatchPageInternal failed: 0x%08x, page 0x%016llx/0x%016llx\n",
                      status,
                      pPage->VirtualAddress,
                      pPage->Cr3);
            }

            break;
        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntUnpUnWatchVaSpacePages(
    _In_ QWORD Cr3
    )
{
    INTSTATUS status;
    LIST_ENTRY *list;

    list = gUnpckPages.Flink;
    while (list != &gUnpckPages)
    {
        PUNPACK_PAGE pPage = CONTAINING_RECORD(list, UNPACK_PAGE, Link);
        list = list->Flink;

        if (pPage->Cr3 == Cr3)
        {
            status = IntUnpUnWatchPageInternal(pPage);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntUnpUnWatchPageInternal failed: 0x%08x, page 0x%016llx/0x%016llx\n",
                      status, pPage->VirtualAddress, pPage->Cr3);
            }
        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntUnpRemovePages(
    void
    )
{
    INTSTATUS status;
    LIST_ENTRY *list;

    list = gUnpckPages.Flink;
    while (list != &gUnpckPages)
    {
        PUNPACK_PAGE pPage = CONTAINING_RECORD(list, UNPACK_PAGE, Link);
        list = list->Flink;

        status = IntUnpUnWatchPageInternal(pPage);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntUnpUnWatchPageInternal failed: 0x%08x, page 0x%016llx/0x%016llx\n",
                  status, pPage->VirtualAddress, pPage->Cr3);
        }
    }

    return INT_STATUS_SUCCESS;
}


void
IntUnpUninit(
    void
    )
{
    IntUnpRemovePages();
}