27 #define BUGCHECK_NAME(x) case(x): return &(#x[9]) 71 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xa--irql-not-less-or-equal";
73 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x19--bad-pool-header";
75 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x1a--memory-management";
77 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x1e--kmode-exception-not-handled";
79 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x3b--system-service-exception";
81 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x4e--pfn-list-corrupt";
83 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x50--page-fault-in-nonpaged-area";
85 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x60--process-initialization-failed";
87 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x77--kernel-stack-inpage-error";
89 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x7a--kernel-data-inpage-error";
91 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x7b--inaccessible-boot-device";
93 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x7e--system-thread-exception-not-handled";
95 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x7f--unexpected-kernel-mode-trap";
97 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x8e--kernel-mode-exception-not-handled";
99 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0xef--critical-process-died";
101 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-0x109---critical-structure-corruption";
103 return "https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2";
131 NLOG(
"Bugcheck 0x%llx - %s\n" 132 "Parameter 1: 0x%016llx\n" 133 "Parameter 2: 0x%016llx\n" 134 "Parameter 3: 0x%016llx\n" 135 "Parameter 4: 0x%016llx\n" 136 "See the online documentation at %s for details\n",
137 Reason, name, Param1, Param2, Param3, Param4, link);
163 ERROR(
"[ERROR] IntDecDecodeInstruction failed for instruction at 0x%016llx: 0x%08x\n", Rip, status);
170 ERROR(
"[ERROR] IntDriverFindByAddress failed: 0x%016llx", Rip);
176 NLOG(
"\n%s:\n", Message);
199 NLOG(
"\nGuest registers on the CPU that caused the bugcheck (%d):\n",
gVcpu->
Index);
203 LOG(
"CR0 = 0x%016llx CR2 = 0x%016llx CR3 = 0x%016llx CR4 = 0x%016llx CR8 = 0x%016llx\n",
205 LOG(
"FLG = 0x%016llx DR7 = 0x%016llx\n", pRegs->
Flags, pRegs->
Dr7);
211 LOG(
"CS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
213 LOG(
"SS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
215 LOG(
"DS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
217 LOG(
"ES = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
219 LOG(
"FS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
221 LOG(
"GS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
237 NLOG(
"\nGuest registers on the CPU %d:\n", v->
Index);
241 LOG(
"CR0 = 0x%016llx CR2 = 0x%016llx CR3 = 0x%016llx CR4 = 0x%016llx CR8 = 0x%016llx\n",
243 LOG(
"FLG = 0x%016llx DR7 = 0x%016llx\n", pRegs->
Flags, pRegs->
Dr7);
249 LOG(
"CS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
251 LOG(
"SS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
253 LOG(
"DS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
255 LOG(
"ES = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
257 LOG(
"FS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
259 LOG(
"GS = 0x%02llx Base = 0x%016llx Limit = 0x%016llx Ar = 0x%08llx\n",
278 NLOG(
"\nPROCESS INFORMATION\n" 281 "Eprocess: 0x%016llx\n" 282 "Parent: 0x%016llx\n" 283 "Real parent: 0x%016llx\n" 284 "Creation time: 0x%016llx\n" 285 "Cr3/User Cr3: 0x%016llx/0x%016llx\n" 287 "Token: 0x%016llx\n",
332 NLOG(
"\nVA TRANSLATION\n");
333 NLOG(
"Virtual Address: 0x%016llx\nPhysical Address: 0x%016llx\nEntries mappings:\n",
356 NLOG(
"%s %s %s %s %s %s %s %s %s\n",
357 (efl.
IOPL ?
"iopl=1 " :
"iopl=0 "),
358 (efl.
OF ?
"ov" :
"nv"),
359 (efl.
DF ?
"dn" :
"up"),
360 (efl.
IF ?
"ei" :
"di"),
361 (efl.
SF ?
"ng" :
"pl"),
362 (efl.
ZF ?
"zr" :
"nr"),
363 (efl.
AF ?
"ac" :
"na"),
364 (efl.
PF ?
"pe" :
"po"),
365 (efl.
CF ?
"cy" :
"nc"));
382 #define MODULE_NAMES_TO_PRINT 64 383 #define TRACE_LIMIT_X64 0x2000 384 #define TRACE_LIMIT_X86 0x2000 390 QWORD writtenModules = 0;
394 NLOG(
"\n%s\n", Message);
410 for (
size_t i = 1; i < limit; i++)
446 #undef MODULE_NAMES_TO_PRINT 447 #undef TRACE_LIMIT_X64 448 #undef TRACE_LIMIT_X86 467 NLOG(
"\nTrap Frame at 0x%016llx:\n", TrapFrame);
471 ERROR(
"[ERROR] IntKernVirtMemRead failed at 0x%016llx: 0x%08x\n", TrapFrame, status);
475 NLOG(
"rax = %016llx rbx = %016llx rcx = %016llx\n" 476 "rdx = %016llx rsi = %016llx rdi = %016llx\n" 477 "rip = %016llx rsp = %016llx rbp = %016llx\n" 478 " r8 = %016llx r9 = %016llx r10 = %016llx\n" 479 "r11 = %016llx r12 = %016llx r13 = %016llx\n" 480 "r14 = %016llx r15 = %016llx\n" 482 trapStructure.
Rax, trapStructure.
Rbx, trapStructure.
Rcx,
483 trapStructure.
Rdx, trapStructure.
Rsi, trapStructure.
Rdi,
484 trapStructure.
Rip, trapStructure.
Rsp, trapStructure.
Rbp,
485 trapStructure.
R8, trapStructure.
R9, trapStructure.
R10,
486 trapStructure.
R11, 0ull, 0ull, 0ull, 0ull,
497 KTSS ktssStructure = {0};
499 NLOG(
"\nKTSS at %08llx:\n", TrapFrame);
504 ERROR(
"[ERROR] IntKernVirtMemRead failed at 0x%016llx: 0x%08x\n", TrapFrame, status);
508 NLOG(
"eax = 0x%08x ebx = 0x%08x ecx = 0x%08x\n" 509 "edx = 0x%08x esi = 0x%08x edi = 0x%08x\n" 510 "eip = 0x%08x esp = 0x%08x ebp = 0x%08x\n" 511 "cs = %04x ss = %04x ds = %04x es = %04x fs = %04x gs = %04x efl=0x%08x\n",
512 ktssStructure.
Eax, ktssStructure.
Ebx, ktssStructure.
Ecx, ktssStructure.
Edx, ktssStructure.
Esi,
513 ktssStructure.
Edi, ktssStructure.
Eip, ktssStructure.
Esp, ktssStructure.
Ebp, ktssStructure.
Cs,
514 ktssStructure.
Ss, ktssStructure.
Ds, ktssStructure.
Es, ktssStructure.
Fs, ktssStructure.
Gs,
540 NLOG(
"\nContext Record at 0x%016llx:\n", ContextRecord);
542 status =
IntKernVirtMemRead(ContextRecord,
sizeof(contextStructure), &contextStructure, NULL);
545 ERROR(
"[ERROR] IntKernVirtMemRead failed at 0x%016llx: 0x%08x\n", ContextRecord, status);
549 NLOG(
"rax = 0x%016llx rbx = 0x%016llx rcx = 0x%016llx\n" 550 "rdx = 0x%016llx rsi = 0x%016llx rdi = 0x%016llx\n" 551 "rip = 0x%016llx rsp = 0x%016llx rbp = 0x%016llx\n" 552 " r8 = 0x%016llx r9 = 0x%016llx r10 = 0x%016llx\n" 553 "r11 = 0x%016llx r12 = 0x%016llx r13 = 0x%016llx\n" 554 "r14 = 0x%016llx r15 = 0x%016llx\n" 555 "cs = 0x%04x ss = 0x%04x ds = 0x%04x es = 0x%04x fs = 0x%04x gs = 0x%04x efl = 0x%08x\n",
556 contextStructure.
Rax, contextStructure.
Rbx, contextStructure.
Rcx,
557 contextStructure.
Rdx, contextStructure.
Rsi, contextStructure.
Rdi,
558 contextStructure.
Rip, contextStructure.
Rsp, contextStructure.
Rbp,
559 contextStructure.
R8, contextStructure.
R9, contextStructure.
R10,
560 contextStructure.
R11, contextStructure.
R12, contextStructure.
R13,
561 contextStructure.
R14, contextStructure.
R15, contextStructure.
SegCs,
562 contextStructure.
SegSs, contextStructure.
SegDs, contextStructure.
SegEs,
573 NLOG(
"\nContext Record at %08llx:\n", ContextRecord);
575 status =
IntKernVirtMemRead(ContextRecord,
sizeof(contextStructure), &contextStructure, NULL);
578 ERROR(
"[ERROR] IntKernVirtMemRead failed at 0x%016llx: 0x%08x\n", ContextRecord, status);
582 NLOG(
"eax = 0x%08x ebx = 0x%08x ecx = 0x%08x edx = 0x%08x esi = 0x%08x edi = 0x%08x\n" 583 "eip = 0x%08x esp = 0x%08x ebp = 0x%08x\n" 584 "cs = 0x%04x ss = 0x%04x ds = 0x%04x es = 0x%04x fs = 0x%04x gs = 0x%04x efl = %08x\n",
585 contextStructure.
Eax, contextStructure.
Ebx, contextStructure.
Ecx,
586 contextStructure.
Edx, contextStructure.
Esi, contextStructure.
Edi,
587 contextStructure.
Eip, contextStructure.
Esp, contextStructure.
Ebp,
588 contextStructure.
SegCs, contextStructure.
SegSs, contextStructure.
SegDs,
589 contextStructure.
SegEs, contextStructure.
SegFs,
613 NLOG(
"\nException Record at 0x%016llx:\n", ExceptionRecord);
615 status =
IntKernVirtMemRead(ExceptionRecord,
sizeof(excpStructure), &excpStructure, NULL);
618 ERROR(
"[ERROR] IntKernVirtMemRead failed at 0x%016llx: 0x%08x\n", ExceptionRecord, status);
622 NLOG(
"Exception address: 0x%016llx\n" 623 "Exception Code: 0x%08x\n" 624 "ExceptionFlags: 0x%08x\n" 625 "NumberParameters: 0x%x\n",
641 NLOG(
"\nException Record at %08llx:\n", ExceptionRecord);
643 status =
IntKernVirtMemRead(ExceptionRecord,
sizeof(excpStructure), &excpStructure, NULL);
646 ERROR(
"[ERROR] IntKernVirtMemRead failed at 0x%016llx: 0x%08x\n", ExceptionRecord, status);
650 NLOG(
"Exception address: %08x\n" 651 "Exception Code: 0x%08x\n" 652 "ExceptionFlags: 0x%08x\n" 653 "NumberParameters: 0x%x\n",
680 const CHAR *objectType =
"<unknown>";
684 objectType =
"process";
686 else if (Param2 == 1)
688 objectType =
"thread";
691 LOG(
"A %s object has died!\n", objectType);
694 NLOG(
"\tProcess name: \"%s\" PID: %u Eprocess: 0x%016llx Cr3: 0x%016llx User Cr3: 0x%016llx Protected: %u\n",
699 NLOG(
"\tNo process found for Eprocess 0x%016llx\n", Param1);
720 QWORD regionType = Param4;
721 const PCHAR regions[] =
723 "A generic data region",
724 "Modification of a function or .pdata",
727 "Type 1 process list corruption",
728 "Type 2 process list corruption",
729 "Debug routine modification",
730 "Critical MSR modification",
733 "Modification of a system service function",
734 "A generic session data region",
735 "Modification of a session function or .pdata",
736 "Modification of an import table",
737 "Modification of a session import table",
738 "Ps Win32 callout modification",
739 "Debug switch routine modification",
740 "IRP allocator modification",
741 "Driver call dispatcher modification",
742 "IRP completion dispatcher modification",
743 "IRP deallocator modification",
744 "A processor control register",
745 "Critical floating point control register modification",
746 "Local APIC modification",
747 "Kernel notification callout modification",
748 "Loaded module list modification",
749 "Type 3 process list corruption",
750 "Type 4 process list corruption",
751 "Driver object corruption",
752 "Executive callback object modification",
753 "Modification of module padding",
754 "Modification of a protected process",
755 "A generic data region",
756 "A page hash mismatch",
757 "A session page hash mismatch",
758 "Load config directory modification",
759 "Inverted function table modification",
760 "Session configuration modification",
761 "An extended processor control register",
762 "Type 1 pool corruption",
763 "Type 2 pool corruption",
764 "Type 3 pool corruption",
765 "Type 4 pool corruption",
766 "Modification of a function or .pdata",
767 "Image integrity corruption",
768 "Processor misconfiguration",
769 "Type 5 process list corruption",
770 "Process shadow corruption",
775 LOG(
"0x%04llx - %s\n", regionType, regions[regionType]);
777 else if (0x101 == regionType)
779 LOG(
"0x%04llx - %s\n", regionType,
"General pool corruption");
781 else if (0x102 == regionType)
783 LOG(
"0x%04llx - %s\n", regionType,
"Modification of win32k.sys");
787 LOG(
"0x%04llx - %s\n", regionType,
"Undocumented");
790 LOG(
"Dumping cloak regions\n");
823 NLOG(
"\n**********************************************************************\n" 825 "* Bugcheck Analysis *\n" 827 "**********************************************************************\n\n");
862 NLOG(
"Bug Check reason not known!\n");
868 LOG(
"Kernel loaded at 0x%016llx Version info: 0x%08x:0x%08llx\n",
911 memzero(pCrashEvent,
sizeof(*pCrashEvent));
913 pCrashEvent->
Reason = Reason;
914 pCrashEvent->
Param1 = Param1;
915 pCrashEvent->
Param2 = Param2;
916 pCrashEvent->
Param3 = Param3;
917 pCrashEvent->
Param4 = Param4;
924 WARNING(
"[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
933 _In_ void const *Detour
952 QWORD code, param1, param2, param3, param4;
980 LOG(
"[INFO] The guest has generated a bugcheck on CPU %d: 0x%08x 0x%016llx 0x%016llx 0x%016llx 0x%016llx\n",
991 ERROR(
"[ERROR] IntWinBcSendBsodEvent failed: 0x%08x\n", status);
TIMER_FRIENDLY void IntDumpArchRegs(IG_ARCH_REGS const *Registers)
This function dumps the register values in a user friendly format.
QWORD PhysicalAddress
The physical address to which VirtualAddress translates to.
DWORD Flags
Windows process flags (possible values for this bitmask are described below).
#define BUGCHECK_KMODE_EXCEPTION_NOT_HANDLED
static void IntLogTrapFrame(QWORD TrapFrame)
Logs information about a trap frame.
IG_ARCH_REGS Regs
The current state of the guest registers.
DWORD Index
The VCPU number.
static void IntLogCurrentIP(QWORD Rip, CHAR const *Message)
Logs information about the RIP at which the crash was triggered.
DWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]
QWORD RealParentEprocess
The active EPROCESS at the moment of creation.
QWORD SystemCr3
The Cr3 used to map the kernel.
#define INT_STATUS_SUCCESS
WIN_KERNEL_DRIVER Win
Valid only for Windows guests.
QWORD ExceptionAddress
The address at which the exception was generated.
DWORD ExceptionCode
The code generated by hardware, or the one used with RaiseException(), or DBG_CONTROL_C.
INTSTATUS IntGetGprs(DWORD CpuNumber, PIG_ARCH_REGS Regs)
Get the current guest GPR state.
#define BUGCHECK_KERNEL_MODE_EXCEPTION_NOT_HANDLED
static char const * IntGetBugCheckLink(QWORD Reason)
Returns the bug check documentation page link for a bug check reason.
static void IntLogStackTrace(QWORD Address, CHAR const *Message)
Attempts to log a guest stack trace.
QWORD BaseVa
The guest virtual address of the kernel module that owns this driver object.
QWORD Param3
Third parameter.
#define INT_SUCCESS(Status)
DWORD Raw
Raw register value.
Informational event sent when the guest crashes. See EVENT_CRASH_EVENT.
BOOLEAN KernelBetaDetections
True if the kernel protection is in beta (log-only) mode.
Holds segment register state.
#define INT_STATUS_NOT_NEEDED_HINT
#define BUGCHECK_MEMORY_MANAGEMENT
int INTSTATUS
The status data type.
QWORD Size
The size of the kernel module that owns this driver object.
#define BUGCHECK_SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
QWORD Peb64Address
PEB 64 address (on x86 OSes, this will be 0).
#define TRFLG_NONE
No special options.
QWORD Param1
First parameter.
PVCPU_STATE VcpuArray
Array of the VCPUs assigned to this guest. The index in this array matches the VCPU number...
#define BUGCHECK_PFN_LIST_CORRUPT
Event structure for guest OS crashes.
QWORD ParentEprocess
The EPROCESS of the parent process.
static char const * IntGetBugCheckName(QWORD Reason)
Returns a name for a bug check code.
DWORD Protected
TRUE if this is a protected process. If this is FALSE, most of the above fields aren't used at all...
DWORD TimeDateStamp
The driver`s internal timestamp (from the _IMAGE_FILE_HEADER).
#define BUGCHECK_SYSTEM_SERVICE_EXCEPTION
Describes a kernel driver.
static void IntWinDumpEflags(DWORD Eflags)
Logs the EFLAGS contents.
Context Frame for 32-bit guests.
QWORD Cr3
Process PDBR. Includes PCID.
DWORD MappingsCount
The number of entries inside the MappingsTrace and MappingsEntries arrays.
GENERIC_ALERT gAlert
Global alert buffer.
static void IntWinBcLogBsodEvent(QWORD Reason, QWORD Param1, QWORD Param2, QWORD Param3, QWORD Param4)
Logs a bug check event and related information about the crash and the kernel.
QWORD CreationTime
The creation time of the process, as stored inside the EPROCESS.
TIMER_FRIENDLY void IntDumpInstruction(INSTRUX *Instruction, QWORD Rip)
This function dumps a given instruction (textual disassembly).
WINUM_PATH * Path
Will point inside the loaded modules list to the full process path.
INTSTATUS IntKernVirtMemFetchDword(QWORD GuestVirtualAddress, DWORD *Data)
Reads 4 bytes from the guest kernel memory.
DWORD NumberParameters
The number of valid entries inside the ExceptionInformation array.
#define BUGCHECK_PROCESS_INITIALIZATION_FAILED
static void IntLogBSODParams(QWORD Reason, QWORD Param1, QWORD Param2, QWORD Param3, QWORD Param4)
Logs the bug check parameters.
INTSTATUS IntKernVirtMemFetchQword(QWORD GuestVirtualAddress, QWORD *Data)
Reads 8 bytes from the guest kernel memory.
static INTSTATUS IntWinBcSendBsodEvent(QWORD Reason, QWORD Param1, QWORD Param2, QWORD Param3, QWORD Param4)
Sends a introEventCrashEvent event.
QWORD MappingsEntries[MAX_TRANSLATION_DEPTH]
Contains the entry in which paging table.
INTSTATUS IntNotifyIntroEvent(INTRO_EVENT_TYPE EventClass, void *Param, size_t EventSize)
Notifies the integrator about an introspection alert.
INTRO_PROCESS CurrentProcess
The currently active process.
QWORD Reason
The bugcheck reason.
Information about Windows kernel crashes.
BOOLEAN Guest64
True if this is a 64-bit guest, False if it is a 32-bit guest.
CHAR Name[IMAGE_BASE_NAME_LEN]
Process base name.
QWORD Current
The currently used options.
The layout of the EFLAGS register.
An _EXCEPTION_RECORD structure used by 64-bit guests.
QWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]
Exception-dependent parameters.
QWORD UserCr3
Process user PDBR. Includes PCID.
Structure encapsulating VCPU-specific information.
#define IS_KERNEL_POINTER_WIN(is64, p)
Checks if a guest virtual address resides inside the Windows kernel address space.
INTSTATUS IntWinBcHandleBugCheck(void const *Detour)
Handles a Windows OS crash.This is the detour handle for the KeBugCheck2 32-bit Windows kernel API an...
PWIN_PROCESS_OBJECT IntWinProcFindObjectByCr3(QWORD Cr3)
Finds a process by its kernel CR3.
DWORD ExitStatus
The exit status of the process (used when sending the process terminated event).
static void IntWinLogVAInfo(QWORD Va)
Logs information about a guest virtual address translation.
void * Name
The name of the driver.
void IntAlertFillWinProcessCurrent(INTRO_PROCESS *EventProcess)
Saves information about the current Windows process inside an alert.
INTSTATUS IntTranslateVirtualAddressEx(QWORD Gva, QWORD Cr3, DWORD Flags, VA_TRANSLATION *Translation)
Translates a guest virtual address to a guest physical address.
#define BUGCHECK_CRITICAL_PROCESS_DIED
#define BUGCHECK_INACCESSIBLE_BOOT_DEVICE
DWORD Pid
Process ID (the one used by Windows).
DWORD CpuCount
The number of logical CPUs.
void IntMemClkDump(void)
Dumps all the active cloak regions.
QWORD Peb32Address
PEB 32 address (on pure x64 processes, this will be 0).
#define BUGCHECK_KERNEL_STACK_INPAGE_ERROR
TIMER_FRIENDLY void IntDumpGvaEx(QWORD Gva, DWORD Length, QWORD Cr3, DWORD RowLength, DWORD ElementLength, BOOLEAN LogHeader, BOOLEAN DumpAscii)
This function dumps a given GVA in a user friendly format. This function uses IntDumpBuffer to perfor...
#define BUGCHECK_PAGE_FAULT_IN_NONPAGED_AREA
QWORD OriginalTokenPtr
Original Token pointer inside EPROCESS (should never change).
static void IntLogExceptionRecord(QWORD ExceptionRecord)
Logs information about an exception record.
MM Mm
Guest memory information, such as paging mode, system Cr3 value, etc.
QWORD EprocessAddress
This will be the address of the ActiveProcess field.
GUEST_STATE gGuest
The current guest state.
#define BUGCHECK_KERNEL_DATA_INPAGE_ERROR
#define INTRO_OPT_EVENT_OS_CRASH
Enable OS crash events (generates introEventCrashEvent events).
QWORD Param4
Fourth parameter.
PWIN_PROCESS_OBJECT IntWinProcFindObjectByEprocess(QWORD Eprocess)
Finds a process by the address of its _EPROCESS structure.
QWORD VirtualAddress
The translated virtual address.
INTSTATUS IntKernVirtMemRead(QWORD KernelGva, DWORD Length, void *Buffer, DWORD *RetLength)
Reads data from a guest kernel virtual memory range.
KERNEL_DRIVER * IntDriverFindByAddress(QWORD Gva)
Returns the driver in which Gva resides.
#define BUGCHECK_UNEXPECTED_KERNEL_MODE_TRAP
#define BUGCHEDCK_CRITICAL_STRUCTURE_CORRUPTION
Encapsulates information about a virtual to physical memory translation.
KERNEL_DRIVER * KernelDriver
Points to the driver object that describes the kernel image.
char * utf16_for_log(const WCHAR *WString)
Converts a UTF-16 to a UTF-8 string to be used inside logging macros.
#define INT_STATUS_INVALID_PARAMETER_1
VCPU_STATE * gVcpu
The state of the current VCPU.
#define MODULE_NAMES_TO_PRINT
static void IntLogGuestRegisters(void)
Logs the guest register state.
static void IntLogProcessInfo(void)
Logs information about the current process.
static void IntLogCriticalProcessHasDied(QWORD Param1, QWORD Param2)
Handles a BUGCHECK_CRITICAL_PROCESS_DIED bug check.
static void IntLogCriticalStructureCoruption(QWORD Param3, QWORD Param4)
Handles a BUGCHEDCK_CRITICAL_STRUCTURE_CORRUPTION bug check.
INTSTATUS IntGetSegs(DWORD CpuNumber, PIG_SEG_REGS Regs)
Read the guest segment registers.
#define EXCEPTION_MAXIMUM_PARAMETERS
Context Frame for 64-bit guests.
QWORD Param2
Second parameter.
#define BUGCHECK_BAD_POOL_HEADER
INTRO_PROT_OPTIONS CoreOptions
The activation and protection options for this guest.
INTSTATUS IntDecDecodeInstruction(IG_CS_TYPE CsType, QWORD Gva, void *Instrux)
Decode an instruction from the provided guest linear address.
An _EXCEPTION_RECORD structure used by 64-bit guests.
#define BUGCHECK_IRQL_NOT_LESS_OR_EQUAL
This structure describes a running process inside the guest.
WCHAR * Path
The string which represents the user-mode module path.
static void IntLogContextRecord(QWORD ContextRecord)
Logs information about a context record.