Bitdefender Hypervisor Memory Introspection
windrv_protected.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
11 
12 #ifndef _WINDRV_PROTECTED_H_
13 #define _WINDRV_PROTECTED_H_
14 
15 #include "introtypes.h"
16 #include "drivers.h"
17 
18 typedef struct _PROTECTED_MODULE_INFO PROTECTED_MODULE_INFO;
19 
20 _Success_(return != NULL)
21 const PROTECTED_MODULE_INFO *
22 IntWinDrvIsProtected(
23  _In_ const KERNEL_DRIVER *Driver
24  );
25 
26 _Success_(return != NULL)
27 const PROTECTED_MODULE_INFO *
28 IntWinDrvObjIsProtected(
29  _In_ const WIN_DRIVER_OBJECT *DriverObject
30  );
31 
32 BOOLEAN
33 IntWinDrvHasDriverObject(
34  _In_ const KERNEL_DRIVER *Driver
35  );
36 
37 BOOLEAN
38 IntWinDrvIsProtectedAv(
39  _In_ const WCHAR *Driver
40  );
41 
42 BOOLEAN
43 IntWinDrvObjIsProtectedAv(
44  _In_ const WCHAR *DrvObj
45  );
46 
47 #endif // !_WINDRV_PROTECTED_H_
48 
BOOLEAN
_Bool BOOLEAN
Definition: intro_types.h:58
IntWinDrvObjIsProtected
const PROTECTED_MODULE_INFO * IntWinDrvObjIsProtected(const WIN_DRIVER_OBJECT *DriverObject)
Get the protected module information for a kernel driver object.
Definition: windrv_protected.c:536
_In_
#define _In_
Definition: intro_sal.h:21
_Success_
#define _Success_(expr)
Definition: intro_sal.h:47
IntWinDrvHasDriverObject
BOOLEAN IntWinDrvHasDriverObject(const KERNEL_DRIVER *Driver)
Check wether a kernel driver has a driver object that we care to protect.
Definition: windrv_protected.c:577
_KERNEL_DRIVER
Describes a kernel driver.
Definition: drivers.h:30
_WIN_DRIVER_OBJECT
Holds information about a driver object.
Definition: windrvobj.h:13
_PROTECTED_MODULE_INFO::DriverObject
const WCHAR * DriverObject
The driver object that must be protected when protecting this module.
Definition: winguest.h:134
WCHAR
uint16_t WCHAR
Definition: intro_types.h:63
_PROTECTED_MODULE_INFO
Encapsulates a protected Windows kernel module.
Definition: winguest.h:126
IntWinDrvIsProtectedAv
BOOLEAN IntWinDrvIsProtectedAv(const WCHAR *Driver)
Check wether a kernel driver is a known and protected antivirus.
Definition: windrv_protected.c:595
IntWinDrvObjIsProtectedAv
BOOLEAN IntWinDrvObjIsProtectedAv(const WCHAR *DrvObj)
Checks if a driver object belongs to a known and protected antivirus.
Definition: windrv_protected.c:611
IntWinDrvIsProtected
const PROTECTED_MODULE_INFO * IntWinDrvIsProtected(const KERNEL_DRIVER *Driver)
Get the protected module information for a kernel driver.
Definition: windrv_protected.c:484