vasmonitor.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _VASMONITOR_H_
#define _VASMONITOR_H_

#include "hook_ptwh.h"


typedef INTSTATUS
(*PFUNC_VaSpaceModificationCallback)(
    _In_ void *Context,
    _In_ QWORD VirtualAddress,
    _In_ QWORD OldEntry,
    _In_ QWORD NewEntry,
    _In_ QWORD PageSize
    );


#define VAS_COMPUTE_GLA_64(Base, Index, Level)      (PAGE_SX((Base) | ((QWORD)(Index) << ((((Level) - 1) * 9) + 12))))
#define VAS_COMPUTE_GLA_PAE(Base, Index, Level)     ((Base) | ((QWORD)(Index) << ((((Level) - 1) * 9) + 12)))
#define VAS_COMPUTE_GLA_32(Base, Index, Level)      ((Base) | ((QWORD)(Index) << ((((Level) - 1) * 10) + 12)))

#define VAS_COMPUTE_GLA(Base, Index, Level, Pg)     (                           \
        (Pg) == PAGING_5_LEVEL_MODE ? VAS_COMPUTE_GLA_64((Base), (Index), (Level)) : \
        (Pg) == PAGING_4_LEVEL_MODE ? VAS_COMPUTE_GLA_64((Base), (Index), (Level)) : \
        (Pg) == PAGING_PAE_MODE ? VAS_COMPUTE_GLA_PAE((Base), (Index), (Level)) : \
        (Pg) == PAGING_NORMAL_MODE ? VAS_COMPUTE_GLA_32((Base), (Index), (Level)) : 0 \
    )

#define VAS_TRANSITIONS_THRESHOLD       64
#define VAS_TOTAL_WRITES_THESHOLD       4096


typedef struct _VAS_TABLE_ENTRY
{
    HOOK_PTEWS          WriteState;     
} VAS_TABLE_ENTRY, *PVAS_TABLE_ENTRY;


typedef struct _VAS_TABLE
{
    struct _VAS_ROOT    *Root;          
    void                *WriteHook;     
    PVAS_TABLE_ENTRY    Entries;        
    struct _VAS_TABLE   **Tables;       
    QWORD               LinearAddress;  
    DWORD               WriteCount;     
    WORD                EntriesCount;
    BYTE                Level;          
    BYTE                PagingMode;     
} VAS_TABLE, *PVAS_TABLE;


typedef struct _VAS_ROOT
{
    LIST_ENTRY          Link;           
    QWORD               Cr3;            
    void                *Context;       
    QWORD               MonitoredBits;  
    PFUNC_VaSpaceModificationCallback Callback; 
    PVAS_TABLE          Table;
} VAS_ROOT, *PVAS_ROOT;



//
// API
//
INTSTATUS
IntVasStartMonitorVaSpace(
    _In_ QWORD Cr3,
    _In_ PFUNC_VaSpaceModificationCallback Callback,
    _In_ void *Context,
    _In_ QWORD MonitoredBits,
    _Out_ void **Root
    );

INTSTATUS
IntVasStopMonitorVaSpace(
    _In_opt_ QWORD Cr3,
    _In_opt_ PVAS_ROOT Root
    );

INTSTATUS
IntVasDump(
    _In_ QWORD Cr3
    );

INTSTATUS
IntVasInit(
    void
    );

INTSTATUS
IntVasUnInit(
    void
    );


#endif // _VASMONITOR_H_