winummodule.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#include "winummodule.h"
#include "alerts.h"
#include "hook.h"
#include "swapmem.h"
#include "unpacker.h"
#include "winprocesshp.h"
#include "winummoduleblock.h"
#include "winumdoubleagent.h"
#include "winthread.h"


const PROTECTED_DLL_INFO gProtectedModules[] =
{
    { u"ntdll.dll",             NAMEHASH_NTDLL },
    { u"kernel32.dll",          NAMEHASH_KERNEL32 },
    { u"kernelbase.dll",        NAMEHASH_KERNELBASE },
    { u"user32.dll",            NAMEHASH_USER32 },
    // Add any other modules here.
};


const PROTECTED_DLL_INFO gProtectedNetModules[] =
{
    { u"ws2_32.dll",            NAMEHASH_WS2_32 },
    { u"wininet.dll",           NAMEHASH_WININET },
};


const PROTECTED_DLL_INFO gProtectedWowModules[] =
{
    { u"ntdll.dll",             NAMEHASH_NTDLL },
    { u"wow64.dll",             NAMEHASH_WOW64 },
    { u"wow64win.dll",          NAMEHASH_WOW64WIN },
    { u"wow64cpu.dll",          NAMEHASH_WOW64CPU },

    // Add any other modules here.
};


static INTSTATUS
IntWinModHookPoly(
    _In_ PWIN_PROCESS_MODULE Module
    );


static BOOLEAN
IntWinModIsProtected(
    _In_ const WIN_PROCESS_MODULE *Module,
    _In_ const PROTECTED_DLL_INFO *ProtectedList,
    _In_ size_t ProtectedCount
    )
{
    for (DWORD i = 0; i < ProtectedCount; i++)
    {
        if (MODULE_MATCH(Module, &ProtectedList[i]))
        {
            return TRUE;
        }
    }

    return FALSE;
}


static INTSTATUS
IntWinProcSendDllEvent(
    _In_ PWIN_PROCESS_MODULE Module,
    _In_ BOOLEAN Loaded
    )
{
    INTSTATUS status;
    PEVENT_MODULE_EVENT pModEvent;

    if (gGuest.UninitPrepared)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    if (0 == (gGuest.CoreOptions.Current & INTRO_OPT_EVENT_MODULES))
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    if (Loaded && Module->LoadEventSent)
    {
        return INT_STATUS_ALREADY_INITIALIZED_HINT;
    }

    if (!Loaded && Module->UnloadEventSent)
    {
        return INT_STATUS_ALREADY_INITIALIZED_HINT;
    }

    if ((NULL == Module->Path) || (0 == Module->VirtualBase) || (0 == Module->Size))
    {
        return INT_STATUS_NOT_INITIALIZED_HINT;
    }

    pModEvent = &gAlert.Module;
    memzero(pModEvent, sizeof(*pModEvent));

    pModEvent->Loaded = Loaded;
    pModEvent->Protected = Module->ShouldProtHooks || Module->ShouldProtUnpack;
    pModEvent->UserMode = TRUE;

    IntAlertFillWinUmModule(Module, &pModEvent->Module);

    IntAlertFillWinProcess(Module->Subsystem->Process, &pModEvent->CurrentProcess);

    status = IntNotifyIntroEvent(introEventModuleEvent, pModEvent, sizeof(*pModEvent));
    if (!INT_SUCCESS(status))
    {
        WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
    }

    if (Loaded)
    {
        Module->LoadEventSent = TRUE;
    }
    else
    {
        Module->UnloadEventSent = TRUE;
    }

    return status;
}


static INTSTATUS
IntWinProcSendAllDllEventsForSubsystem(
    _In_ PWIN_PROCESS_SUBSYSTEM Subsystem
    )
{
    LIST_ENTRY *list;
    PWIN_PROCESS_MODULE pMod;

    list = Subsystem->ProcessModules.Flink;
    while (list != &Subsystem->ProcessModules)
    {
        pMod = CONTAINING_RECORD(list, WIN_PROCESS_MODULE, Link);

        list = list->Flink;

        IntWinProcSendDllEvent(pMod, TRUE);
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinProcSendAllDllEventsForProcess(
    _In_ PWIN_PROCESS_OBJECT Process
    )
{
    if (NULL != Process->Subsystemx86)
    {
        IntWinProcSendAllDllEventsForSubsystem(Process->Subsystemx86);
    }

    if (NULL != Process->Subsystemx64)
    {
        IntWinProcSendAllDllEventsForSubsystem(Process->Subsystemx64);
    }

    return INT_STATUS_SUCCESS;
}


static void
IntWinModCheckSpecialCases(
    _In_ PWIN_PROCESS_MODULE Module
    )
{
    PWIN_PROCESS_OBJECT pProc = Module->Subsystem->Process;

    // If the j9jit.dll is loaded and we are in a Java process, we may be in the Java IBM case
    // where certain VADs must be excepted at execution
    if (strstr_utf16(Module->Path->Name, u"j9jit") &&
        strstr(pProc->Name, "java"))
    {
        pProc->IsDominoJava = TRUE;
        pProc->FirstDominoJavaIgnored = FALSE;
    }
}


static INTSTATUS
IntWinModHandleMainModuleInMemory(
    _In_ void *Context,
    _In_ QWORD Cr3,
    _In_ QWORD ModuleBase,
    _In_ QWORD PhysicalAddress,
    _In_reads_bytes_(DataSize) PBYTE Data,
    _In_ DWORD DataSize,
    _In_ DWORD Flags
    )
{
    INTSTATUS status;
    PWIN_PROCESS_MODULE pMod;
    PWIN_PROCESS_SUBSYSTEM pSubs;
    PWIN_PROCESS_OBJECT pProc;

    UNREFERENCED_PARAMETER(Cr3);
    UNREFERENCED_PARAMETER(DataSize);
    UNREFERENCED_PARAMETER(Flags);

    if (NULL == Context)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == Data)
    {
        return INT_STATUS_INVALID_PARAMETER_5;
    }

    status = INT_STATUS_SUCCESS;

    pMod = (PWIN_PROCESS_MODULE)Context;

    pMod->HeadersSwapHandle = NULL;

    pSubs = pMod->Subsystem;
    if (NULL == pSubs)
    {
        return INT_STATUS_INVALID_INTERNAL_STATE;
    }

    pProc = pSubs->Process;
    if (NULL == pProc)
    {
        return INT_STATUS_INVALID_INTERNAL_STATE;
    }

    if ((Data[0] != 'M') || (Data[1] != 'Z'))
    {
        ERROR("[ERROR] Module is not a valid MZ image: %x%x, 0x%016llx:0x%016llx\n", Data[0], Data[1], ModuleBase,
              PhysicalAddress);
        return INT_STATUS_INVALID_OBJECT_TYPE;
    }

    TRACE("[MODULE] Main module for process %llx (subsystem %d) has loaded!\n",
          pProc->EprocessAddress, pSubs->SubsystemType);

    if (pMod->ShouldProtUnpack)
    {
        TRACE("[MODULE] Protecting module with base 0x%016llx -> 0x%016llx against unpacking.\n", ModuleBase, Cr3);

        status = IntWinModHookPoly(pMod);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinModHookPoly failed: 0x%08x\n", status);
        }

        pProc->UnpackProtected = TRUE;
    }

    return status;
}


static int
IntWinModComparePaths(
    _In_ const WIN_PROCESS_MODULE *Module,
    _In_ const WCHAR *SystemDirPath,
    _In_ const WCHAR *TestModule
    )
{
    WCHAR targetPath[MAX_PATH];
    size_t k, l;

    // Copy the directory path. They're both the same size, so it's safe to copy it entirely.
    memcpy(targetPath,
           SystemDirPath,
           MIN(sizeof(targetPath) - sizeof(WCHAR), (wstrlen(SystemDirPath) + 1) * sizeof(WCHAR)));

    // In case the memcpy didn't copy it
    targetPath[MAX_PATH - 1] = 0;

    // Append the module name.
    k = 0;
    while ((k < MAX_PATH) && (0 != targetPath[k]))
    {
        k++;
    }

    l = 0;
    while ((k + 1 < MAX_PATH) && (0 != TestModule[l]))
    {
        targetPath[k] = TestModule[l];

        k++, l++;
    }

    // Append the null terminator.
    targetPath[k] = 0;

    return wstrncasecmp_len(targetPath, Module->Path->Path, k, Module->Path->PathSize / 2);
}


static QWORD
IntWinModGetProtectionOptionForModule(
    _In_ WIN_PROCESS_MODULE *Module
    )
{
    for (DWORD i = 0; i < ARRAYSIZE(gProtectedModules); i++)
    {
        if (MODULE_MATCH(Module, &gProtectedModules[i]))
        {
            return PROC_OPT_PROT_CORE_HOOKS;
        }
    }

    for (DWORD i = 0; i < ARRAYSIZE(gProtectedWowModules); i++)
    {
        if (MODULE_MATCH(Module, &gProtectedWowModules[i]))
        {
            return PROC_OPT_PROT_CORE_HOOKS;
        }
    }

    for (DWORD i = 0; i < ARRAYSIZE(gProtectedNetModules); i++)
    {
        if (MODULE_MATCH(Module, &gProtectedNetModules[i]))
        {
            return PROC_OPT_PROT_WSOCK_HOOKS;
        }
    }

    return 0;
}


static INTSTATUS
IntWinModIsKernelWriteInjection(
    _In_ EXCEPTION_KM_ORIGINATOR *Originator,
    _Out_ BOOLEAN *IsInjection
    )
{
    INTSTATUS status;
    QWORD copyMemFunc = 0;

    status = IntDetGetFunctionAddressByTag(detTagProcInject, &copyMemFunc);
    if (!INT_SUCCESS(status))
    {
        return status;
    }

    for (DWORD trace = 0; trace < Originator->StackTrace.NumberOfTraces; trace++)
    {
        if (Originator->StackTrace.Traces[trace].CalledAddress == copyMemFunc)
        {
            *IsInjection = TRUE;

            return INT_STATUS_SUCCESS;
        }
    }

    *IsInjection = FALSE;

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinModFillDriverInjectionData(
    _In_ QWORD ReturnRip,
    _Inout_ EXCEPTION_KM_ORIGINATOR *Originator
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;
    KERNEL_DRIVER *pDrv;

    pDrv = IntDriverFindByAddress(ReturnRip);

    Originator->Injection.Kernel = TRUE;
    Originator->Return.Driver = pDrv;
    Originator->Return.Rip = ReturnRip;

    if (NULL != pDrv)
    {
        IMAGE_SECTION_HEADER sectionHeader = { 0 };

        Originator->Return.NameHash = pDrv->NameHash;
        Originator->Return.PathHash = pDrv->Win.PathHash;

        status = IntPeGetSectionHeaderByRva(pDrv->BaseVa,
                                            pDrv->Win.MzPeHeaders,
                                            (DWORD)(Originator->Return.Rip - pDrv->BaseVa),
                                            &sectionHeader);
        if (!INT_SUCCESS(status))
        {
            WARNING("[WARNING] IntPeGetSectionHeaderByRva failed: 0x%08x\n", status);
            return status;
        }

        memcpy(Originator->Return.Section, sectionHeader.Name, sizeof(sectionHeader.Name));
    }
    else
    {
        Originator->Return.NameHash = INITIAL_CRC_VALUE;
        Originator->Return.PathHash = INITIAL_CRC_VALUE;
    }

    return status;
}


static INTSTATUS
IntWinModFillProcessInjectionData(
    _In_ QWORD CurrentThread,
    _Inout_ EXCEPTION_KM_ORIGINATOR *Originator
    )
{
    QWORD eprocess = 0;
    WIN_PROCESS_OBJECT *pProc = NULL;
    INTSTATUS status;

    // The injected process is attached in the current thread, but thread.Process should contain the
    // process that was performing the injection.
    status = IntKernVirtMemFetchWordSize(CurrentThread + WIN_KM_FIELD(Thread, Process), &eprocess);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntKernVirtMemFetchWordSize failed: 0x%08x\n", status);
        return status;
    }

    pProc = IntWinProcFindObjectByEprocess(eprocess);
    if (NULL == pProc)
    {
        ERROR("[ERROR] IntWinProcFindObjectByEprocess failed for 0x%016llx\n", eprocess);
        return INT_STATUS_NOT_FOUND;
    }

    Originator->Injection.User = TRUE;
    Originator->Process.WinProc = pProc;

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinModFillInjectionData(
    _Inout_ EXCEPTION_KM_ORIGINATOR *Originator
    )
{
    INTSTATUS status;

    if (gGuest.Guest64)
    {
        QWORD ethread = 0;
        BYTE previousMode = 0;

        status = IntWinThrGetCurrentThread(gVcpu->Index, &ethread);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinThrGetCurrentThread failed: 0x%08x\n", status);
            return status;
        }

        status = IntKernVirtMemRead(ethread + WIN_KM_FIELD(Thread, PreviousMode), 1, &previousMode, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
            return status;
        }

        if (previousMode == 0)
        {
            QWORD realRsp = 0, realRet = 0;

            // On x64 there is a fake trapframe at Zw* calls which is only kept on the stack and in KTHREAD
            // is just another trapframe... This trapframe only contains some registers and the stack, so it
            // can't be mapped over a KTRAP_FRAME64. It is constructed in KiServiceInternal. For our purpose
            // it doesn't seem that Rbp is ever overwritten during a ZwWriteVirtualMemory, but maybe we should
            // see if we can make it more generic somehow...
            status = IntKernVirtMemFetchQword(gVcpu->Regs.Rbp + WIN_KM_FIELD(Ungrouped, RspOffsetOnZwCall), &realRsp);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntKernVirtMemFetchQword failed: 0x%08x\n", status);
                return status;
            }

            status = IntKernVirtMemFetchQword(realRsp, &realRet);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntKernVirtMemFetchQword failed: 0x%08x\n", status);
                return status;
            }

            status = IntWinModFillDriverInjectionData(realRet, Originator);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntWinModFillDriverInjectionData failed: 0x%08x\n", status);
            }
        }
        else
        {
            status = IntWinModFillProcessInjectionData(ethread, Originator);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntWinModFillProcessInjectionData failed: 0x%08x\n", status);
            }
        }
    }
    else
    {
        KTRAP_FRAME32 trapFrame = { 0 };
        QWORD ethread = 0;
        DWORD trapFrameAddr;

        status = IntWinThrGetCurrentThread(gVcpu->Index, &ethread);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinThrGetCurrentThread failed: 0x%08x\n", status);
            return status;
        }

        status = IntKernVirtMemFetchDword(ethread + WIN_KM_FIELD(Thread, TrapFrame), &trapFrameAddr);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemFetchDword failed: 0x%08x\n", status);
            return status;
        }

        status = IntKernVirtMemRead(trapFrameAddr, sizeof(trapFrame), &trapFrame, NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntKernVirtMemRead failed: 0x%08x\n", status);
            return status;
        }

        if (IS_KERNEL_POINTER_WIN(gGuest.Guest64, trapFrame.Eip))
        {
            // It seems too easy, but the real return is always at trapFrame.HardwareEsp.
            // This happens because of the following code at KiServiceExit:
            //     nt!KiServiceExit + 0x15b:
            //     81b76439 8d6554          lea     esp, [ebp + 54h]
            //     81b7643c 5f              pop     edi
            //     81b7643d 5e              pop     esi
            //     81b7643e 5b              pop     ebx
            //     81b7643f 5d              pop     ebp
            //     81b76440 83c404          add     esp, 4
            //     81b76443 f744240401000000 test    dword ptr[esp + 4], 1
            //     81b7644b 7505            jne     nt!KiSystemCallExit2 (81b76452)  Branch
            // 
            //     nt!KiSystemCallExitBranch + 0x2:
            //     81b7644d 5a              pop     edx
            //     81b7644e 59              pop     ecx
            //     81b7644f 9d              popfd
            //     81b76450 ffe2            jmp     edx

            // So it can be seen that the stack will remain pointing to TrapFrame.HardwareEsp. Jumping to
            // the Zw* function, there will be a ret there, returning to the caller driver. So at HardwareEsp
            // there is always the caller driver.
            status = IntWinModFillDriverInjectionData(trapFrame.HardwareEsp, Originator);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntWinModFillDriverInjectionData failed: 0x%08x\n", status);
            }
        }
        else
        {
            status = IntWinModFillProcessInjectionData(ethread, Originator);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntWinModFillProcessInjectionData failed: 0x%08x\n", status);
            }
        }
    }

    return status;
}



static INTSTATUS
IntWinModHandleKernelWrite(
    _In_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    )
{
    INTSTATUS status = INT_STATUS_SUCCESS;
    EXCEPTION_KM_ORIGINATOR originator = { 0 };
    EXCEPTION_VICTIM_ZONE victim = { 0 };
    INTRO_ACTION_REASON reason = introReasonUnknown;
    BOOLEAN informationOnly = FALSE;
    WIN_PROCESS_MODULE *pModule = (WIN_PROCESS_MODULE *)Context;
    WIN_PROCESS_OBJECT *pProcess = pModule->Subsystem->Process;
    BOOLEAN isInjection = FALSE;

    *Action = introGuestNotAllowed;

    STATS_ENTER(statsKmUmWrites);

    status = IntExceptKernelGetOriginator(&originator, EXCEPTION_KM_ORIGINATOR_OPT_FULL_STACK);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntExceptKernelGetOriginator failed with status: 0x%08x\n", status);

        reason = introReasonInternalError;
        informationOnly = TRUE;
    }

    status = IntWinModIsKernelWriteInjection(&originator, &isInjection);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntWinModIsKernelWriteInjection failed: 0x%08x\n", status);
    }

    if (isInjection)
    {
        status = IntWinModFillInjectionData(&originator);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinModFillInjectionData failed: 0x%08x\n", status);
        }
    }

    status = IntExceptGetVictimEpt(Context,
                                   Address,
                                   IntHookGetGlaFromGpaHook(Hook, Address),
                                   introObjectTypeUmModule,
                                   ZONE_WRITE,
                                   &victim);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntExceptGetVictimEpt failed with status: 0x%08x\n", status);

        reason = introReasonInternalError;
        informationOnly = TRUE;
    }

    if (informationOnly)
    {
        IntExceptKernelUserLogInformation(&victim, &originator, *Action, reason);
    }
    else
    {
        IntExcept(&victim, &originator, exceptionTypeKmUm, Action, &reason, introEventEptViolation);
    }

    STATS_EXIT(statsKmUmWrites);

    if (IntPolicyProcTakeAction(IntWinModGetProtectionOptionForModule(pModule), pProcess, Action, &reason))
    {
        EVENT_EPT_VIOLATION *pEptViol = &gAlert.Ept;

        memzero(pEptViol, sizeof(*pEptViol));

        pEptViol->Header.Action = *Action;
        pEptViol->Header.Reason = reason;
        pEptViol->Header.MitreID = idHooking;

        IntAlertFillCpuContext(TRUE, &pEptViol->Header.CpuContext);

        IntAlertEptFillFromKmOriginator(&originator, pEptViol);
        IntAlertEptFillFromVictimZone(&victim, pEptViol);

        pEptViol->Header.Flags = IntAlertProcGetFlags(IntWinModGetProtectionOptionForModule(pModule),
                                                      pModule->Subsystem->Process, reason, ALERT_FLAG_KM_UM);

        IntAlertFillWinProcessByCr3(pEptViol->Header.CpuContext.Cr3, &pEptViol->Header.CurrentProcess);

        IntAlertFillCodeBlocks(originator.Original.Rip, gVcpu->Regs.Cr3, FALSE, &pEptViol->CodeBlocks);
        IntAlertFillExecContext(0, &pEptViol->ExecContext);

        IntAlertFillVersionInfo(&pEptViol->Header);

        pEptViol->Originator.Injection.User = originator.Injection.User;
        pEptViol->Originator.Injection.Kernel = originator.Injection.Kernel;

        IntAlertFillWinProcess(originator.Process.WinProc, &pEptViol->Originator.Process);

        status = IntNotifyIntroEvent(introEventEptViolation, pEptViol, sizeof(*pEptViol));
        if (!INT_SUCCESS(status))
        {
            WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
        }

        status = INT_STATUS_SUCCESS;
    }

    IntPolicyProcForceBetaIfNeeded(IntWinModGetProtectionOptionForModule(pModule), pProcess, Action);

    return status;
}


static INTSTATUS
IntWinModHandleUserWrite(
    _In_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    )
{
    INTSTATUS status;
    PWIN_PROCESS_MODULE pMod;
    PWIN_PROCESS_OBJECT pOriginatorProc;
    INTRO_ACTION_REASON reason;
    PIG_ARCH_REGS regs;
    EXCEPTION_UM_ORIGINATOR originator;
    EXCEPTION_VICTIM_ZONE victim;
    DWORD iatidx, iatesz;

    status = INT_STATUS_SUCCESS;

    pMod = (PWIN_PROCESS_MODULE)Context;

    regs = &gVcpu->Regs;

    *Action = introGuestNotAllowed;
    reason = introReasonInternalError;

    if (regs->Cr3 != pMod->Subsystem->Process->Cr3)
    {
        const WIN_PROCESS_OBJECT *p = pMod->Subsystem->Process;
        const WIN_PROCESS_OBJECT *p2 = IntWinProcFindObjectByCr3(gVcpu->Regs.Cr3);

        WARNING("[WARNING] [SPECIAL-CASE] Process (pid: %d, eproc %llx, cr3 %llx, usercr3 %llx, name %s) "
                "is not the current one (current cr3 %llx, gva %llx, gpa %llx, ac %d)\n",
                p->Pid, p->EprocessAddress, p->Cr3, p->UserCr3, p->Name, regs->Cr3,
                gVcpu->Gla, gVcpu->Gpa, gVcpu->AccessSize);
        if (NULL != p2)
        {
            WARNING("[WARNING] [SPECIAL-CASE] Process (pid: %d, eproc %llx, cr3 %llx, usercr3 %llx, name %s) "
                    "is the current one!\n", p2->Pid, p2->EprocessAddress, p2->Cr3, p2->UserCr3, p2->Name);
        }
    }

    // Whitelist for ntdll!LdrpTouchPageForWrite.
    if ((gVcpu->AccessSize == 1) &&
        (gVcpu->Instruction.Instruction == ND_INS_OR) &&
        (gVcpu->Instruction.HasImm1) &&
        (gVcpu->Instruction.Immediate1 == 0))
    {
        *Action = introGuestAllowed;
        reason = introReasonAllowed;

        goto _cleanup_and_exit;
    }

    iatesz = (pMod->Is64BitModule ? 8 : 4);

    // White listing for IAT writes - we allow the first write that takes place in each IAT entry
    // if it is done from ntdll
    if ((pMod->IATBitmap != NULL) && (gVcpu->Gla >= pMod->VirtualBase + pMod->Cache->Info.IatRva) &&
        (gVcpu->Gla < pMod->VirtualBase + pMod->Cache->Info.IatRva + (QWORD)pMod->IATEntries * iatesz) &&
        (gVcpu->Regs.Rip >= pMod->Subsystem->NtdllBase &&
         gVcpu->Regs.Rip < pMod->Subsystem->NtdllBase + pMod->Subsystem->NtdllSize))
    {
        iatidx = (DWORD)(gVcpu->Gla - (pMod->VirtualBase + pMod->Cache->Info.IatRva)) / iatesz;

        if (pMod->IATBitmap[iatidx] == 0)
        {
            pMod->IATBitmap[iatidx]++;

            *Action = introGuestAllowed;
            reason = introReasonAllowed;

            goto _cleanup_and_exit;
        }
    }

    STATS_ENTER(statsExceptionsUser);

    memzero(&originator, sizeof(originator));
    memzero(&victim, sizeof(victim));

    pOriginatorProc = pMod->Subsystem->Process;

    status = IntExceptUserGetOriginator(pOriginatorProc, TRUE, regs->Rip, &gVcpu->Instruction, &originator);
    if (status == INT_STATUS_STACK_SWAPPED_OUT)
    {
        *Action = introGuestRetry;
        status = INT_STATUS_SUCCESS;
        goto _send_notification;
    }
    else if (!INT_SUCCESS(status))
    {
        reason = introReasonInternalError;
        *Action = introGuestNotAllowed;

        ERROR("[ERROR] Failed getting originator: 0x%08x\n", status);
        goto _send_notification;
    }

    status = IntExceptGetVictimEpt(pMod,
                                   Address,
                                   IntHookGetGlaFromGpaHook(Hook, Address),
                                   introObjectTypeUmModule,
                                   ZONE_WRITE,
                                   &victim);
    if (!INT_SUCCESS(status))
    {
        reason = introReasonInternalError;
        *Action = introGuestNotAllowed;

        ERROR("[ERROR] Failed getting modified zone: 0x%08x\n", status);
        goto _send_notification;
    }

    IntExcept(&victim, &originator, exceptionTypeUm, Action, &reason, introEventEptViolation);

_send_notification:
    STATS_EXIT(statsExceptionsUser);

    if (IntPolicyProcTakeAction(IntWinModGetProtectionOptionForModule(pMod), pMod->Subsystem->Process, Action, &reason))
    {
        PEVENT_EPT_VIOLATION pEptViol = &gAlert.Ept;

        // First of all, send ALL the dll events.
        IntWinProcSendAllDllEventsForProcess(pOriginatorProc);

        memzero(pEptViol, sizeof(*pEptViol));

        pEptViol->Header.Action = *Action;
        pEptViol->Header.Reason = reason;
        pEptViol->Header.MitreID = idHooking;

        IntAlertFillCpuContext(TRUE, &pEptViol->Header.CpuContext);

        IntAlertEptFillFromUmOriginator(&originator, pEptViol);
        IntAlertEptFillFromVictimZone(&victim, pEptViol);

        pEptViol->Header.Flags = IntAlertProcGetFlags(IntWinModGetProtectionOptionForModule(pMod),
                                                      pMod->Subsystem->Process, reason, 0);

        IntAlertFillWinProcessByCr3(pEptViol->Header.CpuContext.Cr3, &pEptViol->Header.CurrentProcess);

        IntAlertFillCodeBlocks(regs->Rip, regs->Cr3, FALSE, &pEptViol->CodeBlocks);
        IntAlertFillExecContext(0, &pEptViol->ExecContext);

        IntAlertFillVersionInfo(&pEptViol->Header);

        status = IntNotifyIntroEvent(introEventEptViolation, pEptViol, sizeof(*pEptViol));
        if (!INT_SUCCESS(status))
        {
            WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
        }

        status = INT_STATUS_SUCCESS;
    }

_cleanup_and_exit:
    IntPolicyProcForceBetaIfNeeded(IntWinModGetProtectionOptionForModule(pMod), pMod->Subsystem->Process, Action);

    return status;
}


INTSTATUS
IntWinModHandleWrite(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    )
{
    if (NULL == Context)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == Action)
    {
        return INT_STATUS_INVALID_PARAMETER_5;
    }

    *Action = introGuestNotAllowed;

    if (IS_KERNEL_POINTER_WIN(gGuest.Guest64, gVcpu->Regs.Rip))
    {
        return IntWinModHandleKernelWrite(Context, Hook, Address, Action);
    }
    else
    {
        return IntWinModHandleUserWrite(Context, Hook, Address, Action);
    }
}


static INTSTATUS
IntWinModHookModule(
    _In_ PWIN_PROCESS_MODULE Module
    )
{
    INTSTATUS status;
    DWORD sectionRva = 0;
    DWORD sectionCount = 0;
    DWORD i;
    PWIN_PROCESS_OBJECT pProc;
    IMAGE_SECTION_HEADER *sec;

    pProc = Module->Subsystem->Process;

    if (NULL == Module->Cache || NULL == Module->Cache->Headers)
    {
        ERROR("[ERROR] Invalid state where module doesn't has cache (%p) or headers!\n", Module->Cache);
        return INT_STATUS_INVALID_INTERNAL_STATE;
    }

#define MAX_IAT_ENTRIES    4096

    Module->IATEntries = Module->Cache->Info.IatSize / (Module->Is64BitModule ? 8 : 4);
    if (Module->IATEntries > MAX_IAT_ENTRIES)
    {
        WARNING("[WARNING] Module `%s` has %d IAT entries. Will use MAX_IAT_ENTRIES.",
                utf16_for_log(Module->Path->Name), Module->IATEntries);
        Module->IATEntries = MAX_IAT_ENTRIES;
    }


    if (Module->IATEntries != 0)
    {
        // Each entry will be initialized when that IAT entry will be written by the loader. The first write will be
        // allowed without checking the exceptions, all the other writes will go through the exceptions mechanism.
        Module->IATBitmap = HpAllocWithTag(Module->IATEntries, IC_TAG_IATB);
        if (NULL == Module->IATBitmap)
        {
            return INT_STATUS_INSUFFICIENT_RESOURCES;
        }
    }

    status = IntHookObjectCreate(0, pProc->Cr3, &Module->HookObject);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntHookObjectCreate failed: 0x%08x\n", status);
        return status;
    }

    // At this point, there is no point in doing any verification, since they were already done
    // in the previous step (pre-hooking). The MzPeHeaders won't be present if they were invalid.
    status = IntPeListSectionsHeaders(Module->VirtualBase,
                                      Module->Cache->Headers,
                                      PAGE_SIZE,
                                      &sectionRva,
                                      &sectionCount);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntPeListSectionsHeaders failed with status: 0x%08x\n", status);
        return status;
    }

    TRACE("[MODULE] Protecting module '%s' loaded  at 0x%016llx\n",
          utf16_for_log(Module->Path->Path), Module->VirtualBase);

    sec = (IMAGE_SECTION_HEADER *)(Module->Cache->Headers + sectionRva);
    for (i = 0; i < sectionCount; i++, sec++)
    {
        if ((sec->Characteristics & IMAGE_SCN_MEM_WRITE) || (sec->Characteristics & IMAGE_SCN_MEM_DISCARDABLE))
        {
            continue;
        }

        if ((QWORD)sec->VirtualAddress + sec->Misc.VirtualSize > Module->Vad->PageCount * PAGE_SIZE)
        {
            INFO("[INFO] Skipping section from VA 0x%08x, size 0x%08x, which is larger than VadSize 0x%016llx\n",
                 sec->VirtualAddress, sec->Misc.VirtualSize, Module->Vad->PageCount * PAGE_SIZE);
            continue;
        }

#ifdef DEBUG
        // The name of the section isn't always NULL terminated, let's make sure it is
        CHAR name[sizeof(sec->Name) + 1];
        memcpy(name, sec->Name, sizeof(sec->Name));
        name[sizeof(sec->Name)] = 0;

        TRACE("[MODULE] Protecting pageable region: 0x%016llx, VA space 0x%016llx, length %x Name `%s`\n",
              Module->VirtualBase + sec->VirtualAddress, pProc->Cr3, sec->Misc.VirtualSize, name);
#endif

        status = IntHookObjectHookRegion(Module->HookObject,
                                         pProc->Cr3,
                                         Module->VirtualBase + sec->VirtualAddress,
                                         ROUND_UP((SIZE_T)sec->Misc.VirtualSize, PAGE_SIZE),
                                         IG_EPT_HOOK_WRITE,
                                         IntWinModHandleWrite,
                                         Module,
                                         0,
                                         NULL);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookObjectHookRegion failed: 0x%08x\n", status);
        }
    }

    Module->IsProtected = TRUE;

    Module->Subsystem->ProtectedModulesCount++;

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinModUnHookModule(
    _In_ PWIN_PROCESS_MODULE Module
    )
{
    INTSTATUS status;

    if (NULL == Module)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    // Remove the unpacker, if active.
    if (Module->ShouldProtUnpack && Module->Subsystem->Process->UnpackProtected)
    {
        status = IntUnpUnWatchVaSpacePages(Module->Subsystem->Process->Cr3);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntUnpUnWatchVaSpacePages failed: 0x%08x\n", status);
        }
    }

    // Remove the protection, if any.
    if (NULL != Module->HookObject)
    {
        status = IntHookObjectDestroy((HOOK_OBJECT_DESCRIPTOR **)&Module->HookObject, 0);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntHookObjectDestroy failed: 0x%08x\n", status);
        }
    }

    if (NULL != Module->ModBlockObject)
    {
        status = IntWinModBlockRemoveBlockObject(Module->ModBlockObject);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinModBlockRemoveBlockObject failed: 0x%08x\n", status);
        }
    }

    if (Module->IsProtected)
    {
        Module->Subsystem->ProtectedModulesCount--;
    }

    Module->IsProtected = FALSE;

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinModHandlePreInjection(
    _In_ void *Context,
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress
    )
{
    UNREFERENCED_PARAMETER(Cr3);
    UNREFERENCED_PARAMETER(VirtualAddress);

    PWIN_PROCESS_MODULE pMod = (PWIN_PROCESS_MODULE)Context;
    if (NULL == pMod)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    // We try to inject a #PF on this module. We have to make sure that the VAD corresponding to this module is already
    // inserted in the RB tree inside the guest! If we inject a #PF but the VAD is not queued yet, we will end up
    // crashing the process, because it would receive a #PF for an address which is still invalid (because the VAD
    // is not inserted in the tree yet!)
    if (!IntWinVadIsInTree(pMod->Vad))
    {
        LOG("[WINMODULE] The VAD 0x%016llx belonging to module %s seems to not be inside the tree yet, "
            "will postpone #PF...\n", pMod->Vad->VadGva, utf16_for_log(pMod->Path->Path));

        return INT_STATUS_NOT_NEEDED_HINT;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinModHandleModuleHeadersInMemory(
    _In_ void *Context,
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress,
    _In_ QWORD PhysicalAddress,
    _In_reads_bytes_(DataSize) PBYTE Data,
    _In_ DWORD DataSize,
    _In_ DWORD Flags
    )
{
    INTSTATUS status;
    PWIN_PROCESS_MODULE pMod;
    PWIN_PROCESS_SUBSYSTEM pSubs;
    PWIN_PROCESS_OBJECT pProc;

    UNREFERENCED_PARAMETER(Cr3);
    UNREFERENCED_PARAMETER(VirtualAddress);
    UNREFERENCED_PARAMETER(DataSize);
    UNREFERENCED_PARAMETER(PhysicalAddress);
    UNREFERENCED_PARAMETER(Flags);

    if (NULL == Context)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == Data)
    {
        return INT_STATUS_INVALID_PARAMETER_5;
    }

    pMod = (PWIN_PROCESS_MODULE)Context;
    pMod->HeadersSwapHandle = NULL;

    pSubs = pMod->Subsystem;
    if (NULL == pSubs)
    {
        return INT_STATUS_INVALID_INTERNAL_STATE;
    }

    pProc = pSubs->Process;
    if (NULL == pProc)
    {
        return INT_STATUS_INVALID_INTERNAL_STATE;
    }

    status = IntWinUmModCacheSetHeaders(pMod, Data);

    if (INT_SUCCESS(status) && pProc->Protected && pMod->ShouldProtHooks)
    {
        TRACE("[MODULE] Protecting module with base 0x%016llx -> 0x%016llx against hooking.\n", VirtualAddress, Cr3);

        status = IntWinModHookModule(pMod);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinModHookModule failed: 0x%08x\n", status);
        }
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinModHandleModulePathInMemory(
    _In_ WIN_PROCESS_MODULE *Module,
    _In_ WINUM_PATH *Path
    )
{
    PWIN_PROCESS_SUBSYSTEM pSubs;
    PWIN_PROCESS_OBJECT pProc;
    INTSTATUS status;

    pSubs = Module->Subsystem;
    if (NULL == pSubs)
    {
        return INT_STATUS_INVALID_INTERNAL_STATE;
    }

    pProc = pSubs->Process;
    if (NULL == pProc)
    {
        return INT_STATUS_INVALID_INTERNAL_STATE;
    }

    Module->Path = IntWinUmPathReference(Path);

    if (gGuest.Guest64 && (Module->Subsystem->SubsystemType == winSubsys32Bit))
    {
        // OK, we don't compare the entire length, we just want to see if the first part of the path matches.
        if (wstrncasecmp(Module->Path->Path, u"\\windows\\syswow64\\", CWSTRLEN(u"\\windows\\syswow64\\")) == 0)
        {
            Module->IsSystemModule = TRUE;
        }
    }
    else
    {
        // OK, we don't compare the entire length, we just want to see if the first part of the path matches.
        if (wstrncasecmp(Module->Path->Path, u"\\windows\\system32\\", CWSTRLEN(u"\\windows\\system32\\")) == 0)
        {
            Module->IsSystemModule = TRUE;
        }
    }

    pSubs->LoadedModulesCount++;

    TRACE("[MODULE] Module '%s' (%08x) just loaded at 0x%016llx in process '%s' (pid = %d)\n",
          utf16_for_log(Module->Path->Path), Module->Path->NameHash, Module->VirtualBase, pProc->Name, pProc->Pid);

    IntWinModCheckSpecialCases(Module);

    if (Module->VirtualBase == pProc->MainModuleAddress)
    {
        Module->IsMainModule = TRUE;

        pSubs->MainModuleLoaded = TRUE;

        if (!pProc->MainModuleLoaded)
        {
            pProc->MainModuleLoaded = TRUE;

            pProc->Path = IntWinUmPathReference(Module->Path);
        }
    }

    if (Module->IsMainModule && !pProc->SystemProcess)
    {
        if (NULL == IntWinProcGetProtectedInfoEx(Module->Path->Path, !!pProc->SystemProcess))
        {
            TRACE("[INFO] Application '%s' was not found among the protected ones, will remove protection.\n",
                  utf16_for_log(Module->Path->Path));

            status = IntWinProcUnprotect(pProc);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntWinProcUnprotect failed: 0x%08x\n", status);
            }

            return status;
        }
    }

    if (Module->IsSystemModule)
    {
        if ((Module->Path->NameHash == NAMEHASH_NTDLL) &&
            (0 == wstrcasecmp(Module->Path->Name, u"ntdll.dll")))
        {
            Module->Subsystem->NtdllBase = Module->VirtualBase;
            Module->Subsystem->NtdllSize = Module->Size;

            Module->Subsystem->NtdllLoadCount++;
        }
        else if ((Module->Path->NameHash == NAMEHASH_KERNEL32) &&
                 (0 == wstrcasecmp(Module->Path->Name, u"kernel32.dll")))
        {
            Module->Subsystem->Kernel32LoadCount++;
        }

        // For 32-bit processes on 64-bit guests we also need to check the WoW64 modules
        if ((winSubsys64Bit == pSubs->SubsystemType) && (pProc->Wow64Process))
        {
            if (IntWinModIsProtected(Module, gProtectedWowModules, ARRAYSIZE(gProtectedWowModules)))
            {
                Module->ShouldProtHooks = pSubs->Process->ProtCoreModules;
                Module->ShouldGetCache = TRUE;
            }
        }
        else
        {
            if (IntWinModIsProtected(Module, gProtectedModules, ARRAYSIZE(gProtectedModules)))
            {
                Module->ShouldProtHooks = pSubs->Process->ProtCoreModules;
                Module->ShouldGetCache = TRUE;
            }
            else if (IntWinModIsProtected(Module, gProtectedNetModules, ARRAYSIZE(gProtectedNetModules)))
            {
                Module->ShouldProtHooks = pSubs->Process->ProtWsockModules;
                Module->ShouldGetCache = TRUE;
            }
        }
    }

    if (pSubs->Process->ProtUnpack && Module->IsMainModule)
    {
        Module->ShouldProtUnpack = TRUE;
    }

    if (Module->ShouldGetCache)
    {
        IntWinUmModCacheGet(Module);

        if (NULL == Module->Cache)
        {
            ERROR("[ERROR] Module->Cache is NULL after IntWinUmModCacheGet!\n");
        }
        else
        {
            status = IntSwapMemReadData(pSubs->Process->Cr3,
                                        Module->VirtualBase,
                                        PAGE_SIZE,
                                        SWAPMEM_OPT_UM_FAULT,
                                        Module,
                                        0,
                                        IntWinModHandleModuleHeadersInMemory,
                                        IntWinModHandlePreInjection,
                                        &Module->HeadersSwapHandle);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
                return status;
            }
        }
    }

    if (Module->ShouldProtUnpack)
    {
        status = IntSwapMemReadData(pSubs->Process->Cr3,
                                    Module->VirtualBase,
                                    2,
                                    SWAPMEM_OPT_UM_FAULT,
                                    Module,
                                    0,
                                    IntWinModHandleMainModuleInMemory,
                                    IntWinModHandlePreInjection,
                                    &Module->HeadersSwapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemReadData failed: 0x%08x\n", status);
            return status;
        }
    }

    // Finally check if the current module might be loaded through double agent
    IntWinDagentCheckSuspiciousDllLoad(Module);

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinModHandleLoadFromVad(
    _In_ WIN_PROCESS_OBJECT *Process,
    _In_ const VAD *Vad
    )
{
    INTSTATUS status;
    WIN_PROCESS_MODULE *pMod;

    if (Vad->PageCount * PAGE_SIZE > 0xFFFFFFFF)
    {
        ERROR("[ERROR] Module greater than 4GB!\n");

        return INT_STATUS_INVALID_PARAMETER_2;
    }

    pMod = HpAllocWithTag(sizeof(*pMod), IC_TAG_MODU);
    if (NULL == pMod)
    {
        return INT_STATUS_INSUFFICIENT_RESOURCES;
    }

    pMod->VirtualBase = Vad->StartPage;
    pMod->Size = (DWORD)(Vad->PageCount * PAGE_SIZE);
    pMod->StaticScan = Vad->StaticScan;
    pMod->Vad = Vad;

    if (gGuest.Guest64)
    {
        if (!Process->Wow64Process)
        {
            pMod->Subsystem = Process->Subsystemx64;
            pMod->Is64BitModule = TRUE;
        }
        else
        {
            // We're on 64 bit with wow64 process. We determine the subsystem using the module name. Inside the 64 bit
            // subsystem, the following modules will be loaded and possibly unloaded:
            // - /windows/system32/ntdll.dll
            // - /windows/system32/wow64win.dll
            // - /windows/system32/wow64.dll
            // - /windows/system32/wow64cpu.dll
            // - /windows/system32/kernel32.dll
            // - /windows/system32/user32.dll
            // All other modules will be 32 bit modules.
            // OK, we don't compare the entire length, we just want to see if the first part of the path matches.
            if (wstrncasecmp(Vad->Path->Path, u"\\windows\\system32\\", wstrlen(u"\\windows\\system32\\")) == 0)
            {
                pMod->Subsystem = Process->Subsystemx64;
                pMod->Is64BitModule = TRUE;
            }
            else
            {
                pMod->Subsystem = Process->Subsystemx86;
                pMod->Is64BitModule = FALSE;
            }
        }
    }
    else
    {
        pMod->Subsystem = Process->Subsystemx86;
        pMod->Is64BitModule = FALSE;
    }

    InsertTailList(&pMod->Subsystem->ProcessModules, &pMod->Link);

    status = IntWinModHandleModulePathInMemory(pMod, Vad->Path);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntWinModHandleModuleNameInMemory failed: 0x%08x\n", status);
        return status;
    }

    if (pMod->IsMainModule && Process->Wow64Process && (pMod->Subsystem == Process->Subsystemx86))
    {
        WIN_PROCESS_MODULE *pMod64;

        // If this was the main module, and we're inside a Wow64 process, we have to allocate a fresh entry
        // for the 64 bit subsystem.

        pMod64 = HpAllocWithTag(sizeof(*pMod64), IC_TAG_MODU);
        if (NULL == pMod64)
        {
            return INT_STATUS_INSUFFICIENT_RESOURCES;
        }

        pMod64->Subsystem = Process->Subsystemx64;
        pMod64->VirtualBase = Vad->StartPage;
        pMod64->Size = (DWORD)(Vad->PageCount * PAGE_SIZE);
        pMod64->Vad = Vad;

        InsertTailList(&pMod64->Subsystem->ProcessModules, &pMod64->Link);

        status = IntWinModHandleModulePathInMemory(pMod64, Vad->Path);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntWinModHandleModuleNameInMemory failed: 0x%08x\n", status);
            return status;
        }
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntWinModHandleUnload(
    _In_ PWIN_PROCESS_SUBSYSTEM Subsystem,
    _In_ QWORD VirtualBase
    )
{
    LIST_ENTRY *list;

    list = Subsystem->ProcessModules.Flink;
    while (list != &Subsystem->ProcessModules)
    {
        WIN_PROCESS_MODULE *pMod = CONTAINING_RECORD(list, WIN_PROCESS_MODULE, Link);
        list = list->Flink;

        if (pMod->VirtualBase == VirtualBase)
        {
            if ((pMod->Path->NameHash == NAMEHASH_NTDLL) &&
                (0 == wstrcasecmp(pMod->Path->Name, u"ntdll.dll")))
            {
                pMod->Subsystem->NtdllLoadCount--;
            }
            else if ((pMod->Path->NameHash == NAMEHASH_KERNEL32) &&
                     (0 == wstrcasecmp(pMod->Path->Name, u"kernel32.dll")))
            {
                pMod->Subsystem->Kernel32LoadCount--;
            }

            pMod->Subsystem->LoadedModulesCount--;

            // Don't spam with the unload event.

            RemoveEntryList(&pMod->Link);

            IntWinModUnHookModule(pMod);

            IntWinModRemoveModule(pMod);

            return INT_STATUS_SUCCESS;
        }
    }

    return INT_STATUS_NOT_NEEDED_HINT;
}


INTSTATUS
IntWinModHandleUnloadFromVad(
    _In_ PWIN_PROCESS_OBJECT Process,
    _In_ PVAD Vad
    )
{
    INTSTATUS status = INT_STATUS_NOT_NEEDED_HINT;

    if (NULL != Process->Subsystemx86)
    {
        status = IntWinModHandleUnload(Process->Subsystemx86, Vad->StartPage);
        if (INT_STATUS_SUCCESS == status)
        {
            return status;
        }
    }

    if (NULL != Process->Subsystemx64)
    {
        status = IntWinModHandleUnload(Process->Subsystemx64, Vad->StartPage);
        if (INT_STATUS_SUCCESS == status)
        {
            return status;
        }
    }

    return status;
}


static BOOLEAN
IntWinModWriteValidHandler(
    _In_ QWORD Cr3,
    _In_ QWORD Address,
    _In_ void *Context
    )
{
    PWIN_PROCESS_MODULE pMod;

    UNREFERENCED_PARAMETER(Cr3);

    if (NULL == Context)
    {
        return FALSE;
    }

    pMod = (PWIN_PROCESS_MODULE)Context;

    // No cache, bail out, assuming the write is OK.
    if (NULL == pMod->Cache)
    {
        return TRUE;
    }

    if ((Address - pMod->VirtualBase >= pMod->Cache->Info.IatRva) &&
        (Address - pMod->VirtualBase < (QWORD)pMod->Cache->Info.IatRva + pMod->Cache->Info.IatSize))
    {
        // The write is inside the IAT, we can ignore it for now.
        return TRUE;
    }

    return FALSE;
}


static INTSTATUS
IntWinModHookPoly(
    _In_ PWIN_PROCESS_MODULE Module
    )
{
    INTSTATUS status;
    PBYTE pPage;
    IMAGE_SECTION_HEADER *sec;
    DWORD i;
    PWIN_PROCESS_OBJECT pProc;
    INTRO_PE_INFO peInfo = { 0 };

    pPage = NULL;

    pProc = Module->Subsystem->Process;

    status = IntVirtMemMap(Module->VirtualBase, PAGE_SIZE, pProc->Cr3, 0, &pPage);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntVirtMemMap failed: 0x%08x\n", status);
        return status;
    }

    status = IntPeValidateHeader(Module->VirtualBase, pPage, PAGE_SIZE, &peInfo, 0);
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntPeValidateHeader failed: 0x%08x\n", status);
        goto cleanup_and_exit;
    }

    Module->Size = peInfo.SizeOfImage;

    sec = (IMAGE_SECTION_HEADER *)(pPage + peInfo.SectionOffset);
    for (i = 0; i < peInfo.NumberOfSections; i++, sec++)
    {
        DWORD secsize = sec->Misc.VirtualSize;

        // Skip sections larger than 4 MB.
        if (secsize > 4 * ONE_MEGABYTE)
        {
            continue;
        }

        // Check if this is a code section.
        if ((sec->Characteristics & IMAGE_SCN_MEM_EXECUTE) ||
            (sec->Characteristics & IMAGE_SCN_CNT_CODE) ||
            (sec->Characteristics == (IMAGE_SCN_MEM_WRITE | IMAGE_SCN_MEM_READ)))
        {
            TRACE("[MODULE] Protecting pageable section: 0x%016llx, VA space 0x%016llx, length %x\n",
                  Module->VirtualBase + sec->VirtualAddress, pProc->Cr3, secsize);

            for (DWORD j = 0; j < secsize; j += 0x1000)
            {
                status = IntUnpWatchPage(pProc->Cr3,
                                         Module->VirtualBase + sec->VirtualAddress + j,
                                         IntWinModPolyHandler,
                                         IntWinModWriteValidHandler,
                                         Module);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntUnpWatchPage failed: 0x%08x\n", status);
                    break;
                }
            }
        }
    }

cleanup_and_exit:
    // The module may be partially protected against unpacking. This is not an issue, as the hooks will all be removed
    // when the process terminates (the unpacker works on a per/page basis). This only happens in case of errors.
    if (NULL != pPage)
    {
        IntVirtMemUnmap(&pPage);
    }

    return status;
}


INTSTATUS
IntWinModPolyHandler(
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress,
    _In_ PINSTRUX Instrux,
    _In_ void *Context
    )
{
    INTSTATUS status;
    char text[ND_MIN_BUF_SIZE];
    PWIN_PROCESS_MODULE pMod;

    if (NULL == Instrux)
    {
        return INT_STATUS_INVALID_PARAMETER_4;
    }

    if (NULL == Context)
    {
        return INT_STATUS_INVALID_PARAMETER_5;
    }

    pMod = (PWIN_PROCESS_MODULE)Context;

    if (pMod->UnpackAlertSent)
    {
        return INT_STATUS_SUCCESS;
    }

    status = NdToText(Instrux, VirtualAddress, ND_MIN_BUF_SIZE, text);
    if (!INT_SUCCESS(status))
    {
        strlcpy(text, "INVALID", sizeof(text));
    }

    LOG("[ALERT] [UNPACK DETECTED] Unpacked/decrypted page detected @ 0x%016llx:0x%016llx: %s\n", VirtualAddress, Cr3,
        text);

    pMod->UnpackAlertSent = TRUE;

    // Send the unpacker notification
    if (TRUE)
    {
        PEVENT_EPT_VIOLATION pEptViol = &gAlert.Ept;

        memzero(pEptViol, sizeof(*pEptViol));

        pEptViol->Header.Action = introGuestAllowed;
        pEptViol->HookStartPhysical = 0;
        pEptViol->HookStartVirtual = VirtualAddress & PAGE_MASK;
        pEptViol->Offset = VirtualAddress & PAGE_OFFSET;
        pEptViol->Victim.Type = (Cr3 != 0) ? introObjectTypeUmUnpack : introObjectTypeKmUnpack;
        pEptViol->Violation = IG_EPT_HOOK_EXECUTE;
        pEptViol->VirtualPage = VirtualAddress & PAGE_MASK;

        pEptViol->Header.CpuContext.Cpu = gVcpu->Index;
        pEptViol->Header.CpuContext.Rip = VirtualAddress;
        pEptViol->Header.CpuContext.Cr3 = Cr3;
        memcpy(pEptViol->Header.CpuContext.Instruction, text, sizeof(pEptViol->Header.CpuContext.Instruction));

        pEptViol->ExecInfo.Length = Instrux->Length;

        IntAlertFillWinProcess(pMod->Subsystem->Process, &pEptViol->Header.CurrentProcess);

        pEptViol->Header.MitreID = idSoftwarePacking;

        pEptViol->Header.Flags = IntAlertProcGetFlags(PROC_OPT_PROT_CORE_HOOKS,
                                                      pMod->Subsystem->Process, introReasonUnknown, 0);

        if (pMod->Subsystem->Process->SystemProcess)
        {
            pEptViol->Header.Flags |= ALERT_FLAG_SYSPROC;
        }

        IntAlertFillWinUmModule(pMod, &pEptViol->Victim.Module);

        IntAlertFillVersionInfo(&pEptViol->Header);

        status = IntNotifyIntroEvent(introEventEptViolation, pEptViol, sizeof(*pEptViol));
        if (!INT_SUCCESS(status))
        {
            WARNING("[WARNING] IntNotifyIntroEvent failed: 0x%08x\n", status);
        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntWinModRemoveModule(
    _In_ PWIN_PROCESS_MODULE Module
    )
{
    INTSTATUS status;

    if (NULL == Module)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    // Remove any pending swap operation.
    if (NULL != Module->HeadersSwapHandle)
    {
        status = IntSwapMemRemoveTransaction(Module->HeadersSwapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemRemoveTransaction failed: 0x%08x\n", status);
        }

        Module->HeadersSwapHandle = NULL;
    }

    if (NULL != Module->ExportsSwapHandle)
    {
        status = IntSwapMemRemoveTransaction(Module->ExportsSwapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemRemoveTransaction failed: 0x%08x\n", status);
        }

        Module->ExportsSwapHandle = NULL;
    }

    if (NULL != Module->SlackSpaceSwapHandle)
    {
        status = IntSwapMemRemoveTransaction(Module->SlackSpaceSwapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemRemoveTransaction failed: 0x%08x\n", status);
        }

        Module->SlackSpaceSwapHandle = NULL;
    }

    if (NULL != Module->MainModHeadersSwapHandle)
    {
        status = IntSwapMemRemoveTransaction(Module->MainModHeadersSwapHandle);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntSwapMemRemoveTransaction failed: 0x%08x\n", status);
        }

        Module->MainModHeadersSwapHandle = NULL;
    }

    IntWinUmModCacheRelease(Module->Cache);

    if (Module->IsMainModule)
    {
        IntWinUmPathDereference(&Module->Subsystem->Process->Path);
        Module->Subsystem->Process->MainModuleLoaded = FALSE;
    }

    IntWinUmPathDereference(&Module->Path);

    if (NULL != Module->IATBitmap)
    {
        HpFreeAndNullWithTag(&Module->IATBitmap, IC_TAG_IATB);
    }

    HpFreeAndNullWithTag(&Module, IC_TAG_MODU);

    return INT_STATUS_SUCCESS;
}


void
IntWinModulesChangeProtectionFlags(
    _In_ PWIN_PROCESS_SUBSYSTEM Subsystem
    )
{
    PLIST_ENTRY pList;

    // we already have the list of modules, simply iterate it and change protection
    pList = Subsystem->ProcessModules.Flink;
    while (pList != &Subsystem->ProcessModules)
    {
        PWIN_PROCESS_MODULE pMod = CONTAINING_RECORD(pList, WIN_PROCESS_MODULE, Link);

        pList = pList->Flink;

        if (!pMod->IsSystemModule)
        {
            continue;
        }

        // If this is a 32-bit process on a 64-bit guest, we need to check if we have to update protection
        // for WoW64 modules
        if ((winSubsys64Bit == Subsystem->SubsystemType) && (Subsystem->Process->Wow64Process))
        {
            if (IntWinModIsProtected(pMod, gProtectedWowModules, ARRAYSIZE(gProtectedWowModules)))
            {
                if (pMod->ShouldProtHooks && !Subsystem->Process->ProtCoreModules)
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_CORE_HOOKS enabled -> disabled for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                    pMod->ShouldProtHooks = FALSE;
                }
                else if (!pMod->ShouldProtHooks && Subsystem->Process->ProtCoreModules)
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_CORE_HOOKS disabled -> enabled for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                    pMod->ShouldProtHooks = TRUE;
                }
                else
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_CORE_HOOKS did not changed for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                }
            }
        }
        else
        {
            if (IntWinModIsProtected(pMod, gProtectedModules, ARRAYSIZE(gProtectedModules)))
            {
                if (pMod->ShouldProtHooks && !Subsystem->Process->ProtCoreModules)
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_CORE_HOOKS enabled -> disabled for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                    pMod->ShouldProtHooks = FALSE;
                }
                else if (!pMod->ShouldProtHooks && Subsystem->Process->ProtCoreModules)
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_CORE_HOOKS disabled -> enabled for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                    pMod->ShouldProtHooks = TRUE;
                }
                else
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_CORE_HOOKS did not changed for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                }
                break;
            }

            if (IntWinModIsProtected(pMod, gProtectedNetModules, ARRAYSIZE(gProtectedNetModules)))
            {
                if (pMod->ShouldProtHooks && !Subsystem->Process->ProtWsockModules)
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_WSOCK_HOOKS enabled -> disabled for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                    pMod->ShouldProtHooks = FALSE;
                }
                else if (!pMod->ShouldProtHooks && Subsystem->Process->ProtWsockModules)
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_WSOCK_HOOKS disabled -> enabled for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                    pMod->ShouldProtHooks = TRUE;
                }
                else
                {
                    TRACE("[WINMODULE] PROC_PROT_MASK_WSOCK_HOOKS did not changed for %s (Process %d)\n",
                          utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
                }
                break;
            }
        }

        // if this is the main module, check if unpack protection changed
        if (pMod->IsMainModule)
        {
            if (pMod->ShouldProtUnpack && !Subsystem->Process->ProtUnpack)
            {
                INTSTATUS status;

                TRACE("[WINMODULE] PROC_PROT_MASK_UNPACK enabled -> disabled for %s (Process %d). "
                      "Unwatching VA space 0x%016llx...\n", utf16_for_log(pMod->Path->Path),
                      Subsystem->Process->Pid, Subsystem->Process->Cr3);

                status = IntUnpUnWatchVaSpacePages(Subsystem->Process->Cr3);
                if (!INT_SUCCESS(status) && (INT_STATUS_NOT_FOUND != status))
                {
                    ERROR("[ERROR] IntUnpUnWatchVaSpacePages failed: 0x%x\n", status);
                }

                pMod->ShouldProtUnpack = FALSE;
            }
            else if (!pMod->ShouldProtUnpack && Subsystem->Process->ProtUnpack)
            {
                INTSTATUS status;

                TRACE("[WINMODULE] PROC_PROT_MASK_UNPACK disabled -> enabled for %s (Process %d)\n",
                      utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);

                status = IntWinModHookPoly(pMod);
                if (!INT_SUCCESS(status))
                {
                    ERROR("[ERROR] IntWinModHookPoly failed: 0x%x\n", status);
                }

                pMod->ShouldProtUnpack = TRUE;
            }
            else
            {
                TRACE("[WINMODULE] PROC_PROT_MASK_UNPACK did not changed for %s (Process %d)\n",
                      utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid);
            }
        }
        // if this is not the main module, check it is hooked and should be unhooked (or the other way)
        else if ((pMod->ShouldProtHooks) && (!pMod->IsProtected))
        {
            INTSTATUS status;

            TRACE("[WINMODULE] Protecting module with base 0x%016llx -> 0x%016llx against hooking.\n",
                  pMod->VirtualBase, Subsystem->Process->Cr3);

            status = IntWinModHookModule(pMod);
            if (!INT_SUCCESS(status))
            {
                ERROR("[ERROR] IntWinModHookModule failed for %s (Process %d): 0x%x\n",
                      utf16_for_log(pMod->Path->Path), Subsystem->Process->Pid, status);
            }
        }
        else if ((!pMod->ShouldProtHooks) && (pMod->IsProtected))
        {
            TRACE("[WINMODULE] Removing protection for module with base 0x%016llx -> 0x%016llx\n",
                  pMod->VirtualBase, Subsystem->Process->Cr3);

            IntWinModUnHookModule(pMod);
        }
    }
}


PWIN_PROCESS_MODULE
IntWinUmModFindByAddress(
    _In_ PWIN_PROCESS_OBJECT Process,
    _In_ QWORD Gva
    )
{
    LIST_ENTRY *list;

    if (NULL != Process->Subsystemx64)
    {
        list = Process->Subsystemx64->ProcessModules.Flink;
        while (list != &Process->Subsystemx64->ProcessModules)
        {
            PWIN_PROCESS_MODULE pMod = CONTAINING_RECORD(list, WIN_PROCESS_MODULE, Link);
            list = list->Flink;

            if (IN_RANGE_LEN(Gva, pMod->VirtualBase, pMod->Size))
            {
                return pMod;
            }
        }
    }

    if (NULL != Process->Subsystemx86)
    {
        list = Process->Subsystemx86->ProcessModules.Flink;
        while (list != &Process->Subsystemx86->ProcessModules)
        {
            PWIN_PROCESS_MODULE pMod = CONTAINING_RECORD(list, WIN_PROCESS_MODULE, Link);
            list = list->Flink;

            if (IN_RANGE_LEN(Gva, pMod->VirtualBase, pMod->Size))
            {
                return pMod;
            }
        }
    }

    return NULL;
}