vecommon.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _VECOMMON_H_
#define _VECOMMON_H_



#define VE_VMCALL_OP                0x22
#define VE_VMCALL_SUBOP             0x18


#define VE_HCALL_NOP                0

#define VE_HCALL_BREAK              1

#define VE_HCALL_TRACE              2

#define VE_HCALL_RAISE_EPT          3



#pragma pack(push)
#pragma pack(1)


typedef struct _REGISTERS
{
    QWORD       RAX;            // Offset 0x30
    QWORD       RCX;            // Offset 0x38
    QWORD       RDX;            // Offset 0x40
    QWORD       RBX;            // Offset 0x48
    QWORD       RSP;            // Offset 0x50
    QWORD       RBP;            // Offset 0x58
    QWORD       RSI;            // Offset 0x60
    QWORD       RDI;            // Offset 0x68
    QWORD       R8;             // Offset 0x70
    QWORD       R9;             // Offset 0x78
    QWORD       R10;            // Offset 0x80
    QWORD       R11;            // Offset 0x88
    QWORD       R12;            // Offset 0x90
    QWORD       R13;            // Offset 0x98
    QWORD       R14;            // Offset 0xA0
    QWORD       R15;            // Offset 0xA8
    QWORD       RIP;            // Offset 0xB0
    QWORD       CS;             // Offset 0xB8
    QWORD       RFLAGS;         // Offset 0xC0
    QWORD       CR0;            // Offset 0xC8
    QWORD       CR3;            // Offset 0xD0
    QWORD       CR4;            // Offset 0xD8
    QWORD       DR7;            // Offset 0xE0
    QWORD       SS;             // Offset 0xE8
    QWORD       MXCSR;          // Offset 0xF0
    QWORD       Reserved2;      // Offset 0xF8
    BYTE        XMM[256];       // Offset 0x100-0x200

} REGISTERS, *PREGISTERS;


typedef struct _VECPU
{
    // #VE information area.
    DWORD           Reason;                 
    DWORD           Reserved;               
    QWORD           Qualification;          
    QWORD           GuestLinearAddress;     
    QWORD           GuestPhysicalAddress;   
    QWORD           EptpIndex;              
    QWORD           Reserved2;              

    REGISTERS       Registers;              

    PBYTE           ProtectedStack;         
    PBYTE           OriginalStack;          

    QWORD           OldValue;               
    QWORD           NewValue;               

    QWORD           VeTotal;                
    QWORD           VeMm;                   
    QWORD           VePageWalk;             
    QWORD           VeIgnoredTotal;         
    QWORD           VeIgnoredCache;         
    QWORD           VeIgnoredIrrelevant;    
    
    QWORD           TscTotal;               
    QWORD           TscCount;               

    // fetched instruction bytes.
    BYTE            Instruction[16];        

    QWORD           Self;                   
    QWORD           Index;                  

    BOOLEAN         Raised;                 

} VECPU, *PVECPU;

#pragma pack(pop)

#define VE_STACK_SIZE       0x4000

#define VE_MAX_CPUS         64


typedef union _VECPU_PAGE
{
    VECPU           Cpu;                    
    BYTE            Page[0x1000];           
} VECPU_PAGE, *PVECPU_PAGE;


typedef struct _VE_STACK
{
    BYTE        Stack[VE_STACK_SIZE];       
} VE_STACK, *PVE_STACK;



#define VE_CACHE_LINES      64
#define VE_CACHE_BUCKETS    64
#define VE_CACHE_ENTRIES    8

#define VE_CACHE_GET_LINE(x)        (((x) >> 12) & (VE_CACHE_LINES - 1))
#define VE_CACHE_GET_BUCKET(x)      (((x) >> 3) & (VE_CACHE_BUCKETS - 1))

typedef struct _VE_CACHE_LINE
{
    QWORD       Entries[VE_CACHE_BUCKETS][VE_CACHE_ENTRIES]; 
} VE_CACHE_LINE;


typedef unsigned int VESTATUS;

#define VE_STATUS_SUCCESS               0x00000000
#define VE_STATUS_ERROR                 0x80000000
#define VE_STATUS_NOT_SUPPORTED         0x80000001
#define VE_STATUS_DISASM_ERROR          0x80000002
#define VE_STATUS_PAGE_NOT_PRESENT      0x80000003
#define VE_STATUS_ACCESS_DENIED         0x80000004

#define VE_SUCCESS(s)                   ((s) < VE_STATUS_ERROR)

#define VE_BREAK_UNKNOWN_EXIT           0x00000001
#define VE_BREAK_PAGE_WALK_FAILED       0x00000002
#define VE_BREAK_EMULATION_FAILED       0x00000003
#define VE_BREAK_CS_NOT_KERNEL          0x00000004


#endif // _VECOMMON_H_