windriver.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#ifndef _WINDRIVER_H_
#define _WINDRIVER_H_

#include "windrvobj.h"

//
// Internal definition of a loaded kernel driver.
//
typedef struct _WIN_KERNEL_DRIVER
{
    DWORD               TimeDateStamp;          

    DWORD               PathHash;               
    DWORD               PathLength;             

    PWCHAR              Path;                   

    void                *EpHookObject;

    PBYTE               MzPeHeaders;            

    PWIN_DRIVER_OBJECT  DriverObject;           

    void                *HeadersSwapHandle;     

    void                *EatReadHook;            

    QWORD               EatReadCount;

} WIN_KERNEL_DRIVER, *PWIN_KERNEL_DRIVER;


typedef struct _KERNEL_DRIVER KERNEL_DRIVER, *PKERNEL_DRIVER;

#define DRIVER_MAX_ITERATIONS           4096


//
// Loaded drivers specific API
//
INTSTATUS
IntWinDrvIsListHead(
    _In_ QWORD PsLoadedModuleListGva,
    _In_ void *PsLoadedModuleList,
    _In_ QWORD KernelLdr
    );

INTSTATUS
IntWinDrvIterateLoadedModules(
    _In_ PFUNC_IterateListCallback Callback,
    _In_ QWORD Aux
    );

INTSTATUS
IntWinDrvCreateFromAddress(
    _In_ QWORD ModuleInfo,
    _In_ QWORD Flags
    );

INTSTATUS
IntWinDrvRemoveFromAddress(
    _In_ QWORD ModuleInfo
    );

INTSTATUS
IntWinDrvProtect(
    _In_ KERNEL_DRIVER *Driver,
    _In_ QWORD ProtectionFlag
    );

INTSTATUS
IntWinDrvUnprotect(
    _In_ KERNEL_DRIVER *Driver
    );

INTSTATUS
IntWinDrvHandleDriverEntry(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    );

INTSTATUS
IntWinDrvHandleWrite(
    _In_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    );

INTSTATUS
IntWinDrvHandleRead(
    _In_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    );

INTSTATUS
IntWinProtectReadNtEat(
    void
    );

INTSTATUS
IntWinUnprotectReadNtEat(
    void
    );

INTSTATUS
IntWinDrvRemoveEntry(
    _In_ KERNEL_DRIVER *Driver
    );

INTSTATUS
IntWinDrvUpdateProtection(
    void
    );

#endif // _WINDRIVER_H_