update_guests.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _UPDATE_GUESTS_H__
#define _UPDATE_GUESTS_H__



#include "introcore.h"

#define     MAX_VERSION_STRING_SIZE             64

#define     MAX_FUNCTION_NAME_SIZE              64

#define     CAMI_MAGIC_WORD                     'IMAC'

#define     CAMI_MAX_ENTRY_COUNT                0x4000

typedef enum _CAMI_SECTION_HINTS
{
    CAMI_SECTION_HINT_SUPPORTED_OS      = 0x0001,   
    CAMI_SECTION_HINT_SYSCALLS          = 0x0002,   
    CAMI_SECTION_HINT_DIST_SIG          = 0x0004,   
    CAMI_SECTION_HINT_PROT_OPTIONS      = 0x0008,   

    CAMI_SECTION_HINT_WINDOWS           = 0x0100,   
    CAMI_SECTION_HINT_LINUX             = 0x0200,   
} CAMI_SECTION_HINTS;

typedef enum CAMI_STRING_ENCODING
{
    CAMI_STRING_ENCODING_UTF8           = 0x0000,   
    CAMI_STRING_ENCODING_UTF16          = 0x0001,   
} CAMI_STRING_ENCODING;


#pragma pack(push)
#pragma pack(1)

#define UPDATE_CAMI_MIN_VER_MAJOR                        1
#define UPDATE_CAMI_MIN_VER_MINOR                        4

typedef struct _CAMI_VERSION
{
    DWORD Minor;                                    
    DWORD Major;                                    

    DWORD BuildNumber;                              
} CAMI_VERSION, *PCAMI_VERSION;

typedef struct _CAMI_HEADER
{
    DWORD Magic;                                    

    CAMI_VERSION Version;                           

    DWORD FileSize;
    DWORD NumberOfSections;                         
    DWORD PointerToSectionsHeaders;                 

} CAMI_HEADER, *PCAMI_HEADER;

typedef struct _CAMI_SECTION_HEADER
{
    DWORD Hint;                                     
    DWORD EntryCount;                               
    DWORD _Reserved;                                
    DWORD DescriptorTable;                          
} CAMI_SECTION_HEADER, *PCAMI_SECTION_HEADER;

typedef struct _CAMI_LIX_DESCRIPTOR
{
    CHAR    VersionString[MAX_VERSION_STRING_SIZE]; 

    QWORD   MinIntroVersion;                        
    QWORD   MaxIntroVersion;                        

    DWORD   StructuresCount;                        
    DWORD   StructuresTable;

    DWORD   HooksCount;                             
    DWORD   HooksTable;

    DWORD   CustomProtectionOffset;

    DWORD   _Reserved1;                             
    DWORD   _Reserved2;                             
    DWORD   _Reserved3;                             
} CAMI_LIX_DESCRIPTOR, *PCAMI_LIX_DESCRIPTOR;

typedef struct _CAMI_LIX_HOOK
{
    DWORD   NameHash;                               
    BYTE    HookHandler;                            
    BYTE    SkipOnBoot;                             
    WORD    _Reserved1;                             
    DWORD   _Reserved2;                             
} CAMI_LIX_HOOK, *PCAMI_LIX_HOOK;

typedef struct _CAMI_WIN_VERSION_STRING
{
    QWORD   VersionStringSize;                              
    CHAR    VersionString[MAX_VERSION_STRING_SIZE];         
    QWORD   ServerVersionStringSize;                        
    CHAR    ServerVersionString[MAX_VERSION_STRING_SIZE];   
} CAMI_WIN_VERSION_STRING, *PCAMI_WIN_VERSION_STRING;

typedef struct _CAMI_WIN_DESCRIPTOR
{
    DWORD   BuildNumber;                             
    BOOLEAN Kpti;                                    
    BOOLEAN Is64;                                    

    WORD    _Reserved1;                              

    QWORD   MinIntroVersion;                         
    QWORD   MaxIntroVersion;                         

    DWORD   KmStructuresCount;                       
    DWORD   KmStructuresTable;

    DWORD   UmStructuresCount;                       
    DWORD   UmStructuresTable;

    DWORD   FunctionCount;                           
    DWORD   FunctionTable;

    DWORD   CustomProtectionOffset;

    DWORD   VersionStringOffset;
    DWORD   _Reserved3;                              
    DWORD   _Reserved4;                              
} CAMI_WIN_DESCRIPTOR, *PCAMI_WIN_DESCRIPTOR;

typedef struct _CAMI_WIN_FUNCTION
{
    DWORD   NameHash;                               

    DWORD   PatternsCount;                          
    DWORD   PatternsTable;

    DWORD   ArgumentsCount;                         
    DWORD   ArgumentsTable;                         

    QWORD   _Reserved1;                             
    DWORD   _Reserved2;                             
    DWORD   _Reserved3;                             
} CAMI_WIN_FUNCTION, *PCAMI_WIN_FUNCTION;

typedef struct _CAMI_WIN_FUNCTION_PATTERN_EXTENSION
{
    DWORD   ArgumentsCount;                         
    DWORD   ArgumentsTable;                         

    QWORD   _Reserved1;                             
    QWORD   _Reserved2;                             
    QWORD   _Reserved3;                             
    QWORD   _Reserved4;                             
} CAMI_WIN_FUNCTION_PATTERN_EXTENSION, *PCAMI_WIN_FUNCTION_PATTERN_EXTENSION;

typedef struct _CAMI_WIN_FUNCTION_PATTERN
{
    BYTE    SectionHint[8];                         
    DWORD   HashLength;                             
    DWORD   HashOffset;                             

    DWORD   _Reserved1;                             
    DWORD   Extended;                               
} CAMI_WIN_FUNCTION_PATTERN, *PCAMI_WIN_FUNCTION_PATTERN;

typedef struct _CAMI_PATTERN_SIGNATURE
{
    DWORD       SignatureId;                        
    DWORD       Offset;                             
    DWORD       Flags;                              
    WORD        _Reserved;
    WORD        PatternLength;                      
    DWORD       PatternOffset;                      

    DWORD       _Reserved1;                         
    QWORD       _Reserved2;                         
} CAMI_PATTERN_SIGNATURE, *PCAMI_PATTERN_SIGNATURE;

typedef struct _CAMI_OPAQUE_STRUCTURE
{
    DWORD   Members;
    DWORD   MembersCount;                           
} CAMI_OPAQUE_STRUCTURE, *PCAMI_OPAQUE_STRUCTURE;

typedef struct _CAMI_PROT_OPTIONS
{
    QWORD   ForceOff;                               
    QWORD   ForceBeta;                              
    QWORD   ForceFeedback;                          
    QWORD   ForceOn;                                
    DWORD  _Reserved2;                              
    DWORD  _Reserved3;                              
} CAMI_PROT_OPTIONS;

typedef struct _CAMI_PROC_PROT_OPTIONS
{
    union
    {
        WCHAR    Name16[32];                        
        CHAR     Name8[64];                         
    };

    DWORD    OptionsOffset;                         
    DWORD    Encoding;                              

    QWORD   _Reserved1;                             
    DWORD   _Reserved2;                             
    DWORD   _Reserved3;                             

} CAMI_PROC_PROT_OPTIONS;

typedef struct _CAMI_CUSTOM_OS_PROTECTION
{
    DWORD CoreOptionsOffset;    
    DWORD ProcOptionsCount;     
    DWORD ProcOptionsTable;     
    DWORD ShemuOptionsOffset;   
    QWORD _Reserved2;           
} CAMI_CUSTOM_OS_PROTECTION;

#pragma pack(pop)

INTSTATUS
IntCamiLoadSection(
    _In_ DWORD CamiSectionHint
    );

INTSTATUS
IntCamiSetUpdateBuffer(
    _In_ const BYTE *UpdateBuffer,
    _In_ DWORD BufferLength
    );

INTSTATUS
IntCamiGetVersion(
    _Out_ DWORD *MajorVersion,
    _Out_ DWORD *MinorVersion,
    _Out_ DWORD *BuildNumber
    );

INTSTATUS
IntCamiGetWinSupportedList(
    _In_ BOOLEAN KptiInstalled,
    _In_ BOOLEAN Guest64,
    _Out_opt_ DWORD *NtBuildNumberList,
    _Inout_ DWORD *Count
    );

void
IntCamiClearUpdateBuffer(
    void
    );

INTSTATUS
IntCamiProtectedProcessAllocate(
    _In_ DWORD Items
    );

INTSTATUS
IntCamiProtectedProcessFree(
    void
    );

INTSTATUS
IntCamiUpdateProcessProtectionInfo(
    _In_ void *ProtectedProcess
    );

#endif // !_UPDATE_GUESTS_H__