#include "introcore.h"
#include "patsig.h"
#include "detours.h"

Data Structures
struct	_PROTECTED_PROCESS_INFO
	Encapsulates a protected Windows process. More...

struct	_WIN_UNEXPORTED_FUNCTION_PATTERN
	Describes a pattern for a kernel function that is not exported. More...

struct	_WIN_UNEXPORTED_FUNCTION
	Describes a function that is not exported. More...

struct	_PROTECTED_MODULE_INFO
	Encapsulates a protected Windows kernel module. More...

struct	_WIN_OPAQUE_FIELDS
	Contains information about various Windows user mode and kernel mode structures.Everything about a structure of interest should be placed here (size, field offsets, etc). The Km structure contains information about kernel objects, while the Um field contains information about user mode objects. Each structure has a specific tag (WIN_KM_STRUCTURE for Km, WIN_UM_STRUCTURE for Um) which is used to identify it. Each entry inside an array contains specific information. The specific WIN_UM_FIELD and WIN_KM_FIELD structures describe the information found at each index in these arrays. For example, the WIN_KM_FIELD_PROCESS enum describes the information found in the Km.Process array. If the offset at which the name of a process is found inside the kernel _EPROCESS structure is needed, it can be obtained by looking at Km.Process[winKmFieldProcessName]. In order to simplify this, the WIN_KM_FIELD macro can be used: WIN_OPAQUE_FIELDS(Process, Name). A similar approach is available for user mode fields with the WIN_UM_FIELD macro. These fields are set when a CAMI file is loaded at initialization time, in the IntCamiLoadOpaqueFields function. If the loaded CAMI file contains a structure that is not known by introcore, or contains more field than the current introcore version uses, the extra information is discarded. This is why new fields should be added right before the End tags, in order to preserve the current order and allow older introcore versions to load newer CAMI files. More...

struct	_WIN_MODULE_UNIQUE_KEY
	Information that can identify a module. More...

struct	_WINDOWS_GUEST
	Holds information about a Windows guest. More...

struct	_WIN_INIT_SWAP
	The initialization swap handle. More...

Macros
#define	IMAGE_BASE_NAME_LEN 16u
	The maximum length of a process name. More...

#define	IMAGE_FULL_PATH_LEN 260u
	The maximum length of a process path. More...

#define	PROT_PROC_FLAG_NO_PATH 0x00000001
	Flag used to represent internally that a process is protected by name, not by path. More...

#define	WIN_KM_FIELD(Structure, Field) gWinGuest->OsSpecificFields.Km.Structure[winKmField##Structure##Field]
	Macro used to access kernel mode fields inside the WIN_OPAQUE_FIELDS structure. More...

#define	WIN_SYSCALL_NUMBER(Syscall) WIN_KM_FIELD(SyscallNumbers, Syscall)
	Macro used to access syscall numbers from inside the WIN_OPAQUE_FIELDS structure. More...

#define	WIN_UM_FIELD(Structure, Field) gWinGuest->OsSpecificFields.Um.Structure[winUmField##Structure##Field]
	Macro used to access user mode fields inside the WIN_OPAQUE_FIELDS structure. More...

Typedefs
typedef struct _GUEST_STATE	GUEST_STATE

typedef struct _GUEST_STATE *	PGUEST_STATE

typedef struct _PROTECTED_PROCESS_INFO	PROTECTED_PROCESS_INFO
	Encapsulates a protected Windows process. More...

typedef struct _PROTECTED_PROCESS_INFO *	PPROTECTED_PROCESS_INFO

typedef struct _WIN_UNEXPORTED_FUNCTION_PATTERN	WIN_UNEXPORTED_FUNCTION_PATTERN
	Describes a pattern for a kernel function that is not exported. More...

typedef struct _WIN_UNEXPORTED_FUNCTION_PATTERN *	PWIN_UNEXPORTED_FUNCTION_PATTERN

typedef struct _WIN_UNEXPORTED_FUNCTION	WIN_UNEXPORTED_FUNCTION
	Describes a function that is not exported. More...

typedef struct _WIN_UNEXPORTED_FUNCTION *	PWIN_UNEXPORTED_FUNCTION

typedef struct _PROTECTED_MODULE_INFO	PROTECTED_MODULE_INFO
	Encapsulates a protected Windows kernel module. More...

typedef struct _PROTECTED_MODULE_INFO *	PPROTECTED_MODULE_INFO

typedef enum _WIN_UM_FIELD_DLL	WIN_UM_FIELD_DLL
	Indexes in the WIN_OPAQUE_FIELDS.Um.Dll array, containing offsets inside the _LDR_DATA_TABLE_ENTRY structure. More...

typedef enum _WIN_UM_FIELD_PEB	WIN_UM_FIELD_PEB
	Indexes in the WIN_OPAQUE_FIELDS.Um.Peb array, containing offsets inside the _PEB structure.These are the indexes of the offsets inside the WIN_OPAQUE_FIELDS.Um.Peb array. The WIN_UM_FIELD can be used to access these more easily. More...

typedef enum _WIN_UM_FIELD_TEB	WIN_UM_FIELD_TEB
	Indexes in the WIN_OPAQUE_FIELDS.Um.Teb array, containing offsets inside the _TEB structure.The WIN_UM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_STRUCTURE	WIN_KM_STRUCTURE
	Structure tags used for the kernel mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Km field. More...

typedef enum _WIN_UM_STRUCTURE	WIN_UM_STRUCTURE
	Structure tags used for the user mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Um field. More...

typedef enum _WIN_KM_FIELD_PROCESS	WIN_KM_FIELD_PROCESS
	Indexes in the WIN_OPAQUE_FIELDS.Km.Process array, containing offsets inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_THREAD	WIN_KM_FIELD_THREAD
	Indexes in the WIN_OPAQUE_FIELDS.Km.Thread array, containing offsets inside the _ETHREAD structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_DRVOBJ	WIN_KM_FIELD_DRVOBJ
	Indexes in the WIN_OPAQUE_FIELDS.Km.DrvObj array, containing information about the _DRIVER_OBJECT structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_PCR	WIN_KM_FIELD_PCR
	Indexes in the WIN_OPAQUE_FIELDS.Km.Pcr array, containing information about the _KPCR structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_POOLDESCRIPTOR	WIN_KM_FIELD_POOLDESCRIPTOR
	Indexes in the WIN_OPAQUE_FIELDS.Km.PoolDescriptor array, containing information about the _POOL_DESCRIPTOR structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_MMPFN	WIN_KM_FIELD_MMPFN
	Indexes in the WIN_OPAQUE_FIELDS.Km.Mmpfn array, containing information about the _MMPFN structure.For 32-bit versions of the OS, this is split into two sections: PAE and non-PAE, as Windows versions prior to Windows 8 were able to boot without PAE support and in those cases the _MMPFN structure was different. For 32-bit guests with PAE enabled (gGuest->Mm.Mode is PAGING_PAE_MODE in those cases) the Pae version of the tags should be used. For the other guests, the normal versions should be used. More...

typedef enum _WIN_KM_FIELD_TOKEN	WIN_KM_FIELD_TOKEN
	Indexes in the WIN_OPAQUE_FIELDS.Km.Token array, containing information about the _TOKEN structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_UNGROUPED	WIN_KM_FIELD_UNGROUPED
	Indexes in the WIN_OPAQUE_FIELDS.Km.Ungrouped array, containing information about various kernel structures or data.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_EPROCESSFLAGS	WIN_KM_FIELD_EPROCESSFLAGS
	Indexes in the WIN_OPAQUE_FIELDS.Km.EprocessFlags array, containing information about the flags inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_VAD_SHORT	WIN_KM_FIELD_VAD_SHORT
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadShort array, containing information about the _MMVAD_SHORT structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_VAD_LONG	WIN_KM_FIELD_VAD_LONG
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadLong array, containing information about the _MMVAD_LONG structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_VADFLAGS	WIN_KM_FIELD_VADFLAGS
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadFlags array, containing information about the bits in the winKmFieldVadShortFlags field.Certain values are parsed by shifting the flags value and then applying a mask, while boolean values are stored as the bit that must be checked in order to know if that bit is set or not. For example, in order to obtain the type from a 32-bit flags value you need to: More...

typedef enum _WIN_KM_FIELD_SYSCALL_NUMBERS	WIN_KM_FIELD_SYSCALL_NUMBERS
	Indexes in the WIN_OPAQUE_FIELDS.Km.SyscallNumbers array, containing syscall numbers.The WIN_SYSCALL_NUMBER or WIN_KM_FIELD macros can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_FILE_OBJECT	WIN_KM_FIELD_FILE_OBJECT
	Indexes in the WIN_OPAQUE_FIELDS.Km.FileObject array, containing information about the _FILE_OBJECT structure.The WIN_KM_FIELD macros can be used to access these more easily. More...

typedef struct _WIN_OPAQUE_FIELDS	WIN_OPAQUE_FIELDS
	Contains information about various Windows user mode and kernel mode structures.Everything about a structure of interest should be placed here (size, field offsets, etc). The Km structure contains information about kernel objects, while the Um field contains information about user mode objects. Each structure has a specific tag (WIN_KM_STRUCTURE for Km, WIN_UM_STRUCTURE for Um) which is used to identify it. Each entry inside an array contains specific information. The specific WIN_UM_FIELD and WIN_KM_FIELD structures describe the information found at each index in these arrays. For example, the WIN_KM_FIELD_PROCESS enum describes the information found in the Km.Process array. If the offset at which the name of a process is found inside the kernel _EPROCESS structure is needed, it can be obtained by looking at Km.Process[winKmFieldProcessName]. In order to simplify this, the WIN_KM_FIELD macro can be used: WIN_OPAQUE_FIELDS(Process, Name). A similar approach is available for user mode fields with the WIN_UM_FIELD macro. These fields are set when a CAMI file is loaded at initialization time, in the IntCamiLoadOpaqueFields function. If the loaded CAMI file contains a structure that is not known by introcore, or contains more field than the current introcore version uses, the extra information is discarded. This is why new fields should be added right before the End tags, in order to preserve the current order and allow older introcore versions to load newer CAMI files. More...

typedef struct _WIN_OPAQUE_FIELDS *	PWIN_OPAQUE_FIELDS

typedef struct _WIN_MODULE_UNIQUE_KEY	WIN_MODULE_UNIQUE_KEY
	Information that can identify a module. More...

typedef struct _WIN_MODULE_UNIQUE_KEY	PWIN_MODULE_UNIQUE_KEY

typedef struct _WINDOWS_GUEST	WINDOWS_GUEST
	Holds information about a Windows guest. More...

typedef struct _WINDOWS_GUEST *	PWINDOWS_GUEST

typedef struct _WIN_INIT_SWAP	WIN_INIT_SWAP
	The initialization swap handle. More...

typedef struct _WIN_INIT_SWAP *	PWIN_INIT_SWAP

Enumerations
enum	PROTECTED_MODULE_TYPE { winModNone = 0, winModCore, winModAntivirus, winModCitrix }
	Protected kernel module types. More...

enum	OBJ_DISCOVERY_TYPE { FLAG_STATIC_DETECTION = 1, FLAG_DYNAMIC_DETECTION = 2 }
	Describes the mode in which a kernel object was found. More...

enum	_WIN_UM_FIELD_DLL { winUmFieldDllBaseOffsetInModule64 = 0, winUmFieldDllBaseOffsetInModule32, winUmFieldDllSizeOffsetInModule64, winUmFieldDllSizeOffsetInModule32, winUmFieldDllNameOffsetInModule64, winUmFieldDllNameOffsetInModule32, winUmFieldDllEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Um.Dll array, containing offsets inside the _LDR_DATA_TABLE_ENTRY structure. More...

enum	_WIN_UM_FIELD_PEB { winUmFieldPeb64Size = 0, winUmFieldPeb32Size, winUmFieldPebEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Um.Peb array, containing offsets inside the _PEB structure.These are the indexes of the offsets inside the WIN_OPAQUE_FIELDS.Um.Peb array. The WIN_UM_FIELD can be used to access these more easily. More...

enum	_WIN_UM_FIELD_TEB { winUmFieldTeb64Size = 0, winUmFieldTeb32Size, winUmFieldTebWow64SaveArea, winUmFieldTebWow64StackInSaveArea, winUmFieldTebEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Um.Teb array, containing offsets inside the _TEB structure.The WIN_UM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_STRUCTURE { winKmStructureProcess = 0, winKmStructureThread, winKmStructureDrvObj, winKmStructurePcr, winKmStructurePoolDescriptor, winKmStructureMmpfn, winKmStructureToken, winKmStructureUngrouped, winKmStructureEprocessFlags, winKmStructureVadShort, winKmStructureVadLong, winKmStructureVadFlags, winKmStructureSyscallNumbers, winKmStructureFileObject, winKmStructureEnd }
	Structure tags used for the kernel mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Km field. More...

enum	_WIN_UM_STRUCTURE { winUmStructureDll = 0, winUmStructurePeb, winUmStructureTeb, winUmStructureEnd }
	Structure tags used for the user mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Um field. More...

enum	_WIN_KM_FIELD_PROCESS { winKmFieldProcessCr3 = 0, winKmFieldProcessUserCr3, winKmFieldProcessKexecOptions, winKmFieldProcessListEntry, winKmFieldProcessName, winKmFieldProcessSectionBase, winKmFieldProcessId, winKmFieldProcessParentPid, winKmFieldProcessVadRoot, winKmFieldProcessCreateTime, winKmFieldProcessExitStatus, winKmFieldProcessToken, winKmFieldProcessObjectTable, winKmFieldProcessPeb, winKmFieldProcessThreadListHead, winKmFieldProcessWoW64, winKmFieldProcessFlags, winKmFieldProcessFlags3, winKmFieldProcessMitigationFlags, winKmFieldProcessMitigationFlags2, winKmFieldProcessDebugPort, winKmFieldProcessSpare, winKmFieldProcessEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Process array, containing offsets inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_THREAD { winKmFieldThreadProcess = 0, winKmFieldThreadThreadListEntry, winKmFieldThreadKernelStack, winKmFieldThreadStackBase, winKmFieldThreadStackLimit, winKmFieldThreadState, winKmFieldThreadWaitReason, winKmFieldThreadAttachedProcess, winKmFieldThreadTeb, winKmFieldThreadId, winKmFieldThreadClientSecurity, winKmFieldThreadTrapFrame, winKmFieldThreadWin32StartAddress, winKmFieldThreadPreviousMode, winKmFieldThreadEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Thread array, containing offsets inside the _ETHREAD structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_DRVOBJ { winKmFieldDrvObjSize = 0, winKmFieldDrvObjFiodispSize, winKmFieldDrvObjAllocationGap, winKmFieldDrvObjFiodisp, winKmFieldDrvObjStart, winKmFieldDrvObjEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.DrvObj array, containing information about the _DRIVER_OBJECT structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_PCR { winKmFieldPcrCurrentThread = 0, winKmFieldPcrUserTime, winKmFieldPcrPcrb, winKmFieldPcrPrcbInterruptObject, winKmFieldPcrEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Pcr array, containing information about the _KPCR structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_POOLDESCRIPTOR { winKmFieldPoolDescriptorTotalBytes = 0, winKmFieldPoolDescriptorNppSize, winKmFieldPoolDescriptorEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.PoolDescriptor array, containing information about the _POOL_DESCRIPTOR structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_MMPFN { winKmFieldMmpfnSize = 0, winKmFieldMmpfnPte, winKmFieldMmpfnRefCount, winKmFieldMmpfnFlags, winKmFieldMmpfnPaeSize, winKmFieldMmpfnPaePte, winKmFieldMmpfnPaeRefCount, winKmFieldMmpfnPaeFlags, winKmFieldMmpfnEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Mmpfn array, containing information about the _MMPFN structure.For 32-bit versions of the OS, this is split into two sections: PAE and non-PAE, as Windows versions prior to Windows 8 were able to boot without PAE support and in those cases the _MMPFN structure was different. For 32-bit guests with PAE enabled (gGuest->Mm.Mode is PAGING_PAE_MODE in those cases) the Pae version of the tags should be used. For the other guests, the normal versions should be used. More...

enum	_WIN_KM_FIELD_TOKEN { winKmFieldTokenPrivs = 0, winKmFieldTokenUserCount, winKmFieldTokenRestrictedCount, winKmFieldTokenUsers, winKmFieldTokenRestrictedSids, winKmFieldTokenEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Token array, containing information about the _TOKEN structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_UNGROUPED { winKmFieldUngroupedCtlAreaFile = 0, winKmFieldUngroupedHandleTableTableCode, winKmFieldUngroupedHalIntCtrlType, winKmFieldUngroupedWmiGetClockOffset, winKmFieldUngroupedEtwDbgDataSiloOffset, winKmFieldUngroupedEtwSignatureOffset, winKmFieldUngroupedSubsectionCtlArea, winKmFieldUngroupedHalPerfCntFunctionOffset, winKmFieldUngroupedRspOffsetOnZwCall, winKmFieldUngroupedHalIntCtrlTypeMaxOffset, winKmFieldUngroupedHalIntCtrlTypeMinOffset, winKmFieldUngroupedSharedUserDataSize, winKmFieldUngroupedEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Ungrouped array, containing information about various kernel structures or data.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_EPROCESSFLAGS { winKmFieldEprocessFlagsNoDebugInherit = 0, winKmFieldEprocessFlagsExiting, winKmFieldEprocessFlagsDelete, winKmFieldEprocessFlags3Crashed, winKmFieldEprocessFlagsVmDeleted, winKmFieldEprocessFlagsHasAddrSpace, winKmFieldEprocessFlagsOutSwapped, winKmFieldEprocessFlagsEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.EprocessFlags array, containing information about the flags inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_VAD_SHORT { winKmFieldVadShortParent = 0, winKmFieldVadShortLeft, winKmFieldVadShortRight, winKmFieldVadShortStartingVpn, winKmFieldVadShortStartingVpnHigh, winKmFieldVadShortEndingVpn, winKmFieldVadShortEndingVpnHigh, winKmFieldVadShortFlags, winKmFieldVadShortFlagsSize, winKmFieldVadShortVpnSize, winKmFieldVadShortSize, winKmFieldVadShortEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadShort array, containing information about the _MMVAD_SHORT structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_VAD_LONG { winKmFieldVadLongSubsection = 0, winKmFieldVadLongEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadLong array, containing information about the _MMVAD_LONG structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_VADFLAGS { winKmFieldVadFlagsTypeShift = 0, winKmFieldVadFlagsTypeMask, winKmFieldVadFlagsProtectionShift, winKmFieldVadFlagsProtectionMask, winKmFieldVadFlagsNoChangeBit, winKmFieldVadFlagsPrivateFixupMask, winKmFieldVadFlagsDeleteInProgressMask, winKmFieldVadFlagsEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadFlags array, containing information about the bits in the winKmFieldVadShortFlags field.Certain values are parsed by shifting the flags value and then applying a mask, while boolean values are stored as the bit that must be checked in order to know if that bit is set or not. For example, in order to obtain the type from a 32-bit flags value you need to: More...

enum	_WIN_KM_FIELD_SYSCALL_NUMBERS { winKmFieldSyscallNumbersNtWriteVirtualMemory = 0, winKmFieldSyscallNumbersNtProtectVirtualMemory, winKmFieldSyscallNumbersNtCreateThreadEx, winKmFieldSyscallNumbersEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.SyscallNumbers array, containing syscall numbers.The WIN_SYSCALL_NUMBER or WIN_KM_FIELD macros can be used to access these more easily. More...

enum	_WIN_KM_FIELD_FILE_OBJECT { winKmFieldFileObjectNameBuffer, winKmFieldFileObjectNameLength, winKmFieldFileObjectEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.FileObject array, containing information about the _FILE_OBJECT structure.The WIN_KM_FIELD macros can be used to access these more easily. More...

enum	WIN_PRODUCT_TYPE { winProductTypeNotYetLoaded, winProductTypeWinNt, winProductTypeLanManNt, winProductTypeServer, winProductTypeUnknown }
	The type of the Windows OS. More...

Functions
INTSTATUS	IntWinGuestNew (void)
	Starts the initialization and protection process for a new Windows guest. More...

INTSTATUS	IntWinGuestInit (void)
	Initializes a new Windows guest. More...

void	IntWinGuestUninit (void)
	Uninits a Windows guest. More...

void	IntWinGuestCancelKernelRead (void)
	Cancels the kernel read. More...

INTSTATUS	IntWinGetVersionString (DWORD FullStringSize, DWORD VersionStringSize, CHAR FullString, CHAR VersionString)
	Gets the version string for a Windows guest. More...

Macro Definition Documentation

◆ IMAGE_BASE_NAME_LEN

#define IMAGE_BASE_NAME_LEN 16u

The maximum length of a process name.

Definition at line 15 of file winguest.h.

Referenced by IntLixAgentNameIsRunning(), IntWinDpiIsSelf(), IntWinProcAddProtectedProcess(), IntWinProcCreateProcessObject(), IntWinProcDump(), IntWinProcGetImageBaseNameFromPath(), IntWinProcGetNameFromEprocess(), IntWinProcGetNameFromInternalEprocess(), IntWinProcIsPsActiveProcessHead(), IntWinProcRemoveAllProtectedProcesses(), and IntWinProcRemoveProtectedProcess().

◆ IMAGE_FULL_PATH_LEN

#define IMAGE_FULL_PATH_LEN 260u

The maximum length of a process path.

Definition at line 18 of file winguest.h.

◆ PROT_PROC_FLAG_NO_PATH

#define PROT_PROC_FLAG_NO_PATH 0x00000001

Flag used to represent internally that a process is protected by name, not by path.

Definition at line 21 of file winguest.h.

Referenced by IntWinProcAddProtectedProcess(), and IntWinProcGetProtectedInfoEx().

Typedef Documentation

◆ GUEST_STATE

typedef struct _GUEST_STATE GUEST_STATE

Definition at line 12 of file winguest.h.

◆ PGUEST_STATE

typedef struct _GUEST_STATE * PGUEST_STATE

Definition at line 12 of file winguest.h.

◆ PPROTECTED_MODULE_INFO

typedef struct _PROTECTED_MODULE_INFO * PPROTECTED_MODULE_INFO

◆ PPROTECTED_PROCESS_INFO

typedef struct _PROTECTED_PROCESS_INFO * PPROTECTED_PROCESS_INFO

◆ PROTECTED_MODULE_INFO

typedef struct _PROTECTED_MODULE_INFO PROTECTED_MODULE_INFO

Encapsulates a protected Windows kernel module.

◆ PROTECTED_PROCESS_INFO

typedef struct _PROTECTED_PROCESS_INFO PROTECTED_PROCESS_INFO

Encapsulates a protected Windows process.

◆ PWIN_INIT_SWAP

typedef struct _WIN_INIT_SWAP * PWIN_INIT_SWAP

◆ PWIN_MODULE_UNIQUE_KEY

typedef struct _WIN_MODULE_UNIQUE_KEY PWIN_MODULE_UNIQUE_KEY

◆ PWIN_UNEXPORTED_FUNCTION

typedef struct _WIN_UNEXPORTED_FUNCTION * PWIN_UNEXPORTED_FUNCTION

◆ PWIN_UNEXPORTED_FUNCTION_PATTERN

typedef struct _WIN_UNEXPORTED_FUNCTION_PATTERN * PWIN_UNEXPORTED_FUNCTION_PATTERN

◆ PWINDOWS_GUEST

typedef struct _WINDOWS_GUEST * PWINDOWS_GUEST

◆ WIN_INIT_SWAP

typedef struct _WIN_INIT_SWAP WIN_INIT_SWAP

The initialization swap handle.

These are used to read WINDOWS_GUEST.KernelBuffer.

◆ WIN_MODULE_UNIQUE_KEY

typedef struct _WIN_MODULE_UNIQUE_KEY WIN_MODULE_UNIQUE_KEY

Information that can identify a module.

This can be used to obtain a PDB for a module.

◆ WIN_UNEXPORTED_FUNCTION

typedef struct _WIN_UNEXPORTED_FUNCTION WIN_UNEXPORTED_FUNCTION

Describes a function that is not exported.

This structure has a variable length

◆ WIN_UNEXPORTED_FUNCTION_PATTERN

typedef struct _WIN_UNEXPORTED_FUNCTION_PATTERN WIN_UNEXPORTED_FUNCTION_PATTERN

Describes a pattern for a kernel function that is not exported.

Functions that are not exported can not be found by name, so we search them by a pattern

◆ WINDOWS_GUEST

typedef struct _WINDOWS_GUEST WINDOWS_GUEST

Holds information about a Windows guest.

Enumeration Type Documentation

◆ OBJ_DISCOVERY_TYPE

enum OBJ_DISCOVERY_TYPE

Describes the mode in which a kernel object was found.

Enumerator

FLAG_STATIC_DETECTION

The object was detected after it was created.

This usually implies a memory scan of some type.

FLAG_DYNAMIC_DETECTION

The object was detected when it was created.

Definition at line 145 of file winguest.h.

◆ PROTECTED_MODULE_TYPE

enum PROTECTED_MODULE_TYPE

Protected kernel module types.

Enumerator
winModNone	Invalid.
winModCore	Core Windows kernel modules.
winModAntivirus	Antivirus modules.
winModCitrix	Xen-specific Citrix modules.

Definition at line 115 of file winguest.h.

◆ WIN_PRODUCT_TYPE

enum WIN_PRODUCT_TYPE

The type of the Windows OS.

This is equivalent to the _NT_PRODUCT_TYPE enum found inside the Windows kernel.

Enumerator
winProductTypeNotYetLoaded	Information not yet loaded.
winProductTypeWinNt	Workstation.
winProductTypeLanManNt	Advanced server.
winProductTypeServer	Server.
winProductTypeUnknown	The product type is unknown. Usually this means that the product information could not be obtained or that it is not valid.

Definition at line 795 of file winguest.h.

Function Documentation

◆ IntWinGetVersionString()

INTSTATUS IntWinGetVersionString	(	DWORD	FullStringSize,
		DWORD	VersionStringSize,
		CHAR *	FullString,
		CHAR *	VersionString
	)

Gets the version string for a Windows guest.

Parameters

[in]	FullStringSize	The size of the FullString buffer
[in]	VersionStringSize	The size of the VersionString buffer
[out]	FullString	A NULL-terminated string containing detailed version information
[out]	VersionString	A NULL-terminated string containing human-readable version information

Return values

INT_STATUS_SUCCESS	in case of success
INT_STATUS_NOT_READY	if the information is not yet available
INT_STATUS_DATA_BUFFER_TOO_SMALL	if any of the buffers is not large enough

Definition at line 2650 of file winguest.c.

Referenced by IntGetVersionString().

◆ IntWinGuestCancelKernelRead()

void IntWinGuestCancelKernelRead ( void )

Cancels the kernel read.

This function cancels all the pending page faults that were scheduled in order to read the WINDOWS_GUEST.KernelBuffer.

Definition at line 607 of file winguest.c.

Referenced by IntGuestPrepareUninit(), and IntWinGuestNew().

◆ IntWinGuestInit()

INTSTATUS IntWinGuestInit ( void )

Initializes a new Windows guest.

Any operations that should be done after basic information about the guest is obtained should be done here. Breakpoint exits are enabled here and not in IntCallbacksInit where all the other events are enabled because activating the break point exits earlier may cause a slow boot on Linux OS so this activation step is done by each OS as a custom step in the initialization phase.

Returns: INT_STATUS_SUCCESS if successful, or an appropriate INTSTATUS error value

Definition at line 641 of file winguest.c.

Referenced by IntWinGuestNew().

◆ IntWinGuestNew()

INTSTATUS IntWinGuestNew ( void )

Starts the initialization and protection process for a new Windows guest.

This will find the base of the kernel, initiate the WINDOWS_GUEST.KernelBuffer read, will start to look for relevant kernel objects, variables, and functions and will activate protection when every needed piece of information is known. The initialization depends on the value of the syscall MSR (for 64-bit guests) or the sysenter MSR (for 32-bit guests) as it will point inside the kernel image and we need a valid address that points somewhere inside the kernel image. Parts of the initialization may be done asynchronously.