update_exceptions.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#ifndef _UPDATE_EXCEPTIONS_H_
#define _UPDATE_EXCEPTIONS_H_

#include "exceptions.h"

//
// These will be shared between Linux & Windows
//

#pragma pack(push)
#pragma pack(1)


typedef struct _UPDATE_FILE_HEADER
{
    DWORD Magic;                        

    struct
    {
        WORD Major;                     
        WORD Minor;                     
    } Version;

    DWORD KernelExceptionsCount;        
    DWORD UserExceptionsCount;          
    DWORD SignaturesCount;              

    DWORD BuildNumber;                  

    DWORD UserExceptionsGlobCount;      
    DWORD KernelUserExceptionsCount;    

    DWORD _Reserved[1];
} UPDATE_FILE_HEADER, *PUPDATE_FILE_HEADER;


typedef struct _UPDATE_HEADER
{
    BYTE    Type;                       
    WORD    Size;                       
} UPDATE_HEADER, *PUPDATE_HEADER;


typedef struct _UPDATE_KM_EXCEPTION
{
    struct
    {
        DWORD   NameHash;               
        DWORD   PathHash;               
    } Originator;

    DWORD       VictimNameHash;         

    DWORD       Flags;                  

    BYTE        _Reserved;              
    BYTE        Type;                   
    WORD        SigCount;               

    _Field_size_(SigCount)
    DWORD       SigIds[];               
} UPDATE_KM_EXCEPTION, *PUPDATE_KM_EXCEPTION;


typedef struct _UPDATE_UM_EXCEPTION
{
    DWORD       OriginatorNameHash;     

    struct
    {
        DWORD   NameHash;               
        DWORD   ProcessHash;            
    } Victim;

    DWORD       Flags;                  

    BYTE        _Reserved;              
    BYTE        Type;                   
    WORD        SigCount;               

    _Field_size_(SigCount)
    DWORD       SigIds[];               
} UPDATE_UM_EXCEPTION, *PUPDATE_UM_EXCEPTION;


typedef struct _UPDATE_UM_EXCEPTION_GLOB
{
    DWORD       Flags;

    BYTE        _Reserved;
    BYTE        Type;
    WORD        SigCount;

    CHAR        OriginatorNameGlob[EXCEPTION_UM_GLOB_LENGTH];

    struct
    {
        CHAR    NameGlob[EXCEPTION_UM_GLOB_LENGTH];
        CHAR    ProcessGlob[EXCEPTION_UM_GLOB_LENGTH];
    } Victim;

    _Field_size_(SigCount)
    DWORD       SigIds[];   
} UPDATE_UM_EXCEPTION_GLOB, *PUPDATE_UM_EXCEPTION_GLOB;


typedef struct _UPDATE_KUM_EXCEPTION
{
    union
    {
        DWORD       NameHash;                   
        DWORD       DriverHash;                 
        DWORD       ProcessHash;                
    } Originator;

    struct
    {
        DWORD   NameHash;               
        DWORD   ProcessHash;            
    } Victim;

    DWORD       Flags;                  

    BYTE        _Reserved;              
    BYTE        Type;                   
    WORD        SigCount;               

    _Field_size_(SigCount)
    DWORD       SigIds[];               
} UPDATE_KUM_EXCEPTION, *PUPDATE_KUM_EXCEPTION;


typedef struct _UPDATE_CB_HASH
{
    BYTE        Count;              

    _Field_size_(Count)
    DWORD       Hashes[];           
} UPDATE_CB_HASH, *PUPDATE_CB_HASH;


typedef struct _UPDATE_VALUE_HASH
{
    WORD            Offset;         
    WORD            Size;           
    BYTE            _Reserved[4];
    DWORD           Hash;           
} UPDATE_VALUE_HASH, *PUPDATE_VALUE_HASH;


typedef struct _UPDATE_EXPORT_HASH
{
    WORD            Delta;          
    BYTE            _Reserved[2];
    DWORD           Hash;           
} UPDATE_EXPORT_HASH, *PUPDATE_EXPORT_HASH;


typedef struct _UPDATE_CB_SIGNATURE
{
    DWORD       Id;                 
    DWORD       Flags;              

    BYTE        Score;              
    BYTE        ListsCount;         

    char        HashesList[];       
} UPDATE_CB_SIGNATURE, *PUPDATE_CB_SIGNATURE;


typedef struct _UPDATE_EXPORT_SIGNATURE
{
    DWORD       Id;                 
    DWORD       Flags;              

    DWORD       LibraryName;        

    BYTE        ListsCount;         
    BYTE        _Align[3];

    char        HashesList[];       
} UPDATE_EXPORT_SIGNATURE, *PUPDATE_EXPORT_SIGNATURE;


typedef struct _UPDATE_VALUE_SIGNATURE
{
    DWORD       Id;                 
    DWORD       Flags;              

    BYTE        Score;              
    BYTE        ListsCount;         
    BYTE        _Align[2];

    char        HashesList[];       
} UPDATE_VALUE_SIGNATURE, *PUPDATE_VALUE_SIGNATURE;


typedef struct _UPDATE_IDT_SIGNATURE
{
    DWORD       Id;                 
    DWORD       Flags;              

    BYTE        Entry;              
    BYTE        _Reserved[3];
} UPDATE_IDT_SIGNATURE, *PUPDATE_IDT_SIGNATURE;


typedef struct _UPDATE_VALUE_CODE_SIGNATURE
{
    DWORD       Id;                 
    DWORD       Flags;              

    INT16       Offset;             
    WORD        Length;             

    WORD        Pattern[];          
} UPDATE_VALUE_CODE_SIGNATURE, *PUPDATE_VALUE_CODE_SIGNATURE;


typedef struct _UPDATE_VERSION_OS_SIGNATURE
{
    DWORD       Id;                 
    DWORD       Flags;              

    union
    {
        struct
        {
            BYTE Version;
            BYTE Patch;
            WORD Sublevel;
            WORD Backport;
            BYTE _Reserved[2];
        };
        QWORD Value;
    } Minimum;

    union
    {
        struct
        {
            BYTE Version;
            BYTE Patch;
            WORD Sublevel;
            WORD Backport;
            BYTE _Reserved[2];
        };
        QWORD Value;
    } Maximum;

} UPDATE_VERSION_OS_SIGNATURE, *PUPDATE_VERSION_OS_SIGNATURE;


typedef struct _UPDATE_VERSION_INTRO_SIGNATURE
{
    DWORD       Id;             
    DWORD       Flags;          

    union
    {
        struct
        {
            WORD    Major;
            WORD    Minor;
            WORD    Revision;
            WORD    Build;
        };

        QWORD Raw;
    } Minimum;

    union
    {
        struct
        {
            WORD    Major;
            WORD    Minor;
            WORD    Revision;
            WORD    Build;
        };

        QWORD Raw;
    } Maximum;

} UPDATE_VERSION_INTRO_SIGNATURE, *PUPDATE_VERSION_INTRO_SIGNATURE;


typedef struct _UPDATE_PROCESS_CREATION_SIGNATURE
{
    DWORD       Id;             
    DWORD       Flags;          

    DWORD       CreateMask;     

    DWORD       _Reserved[3];

} UPDATE_PROCESS_CREATION_SIGNATURE, *PUPDATE_PROCESS_CREATION_SIGNATURE;

#pragma pack(pop)


#define UPDATE_MAGIC_WORD                           'ANXE'

#define UPDATE_TYPE_KM_EXCEPTION                    1
#define UPDATE_TYPE_UM_EXCEPTION                    2
#define UPDATE_TYPE_UM_EXCEPTION_GLOB_MATCH         6
#define UPDATE_TYPE_APC_UM_EXCEPTION                9

#define UPDATE_TYPE_CB_SIGNATURE                    3
#define UPDATE_TYPE_EXPORT_SIGNATURE                4
#define UPDATE_TYPE_VALUE_SIGNATURE                 5
#define UPDATE_TYPE_RESERVED                        7
#define UPDATE_TYPE_VALUE_CODE_SIGNATURE            8
#define UPDATE_TYPE_IDT_SIGNATURE                   10
#define UPDATE_TYPE_VERSION_OS_SIGNATURE            11
#define UPDATE_TYPE_VERSION_INTRO_SIGNATURE         12
#define UPDATE_TYPE_PROCESS_CREATION_SIGNATURE      13
#define UPDATE_TYPE_KUM_EXCEPTION                   14

#define UPDATE_EXCEPTIONS_MIN_VER_MAJOR             2
#define UPDATE_EXCEPTIONS_MIN_VER_MINOR             2


INTSTATUS
IntUpdateGetVersion(
    _Out_ WORD *MajorVersion,
    _Out_ WORD *MinorVersion,
    _Out_ DWORD *BuildNumber
    );

INTSTATUS
IntUpdateLoadExceptions(
    _In_ void *Buffer,
    _In_ DWORD Length,
    _In_ DWORD Flags
    );

INTSTATUS
IntUpdateAddExceptionFromAlert(
    _In_ const void *Event,
    _In_ INTRO_EVENT_TYPE Type,
    _In_ BOOLEAN Exception,
    _In_ QWORD Context
    );

INTSTATUS
IntUpdateFlushAlertExceptions(
    void
    );

INTSTATUS
IntUpdateRemoveException(
    _In_opt_ QWORD Context
    );

#endif // _UPDATE_EXCEPTIONS_H_