winumcache.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _WINUM_CACHE_H_
#define _WINUM_CACHE_H_

#include "introcrt.h"

typedef struct _WIN_PROCESS_MODULE WIN_PROCESS_MODULE;

#define MAX_OFFSETS_PER_NAME    10


typedef struct _WINUM_CACHE_EXPORT
{
    RBNODE      RbNode;                             

    DWORD       Rva;                                
    DWORD       NameHashes[MAX_OFFSETS_PER_NAME];   
    DWORD       NameLens[MAX_OFFSETS_PER_NAME];     
    DWORD       NameOffsets[MAX_OFFSETS_PER_NAME];  
    DWORD       NumberOfOffsets;                    

    PCHAR       Names[MAX_OFFSETS_PER_NAME];
} WINUM_CACHE_EXPORT, *PWINUM_CACHE_EXPORT;


typedef struct _WINUM_CACHE_MEMORY_FUNCS
{
    union
    {
        struct
        {
            DWORD       MemcpyRva;          
            DWORD       MemcpySRva;         
            DWORD       MemmoveRva;         
            DWORD       MemmoveSRva;        
            DWORD       MemsetRva;          
        };

        DWORD           FuncArray[5];       
    };
} WINUM_CACHE_MEMORY_FUNCS, *PWINUM_CACHE_MEMORY_FUNCS;


typedef struct _WINUM_CACHE_EXPORTS
{
    RBTREE                  Tree;           
    WINUM_CACHE_EXPORT      *Array;         

    PCHAR                   Names;

    DWORD                   StartNames;     
    DWORD                   EndNames;       

} WINUM_CACHE_EXPORTS, *PWINUM_CACHE_EXPORTS;


typedef struct _WINUM_MODULE_CACHE
{
    LIST_ENTRY                  Link;           

    DWORD                       ModuleNameHash; 

    struct
    {
        DWORD                   EatRva;         
        DWORD                   EatSize;        

        DWORD                   IatRva;         
        DWORD                   IatSize;        

        DWORD                   TimeDateStamp;  
        DWORD                   SizeOfImage;    
    } Info;

    WINUM_CACHE_EXPORTS         Exports;        
    WINUM_CACHE_MEMORY_FUNCS    MemFuncs;       

    BYTE                        *Headers;       

    BOOLEAN                     Wow64;          

    BOOLEAN                     ExportDirRead;  
    BOOLEAN                     MemoryFuncsRead;

    BOOLEAN                     Dirty;

} WINUM_MODULE_CACHE, *PWINUM_MODULE_CACHE;


#define WINUMCACHE_MAX_EXPORTS  10000u


//
// API
//
INTSTATUS
IntWinUmModCacheSetHeaders(
    _In_ WIN_PROCESS_MODULE *Module,
    _In_reads_bytes_(4096) BYTE *Headers
    );

void
IntWinUmModCacheGet(
    _In_ WIN_PROCESS_MODULE *Module
    );

void
IntWinUmModCacheRelease(
    _In_ WINUM_MODULE_CACHE *Cache
    );

void
IntWinUmCacheUninit(
    void
    );

WINUM_CACHE_EXPORT *
IntWinUmModCacheExportFind(
    _In_ WIN_PROCESS_MODULE *Module,
    _In_ DWORD Rva,
    _In_ DWORD ErrorRange
    );

BOOLEAN
IntWinUmCacheIsExportDirRead(
    _In_ WIN_PROCESS_MODULE *Module
    );

WINUM_CACHE_EXPORT *
IntWinUmCacheGetExportFromRange(
    _In_ WIN_PROCESS_MODULE *Module,
    _In_ QWORD Gva,
    _In_ DWORD Length
    );

#endif // _WINUM_CACHE_H_