41 #define WMI_PTR_MASK 0xFFFFFFFFFFFFFFFE 126 QWORD currentCpuGetClock = 0;
141 ERROR(
"[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
162 ERROR(
"[ERROR] IntWinInfHookIntegrityHandleWrite failed: 0x%08x\n", status);
188 ERROR(
"[ERROR] IntWinInfHookIntegrityHandleWrite failed: 0x%08x\n", status);
205 ERROR(
"[ERROR] IntKernVirtMemWrite failed: 0x%08x\n", status);
247 memzero(pEptViol,
sizeof(*pEptViol));
270 WARNING(
"[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
306 exitAfterInformation =
TRUE;
310 ERROR(
"[ERROR] Failed getting originator: 0x%08x\n", status);
312 exitAfterInformation =
TRUE;
324 ERROR(
"[ERROR] Failed getting zone details: 0x%08x\n", status);
325 exitAfterInformation =
TRUE;
328 if (exitAfterInformation)
343 LOG(
"[INFINITY-HOOK] Detected modification of WMI_LOGGER_CONTEXT.GetCpuClock. Rip: 0x%016llx\n",
383 TRACE(
"[SPP WMI STATS] Total writes: 0x%016llx, interesting: 0x%016llx\n",
389 ERROR(
"[ERROR] IntWinInfHookEptSppHandleWrite failed: 0x%08x\n", status);
426 if (gLoggerCtxState.
WmiTotal % 1000 == 0)
428 LOG(
"[SPP WMI STATS] Total writes: 0x%016llx, interesting: 0x%016llx\n", gLoggerCtxState.
WmiTotal,
454 LOG(
"[INFO] Request to hook logger CTX 0x%016llx through SPP\n", gLoggerCtxState.
WmiLoggerCtx);
463 ERROR(
"[ERROR] IntHookObjectCreate failed: 0x%08x\n", status);
478 ERROR(
"[ERROR] IntHookObjectHookRegion failed: 0x%08x\n", status);
482 LOG(
"[INFO] Successfully hooked logger CTX 0x%016llx\n", gLoggerCtxState.
WmiLoggerCtx);
485 #ifdef OPT_SET_WMI_SPP_STATS 492 ERROR(
"[ERROR] IntHookObjectCreate failed: 0x%08x\n", status);
507 ERROR(
"[ERROR] IntHookObjectHookRegion failed: 0x%08x\n", status);
556 LOG(
"[SPP SILO WMI] Ptr changed, total: 0x%016llx, interesting: 0x%016llx\n", gLoggerCtxState.
SiloTotal,
562 ERROR(
"[ERROR] IntDecGetWrittenValueFromInstruction failed: 0x%08x\n", status);
573 LOG(
"[INFO] WMI_LOGGER_CONTEXT relocated from 0x%016llx to 0x%016llx (ptr 0x%016llx)\n",
581 ERROR(
"[ERROR] IntHookObjectDestroy failed: 0x%08x\n", status);
591 ERROR(
"[ERROR] IntHookObjectDestroy failed: 0x%08x\n", status);
600 goto _allow_and_exit;
616 WARNING(
"[WARNING] IntWinInfCheckCtxLoggerOnRelocation failed: 0x%08x\n", status);
617 goto _allow_and_exit;
622 LOG(
"[INFO] WMI_LOGGER_CONTEXT relocated from kernel, RIP 0x%016llx, we'll trust it\n",
gVcpu->
Regs.
Rip);
628 ERROR(
"[ERROR] IntWinInfHookHookSppWmiGetClock failed: 0x%08x\n", status);
671 if (gLoggerCtxState.
SiloTotal % 1000 == 0)
673 LOG(
"[SPP SILO WMI] Silo changed, total: 0x%016llx, interesting: 0x%016llx\n",
716 ERROR(
"[ERROR] IntHookObjectCreate failed: 0x%08x\n", status);
731 ERROR(
"[ERROR] IntHookObjectHookRegion failed: 0x%08x\n", status);
735 #ifdef OPT_SET_WMI_SPP_STATS 740 ERROR(
"[ERROR] IntHookObjectCreate failed: 0x%08x\n", status);
755 ERROR(
"[ERROR] IntHookObjectHookRegion failed: 0x%08x\n", status);
760 LOG(
"[INFO] Successfully hooked silo ptr\n");
799 memzero(pIntViol,
sizeof(*pIntViol));
801 pIntViol->
BaseAddress = Victim->Integrity.StartVirtualAddress;
802 pIntViol->
VirtualAddress = Victim->Integrity.StartVirtualAddress + Victim->Integrity.Offset;
804 pIntViol->
Size = Victim->Integrity.TotalLength;
840 WARNING(
"[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
897 if (NULL != IntegrityRegion)
902 ERROR(
"[ERROR] Failed getting integrity zone: 0x%08x\n", status);
904 exitAfterInformation =
TRUE;
928 exitAfterInformation =
TRUE;
932 ERROR(
"[ERROR] Failed getting originator: 0x%08x\n", status);
934 exitAfterInformation =
TRUE;
937 if (exitAfterInformation)
961 _In_ void *IntegrityRegion
973 QWORD getCpuClock = 0;
982 ERROR(
"[ERROR] IntKernVirtMemRead failed for 0x%016llx: 0x%08x\n",
994 IntegrityRegion, &action);
997 ERROR(
"[ERROR] IntWinInfHookIntegrityHandleWrite failed: 0x%08x\n", status);
1008 LOG(
"[ROOTKIT] Change of GetCpuClock: New value: 0x%016llx Old value: 0x%016llx\n", getCpuClock,
1018 ERROR(
"[ERROR] IntKernVirtMemWrite failed: 0x%08x\n", status);
1030 _In_ void *IntegrityRegion
1056 QWORD wmiLoggerCtx = 0;
1064 ERROR(
"[ERROR] IntIntegrityRemoveRegion failed: 0x%08x\n", status);
1074 ERROR(
"[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
1081 shouldSkipHook = (wmiLoggerCtx & 1) || wmiLoggerCtx == 0;
1085 LOG(
"[INFO] WMI_LOGGER_CONTEXT relocated from 0x%016llx to %016llx (shouldSkipHook: %s)\n",
1086 gLoggerCtxState.
WmiLoggerCtx, wmiLoggerCtx, shouldSkipHook ?
"TRUE" :
"FALSE");
1097 goto _recalculate_and_exit;
1107 WARNING(
"[WARNING] IntWinInfCheckCtxLoggerOnRelocation failed: 0x%08x\n", status);
1108 goto _recalculate_and_exit;
1120 ERROR(
"[ERROR] IntIntegrityAddRegion failed: 0x%08x\n", status);
1124 _recalculate_and_exit:
1166 DWORD etwpDbgDataRva = 0;
1167 QWORD etwpDbgDataGva;
1181 memcpy(pattern.
SectionHint,
".rdata",
sizeof(
".rdata"));
1184 &pattern,
FALSE, &etwpDbgDataRva);
1189 &pattern,
TRUE, &etwpDbgDataRva);
1192 ERROR(
"[ERROR] IntPeFindFunctionByPattern failed: 0x%08x\n", status);
1205 LOG(
"[INFO] Found EtwpDebuggerData at RVA 0x%08x -> ptr at 0x%016llx\n", etwpDbgDataRva, etwpDbgDataGva);
1209 *EtwpDebuggerData = etwpDbgDataGva;
1253 ERROR(
"[ERROR] IntDecGetWrittenValueFromInstruction failed: 0x%08x\n", status);
1268 ERROR(
"[ERROR] IntHookGvaRemoveHook failed: 0x%08x\n", status);
1299 QWORD etwpDbgDataGva = 0;
1300 QWORD etwpDbgDataSiloPtrGva;
1301 QWORD etwpDbgDataSilo = 0;
1302 QWORD ctxLoggerPtrGva;
1303 QWORD ctxLoggerGva = 0;
1308 ERROR(
"[ERROR] IntWinInfHookGetEtwpDebuggerData failed: 0x%08x\n", status);
1312 etwpDbgDataSiloPtrGva = etwpDbgDataGva +
WIN_KM_FIELD(Ungrouped, EtwDbgDataSiloOffset);
1317 ERROR(
"[ERROR] IntKernVirtMemRead failed for 0x%016llx: 0x%08x\n", etwpDbgDataSiloPtrGva, status);
1321 if (0 == etwpDbgDataSilo)
1326 LOG(
"[INFO] EtwpDbgDataSilo is 0, will hook for write and init afterwards...\n");
1329 etwpDbgDataSiloPtrGva,
1339 ERROR(
"[ERROR] IntHookGvaSetHook failed: 0x%08x\n", status);
1343 *KernelCtxLogger = 0;
1348 LOG(
"[INFO] Found EtwpDebuggerDataSilo at 0x%016llx -> Logger Ctx Ptr GVA at 0x%016llx\n",
1349 etwpDbgDataSilo, ctxLoggerPtrGva);
1356 ERROR(
"[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
1360 LOG(
"[INFO] Found ctx wmi logger GVA: 0x%016llx\n", ctxLoggerGva);
1362 *KernelCtxLogger = ctxLoggerGva;
1388 QWORD wmiLoggerCtx = 0;
1389 QWORD getCpuClock = 0;
1396 ERROR(
"[ERROR] IntWinInfHookGetCircularCtxLogger failed: 0x%08x\n", status);
1401 *GetCpuClockGva = 0;
1403 if (NULL != WmiLoggerCtx)
1411 if ((wmiLoggerCtx & 1) || (wmiLoggerCtx &
WMI_PTR_MASK) == 0)
1420 ERROR(
"[ERROR] IntKernVirtMemRead failed for 0x%016llx: 0x%08x\n",
1421 wmiLoggerCtx +
WIN_KM_FIELD(Ungrouped, WmiGetClockOffset), status);
1425 LOG(
"[INFO] GetCpuClock() at 0x%016llx\n", getCpuClock);
1430 WARNING(
"[WARNING] GetCpuClock does not reside inside the kernel!\n");
1439 *GetCpuClockGva = getCpuClock;
1441 if (NULL != WmiLoggerCtx)
1443 *WmiLoggerCtx = wmiLoggerCtx;
1476 QWORD getCpuClock = 0;
1477 QWORD wmiLoggerCtx = 0;
1505 ERROR(
"[ERROR] IntWinInfHookGetWmiLoggerGetCpuClock failed: 0x%08x\n", status);
1506 goto cleanup_and_exit;
1521 ERROR(
"[ERROR] IntWinInfHookSppHookWmiSiloPtr failed: 0x%08x\n", status);
1522 goto cleanup_and_exit;
1529 WARNING(
"[WARNING] IntWinInfCheckCtxLoggerOnRelocation failed: 0x%08x\n", status);
1530 goto _skip_hooking_spp;
1536 ERROR(
"[ERROR] IntWinInfHookHookSppWmiGetClock failed: 0x%08x\n", status);
1537 goto cleanup_and_exit;
1549 ERROR(
"[ERROR] Wmi integrity hook already initialized! %p %p\n",
1553 goto cleanup_and_exit;
1565 ERROR(
"[ERROR] IntIntegrityAddRegion failed: 0x%08x\n", status);
1566 goto cleanup_and_exit;
1573 WARNING(
"[WARNING] IntWinInfCheckCtxLoggerOnRelocation failed: 0x%08x\n", status);
1587 ERROR(
"[ERROR] IntIntegrityAddRegion failed: 0x%08x\n", status);
1588 goto cleanup_and_exit;
1633 ERROR(
"[ERROR] IntIntegrityRemoveRegion failed: 0x%08x\n", status);
1645 ERROR(
"[ERROR] IntIntegrityRemoveRegion failed: 0x%08x\n", status);
1657 ERROR(
"[ERROR] IntHookObjectDestroy failed: 0x%08x\n", status);
1667 ERROR(
"[ERROR] IntHookObjectDestroy failed: 0x%08x\n", status);
1677 ERROR(
"[ERROR] IntHookObjectDestroy failed: 0x%08x\n", status);
1687 ERROR(
"[ERROR] IntHookObjectDestroy failed: 0x%08x\n", status);
1697 ERROR(
"[ERROR] IntHookGvaRemoveHook failed: 0x%08x\n", status);
1705 memzero(&gLoggerCtxState,
sizeof(gLoggerCtxState));
Measures kernel mode exceptions checks.
static INTSTATUS IntWinInfHookHookSppWmiGetClock(void)
Establishes the EPT hook on the WMI_LOGGER_CONTEXT's GetCpuClock field.
enum _INTRO_ACTION_REASON INTRO_ACTION_REASON
The reason for which an INTRO_ACTION was taken.
INTRO_CODEBLOCKS CodeBlocks
Code blocks extracted for the alert.
static INTSTATUS IntWinInfHookHandleSiloFirstWrite(void *Context, void *Hook, QWORD Address, INTRO_ACTION *Action)
EPT callback to handle the first write over EtwpDebuggerData, where the pointer of EtwDebuggerDataSil...
static INTSTATUS IntWinInfHookSppWmiSiloStatsCallback(void *Context, void *Hook, QWORD Address, INTRO_ACTION *Action)
EPT callback for the SPP region on which exits will always occur on the EtwpDebuggerDataSilo EPT hook...
static INTSTATUS IntWinInfHookWmiGetCpuClockSppCallback(void *Context, void *Hook, QWORD Address, INTRO_ACTION *Action)
EPT callback for writes over WMI_LOGGER_CONTEXT's GetCpuClock.
QWORD IntAlertCoreGetFlags(QWORD ProtectionFlag, INTRO_ACTION_REASON Reason)
Returns the flags for an alert.
void * SiloIntegrityObject
Integrity object for EtwDebuggerDataSilo.WmiCtxLoggerPtr.
An internal error occurred (no memory, pages not present, etc.).
BOOLEAN IntPolicyCoreForceBetaIfNeeded(QWORD Flag, INTRO_ACTION *Action)
Checks if a forced action should be taken even if the log-only mode is active.
WINDOWS_GUEST * gWinGuest
Global variable holding the state of a Windows guest.
INTSTATUS IntKernVirtMemWrite(QWORD KernelGva, DWORD Length, void *Buffer)
Writes data to a guest kernel virtual memory range.
QWORD ZoneFlags
The flags of the modified zone.
INTSTATUS IntHookObjectDestroy(HOOK_OBJECT_DESCRIPTOR **Object, DWORD Flags)
Destroy an entire hook object. All regions belonging to this object will be removed.
IG_ARCH_REGS Regs
The current state of the guest registers.
MITRE_ID MitreID
The Mitre ID that corresponds to this attack.
QWORD SystemCr3
The Cr3 used to map the kernel.
#define INT_STATUS_SUCCESS
BOOLEAN IntPolicyCoreTakeAction(QWORD Flag, INTRO_ACTION *Action, INTRO_ACTION_REASON *Reason)
Returns the action that should be taken for a core introspection option.
Infinity hook modifications of WMI_LOGGER_CONTEXT.GetCpuClock.
Event structure for integrity violations on monitored structures.
INTSTATUS IntIntegrityAddRegion(QWORD VirtualAddress, DWORD Length, INTRO_OBJECT_TYPE Type, void *Context, PFUNC_IntegrityViolationCallback Callback, BOOLEAN CopyContent, void **Descriptor)
Creates an INTEGRITY_REGION object and adds it to the gIntegrityRegions list.
struct _WIN_LOGGER_CTX_STATE WIN_LOGGER_CTX_STATE
QWORD BaseVa
The guest virtual address of the kernel module that owns this driver object.
#define INT_SUCCESS(Status)
QWORD Flags
A combination of ALERT_FLAG_* values describing the alert.
INTSTATUS IntResumeVcpus(void)
Resumes the VCPUs previously paused with IntPauseVcpus.
BOOLEAN KernelBetaDetections
True if the kernel protection is in beta (log-only) mode.
struct _EVENT_INTEGRITY_VIOLATION::@304 Victim
#define INT_STATUS_NOT_NEEDED_HINT
#define ALERT_FLAG_ASYNC
If set, the alert was generated in an async manner.
INTSTATUS IntPeFindFunctionByPatternInBuffer(BYTE *Buffer, DWORD BufferSize, WIN_UNEXPORTED_FUNCTION_PATTERN *Pattern, BOOLEAN IgnoreSectionHint, DWORD *Rva)
Find a function using a pattern.
int INTSTATUS
The status data type.
static INTSTATUS IntWinInfHookSppHookWmiSiloPtr(void)
Establishes the EPT hook on EtwpDebuggerDataSilo on the pointer to WMI_LOGGER_CONTEXT.
DWORD Offset
The offset of the modification.
INTSTATUS IntIntegrityDeleteRegion(void *Descriptor)
Marks the given integrity region for deletion. It will be removed after calling all the integrity cal...
void * WmiLoggerHookObjectStats
Hook object for SPP statistics on WMI_LOGGER_CONTEXT.GetCpuClock.
Describes a kernel-mode originator.
INTSTATUS IntPauseVcpus(void)
Pauses all the guest VCPUs.
void IntAlertFillCpuContext(BOOLEAN CopyInstruction, INTRO_CPUCTX *CpuContext)
Fills the current CPU context for an alert.
INSTRUX Instruction
The current instruction, pointed by the guest RIP.
WIN_LOGGER_CTX_STATE gLoggerCtxState
Describes a pattern for a kernel function that is not exported.
INTSTATUS IntWinInfHookUnprotect(void)
Removes the protection against infinity hook.
Describes a kernel driver.
INTSTATUS IntHookGvaSetHook(QWORD Cr3, QWORD Gva, DWORD Length, BYTE Type, void *Callback, void *Context, void *ParentHook, DWORD Flags, HOOK_GVA **GvaHook)
Set a read, write, execute or swap hook on a guest virtual address.
void IntAlertFillVersionInfo(INTRO_VIOLATION_HEADER *Header)
Fills version information for an alert.
INTRO_VIOLATION_HEADER Header
The alert header.
#define ZONE_INTEGRITY
Used for integrity zone.
INTRO_ACTION_REASON Reason
The reason for which Action was taken.
EXCEPTION_VICTIM_OBJECT Object
The modified object.
INTSTATUS IntAlertFillCodeBlocks(QWORD Rip, QWORD Cr3, BOOLEAN Execute, INTRO_CODEBLOCKS *CodeBlocks)
Fills the code blocks pattern for an alert.
QWORD LoggerGvaInSilo
Keeps the address of the pointer to WMI_LOGGER_CONTEXT (basically EtwDebuggerDataSilo + 0x10)...
#define ALERT_FLAG_BETA
If set, the alert is a BETA alert. No action was taken.
void * SiloHookObject
Hook object for SPP hooking on EtwDebuggerDataSilo - needed for when WMI_LOGGER_CONTEXT is relocated...
void IntAlertEptFillFromKmOriginator(const EXCEPTION_KM_ORIGINATOR *Originator, EVENT_EPT_VIOLATION *EptViolation)
Fills kernel mode originator information inside an EPT alert.
GENERIC_ALERT gAlert
Global alert buffer.
BOOLEAN SupportSPP
Set to True if support for SPP was detected.
INTSTATUS IntIntegrityRecalculate(INTEGRITY_REGION *IntegrityRegion)
Recalculates the hash and reads the original content again for a given region.
void IntAlertFillWriteInfo(const EXCEPTION_VICTIM_ZONE *Victim, INTRO_WRITE_INFO *WriteInfo)
Fills the write information for an alert.
#define INT_STATUS_EXCEPTION_BLOCK
DWORD Size
The size of the modified memory area.
Describes an operand value.
#define INT_STATUS_ALREADY_INITIALIZED
void IntAlertEptFillFromVictimZone(const EXCEPTION_VICTIM_ZONE *Victim, EVENT_EPT_VIOLATION *EptViolation)
Fills the victim information inside an EPT alert.
#define INT_STATUS_NOT_INITIALIZED
QWORD QwordValues[ND_MAX_REGISTER_SIZE/8]
The modified object is inside an integrity hook.
static INTSTATUS IntWinInfCheckCtxLoggerOnRelocation(void)
Checks the WMI_LOGGER_CONTEXT when the pointer to the old structure has changed in the EtwDebuggerDat...
INTRO_CPUCTX CpuContext
The context of the CPU that triggered the alert.
INTSTATUS IntNotifyIntroEvent(INTRO_EVENT_TYPE EventClass, void *Param, size_t EventSize)
Notifies the integrator about an introspection alert.
void * WmiLoggerIntegrityObject
Integrity object for WMI_LOGGER_CONTEXT.GetCpuClock.
void * SiloHookObjectStats
Hook object for SPP statistics on EtwDebuggerDataSilo.
BOOLEAN Guest64
True if this is a 64-bit guest, False if it is a 32-bit guest.
INTSTATUS IntExceptGetVictimEpt(void *Context, QWORD Gpa, QWORD Gva, INTRO_OBJECT_TYPE Type, DWORD ZoneFlags, EXCEPTION_VICTIM_ZONE *Victim)
Fills an EXCEPTION_VICTIM_ZONE with relevant information from an EPT violation.
QWORD Current
The currently used options.
INTRO_MODULE Module
The module that modified the monitored region.
QWORD VirtualAddress
The guest virtual address which was modified.
INTRO_VIOLATION_HEADER Header
The alert header.
union _OPERAND_VALUE::@22 Value
The actual operand value.
#define IS_KERNEL_POINTER_WIN(is64, p)
Checks if a guest virtual address resides inside the Windows kernel address space.
QWORD StartVirtualAddress
The start address of the integrity zone.
CHAR SectionHint[8]
Optional section name hint.
INTSTATUS IntExceptGetVictimIntegrity(INTEGRITY_REGION *IntegrityRegion, DWORD *Offset, EXCEPTION_VICTIM_ZONE *Victim)
This function is used to get the information about the modified zone from the integrity region...
QWORD WmiInteresting
SPP stats for WMI_LOGGER_CONTEXT, containing the number of writes that we are interested into...
QWORD KernelVa
The guest virtual address at which the kernel image.
void IntExceptKernelLogInformation(EXCEPTION_VICTIM_ZONE *Victim, EXCEPTION_KM_ORIGINATOR *Originator, INTRO_ACTION Action, INTRO_ACTION_REASON Reason)
Print the information about a kernel-mode violation and dumps the code-blocks.
INTSTATUS IntWinInfHookProtect(void)
This function initializes protection against infinity hook mechanism.
BYTE WordSize
Guest word size. Will be 4 for 32-bit guests and 8 for 64-bit guests.
INTRO_OBJECT_TYPE Type
The type of the modified object.
ZONE_TYPE ZoneType
The type of the modified zone.
INTRO_EXEC_CONTEXT ExecContext
Information about the instruction that triggered the alert.
QWORD SiloInteresting
SPP stats for EtwDebuggerDataSilo, containing the number of writes that we are interested into...
static INTSTATUS IntWinInfHookGetCircularCtxLogger(QWORD *KernelCtxLogger)
Fetches the WMI_LOGGER_CONTEXT pointer from EtwDebuggerDataSilo, if possible.
#define INT_STATUS_ALREADY_INITIALIZED_HINT
INTSTATUS IntHookGvaRemoveHook(HOOK_GVA **Hook, DWORD Flags)
Remove a GVA hook.
Sent when an EPT violation triggers an alert. See EVENT_EPT_VIOLATION.
#define ALERT_FLAG_NOT_RING0
If set, the alert was triggered in ring 1, 2 or 3.
Describes the modified zone.
#define UNREFERENCED_PARAMETER(P)
struct _EXCEPTION_VICTIM_ZONE::@58::@60 WriteInfo
#define WIN_KM_FIELD(Structure, Field)
Macro used to access kernel mode fields inside the WIN_OPAQUE_FIELDS structure.
WCHAR Name[ALERT_PATH_MAX_LEN]
NULL-terminated string with a human readable description of the modified object.
DWORD KernelBufferSize
The size of the KernelBuffer.
static INTSTATUS IntWinInfHookGetCpuClockIntegrityCallback(void *IntegrityRegion)
Function called whenever a modification has been detected through the integrity mechanism on WMI_LOGG...
BOOLEAN Valid
Set to True if the information in the structure is valid, False otherwise.
enum _INTRO_ACTION INTRO_ACTION
Event actions.
void * FirstSiloWriteHookObject
INTSTATUS IntIntegrityRemoveRegion(void *Descriptor)
Removes an integrity region from the gIntegrityRegions list.
INTRO_WRITE_INFO WriteInfo
QWORD EtwDbgDataGva
The guest virtual address of EtwpDebuggerData.
QWORD Cr3
The value of the guest CR3 register when the event was generated.
MM Mm
Guest memory information, such as paging mode, system Cr3 value, etc.
GUEST_STATE gGuest
The current guest state.
void IntAlertFillWinProcessByCr3(QWORD ProcessCr3, INTRO_PROCESS *EventProcess)
Saves information about a Windows process inside an alert. The process is searched by its kernel CR3...
static INTSTATUS IntWinInfHookSppViolationCallbackWmiPtrChanged(void *Context, void *Hook, QWORD Address, INTRO_ACTION *Action)
EPT callback for writes over the WMI_LOGGER_CONTEXT pointer inside the EtwDebuggerDataSilo structure...
QWORD CurrentGetCpuClock
Keeps the current, known WMI_LOGGER_CONTEXT.GetCpuClock which is verified on integrity.
EVENT_INTEGRITY_VIOLATION Integrity
static INTSTATUS IntWinInfHookWmiGetCpuClockSppStatsCallback(void *Context, void *Hook, QWORD Address, INTRO_ACTION *Action)
EPT callback for the SPP region on which exits will always occur on the GetCpuClock EPT hook...
struct _EVENT_INTEGRITY_VIOLATION::@302 Originator
INTRO_ACTION Action
The action that was taken as the result of this alert.
INTSTATUS IntKernVirtMemRead(QWORD KernelGva, DWORD Length, void *Buffer, DWORD *RetLength)
Reads data from a guest kernel virtual memory range.
KERNEL_DRIVER * IntDriverFindByAddress(QWORD Gva)
Returns the driver in which Gva resides.
BOOLEAN FailedToInitialize
Set if the protection failed to initialize, in order to avoid retrying indefinitely.
QWORD BaseAddress
The guest virtual address at which the monitored integrity region starts.
static INTSTATUS IntWinInfHookGetEtwpDebuggerData(QWORD *EtwpDebuggerData)
Finds the EtwpDebuggerData guest virtual address in the guest's kernel.
INTSTATUS IntHookObjectHookRegion(void *Object, QWORD Cr3, QWORD Gla, SIZE_T Length, BYTE Type, void *Callback, void *Context, DWORD Flags, HOOK_REGION_DESCRIPTOR **Region)
Hook a contiguous region of virtual memory inside the provided virtual address space.
INTSTATUS IntExceptGetOriginatorFromModification(EXCEPTION_VICTIM_ZONE *Victim, EXCEPTION_KM_ORIGINATOR *Originator)
This function is used for integrity violations to get the information about the kernel-mode originato...
#define INT_STATUS_NOT_INITIALIZED_HINT
BYTE * KernelBuffer
A buffer containing the entire kernel image.
KERNEL_DRIVER * KernelDriver
Points to the driver object that describes the kernel image.
static INTSTATUS IntWinInfHookEptSppHandleWrite(INTRO_ACTION *Action)
Handles a write detected through EPT over WMI_LOGGER_CONTEXT's GetCpuClock function pointer and takes...
#define INT_STATUS_NOT_SUPPORTED
INTRO_PROCESS CurrentProcess
The current process.
VCPU_STATE * gVcpu
The state of the current VCPU.
INTSTATUS IntDecGetWrittenValueFromInstruction(PINSTRUX Instrux, PIG_ARCH_REGS Registers, PBYTE MemoryValue, OPERAND_VALUE *WrittenValue)
Decode a written value from a memory write instruction.
The action was blocked because there was no exception for it.
Sent for integrity violation alerts. See EVENT_INTEGRITY_VIOLATION.
EXCEPTION_VICTIM_INTEGRITY Integrity
Valid if the modified zone is Integrity.
static INTSTATUS IntWinInfHookEptSppSendAlert(EXCEPTION_VICTIM_ZONE *Victim, EXCEPTION_KM_ORIGINATOR *Originator, INTRO_ACTION Action, INTRO_ACTION_REASON Reason)
Sends an alert for an EPT violation. Used only when SPP mechanism is supported.
Event structure for EPT violations.
static INTSTATUS IntWinInfHookIntegrityHandleWrite(QWORD OldValue, QWORD NewValue, INTEGRITY_REGION *IntegrityRegion, INTRO_ACTION *Action)
Handles a detected modification on GetCpuClock field inside the WMI_LOGGER_CONTEXT structure...
void IntAlertFillWinKmModule(const KERNEL_DRIVER *Driver, INTRO_MODULE *EventModule)
Saves kernel module information inside an alert.
struct _WIN_LOGGER_CTX_STATE * PWIN_LOGGER_CTX_STATE
static INTSTATUS IntWinInfHookIntegritySendAlert(EXCEPTION_VICTIM_ZONE *Victim, EXCEPTION_KM_ORIGINATOR *Originator, INTRO_ACTION Action, INTRO_ACTION_REASON Reason)
Sends an integrity alert when a modification on WMI_LOGGER_CONTEXT's GetCpuClock has been detected th...
INTSTATUS IntExceptKernelGetOriginator(EXCEPTION_KM_ORIGINATOR *Originator, DWORD Options)
This function is used to get the information about the kernel-mode originator.
INTSTATUS IntAlertFillExecContext(QWORD Cr3, INTRO_EXEC_CONTEXT *ExecContext)
Fills the current execution context.
#define ZONE_WRITE
Used for write violation.
INTRO_PROT_OPTIONS CoreOptions
The activation and protection options for this guest.
INTSTATUS IntHookObjectCreate(DWORD ObjectType, QWORD Cr3, void **Object)
Create a new hook object.
#define INTRO_OPT_PROT_KM_LOGGER_CONTEXT
Enable protection on WMI_LOGGER_CONTEXT.GetCpuClock used by InfinityHook (Windows only)...
void IntExcept(EXCEPTION_VICTIM_ZONE *Victim, void *Originator, EXCEPTION_TYPE Type, INTRO_ACTION *Action, INTRO_ACTION_REASON *Reason, INTRO_EVENT_TYPE EventClass)
This function is the entry point for the exception mechanism.
void * WmiLoggerHookObject
Hook object for SPP hooking of WMI_LOGGER_CONTEXT.GetCpuClock.
#define VICTIM_CIRCULAR_KERNEL_CTX_LOGGER
Printable name used for introObjectTypeKmLoggerContext objects.
static INTSTATUS IntWinInfHookGetWmiLoggerGetCpuClock(QWORD *GetCpuClockGva, QWORD *WmiLoggerCtx)
Gets the GetCpuClock field inside the WMI_LOGGER_CONTEXT structure, and the structure guest virtual a...
INTSTATUS IntWinInfHookSiloWmiPtrIntegrityCallback(void *IntegrityRegion)
Integrity callback for modifications over the WMI_LOGGER_CONTEXT pointer inside the EtwDebuggerDataSi...