winselfmap.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "winselfmap.h"
#include "alerts.h"
#include "hook.h"

extern LIST_HEAD gWinProcesses;


__forceinline static void
IntWinSelfMapSelfMapUpdate(
    _In_ QWORD ModifiedCr3,
    _Inout_ WIN_PROCESS_OBJECT *Process,
    _In_ QWORD NewValue
    )
{
    if (Process->Cr3 == ModifiedCr3)
    {
        Process->SelfMapEntryValue = NewValue;
    }
    else
    {
        Process->UserSelfMapEntryValue = NewValue;
    }
}


static INTSTATUS
IntWinSelfMapHandleCr3SelfMapModification(
    _In_ QWORD NewValue,
    _In_ QWORD OldValue,
    _Inout_ WIN_PROCESS_OBJECT *Process,
    _In_ QWORD Cr3
    )
{
    INTSTATUS status;
    INTRO_ACTION action;
    INTRO_ACTION_REASON reason;
    EVENT_TRANSLATION_VIOLATION *pTr = &gAlert.Translation;

    action = introGuestNotAllowed;
    reason = introReasonNoException;

    memzero(pTr, sizeof(*pTr));

    WARNING("[WARNING] Self-mapping entry modified for process '%s' with CR3 %llx (%s), addr %llx, "
            "from 0x%016llx to 0x%016llx\n", Process->Name, Cr3, Cr3 == Process->Cr3 ? "kernel" : "user",
            SELF_MAP_ENTRY(Cr3), OldValue, NewValue);

    if (IntPolicyCoreIsOptionBeta(INTRO_OPT_PROT_KM_SELF_MAP_ENTRY))
    {
        LOG("^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ (B) ROOTKIT ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n\n");
    }
    else
    {
        LOG("^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ROOTKIT ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n\n");

        QWORD *pPage = NULL;

        status = IntPhysMemMap(SELF_MAP_ENTRY(Cr3), sizeof(QWORD), 0, &pPage);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntPhysMemMap failed: 0x%08x\n", status);
            goto _just_send_alert;
        }

        // restore only the US bit in case of modification
        pPage[0] = NewValue & (~PT_US);

        IntPhysMemUnmap(&pPage);
    }

    // We always update the selfmap with the new value
    IntWinSelfMapSelfMapUpdate(Cr3, Process, NewValue);

_just_send_alert:
    if (IntPolicyCoreTakeAction(INTRO_OPT_PROT_KM_SELF_MAP_ENTRY, &action, &reason))
    {
        pTr->Header.Action = action;
        pTr->Header.Reason = reason;
        pTr->Header.MitreID = idRootkit;

        pTr->Header.Flags = IntAlertCoreGetFlags(INTRO_OPT_PROT_KM_SELF_MAP_ENTRY, reason) | ALERT_FLAG_ASYNC;

        if (Process->SystemProcess)
        {
            pTr->Header.Flags |= ALERT_FLAG_SYSPROC;
        }

        IntAlertFillCpuContext(FALSE, &pTr->Header.CpuContext);

        IntAlertFillWinProcessByCr3(Process->Cr3, &pTr->Header.CurrentProcess);

        IntAlertFillVersionInfo(&pTr->Header);

        pTr->WriteInfo.NewValue[0] = NewValue;
        pTr->WriteInfo.OldValue[0] = OldValue;
        pTr->WriteInfo.Size = sizeof(QWORD);

        pTr->Originator.Module.Valid = FALSE;
        pTr->Header.CpuContext.Valid = FALSE;
        pTr->Header.CurrentProcess.Valid = FALSE;

        pTr->Victim.VirtualAddress = SELF_MAP_ENTRY_VA;
        pTr->ViolationType = transViolationSelfMap;

        status = IntNotifyIntroEvent(introEventTranslationViolation, pTr, sizeof(*pTr));
        if (!INT_SUCCESS(status))
        {
            WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
        }
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinSelfMapCheckSelfMapEntry(
    _Inout_ WIN_PROCESS_OBJECT *Process,
    _In_opt_ const QWORD *CurrentKernelValue,
    _In_opt_ const QWORD *CurrentUserValue
    )
{
    QWORD currentKern, currentUser;
    INTSTATUS status = INT_STATUS_SUCCESS;

    if (Process->Outswapped)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    if (NULL == CurrentKernelValue)
    {
        status = IntPhysicalMemRead(SELF_MAP_ENTRY(Process->Cr3), sizeof(QWORD), &currentKern, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntPhysicalMemRead failed: 0x%08x\n", status);
            goto _exit;
        }
    }
    else
    {
        currentKern = *CurrentKernelValue;
    }

    if (NULL == CurrentUserValue && Process->Cr3 != Process->UserCr3)
    {
        status = IntPhysicalMemRead(SELF_MAP_ENTRY(Process->UserCr3), sizeof(QWORD), &currentUser, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntPhysicalMemRead failed: 0x%08x\n", status);
            goto _exit;
        }
    }
    else if (Process->Cr3 != Process->UserCr3)
    {
        currentUser = *CurrentUserValue;
    }
    else
    {
        goto _only_kern_check;
    }

    // When in beta, we should also verify that our stored value didn't have the U/S bit as on kernel beta detections
    // we only want to give an alert when this bit was modified vs. what we have stored instead of sending an alert
    // every time we check, but if KernelBetaDetections was changed on the fly we should also consider a detection
    // even if our previously stored value had U/S bit activated.
    if (Process->Cr3 != Process->UserCr3)
    {
        if (SELF_MAP_ENTRY_IS_DETECTION(currentUser) &&
            ((Process->UserSelfMapEntryValue & PT_US) != (currentUser & PT_US) || !gGuest.KernelBetaDetections))
        {
            status = IntWinSelfMapHandleCr3SelfMapModification(currentUser, Process->UserSelfMapEntryValue, Process,
                                                               Process->UserCr3);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntWinSelfMapCr3SelfMapModification failed: 0x%x\n", status);
            }
        }
        else if (Process->UserSelfMapEntryValue != currentUser)
        {
            Process->UserSelfMapEntryValue = currentUser;
        }
    }

_only_kern_check:
    if (SELF_MAP_ENTRY_IS_DETECTION(currentKern) &&
        ((Process->SelfMapEntryValue & PT_US) != (currentKern & PT_US) || !gGuest.KernelBetaDetections))
    {
        status = IntWinSelfMapHandleCr3SelfMapModification(currentKern,
                                                           Process->SelfMapEntryValue,
                                                           Process,
                                                           Process->Cr3);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinSelfMapCr3SelfMapModification failed: 0x%x\n", status);
        }
    }
    else if (Process->SelfMapEntryValue != currentKern)
    {
        Process->SelfMapEntryValue = currentKern;
    }

_exit:
    return status;
}


static INTSTATUS
IntWinSelfMapHandleCr3SelfMapWrite(
    _Inout_ WIN_PROCESS_OBJECT *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    )
{
    WIN_PROCESS_OBJECT *pProc = Context;
    INTSTATUS status;
    EXCEPTION_KM_ORIGINATOR originator = { 0 };
    EXCEPTION_VICTIM_ZONE victim = { 0 };
    IG_ARCH_REGS *regs;
    INTRO_ACTION action;
    INTRO_ACTION_REASON reason;
    QWORD gva;
    QWORD cr3Modified;
    BOOLEAN isBeta;

    regs = &gVcpu->Regs;
    action = introGuestNotAllowed;
    reason = introReasonNoException;
    isBeta = IntPolicyCoreIsOptionBeta(INTRO_OPT_PROT_KM_SELF_MAP_ENTRY);

    cr3Modified = CLEAN_PHYS_ADDRESS64(pProc->Cr3) == CLEAN_PHYS_ADDRESS64(Address) ? pProc->Cr3 : pProc->UserCr3;

    if (!gVcpu->PtEmuBuffer.Valid)
    {
        action = introGuestAllowed;
        reason = introReasonAllowed;
        goto cleanup_and_exit;
    }

    // KPTI is enabled and relevant only for non-privileged processes. Processes which are already privileged
    // (running as system/admin/etc.), do start with both the kernel and user CR3 allocated & initialized, but soon
    // after the process is created, the user CR3 will be freed. The self-map mechanism will keep the protection on
    // that user CR3. Eliminate the self-map protection on user CR3 once they are removed; we can figure out that a
    // user CR3 is deleted when the self-map entry for tit is made invalid (present bit == 0).
    if (!!(gVcpu->PtEmuBuffer.Old & PT_P) &&
        !(gVcpu->PtEmuBuffer.New & PT_P))
    {
        action = introGuestAllowed;
        reason = introReasonAllowed;

        if (Hook == pProc->SelfMapHook)
        {
            pProc->SelfMapHook = NULL;
        }
        else if (Hook == pProc->UserSelfMapHook)
        {
            pProc->UserSelfMapHook = NULL;
        }

        status = IntHookGpaRemoveHook((HOOK_GPA **)&Hook, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookGpaRemoveHook failed: 0x%08x\n", status);
        }

        return INT_STATUS_SUCCESS;
    }

    if (gVcpu->PtEmuBuffer.Old == 0 ||
        (!SELF_MAP_ENTRY_IS_DETECTION(gVcpu->PtEmuBuffer.New)))
    {
        action = introGuestAllowed;
        reason = introReasonAllowed;

        IntWinSelfMapSelfMapUpdate(cr3Modified, pProc, gVcpu->PtEmuBuffer.New);

        goto cleanup_and_exit;
    }

    STATS_ENTER(statsExceptionsKern);

    status = IntExceptKernelGetOriginator(&originator, 0);
    if (!INT_SUCCESS(status))
    {
        WARNING("[WARNING] IntExceptKernelGetOriginator failed: 0x%08x\n", status);
    }

    gva = SELF_MAP_ENTRY_VA;

    status = IntExceptGetVictimEpt(Context, Address, gva, introObjectTypeSelfMapEntry, ZONE_WRITE, &victim);

    if (!INT_SUCCESS(status))
    {
        reason = introReasonInternalError;
        ERROR("[ERROR] Failed getting zone details: 0x%08x\n", status);
        goto _exit_exceptions;
    }

    // overwrite with these values
    victim.WriteInfo.NewValue[0] = gVcpu->PtEmuBuffer.New;
    victim.WriteInfo.OldValue[0] = gVcpu->PtEmuBuffer.Old;
    victim.WriteInfo.AccessSize = sizeof(QWORD);

    IntExcept(&victim, &originator, exceptionTypeKm, &action, &reason, introEventEptViolation);

_exit_exceptions:
    STATS_EXIT(statsExceptionsKern);

    if (IntPolicyCoreTakeAction(INTRO_OPT_PROT_KM_SELF_MAP_ENTRY, &action, &reason))
    {
        EVENT_EPT_VIOLATION *pEpt = &gAlert.Ept;

        memzero(pEpt, sizeof(*pEpt));

        WARNING("[WARNING] Self-mapping entry modified for process '%s' with CR3 %llx (%s), "
                "addr %llx, from 0x%016llx to 0x%016llx from RIP 0x%016llx\n",
                pProc->Name,
                cr3Modified,
                cr3Modified == pProc->Cr3 ? "kernel" : "user",
                Address,
                gVcpu->PtEmuBuffer.Old,
                gVcpu->PtEmuBuffer.New,
                regs->Rip);

        if (!isBeta)
        {
            QWORD *pPage = NULL;

            status = IntPhysMemMap(Address, sizeof(QWORD), 0, &pPage);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntPhysMemMap failed: 0x%08x\n", status);
                goto just_send_alert;
            }

            gVcpu->PtEmuBuffer.New &= (~PT_US);

            pPage[0] = gVcpu->PtEmuBuffer.New;

            IntPhysMemUnmap(&pPage);

            IntWinSelfMapSelfMapUpdate(cr3Modified, pProc, gVcpu->PtEmuBuffer.New);
        }

just_send_alert:
        pEpt->Header.Action = action;
        pEpt->Header.Reason = reason;
        pEpt->Header.MitreID = idRootkit;

        IntAlertFillCpuContext(TRUE, &pEpt->Header.CpuContext);

        IntAlertEptFillFromKmOriginator(&originator, pEpt);
        IntAlertEptFillFromVictimZone(&victim, pEpt);

        pEpt->Header.Flags = IntAlertCoreGetFlags(INTRO_OPT_PROT_KM_SELF_MAP_ENTRY, reason);

        if (pProc->SystemProcess)
        {
            pEpt->Header.Flags |= ALERT_FLAG_SYSPROC;
        }

        IntAlertFillWinProcessByCr3(regs->Cr3, &pEpt->Header.CurrentProcess);

        IntAlertFillCodeBlocks(originator.Original.Rip, regs->Cr3, FALSE, &pEpt->CodeBlocks);
        IntAlertFillExecContext(regs->Cr3, &pEpt->ExecContext);

        IntAlertFillVersionInfo(&pEpt->Header);

        status = IntNotifyIntroEvent(introEventEptViolation, pEpt, sizeof(*pEpt));
        if (!INT_SUCCESS(status))
        {
            WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
        }
    }

cleanup_and_exit:
    if (isBeta || action == introGuestAllowed)
    {
        IntWinSelfMapSelfMapUpdate(cr3Modified, pProc, gVcpu->PtEmuBuffer.New);
    }

    IntPolicyCoreForceBetaIfNeeded(INTRO_OPT_PROT_KM_SELF_MAP_ENTRY, &action);

    *Action = action;

    return INT_STATUS_SUCCESS;
}


TIMER_FRIENDLY INTSTATUS
IntWinSelfMapValidateSelfMapEntries(
    void
    )
{
    LIST_ENTRY *pList = NULL;

    if (!gGuest.ProtectionActivated)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if (!gGuest.GuestInitialized)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if ((introGuestWindows != gGuest.OSType) ||
        (gGuest.CoreOptions.Current & INTRO_OPT_PROT_KM_SELF_MAP_ENTRY) == 0 ||
        (gGuest.Mm.Mode != PAGING_4_LEVEL_MODE &&
         gGuest.Mm.Mode != PAGING_5_LEVEL_MODE))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    STATS_ENTER(statsSelfMapEntryProtection);

    pList = gWinProcesses.Flink;
    while (pList != &gWinProcesses)
    {
        WIN_PROCESS_OBJECT *pProcess = CONTAINING_RECORD(pList, WIN_PROCESS_OBJECT, Link);
        INTSTATUS status;

        pList = pList->Flink;

        status = IntWinSelfMapCheckSelfMapEntry(pProcess, NULL, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinCheckSelfMapEntry failed: 0x%08x\n", status);
        }
    }

    STATS_EXIT(statsSelfMapEntryProtection);

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinSelfMapEnableSelfMapEntryProtection(
    void
    )
{
    PLIST_ENTRY pList = NULL;

    if (!gGuest.ProtectionActivated)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if (!gGuest.GuestInitialized)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if ((introGuestWindows != gGuest.OSType) ||
        (gGuest.Mm.Mode != PAGING_4_LEVEL_MODE &&
         gGuest.Mm.Mode != PAGING_5_LEVEL_MODE))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    pList = gWinProcesses.Flink;
    while (pList != &gWinProcesses)
    {
        WIN_PROCESS_OBJECT *pProcess = CONTAINING_RECORD(pList, WIN_PROCESS_OBJECT, Link);
        INTSTATUS status;

        pList = pList->Flink;

        status = IntWinSelfMapCheckSelfMapEntry(pProcess, NULL, NULL);

        // no point in protecting the process if it already has a hook on it...
        if (pProcess->SelfMapHook != NULL && pProcess->UserSelfMapHook != NULL)
        {
            continue;
        }

        status = IntWinSelfMapProtectSelfMapIndex(pProcess);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinProtectSelfMapIndex failed: 0x%08x\n", status);
            continue;
        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinSelfMapGetAndCheckSelfMapEntry(
    _Inout_ WIN_PROCESS_OBJECT *Process
    )
{
    INTSTATUS status;
    QWORD currentKern, currentUser;

    if (NULL == Process)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (!gGuest.ProtectionActivated)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if (!gGuest.GuestInitialized)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if ((introGuestWindows != gGuest.OSType) ||
        (gGuest.Mm.Mode != PAGING_4_LEVEL_MODE &&
         gGuest.Mm.Mode != PAGING_5_LEVEL_MODE))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    status = IntPhysicalMemRead(SELF_MAP_ENTRY(Process->Cr3), sizeof(QWORD), &currentKern, NULL);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntPhysicalMemRead failed: 0x%08x\n", status);
        goto _exit;
    }

    // assume current self map entry value has U/S bit deactivated, as we should give a detection on integrity checking
    Process->SelfMapEntryValue = (currentKern & (~PT_US));

    status = IntPhysicalMemRead(SELF_MAP_ENTRY(Process->UserCr3), sizeof(QWORD), &currentUser, NULL);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntPhysicalMemRead failed: 0x%08x\n", status);
        goto _exit;
    }

    // assume current self map entry value has U/S bit deactivated, as we should give a detection on integrity checking
    Process->UserSelfMapEntryValue = (currentUser & (~PT_US));

    if (0 != (gGuest.CoreOptions.Current & INTRO_OPT_PROT_KM_SELF_MAP_ENTRY))
    {
        status = IntWinSelfMapCheckSelfMapEntry(Process, &currentKern, &currentUser);
    }

_exit:
    return status;
}


INTSTATUS
IntWinSelfMapDisableSelfMapEntryProtection(
    void
    )
{
    LIST_ENTRY *pList = NULL;

    if (!gGuest.ProtectionActivated)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if (!gGuest.GuestInitialized)
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    if ((introGuestWindows != gGuest.OSType) ||
        (gGuest.Mm.Mode != PAGING_4_LEVEL_MODE &&
         gGuest.Mm.Mode != PAGING_5_LEVEL_MODE))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    pList = gWinProcesses.Flink;
    while (pList != &gWinProcesses)
    {
        WIN_PROCESS_OBJECT *pProcess = CONTAINING_RECORD(pList, WIN_PROCESS_OBJECT, Link);
        INTSTATUS status;

        pList = pList->Flink;

        status = IntWinSelfMapUnprotectSelfMapIndex(pProcess);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinSelfMapUnprotectSelfMapIndex failed: 0x%08x\n", status);
            continue;
        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinSelfMapProtectSelfMapIndex(
    _Inout_ WIN_PROCESS_OBJECT *Process
    )
{

    INTSTATUS status = INT_STATUS_SUCCESS;
    BOOLEAN bShouldProtect = FALSE;

    if (NULL == Process)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if ((introGuestWindows != gGuest.OSType) ||
        (gGuest.CoreOptions.Current & INTRO_OPT_PROT_KM_SELF_MAP_ENTRY) == 0 ||
        (gGuest.Mm.Mode != PAGING_4_LEVEL_MODE &&
         gGuest.Mm.Mode != PAGING_5_LEVEL_MODE))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    // Force only integrity mechanism to kick-in: as we have seen, processes might be "swapped-out"
    // (see MmSwapOutProcess) - when a process is then swapped in (see MmSwapInProcess), it verifies OutSwapped
    // flag in EPROCESS.Flags, and if it is set, it copies the whole upper entries (>0x800) from the current process
    // kernel PML4 into the upper entries of the swapped in process PML4, using memmove, case in which some MOVDQA
    // instructions come on kernel page tables (because this is the only hook we put on kernel page tables on
    // protected processes). So, until we find a better solution, keep only the integrity check.
    bShouldProtect = Process->Pid == 4;

    TRACE("[INFO] Protecting self-mapping entry for process %s, pid %d with CR3: %llx, UserCR3: %llx with %s\n",
          Process->Name, Process->Pid, Process->Cr3, Process->UserCr3, bShouldProtect ? "EPT" : "INTEGRITY");

    if (bShouldProtect)
    {
        if (Process->SelfMapHook == NULL)
        {
            status = IntHookGpaSetHook(SELF_MAP_ENTRY(Process->Cr3),
                                       sizeof(QWORD),
                                       IG_EPT_HOOK_WRITE,
                                       IntWinSelfMapHandleCr3SelfMapWrite,
                                       Process,
                                       NULL,
                                       HOOK_FLG_PAGING_STRUCTURE | HOOK_FLG_HIGH_PRIORITY,
                                       (PHOOK_GPA *)&Process->SelfMapHook);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntHookGpaSetHook failed: 0x%08x\n", status);
            }
        }

        // Avoid double hooking
        if (Process->Cr3 != Process->UserCr3 && Process->UserSelfMapHook == NULL)
        {
            status = IntHookGpaSetHook(SELF_MAP_ENTRY(Process->UserCr3),
                                       sizeof(QWORD),
                                       IG_EPT_HOOK_WRITE,
                                       IntWinSelfMapHandleCr3SelfMapWrite,
                                       Process,
                                       NULL,
                                       HOOK_FLG_PAGING_STRUCTURE | HOOK_FLG_HIGH_PRIORITY,
                                       (PHOOK_GPA *)&Process->UserSelfMapHook);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntHookGpaSetHook failed: 0x%08x\n", status);
            }
        }
    }

    return status;
}


INTSTATUS
IntWinSelfMapUnprotectSelfMapIndex(
    _Inout_ WIN_PROCESS_OBJECT *Process
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;

    if (Process == NULL)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    TRACE("[INFO] Deactivating self-map index protection for %s (pid %d, cr3: kernel %016llx, user: %016llx)\n",
          Process->Name, Process->Pid, Process->Cr3, Process->UserCr3);

    if (Process->SelfMapHook != NULL)
    {
        status = IntHookGpaRemoveHook((HOOK_GPA **)&Process->SelfMapHook, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookGpaRemoveHook failed: 0x%08x\n", status);
        }
    }

    if (Process->UserSelfMapHook != NULL)
    {
        status = IntHookGpaRemoveHook((HOOK_GPA **)&Process->UserSelfMapHook, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookGpaRemoveHook failed: 0x%08x\n", status);
        }
    }

    return status;
}