exceptions.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _EXCEPTIONS_H_
#define _EXCEPTIONS_H_



#include "guest_stack.h"
#include "drivers.h"
#include "integrity.h"
#include "introcpu.h"
#include "lixprocess.h"
#include "winummodule.h"

// Special value, so we don't log this
#define EXCEPTION_INTROUNIT_NAME_HASH   0x1036c1b7
#define EXCEPTION_NO_NAME               "<no name>"
#define EXCEPTION_NO_WNAME              u"<no name>"
#define EXCEPTION_NO_INSTRUCTION        "<generic>"
#define EXCEPTION_NO_SYMBOL             "<no sym>"

#define EXPORT_BEGIN_WRITE_ERR_RANGE    0x10
#define EXPORT_NAME_UNKNOWN             "<unknown>"

#define EXCEPTION_UM_GLOB_LENGTH        64

//
// We group exceptions into 16 categories, by the originator hash:
// 0 - GeneralExceptions (special ones)
// 0x00000001 - 0x0fffffff
// 0x10000000 - 0x1fffffff
// 0x20000000 - 0x2fffffff
// .......................
// 0xf0000000 - 0xfffffffe
//
// NOTE: 0xffffffff as a hash is invalid!
// NOTE: When the PathHash is missing we use the NameHash;
//
#define EXCEPTION_TABLE_SIZE            0x10
#define EXCEPTION_TABLE_ID(H)           (((H) & 0xF0000000) >> 0x1c)

#define EXCEPTION_CODEBLOCKS_OFFSET     0x250

typedef enum _EXCEPTION_TYPE
{
    exceptionTypeUm,                        
    exceptionTypeKm,                        
    exceptionTypeUmGlob,                    
    exceptionTypeKmUm,                      
} EXCEPTION_TYPE;


typedef enum _EXCEPTION_SIGNATURE_TYPE
{
    signatureTypeVersionOs          = 50,   
    signatureTypeVersionIntro       = 51,   
    signatureTypeProcessCreation    = 70,   
    signatureTypeExport             = 100,  
    signatureTypeValue              = 200,  
    signatureTypeIdt                = 300,  
    signatureTypeValueCode          = 500,  
    signatureTypeCodeBlocks         = 600,  
} EXCEPTION_SIGNATURE_TYPE;


typedef struct _EXCEPTIONS
{
    LIST_HEAD   GenericKernelExceptions;
    LIST_HEAD   GenericUserExceptions;

    LIST_HEAD   GenericKernelUserExceptions;

    LIST_HEAD   NoNameKernelExceptions;
    LIST_HEAD   NoNameUserExceptions;

    LIST_HEAD   NoNameKernelUserExceptions;

    LIST_HEAD   GlobUserExceptions;

    LIST_HEAD   KernelExceptions[EXCEPTION_TABLE_SIZE];     
    LIST_HEAD   KernelUserExceptions[EXCEPTION_TABLE_SIZE]; 
    LIST_HEAD   UserExceptions[EXCEPTION_TABLE_SIZE];       
    LIST_HEAD   ProcessCreationExceptions;                  

    LIST_HEAD   UserFeedbackExceptions;
    LIST_HEAD   KernelFeedbackExceptions;
    LIST_HEAD   KernelUserFeedbackExceptions;
    LIST_HEAD   ProcessCreationFeedbackExceptions;

    LIST_HEAD   ProcessCreationAlertExceptions;
    LIST_HEAD   UserAlertExceptions;
    LIST_HEAD   KernelAlertExceptions;
    LIST_HEAD   KernelUserAlertExceptions;

    LIST_HEAD   CbSignatures;                           
    LIST_HEAD   ExportSignatures;                       
    LIST_HEAD   ValueSignatures;                        
    LIST_HEAD   ValueCodeSignatures;                    
    LIST_HEAD   IdtSignatures;                          
    LIST_HEAD   VersionOsSignatures;                    
    LIST_HEAD   VersionIntroSignatures;                 
    LIST_HEAD   ProcessCreationSignatures;              

    struct
    {
        DWORD       Build;
        WORD        Major;
        WORD        Minor;
    } Version;                                          

    BOOLEAN     Loaded;                                 
} EXCEPTIONS, *PEXCEPTIONS;


typedef enum _KM_EXCEPTION_OBJECT
{
    kmObjNone = 0,         
    kmObjAny,              
    kmObjDriver,           
    kmObjDriverImports,    
    kmObjDriverCode,       
    kmObjDriverData,       
    kmObjDriverResources,  
    kmObjSsdt,             
    kmObjDrvObj,           
    kmObjFastIo,           
    kmObjMsr,              
    kmObjCr4,              
    kmObjHalHeap,          
    kmObjSelfMapEntry,     
    kmObjIdt,              
    kmObjIdtr,             
    kmObjGdtr,             
    kmObjLoggerCtx,
    kmObjDriverExports,    
    kmObjTokenPrivs,       
    kmObjSharedUserData,   

    // Add more as needed
} KM_EXCEPTION_OBJECT;


typedef enum _KUM_EXCEPTION_OBJECT
{
    kumObjNone = 0,         
    kumObjAny,              
    kumObjModule,           
    kumObjModuleImports,    
    kumObjModuleExports     

    // Add more as needed
} KUM_EXCEPTION_OBJECT;


typedef enum _UM_EXCEPTION_OBJECT
{
    umObjNone = 0,              
    umObjAny,                   
    umObjProcess,               
    umObjModule,                
    umObjModuleImports,         
    umObjNxZone,                
    umObjModuleExports,         
    umObjProcessThreadContext,
    umObjProcessPeb32,          
    umObjProcessPeb64,          
    umObjProcessApcThread,
    umObjProcessCreation,       
    umObjModuleLoad,
    umObjProcessCreationDpi,    
    umObjSharedUserData,        

    // Add more as needed
} UM_EXCEPTION_OBJECT;



#pragma pack(push)
#pragma pack(4)
typedef union _EXCEPTION_SIGNATURE_ID
{
    struct
    {
        DWORD Value : 22;               
        DWORD Type : 10;                
    } Field;

    DWORD Value;                        
} EXCEPTION_SIGNATURE_ID, *PEXCEPTION_SIGNATURE_ID;


typedef struct _KM_EXCEPTION
{
    LIST_ENTRY  Link;

    DWORD       OriginatorNameHash;             

    DWORD       VictimNameHash;                 

    DWORD       Flags;                          

    KM_EXCEPTION_OBJECT Type;                   

    QWORD       Context;                        

    WORD                        SigCount;       
    EXCEPTION_SIGNATURE_ID      Signatures[];   
} KM_EXCEPTION, *PKM_EXCEPTION;


typedef struct _KUM_EXCEPTION
{
    LIST_ENTRY  Link;

    DWORD       OriginatorNameHash;             

    struct
    {
        DWORD   NameHash;                       
        DWORD   ProcessHash;
    } Victim;

    DWORD       Flags;                          

    KUM_EXCEPTION_OBJECT Type;                  

    QWORD       Context;                        

    WORD                        SigCount;       
    EXCEPTION_SIGNATURE_ID      Signatures[];   
} KUM_EXCEPTION, *PKUM_EXCEPTION;



typedef struct _UM_EXCEPTION
{
    LIST_ENTRY  Link;

    DWORD       OriginatorNameHash;         

    struct
    {
        DWORD   NameHash;                   
        DWORD   ProcessHash;
    } Victim;

    DWORD       Flags;                      

    UM_EXCEPTION_OBJECT Type;               

    QWORD       Context;                    

    WORD                    SigCount;       
    EXCEPTION_SIGNATURE_ID  Signatures[];   
} UM_EXCEPTION, *PUM_EXCEPTION;


typedef struct _UM_EXCEPTION_GLOB
{
    LIST_ENTRY  Link;

    char        OriginatorNameGlob[EXCEPTION_UM_GLOB_LENGTH];

    struct
    {
        CHAR    NameGlob[EXCEPTION_UM_GLOB_LENGTH];
        CHAR    ProcessGlob[EXCEPTION_UM_GLOB_LENGTH];
    } Victim;

    DWORD       Flags;                                  

    UM_EXCEPTION_OBJECT Type;                           

    QWORD       Context;                                

    WORD                        SigCount;               
    EXCEPTION_SIGNATURE_ID      Signatures[];           
} UM_EXCEPTION_GLOB, *PUM_EXCEPTION_GLOB;


typedef struct _SIG_CODEBLOCK_HASH
{
    BYTE    Count;                      
    DWORD   Hashes[];                   
} SIG_CODEBLOCK_HASH, *PSIG_CODEBLOCK_HASH;


typedef struct _SIG_VALUE_HASH
{
    WORD    Offset;                 
    WORD    Size;                   
    DWORD   Hash;                   
} SIG_VALUE_HASH, *PSIG_VALUE_HASH;


typedef struct _SIG_EXPORT_HASH
{
    WORD    Delta;                  
    DWORD   Hash;                   
} SIG_EXPORT_HASH, *PSIG_EXPORT_HASH;


typedef struct _EXCEPTION_CB_SIGNATURE
{
    LIST_ENTRY  Link;

    EXCEPTION_SIGNATURE_ID  Id;         
    DWORD       Flags;                  

    BYTE        Score;                  
    BYTE        ListsCount;             
    BOOLEAN     AlertSignature;         

    CHAR        Object[];               
} SIG_CODEBLOCKS, *PSIG_CODEBLOCKS;


typedef struct _SIG_VALUE_CODE
{
    LIST_ENTRY  Link;

    EXCEPTION_SIGNATURE_ID  Id;         
    DWORD       Flags;                  

    INT16       Offset;                 
    WORD        Length;                 
    BOOLEAN     AlertSignature;         

    WORD        Object[];               
} SIG_VALUE_CODE, *PSIG_VALUE_CODE;


typedef struct _SIG_EXPORT
{
    LIST_ENTRY  Link;

    EXCEPTION_SIGNATURE_ID  Id;         
    DWORD       Flags;                  

    DWORD       LibraryNameHash;        

    BYTE        ListsCount;             
    BOOLEAN     AlertSignature;         

    CHAR        Object[];               
} SIG_EXPORT, *PSIG_EXPORT;


typedef struct _SIG_VALUE
{
    LIST_ENTRY  Link;

    EXCEPTION_SIGNATURE_ID  Id;         
    DWORD       Flags;                  

    BYTE        Score;                  
    BYTE        ListsCount;             
    BOOLEAN     AlertSignature;         

    CHAR        Object[];               
} SIG_VALUE, *PSIG_VALUE;


typedef struct _SIG_IDT
{
    LIST_ENTRY  Link;

    EXCEPTION_SIGNATURE_ID  Id;         
    DWORD       Flags;                  

    BYTE        Entry;                  

    BOOLEAN     AlertSignature;         
} SIG_IDT, *PSIG_IDT;


typedef struct _SIG_VERSION_OS
{
    LIST_ENTRY  Link;

    EXCEPTION_SIGNATURE_ID  Id;         
    DWORD       Flags;                  

    BOOLEAN     AlertSignature;         

    union
    {
        struct
        {
            BYTE Version;
            BYTE Patch;
            WORD Sublevel;
            WORD Backport;
            BYTE _Reserved[2];
        };

        QWORD Value;            
    } Minimum;

    union
    {
        struct
        {
            BYTE Version;
            BYTE Patch;
            WORD Sublevel;
            WORD Backport;
            BYTE _Reserved[2];
        };

        QWORD Value;                
    } Maximum;

} SIG_VERSION_OS, *PSIG_VERSION_OS;


typedef struct _SIG_VERSION_INTRO
{
    LIST_ENTRY  Link;

    EXCEPTION_SIGNATURE_ID  Id;         
    DWORD       Flags;                  

    BOOLEAN     AlertSignature;         

    union
    {
        struct
        {
            WORD    Major;
            WORD    Minor;
            WORD    Revision;
            WORD    Build;
        };

        QWORD Raw;
    } Minimum;

    union
    {
        struct
        {
            WORD    Major;
            WORD    Minor;
            WORD    Revision;
            WORD    Build;
        };

        QWORD Raw;
    } Maximum;

} SIG_VERSION_INTRO, *PSIG_VERSION_INTRO;


typedef struct _SIG_PROCESS_CREATION
{
    LIST_ENTRY  Link;

    EXCEPTION_SIGNATURE_ID  Id;     
    DWORD       Flags;              

    BOOLEAN     AlertSignature;     

    DWORD       CreateMask;         

} SIG_PROCESS_CREATION, *PSIG_PROCESS_CREATION;

#pragma pack(pop)


typedef enum _EXCEPTION_FLG
{
    EXCEPTION_FLG_FEEDBACK          = 0x00000001,       
    EXCEPTION_FLG_32                = 0x00000002,       
    EXCEPTION_FLG_64                = 0x00000004,       
    EXCEPTION_FLG_INIT              = 0x00000008,
    EXCEPTION_FLG_RETURN            = 0x00000010,

    EXCEPTION_FLG_LINUX             = 0x00000080,       

    EXCEPTION_FLG_READ              = 0x10000000,       
    EXCEPTION_FLG_WRITE             = 0x20000000,       
    EXCEPTION_FLG_EXECUTE           = 0x40000000,       

    EXCEPTION_FLG_IGNORE            = 0x80000000,       

    EXCEPTION_KM_FLG_NON_DRIVER     = 0x00000100,
    EXCEPTION_KM_FLG_RETURN_DRV     = 0x00000200,
    EXCEPTION_KM_FLG_SMAP           = 0x00000400,       
    EXCEPTION_KM_FLG_SMEP           = 0x00000800,       

    EXCEPTION_KM_FLG_INTEGRITY      = 0x00001000,       

    EXCEPTION_UM_FLG_SYS_PROC       = 0x00000100,
    EXCEPTION_UM_FLG_CHILD_PROC     = 0x00000200,

    EXCEPTION_UM_FLG_ONETIME        = 0x00000800,       
    EXCEPTION_UM_FLG_LIKE_APPHELP   = 0x00001000,       

} EXCEPTION_FLG;


typedef enum _KM_EXCEPTION_NAME
{
    kmExcNameAny = 0,       
    kmExcNameOwn,           
    kmExcNameKernel,        
    kmExcNameHal,           
    kmExcNameNone,          

    // Note: Add new names only from this line on, because the exception generation
    // script depends on the ordering of these values.

    kmExcNameVdso,          
    kmExcNameVsyscall,      

    kmExcNameVeAgent,       

    // Add more as needed

    kmExcNameInvalid        

} KM_EXCEPTION_NAME;


typedef enum _UM_EXCEPTION_NAME
{
    umExcNameAny = 0,       
    umExcNameOwn,           
    umExcNameVdso,          
    umExcNameVsyscall,      

    umExcNameNone,          

    // Add more as needed

    umExcNameInvalid        
} UM_EXCEPTION_NAME;


typedef enum _SIGNATURE_FLG
{
    SIGNATURE_FLG_32                    = 0x00000001,   
    SIGNATURE_FLG_64                    = 0x00000002,   

    SIGNATURE_FLG_CB_MEDIUM             = 0x00000004,   

    SIGNATURE_FLG_VALUE_CLI             = 0x00010000,

    SIGNATURE_FLG_LINUX                 = 0x00000080,   

} SIGNATURE_FLG;


//
// Zone flags
//
#define ZONE_LIB_IMPORTS        0x000000001ULL  
#define ZONE_LIB_EXPORTS        0x000000002ULL  
#define ZONE_LIB_CODE           0x000000004ULL  
#define ZONE_LIB_DATA           0x000000008ULL  
#define ZONE_LIB_RESOURCES      0x000000010ULL

#define ZONE_PROC_THREAD_CTX    0x000000020ULL  
#define ZONE_PROC_THREAD_APC    0x000000040ULL  
#define ZONE_DEP_EXECUTION      0x000000080ULL  
#define ZONE_MODULE_LOAD        0x000000100ULL  

#define ZONE_WRITE              0x010000000ULL  
#define ZONE_READ               0x020000000ULL  
#define ZONE_EXECUTE            0x040000000ULL  

#define ZONE_INTEGRITY          0x100000000ULL  


typedef enum _ZONE_TYPE
{
    exceptionZoneEpt = 1,       
    exceptionZoneMsr,           
    exceptionZoneCr,            
    exceptionZoneIntegrity,     
    exceptionZoneProcess,       
    exceptionZoneDtr,           
} ZONE_TYPE;


typedef struct _EXCEPTION_VICTIM_EPT
{
    QWORD   Gva;                
    QWORD   Gpa;                
} EXCEPTION_VICTIM_EPT, *PEXCEPTION_VICTIM_EPT;


typedef struct _EXCEPTION_VICTIM_MSR
{
    QWORD   NewDriverBase;      
    DWORD   Msr;                
} EXCEPTION_VICTIM_MSR, *PEXCEPTION_VICTIM_MSR;


typedef struct _EXCEPTION_VICTIM_CR
{
    DWORD   Cr;                 

    BOOLEAN Smap;               
    BOOLEAN Smep;               
} EXCEPTION_VICTIM_CR, *PEXCEPTION_VICTIM_CR;


typedef struct _EXCEPTION_VICTIM_DTR
{
    INTRO_OBJECT_TYPE   Type;   
} EXCEPTION_VICTIM_DTR, *PEXCEPTION_VICTIM_DTR;


typedef struct _EXCEPTION_VICTIM_INTEGRITY
{
    QWORD   StartVirtualAddress;    
    DWORD   Offset;                 
    DWORD   TotalLength;            
} EXCEPTION_VICTIM_INTEGRITY, *PEXCEPTION_VICTIM_INTEGRITY;


typedef struct _EXCEPTION_VICTIM_INJECTION
{
    QWORD   Gva;                    
    DWORD   Length;                 

    BYTE    *Buffer;                
    DWORD   BufferSize;             
} EXCEPTION_VICTIM_INJECTION, *PEXCEPTION_VICTIM_INJECTION;

typedef struct _EXCEPTION_VICTIM_MODULE
{
    union
    {
        void                *Module;    
        WIN_PROCESS_MODULE  *WinMod;    

    };

    char    SectionName[9];             

    WINUM_CACHE_EXPORT  *Export;        
} EXCEPTION_VICTIM_MODULE, *PEXCEPTION_VICTIM_MODULE;


typedef struct _EXCEPTION_VICTIM_OBJECT
{
    INTRO_OBJECT_TYPE   Type;           

    DWORD               NameHash;       

    union
    {
        char    *Name;                  
        WCHAR   *NameWide;              
    };

    QWORD               BaseAddress;

    union
    {
        union
        {
            EXCEPTION_VICTIM_MODULE Module;         
            WIN_DRIVER_OBJECT       *DriverObject;  
        };

        // All of the fields can be valid (injection into a library which has a VAD for eg.).
        struct
        {
            VAD                     *Vad;           
            EXCEPTION_VICTIM_MODULE Library;        

            union
            {
                void               *Process;        
                WIN_PROCESS_OBJECT *WinProc;        
                LIX_TASK_OBJECT    *LixProc;        
            };
        };
    };
} EXCEPTION_VICTIM_OBJECT, *PEXCEPTION_VICTIM_OBJECT;


typedef struct _EXCEPTION_VICTIM_ZONE
{
    EXCEPTION_VICTIM_OBJECT Object;             

    ZONE_TYPE               ZoneType;           
    QWORD                   ZoneFlags;          

    QWORD                   ProtectionFlag;     

    union
    {
        EXCEPTION_VICTIM_EPT        Ept;        
        EXCEPTION_VICTIM_MSR        Msr;        
        EXCEPTION_VICTIM_CR         Cr;         
        EXCEPTION_VICTIM_DTR        Dtr;        
        EXCEPTION_VICTIM_INTEGRITY  Integrity;  
        EXCEPTION_VICTIM_INJECTION  Injection;  
    };

    union
    {
        struct
        {
            QWORD   OldValue[8];    
            QWORD   NewValue[8];    

            DWORD   AccessSize;     
        } WriteInfo;

        struct
        {
            QWORD   Value[8];       

            DWORD   AccessSize;     
        } ReadInfo;

        struct
        {
            QWORD       Rsp;        
            QWORD       StackBase;  
            QWORD       StackLimit; 
            DWORD       Length;     
        } ExecInfo;
    };
} EXCEPTION_VICTIM_ZONE, *PEXCEPTION_VICTIM_ZONE;


typedef struct _EXCEPTION_KM_ORIGINATOR
{
    struct
    {
        DWORD           NameHash;               
        DWORD           PathHash;               
        KERNEL_DRIVER   *Driver;                
        QWORD           Rip;                    
        CHAR            Section[9];             
    } Return;

    STACK_ELEMENT StackElements[8];             
    STACK_TRACE StackTrace;

    // Only valid in kernel exceptions
    struct
    {
        DWORD           NameHash;               
        DWORD           PathHash;               
        KERNEL_DRIVER   *Driver;                
        QWORD           Rip;                    
        CHAR            Section[9];             
    } Original;

    INSTRUX                 *Instruction;

    BOOLEAN                 IsEntryPoint;       
    BOOLEAN                 IsIntegrity;        
} EXCEPTION_KM_ORIGINATOR, *PEXCEPTION_KM_ORIGINATOR;


typedef struct _EXCEPTION_UM_ORIGINATOR
{
    DWORD       NameHash;       

    union
    {
        PCHAR   Name;           
        PWCHAR  NameWide;       
    };

    union
    {
        void                *Process;   
        WIN_PROCESS_OBJECT  *WinProc;   
        LIX_TASK_OBJECT     *LixProc;   
    };

    union
    {
        void                *Library;   
        WIN_PROCESS_MODULE  *WinLib;    
    };

    union
    {
        QWORD   Rip;            
        QWORD   SourceVA;       
    };

    struct
    {
        DWORD   NameHash;       
        union
        {
            PCHAR   Name;       
            PWCHAR  NameWide;   

        };
        QWORD   Rip;            

        union
        {
            void                *Library;   
            WIN_PROCESS_MODULE  *WinLib;    
        };
    } Return;

    INTRO_PC_VIOLATION_TYPE     PcType;       

    INSTRUX     *Instruction;   

    BOOLEAN     Execute;        
} EXCEPTION_UM_ORIGINATOR, *PEXCEPTION_UM_ORIGINATOR;


#define EXCEPTION_KM_ORIGINATOR_OPT_DO_NOT_BLOCK    0x00000001u


//
// Helpers
//
#define for_each_km_exception(_ex_head, _var_name) \
    list_for_each(_ex_head, KM_EXCEPTION, _var_name)
#define for_each_kum_exception(_ex_head, _var_name) \
    list_for_each(_ex_head, KUM_EXCEPTION, _var_name)
#define for_each_um_exception(_ex_head, _var_name) \
    list_for_each(_ex_head, UM_EXCEPTION, _var_name)
#define for_each_um_glob_exception(_ex_head, _var_name) \
    list_for_each(_ex_head, UM_EXCEPTION_GLOB, _var_name)
#define for_each_cb_signature(_ex_head, _var_name) \
    list_for_each(_ex_head, SIG_CODEBLOCKS, _var_name)
#define for_each_export_signature(_ex_head, _var_name) \
    list_for_each(_ex_head, SIG_EXPORT, _var_name)
#define for_each_value_signature(_ex_head, _var_name) \
    list_for_each(_ex_head, SIG_VALUE, _var_name)
#define for_each_value_code_signature(_ex_head, _var_name) \
    list_for_each(_ex_head, SIG_VALUE_CODE, _var_name)
#define for_each_idt_signature(_ex_head, _var_name) \
    list_for_each(_ex_head, SIG_IDT, _var_name)
#define for_each_version_os_signature(_ex_head, _var_name) \
    list_for_each(_ex_head, SIG_VERSION_OS, _var_name)
#define for_each_version_intro_signature(_ex_head, _var_name) \
    list_for_each(_ex_head, SIG_VERSION_INTRO, _var_name)
#define for_each_process_creation_signature(_ex_head, _var_name) \
    list_for_each(_ex_head, SIG_PROCESS_CREATION, _var_name)


//
// Functions
//

INTSTATUS
IntExceptInit(
    void
    );

INTSTATUS
IntExceptUninit(
    void
    );

INTSTATUS
IntExceptAlertRemove(
    void
    );

INTSTATUS
IntExceptRemove(
    void
    );

int
IntExceptPrintLixTaskInfo(
    _In_opt_ const LIX_TASK_OBJECT *Task,
    _In_ char *Header,
    _Out_ char *Line,
    _In_ int MaxLength,
    _In_opt_ DWORD NameAlignment
    );

int
IntExceptPrintWinModInfo(
    _In_ WIN_PROCESS_MODULE *Module,
    _In_ char *Header,
    _Out_ char *Line,
    _In_ int MaxLength,
    _In_opt_ DWORD NameAlignment
    );

int
IntExceptPrintWinProcInfo(
    _In_ WIN_PROCESS_OBJECT *Process,
    _In_ char *Header,
    _Out_ char *Line,
    _In_ int MaxLength,
    _In_opt_ DWORD NameAlignment
    );

int
IntExceptPrintWinKmModInfo(
    _In_ KERNEL_DRIVER *Module,
    _In_ char *Header,
    _Out_ char *Line,
    _In_ int MaxLength,
    _In_opt_ DWORD NameAlignment
    );

void
IntExceptUserLogInformation(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_UM_ORIGINATOR *Originator,
    _In_ INTRO_ACTION Action,
    _In_ INTRO_ACTION_REASON Reason
    );

void
IntExceptKernelLogInformation(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_KM_ORIGINATOR *Originator,
    _In_ INTRO_ACTION Action,
    _In_ INTRO_ACTION_REASON Reason
    );

void
IntExceptKernelUserLogInformation(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_KM_ORIGINATOR *Originator,
    _In_ INTRO_ACTION Action,
    _In_ INTRO_ACTION_REASON Reason
    );

void
IntExceptDumpSignatures(
    _In_ void *Originator,
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ BOOLEAN KernelMode,
    _In_ BOOLEAN ReturnDrv
    );

INTSTATUS
IntExceptKernelGetOriginator(
    _Out_ EXCEPTION_KM_ORIGINATOR *Originator,
    _In_ DWORD Options
    );

INTSTATUS
IntExceptUserGetExecOriginator(
    _In_ void *Process,
    _Out_ EXCEPTION_UM_ORIGINATOR *Originator
    );

INTSTATUS
IntExceptUserGetOriginator(
    _In_ void *Process,
    _In_ BOOLEAN ModuleWrite,
    _In_ QWORD Address,
    _In_opt_ INSTRUX *Instrux,
    _Out_ EXCEPTION_UM_ORIGINATOR *Originator
    );

INTSTATUS
IntExceptGetOriginatorFromModification(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _Out_ EXCEPTION_KM_ORIGINATOR *Originator
    );

INTSTATUS
IntExceptGetVictimCr(
    _In_ QWORD NewValue,
    _In_ QWORD OldValue,
    _In_ DWORD Cr,
    _Out_ EXCEPTION_VICTIM_ZONE *Victim
    );

INTSTATUS
IntExceptGetVictimEpt(
    _In_opt_ void *Context,
    _In_ QWORD Gpa,
    _In_ QWORD Gva,
    _In_ INTRO_OBJECT_TYPE Type,
    _In_ DWORD ZoneFlags,
    _Out_ EXCEPTION_VICTIM_ZONE *Victim
    );

INTSTATUS
IntExceptGetVictimProcess(
    _In_ void *Process,
    _In_ QWORD DestinationGva,
    _In_ DWORD Length,
    _In_ QWORD ZoneFlags,
    _Out_ EXCEPTION_VICTIM_ZONE *Victim
    );

INTSTATUS
IntExceptGetVictimIntegrity(
    _In_ INTEGRITY_REGION *IntegrityRegion,
    _Inout_ DWORD *Offset,
    _Out_ EXCEPTION_VICTIM_ZONE *Victim
    );

INTSTATUS
IntExceptGetVictimMsr(
    _In_ QWORD NewValue,
    _In_ QWORD OldValue,
    _In_ DWORD Msr,
    _Out_ EXCEPTION_VICTIM_ZONE *Victim
    );

INTSTATUS
IntExceptGetVictimDtr(
    _In_ DTR *NewValue,
    _In_ DTR *OldValue,
    _In_ INTRO_OBJECT_TYPE Type,
    _Out_ EXCEPTION_VICTIM_ZONE *Victim
    );

INTSTATUS
IntExceptGetVictimProcessCreation(
    _In_ void *Process,
    _In_ INTRO_OBJECT_TYPE ObjectType,
    _Out_ EXCEPTION_VICTIM_ZONE *Victim
    );

INTSTATUS
IntExceptKernelVerifyExtra(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_UM_ORIGINATOR *Originator,
    _In_ UM_EXCEPTION *Exception
    );

INTSTATUS
IntExceptUserVerifyExtra(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_UM_ORIGINATOR *Originator,
    _In_ UM_EXCEPTION *Exception
    );

INTSTATUS
IntExceptKernelUserVerifyExtra(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_UM_ORIGINATOR *Originator,
    _In_ UM_EXCEPTION *Exception
    );

INTSTATUS
IntExceptUserVerifyExtraGlobMatch(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_UM_ORIGINATOR *Originator,
    _In_ UM_EXCEPTION_GLOB *Exception
    );

INTSTATUS
IntExceptMatchException(
    _In_ void *Victim,
    _In_ void *Originator,
    _In_ void *Exception,
    _In_ EXCEPTION_TYPE ExceptionType,
    _Out_ INTRO_ACTION *Action,
    _Out_ INTRO_ACTION_REASON *Reason
    );

INTSTATUS
IntExceptKernelMatchVictim(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_KM_ORIGINATOR *Originator,
    _In_ KM_EXCEPTION *Exception
    );

INTSTATUS
IntExceptUserMatchVictim(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_UM_ORIGINATOR *Originator,
    _In_ void *Exception,
    _In_ EXCEPTION_TYPE ExceptionType
    );

INTSTATUS
IntExceptKernelUserMatchVictim(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_KM_ORIGINATOR *Originator,
    _In_ KUM_EXCEPTION *Exception
    );

INTSTATUS
IntExceptKernel(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_KM_ORIGINATOR *Originator,
    _Out_ INTRO_ACTION *Action,
    _Out_ INTRO_ACTION_REASON *Reason
    );

INTSTATUS
IntExceptUser(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_UM_ORIGINATOR *Originator,
    _Out_ INTRO_ACTION *Action,
    _Out_ INTRO_ACTION_REASON *Reason
    );

INTSTATUS
IntExceptKernelUser(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ EXCEPTION_KM_ORIGINATOR *Originator,
    _Out_ INTRO_ACTION *Action,
    _Out_ INTRO_ACTION_REASON *Reason
    );

void
IntExcept(
    _In_ EXCEPTION_VICTIM_ZONE *Victim,
    _In_ void *Originator,
    _In_ EXCEPTION_TYPE Type,
    _Out_ INTRO_ACTION *Action,
    _Out_ INTRO_ACTION_REASON *Reason,
    _In_ INTRO_EVENT_TYPE EventClass
    );

void
IntExceptInvCbCacheByGva(
    _In_ QWORD Gva
    );

void
IntExceptInvCbCacheByCr3(
    _In_ QWORD Cr3
    );

BOOLEAN
IntUpdateAreExceptionsLoaded(
    void
    );

#define IntExceptErase(Ptr, Tag)                \
    do {                                        \
        RemoveEntryList(&((Ptr)->Link));        \
        HpFreeAndNullWithTag(&(Ptr), (Tag));    \
    } while(0)

#endif // _EXCEPTIONS_H_