hook_ptm.h

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */
#ifndef _HOOK_PTM_H_
#define _HOOK_PTM_H_

#include "hook_gpa.h"


typedef struct _HOOK_PTM_TABLE
{
    HOOK_HEADER         Header;         
    LIST_ENTRY          Link;           
    QWORD               Gpa;            
    PHOOK_GPA           GpaHook;        
    BOOLEAN             GpaHookSet;     
    DWORD               RefCount;
    DWORD               DelCount;       
    DWORD               EntriesCount;   
    LIST_ENTRY          *Entries;
} HOOK_PTM_TABLE, *PHOOK_PTM_TABLE;


typedef struct _HOOK_PTM
{
    HOOK_HEADER                 Header;         
    LIST_ENTRY                  Link;           
    QWORD                       Address;        
    PHOOK_PTM_TABLE             PtHook;         
    PFUNC_EptViolationCallback  Callback;
} HOOK_PTM, *PHOOK_PTM;


#define PTM_HOOK_TABLE_SIZE             1024
#define PTM_HOOK_ID(addr)               (((addr) >> 12) & (PTM_HOOK_TABLE_SIZE - 1))
#define PTM_PAE_ROOT_HOOK_ID(addr)      (((addr) >>  5) & (PTM_HOOK_TABLE_SIZE - 1))


typedef struct _HOOK_PTM_STATE
{
    LIST_ENTRY          PtmHooks[PTM_HOOK_TABLE_SIZE];  
    LIST_ENTRY          RemovedPtmHooks;    
    LIST_ENTRY          RemovedPtHooks;     
    BOOLEAN             HooksRemoved;       
} HOOK_PTM_STATE, *PHOOK_PTM_STATE;


//
// API
//
INTSTATUS
IntHookPtmSetHook(
    _In_ QWORD Address,
    _In_ PFUNC_EptViolationCallback Callback,
    _In_ void *Context,
    _In_ void *ParentHook,
    _In_ DWORD Flags,
    _Out_opt_ PHOOK_PTM *Hook
    );

INTSTATUS
IntHookPtmRemoveHook(
    _Inout_ HOOK_PTM **Hook,
    _In_ DWORD Flags
    );

INTSTATUS
IntHookPtmDeleteHook(
    _In_ HOOK_PTM **Hook,
    _In_ DWORD Flags
    );

INTSTATUS
IntHookPtmCommitHooks(
    void
    );

INTSTATUS
IntHookPtmInit(
    void
    );

#endif // _HOOK_PTM_H_