winidt.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "winidt.h"
#include "alerts.h"
#include "hook.h"


static INTSTATUS
IntWinIdtSendIntegrityAlert(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_KM_ORIGINATOR *Originator,
    _In_ INTRO_ACTION Action,
    _In_ INTRO_ACTION_REASON Reason
    )
{
    INTSTATUS status;
    EVENT_INTEGRITY_VIOLATION *pEvent;

    pEvent = &gAlert.Integrity;
    memzero(pEvent, sizeof(*pEvent));

    pEvent->BaseAddress = Victim->Integrity.StartVirtualAddress;
    pEvent->VirtualAddress = Victim->Integrity.StartVirtualAddress + Victim->Integrity.Offset;
    pEvent->Size = gGuest.Guest64 ? IDT_DESC_SIZE64 : IDT_DESC_SIZE32;
    pEvent->Victim.IdtEntry = (BYTE)(Victim->Integrity.Offset / pEvent->Size);
    pEvent->Victim.Type = introObjectTypeIdt;

    // No valid CPU context and no valid current process can be obtained for this, as it is
    // an integrity alert.
    pEvent->Header.CpuContext.Valid = FALSE;
    pEvent->Header.CurrentProcess.Valid = FALSE;

    pEvent->Header.Flags = IntAlertCoreGetFlags(INTRO_OPT_PROT_KM_IDT, Reason);
    pEvent->Header.Flags |= ALERT_FLAG_ASYNC;

    pEvent->Header.Action = Action;
    pEvent->Header.Reason = Reason;
    pEvent->Header.MitreID = idRootkit;

    memcpy(pEvent->Victim.Name, VICTIM_IDT, sizeof(VICTIM_IDT));

    IntAlertFillWriteInfo(Victim, &pEvent->WriteInfo);

    IntAlertFillWinKmModule(Originator->Original.Driver, &pEvent->Originator.Module);

    IntAlertFillVersionInfo(&pEvent->Header);

    status = IntNotifyIntroEvent(introEventIntegrityViolation, pEvent, sizeof(*pEvent));
    if (!INT_SUCCESS(status))
    {
        WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
    }

    return INT_STATUS_SUCCESS;
}

static INTSTATUS
IntWinIdtHandleModification(
    _Inout_ INTEGRITY_REGION *IntegrityRegion
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;
    BOOLEAN recalculate = FALSE;

    STATS_ENTER(statsExceptionsKern);

    // Search for modifications
    for (DWORD offset = 0; offset < IntegrityRegion->Length;)
    {
        EXCEPTION_VICTIM_ZONE victim = { 0 };
        EXCEPTION_KM_ORIGINATOR originator = { 0 };
        INTRO_ACTION action = introGuestNotAllowed;
        INTRO_ACTION_REASON reason = introReasonUnknown;

        status = IntExceptGetVictimIntegrity(IntegrityRegion, &offset, &victim);
        if (INT_STATUS_NOT_FOUND == status)
        {
            // We are done with the modifications, so exit
            status = INT_STATUS_SUCCESS;
            break;
        }
        else if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed getting integrity zone: 0x%08x\n", status);
            break;
        }

        status = IntExceptGetOriginatorFromModification(&victim, &originator);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed getting originator: 0x%08x\n", status);
            break;
        }

        IntExcept(&victim, &originator, exceptionTypeKm, &action, &reason, introEventIntegrityViolation);

        if (IntPolicyCoreTakeAction(INTRO_OPT_PROT_KM_IDT, &action, &reason))
        {
            IntWinIdtSendIntegrityAlert(&victim, &originator, action, reason);
        }

        if (IntPolicyCoreForceBetaIfNeeded(INTRO_OPT_PROT_KM_IDT, &action))
        {
            reason = introReasonAllowed;
        }

        if (action == introGuestAllowed)
        {
            recalculate = TRUE;
        }
        else if (action == introGuestNotAllowed)
        {
            IntPauseVcpus();

            status = IntKernVirtMemWrite(IntegrityRegion->Gva + victim.Integrity.Offset,
                                         victim.WriteInfo.AccessSize,
                                         (BYTE *)IntegrityRegion->OriginalContent + victim.Integrity.Offset);
            IntResumeVcpus();

            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntKernVirtMemWrite failed for gva 0x%016llx: 0x%08x\n",
                      IntegrityRegion->Gva + victim.Integrity.Offset, status);
                goto cleanup_and_exit;
            }
        }
    }

    if (recalculate)
    {
        IntIntegrityRecalculate(IntegrityRegion);
    }

cleanup_and_exit:
    STATS_EXIT(statsExceptionsKern);

    return status;
}


_Function_class_(PFUNC_EptViolationCallback)
static INTSTATUS
IntWinIdtWriteHandler(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    )
{
    INTSTATUS status;
    EXCEPTION_VICTIM_ZONE victim;
    EXCEPTION_KM_ORIGINATOR originator;
    INTRO_ACTION_REASON reason;
    QWORD idtBase;
    QWORD idtLimit;

    UNREFERENCED_PARAMETER(Context);
    UNREFERENCED_PARAMETER(Hook);
    UNREFERENCED_PARAMETER(Address);

    if (NULL == Action)
    {
        return INT_STATUS_INVALID_PARAMETER_4;
    }

    status = IntGuestGetIdtFromGla(gVcpu->Gla, &idtBase, &idtLimit);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntGuestGetIdtFromGla failed: 0x%08x, the write on 0x%016llx "
              "(gpa 0x%016llx) from cpu %d seems to be outside any idt!\n",
              status, gVcpu->Gla, gVcpu->Gpa, gVcpu->Index);

        *Action = introGuestAllowed;

        return INT_STATUS_NOT_NEEDED_HINT;
    }

    *Action = introGuestNotAllowed;
    reason = introReasonUnknown;

    STATS_ENTER(statsExceptionsKern);

    memzero(&victim, sizeof(victim));
    memzero(&originator, sizeof(originator));

    status = IntExceptKernelGetOriginator(&originator, 0);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed getting originator: 0x%08x\n", status);
        reason = introReasonInternalError;
    }

    status = IntExceptGetVictimEpt(&idtBase,
                                   gVcpu->Gpa,
                                   gVcpu->Gla,
                                   introObjectTypeIdt,
                                   ZONE_WRITE,
                                   &victim);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed getting zone details: 0x%08x\n", status);
        reason = introReasonInternalError;
    }

    IntExcept(&victim, &originator, exceptionTypeKm, Action, &reason, introEventEptViolation);

    STATS_EXIT(statsExceptionsKern);

    if (IntPolicyCoreTakeAction(INTRO_OPT_PROT_KM_IDT, Action, &reason))
    {
        PEVENT_EPT_VIOLATION pEptViol = &gAlert.Ept;
        memzero(pEptViol, sizeof(*pEptViol));

        pEptViol->Header.Action = *Action;
        pEptViol->Header.Reason = reason;
        pEptViol->Header.MitreID = idRootkit;

        pEptViol->Header.Flags = IntAlertCoreGetFlags(INTRO_OPT_PROT_KM_IDT, reason);

        IntAlertFillCpuContext(TRUE, &pEptViol->Header.CpuContext);

        if (originator.Original.Driver)
        {
            IntAlertFillWinKmModule(originator.Original.Driver, &pEptViol->Originator.Module);
        }
        if (originator.Return.Driver)
        {
            IntAlertFillWinKmModule(originator.Return.Driver, &pEptViol->Originator.ReturnModule);
        }

        IntAlertEptFillFromVictimZone(&victim, pEptViol);

        IntAlertFillWinProcessByCr3(gVcpu->Regs.Cr3, &pEptViol->Header.CurrentProcess);

        IntAlertFillCodeBlocks(originator.Original.Rip, gVcpu->Regs.Cr3, FALSE, &pEptViol->CodeBlocks);
        IntAlertFillExecContext(0, &pEptViol->ExecContext);

        IntAlertFillVersionInfo(&pEptViol->Header);

        status = IntNotifyIntroEvent(introEventEptViolation, pEptViol, sizeof(*pEptViol));
        if (!INT_SUCCESS(status))
        {
            WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
        }
    }

    IntPolicyCoreForceBetaIfNeeded(INTRO_OPT_PROT_KM_IDT, Action);

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinIdtProtectOnCpuEpt(
    _In_ DWORD CpuNumber
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;
    DWORD size;

    if (gGuest.VcpuArray[CpuNumber].IdtHookObject != NULL)
    {
        return INT_STATUS_ALREADY_INITIALIZED_HINT;
    }

    TRACE("[HOOK] Adding IDT protection (EPT) on CPU %d at 0x%016llx (limit 0x%x)...\n",
          CpuNumber, gGuest.VcpuArray[CpuNumber].IdtBase, gGuest.VcpuArray[CpuNumber].IdtLimit);

    status = IntHookObjectCreate(introObjectTypeIdt, 0, &gGuest.VcpuArray[CpuNumber].IdtHookObject);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookObjectCreate failed: 0x%08x\n", status);
        return status;
    }

    size = MIN((gGuest.Guest64 ? DESCRIPTOR_SIZE_64 : DESCRIPTOR_SIZE_32) * 0x20,
               gGuest.VcpuArray[CpuNumber].IdtLimit + 1);

    status = IntHookObjectHookRegion(gGuest.VcpuArray[CpuNumber].IdtHookObject,
                                     0,
                                     gGuest.VcpuArray[CpuNumber].IdtBase,
                                     size,
                                     IG_EPT_HOOK_WRITE,
                                     IntWinIdtWriteHandler,
                                     NULL,
                                     0,
                                     NULL);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed hooking IDT at 0x%016llx for CPU %d: 0x%08x\n",
              gGuest.VcpuArray[CpuNumber].IdtBase, CpuNumber, status);
        return status;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinIdtProtectOnCpuIntegrity(
    _In_ DWORD CpuNumber
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;
    DWORD size;

    if (gGuest.VcpuArray[CpuNumber].IdtIntegrityObject != NULL)
    {
        return INT_STATUS_ALREADY_INITIALIZED_HINT;
    }

    TRACE("[HOOK] Adding IDT protection (Integrity) on CPU %d at 0x%016llx (limit 0x%x)...\n",
          CpuNumber, gGuest.VcpuArray[CpuNumber].IdtBase, gGuest.VcpuArray[CpuNumber].IdtLimit);

    size = MIN((gGuest.Guest64 ? DESCRIPTOR_SIZE_64 : DESCRIPTOR_SIZE_32) * 0x20,
               gGuest.VcpuArray[CpuNumber].IdtLimit + 1);

    status = IntIntegrityAddRegion(gGuest.VcpuArray[CpuNumber].IdtBase,
                                   size,
                                   introObjectTypeIdt,
                                   NULL,
                                   IntWinIdtHandleModification,
                                   TRUE,
                                   &gGuest.VcpuArray[CpuNumber].IdtIntegrityObject);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed to add IDT to integrity checks: 0x%08x\n", status);
        return status;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinIdtUnprotectOnCpuEpt(
    _In_ DWORD CpuNumber
    )
{
    INTSTATUS status;

    if (gGuest.VcpuArray[CpuNumber].IdtHookObject == NULL)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    TRACE("[HOOK] Removing IDT protection (EPT) on CPU %d at 0x%016llx...\n", CpuNumber,
          gGuest.VcpuArray[CpuNumber].IdtBase);

    status = IntHookObjectDestroy((HOOK_OBJECT_DESCRIPTOR **)&gGuest.VcpuArray[CpuNumber].IdtHookObject, 0);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed removing idt hook object: 0x%08x\n", status);
        return status;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinIdtUnprotectOnCpuIntergity(
    _In_ DWORD CpuNumber
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;

    if (gGuest.VcpuArray[CpuNumber].IdtIntegrityObject == NULL)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    TRACE("[HOOK] Removing IDT protection (Integrity) on CPU %d at 0x%016llx...\n",
          CpuNumber, gGuest.VcpuArray[CpuNumber].IdtBase);

    status = IntIntegrityRemoveRegion(gGuest.VcpuArray[CpuNumber].IdtIntegrityObject);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntIntegrityRemoveRegion failed: 0x%08x\n", status);
        return status;
    }

    gGuest.VcpuArray[CpuNumber].IdtIntegrityObject = NULL;

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinIdtProtectOnCpu(
    _In_ DWORD CpuNumber
    )
{
    if (CpuNumber >= gGuest.CpuCount)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    if (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, gGuest.VcpuArray[CpuNumber].IdtBase))
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    // Windows version >= 16299
    if (gGuest.OSVersion >= 16299 && gGuest.Guest64)
    {
        return IntWinIdtProtectOnCpuEpt(CpuNumber);
    }
    else
    {
        return IntWinIdtProtectOnCpuIntegrity(CpuNumber);
    }
}


INTSTATUS
IntWinIdtUnprotectOnCpu(
    _In_ DWORD CpuNumber
    )
{
    if (CpuNumber >= gGuest.CpuCount)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    if (!IS_KERNEL_POINTER_WIN(gGuest.Guest64, gGuest.VcpuArray[CpuNumber].IdtBase))
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if (gGuest.OSVersion >= 16299 && gGuest.Guest64)
    {
        return IntWinIdtUnprotectOnCpuEpt(CpuNumber);
    }
    else
    {
        return IntWinIdtUnprotectOnCpuIntergity(CpuNumber);
    }
}


INTSTATUS
IntWinIdtProtectAll(
    void
    )
{
    DWORD i;
    INTSTATUS status;
    INTSTATUS failStatus;

    // In case there are no CPU's (which is never!)
    failStatus = INT_STATUS_NOT_NEEDED_HINT;

    for (i = 0; i < gGuest.CpuCount; i++)
    {
        status = IntWinIdtProtectOnCpu(i);
        if (!INT_SUCCESS(status))
        {
            failStatus = status;
            continue;
        }
    }

    return failStatus;
}


INTSTATUS
IntWinIdtUnprotectAll(
    void
    )
{
    DWORD i;
    INTSTATUS status;
    INTSTATUS failStatus;

    // In case there are no CPU's (which is never!)
    failStatus = INT_STATUS_NOT_NEEDED_HINT;

    for (i = 0; i < gGuest.CpuCount; i++)
    {
        status = IntWinIdtUnprotectOnCpu(i);
        if (!INT_SUCCESS(status))
        {
            failStatus = status;
            continue;
        }
    }

    return failStatus;
}