windpi.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#ifndef _WINDPI_H_
#define _WINDPI_H_

#include "winguest.h"

typedef struct _WIN_PROCESS_OBJECT WIN_PROCESS_OBJECT, *PWIN_PROCESS_OBJECT;

#define HEAP_SPRAY_NR_PAGES 0xF

typedef struct _DPI_EXTRA_INFO
{
    struct
    {
        QWORD _Reserved;            
    } DpiDebugExtraInfo;

    struct
    {
        QWORD CurrentStack;         
        QWORD StackBase;            
        QWORD StackLimit;           
        QWORD TrapFrameAddress;
        QWORD CurrentWow64Stack;
        QWORD Wow64StackBase;       
        QWORD Wow64StackLimit;      
    } DpiPivotedStackExtraInfo;

    struct
    {
        QWORD StolenFromEprocess;   
    } DpiStolenTokenExtraInfo;

    struct
    {
        struct
        {
            DWORD Mapped : 1;           
            DWORD Detected : 1;
            DWORD HeapValCount : 11;
            DWORD Offset : 12;
            DWORD Executable : 1;       
            DWORD Reserved : 7;         
        } HeapPages[HEAP_SPRAY_NR_PAGES];

        QWORD ShellcodeFlags;           
    } DpiHeapSprayExtraInfo;

    struct
    {
        QWORD OldEnabled;               
        QWORD NewEnabled;
        QWORD OldPresent;               
        QWORD NewPresent;
    } DpiTokenPrivsExtraInfo;

    struct
    {
        QWORD StartAddress;             
        QWORD ShellcodeFlags;           
    } DpiThreadStartExtraInfo;

    struct
    {
        QWORD SecDescStolenFromEproc;

        QWORD OldPtrValue;              
        QWORD NewPtrValue;              

        ACL OldSacl;                    
        ACL OldDacl;                    

        ACL NewSacl;                    
        ACL NewDacl;                    
    } DpiSecDescAclExtraInfo;

} DPI_EXTRA_INFO, *PDPI_EXTRA_INFO;

void
IntWinDpiGatherDpiInfo(
    _Inout_ WIN_PROCESS_OBJECT *Process,
    _In_ WIN_PROCESS_OBJECT *Parent,
    _In_ QWORD DebugHandle
    );

INTRO_ACTION
IntWinDpiCheckCreation(
    _In_ WIN_PROCESS_OBJECT *Child,
    _In_ WIN_PROCESS_OBJECT *RealParent
    );

#endif // _WINDPI_H_