winagent.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _WIN_AGENT_H_
#define _WIN_AGENT_H_

#include "aghcall.h"
#include "agent.h"

#define MAX_BOOTSTRAP_SIZE          512u

#define AG_OPT_INJECT_ON_RIP_POWSTATE_CHANGE      0x00000001


typedef INTSTATUS
(*PFUNC_AgentInjection)(
    _In_ QWORD GuestVirtualAddress,
    _In_ DWORD AgentTag,
    _In_opt_ void *Context
    );


typedef INTSTATUS
(*PFUNC_AgentCompletion)(
    _In_ QWORD GuestVirtualAddress,
    _In_ DWORD ErrorCode,
    _In_ DWORD AgentTag,
    _In_opt_ void *Context
    );


typedef QWORD
(*PFUNC_AgentDeliver)(
    _In_ QWORD GuestVirtualAddress,
    _In_ DWORD MaxSize,
    _In_opt_ void *Context
    );


typedef enum _AGENT_HCALL
{
    AGENT_HCALL_VMCALL,     
    AGENT_HCALL_INT3,       
} AGENT_HCALL;



typedef struct _WIN_AGENT
{
    LIST_ENTRY  Link;                               

    AGENT_TYPE  AgentType;                          
    AGENT_HCALL HcallType;                          

    PFUNC_AgentInjection    InjectionCallback;      
    PFUNC_AgentDeliver      DeliverCallback;        
    PFUNC_AgentCompletion   CompletionCallback;     
    void       *Context;                            

    // Bootstrap related.
    QWORD       BootstrapAddress;                   
    DWORD       BootstrapSize;                      

    // Driver related.
    QWORD       DriverAddress;                      
    DWORD       DriverSize;                         
    DWORD       DriverEntryPoint;                   

    DWORD       AgentTag;                           
    DWORD       Flags;                              

    QWORD       Token1;                             
    QWORD       Token2;                             
    QWORD       Token3;                             

    void        *InsCloakRegion;                    
    void        *BootCloakRegion;                   

    BYTE        InstructionBytes[16];               
    BYTE        InstructionLen;                     
    BOOLEAN     InstructionRestored;                
    QWORD       InstructionAddress;                 

    // Agent related.
    PBYTE       AgentContent;                       
    DWORD       AgentSize;                          
    DWORD       AgentPosition;
    BOOLEAN     AgentInternal;                      

    DWORD       Agid;                               
    DWORD       ErrorCode;                          
    DWORD       Pid;
    SIZE_T      ArgsLen;                            
    CHAR        Args[IG_MAX_COMMAND_LINE_LENGTH];   

    CHAR        Name[IG_MAX_AGENT_NAME_LENGTH];     

    WORD        OffsetJumpBack;

    BYTE        BootStrap[MAX_BOOTSTRAP_SIZE];      

    DWORD       Options;                            

} WIN_AGENT, *PWIN_AGENT;


//
// API
//
BOOLEAN
IntWinAgentIsRipInsideCurrentAgent(
    _In_ QWORD Rip
    );

INTSTATUS
IntWinAgentHandleVmcall(
    _In_ QWORD Rip
    );

INTSTATUS
IntWinAgentHandleInt3(
    _In_ QWORD Rip,
    _In_ DWORD CpuNumber
    );

INTSTATUS
IntWinAgentInject(
    _In_ PFUNC_AgentInjection InjectionCallback,
    _In_ PFUNC_AgentCompletion CompletionCallback,
    _In_opt_ PFUNC_AgentDeliver DeliverCallback,
    _In_opt_ void *Context,
    _In_ PBYTE AgentContent,
    _In_ DWORD AgentSize,
    _In_ BOOLEAN AgentInternal,
    _In_ DWORD AgentTag,
    _In_ AGENT_TYPE AgentType,
    _In_opt_z_ const CHAR *Name,
    _In_ DWORD Options,
    _In_opt_ const CHAR *Args,
    _In_opt_ DWORD Pid,
    _Outptr_opt_ PWIN_AGENT *Agent
    );

INTSTATUS
IntWinAgentInjectBreakpoint(
    _In_ PFUNC_AgentInjection InjectionCallback,
    _In_opt_ void *Context,
    _Outptr_opt_ PWIN_AGENT *Agent
    );

INTSTATUS
IntWinAgentInjectTrampoline(
    void
    );

INTSTATUS
IntWinAgentEnableInjection(
    void
    );

void
IntWinAgentCheckIfProcessAgentAndIncrement(
    _In_ CHAR *ImageName,
    _Out_ BOOLEAN *IsAgent,
    _Out_ DWORD *Tag
    );

void
IntWinAgentCheckIfProcessAgentAndDecrement(
    _In_ CHAR *ImageName,
    _Out_opt_ BOOLEAN *IsAgent,
    _Out_opt_ DWORD *Tag,
    _Out_opt_ BOOLEAN *Removed
    );

void
IntWinAgentRemoveEntryByAgid(
    _In_ DWORD Counter,
    _Out_opt_ DWORD *Tag
    );

void
IntWinAgentDisablePendingAgents(
    void
    );

BOOLEAN
IntWinAgentIsPtrInTrampoline(
    _In_ QWORD Ptr,
    _In_ THS_PTR_TYPE Type
    );

AG_WAITSTATE
IntWinAgentGetState(
    _Out_opt_ DWORD *Tag
    );

INTSTATUS
IntWinAgentActivatePendingAgent(
    void
    );

void
IntWinAgentInit(
    void
    );

INTSTATUS
IntWinAgentUnInit(
    void
    );

#endif // _WIN_AGENT_H_