Guest support and policy update mechanism. More...

Files
file	update_guests.h
	Exposes the definitions used by the CAMI parser and the functions used to load guest support information or update protection policies.

file	update_guests.c
	The CAMI parser.

Data Structures
struct	_LIX_OPAQUE_FIELDS
	Contains information about various Linux structures. More...

struct	_LIX_SYMBOL
	Describes a Linux ksym. More...

struct	_LIX_ACTIVE_PATCH
	Describes the information about a Linux active-patch. More...

struct	_WIN_OPAQUE_FIELDS
	Contains information about various Windows user mode and kernel mode structures.Everything about a structure of interest should be placed here (size, field offsets, etc). The Km structure contains information about kernel objects, while the Um field contains information about user mode objects. Each structure has a specific tag (WIN_KM_STRUCTURE for Km, WIN_UM_STRUCTURE for Um) which is used to identify it. Each entry inside an array contains specific information. The specific WIN_UM_FIELD and WIN_KM_FIELD structures describe the information found at each index in these arrays. For example, the WIN_KM_FIELD_PROCESS enum describes the information found in the Km.Process array. If the offset at which the name of a process is found inside the kernel _EPROCESS structure is needed, it can be obtained by looking at Km.Process[winKmFieldProcessName]. In order to simplify this, the WIN_KM_FIELD macro can be used: WIN_OPAQUE_FIELDS(Process, Name). A similar approach is available for user mode fields with the WIN_UM_FIELD macro. These fields are set when a CAMI file is loaded at initialization time, in the IntCamiLoadOpaqueFields function. If the loaded CAMI file contains a structure that is not known by introcore, or contains more field than the current introcore version uses, the extra information is discarded. This is why new fields should be added right before the End tags, in order to preserve the current order and allow older introcore versions to load newer CAMI files. More...

Macros
#define	LIX_FIELD(Structure, Field) gLixGuest->OsSpecificFields.OpaqueFields.Structure[lixField##Structure##Field]
	Macro used to access fields inside the LIX_OPAQUE_FIELDS structure. More...

#define	WIN_KM_FIELD(Structure, Field) gWinGuest->OsSpecificFields.Km.Structure[winKmField##Structure##Field]
	Macro used to access kernel mode fields inside the WIN_OPAQUE_FIELDS structure. More...

#define	WIN_SYSCALL_NUMBER(Syscall) WIN_KM_FIELD(SyscallNumbers, Syscall)
	Macro used to access syscall numbers from inside the WIN_OPAQUE_FIELDS structure. More...

#define	WIN_UM_FIELD(Structure, Field) gWinGuest->OsSpecificFields.Um.Structure[winUmField##Structure##Field]
	Macro used to access user mode fields inside the WIN_OPAQUE_FIELDS structure. More...

Typedefs
typedef enum LIX_STRUCTURE	LIX_STRUCTURE
	Structure tags used for the Linux structures. More...

typedef enum _LIX_FIELD_INFO	LIX_FIELD_INFO
	Describes information about a Linux guest. More...

typedef enum _LIX_FIELD_MODULE	LIX_FIELD_MODULE
	The index for offsets of 'struct module'. More...

typedef enum _LIX_FIELD_BINPRM	LIX_FIELD_BINPRM
	The index for offsets of 'struct linux_binprm'. More...

typedef enum _LIX_FIELD_VMA	LIX_FIELD_VMA
	The index for offsets of 'struct vm_area_struct'. More...

typedef enum _LIX_FIELD_DENTRY	LIX_FIELD_DENTRY
	The index for offsets of 'struct dentry'. More...

typedef enum _LIX_FIELD_MMSTRUCT	LIX_FIELD_MMSTRUCT
	The index for offsets of 'struct mm_struct'. More...

typedef enum _LIX_FIELD_TASKSTRUCT	LIX_FIELD_TASKSTRUCT
	The index for offsets of 'struct task-struct'. More...

typedef enum _LIX_FIELD_FS	LIX_FIELD_FS
	The index for offsets of 'struct fs_struct'. More...

typedef enum _LIX_FIELD_FDTABLE	LIX_FIELD_FDTABLE
	The index for offsets of 'struct fdtable'. More...

typedef enum _LIX_FIELD_FILES	LIX_FIELD_FILES
	The index for offsets of 'struct files_struct'. More...

typedef enum _LIX_FIELD_INODE	LIX_FIELD_INODE
	The index for offsets of 'struct inode'. More...

typedef enum _LIX_FIELD_SOCKET	LIX_FIELD_SOCKET
	The index for offsets of 'struct socket'. More...

typedef enum _LIX_FIELD_SOCK	LIX_FIELD_SOCK
	The index for offsets of 'struct sock'. More...

typedef enum _LIX_FIELD_CRED	LIX_FIELD_CRED
	The index for offsets of 'struct cred'. More...

typedef enum _LIX_FIELD_NSPROXY	LIX_FIELD_NSPROXY
	The index for offsets of 'struct nsproxy'. More...

typedef enum _LIX_FIELD_UNGROUPED	LIX_FIELD_UNGROUPED
	The index for offsets of structures that are not grouped. More...

typedef struct _LIX_OPAQUE_FIELDS	LIX_OPAQUE_FIELDS
	Contains information about various Linux structures. More...

typedef struct _LIX_OPAQUE_FIELDS *	PLIX_OPAQUE_FIELDS

typedef struct _LIX_SYMBOL	LIX_SYMBOL
	Describes a Linux ksym. More...

typedef struct _LIX_SYMBOL *	PLIX_SYMBOL

typedef enum _LIX_ACTIVE_PATCH_TYPE	LIX_ACTIVE_PATCH_TYPE
	Describes the type of an Linux active-patch. More...

typedef struct _LIX_ACTIVE_PATCH	LIX_ACTIVE_PATCH
	Describes the information about a Linux active-patch. More...

typedef enum _WIN_UM_FIELD_DLL	WIN_UM_FIELD_DLL
	Indexes in the WIN_OPAQUE_FIELDS.Um.Dll array, containing offsets inside the _LDR_DATA_TABLE_ENTRY structure. More...

typedef enum _WIN_UM_FIELD_PEB	WIN_UM_FIELD_PEB
	Indexes in the WIN_OPAQUE_FIELDS.Um.Peb array, containing offsets inside the _PEB structure.These are the indexes of the offsets inside the WIN_OPAQUE_FIELDS.Um.Peb array. The WIN_UM_FIELD can be used to access these more easily. More...

typedef enum _WIN_UM_FIELD_TEB	WIN_UM_FIELD_TEB
	Indexes in the WIN_OPAQUE_FIELDS.Um.Teb array, containing offsets inside the _TEB structure.The WIN_UM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_STRUCTURE	WIN_KM_STRUCTURE
	Structure tags used for the kernel mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Km field. More...

typedef enum _WIN_UM_STRUCTURE	WIN_UM_STRUCTURE
	Structure tags used for the user mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Um field. More...

typedef enum _WIN_KM_FIELD_PROCESS	WIN_KM_FIELD_PROCESS
	Indexes in the WIN_OPAQUE_FIELDS.Km.Process array, containing offsets inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_THREAD	WIN_KM_FIELD_THREAD
	Indexes in the WIN_OPAQUE_FIELDS.Km.Thread array, containing offsets inside the _ETHREAD structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_DRVOBJ	WIN_KM_FIELD_DRVOBJ
	Indexes in the WIN_OPAQUE_FIELDS.Km.DrvObj array, containing information about the _DRIVER_OBJECT structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_PCR	WIN_KM_FIELD_PCR
	Indexes in the WIN_OPAQUE_FIELDS.Km.Pcr array, containing information about the _KPCR structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_POOLDESCRIPTOR	WIN_KM_FIELD_POOLDESCRIPTOR
	Indexes in the WIN_OPAQUE_FIELDS.Km.PoolDescriptor array, containing information about the _POOL_DESCRIPTOR structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_MMPFN	WIN_KM_FIELD_MMPFN
	Indexes in the WIN_OPAQUE_FIELDS.Km.Mmpfn array, containing information about the _MMPFN structure.For 32-bit versions of the OS, this is split into two sections: PAE and non-PAE, as Windows versions prior to Windows 8 were able to boot without PAE support and in those cases the _MMPFN structure was different. For 32-bit guests with PAE enabled (gGuest->Mm.Mode is PAGING_PAE_MODE in those cases) the Pae version of the tags should be used. For the other guests, the normal versions should be used. More...

typedef enum _WIN_KM_FIELD_TOKEN	WIN_KM_FIELD_TOKEN
	Indexes in the WIN_OPAQUE_FIELDS.Km.Token array, containing information about the _TOKEN structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_UNGROUPED	WIN_KM_FIELD_UNGROUPED
	Indexes in the WIN_OPAQUE_FIELDS.Km.Ungrouped array, containing information about various kernel structures or data.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_EPROCESSFLAGS	WIN_KM_FIELD_EPROCESSFLAGS
	Indexes in the WIN_OPAQUE_FIELDS.Km.EprocessFlags array, containing information about the flags inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_VAD_SHORT	WIN_KM_FIELD_VAD_SHORT
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadShort array, containing information about the _MMVAD_SHORT structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_VAD_LONG	WIN_KM_FIELD_VAD_LONG
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadLong array, containing information about the _MMVAD_LONG structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_VADFLAGS	WIN_KM_FIELD_VADFLAGS
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadFlags array, containing information about the bits in the winKmFieldVadShortFlags field.Certain values are parsed by shifting the flags value and then applying a mask, while boolean values are stored as the bit that must be checked in order to know if that bit is set or not. For example, in order to obtain the type from a 32-bit flags value you need to: More...

typedef enum _WIN_KM_FIELD_SYSCALL_NUMBERS	WIN_KM_FIELD_SYSCALL_NUMBERS
	Indexes in the WIN_OPAQUE_FIELDS.Km.SyscallNumbers array, containing syscall numbers.The WIN_SYSCALL_NUMBER or WIN_KM_FIELD macros can be used to access these more easily. More...

typedef enum _WIN_KM_FIELD_FILE_OBJECT	WIN_KM_FIELD_FILE_OBJECT
	Indexes in the WIN_OPAQUE_FIELDS.Km.FileObject array, containing information about the _FILE_OBJECT structure.The WIN_KM_FIELD macros can be used to access these more easily. More...

typedef struct _WIN_OPAQUE_FIELDS	WIN_OPAQUE_FIELDS
	Contains information about various Windows user mode and kernel mode structures.Everything about a structure of interest should be placed here (size, field offsets, etc). The Km structure contains information about kernel objects, while the Um field contains information about user mode objects. Each structure has a specific tag (WIN_KM_STRUCTURE for Km, WIN_UM_STRUCTURE for Um) which is used to identify it. Each entry inside an array contains specific information. The specific WIN_UM_FIELD and WIN_KM_FIELD structures describe the information found at each index in these arrays. For example, the WIN_KM_FIELD_PROCESS enum describes the information found in the Km.Process array. If the offset at which the name of a process is found inside the kernel _EPROCESS structure is needed, it can be obtained by looking at Km.Process[winKmFieldProcessName]. In order to simplify this, the WIN_KM_FIELD macro can be used: WIN_OPAQUE_FIELDS(Process, Name). A similar approach is available for user mode fields with the WIN_UM_FIELD macro. These fields are set when a CAMI file is loaded at initialization time, in the IntCamiLoadOpaqueFields function. If the loaded CAMI file contains a structure that is not known by introcore, or contains more field than the current introcore version uses, the extra information is discarded. This is why new fields should be added right before the End tags, in order to preserve the current order and allow older introcore versions to load newer CAMI files. More...

typedef struct _WIN_OPAQUE_FIELDS *	PWIN_OPAQUE_FIELDS

Enumerations
enum	LIX_STRUCTURE { lixStructureInfo = 0, lixStructureModule, lixStructureBinprm, lixStructureVma, lixStructureDentry, lixStructureMmStruct, lixStructureTaskStruct, lixStructureFs, lixStructureFdTable, lixStructureFiles, lixStructureInode, lixStructureSocket, lixStructureSock, lixStructureCred, lixStructureNsProxy, lixStructureUngrouped, lixStructureEnd }
	Structure tags used for the Linux structures. More...

enum	_LIX_FIELD_INFO { lixFieldInfoThreadSize = 0, lixFieldInfoHasModuleLayout, lixFieldInfoHasVdsoImageStruct, lixFieldInfoHasSmallSlack, lixFieldInfoHasKsymRelative, lixFieldInfoHasKsymAbsolutePercpu, lixFieldInfoHasKsymSize, lixFieldInfoHasAlternateSyscall, lixFieldInfoHasVmaAdjustExpand, lixFieldInfoHasVdsoFixed, lixFieldInfoHasKsymReducedSize, lixFieldInfoEnd }
	Describes information about a Linux guest. More...

enum	_LIX_FIELD_MODULE { lixFieldModuleSizeof = 0, lixFieldModuleList, lixFieldModuleName, lixFieldModuleSymbols, lixFieldModuleNumberOfSymbols, lixFieldModuleGplSymbols, lixFieldModuleNumberOfGplSymbols, lixFieldModuleInit, lixFieldModuleModuleInit, lixFieldModuleModuleCore, lixFieldModuleInitSize, lixFieldModuleCoreSize, lixFieldModuleInitTextSize, lixFieldModuleCoreTextSize, lixFieldModuleInitRoSize, lixFieldModuleCoreRoSize, lixFieldModuleCoreLayout, lixFieldModuleInitLayout, lixFieldModuleState, lixFieldModuleEnd }
	The index for offsets of 'struct module'. More...

enum	_LIX_FIELD_BINPRM { lixFieldBinprmSizeof = 0, lixFieldBinprmMm, lixFieldBinprmFile, lixFieldBinprmCred, lixFieldBinprmFilename, lixFieldBinprmInterp, lixFieldBinprmVma, lixFieldBinprmArgc, lixFieldBinprmEnd }
	The index for offsets of 'struct linux_binprm'. More...

enum	_LIX_FIELD_VMA { lixFieldVmaVmaStart = 0, lixFieldVmaVmaEnd, lixFieldVmaVmNext, lixFieldVmaVmPrev, lixFieldVmaMm, lixFieldVmaFlags, lixFieldVmaFile, lixFieldVmaRbNode, lixFieldVmaEnd }
	The index for offsets of 'struct vm_area_struct'. More...

enum	_LIX_FIELD_DENTRY { lixFieldDentryParent = 0, lixFieldDentryName, lixFieldDentryDiname, lixFieldDentryInode, lixFieldDentryEnd }
	The index for offsets of 'struct dentry'. More...

enum	_LIX_FIELD_MMSTRUCT { lixFieldMmStructPgd = 0, lixFieldMmStructMmUsers, lixFieldMmStructMmCount, lixFieldMmStructMmList, lixFieldMmStructStartCode, lixFieldMmStructEndCode, lixFieldMmStructStartData, lixFieldMmStructEndData, lixFieldMmStructFlags, lixFieldMmStructExeFile, lixFieldMmStructVma, lixFieldMmStructStartStack, lixFieldMmStructRbNode, lixFieldMmStructVdsoAddress, lixFieldMmStructEnd }
	The index for offsets of 'struct mm_struct'. More...

enum	_LIX_FIELD_TASKSTRUCT { lixFieldTaskStructStack = 0, lixFieldTaskStructUsage, lixFieldTaskStructFlags, lixFieldTaskStructTasks, lixFieldTaskStructPid, lixFieldTaskStructTgid, lixFieldTaskStructRealParent, lixFieldTaskStructParent, lixFieldTaskStructMm, lixFieldTaskStructStartTime, lixFieldTaskStructComm, lixFieldTaskStructSignal, lixFieldTaskStructExitCode, lixFieldTaskStructThreadNode, lixFieldTaskStructThreadGroup, lixFieldTaskStructCred, lixFieldTaskStructFs, lixFieldTaskStructFiles, lixFieldTaskStructNsProxy, lixFieldTaskStructGroupLeader, lixFieldTaskStructExitSignal, lixFieldTaskStructInExecve, lixFieldTaskStructInExecveBit, lixFieldTaskStructThreadStructSp, lixFieldTaskStructAltStackSp, lixFieldTaskStructEnd }
	The index for offsets of 'struct task-struct'. More...

enum	_LIX_FIELD_FS { lixFieldFsSizeof = 0, lixFieldFsRoot, lixFieldFsPwd, lixFieldFsEnd }
	The index for offsets of 'struct fs_struct'. More...

enum	_LIX_FIELD_FDTABLE { lixFieldFdTableMaxFds = 0, lixFieldFdTableFd, lixFieldFdTableEnd }
	The index for offsets of 'struct fdtable'. More...

enum	_LIX_FIELD_FILES { lixFieldFilesSizeof = 0, lixFieldFilesFdt, lixFieldFilesEnd }
	The index for offsets of 'struct files_struct'. More...

enum	_LIX_FIELD_INODE { lixFieldInodeSizeof = 0, lixFieldInodeImode, lixFieldInodeUid, lixFieldInodeGid, lixFieldInodeEnd }
	The index for offsets of 'struct inode'. More...

enum	_LIX_FIELD_SOCKET { lixFieldSocketState = 0, lixFieldSocketType, lixFieldSocketFlags, lixFieldSocketSk, lixFieldSocketEnd }
	The index for offsets of 'struct socket'. More...

enum	_LIX_FIELD_SOCK { lixFieldSockSizeof = 0, lixFieldSockNum, lixFieldSockDport, lixFieldSockDaddr, lixFieldSockRcvSaddr, lixFieldSockFamily, lixFieldSockState, lixFieldSockProto, lixFieldSockV6Daddr, lixFieldSockV6RcvSaddr, lixFieldSockEnd }
	The index for offsets of 'struct sock'. More...

enum	_LIX_FIELD_CRED { lixFieldCredSizeof = 0, lixFieldCredUsage, lixFieldCredRcu, lixFieldCredEnd }
	The index for offsets of 'struct cred'. More...

enum	_LIX_FIELD_NSPROXY { lixFieldNsProxyCount = 0, lixFieldNsProxyUts, lixFieldNsProxyIpc, lixFieldNsProxyMnt, lixFieldNsProxyPid, lixFieldNsProxyNet, lixFieldNsProxyEnd }
	The index for offsets of 'struct nsproxy'. More...

enum	_LIX_FIELD_UNGROUPED { lixFieldUngroupedFileDentry = 0, lixFieldUngroupedProtoName, lixFieldUngroupedSignalListHead, lixFieldUngroupedSocketAllocVfsInode, lixFieldUngroupedRunning, lixFieldUngroupedFilePath, lixFieldUngroupedSignalNrThreads, lixFieldUngroupedEnd }
	The index for offsets of structures that are not grouped. More...

enum	_LIX_ACTIVE_PATCH_TYPE { lixActivePatchTextPoke = 0, lixActivePatchFtrace, lixActivePatchJmpLabel, lixActivePatchCount }
	Describes the type of an Linux active-patch. More...

enum	_WIN_UM_FIELD_DLL { winUmFieldDllBaseOffsetInModule64 = 0, winUmFieldDllBaseOffsetInModule32, winUmFieldDllSizeOffsetInModule64, winUmFieldDllSizeOffsetInModule32, winUmFieldDllNameOffsetInModule64, winUmFieldDllNameOffsetInModule32, winUmFieldDllEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Um.Dll array, containing offsets inside the _LDR_DATA_TABLE_ENTRY structure. More...

enum	_WIN_UM_FIELD_PEB { winUmFieldPeb64Size = 0, winUmFieldPeb32Size, winUmFieldPebEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Um.Peb array, containing offsets inside the _PEB structure.These are the indexes of the offsets inside the WIN_OPAQUE_FIELDS.Um.Peb array. The WIN_UM_FIELD can be used to access these more easily. More...

enum	_WIN_UM_FIELD_TEB { winUmFieldTeb64Size = 0, winUmFieldTeb32Size, winUmFieldTebWow64SaveArea, winUmFieldTebWow64StackInSaveArea, winUmFieldTebEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Um.Teb array, containing offsets inside the _TEB structure.The WIN_UM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_STRUCTURE { winKmStructureProcess = 0, winKmStructureThread, winKmStructureDrvObj, winKmStructurePcr, winKmStructurePoolDescriptor, winKmStructureMmpfn, winKmStructureToken, winKmStructureUngrouped, winKmStructureEprocessFlags, winKmStructureVadShort, winKmStructureVadLong, winKmStructureVadFlags, winKmStructureSyscallNumbers, winKmStructureFileObject, winKmStructureEnd }
	Structure tags used for the kernel mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Km field. More...

enum	_WIN_UM_STRUCTURE { winUmStructureDll = 0, winUmStructurePeb, winUmStructureTeb, winUmStructureEnd }
	Structure tags used for the user mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Um field. More...

enum	_WIN_KM_FIELD_PROCESS { winKmFieldProcessCr3 = 0, winKmFieldProcessUserCr3, winKmFieldProcessKexecOptions, winKmFieldProcessListEntry, winKmFieldProcessName, winKmFieldProcessSectionBase, winKmFieldProcessId, winKmFieldProcessParentPid, winKmFieldProcessVadRoot, winKmFieldProcessCreateTime, winKmFieldProcessExitStatus, winKmFieldProcessToken, winKmFieldProcessObjectTable, winKmFieldProcessPeb, winKmFieldProcessThreadListHead, winKmFieldProcessWoW64, winKmFieldProcessFlags, winKmFieldProcessFlags3, winKmFieldProcessMitigationFlags, winKmFieldProcessMitigationFlags2, winKmFieldProcessDebugPort, winKmFieldProcessSpare, winKmFieldProcessEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Process array, containing offsets inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_THREAD { winKmFieldThreadProcess = 0, winKmFieldThreadThreadListEntry, winKmFieldThreadKernelStack, winKmFieldThreadStackBase, winKmFieldThreadStackLimit, winKmFieldThreadState, winKmFieldThreadWaitReason, winKmFieldThreadAttachedProcess, winKmFieldThreadTeb, winKmFieldThreadId, winKmFieldThreadClientSecurity, winKmFieldThreadTrapFrame, winKmFieldThreadWin32StartAddress, winKmFieldThreadEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Thread array, containing offsets inside the _ETHREAD structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_DRVOBJ { winKmFieldDrvObjSize = 0, winKmFieldDrvObjFiodispSize, winKmFieldDrvObjAllocationGap, winKmFieldDrvObjFiodisp, winKmFieldDrvObjStart, winKmFieldDrvObjEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.DrvObj array, containing information about the _DRIVER_OBJECT structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_PCR { winKmFieldPcrCurrentThread = 0, winKmFieldPcrUserTime, winKmFieldPcrEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Pcr array, containing information about the _KPCR structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_POOLDESCRIPTOR { winKmFieldPoolDescriptorTotalBytes = 0, winKmFieldPoolDescriptorNppSize, winKmFieldPoolDescriptorEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.PoolDescriptor array, containing information about the _POOL_DESCRIPTOR structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_MMPFN { winKmFieldMmpfnSize = 0, winKmFieldMmpfnPte, winKmFieldMmpfnRefCount, winKmFieldMmpfnFlags, winKmFieldMmpfnPaeSize, winKmFieldMmpfnPaePte, winKmFieldMmpfnPaeRefCount, winKmFieldMmpfnPaeFlags, winKmFieldMmpfnEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Mmpfn array, containing information about the _MMPFN structure.For 32-bit versions of the OS, this is split into two sections: PAE and non-PAE, as Windows versions prior to Windows 8 were able to boot without PAE support and in those cases the _MMPFN structure was different. For 32-bit guests with PAE enabled (gGuest->Mm.Mode is PAGING_PAE_MODE in those cases) the Pae version of the tags should be used. For the other guests, the normal versions should be used. More...

enum	_WIN_KM_FIELD_TOKEN { winKmFieldTokenPrivs = 0, winKmFieldTokenUserCount, winKmFieldTokenRestrictedCount, winKmFieldTokenUsers, winKmFieldTokenRestrictedSids, winKmFieldTokenEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Token array, containing information about the _TOKEN structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_UNGROUPED { winKmFieldUngroupedCtlAreaFile = 0, winKmFieldUngroupedHandleTableTableCode, winKmFieldUngroupedHalIntCtrlType, winKmFieldUngroupedWmiGetClockOffset, winKmFieldUngroupedEtwDbgDataSiloOffset, winKmFieldUngroupedEtwSignatureOffset, winKmFieldUngroupedSubsectionCtlArea, winKmFieldUngroupedEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.Ungrouped array, containing information about various kernel structures or data.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_EPROCESSFLAGS { winKmFieldEprocessFlagsNoDebugInherit = 0, winKmFieldEprocessFlagsExiting, winKmFieldEprocessFlagsDelete, winKmFieldEprocessFlags3Crashed, winKmFieldEprocessFlagsVmDeleted, winKmFieldEprocessFlagsHasAddrSpace, winKmFieldEprocessFlagsEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.EprocessFlags array, containing information about the flags inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_VAD_SHORT { winKmFieldVadShortParent = 0, winKmFieldVadShortLeft, winKmFieldVadShortRight, winKmFieldVadShortStartingVpn, winKmFieldVadShortStartingVpnHigh, winKmFieldVadShortEndingVpn, winKmFieldVadShortEndingVpnHigh, winKmFieldVadShortFlags, winKmFieldVadShortFlagsSize, winKmFieldVadShortVpnSize, winKmFieldVadShortSize, winKmFieldVadShortEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadShort array, containing information about the _MMVAD_SHORT structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_VAD_LONG { winKmFieldVadLongSubsection = 0, winKmFieldVadLongEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadLong array, containing information about the _MMVAD_LONG structure.The WIN_KM_FIELD macro can be used to access these more easily. More...

enum	_WIN_KM_FIELD_VADFLAGS { winKmFieldVadFlagsTypeShift = 0, winKmFieldVadFlagsTypeMask, winKmFieldVadFlagsProtectionShift, winKmFieldVadFlagsProtectionMask, winKmFieldVadFlagsNoChangeBit, winKmFieldVadFlagsPrivateFixupMask, winKmFieldVadFlagsDeleteInProgressMask, winKmFieldVadFlagsEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.VadFlags array, containing information about the bits in the winKmFieldVadShortFlags field.Certain values are parsed by shifting the flags value and then applying a mask, while boolean values are stored as the bit that must be checked in order to know if that bit is set or not. For example, in order to obtain the type from a 32-bit flags value you need to: More...

enum	_WIN_KM_FIELD_SYSCALL_NUMBERS { winKmFieldSyscallNumbersNtWriteVirtualMemory = 0, winKmFieldSyscallNumbersNtProtectVirtualMemory, winKmFieldSyscallNumbersNtCreateThreadEx, winKmFieldSyscallNumbersEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.SyscallNumbers array, containing syscall numbers.The WIN_SYSCALL_NUMBER or WIN_KM_FIELD macros can be used to access these more easily. More...

enum	_WIN_KM_FIELD_FILE_OBJECT { winKmFieldFileObjectNameBuffer, winKmFieldFileObjectNameLength, winKmFieldFileObjectEnd }
	Indexes in the WIN_OPAQUE_FIELDS.Km.FileObject array, containing information about the _FILE_OBJECT structure.The WIN_KM_FIELD macros can be used to access these more easily. More...

Detailed Description

Guest support and policy update mechanism.

CAMI is an Introcore sub module serving mainly as an OS specific info database. However, it may include other features that can control Introspection behavior, such as hooked kernel APIs or enforced options (forcing features to be on or off).

Macro Definition Documentation

◆ LIX_FIELD

#define LIX_FIELD	(	Structure,
		Field
	)	gLixGuest->OsSpecificFields.OpaqueFields.Structure[lixField##Structure##Field]

Macro used to access fields inside the LIX_OPAQUE_FIELDS structure.

Parameters

[in]	Structure	The structure name. This is identical to the name of the array in the LIX_OPAQUE_FIELDS.
[in]	Field	The name of the field.

Returns: The value of the requested field

Definition at line 426 of file lixguest.h.

Referenced by IntKsymGetAddress(), IntKsymInit(), IntKsymRelativeFindOffsetTableEnd(), IntKsymRelativeFindOffsetTableStart(), IntLixAgentFindInstruction(), IntLixCommitCredsHandle(), IntLixCredCalculateChecksum(), IntLixCredInitMap(), IntLixDentryGetName(), IntLixDepInjectProcess(), IntLixDrvCreateDriverObject(), IntLixDrvCreateFromAddress(), IntLixDrvFindList(), IntLixDrvIterateList(), IntLixDrvSystemBooting(), IntLixDrvValidate(), IntLixFileGetDentry(), IntLixFileGetPath(), IntLixFileReadDentry(), IntLixGetInitTask(), IntLixGuestAllocateDeploy(), IntLixGuestInit(), IntLixGuestInitAgentCompletion(), IntLixGuestNew(), IntLixMmFindVmaInLinkedList(), IntLixMmFindVmaInRbTree(), IntLixMmGetInitMm(), IntLixMmListVmasInternal(), IntLixMmPopulateVmasInternal(), IntLixNetFileIsSocket(), IntLixNetGetConnectionFromSocket(), IntLixNetSendTaskConnections(), IntLixResolveExeFileOffset(), IntLixTaskActivateExploitProtection(), IntLixTaskAdd(), IntLixTaskCreate(), IntLixTaskCreateFromBinprm(), IntLixTaskCreateInitTask(), IntLixTaskDeactivateExploitProtection(), IntLixTaskDumpTree(), IntLixTaskFetchCmdLine(), IntLixTaskFetchMm(), IntLixTaskGetTrapFrame(), IntLixTaskGuestTerminating(), IntLixTaskIsUserStackPivoted(), IntLixTaskIterateGuestTasks(), IntLixTaskIterateThreadGroup(), IntLixTaskIterateThreadNode(), IntLixTaskIterateThreads(), IntLixTaskMarkAgent(), IntLixTaskSendCredViolationEvent(), IntLixVdsoFetchAddress(), IntLixVdsoFixedProtect(), IntLixVdsoResolveDynamicOffset(), IntLixVmaAdjustInternal(), IntLixVmaChangeProtection(), IntLixVmaExpandDownwards(), IntLixVmaFill(), IntThrGetStackSize(), IntThrSafeLixGetCurrentStack(), IntThrSafeLixInspectWaitingThread(), and IntVmaMarkProtection().

◆ WIN_KM_FIELD

#define WIN_KM_FIELD	(	Structure,
		Field
	)	gWinGuest->OsSpecificFields.Km.Structure[winKmField##Structure##Field]

Macro used to access kernel mode fields inside the WIN_OPAQUE_FIELDS structure.

Parameters

[in]	Structure	The structure name. This is identical to the name of the array in the WIN_OPAQUE_FIELDS.Km structure which contains the needed information.
[in]	Field	The name of the field. For example, if the value of the winKmFieldProcessName field is needed, this will simply be Field.

Returns: The value of the requested field.

Remarks: This is a handy macro, allowing for more concise and expressive code when accessing the opaque kernel information. For example:
procNameOffset = gWinGuest->OsSpecificFields.Km.Process[winKmFieldProcessName];
procNameOffset = WIN_KM_FIELD(Process, Name);

Definition at line 726 of file winguest.h.

Referenced by DbgDumpPfn(), DbgDumpVadRoot(), IntPtiDeliverDriverForLoad(), IntThrSafeWinGetCurrentStack(), IntThrSafeWinInspectWaitingThread(), IntWinDpiGetProcessDebugFlag(), IntWinDpiValidateThreadStart(), IntWinDrvObjHandleModification(), IntWinDrvObjHandleWrite(), IntWinDrvObjIsValidDriverObject(), IntWinDrvObjProtect(), IntWinDrvObjProtectFastIoDispatch(), IntWinDrvObjRemoveFromAddress(), IntWinGetAccessTokenFromProcess(), IntWinGetAccesTokenFromThread(), IntWinGetStartUpTime(), IntWinGuestFindKernelObjects(), IntWinHalIsIntController(), IntWinHalProtectHalIntCtrl(), IntWinInfCheckCtxLoggerOnRelocation(), IntWinInfHookEptSppHandleWrite(), IntWinInfHookGetCircularCtxLogger(), IntWinInfHookGetCpuClockIntegrityCallback(), IntWinInfHookGetEtwpDebuggerData(), IntWinInfHookGetWmiLoggerGetCpuClock(), IntWinInfHookHookSppWmiGetClock(), IntWinInfHookIntegrityHandleWrite(), IntWinInfHookProtect(), IntWinInfHookSiloWmiPtrIntegrityCallback(), IntWinPatchVadHandleCommit(), IntWinPfnIsMmPfnDatabase(), IntWinPfnModifyRefCount(), IntWinProcAdd(), IntWinProcCreateProcessObject(), IntWinProcDeleteProcessObject(), IntWinProcDumpEgFlags(), IntWinProcEnforceProcessDep(), IntWinProcGetNameFromEprocess(), IntWinProcHandleCreateInternal(), IntWinProcHandleTerminate(), IntWinProcIsExploitGuardEnabled(), IntWinProcIsPsActiveProcessHead(), IntWinProcIterateGuestProcesses(), IntWinProcMarkAgent(), IntWinProcMarkAsSystemProcess(), IntWinProcPatchCopyMemoryDetour(), IntWinProcPatchSpareValue(), IntWinProcRemoveProcess(), IntWinProcSetUserCr3(), IntWinProcValidateSystemCr3(), IntWinReadToken(), IntWinStackUserTrapFrameGetGeneric(), IntWinThrGetCurrentThread(), IntWinThrGetCurrentTib(), IntWinThrHandleQueueApc(), IntWinThrHandleThreadHijack(), IntWinThrIterateThreads(), IntWinThrPatchThreadHijackHandler(), IntWinThrPrepareApcHandler(), IntWinTokenCheckCurrentPrivileges(), IntWinTokenFetchTokenAddress(), IntWinTokenPrivsHandleWrite(), IntWinTokenPrivsProtectOnProcess(), IntWinTokenPtrCheckIntegrityOnProcess(), IntWinVadFetchImageName(), IntWinVadFetchVadFromMemory(), IntWinVadHandleProtectGeneric(), IntWinVadImportProcessTree(), IntWinVadMapShortVad(), IntWinVadPatchDeleteVaRange(), IntWinVadPatchFinishVadDeletion(), IntWinVadPatchInsert(), IntWinVadPatchInsertMap(), IntWinVadPatchInsertPrivate(), IntWinVadPatchVirtualProtect(), IntWinVadProcImportMainModuleVad(), and IntWinVadRescanVad().

◆ WIN_SYSCALL_NUMBER

#define WIN_SYSCALL_NUMBER ( Syscall ) WIN_KM_FIELD(SyscallNumbers, Syscall)

Macro used to access syscall numbers from inside the WIN_OPAQUE_FIELDS structure.

Parameters

[in] Syscall The syscall name. For example, if the value of winKmFieldSyscallNumbersNtCreateThreadEx is is needed, this will simply be NtCreateThreadEx.

Returns: The requested syscall number.

Remarks: This is a handy macro, allowing for more concise and expressive code when accessing the opaque kernel information. For example:
sysNo = gWinGuest->OsSpecificFields.Km.SyscallNumbers[winKmFieldNtCreateThreadEx];
sysNo = WIN_SYSCALL_NUMBER(NtCreateThreadEx);

Definition at line 744 of file winguest.h.

◆ WIN_UM_FIELD

#define WIN_UM_FIELD	(	Structure,
		Field
	)	gWinGuest->OsSpecificFields.Um.Structure[winUmField##Structure##Field]

Macro used to access user mode fields inside the WIN_OPAQUE_FIELDS structure.

Parameters

[in]	Structure	The structure name. This is identical to the name of the array in the WIN_OPAQUE_FIELDS.Um structure which contains the needed information.
[in]	Field	The name of the field. For example, if the value of the winUmFieldTebWow64SaveArea field is needed, this will simply be Wow64SaveArea.

Returns: The value of the requested field.

Remarks: This is a handy macro, allowing for more concise and expressive code when accessing the opaque user information. For example:
wow64SaveAreaOffset = gWinGuest->OsSpecificFields.Um.Teb[winUmFieldTebWow64SaveArea];
wow64SaveAreaOffset = WIN_UM_FIELD(Teb, Wow64SaveArea);

Definition at line 764 of file winguest.h.

Referenced by IntExceptUserMatchZoneType(), IntWinStackWow64CheckIsPivoted(), and IntWinUmCheckInitializationInjection().

Typedef Documentation

◆ LIX_ACTIVE_PATCH

typedef struct _LIX_ACTIVE_PATCH LIX_ACTIVE_PATCH

Describes the information about a Linux active-patch.

◆ LIX_ACTIVE_PATCH_TYPE

typedef enum _LIX_ACTIVE_PATCH_TYPE LIX_ACTIVE_PATCH_TYPE

Describes the type of an Linux active-patch.

◆ LIX_FIELD_BINPRM

typedef enum _LIX_FIELD_BINPRM LIX_FIELD_BINPRM

The index for offsets of 'struct linux_binprm'.

◆ LIX_FIELD_CRED

typedef enum _LIX_FIELD_CRED LIX_FIELD_CRED

The index for offsets of 'struct cred'.

◆ LIX_FIELD_DENTRY

typedef enum _LIX_FIELD_DENTRY LIX_FIELD_DENTRY

The index for offsets of 'struct dentry'.

◆ LIX_FIELD_FDTABLE

typedef enum _LIX_FIELD_FDTABLE LIX_FIELD_FDTABLE

The index for offsets of 'struct fdtable'.

◆ LIX_FIELD_FILES

typedef enum _LIX_FIELD_FILES LIX_FIELD_FILES

The index for offsets of 'struct files_struct'.

◆ LIX_FIELD_FS

typedef enum _LIX_FIELD_FS LIX_FIELD_FS

The index for offsets of 'struct fs_struct'.

◆ LIX_FIELD_INFO

typedef enum _LIX_FIELD_INFO LIX_FIELD_INFO

Describes information about a Linux guest.

◆ LIX_FIELD_INODE

typedef enum _LIX_FIELD_INODE LIX_FIELD_INODE

The index for offsets of 'struct inode'.

◆ LIX_FIELD_MMSTRUCT

typedef enum _LIX_FIELD_MMSTRUCT LIX_FIELD_MMSTRUCT

The index for offsets of 'struct mm_struct'.

◆ LIX_FIELD_MODULE

typedef enum _LIX_FIELD_MODULE LIX_FIELD_MODULE

The index for offsets of 'struct module'.

◆ LIX_FIELD_NSPROXY

typedef enum _LIX_FIELD_NSPROXY LIX_FIELD_NSPROXY

The index for offsets of 'struct nsproxy'.

◆ LIX_FIELD_SOCK

typedef enum _LIX_FIELD_SOCK LIX_FIELD_SOCK

The index for offsets of 'struct sock'.

◆ LIX_FIELD_SOCKET

typedef enum _LIX_FIELD_SOCKET LIX_FIELD_SOCKET

The index for offsets of 'struct socket'.

◆ LIX_FIELD_TASKSTRUCT

typedef enum _LIX_FIELD_TASKSTRUCT LIX_FIELD_TASKSTRUCT

The index for offsets of 'struct task-struct'.

◆ LIX_FIELD_UNGROUPED

typedef enum _LIX_FIELD_UNGROUPED LIX_FIELD_UNGROUPED

The index for offsets of structures that are not grouped.

◆ LIX_FIELD_VMA

typedef enum _LIX_FIELD_VMA LIX_FIELD_VMA

The index for offsets of 'struct vm_area_struct'.

◆ LIX_OPAQUE_FIELDS

typedef struct _LIX_OPAQUE_FIELDS LIX_OPAQUE_FIELDS

Contains information about various Linux structures.

◆ LIX_STRUCTURE

typedef enum LIX_STRUCTURE LIX_STRUCTURE

Structure tags used for the Linux structures.

◆ LIX_SYMBOL

typedef struct _LIX_SYMBOL LIX_SYMBOL

Describes a Linux ksym.

◆ PLIX_OPAQUE_FIELDS

typedef struct _LIX_OPAQUE_FIELDS * PLIX_OPAQUE_FIELDS

◆ PLIX_SYMBOL

typedef struct _LIX_SYMBOL * PLIX_SYMBOL

◆ PWIN_OPAQUE_FIELDS

typedef struct _WIN_OPAQUE_FIELDS * PWIN_OPAQUE_FIELDS

◆ WIN_KM_FIELD_DRVOBJ

typedef enum _WIN_KM_FIELD_DRVOBJ WIN_KM_FIELD_DRVOBJ

Indexes in the WIN_OPAQUE_FIELDS.Km.DrvObj array, containing information about the _DRIVER_OBJECT structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_EPROCESSFLAGS

typedef enum _WIN_KM_FIELD_EPROCESSFLAGS WIN_KM_FIELD_EPROCESSFLAGS

Indexes in the WIN_OPAQUE_FIELDS.Km.EprocessFlags array, containing information about the flags inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_FILE_OBJECT

typedef enum _WIN_KM_FIELD_FILE_OBJECT WIN_KM_FIELD_FILE_OBJECT

Indexes in the WIN_OPAQUE_FIELDS.Km.FileObject array, containing information about the _FILE_OBJECT structure.The WIN_KM_FIELD macros can be used to access these more easily.

◆ WIN_KM_FIELD_MMPFN

typedef enum _WIN_KM_FIELD_MMPFN WIN_KM_FIELD_MMPFN

Indexes in the WIN_OPAQUE_FIELDS.Km.Mmpfn array, containing information about the _MMPFN structure.For 32-bit versions of the OS, this is split into two sections: PAE and non-PAE, as Windows versions prior to Windows 8 were able to boot without PAE support and in those cases the _MMPFN structure was different. For 32-bit guests with PAE enabled (gGuest->Mm.Mode is PAGING_PAE_MODE in those cases) the Pae version of the tags should be used. For the other guests, the normal versions should be used.

The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_PCR

typedef enum _WIN_KM_FIELD_PCR WIN_KM_FIELD_PCR

Indexes in the WIN_OPAQUE_FIELDS.Km.Pcr array, containing information about the _KPCR structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_POOLDESCRIPTOR

typedef enum _WIN_KM_FIELD_POOLDESCRIPTOR WIN_KM_FIELD_POOLDESCRIPTOR

Indexes in the WIN_OPAQUE_FIELDS.Km.PoolDescriptor array, containing information about the _POOL_DESCRIPTOR structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_PROCESS

typedef enum _WIN_KM_FIELD_PROCESS WIN_KM_FIELD_PROCESS

Indexes in the WIN_OPAQUE_FIELDS.Km.Process array, containing offsets inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_SYSCALL_NUMBERS

typedef enum _WIN_KM_FIELD_SYSCALL_NUMBERS WIN_KM_FIELD_SYSCALL_NUMBERS

Indexes in the WIN_OPAQUE_FIELDS.Km.SyscallNumbers array, containing syscall numbers.The WIN_SYSCALL_NUMBER or WIN_KM_FIELD macros can be used to access these more easily.

◆ WIN_KM_FIELD_THREAD

typedef enum _WIN_KM_FIELD_THREAD WIN_KM_FIELD_THREAD

Indexes in the WIN_OPAQUE_FIELDS.Km.Thread array, containing offsets inside the _ETHREAD structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_TOKEN

typedef enum _WIN_KM_FIELD_TOKEN WIN_KM_FIELD_TOKEN

Indexes in the WIN_OPAQUE_FIELDS.Km.Token array, containing information about the _TOKEN structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_UNGROUPED

typedef enum _WIN_KM_FIELD_UNGROUPED WIN_KM_FIELD_UNGROUPED

Indexes in the WIN_OPAQUE_FIELDS.Km.Ungrouped array, containing information about various kernel structures or data.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_VAD_LONG

typedef enum _WIN_KM_FIELD_VAD_LONG WIN_KM_FIELD_VAD_LONG

Indexes in the WIN_OPAQUE_FIELDS.Km.VadLong array, containing information about the _MMVAD_LONG structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_VAD_SHORT

typedef enum _WIN_KM_FIELD_VAD_SHORT WIN_KM_FIELD_VAD_SHORT

Indexes in the WIN_OPAQUE_FIELDS.Km.VadShort array, containing information about the _MMVAD_SHORT structure.The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_FIELD_VADFLAGS

typedef enum _WIN_KM_FIELD_VADFLAGS WIN_KM_FIELD_VADFLAGS

Indexes in the WIN_OPAQUE_FIELDS.Km.VadFlags array, containing information about the bits in the winKmFieldVadShortFlags field.Certain values are parsed by shifting the flags value and then applying a mask, while boolean values are stored as the bit that must be checked in order to know if that bit is set or not. For example, in order to obtain the type from a 32-bit flags value you need to:

DWORD flags = ...

VAD_TYPE = (flags >> WIN_KM_FIELD(VadFlags, TypeShift)) & WIN_KM_FIELD(VadFlags, TypeMask);

While checking if private fix-up is set:

DWORD flags = ...

BOOLEAN privateFixup = 0 != (flags & WIN_KM_FIELD(VadFlags, PrivateFixupMask));

The WIN_KM_FIELD macro can be used to access these more easily.

◆ WIN_KM_STRUCTURE

typedef enum _WIN_KM_STRUCTURE WIN_KM_STRUCTURE

Structure tags used for the kernel mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Km field.

◆ WIN_OPAQUE_FIELDS

typedef struct _WIN_OPAQUE_FIELDS WIN_OPAQUE_FIELDS

Contains information about various Windows user mode and kernel mode structures.Everything about a structure of interest should be placed here (size, field offsets, etc). The Km structure contains information about kernel objects, while the Um field contains information about user mode objects. Each structure has a specific tag (WIN_KM_STRUCTURE for Km, WIN_UM_STRUCTURE for Um) which is used to identify it. Each entry inside an array contains specific information. The specific WIN_UM_FIELD and WIN_KM_FIELD structures describe the information found at each index in these arrays. For example, the WIN_KM_FIELD_PROCESS enum describes the information found in the Km.Process array. If the offset at which the name of a process is found inside the kernel _EPROCESS structure is needed, it can be obtained by looking at Km.Process[winKmFieldProcessName]. In order to simplify this, the WIN_KM_FIELD macro can be used: WIN_OPAQUE_FIELDS(Process, Name). A similar approach is available for user mode fields with the WIN_UM_FIELD macro. These fields are set when a CAMI file is loaded at initialization time, in the IntCamiLoadOpaqueFields function. If the loaded CAMI file contains a structure that is not known by introcore, or contains more field than the current introcore version uses, the extra information is discarded. This is why new fields should be added right before the End tags, in order to preserve the current order and allow older introcore versions to load newer CAMI files.

◆ WIN_UM_FIELD_DLL

typedef enum _WIN_UM_FIELD_DLL WIN_UM_FIELD_DLL

Indexes in the WIN_OPAQUE_FIELDS.Um.Dll array, containing offsets inside the _LDR_DATA_TABLE_ENTRY structure.

The WIN_UM_FIELD macro can be used to access these more easily.

◆ WIN_UM_FIELD_PEB

typedef enum _WIN_UM_FIELD_PEB WIN_UM_FIELD_PEB

Indexes in the WIN_OPAQUE_FIELDS.Um.Peb array, containing offsets inside the _PEB structure.These are the indexes of the offsets inside the WIN_OPAQUE_FIELDS.Um.Peb array. The WIN_UM_FIELD can be used to access these more easily.

◆ WIN_UM_FIELD_TEB

typedef enum _WIN_UM_FIELD_TEB WIN_UM_FIELD_TEB

Indexes in the WIN_OPAQUE_FIELDS.Um.Teb array, containing offsets inside the _TEB structure.The WIN_UM_FIELD macro can be used to access these more easily.

◆ WIN_UM_STRUCTURE

typedef enum _WIN_UM_STRUCTURE WIN_UM_STRUCTURE

Structure tags used for the user mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Um field.

Enumeration Type Documentation

◆ _LIX_ACTIVE_PATCH_TYPE

enum _LIX_ACTIVE_PATCH_TYPE

Describes the type of an Linux active-patch.

Enumerator
lixActivePatchTextPoke	Used for 'text_poke'.
lixActivePatchFtrace	Used for 'ftrace'.
lixActivePatchJmpLabel	Used for 'arch_jump_label_transform'.
lixActivePatchCount	The number of entries.

Definition at line 444 of file lixguest.h.

◆ _LIX_FIELD_BINPRM

enum _LIX_FIELD_BINPRM

The index for offsets of 'struct linux_binprm'.

Enumerator
lixFieldBinprmSizeof	The value of sizeof(struct linux_binprm).
lixFieldBinprmMm	The offset of linux_binprm.mm.
lixFieldBinprmFile	The offset of linux_binprm.file.
lixFieldBinprmCred	The offset of linux_binprm.cred.
lixFieldBinprmFilename	The offset of linux_binprm.filename.
lixFieldBinprmInterp	The offset of linux_binprm.interp.
lixFieldBinprmVma	The offset of linux_binprm.vma.
lixFieldBinprmArgc	The offset of linux_binprm.argc.
lixFieldBinprmEnd	The end of tags.

Definition at line 142 of file lixguest.h.

◆ _LIX_FIELD_CRED

enum _LIX_FIELD_CRED

The index for offsets of 'struct cred'.

Enumerator
lixFieldCredSizeof	The value of sizeof(struct cred).
lixFieldCredUsage	The offset of cred.usage.
lixFieldCredRcu	The offset of cred.rcu.
lixFieldCredEnd	The end of tags.

Definition at line 336 of file lixguest.h.

◆ _LIX_FIELD_DENTRY

enum _LIX_FIELD_DENTRY

The index for offsets of 'struct dentry'.

Enumerator
lixFieldDentryParent	The offset of dentry.d_parent.
lixFieldDentryName	The offset of dentry.d_name.
lixFieldDentryDiname	The offset of dentry.d_iname.
lixFieldDentryInode	The offset of dentry.d_inode.
lixFieldDentryEnd	The end of tags.

Definition at line 178 of file lixguest.h.

◆ _LIX_FIELD_FDTABLE

enum _LIX_FIELD_FDTABLE

The index for offsets of 'struct fdtable'.

Enumerator
lixFieldFdTableMaxFds	The offset of fdtable.max_fds.
lixFieldFdTableFd	The offset of fs_struct.fd.
lixFieldFdTableEnd	The end of tags.

Definition at line 264 of file lixguest.h.

◆ _LIX_FIELD_FILES

enum _LIX_FIELD_FILES

The index for offsets of 'struct files_struct'.

Enumerator
lixFieldFilesSizeof	The value of sizeof(struct files_struct).
lixFieldFilesFdt	The offset of fs_struct.fdt.
lixFieldFilesEnd	The end of tags.

Definition at line 276 of file lixguest.h.

◆ _LIX_FIELD_FS

enum _LIX_FIELD_FS

The index for offsets of 'struct fs_struct'.

Enumerator
lixFieldFsSizeof	The value of sizeof(struct fs_struct).
lixFieldFsRoot	The offset of fs_struct.root.
lixFieldFsPwd	The offset of fs_struct.pwd.
lixFieldFsEnd	The end of tags.

Definition at line 251 of file lixguest.h.

◆ _LIX_FIELD_INFO

enum _LIX_FIELD_INFO

Describes information about a Linux guest.

Enumerator
lixFieldInfoThreadSize	The size of a thread.
lixFieldInfoHasModuleLayout	The guest has module layout.
lixFieldInfoHasVdsoImageStruct	The guest has the vdso image struct.
lixFieldInfoHasSmallSlack	Unused.
lixFieldInfoHasKsymRelative	The guest emit the symbol references in the kallsyms table as 32-bit entries, each containing a relative value in the range [base, base + U32_MAX].
lixFieldInfoHasKsymAbsolutePercpu	The guest emit an absolute value in the range [0, S32_MAX] or a relative value in the range [base, base + S32_MAX], where base is the lowest relative symbol address encountered in the image.
lixFieldInfoHasKsymSize	The guest has an additional table that contains the sizes of the functions/variables.
lixFieldInfoHasAlternateSyscall	The guest has an alternative syscall handler.
lixFieldInfoHasVmaAdjustExpand	Unused.
lixFieldInfoHasVdsoFixed	The guest has is build with VSYSCALL support.
lixFieldInfoHasKsymReducedSize	The size of a 'kallsym_markers' entry is 4.
lixFieldInfoEnd	The end of tags.

Definition at line 87 of file lixguest.h.

◆ _LIX_FIELD_INODE

enum _LIX_FIELD_INODE

The index for offsets of 'struct inode'.

Enumerator
lixFieldInodeSizeof	The value of sizeof(struct inode).
lixFieldInodeImode	The offset of inode.i_mode.
lixFieldInodeUid	The offset of inode.i_uid.
lixFieldInodeGid	The offset of inode.i_gid.
lixFieldInodeEnd	The end of tags.

Definition at line 288 of file lixguest.h.

◆ _LIX_FIELD_MMSTRUCT

enum _LIX_FIELD_MMSTRUCT

The index for offsets of 'struct mm_struct'.

Enumerator
lixFieldMmStructPgd	The offset of mm_struct.pgd.
lixFieldMmStructMmUsers	The offset of mm_struct.mm_users.
lixFieldMmStructMmCount	The offset of mm_struct.mm_count.
lixFieldMmStructMmList	The offset of mm_struct.mmlist.
lixFieldMmStructStartCode	The offset of mm_struct.start_code.
lixFieldMmStructEndCode	The offset of mm_struct.end_code.
lixFieldMmStructStartData	The offset of mm_struct.start_data.
lixFieldMmStructEndData	The offset of mm_struct.end_data.
lixFieldMmStructFlags	The offset of mm_struct.flags.
lixFieldMmStructExeFile	The offset of mm_struct.end_data.exe_file.
lixFieldMmStructVma	The offset of mm_struct.mmap.
lixFieldMmStructStartStack	The offset of mm_struct.start_stack.
lixFieldMmStructRbNode	The offset of mm_struct.mm_rb.
lixFieldMmStructVdsoAddress	The offset of mm_struct.context.vdso.
lixFieldMmStructEnd	The end of tags.

Definition at line 192 of file lixguest.h.

◆ _LIX_FIELD_MODULE

enum _LIX_FIELD_MODULE

The index for offsets of 'struct module'.

Enumerator
lixFieldModuleSizeof	The value of sizeof(struct module).
lixFieldModuleList	The offset of module.list.
lixFieldModuleName	The offset of module.name.
lixFieldModuleSymbols	The offset of module.symbols.
lixFieldModuleNumberOfSymbols	The offset of module.sum_syms.
lixFieldModuleGplSymbols	The offset of module.gpl_syms.
lixFieldModuleNumberOfGplSymbols	The offset of module.num_gpl_syms.
lixFieldModuleInit	The offset of module.init.
lixFieldModuleModuleInit	The offset of module.init_layout.
lixFieldModuleModuleCore	The offset of module.core_layout.
lixFieldModuleInitSize	The offset of module.init_layout.size.
lixFieldModuleCoreSize	The offset of module.core_layout.size.
lixFieldModuleInitTextSize	The offset of module.init_layout.text_size.
lixFieldModuleCoreTextSize	The offset of module.core_layout.text_size.
lixFieldModuleInitRoSize	The offset of module.init_layout.ro_size.
lixFieldModuleCoreRoSize	The offset of module.core_layout.ro_size.
lixFieldModuleCoreLayout	The offset of module.core_layout.
lixFieldModuleInitLayout	The offset of module.init_layout.
lixFieldModuleState	The offset of module.state.
lixFieldModuleEnd	The end of tags.

Definition at line 113 of file lixguest.h.

◆ _LIX_FIELD_NSPROXY

enum _LIX_FIELD_NSPROXY

The index for offsets of 'struct nsproxy'.

Enumerator
lixFieldNsProxyCount	The offset of nsproxy.count.
lixFieldNsProxyUts	The offset of nsproxy.uts_ns.
lixFieldNsProxyIpc	The offset of nsproxy.ipc_ns.
lixFieldNsProxyMnt	The offset of nsproxy.mnt_ns.
lixFieldNsProxyPid	The offset of nsproxy.pid_ns_for_children.
lixFieldNsProxyNet	The offset of nsproxy.net_ns.
lixFieldNsProxyEnd	The end of tags.

Definition at line 349 of file lixguest.h.

◆ _LIX_FIELD_SOCK

enum _LIX_FIELD_SOCK

The index for offsets of 'struct sock'.

Enumerator
lixFieldSockSizeof	The value of sizeof(struct sock).
lixFieldSockNum	The offset of sock.sk_num.
lixFieldSockDport	The offset of sock.sk_dport.
lixFieldSockDaddr	The offset of sock.sk_daddr.
lixFieldSockRcvSaddr	The offset of sock.sk_receive_addr.
lixFieldSockFamily	The offset of sock.sk_family.
lixFieldSockState	The offset of sock.sk_state.
lixFieldSockProto	The offset of sock.sk_prot.
lixFieldSockV6Daddr	The offset of sock.sk_v6_daddr.
lixFieldSockV6RcvSaddr	The offset of sock.sk_v6_daddr.
lixFieldSockEnd	The end of tags.

Definition at line 316 of file lixguest.h.

◆ _LIX_FIELD_SOCKET

enum _LIX_FIELD_SOCKET

The index for offsets of 'struct socket'.

Enumerator
lixFieldSocketState	The offset of socket.state.
lixFieldSocketType	The offset of socket.type.
lixFieldSocketFlags	The offset of socket.flags.
lixFieldSocketSk	The offset of socket.sk.
lixFieldSocketEnd	The end of tags.

Definition at line 302 of file lixguest.h.

◆ _LIX_FIELD_TASKSTRUCT

enum _LIX_FIELD_TASKSTRUCT

The index for offsets of 'struct task-struct'.

Enumerator
lixFieldTaskStructStack	The offset of task_struct.stack.
lixFieldTaskStructUsage	The offset of task_struct.usage.
lixFieldTaskStructFlags	The offset of task_struct.flags.
lixFieldTaskStructTasks	The offset of task_struct.tasks.
lixFieldTaskStructPid	The offset of task_struct.pid.
lixFieldTaskStructTgid	The offset of task_struct.tgid.
lixFieldTaskStructRealParent	The offset of task_struct.real_parent.
lixFieldTaskStructParent	The offset of task_struct.parent.
lixFieldTaskStructMm	The offset of task_struct.mm.
lixFieldTaskStructStartTime	The offset of task_struct.start_time.
lixFieldTaskStructComm	The offset of task_struct.comm.
lixFieldTaskStructSignal	The offset of task_struct.signal.
lixFieldTaskStructExitCode	The offset of task_struct.exit_code.
lixFieldTaskStructThreadNode	The offset of task_struct.thread_node.
lixFieldTaskStructThreadGroup	The offset of task_struct.thread_group.
lixFieldTaskStructCred	The offset of task_struct.cred.
lixFieldTaskStructFs	The offset of task_struct.fs.
lixFieldTaskStructFiles	The offset of task_struct.files.
lixFieldTaskStructNsProxy	The offset of task_struct.nsproxy.
lixFieldTaskStructGroupLeader	The offset of task_struct.group_leader.
lixFieldTaskStructExitSignal	The offset of task_struct.exit_signal.
lixFieldTaskStructInExecve	The offset of task_struct.in_execve.
lixFieldTaskStructInExecveBit	The offset of task_struct.execve.
lixFieldTaskStructThreadStructSp	The offset of task_struct.thread_struct.sp.
lixFieldTaskStructAltStackSp	The offset of alternate stack.
lixFieldTaskStructEnd	The end of tags.

Definition at line 216 of file lixguest.h.

◆ _LIX_FIELD_UNGROUPED

enum _LIX_FIELD_UNGROUPED

The index for offsets of structures that are not grouped.

Enumerator
lixFieldUngroupedFileDentry	The offset of file.f_path.dentry.
lixFieldUngroupedProtoName	The offset of proto.name.
lixFieldUngroupedSignalListHead	The offset of signal_struct.thread_head.
lixFieldUngroupedSocketAllocVfsInode	The guest virtual address of the 'struct socket *sock_alloc(void);' function.
lixFieldUngroupedRunning	The value of the system_state.RUNNING.
lixFieldUngroupedFilePath	The offset of file.f_path.
lixFieldUngroupedSignalNrThreads	The offset of signal_struct.nr_threads.
lixFieldUngroupedEnd	The end of tags.

Definition at line 365 of file lixguest.h.

◆ _LIX_FIELD_VMA

enum _LIX_FIELD_VMA

The index for offsets of 'struct vm_area_struct'.

Enumerator
lixFieldVmaVmaStart	The offset of vm_area_struct.vm_start.
lixFieldVmaVmaEnd	The offset of vm_area_struct.vm_end.
lixFieldVmaVmNext	The offset of vm_area_struct.vm_next.
lixFieldVmaVmPrev	The offset of vm_area_struct.vm_prev.
lixFieldVmaMm	The offset of vm_area_struct.vm_mm.
lixFieldVmaFlags	The offset of vm_area_struct.flags.
lixFieldVmaFile	The offset of vm_area_struct.file.
lixFieldVmaRbNode	The offset of vm_area_struct.vm_rb.
lixFieldVmaEnd	The end of tags.

Definition at line 160 of file lixguest.h.

◆ _WIN_KM_FIELD_DRVOBJ

enum _WIN_KM_FIELD_DRVOBJ

Indexes in the WIN_OPAQUE_FIELDS.Km.DrvObj array, containing information about the _DRIVER_OBJECT structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldDrvObjSize	The size of the _DRIVER_OBJECT structure. This is the size protected by introcore when protecting driver objects due to the INTRO_OPT_PROT_KM_DRVOBJ protection flag.
winKmFieldDrvObjFiodispSize	The size of the _FAST_IO_DISPATCH structure. This is the size protected by introcore when protecting driver objects due to the INTRO_OPT_PROT_KM_DRVOBJ protection flag.
winKmFieldDrvObjAllocationGap	The size of the allocation that precedes a driver object, excluding the POOL_HEADER (0x8/0x10 bytes).
winKmFieldDrvObjFiodisp	Offset of FastIoDispatch.
winKmFieldDrvObjStart	Offset of DriverStart.
winKmFieldDrvObjEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 330 of file winguest.h.

◆ _WIN_KM_FIELD_EPROCESSFLAGS

enum _WIN_KM_FIELD_EPROCESSFLAGS

Indexes in the WIN_OPAQUE_FIELDS.Km.EprocessFlags array, containing information about the flags inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldEprocessFlagsNoDebugInherit	Mask for NoDebugInherit from _EPROCESS.Flags.
winKmFieldEprocessFlagsExiting	Mask for Exiting from _EPROCESS.Flags.
winKmFieldEprocessFlagsDelete	Mask for Delete from _EPROCESS.Flags.
winKmFieldEprocessFlags3Crashed	Mask for Flag3Crashed from _EPROCESS.Flags.
winKmFieldEprocessFlagsVmDeleted	Mask for VmDeleted from _EPROCESS.Flags.
winKmFieldEprocessFlagsHasAddrSpace	Mask for HasAddrSpace from _EPROCESS.Flags.
winKmFieldEprocessFlagsEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 462 of file winguest.h.

◆ _WIN_KM_FIELD_FILE_OBJECT

enum _WIN_KM_FIELD_FILE_OBJECT

Indexes in the WIN_OPAQUE_FIELDS.Km.FileObject array, containing information about the _FILE_OBJECT structure.The WIN_KM_FIELD macros can be used to access these more easily.

Enumerator

winKmFieldFileObjectNameBuffer

Offset of FileName.Buffer.

winKmFieldFileObjectNameLength

Offset of FileName.Length

winKmFieldFileObjectEnd

The end of the fields.

This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 629 of file winguest.h.

◆ _WIN_KM_FIELD_MMPFN

enum _WIN_KM_FIELD_MMPFN

Indexes in the WIN_OPAQUE_FIELDS.Km.Mmpfn array, containing information about the _MMPFN structure.For 32-bit versions of the OS, this is split into two sections: PAE and non-PAE, as Windows versions prior to Windows 8 were able to boot without PAE support and in those cases the _MMPFN structure was different. For 32-bit guests with PAE enabled (gGuest->Mm.Mode is PAGING_PAE_MODE in those cases) the Pae version of the tags should be used. For the other guests, the normal versions should be used.

The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldMmpfnSize	The size of the _MMPFN structure.
winKmFieldMmpfnPte	Offset of PteAddress (or PteLong).
winKmFieldMmpfnRefCount	Offset of u3.ReferenceCount.
winKmFieldMmpfnFlags	Offset of u3.e1.
winKmFieldMmpfnPaeSize	The size of the _MMPFN structure when PAE is enabled.
winKmFieldMmpfnPaePte	Offset of PteAddress (or PteLong) when PAE is enabled.
winKmFieldMmpfnPaeRefCount	Offset of u3.ReferenceCount when PAE is enabled.
winKmFieldMmpfnPaeFlags	Offset of u3.e1 when PAE is enabled.
winKmFieldMmpfnEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 396 of file winguest.h.

◆ _WIN_KM_FIELD_PCR

enum _WIN_KM_FIELD_PCR

Indexes in the WIN_OPAQUE_FIELDS.Km.Pcr array, containing information about the _KPCR structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator

winKmFieldPcrCurrentThread

Offset of PrcbData.CurrentThread.

winKmFieldPcrUserTime

Offset of PrcbData.UserTime.

winKmFieldPcrEnd

The end of the fields.

This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 358 of file winguest.h.

◆ _WIN_KM_FIELD_POOLDESCRIPTOR

enum _WIN_KM_FIELD_POOLDESCRIPTOR

Indexes in the WIN_OPAQUE_FIELDS.Km.PoolDescriptor array, containing information about the _POOL_DESCRIPTOR structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator

winKmFieldPoolDescriptorTotalBytes

Offset of TotalBytes.

winKmFieldPoolDescriptorNppSize

The size of the non paged pool.

winKmFieldPoolDescriptorEnd

The end of the fields.

This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 375 of file winguest.h.

◆ _WIN_KM_FIELD_PROCESS

enum _WIN_KM_FIELD_PROCESS

Indexes in the WIN_OPAQUE_FIELDS.Km.Process array, containing offsets inside the _EPROCESS structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldProcessCr3	Offset of Pcb.DirectoryTableBase.
winKmFieldProcessUserCr3	Offset of Pcb.UserDirectoryTableBase if it exists, DirectoryTableBase if not.
winKmFieldProcessKexecOptions	Offset of Pcb.Flags.
winKmFieldProcessListEntry	Offset of ActiveProcessLinks.
winKmFieldProcessName	Offset of ImageFileName.
winKmFieldProcessSectionBase	Offset of SectionBaseAddress.
winKmFieldProcessId	Offset of UniqueProcessId.
winKmFieldProcessParentPid	Offset of InheritedFromUniqueProcessId.
winKmFieldProcessVadRoot	Offset of VadRoot.
winKmFieldProcessCreateTime	Offset of CreateTime.
winKmFieldProcessExitStatus	Offset of ExitStatus.
winKmFieldProcessToken	Offset of Token.
winKmFieldProcessObjectTable	Offset of ObjectTable.
winKmFieldProcessPeb	Offset of Peb.
winKmFieldProcessThreadListHead	Offset of Pcb.ThreadListHead.
winKmFieldProcessWoW64	Offset of Wow64Process (only for 64-bit guests).
winKmFieldProcessFlags	Offset of Flags.
winKmFieldProcessFlags3	Offset of Flags3.
winKmFieldProcessMitigationFlags	Offset of MitigationFlags if it exists (>= RS3).
winKmFieldProcessMitigationFlags2	Offset of MitigationFlags2 if it exists (>= RS3).
winKmFieldProcessDebugPort	Offset of DebugPort (needed for DPI Debug Flag).
winKmFieldProcessSpare	The offset at which spare space is found inside the structure. It is safe for introcore to change these fields (for example, for inserting protection data).
winKmFieldProcessEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 263 of file winguest.h.

◆ _WIN_KM_FIELD_SYSCALL_NUMBERS

enum _WIN_KM_FIELD_SYSCALL_NUMBERS

Indexes in the WIN_OPAQUE_FIELDS.Km.SyscallNumbers array, containing syscall numbers.The WIN_SYSCALL_NUMBER or WIN_KM_FIELD macros can be used to access these more easily.

Enumerator
winKmFieldSyscallNumbersNtWriteVirtualMemory	The NtWriteSyscallMemory syscall number.
winKmFieldSyscallNumbersNtProtectVirtualMemory	The NtProtectVirtualMemory syscall number.
winKmFieldSyscallNumbersNtCreateThreadEx	The NtCreateThreadEx syscall number.
winKmFieldSyscallNumbersEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 611 of file winguest.h.

◆ _WIN_KM_FIELD_THREAD

enum _WIN_KM_FIELD_THREAD

Indexes in the WIN_OPAQUE_FIELDS.Km.Thread array, containing offsets inside the _ETHREAD structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldThreadProcess	Offset of Tcb.Process.
winKmFieldThreadThreadListEntry	Offset of Tcb.ThreadListEntry (not the one found directly in the _ETHREAD).
winKmFieldThreadKernelStack	Offset of Tcb.KernelStack.
winKmFieldThreadStackBase	Offset of Tcb.StackBase.
winKmFieldThreadStackLimit	Offset of Tcb.StackLimit.
winKmFieldThreadState	Offset of Tcb.State.
winKmFieldThreadWaitReason	Offset of Tcb.WaitReason.
winKmFieldThreadAttachedProcess	Offset of Tcb.ApcState.Process.
winKmFieldThreadTeb	Offset of Tcb.Teb.
winKmFieldThreadId	Offset of Cid.UniqueThread.
winKmFieldThreadClientSecurity	Offset of ClientSecurity.
winKmFieldThreadTrapFrame	Offset of Tcb.TrapFrame.
winKmFieldThreadWin32StartAddress	Offset of Win32StartAddress.
winKmFieldThreadEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 303 of file winguest.h.

◆ _WIN_KM_FIELD_TOKEN

enum _WIN_KM_FIELD_TOKEN

Indexes in the WIN_OPAQUE_FIELDS.Km.Token array, containing information about the _TOKEN structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldTokenPrivs	Offset of Privileges.
winKmFieldTokenUserCount	Offset of UserAndGroupCount.
winKmFieldTokenRestrictedCount	Offset of RestrictedSidCount.
winKmFieldTokenUsers	Offset of UserAndGroups.
winKmFieldTokenRestrictedSids	Offset of RestrictedSids.
winKmFieldTokenEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 419 of file winguest.h.

◆ _WIN_KM_FIELD_UNGROUPED

enum _WIN_KM_FIELD_UNGROUPED

Indexes in the WIN_OPAQUE_FIELDS.Km.Ungrouped array, containing information about various kernel structures or data.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldUngroupedCtlAreaFile	Offset of FilePointer in _CONTROL_AREA.
winKmFieldUngroupedHandleTableTableCode	Offset of TableCode _HANDLE_TABLE.
winKmFieldUngroupedHalIntCtrlType	Offset of InterruptControllerType.
winKmFieldUngroupedWmiGetClockOffset	Offset of GetCpuClock in _WMI_LOGGER_CONTEXT.
winKmFieldUngroupedEtwDbgDataSiloOffset	Offset of EtwDbgDataSilo in EtwpDbgData.
winKmFieldUngroupedEtwSignatureOffset	The offset relative tot he EtwDebuggerData structure at which the ETW signature is found.
winKmFieldUngroupedSubsectionCtlArea	Offset of ControlArea in _SUBSECTION.
winKmFieldUngroupedEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 439 of file winguest.h.

◆ _WIN_KM_FIELD_VAD_LONG

enum _WIN_KM_FIELD_VAD_LONG

Indexes in the WIN_OPAQUE_FIELDS.Km.VadLong array, containing information about the _MMVAD_LONG structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator

winKmFieldVadLongSubsection

Offset of Subsection.

winKmFieldVadLongEnd

The end of the fields.

This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries

Definition at line 534 of file winguest.h.

◆ _WIN_KM_FIELD_VAD_SHORT

enum _WIN_KM_FIELD_VAD_SHORT

Indexes in the WIN_OPAQUE_FIELDS.Km.VadShort array, containing information about the _MMVAD_SHORT structure.The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldVadShortParent	Offset of ParentValue.
winKmFieldVadShortLeft	Offset of LeftChild.
winKmFieldVadShortRight	Offset of RightChild.
winKmFieldVadShortStartingVpn	Offset of StartingVpn. Since the size of the field may vary from a Windows version to another, #winKmFieldVadShortVpnSize should be checked in order to know how much to read from the guest.
winKmFieldVadShortStartingVpnHigh	Offset of StartingVpnHigh. Not all Windows versions have this. If it is 0, it is not used.
winKmFieldVadShortEndingVpn	Offset of EndingVpn. Since the size of the field may vary from a Windows version to another, #winKmFieldVadShortVpnSize should be checked in order to know how much to read from the guest.
winKmFieldVadShortEndingVpnHigh	Offset of EndingVpnHigh. Not all Windows versions have this. If it is 0, it is not used.
winKmFieldVadShortFlags	Offset of VadFlags. The size of the field varies. Check #winKmFieldVadShortFlagsSize in order to know the valid size.
winKmFieldVadShortFlagsSize	The minimum size that must be read from the guest in order to properly parse winKmFieldVadShortFlags.
winKmFieldVadShortVpnSize	The size of winKmFieldVadShortStartingVpn and winKmFieldVadShortEndingVpn. #winKmFieldVadShortStartingVpnHigh and #winKmFieldVadShortEndingVpnHigh are always 1 in size.
winKmFieldVadShortSize	The minimum size that must be read from the guest in order to properly parse a _MMVAD_SHORT structure.
winKmFieldVadShortEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries

Definition at line 483 of file winguest.h.

◆ _WIN_KM_FIELD_VADFLAGS

enum _WIN_KM_FIELD_VADFLAGS

Indexes in the WIN_OPAQUE_FIELDS.Km.VadFlags array, containing information about the bits in the winKmFieldVadShortFlags field.Certain values are parsed by shifting the flags value and then applying a mask, while boolean values are stored as the bit that must be checked in order to know if that bit is set or not. For example, in order to obtain the type from a 32-bit flags value you need to:

DWORD flags = ...

VAD_TYPE = (flags >> WIN_KM_FIELD(VadFlags, TypeShift)) & WIN_KM_FIELD(VadFlags, TypeMask);

While checking if private fix-up is set:

DWORD flags = ...

BOOLEAN privateFixup = 0 != (flags & WIN_KM_FIELD(VadFlags, PrivateFixupMask));

The WIN_KM_FIELD macro can be used to access these more easily.

Enumerator
winKmFieldVadFlagsTypeShift	The right shift that must be applied to the flags field before applying the winKmFieldVadFlagsTypeMask mask in order to obtain the Type value.
winKmFieldVadFlagsTypeMask	The mask that must be applied in order to obtain the Type value. The flags value must first be right shifted with #winKmFieldVadFlagsTypeShift.
winKmFieldVadFlagsProtectionShift	The right shift that must be applied to the flags field before applying the winKmFieldVadFlagsProtectionMask mask in order to obtain the Protection value.
winKmFieldVadFlagsProtectionMask	The mask that must be applied in order to obtain the Protection value. The flags value must first be right shifted with #winKmFieldVadFlagsProtectionShift.
winKmFieldVadFlagsNoChangeBit	The index of the NoChange bit. Since this can be in the upper 32-bits of a 64-bit value and CAMI can not send 64-bit values, it is stored as the bit index. For example: QWORD flags = ... BOOLEAN noChange = 0 != (flags & BIT(WIN_KM_FIELD(VadFlags, NoChangeBit)));
winKmFieldVadFlagsPrivateFixupMask	The mask that must be applied for the private fix-up setting.
winKmFieldVadFlagsDeleteInProgressMask	The mask for the DeleteInProgressBit. Not all Windows versions use this. If it is not used it is 0.
winKmFieldVadFlagsEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries

Definition at line 563 of file winguest.h.

◆ _WIN_KM_STRUCTURE

enum _WIN_KM_STRUCTURE

Structure tags used for the kernel mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Km field.

Enumerator
winKmStructureProcess	Used for the WIN_OPAQUE_FIELDS.Km.Process array.
winKmStructureThread	Used for the WIN_OPAQUE_FIELDS.Km.Thread array.
winKmStructureDrvObj	Used for the WIN_OPAQUE_FIELDS.Km.DrvObj array.
winKmStructurePcr	Used for the WIN_OPAQUE_FIELDS.Km.Pcr array.
winKmStructurePoolDescriptor	Used for the WIN_OPAQUE_FIELDS.Km.PoolDescriptor array.
winKmStructureMmpfn	Used for the WIN_OPAQUE_FIELDS.Km.Mmpfn array.
winKmStructureToken	Used for the WIN_OPAQUE_FIELDS.Km.Token array.
winKmStructureUngrouped	Used for the WIN_OPAQUE_FIELDS.Km.Ungrouped array.
winKmStructureEprocessFlags	Used for the WIN_OPAQUE_FIELDS.Km.EprocessFlags array.
winKmStructureVadShort	Used for the WIN_OPAQUE_FIELDS.Km.VadShort array.
winKmStructureVadLong	Used for the WIN_OPAQUE_FIELDS.Km.VadLong array.
winKmStructureVadFlags	Used for the WIN_OPAQUE_FIELDS.Km.VadFlags array.
winKmStructureSyscallNumbers	Used for the WIN_OPAQUE_FIELDS.Km.SyscallNumbers array.
winKmStructureFileObject	Used for the WIN_OPAQUE_FIELDS.Km.FileObject array.
winKmStructureEnd	The end of the tags. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 218 of file winguest.h.

◆ _WIN_UM_FIELD_DLL

enum _WIN_UM_FIELD_DLL

Indexes in the WIN_OPAQUE_FIELDS.Um.Dll array, containing offsets inside the _LDR_DATA_TABLE_ENTRY structure.

The WIN_UM_FIELD macro can be used to access these more easily.

Enumerator
winUmFieldDllBaseOffsetInModule64	The offset of the DllBase field for 64-bit modules.
winUmFieldDllBaseOffsetInModule32	The offset of the DllBase field for 32-bit modules.
winUmFieldDllSizeOffsetInModule64	The offset of the SizeOfImage field for 64-bit modules.
winUmFieldDllSizeOffsetInModule32	The offset of the SizeOfImage field for 64-bit modules.
winUmFieldDllNameOffsetInModule64	The offset of the FullDllName field for 64-bit modules.
winUmFieldDllNameOffsetInModule32	The offset of the FullDllName field for 32-bit modules.
winUmFieldDllEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 160 of file winguest.h.

◆ _WIN_UM_FIELD_PEB

enum _WIN_UM_FIELD_PEB

Indexes in the WIN_OPAQUE_FIELDS.Um.Peb array, containing offsets inside the _PEB structure.These are the indexes of the offsets inside the WIN_OPAQUE_FIELDS.Um.Peb array. The WIN_UM_FIELD can be used to access these more easily.

Enumerator

winUmFieldPeb64Size

The relevant size of the _PEB for 64-bit processes.

winUmFieldPeb32Size

The relevant size of the _PEB for 32-bit processes.

winUmFieldPebEnd

The end of the fields.

This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 181 of file winguest.h.

◆ _WIN_UM_FIELD_TEB

enum _WIN_UM_FIELD_TEB

Indexes in the WIN_OPAQUE_FIELDS.Um.Teb array, containing offsets inside the _TEB structure.The WIN_UM_FIELD macro can be used to access these more easily.

Enumerator
winUmFieldTeb64Size	The relevant size of the _TEB for 64-bit processes.
winUmFieldTeb32Size	The relevant size of the _TEB for 32-bit processes
winUmFieldTebWow64SaveArea	The offset of the area in which a thread of a WoW64 application saves its general purpose registers when jumping to 64-bit code in order to issue a syscall
winUmFieldTebWow64StackInSaveArea	The offset of the ESP in the winUmFieldTebWow64SaveArea.
winUmFieldTebEnd	The end of the fields. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries

Definition at line 197 of file winguest.h.

◆ _WIN_UM_STRUCTURE

enum _WIN_UM_STRUCTURE

Structure tags used for the user mode structures.Each of these refers to a WIN_OPAQUE_FIELDS.Um field.

Enumerator
winUmStructureDll	Used for the WIN_OPAQUE_FIELDS.Um.Dll array.
winUmStructurePeb	Used for the WIN_OPAQUE_FIELDS.Um.Peb array.
winUmStructureTeb	Used for the WIN_OPAQUE_FIELDS.Um.Teb array.
winUmStructureEnd	The end of the tags. This must always be the last entry in this enum. New entries must be added right before this one in order to preserve the existing order of entries.

Definition at line 246 of file winguest.h.

◆ LIX_STRUCTURE

enum LIX_STRUCTURE

Structure tags used for the Linux structures.

Enumerator
lixStructureInfo	The tag for LIX_FIELD_INFO.
lixStructureModule	The tag for LIX_FIELD_MODULE.
lixStructureBinprm	The tag for LIX_FIELD_BINPRM.
lixStructureVma	The tag for LIX_FIELD_VMA.
lixStructureDentry	The tag for LIX_FIELD_DENTRY.
lixStructureMmStruct	The tag for LIX_FIELD_MMSTRUCT.
lixStructureTaskStruct	The tag for LIX_FIELD_TASKSTRUCT.
lixStructureFs	The tag for LIX_FIELD_FS.
lixStructureFdTable	The tag for LIX_FIELD_FDTABLE.
lixStructureFiles	The tag for LIX_FIELD_FILES.
lixStructureInode	The tag for LIX_FIELD_INODE.
lixStructureSocket	The tag for LIX_FIELD_SOCKET.
lixStructureSock	The tag for LIX_FIELD_SOCK.
lixStructureCred	The tag for LIX_FIELD_CRED.
lixStructureNsProxy	The tag for LIX_FIELD_NSPROXY.
lixStructureUngrouped	The tag for LIX_FIELD_UNGROUPED.
lixStructureEnd	The end of tags.

Definition at line 61 of file lixguest.h.

Files

Data Structures

Macros

Typedefs

Enumerations

Detailed Description

Macro Definition Documentation

◆ LIX_FIELD

◆ WIN_KM_FIELD

◆ WIN_SYSCALL_NUMBER

◆ WIN_UM_FIELD

Typedef Documentation

◆ LIX_ACTIVE_PATCH

◆ LIX_ACTIVE_PATCH_TYPE

◆ LIX_FIELD_BINPRM

◆ LIX_FIELD_CRED

◆ LIX_FIELD_DENTRY

◆ LIX_FIELD_FDTABLE

◆ LIX_FIELD_FILES

◆ LIX_FIELD_FS

◆ LIX_FIELD_INFO

◆ LIX_FIELD_INODE

◆ LIX_FIELD_MMSTRUCT

◆ LIX_FIELD_MODULE

◆ LIX_FIELD_NSPROXY

◆ LIX_FIELD_SOCK

◆ LIX_FIELD_SOCKET

◆ LIX_FIELD_TASKSTRUCT

◆ LIX_FIELD_UNGROUPED

◆ LIX_FIELD_VMA

◆ LIX_OPAQUE_FIELDS

◆ LIX_STRUCTURE

◆ LIX_SYMBOL

◆ PLIX_OPAQUE_FIELDS

◆ PLIX_SYMBOL

◆ PWIN_OPAQUE_FIELDS

◆ WIN_KM_FIELD_DRVOBJ

◆ WIN_KM_FIELD_EPROCESSFLAGS

◆ WIN_KM_FIELD_FILE_OBJECT

◆ WIN_KM_FIELD_MMPFN

◆ WIN_KM_FIELD_PCR

◆ WIN_KM_FIELD_POOLDESCRIPTOR

◆ WIN_KM_FIELD_PROCESS

◆ WIN_KM_FIELD_SYSCALL_NUMBERS

◆ WIN_KM_FIELD_THREAD

◆ WIN_KM_FIELD_TOKEN

◆ WIN_KM_FIELD_UNGROUPED

◆ WIN_KM_FIELD_VAD_LONG

◆ WIN_KM_FIELD_VAD_SHORT

◆ WIN_KM_FIELD_VADFLAGS

◆ WIN_KM_STRUCTURE

◆ WIN_OPAQUE_FIELDS

◆ WIN_UM_FIELD_DLL

◆ WIN_UM_FIELD_PEB

◆ WIN_UM_FIELD_TEB

◆ WIN_UM_STRUCTURE

Enumeration Type Documentation

◆ _LIX_ACTIVE_PATCH_TYPE

◆ _LIX_FIELD_BINPRM

◆ _LIX_FIELD_CRED

◆ _LIX_FIELD_DENTRY

◆ _LIX_FIELD_FDTABLE

◆ _LIX_FIELD_FILES

◆ _LIX_FIELD_FS

◆ _LIX_FIELD_INFO

◆ _LIX_FIELD_INODE

◆ _LIX_FIELD_MMSTRUCT

◆ _LIX_FIELD_MODULE

◆ _LIX_FIELD_NSPROXY

◆ _LIX_FIELD_SOCK

◆ _LIX_FIELD_SOCKET

◆ _LIX_FIELD_TASKSTRUCT

◆ _LIX_FIELD_UNGROUPED

◆ _LIX_FIELD_VMA

◆ _WIN_KM_FIELD_DRVOBJ

◆ _WIN_KM_FIELD_EPROCESSFLAGS

◆ _WIN_KM_FIELD_FILE_OBJECT

◆ _WIN_KM_FIELD_MMPFN

◆ _WIN_KM_FIELD_PCR

◆ _WIN_KM_FIELD_POOLDESCRIPTOR