|
Bitdefender Hypervisor Memory Introspection
|
#include "handlers.h"#include <stdint.h>#include <signal.h>#include <stddef.h>#include <stdbool.h>#include <errno.h>Go to the source code of this file.
Macros | |
| #define | __fn_aligned __attribute__((aligned(16))) |
| #define | __fn_save_all __attribute__((no_caller_saved_registers)) |
| #define | __section(S) __attribute__((section (S))) |
| #define | __default_fn_attr __fn_save_all __fn_aligned |
| #define | __fn_naked __attribute__((naked)) |
| #define | BIT(x) (1ULL << (x)) |
| #define | UNUSED_PARAMETER(P) ((void)(P)) |
| #define | PAGE_SIZE 0x1000 |
| #define | get_jump_back_offset(fn_name) |
| #define | get_detour_enable_offset(fn_name) |
| #define | GNUASM_DEFINE_STR(SYMBOL, STR) asm volatile ("#define " SYMBOL " " #STR); |
| #define | GNUASM_DEFINE_VAL(SYMBOL, VALUE) asm volatile ("#define " SYMBOL " %0" :: "n"(VALUE)) |
| #define | def_detour_asm_vars(fn_name) GNUASM_DEFINE_VAL(#fn_name "_jmp", get_jump_back_offset(fn_name)) |
| #define | def_detour_hijack_asm_vars(fn_name, hijack_fn_name) GNUASM_DEFINE_VAL(#fn_name "_" # hijack_fn_name "_jmp", get_jump_back_offset(fn_name ## _ ## hijack_fn_name)) |
| #define | def_detour_vars(fn_name) extern void *fn_name ## _trampoline; extern void *fn_name ## _reloc |
| #define | def_detour_hijack_vars(fn_name, fn_hijack_name) extern void *fn_name ## _ ## fn_hijack_name ## _trampoline; extern void *fn_name ## _ ## fn_hijack_name ## _reloc |
| #define | init_detour_field(fn_name) |
| #define | init_detour_hijack_field(fn_name, hijack_fn_name) |
| #define | __vmcall_param_1(param) register size_t __p1 asm("r8") = (size_t)(param); asm volatile("" :: "r" (__p1)); |
| #define | __vmcall_param_2(param) register size_t __p2 asm("r9") = (size_t)(param); asm volatile("" :: "r" (__p2)); |
| #define | __vmcall_param_3(param) register size_t __p3 asm("r10") = (size_t)(param); asm volatile("" :: "r" (__p3)); |
| #define | __vmcall_param_4(param) register size_t __p4 asm("r11") = (size_t)(param); asm volatile("" :: "r" (__p4)); |
| #define | __vmcall_param_5(param) register size_t __p5 asm("r12") = (size_t)(param); asm volatile("" :: "r" (__p5)); |
| #define | __vmcall_param_6(param) register size_t __p6 asm("r13") = (size_t)(param); asm volatile("" :: "r" (__p6)); |
| #define | __vmcall_param_7(param) register size_t __p7 asm("r14") = (size_t)(param); asm volatile("" :: "r" (__p7)); |
| #define | __vmcall_param_8(param) register size_t __p8 asm("r15") = (size_t)(param); asm volatile("" :: "r" (__p8)); |
| #define | vmcall_1(id, p1) |
| #define | vmcall_2(id, p1, p2) |
| #define | vmcall_3(id, p1, p2, p3) |
| #define | vmcall_4(id, p1, p2, p3, p4) |
| #define | vmcall_5(id, p1, p2, p3, p4, p5) |
| #define | vmcall_6(id, p1, p2, p3, p4, p5, p6) |
| #define __default_fn_attr __fn_save_all __fn_aligned |
| #define __fn_save_all __attribute__((no_caller_saved_registers)) |
| #define __vmcall_param_1 | ( | param | ) | register size_t __p1 asm("r8") = (size_t)(param); asm volatile("" :: "r" (__p1)); |
| #define __vmcall_param_2 | ( | param | ) | register size_t __p2 asm("r9") = (size_t)(param); asm volatile("" :: "r" (__p2)); |
| #define __vmcall_param_3 | ( | param | ) | register size_t __p3 asm("r10") = (size_t)(param); asm volatile("" :: "r" (__p3)); |
| #define __vmcall_param_4 | ( | param | ) | register size_t __p4 asm("r11") = (size_t)(param); asm volatile("" :: "r" (__p4)); |
| #define __vmcall_param_5 | ( | param | ) | register size_t __p5 asm("r12") = (size_t)(param); asm volatile("" :: "r" (__p5)); |
| #define __vmcall_param_6 | ( | param | ) | register size_t __p6 asm("r13") = (size_t)(param); asm volatile("" :: "r" (__p6)); |
| #define __vmcall_param_7 | ( | param | ) | register size_t __p7 asm("r14") = (size_t)(param); asm volatile("" :: "r" (__p7)); |
| #define __vmcall_param_8 | ( | param | ) | register size_t __p8 asm("r15") = (size_t)(param); asm volatile("" :: "r" (__p8)); |
| #define def_detour_asm_vars | ( | fn_name | ) | GNUASM_DEFINE_VAL(#fn_name "_jmp", get_jump_back_offset(fn_name)) |
Definition at line 45 of file common.h.
Referenced by __asm_defines().
| #define def_detour_hijack_asm_vars | ( | fn_name, | |
| hijack_fn_name | |||
| ) | GNUASM_DEFINE_VAL(#fn_name "_" # hijack_fn_name "_jmp", get_jump_back_offset(fn_name ## _ ## hijack_fn_name)) |
Definition at line 48 of file common.h.
Referenced by __asm_defines().
| #define def_detour_hijack_vars | ( | fn_name, | |
| fn_hijack_name | |||
| ) | extern void *fn_name ## _ ## fn_hijack_name ## _trampoline; extern void *fn_name ## _ ## fn_hijack_name ## _reloc |
| #define def_detour_vars | ( | fn_name | ) | extern void *fn_name ## _trampoline; extern void *fn_name ## _reloc |
| #define get_detour_enable_offset | ( | fn_name | ) |
| #define get_jump_back_offset | ( | fn_name | ) |
| #define GNUASM_DEFINE_STR | ( | SYMBOL, | |
| STR | |||
| ) | asm volatile ("#define " SYMBOL " " #STR); |
| #define GNUASM_DEFINE_VAL | ( | SYMBOL, | |
| VALUE | |||
| ) | asm volatile ("#define " SYMBOL " %0" :: "n"(VALUE)) |
| #define init_detour_field | ( | fn_name | ) |
| #define init_detour_hijack_field | ( | fn_name, | |
| hijack_fn_name | |||
| ) |
| #define vmcall_1 | ( | id, | |
| p1 | |||
| ) |
Definition at line 97 of file common.h.
Referenced by module_param_sysfs_remove(), and module_param_sysfs_setup().
| #define vmcall_2 | ( | id, | |
| p1, | |||
| p2 | |||
| ) |
Definition at line 104 of file common.h.
Referenced by __vma_link_rb(), arch_jump_label_transform(), arch_ptrace(), change_protection(), commit_creds(), do_exit(), do_munmap_rb_erase(), mprotect_fixup_vma_wants_writenotify(), process_vm_rw_core(), vma_adjust_rb_erase(), vma_rb_erase(), and wake_up_new_task().
| #define vmcall_3 | ( | id, | |
| p1, | |||
| p2, | |||
| p3 | |||
| ) |
Definition at line 112 of file common.h.
Referenced by complete_signal(), expand_downwards(), flush_old_exec(), ftrace_write(), and text_poke().
| #define vmcall_4 | ( | id, | |
| p1, | |||
| p2, | |||
| p3, | |||
| p4 | |||
| ) |
Definition at line 121 of file common.h.
Referenced by vma_adjust().
| #define vmcall_5 | ( | id, | |
| p1, | |||
| p2, | |||
| p3, | |||
| p4, | |||
| p5 | |||
| ) |
Definition at line 131 of file common.h.
Referenced by __access_remote_vm().