winummodule.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _WINUMMODULE_H_
#define _WINUMMODULE_H_

#include "winumcache.h"
#include "winvad.h"

#define NAMEHASH_NTDLL          0xbe9d4ec5
#define NAMEHASH_KERNEL32       0x72f47653
#define NAMEHASH_KERNELBASE     0x2945f399
#define NAMEHASH_USER32         0xb8d0fd42

#define NAMEHASH_WOW64          0xb29d7275
#define NAMEHASH_WOW64WIN       0xb3ad9cbb
#define NAMEHASH_WOW64CPU       0x824c82be

#define NAMEHASH_WS2_32         0x3d20b35c
#define NAMEHASH_WININET        0x7350cbf8

#define NAMEHASH_VERIFIER       0x3608e61f
#define NAMEHASH_APISETSCHEMA   0x6b8a8a45


typedef struct _WIN_PROCESS_MODULE
{
    LIST_ENTRY          Link;                   

    QWORD               VirtualBase;            
    DWORD               Size;                   

    union
    {
        DWORD           Flags;                  
        struct
        {
            DWORD       ShouldProtHooks: 1;     
            DWORD       ShouldProtUnpack: 1;    
            DWORD       UnpackAlertSent: 1;     
            DWORD       Is64BitModule: 1;       
            DWORD       IsProtected: 1;         
            DWORD       IsMainModule: 1;        
            DWORD       IsSystemModule : 1;     
            DWORD       LoadEventSent: 1;       
            DWORD       UnloadEventSent: 1;     
            DWORD       IsSuspicious: 1;        
            DWORD       SuspChecked: 1;         
            DWORD       StaticScan: 1;
            DWORD       ShouldGetCache: 1;      
            DWORD       DoubleAgentAlertSent: 1;
        };
    };

    PWIN_PROCESS_SUBSYSTEM  Subsystem;          

    WINUM_PATH              *Path;              
    WINUM_MODULE_CACHE      *Cache;             

    DWORD                   IATEntries;         
    PBYTE                   IATBitmap;          

    void                    *HookObject;        
    void                    *HeadersSwapHandle; 
    void                    *ExportsSwapHandle; 

    void                    *ModBlockObject;    

    QWORD                   SlackSpaceForVerifier;
    QWORD                   AddressOfVerifierData;
    BOOLEAN                 FirstDoubleAgentExecDone;
    void                    *SlackSpaceSwapHandle;

    void                    *MainModHeadersSwapHandle;

    const VAD               *Vad;               

} WIN_PROCESS_MODULE, *PWIN_PROCESS_MODULE;


typedef struct _PROTECTED_DLL_INFO
{
    WCHAR   *Name;      
    DWORD   NameHash;   
} PROTECTED_DLL_INFO, * PPROTECTED_DLL_INFO;


#define MODULE_MATCH(m, p)      ((((m)->Path->NameHash == (p)->NameHash)) && \
                                (0 == memcmp((m)->Path->Name, (p)->Name, (m)->Path->NameSize)))


//
// API
//
INTSTATUS
IntWinModHandleLoadFromVad(
    _In_ WIN_PROCESS_OBJECT *Process,
    _In_ const VAD *Vad
    );

INTSTATUS
IntWinModHandleUnloadFromVad(
    _In_ PWIN_PROCESS_OBJECT Process,
    _In_ PVAD Vad
    );

INTSTATUS
IntWinModHandleWrite(
    _In_opt_ void *Context,
    _In_ void *Hook,
    _In_ QWORD Address,
    _Out_ INTRO_ACTION *Action
    );

INTSTATUS
IntWinModPolyHandler(
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress,
    _In_ PINSTRUX Instrux,
    _In_ void *Context
    );

INTSTATUS
IntWinModUnHookModule(
    _In_ PWIN_PROCESS_MODULE Module
    );

INTSTATUS
IntWinModRemoveModule(
    _In_ PWIN_PROCESS_MODULE Module
    );

void
IntWinModulesChangeProtectionFlags(
    _In_ PWIN_PROCESS_SUBSYSTEM Subsystem
    );

PWIN_PROCESS_MODULE
IntWinUmModFindByAddress(
    _In_ PWIN_PROCESS_OBJECT Process,
    _In_ QWORD Gva
    );

INTSTATUS
IntWinModHandlePreInjection(
    _In_ void *Context,
    _In_ QWORD Cr3,
    _In_ QWORD VirtualAddress
    );

INTSTATUS
IntWinProcSendAllDllEventsForProcess(
    _In_ PWIN_PROCESS_OBJECT Process
    );

#endif // _WINUMMODULE_H_