#include "introtypes.h"

Data Structures
struct	_WIN_DRIVER_OBJECT
	Holds information about a driver object. More...

Typedefs
typedef struct _WIN_DRIVER_OBJECT	WIN_DRIVER_OBJECT
	Holds information about a driver object. More...

typedef struct _WIN_DRIVER_OBJECT *	PWIN_DRIVER_OBJECT

Functions
BOOLEAN	IntWinDrvObjIsValidDriverObject (QWORD DriverObjectAddress)
	Checks if a guest memory area contains a valid _DRIVER_OBJECT structure. More...

PWIN_DRIVER_OBJECT	IntWinDrvObjFindByDrvObj (QWORD Gva)
	Finds a driver object in the gWinDriverObjects list by its guest virtual address. More...

PWIN_DRIVER_OBJECT	IntWinDrvObjFindByOwnerAddress (QWORD Owner)
	Finds a driver object in the gWinDriverObjects list by the base of the kernel module that owns it. More...

INTSTATUS	IntWinDrvObjCreateFromAddress (QWORD GuestAddress, BOOLEAN StaticDetected, PWIN_DRIVER_OBJECT *DriverObject)
	Creates a new driver object. More...

INTSTATUS	IntWinDrvObjRemoveFromAddress (QWORD DriverObjectAddress)
	Frees and removes protection for a driver object by its address. More...

INTSTATUS	IntWinDrvObjProtect (WIN_DRIVER_OBJECT *DriverObject)
	Protects a driver object and its fast IO dispatch table, if one exists. More...

INTSTATUS	IntWinDrvObjUnprotect (WIN_DRIVER_OBJECT *DriverObject)
	Deactivates protection for a driver object and its fast IO dispatch structure. More...

INTSTATUS	IntWinDrvObjRemove (WIN_DRIVER_OBJECT *DriverObject)
	Removes a driver object and updates its owner module. More...

INTSTATUS	IntWinDrvObjUpdateProtection (void)
	Updates the protection for all the driver objects in the gWinDriverObjects list. More...

INTSTATUS	IntWinDrvObjUninit (void)
	Removes all the driver objects in the gWinDriverObjects. More...

Typedef Documentation

◆ PWIN_DRIVER_OBJECT

typedef struct _WIN_DRIVER_OBJECT * PWIN_DRIVER_OBJECT

◆ WIN_DRIVER_OBJECT

typedef struct _WIN_DRIVER_OBJECT WIN_DRIVER_OBJECT

Holds information about a driver object.

Function Documentation

◆ IntWinDrvObjCreateFromAddress()

INTSTATUS IntWinDrvObjCreateFromAddress	(	QWORD	GuestAddress,
		BOOLEAN	StaticDetected,
		PWIN_DRIVER_OBJECT *	DriverObject
	)

Creates a new driver object.

If a driver object for GuestAddress is already known this function does nothing. This function assumes that GuestAddress points to a valid driver object. IntWinDrvObjIsValidDriverObject should be used to validate that this is true before calling this function. The driver will be inserted in the gWinDriverObjects list and will be protected (alongside its fast IO dispatch structure), if necessary.

Parameters

[in]	GuestAddress	Guest virtual address at which the _DRIVER_OBJECT structure is found.
[in]	StaticDetected	True if the driver object was detected after it was created, through a memory scan. False if it was detected when it was created.
[out]	DriverObject	On success, will contain a pointer to the created WIN_DRIVER_OBJECT. If a driver object already exists for GuestAddress it will point to that driver object. May be NULL.

Return values

INT_STATUS_SUCCESS	in case of success.
INT_STATUS_NOT_NEEDED_HINT	if a driver object for GuestAddress already exists.
INT_STATUS_INSUFFICIENT_RESOURCES	if not enough memory is available.

Definition at line 227 of file windrvobj.c.

Referenced by IntWinDrvHandleDriverEntry(), and IntWinObjHandleDriverDirectoryEntryInMemory().

◆ IntWinDrvObjFindByDrvObj()

PWIN_DRIVER_OBJECT IntWinDrvObjFindByDrvObj ( QWORD Gva )

Finds a driver object in the gWinDriverObjects list by its guest virtual address.

Parameters

[in] Gva Guest virtual address to search by.

Returns: A pointer to the WIN_DRIVER_OBJECT that matches Gva, or NULL if no match exists.

Definition at line 424 of file windrvobj.c.

Referenced by IntWinDrvObjCreateFromAddress().

◆ IntWinDrvObjFindByOwnerAddress()

PWIN_DRIVER_OBJECT IntWinDrvObjFindByOwnerAddress ( QWORD Owner )

Finds a driver object in the gWinDriverObjects list by the base of the kernel module that owns it.

Parameters

[in] Owner Guest virtual address to search by.

Returns: A pointer to the WIN_DRIVER_OBJECT that matches Gva, or NULL if no match exists.

Definition at line 453 of file windrvobj.c.

◆ IntWinDrvObjIsValidDriverObject()

BOOLEAN IntWinDrvObjIsValidDriverObject ( QWORD DriverObjectAddress )

Checks if a guest memory area contains a valid _DRIVER_OBJECT structure.

The check is based on invariants:

the object must be in the kernel's address space
the object must be present in memory
the Type field must be DRIVER_OBJECT_TYPE
the DriverStart should be present, not be accessible from user mode, and be cacheable
the module that owns the driver must have a valid MZPE header
the DriverSize from the object must match the one from the module
the entry point from the module must match the one from the driver object

The DRIVER_OBJECT64 definition is used for the checks on 64-bit guests; the DRIVER_OBJECT32 definition is used for 32-bit guests.

Parameters

[in] DriverObjectAddress The guest virtual address to check.

Returns: True if DriverObjectAddress points to a valid driver object; False if it does not.

Definition at line 28 of file windrvobj.c.

Referenced by IntWinDrvHandleDriverEntry(), and IntWinObjHandleDriverDirectoryEntryInMemory().

◆ IntWinDrvObjProtect()

INTSTATUS IntWinDrvObjProtect ( WIN_DRIVER_OBJECT * DriverObject )

Protects a driver object and its fast IO dispatch table, if one exists.

This will set an EPT or an integrity hook for the driver object and an integrity hook for the fast IO dispatch table.

Parameters

[in,out] DriverObject Driver object to be protected.

Return values

INT_STATUS_SUCCESS	in case of success.
INT_STATUS_INVALID_PARAMETER_1	if DriverObject is NULL.

Definition at line 1164 of file windrvobj.c.

Referenced by IntWinDrvObjCreateFromAddress(), and IntWinDrvObjUpdateProtection().

◆ IntWinDrvObjRemove()

INTSTATUS IntWinDrvObjRemove ( WIN_DRIVER_OBJECT * DriverObject )

Removes a driver object and updates its owner module.

If there is a KERNEL_DRIVER that owns this driver object, it's DriverObject field will be set to NULL.

Parameters

[in] DriverObject Object to remove.

Return values

INT_STATUS_SUCCESS	in case of success.
INT_STATUS_INVALID_PARAMETER_1	if DriverObject is NULL.

Definition at line 1344 of file windrvobj.c.

Referenced by IntWinDrvObjCreateFromAddress(), IntWinDrvObjRemoveFromAddress(), IntWinDrvObjUninit(), and IntWinDrvRemoveEntry().

◆ IntWinDrvObjRemoveFromAddress()

INTSTATUS IntWinDrvObjRemoveFromAddress ( QWORD DriverObjectAddress )

Frees and removes protection for a driver object by its address.

Parameters

[in] DriverObjectAddress Guest virtual address of the driver object.

Return values

INT_STATUS_SUCCESS	in case of success.
INT_STATUS_NOT_FOUND	if no driver object is found.

Definition at line 1246 of file windrvobj.c.

Referenced by IntWinPoolHandleFree().

◆ IntWinDrvObjUninit()

INTSTATUS IntWinDrvObjUninit ( void )

Removes all the driver objects in the gWinDriverObjects.

This will free any resources held by the driver objects and will remove their protection.

Returns: INT_STATUS_SUCCESS if successful, or an appropriate INTSTATUS error value.

Definition at line 1429 of file windrvobj.c.

Referenced by IntWinGuestUninit().

◆ IntWinDrvObjUnprotect()

INTSTATUS IntWinDrvObjUnprotect ( WIN_DRIVER_OBJECT * DriverObject )

Deactivates protection for a driver object and its fast IO dispatch structure.

Parameters

[in,out] DriverObject The object for which the protection will be removed.

Return values

INT_STATUS_SUCCESS	in case of success.
INT_STATUS_INVALID_PARAMETER_1	if DriverObject is NULL.
INT_STATUS_NOT_NEEDED_HINT	if the driver object is not protected. There is no need to also check the fast IO dispatch, as it can not be protected if the driver object itself is not protected.

Definition at line 1100 of file windrvobj.c.

Referenced by IntWinDrvObjRemove(), and IntWinDrvObjUpdateProtection().

◆ IntWinDrvObjUpdateProtection()

INTSTATUS IntWinDrvObjUpdateProtection ( void )

Updates the protection for all the driver objects in the gWinDriverObjects list.

Based on new core options (Activation and protection flags) protection will be activated or deactivated.

Definition at line 1385 of file windrvobj.c.

Referenced by IntGuestUpdateCoreOptions().

Data Structures

Typedefs

Functions

Typedef Documentation

◆ PWIN_DRIVER_OBJECT

◆ WIN_DRIVER_OBJECT

Function Documentation

◆ IntWinDrvObjCreateFromAddress()

◆ IntWinDrvObjFindByDrvObj()

◆ IntWinDrvObjFindByOwnerAddress()

◆ IntWinDrvObjIsValidDriverObject()

◆ IntWinDrvObjProtect()

◆ IntWinDrvObjRemove()

◆ IntWinDrvObjRemoveFromAddress()

◆ IntWinDrvObjUninit()

◆ IntWinDrvObjUnprotect()

◆ IntWinDrvObjUpdateProtection()