winvad.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _WINVAD_H_
#define _WINVAD_H_

#include "detours.h"
#include "winprocess.h"

#define PROT_READ 1
#define PROT_WRITE 2
#define PROT_EXEC 4

typedef enum
{
    VAD_PROT_NOACCESS = 0x0000,
    VAD_PROT_READONLY = 0x0001,
    VAD_PROT_EXECUTE = 0x0002,
    VAD_PROT_EXECUTE_READ = 0x0003,
    VAD_PROT_READWRITE = 0x0004,
    VAD_PROT_WRITECOPY = 0x0005,
    VAD_PROT_EXECUTE_READWRITE = 0x0006,
    VAD_PROT_EXECUTE_WRITECOPY = 0x0007,
    VAD_PROT_NOCACHE = 0x0008,
    VAD_PROT_GUARD = 0x0010,
    VAD_PROT_WRITECOMBINE = 0x0020,
} WIN_VAD_PROT;

typedef struct _VAD_PAGE
{
    QWORD       Address;

    DWORD       VmProtection;
    DWORD       Protection;

    struct _VAD *Vad;
    void        *ExecHook;

    QWORD       RangeStart;
    QWORD       RangeEnd;

    BOOLEAN     Legitimate;
} VAD_PAGE, *PVAD_PAGE;

typedef struct _VAD
{
    RBNODE RbNode;
    QWORD Left;
    QWORD Right;
    QWORD Parent;
    QWORD StartPage;
    QWORD EndPage;
    QWORD VadGva;
    QWORD PageCount;
    DWORD VadProtection;
    VAD_TYPE VadType;
    DWORD Protection;

    WIN_PROCESS_OBJECT *Process;
    VAD_PAGE **VadPages;
    void *PathSwapHandle;

    QWORD SubsectionGva;

    WINUM_PATH *Path;

    DWORD ExecCount;

    struct
    {
        DWORD StaticScan : 1;
        DWORD IsStack : 1;
        DWORD HugeVad : 1;
        DWORD IsIgnored : 1;
        DWORD NoChange : 1;
        DWORD PrivateFixup : 1;
        DWORD DeleteInProgress : 1;
        DWORD Unused : 25;
    };
} VAD, *PVAD;

typedef INTSTATUS (*PFUNC_WinVadTraversalCallback)(
    _In_ QWORD VadNodeGva,
    _In_ DWORD Level,
    _In_opt_ void *Context
    );

void
IntWinVadProcessInit(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

VAD *
IntWinVadFindByVa(
    _In_ WIN_PROCESS_OBJECT *Process,
    _In_ QWORD Va
    );

INTSTATUS
IntWinVadHandleInsert(
    _In_ void const *Detour
    );

INTSTATUS
IntWinVadHandleInsertPrivate(
    _In_ void const *Detour
    );

INTSTATUS
IntWinVadHandleInsertMap(
    _In_ void const *Detour
    );

INTSTATUS
IntWinVadHandleVirtualProtect(
    _In_ void const *Detour
    );

INTSTATUS
IntWinVadHandleDeleteVaRange(
    _In_ void const *Detour
    );

INTSTATUS
IntWinVadHandleFinishVadDeletion(
    _In_ void const *Detour
    );

INTSTATUS
IntWinVadImportProcessTree(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

INTSTATUS
IntWinVadRemoveProcessTree(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

void
IntWinVadStopExploitMonitor(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

INTSTATUS
IntWinVadShortDump(
    _In_ QWORD VadNodeGva,
    _In_ DWORD Level,
    _In_opt_ void *Context
    );

QWORD
IntWinVadFindNodeInGuestSpace(
    _In_ QWORD VadRoot,
    _In_ QWORD StartPage,
    _In_ QWORD EndPage,
    _In_ DWORD Level,
    _In_ QWORD OldStartPage,
    _In_ BOOLEAN LastBranchRight
    );

INTSTATUS
IntWinVadInOrderRecursiveTraversal(
    _In_ QWORD VadNodeGva,
    _In_ DWORD Level,
    _In_ PFUNC_WinVadTraversalCallback Callback,
    _In_opt_ void *Context
    );

_Function_class_(FUNC_RbTreeWalkCallback)
BOOLEAN
IntWinVadDump(
    _In_ VAD const *Vad,
    _In_ void *Context
    );

INTSTATUS
IntWinVadWalkTree(
    _In_ PWIN_PROCESS_OBJECT Process,
    _In_ PFUNC_RbTreeWalkCallback Callback
    );

INTSTATUS
IntWinVadHandleCommit(
    _In_ void const *Detour
    );

VAD *
IntWinVadFindAndUpdateIfNecessary(
    _Inout_ WIN_PROCESS_OBJECT *Process,
    _In_ QWORD StartHint,
    _In_ QWORD LengthHint
    );

_Function_class_(PFUNC_PreDetourCallback)
INTSTATUS
IntWinPatchVadHandleCommit(
    _In_ QWORD FunctionAddress,
    _Inout_ API_HOOK_HANDLER *Handler,
    _In_ void *Descriptor
    );

BOOLEAN
IntWinVadIsInTree(
    _In_ const VAD *Vad
    );

_Function_class_(PFUNC_PreDetourCallback)
INTSTATUS
IntWinVadPatchInsertPrivate(
    _In_ QWORD FunctionAddress,
    _Inout_ API_HOOK_HANDLER *Handler,
    _In_ void *Descriptor
    );

_Function_class_(PFUNC_PreDetourCallback)
INTSTATUS
IntWinVadPatchInsertMap(
    _In_ QWORD FunctionAddress,
    _Inout_ API_HOOK_HANDLER *Handler,
    _In_ void *Descriptor
    );

_Function_class_(PFUNC_PreDetourCallback)
INTSTATUS
IntWinVadPatchVirtualProtect(
    _In_ QWORD FunctionAddress,
    _Inout_ API_HOOK_HANDLER *Handler,
    _In_ void *Descriptor
    );

_Function_class_(PFUNC_PreDetourCallback)
INTSTATUS
IntWinVadPatchDeleteVaRange(
    _In_ QWORD FunctionAddress,
    _Inout_ API_HOOK_HANDLER *Handler,
    _In_ void *Descriptor
    );

_Function_class_(PFUNC_PreDetourCallback)
INTSTATUS
IntWinVadPatchFinishVadDeletion(
    _In_ QWORD FunctionAddress,
    _Inout_ API_HOOK_HANDLER *Handler,
    _In_ void *Descriptor
    );

_Function_class_(PFUNC_PreDetourCallback)
INTSTATUS
IntWinVadPatchInsert(
    _In_ QWORD FunctionAddress,
    _Inout_ API_HOOK_HANDLER *Handler,
    _In_ void *Descriptor
    );

INTSTATUS
IntWinVadProcImportMainModuleVad(
    _Inout_ WIN_PROCESS_OBJECT *Process
    );

void
IntWinVadDestroyObject(
    _Inout_ VAD **Vad
    );

INTSTATUS
IntWinVadFetchByRange(
    _In_ QWORD VadRoot,
    _In_ QWORD StartPage,
    _In_ QWORD EndPage,
    _Out_ VAD *Vad
    );

#endif