winselfmap.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _WINSELFMAP_H_
#define _WINSELFMAP_H_

#include "guests.h"

typedef struct _WIN_PROCESS_OBJECT WIN_PROCESS_OBJECT, *PWIN_PROCESS_OBJECT;

#define SELF_MAP_ENTRY(Cr3)                     (CLEAN_PHYS_ADDRESS64(((QWORD)(Cr3))) + gGuest.Mm.SelfMapIndex * 8ull)

#define SELF_MAP_ENTRY_IS_DETECTION(entry)      (((entry) & PT_P) != 0 && ((entry) & PT_US) != 0)

#define SELF_MAP_ENTRY_VA   (0xFFFF800000000000 | ((QWORD)gGuest.Mm.SelfMapIndex << 39) | \
                            ((QWORD)gGuest.Mm.SelfMapIndex << 30) | ((QWORD)gGuest.Mm.SelfMapIndex << 21) | \
                            ((QWORD)gGuest.Mm.SelfMapIndex << 12) | ((QWORD)gGuest.Mm.SelfMapIndex * 8))


INTSTATUS
IntWinSelfMapValidateSelfMapEntries(
    void
    );

INTSTATUS
IntWinSelfMapUnprotectSelfMapIndex(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

INTSTATUS
IntWinSelfMapProtectSelfMapIndex(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

INTSTATUS
IntWinSelfMapDisableSelfMapEntryProtection(
    void
    );

INTSTATUS
IntWinSelfMapEnableSelfMapEntryProtection(
    void
    );

INTSTATUS
IntWinSelfMapGetAndCheckSelfMapEntry(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

#endif