Bitdefender Hypervisor Memory Introspection
|
Windows detour descriptors. More...
#include "introcore.h"
#include "winbugcheck.h"
#include "winpool.h"
#include "winpower.h"
#include "winthread.h"
#include "winumcrash.h"
#include "winvad.h"
#include "drivers.h"
Go to the source code of this file.
Variables | |
API_HOOK_DESCRIPTOR | gHookableApisX86 [] |
The functions to be hooked for 32-bit Windows guests. More... | |
const size_t | gHookableApisX86Size = ARRAYSIZE(gHookableApisX86) |
The number of functions to be hooked for 32-bit Windows guests. More... | |
API_HOOK_DESCRIPTOR | gHookableApisX64 [] |
The functions to be hooked for 64-bit Windows guests. More... | |
const size_t | gHookableApisX64Size = ARRAYSIZE(gHookableApisX64) |
The number of functions to be hooked for 64-bit Windows guests. More... | |
Windows detour descriptors.
This file contains the descriptors for all the detours introcore will set on Windows kernel functions.
Each descriptor is a API_HOOK_DESCRIPTOR structure and contains the information needed in order to properly set the hook.
If a detour uses the hypercall type hypercallTypeInt3 it must have a INT3 instruction (0xCC) in its handler and set API_HOOK_HANDLER.HypercallOffset to the offset at which the INT3 is found. If a detour uses the hypercall type hypercallTypeVmcall it must have a VMCALL instruction (0x0F 0x01 0xC1) and set API_HOOK_HANDLER.HypercallOffset to the offset at which the VMCALL is found. In addition to this, the handler must set RAX = 34, RDI = 24, RSI = 0 for 64-bit guests and EAX = 34, EBX = 24, ECX = 0 for 32-bit guests, otherwise the VMCALL may not be recognized by the hypervisor (Xen will inject a general protection fault inside the guest, for example). Usually, there is no reason to use VMCALL as the hypercall for a function detour and INT3 is recommended.
Check the documentation of individual detour handlers for details about those.
Convention for documenting the assembly code:
Definition in file winhkhnd.c.
API_HOOK_DESCRIPTOR gHookableApisX64[] |
The functions to be hooked for 64-bit Windows guests.
Definition at line 1816 of file winhkhnd.c.
Referenced by IntWinApiHookAll(), IntWinApiUpdateHookDescriptor(), and IntWinApiUpdateHooks().
const size_t gHookableApisX64Size = ARRAYSIZE(gHookableApisX64) |
The number of functions to be hooked for 64-bit Windows guests.
Definition at line 4992 of file winhkhnd.c.
Referenced by IntWinApiHookAll(), IntWinApiUpdateHookDescriptor(), and IntWinApiUpdateHooks().
API_HOOK_DESCRIPTOR gHookableApisX86[] |
The functions to be hooked for 32-bit Windows guests.
Definition at line 61 of file winhkhnd.c.
Referenced by IntWinApiHookAll(), IntWinApiUpdateHookDescriptor(), and IntWinApiUpdateHooks().
const size_t gHookableApisX86Size = ARRAYSIZE(gHookableApisX86) |
The number of functions to be hooked for 32-bit Windows guests.
Definition at line 1809 of file winhkhnd.c.
Referenced by IntWinApiHookAll(), IntWinApiUpdateHookDescriptor(), and IntWinApiUpdateHooks().