Bitdefender Hypervisor Memory Introspection
winhal.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
5 #ifndef _WINHAL_H_
6 #define _WINHAL_H_
7 
8 #include "introtypes.h"
9 
13 typedef struct _WIN_HAL_DATA
14 {
16  QWORD HalHeapAddress;
18  QWORD HalIntCtrlAddress;
20  QWORD HalPerfCounterAddress;
22  DWORD HalHeapSize;
23 
25  QWORD HalDispatchTableAddress;
27  DWORD HalDispatchTableSize;
28 
30  KERNEL_DRIVER *OwnerHalModule;
31 
33  void *HalHeapExecHook;
35  void *HalIntCtrlWriteHook;
37  void *HalDispatchIntegrityHook;
38 
45  BYTE *HalBuffer;
46 
48  DWORD HalBufferSize;
49 
51  DWORD RemainingSections;
52 
55  LIST_ENTRY InitSwapHandles;
56 
59  void *HalHdrSwapHandle;
60 
62  void *HalPerfIntegrityObj;
63 } WIN_HAL_DATA, *PWIN_HAL_DATA;
64 
65 
66 INTSTATUS
67 IntWinHalCreateHalData(
68  void
69  );
70 
71 void
72 IntWinHalUninit(
73  void
74  );
75 
76 INTSTATUS
77 IntWinHalUpdateProtection(
78  void
79  );
80 
81 INTSTATUS
82 IntWinHalProtectHalHeapExecs(
83  void
84  );
85 
86 INTSTATUS
87 IntWinHalProtectHalIntCtrl(
88  void
89  );
90 
91 INTSTATUS
92 IntWinHalProtectHalDispatchTable(
93  void
94  );
95 
96 INTSTATUS
97 IntWinHalUnprotectHalHeapExecs(
98  void
99  );
100 
101 INTSTATUS
102 IntWinHalUnprotectHalIntCtrl(
103  void
104  );
105 
106 INTSTATUS
107 IntWinHalUnprotectHalDispatchTable(
108  void
109  );
110 
111 INTSTATUS
112 IntWinHalProtectHalPerfCounter(
113  void
114  );
115 
116 INTSTATUS
117 IntWinHalUnprotectHalPerfCounter(
118  void
119  );
120 
121 #endif // _WINHAL_H_
_WIN_HAL_DATA::HalHdrSwapHandle
void * HalHdrSwapHandle
HAL headers swap handle. Used only if HAL is not protected, and the headers are not read automaticall...
Definition: winhal.h:59
IntWinHalUnprotectHalHeapExecs
INTSTATUS IntWinHalUnprotectHalHeapExecs(void)
Deactivates the HAL heap execution protection.
Definition: winhal.c:812
PWIN_HAL_DATA
struct _WIN_HAL_DATA * PWIN_HAL_DATA
BYTE
uint8_t BYTE
Definition: intro_types.h:47
IntWinHalProtectHalIntCtrl
INTSTATUS IntWinHalProtectHalIntCtrl(void)
Protects the HAL interrupt controller against writes.
Definition: winhal.c:837
_WIN_HAL_DATA::HalPerfIntegrityObj
void * HalPerfIntegrityObj
The HAL Performance Counter integrity hook object.
Definition: winhal.h:62
IntWinHalCreateHalData
INTSTATUS IntWinHalCreateHalData(void)
Initializes gHalData.
Definition: winhal.c:2270
_WIN_HAL_DATA::InitSwapHandles
LIST_ENTRY InitSwapHandles
A list containing the swap handles for the swapped out sections which should be read in HalBuffer...
Definition: winhal.h:55
IntWinHalUninit
void IntWinHalUninit(void)
Frees any resources held by gHalData and removes all the HAL protections.
Definition: winhal.c:2479
INTSTATUS
int INTSTATUS
The status data type.
Definition: introstatus.h:24
_KERNEL_DRIVER
Describes a kernel driver.
Definition: drivers.h:30
IntWinHalProtectHalDispatchTable
INTSTATUS IntWinHalProtectHalDispatchTable(void)
Activates the HAL dispatch table protection.
Definition: winhal.c:914
_WIN_HAL_DATA::HalBufferSize
DWORD HalBufferSize
The size of HAL buffer.
Definition: winhal.h:48
_WIN_HAL_DATA::HalIntCtrlWriteHook
void * HalIntCtrlWriteHook
The HAL interrupt controller write hook object.
Definition: winhal.h:35
IntWinHalUnprotectHalDispatchTable
INTSTATUS IntWinHalUnprotectHalDispatchTable(void)
Deactivates the HAL dispatch table protection.
Definition: winhal.c:957
_WIN_HAL_DATA::HalHeapSize
DWORD HalHeapSize
The size of the HAL heap.
Definition: winhal.h:22
_WIN_HAL_DATA::HalDispatchIntegrityHook
void * HalDispatchIntegrityHook
The HAL dispatch table integrity hook object.
Definition: winhal.h:37
QWORD
unsigned long long QWORD
Definition: intro_types.h:53
_WIN_HAL_DATA::RemainingSections
DWORD RemainingSections
The number of sections which are not yet read into HAL buffer.
Definition: winhal.h:51
_WIN_HAL_DATA::HalBuffer
BYTE * HalBuffer
A buffer containing the whole HAL image.
Definition: winhal.h:45
WIN_HAL_DATA
struct _WIN_HAL_DATA WIN_HAL_DATA
Hal information.
IntWinHalUnprotectHalIntCtrl
INTSTATUS IntWinHalUnprotectHalIntCtrl(void)
Deactivates the HAL interrupt controller write protection.
Definition: winhal.c:889
_WIN_HAL_DATA::HalHeapAddress
QWORD HalHeapAddress
The guest virtual address of the HAL heap.
Definition: winhal.h:16
DWORD
uint32_t DWORD
Definition: intro_types.h:49
_WIN_HAL_DATA::HalDispatchTableSize
DWORD HalDispatchTableSize
The size of the HAL dispatch table.
Definition: winhal.h:27
_WIN_HAL_DATA::OwnerHalModule
KERNEL_DRIVER * OwnerHalModule
The hal.dll kernel module or ntoskrnl.exe.
Definition: winhal.h:30
IntWinHalUpdateProtection
INTSTATUS IntWinHalUpdateProtection(void)
Updates any of the HAL protections.
Definition: winhal.c:2405
_WIN_HAL_DATA::HalDispatchTableAddress
QWORD HalDispatchTableAddress
The guest virtual address of the HAL dispatch table.
Definition: winhal.h:25
_WIN_HAL_DATA::HalIntCtrlAddress
QWORD HalIntCtrlAddress
The guest virtual address of the HAL interrupt controller.
Definition: winhal.h:18
IntWinHalProtectHalPerfCounter
INTSTATUS IntWinHalProtectHalPerfCounter(void)
Enables protection on HalPerformanceCounter function pointer.
Definition: winhal.c:989
_WIN_HAL_DATA
Hal information.
Definition: winhal.h:13
_WIN_HAL_DATA::HalHeapExecHook
void * HalHeapExecHook
The HAL heap execution hook object.
Definition: winhal.h:33
IntWinHalUnprotectHalPerfCounter
INTSTATUS IntWinHalUnprotectHalPerfCounter(void)
Removes the protection on HalPerformanceCounter.
Definition: winhal.c:1035
_WIN_HAL_DATA::HalPerfCounterAddress
QWORD HalPerfCounterAddress
The guest virtual address of the HAL performance counter.
Definition: winhal.h:20
IntWinHalProtectHalHeapExecs
INTSTATUS IntWinHalProtectHalHeapExecs(void)
Hooks the HAL heap against execution.
Definition: winhal.c:718
_LIST_ENTRY
Definition: introlists.h:16