winguest.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _WINGUEST_H_
#define _WINGUEST_H_

#include "introcore.h"
#include "patsig.h"
#include "detours.h"

typedef struct _GUEST_STATE GUEST_STATE, *PGUEST_STATE;

#define IMAGE_BASE_NAME_LEN 16u

#define IMAGE_FULL_PATH_LEN 260u

#define PROT_PROC_FLAG_NO_PATH 0x00000001

typedef struct _PROTECTED_PROCESS_INFO
{
    CHAR        ImageBaseNamePattern[IMAGE_BASE_NAME_LEN];

    struct
    {
        DWORD   Original;
        DWORD   Current;

        QWORD   Beta;
        QWORD   Feedback;
    } Protection;

    DWORD       Flags;
    PWCHAR      FullPathPattern;
    PWCHAR      FullNamePattern;
    QWORD       Context;

    LIST_ENTRY  Link;
} PROTECTED_PROCESS_INFO, *PPROTECTED_PROCESS_INFO;

typedef struct _WIN_UNEXPORTED_FUNCTION_PATTERN
{
    CHAR                SectionHint[8];
    PATTERN_SIGNATURE   Signature;
    DETOUR_ARGS         Arguments;
} WIN_UNEXPORTED_FUNCTION_PATTERN, *PWIN_UNEXPORTED_FUNCTION_PATTERN;


typedef struct _WIN_UNEXPORTED_FUNCTION
{
    DWORD                           NameHash;

    DWORD                           PatternsCount;
    _Field_size_(PatternsCount)
    WIN_UNEXPORTED_FUNCTION_PATTERN Patterns[0]; 
} WIN_UNEXPORTED_FUNCTION, *PWIN_UNEXPORTED_FUNCTION;

typedef enum
{
    winModNone = 0,  
    winModCore,      
    winModAntivirus, 
    winModCitrix,    
} PROTECTED_MODULE_TYPE;

typedef struct _PROTECTED_MODULE_INFO
{
    PROTECTED_MODULE_TYPE   Type;   
    const WCHAR             *Name;  
    const WCHAR             *Path;  
    const WCHAR             *DriverObject;

    QWORD                   RequiredFlags;
} PROTECTED_MODULE_INFO, *PPROTECTED_MODULE_INFO;

typedef enum
{
    FLAG_STATIC_DETECTION = 1,
    FLAG_DYNAMIC_DETECTION = 2,
} OBJ_DISCOVERY_TYPE;

typedef enum _WIN_UM_FIELD_DLL
{
    winUmFieldDllBaseOffsetInModule64 = 0,  
    winUmFieldDllBaseOffsetInModule32,      
    winUmFieldDllSizeOffsetInModule64,      
    winUmFieldDllSizeOffsetInModule32,      
    winUmFieldDllNameOffsetInModule64,      
    winUmFieldDllNameOffsetInModule32,      
    winUmFieldDllEnd
} WIN_UM_FIELD_DLL;

typedef enum _WIN_UM_FIELD_PEB
{
    winUmFieldPeb64Size = 0,    
    winUmFieldPeb32Size,        
    winUmFieldPebEnd
} WIN_UM_FIELD_PEB;

typedef enum _WIN_UM_FIELD_TEB
{
    winUmFieldTeb64Size = 0,            
    winUmFieldTeb32Size,                
    winUmFieldTebWow64SaveArea,
    winUmFieldTebWow64StackInSaveArea,
    winUmFieldTebEnd
} WIN_UM_FIELD_TEB;

typedef enum _WIN_KM_STRUCTURE
{
    winKmStructureProcess = 0,    
    winKmStructureThread,         
    winKmStructureDrvObj,         
    winKmStructurePcr,            
    winKmStructurePoolDescriptor, 
    winKmStructureMmpfn,          
    winKmStructureToken,          
    winKmStructureUngrouped,      
    winKmStructureEprocessFlags,  
    winKmStructureVadShort,       
    winKmStructureVadLong,        
    winKmStructureVadFlags,       
    winKmStructureSyscallNumbers, 
    winKmStructureFileObject,     
    winKmStructureEnd
} WIN_KM_STRUCTURE;

typedef enum _WIN_UM_STRUCTURE
{
    winUmStructureDll = 0,  
    winUmStructurePeb,      
    winUmStructureTeb,      
    winUmStructureEnd
} WIN_UM_STRUCTURE;

typedef enum _WIN_KM_FIELD_PROCESS
{
    winKmFieldProcessCr3 = 0,          
    winKmFieldProcessUserCr3,
    winKmFieldProcessKexecOptions,     
    winKmFieldProcessListEntry,        
    winKmFieldProcessName,             
    winKmFieldProcessSectionBase,      
    winKmFieldProcessId,               
    winKmFieldProcessParentPid,        
    winKmFieldProcessVadRoot,          
    winKmFieldProcessCreateTime,       
    winKmFieldProcessExitStatus,       
    winKmFieldProcessToken,            
    winKmFieldProcessObjectTable,      
    winKmFieldProcessPeb,              
    winKmFieldProcessThreadListHead,   
    winKmFieldProcessWoW64,            
    winKmFieldProcessFlags,            
    winKmFieldProcessFlags3,           
    winKmFieldProcessMitigationFlags,  
    winKmFieldProcessMitigationFlags2, 
    winKmFieldProcessDebugPort,        
    winKmFieldProcessSpare,

    winKmFieldProcessEnd
} WIN_KM_FIELD_PROCESS;

typedef enum _WIN_KM_FIELD_THREAD
{
    winKmFieldThreadProcess = 0,        
    winKmFieldThreadThreadListEntry,    
    winKmFieldThreadKernelStack,        
    winKmFieldThreadStackBase,          
    winKmFieldThreadStackLimit,         
    winKmFieldThreadState,              
    winKmFieldThreadWaitReason,         
    winKmFieldThreadAttachedProcess,    
    winKmFieldThreadTeb,                
    winKmFieldThreadId,                 
    winKmFieldThreadClientSecurity,     
    winKmFieldThreadTrapFrame,          
    winKmFieldThreadWin32StartAddress,  
    winKmFieldThreadPreviousMode,       
    winKmFieldThreadEnd
} WIN_KM_FIELD_THREAD;

typedef enum _WIN_KM_FIELD_DRVOBJ
{
    winKmFieldDrvObjSize = 0,
    winKmFieldDrvObjFiodispSize,
    winKmFieldDrvObjAllocationGap,
    winKmFieldDrvObjFiodisp,       
    winKmFieldDrvObjStart,         
    winKmFieldDrvObjEnd
} WIN_KM_FIELD_DRVOBJ;

typedef enum _WIN_KM_FIELD_PCR
{
    winKmFieldPcrCurrentThread = 0,         
    winKmFieldPcrUserTime,                  
    winKmFieldPcrPcrb,                      
    winKmFieldPcrPrcbInterruptObject,       
    winKmFieldPcrEnd
} WIN_KM_FIELD_PCR;

typedef enum _WIN_KM_FIELD_POOLDESCRIPTOR
{
    winKmFieldPoolDescriptorTotalBytes = 0, 
    winKmFieldPoolDescriptorNppSize,        
    winKmFieldPoolDescriptorEnd
} WIN_KM_FIELD_POOLDESCRIPTOR;

typedef enum _WIN_KM_FIELD_MMPFN
{
    winKmFieldMmpfnSize = 0,    
    winKmFieldMmpfnPte,         
    winKmFieldMmpfnRefCount,    
    winKmFieldMmpfnFlags,       

    winKmFieldMmpfnPaeSize,     
    winKmFieldMmpfnPaePte,      
    winKmFieldMmpfnPaeRefCount, 
    winKmFieldMmpfnPaeFlags,    
    winKmFieldMmpfnEnd
} WIN_KM_FIELD_MMPFN;

typedef enum _WIN_KM_FIELD_TOKEN
{
    winKmFieldTokenPrivs = 0,       
    winKmFieldTokenUserCount,       
    winKmFieldTokenRestrictedCount, 
    winKmFieldTokenUsers,           
    winKmFieldTokenRestrictedSids,  
    winKmFieldTokenEnd
} WIN_KM_FIELD_TOKEN;

typedef enum _WIN_KM_FIELD_UNGROUPED
{
    winKmFieldUngroupedCtlAreaFile = 0,         
    winKmFieldUngroupedHandleTableTableCode,    
    winKmFieldUngroupedHalIntCtrlType,          
    winKmFieldUngroupedWmiGetClockOffset,       
    winKmFieldUngroupedEtwDbgDataSiloOffset,    
    winKmFieldUngroupedEtwSignatureOffset,
    winKmFieldUngroupedSubsectionCtlArea,       
    winKmFieldUngroupedHalPerfCntFunctionOffset,
    winKmFieldUngroupedRspOffsetOnZwCall,
    winKmFieldUngroupedHalIntCtrlTypeMaxOffset, 
    winKmFieldUngroupedHalIntCtrlTypeMinOffset, 
    winKmFieldUngroupedSharedUserDataSize,      
    winKmFieldUngroupedEnd
} WIN_KM_FIELD_UNGROUPED;

typedef enum _WIN_KM_FIELD_EPROCESSFLAGS
{
    winKmFieldEprocessFlagsNoDebugInherit = 0, 
    winKmFieldEprocessFlagsExiting,            
    winKmFieldEprocessFlagsDelete,             
    winKmFieldEprocessFlags3Crashed,           
    winKmFieldEprocessFlagsVmDeleted,          
    winKmFieldEprocessFlagsHasAddrSpace,       
    winKmFieldEprocessFlagsOutSwapped,         
    winKmFieldEprocessFlagsEnd
} WIN_KM_FIELD_EPROCESSFLAGS;

typedef enum _WIN_KM_FIELD_VAD_SHORT
{
    winKmFieldVadShortParent = 0,
    winKmFieldVadShortLeft,
    winKmFieldVadShortRight,
    winKmFieldVadShortStartingVpn,
    winKmFieldVadShortStartingVpnHigh,
    winKmFieldVadShortEndingVpn,
    winKmFieldVadShortEndingVpnHigh,
    winKmFieldVadShortFlags,
    winKmFieldVadShortFlagsSize,
    winKmFieldVadShortVpnSize,
    winKmFieldVadShortSize,
    winKmFieldVadShortEnd
} WIN_KM_FIELD_VAD_SHORT;

typedef enum _WIN_KM_FIELD_VAD_LONG
{
    winKmFieldVadLongSubsection = 0,    
    winKmFieldVadLongEnd
} WIN_KM_FIELD_VAD_LONG;

typedef enum _WIN_KM_FIELD_VADFLAGS
{
    winKmFieldVadFlagsTypeShift = 0,
    winKmFieldVadFlagsTypeMask,

    winKmFieldVadFlagsProtectionShift,
    winKmFieldVadFlagsProtectionMask,

    winKmFieldVadFlagsNoChangeBit,

    winKmFieldVadFlagsPrivateFixupMask,

    winKmFieldVadFlagsDeleteInProgressMask,

    winKmFieldVadFlagsEnd
} WIN_KM_FIELD_VADFLAGS;

typedef enum _WIN_KM_FIELD_SYSCALL_NUMBERS
{
    winKmFieldSyscallNumbersNtWriteVirtualMemory = 0,   
    winKmFieldSyscallNumbersNtProtectVirtualMemory,     
    winKmFieldSyscallNumbersNtCreateThreadEx,           
    winKmFieldSyscallNumbersEnd
} WIN_KM_FIELD_SYSCALL_NUMBERS;

typedef enum _WIN_KM_FIELD_FILE_OBJECT
{
    winKmFieldFileObjectNameBuffer, 
    winKmFieldFileObjectNameLength, 
    winKmFieldFileObjectEnd
} WIN_KM_FIELD_FILE_OBJECT;

typedef struct _WIN_OPAQUE_FIELDS
{
    struct
    {
        DWORD Process[winKmFieldProcessEnd];
        DWORD Thread[winKmFieldThreadEnd];
        DWORD DrvObj[winKmFieldDrvObjEnd];
        DWORD Pcr[winKmFieldPcrEnd];
        DWORD PoolDescriptor[winKmFieldPoolDescriptorEnd];
        DWORD Mmpfn[winKmFieldMmpfnEnd];
        DWORD Token[winKmFieldTokenEnd];
        DWORD Ungrouped[winKmFieldUngroupedEnd];
        DWORD EprocessFlags[winKmFieldEprocessFlagsEnd];
        DWORD VadShort[winKmFieldVadShortEnd];
        DWORD VadLong[winKmFieldVadLongEnd];
        DWORD VadFlags[winKmFieldVadFlagsEnd];
        DWORD SyscallNumbers[winKmFieldSyscallNumbersEnd];
        DWORD FileObject[winKmFieldFileObjectEnd];
    } Km;

    struct
    {
        DWORD Dll[winUmFieldDllEnd];
        DWORD Peb[winUmFieldPebEnd];
        DWORD Teb[winUmFieldTebEnd];
    } Um;
} WIN_OPAQUE_FIELDS, *PWIN_OPAQUE_FIELDS;

#define WIN_KM_FIELD(Structure, Field) gWinGuest->OsSpecificFields.Km.Structure[winKmField##Structure##Field]

#define WIN_SYSCALL_NUMBER(Syscall) WIN_KM_FIELD(SyscallNumbers, Syscall)

#define WIN_UM_FIELD(Structure, Field) gWinGuest->OsSpecificFields.Um.Structure[winUmField##Structure##Field]

typedef struct _WIN_MODULE_UNIQUE_KEY
{
    DWORD ImageSize;        
    DWORD TimeDateStamp;    
} WIN_MODULE_UNIQUE_KEY, PWIN_MODULE_UNIQUE_KEY;

typedef enum
{
    winProductTypeNotYetLoaded, 
    winProductTypeWinNt,        
    winProductTypeLanManNt,     
    winProductTypeServer,       
    winProductTypeUnknown
} WIN_PRODUCT_TYPE;

typedef struct _WINDOWS_GUEST
{
    QWORD PsCreateSystemThread;         
    QWORD ExAllocatePoolWithTag;        
    QWORD ExFreePoolWithTag;            
    QWORD SyscallAddress;               
    DWORD NtBuildNumberValue;           
    QWORD KeServiceDescriptorTable;     
    QWORD Ssdt;                         
    DWORD NumberOfServices;             
    QWORD HalpInterruptControllerGva;   
    QWORD PropperSyscallGva;            

    PCHAR NtBuildLabString;             
    PCHAR VersionString;
    PCHAR ServerVersionString;

    WIN_PRODUCT_TYPE ProductType;       

    QWORD PsActiveProcessHead;          
    QWORD PsLoadedModuleList;           
    QWORD MmPfnDatabase;                
    QWORD ObpRootDirectoryObject;       
    QWORD DriverDirectory;              
    QWORD FileSystemDirectory;          

    BYTE *KernelBuffer;
    DWORD KernelBufferSize;             

    DWORD RemainingSections;            
    LIST_HEAD InitSwapHandles;          

    WIN_OPAQUE_FIELDS OsSpecificFields; 
} WINDOWS_GUEST, *PWINDOWS_GUEST;

typedef struct _WIN_INIT_SWAP
{
    LIST_ENTRY  Link;               
    void        *SwapHandle;       

    QWORD       VirtualAddress;     
    DWORD       Size;               
} WIN_INIT_SWAP, *PWIN_INIT_SWAP;

INTSTATUS
IntWinGuestNew(
    void
    );

INTSTATUS
IntWinGuestInit(
    void
    );

void
IntWinGuestUninit(
    void
    );

void
IntWinGuestCancelKernelRead(
    void
    );

INTSTATUS
IntWinGetVersionString(
    _In_ DWORD FullStringSize,
    _In_ DWORD VersionStringSize,
    _Out_ CHAR *FullString,
    _Out_ CHAR *VersionString
    );

#endif // _WINGUEST_H_