Bitdefender Hypervisor Memory Introspection
winobj.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2020 Bitdefender
3  * SPDX-License-Identifier: Apache-2.0
4  */
5 #ifndef _WINOBJ_H_
6 #define _WINOBJ_H_
7 
8 #include "wddefs.h"
9 
10 INTSTATUS
11 IntWinObjIsTypeObject(
12  _In_ QWORD Gva
13  );
14 
15 INTSTATUS
16 IntWinObjGetPoolHeaderForObject(
17  _In_ QWORD ObjectGva,
18  _Out_ POOL_HEADER *PoolHeader
19  );
20 
21 INTSTATUS
22 IntWinGuestFindDriversNamespace(
23  void
24  );
25 
26 void
27 IntWinObjCleanup(
28  void
29  );
30 
31 #endif // !_WINOBJ_H_
_Out_
#define _Out_
Definition: intro_sal.h:22
_In_
#define _In_
Definition: intro_sal.h:21
_POOL_HEADER
Definition: wddefs.h:460
IntWinObjCleanup
void IntWinObjCleanup(void)
Cleans up any resources allocated by the object search.
Definition: winobj.c:2080
IntWinObjIsTypeObject
INTSTATUS IntWinObjIsTypeObject(QWORD Gva)
Checks if the supplied guest memory location holds a valid type object.
Definition: winobj.c:1503
INTSTATUS
int INTSTATUS
The status data type.
Definition: introstatus.h:24
QWORD
unsigned long long QWORD
Definition: intro_types.h:53
IntWinObjGetPoolHeaderForObject
INTSTATUS IntWinObjGetPoolHeaderForObject(QWORD ObjectGva, POOL_HEADER *PoolHeader)
Reads the _POOL_HEADER structure for a given kernel object.
Definition: winobj.c:1648
wddefs.h
Contains definitions for structures and constants used by the Windows kernel.
IntWinGuestFindDriversNamespace
INTSTATUS IntWinGuestFindDriversNamespace(void)
Runs the driver object namespace search.
Definition: winobj.c:1855