winprocess.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#ifndef _WINPROCESS_H_
#define _WINPROCESS_H_

#include "winumpath.h"
#include "winguest.h"
#include "update_guests.h"
#include "windpi.h"
#include "winsecdesc.h"

struct _WIN_PROCESS_OBJECT;

#define WIN_STATUS_ACCESS_DENIED        0xC0000022      
#define WIN_STATUS_SUCCESS              0x00000000      


typedef enum _WIN_SUBSYTEM_TYPE
{
    winSubsysUnknown = 0,       
    winSubsys64Bit,             
    winSubsys32Bit,             
} WIN_SUBSYTEM_TYPE;

typedef enum _WINPROC_GUEST_EXITS
{
    winProcExitVad          = 0x01,     
    winProcExitWriteMemory  = 0x02,     
    winProcExitReadMemory   = 0x04,     
    winProcExitThreadCtx    = 0x08,     
    winProcExitQueueApc     = 0x10,     
    winProcExitSetProcInfo  = 0x20,     
} WINPROC_GUEST_EXITS;


typedef struct _WIN_PROCESS_SUBSYSTEM
{
    struct _WIN_PROCESS_OBJECT  *Process;                   
    WIN_SUBSYTEM_TYPE           SubsystemType;              

    QWORD                       PebAddress;                 

    DWORD                       ProtectedModulesCount;      
    DWORD                       LoadedModulesCount;         

    const WCHAR                 *SystemDirPath;

    LIST_HEAD                   ProcessModules;             

    BOOLEAN                     MainModuleLoaded;           
    BYTE                        NtdllLoadCount;             
    BYTE                        Kernel32LoadCount;          

    QWORD                       NtdllBase;                  
    DWORD                       NtdllSize;                  
} WIN_PROCESS_SUBSYSTEM, *PWIN_PROCESS_SUBSYSTEM;

typedef struct _WIN_PROCESS_OBJECT
{
    LIST_ENTRY          Link;                       
    RBNODE              NodeCr3;                    
    RBNODE              NodeUserCr3;                
    RBNODE              NodeEproc;                  

    QWORD               EprocessAddress;            
    QWORD               ParentEprocess;             
    QWORD               RealParentEprocess;         

    QWORD               CreationTime;


    QWORD               Cr3;                        
    QWORD               UserCr3;                    
    DWORD               Pid;                        
    DWORD               NameHash;                   

    QWORD               Peb64Address;               
    QWORD               Peb32Address;               

    QWORD               MainModuleAddress;          

    CHAR                Name[IMAGE_BASE_NAME_LEN];  

    WINUM_PATH          *Path;

    PCHAR               CommandLine;

    DWORD               CommandLineSize;            

    union
    {
        DWORD           Flags;

        struct
        {
            DWORD           Wow64Process : 1;           
            DWORD           Terminating : 1;            

            DWORD           Protected : 1;
            DWORD           IsAgent : 1;                
            DWORD           MainModuleLoaded : 1;       
            DWORD           UnpackProtected : 1;        
            DWORD           Initialized : 1;
            DWORD           BetaDetections : 1;         
            DWORD           SystemProcess : 1;          
            DWORD           Lsass : 1;                  

            DWORD           StaticDetected : 1;

            DWORD           LastPebWriteDone : 1;
            DWORD           InjectedApphelp : 1;        

            DWORD           ParentWow64 : 1;            

            DWORD           StartInitializing : 1;

            DWORD           OneTimeInjectionDone : 1;   
            DWORD           LateProtection : 1;         

            DWORD           Peb32ContextWritten : 1;

            DWORD           Peb64ContextWritten : 1;

            DWORD           MonitorVad : 1;             
            DWORD           MonitorModules : 1;         
            DWORD           IsPreviousAgent : 1;        

            DWORD           ExploitGuardEnabled : 1;

            DWORD           Outswapped : 1;             
        };
    };

    BYTE                InjectionsCount;            
    BYTE                PebWrittenCount;            

    QWORD               InjectedApphelpAddress;     
    DWORD               InjectedAppHelpSize;        

    DWORD               LastException;              
    QWORD               LastExceptionRip;           

    BOOLEAN             LastExceptionContinuable;

    BOOLEAN             HasNaClEnabled;

    BOOLEAN             EnforcedDep;                

    DWORD               ExitStatus;

    BOOLEAN             IsDominoJava;               
    BOOLEAN             FirstDominoJavaIgnored;     

    union
    {
        DWORD           ProtectionMask;

        struct
        {
            DWORD       ProtReserved1 : 2;          
            DWORD       ProtCoreModules : 1;        
            DWORD       ProtUnpack : 1;             
            DWORD       ProtWriteMem : 1;           
            DWORD       ProtWsockModules : 1;       
            DWORD       ProtExploits : 1;           
            DWORD       ProtThreadCtx : 1;

            DWORD       ProtQueueApc : 1;           
            DWORD       ProtCreation: 1;

            DWORD       ProtDoubleAgent : 1;        
            DWORD       ProtScanCmdLine : 1;        
            DWORD       ProtInstrument : 1;         
            DWORD       ProtReserved2 : 16;         
            DWORD       ProtRemediate : 1;

            DWORD       ProtKillExploit : 1;        
            DWORD       ProtBeta : 1;
        };
    };

    QWORD               BetaMask;                   
    QWORD               FeedbackMask;               

    DWORD               AgentTag;                   

    void                *Cr3PageLockObject;

    void                *UserCr3PageLockObject;

    RBTREE              VadTree;                    
    void                *VasMonRoot;                
    LIST_HEAD           *VadPages;                  

    QWORD               OriginalTokenPtr;           

    void                *ParamsSwapHandle;

    void                *CmdLineSwapHandle;

    void                *CmdBufSwapHandle;          

    void                *SelfMapHook;               
    void                *UserSelfMapHook;           

    QWORD               SelfMapEntryValue;          
    QWORD               UserSelfMapEntryValue;      

    QWORD               Context;

    BOOLEAN             ImageIsFromNativeSubsystem;  
    BOOLEAN             IsVerifierLoaded;            

    WORD                OriginalSpareValue;

    void                *MainModuleVad;

    struct
    {
        BOOLEAN             ParentHasPivotedStack;      

        QWORD               DebuggerEprocess;

        QWORD               TokenStolenFromEprocess;

        BOOLEAN             ParentHasBeenHeapSprayed;   

        BOOLEAN             ParentHasTokenPrivsAltered;

        BOOLEAN             ParentThreadSuspicious;     

        BOOLEAN             ParentHasAlteredSecDescPtr;

        BOOLEAN             ParentHasEditedAcl;
    } CreationInfo;

    DPI_EXTRA_INFO          DpiExtraInfo;   

    PWIN_PROCESS_SUBSYSTEM Subsystemx86;

    PWIN_PROCESS_SUBSYSTEM Subsystemx64;

    void                    *TokenHook;      

    void                   *TokenSwapHook;

    QWORD                   OriginalPresentPrivs;

    QWORD                   OriginalEnabledPrivs;

    BOOLEAN                 SkipPrivsNextCheck;

    BOOLEAN                 PrivsChangeDetected;

    BOOLEAN                 PrivsChangeOneBit;

    struct  
    {
        QWORD                   SecurityDescriptorGva;

        BYTE                    RawBuffer[INTRO_SECURITY_DESCRIPTOR_SIZE];

        DWORD                   RawBufferSize;

        ACL                     Sacl;

        ACL                     Dacl;
    } SecurityDescriptor;

} WIN_PROCESS_OBJECT, *PWIN_PROCESS_OBJECT;


static __forceinline QWORD
IntWinProcGetProtOption(
    _In_ const WIN_PROCESS_OBJECT *Process
    )
{
    return Process->SystemProcess ? INTRO_OPT_PROT_UM_SYS_PROCS : INTRO_OPT_PROT_UM_MISC_PROCS;
}

static __forceinline BOOLEAN
IntWinProcPolicyIsBeta(
    _In_ const WIN_PROCESS_OBJECT *Process,
    _In_ QWORD Flag
    )
{
    return Process->BetaDetections ||
           IntPolicyCoreIsOptionBeta(IntWinProcGetProtOption(Process)) ||
           (Process->BetaMask & Flag) != 0;
}

static __forceinline BOOLEAN
IntWinProcPolicyIsFeedback(
    _In_ const WIN_PROCESS_OBJECT *Process,
    _In_ QWORD Flag
    )
{
    return ((Process->FeedbackMask & Flag) ||
            (IntPolicyIsCoreOptionFeedback(IntWinProcGetProtOption(Process))));
}

INTSTATUS
IntWinProcHandleCreate(
    _In_ void *Detour
    );

INTSTATUS
IntWinProcHandleTerminate(
    _In_ void *Detour
    );

INTSTATUS
IntWinProcHandleCopyMemory(
    _In_ void *Detour
    );

INTSTATUS
IntWinProcSwapIn(
    _In_  void *Detour
    );

INTSTATUS
IntWinProcSwapOut(
    _In_  void *Detour
    );

INTSTATUS
IntWinProcPatchCopyMemoryDetour(
    _In_ QWORD FunctionAddress,
    _In_ void *Handler,
    _In_ void *Descriptor
    );

INTSTATUS
IntWinProcPatchPspInsertProcess86(
    _In_ QWORD FunctionAddress,
    _In_ void *Handler,
    _In_ void *Descriptor
    );

INTSTATUS
IntWinProcPatchSwapOut64(
    _In_ QWORD FunctionAddress,
    _In_ void *Handler,
    _In_ void *Descriptor
    );

INTSTATUS
IntWinProcPatchSwapOut32(
    _In_ QWORD FunctionAddress,
    _In_ void *Handler,
    _In_ void *Descriptor
    );

INTSTATUS
IntWinProcProtect(
    _In_ WIN_PROCESS_OBJECT *Process
    );

INTSTATUS
IntWinProcUnprotect(
    _In_ WIN_PROCESS_OBJECT *Process
    );

const PROTECTED_PROCESS_INFO *
IntWinProcGetProtectedInfoEx(
    _In_ PWCHAR Path,
    _In_ BOOLEAN IsSystem
    );

INTSTATUS
IntWinProcUpdateProtection(
    void
    );

INTSTATUS
IntWinProcCreateProcessObject(
    _Out_ WIN_PROCESS_OBJECT **Process,
    _In_ QWORD EprocessAddress,
    _In_ PBYTE EprocessBuffer,
    _In_ QWORD ParentEprocess,
    _In_ QWORD RealParentEprocess,
    _In_ QWORD Cr3,
    _In_ DWORD Pid,
    _In_ BOOLEAN StaticScan
    );

INTSTATUS
IntWinProcValidateSystemCr3(
    void
    );

INTSTATUS
IntWinProcAddProtectedProcess(
    _In_ const WCHAR *Path,
    _In_ DWORD ProtectionMask,
    _In_ QWORD Context
    );

INTSTATUS
IntWinProcRemoveProtectedProcess(
    _In_ const WCHAR *Path
    );

INTSTATUS
IntWinProcRemoveAllProtectedProcesses(
    void
    );

void
IntWinProcDumpProtected(
    void
    );

void
IntWinProcUninit(
    void
    );

INTSTATUS
IntWinProcGetObjectByPid(
    _In_ DWORD Pid,
    _Outptr_ WIN_PROCESS_OBJECT **Process
    );

INTSTATUS
IntWinProcReadCommandLine(
    _In_ WIN_PROCESS_OBJECT *Process
    );

INTSTATUS
IntWinProcChangeProtectionFlags(
    _In_ WIN_PROCESS_OBJECT *Process,
    _In_ DWORD OldMask,
    _In_ DWORD NewMask
    );

void
IntWinProcUpdateProtectedProcess(
    _In_ const void *Name,
    _In_ const CAMI_STRING_ENCODING Encoding,
    _In_ const CAMI_PROT_OPTIONS *Options
    );

INTSTATUS
IntWinProcHandleInstrument(
    _In_ void *Detour
    );

INTSTATUS
IntWinProcPrepareInstrument(
    _In_ QWORD FunctionAddress,
    _In_ void *Handler,
    _In_ void *Descriptor
    );

#endif // _WINPROCESS_H_