update_guests.c

Go to the documentation of this file.

/*
 * Copyright (c) 2020 Bitdefender
 * SPDX-License-Identifier: Apache-2.0
 */

#include "update_guests.h"
#include "winapi.h"
#include "guests.h"
#include "winprocess.h"
#include "lixprocess.h"

static CAMI_VERSION gCamiVersion = { 0 };

static const BYTE *gUpdateBuffer = NULL;

static DWORD gUpdateBufferSize = 0;

extern PATTERN_SIGNATURE *gSysenterSignatures;

extern DWORD gSysenterSignaturesCount;

extern PATTERN_SIGNATURE *gLinuxDistSigs;

extern DWORD gLinuxDistSigsCount;

extern INT_VERSION_INFO IntHviVersion;


#define IS_CAMI_FILEOFFSET_OK(FileOffset)   __likely((FileOffset) < gUpdateBufferSize)

#define IS_CAMI_FILEPOINTER_OK(FilePointer) __likely((const BYTE*)(FilePointer) >= (const BYTE*)gUpdateBuffer) && \
                                                    ((const BYTE*)(FilePointer) < (const BYTE*)gUpdateBuffer + \
                                                                                    gUpdateBufferSize)

#define IS_CAMI_STRUCTURE_OK(FilePointer)   __likely(IS_CAMI_FILEPOINTER_OK(FilePointer) && \
                                                     IS_CAMI_FILEPOINTER_OK(((const BYTE*)((FilePointer) + 1) - 1)))

#define IS_CAMI_ARRAY_OK(StartPointer, Count)   __likely(IS_CAMI_FILEPOINTER_OK(StartPointer) && \
                                                        ((Count) < CAMI_MAX_ENTRY_COUNT) && \
                                                        (((DWORD)(Count) == 0) || \
                                                        (IS_CAMI_FILEPOINTER_OK((const BYTE*)((StartPointer) + \
                                                                                    (DWORD)(Count)) - 1))))

#define GET_CAMI_STRUCT(Type, Offset)           ((Type)(const void *)((const BYTE*)gUpdateBuffer + (DWORD)(Offset)))

typedef struct _CAMI_STRUCTURE
{
    DWORD   StructureTag;

    size_t  Offset;

    DWORD   MembersCount;
} CAMI_STRUCTURE;

typedef struct _CAMI_PROCESS_PROTECTION_INFO
{
    struct
    {
        union
        {
            WCHAR    Name16[32];        
            CHAR     Name8[64];         
        };

        CAMI_STRING_ENCODING Encoding;  
    } Name;                             

    CAMI_PROT_OPTIONS   Options;        
} CAMI_PROCESS_PROTECTION_INFO, *PCAMI_PROCESS_PROTECTION_INFO;

typedef struct _CAMI_PROCESS_PROTECTION_DATA
{
    DWORD                           Count;  
    CAMI_PROCESS_PROTECTION_INFO    *Items; 
} CAMI_PROCESS_PROTECTION_DATA, *PCAMI_PROCESS_PROTECTION_DATA;


static CAMI_PROCESS_PROTECTION_DATA gCamiProcessProtectionData;

static const CAMI_STRUCTURE gLinuxStructures[lixStructureEnd] =
{
    {.StructureTag = lixStructureInfo,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Info),
     .MembersCount = lixFieldInfoEnd},

    {.StructureTag = lixStructureModule,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Module),
     .MembersCount = lixFieldModuleEnd},

    {.StructureTag = lixStructureBinprm,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Binprm),
     .MembersCount = lixFieldBinprmEnd},

    {.StructureTag = lixStructureVma,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Vma),
     .MembersCount = lixFieldVmaEnd},

    {.StructureTag = lixStructureDentry,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Dentry),
     .MembersCount = lixFieldDentryEnd},

    {.StructureTag = lixStructureMmStruct,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.MmStruct),
     .MembersCount = lixFieldMmStructEnd},

    {.StructureTag = lixStructureTaskStruct,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.TaskStruct),
     .MembersCount = lixFieldTaskStructEnd},

    {.StructureTag = lixStructureFs,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Fs),
     .MembersCount = lixFieldFsEnd},

    {.StructureTag = lixStructureFdTable,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.FdTable),
     .MembersCount = lixFieldFdTableEnd},

    {.StructureTag = lixStructureFiles,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Files),
     .MembersCount = lixFieldFilesEnd},

    {.StructureTag = lixStructureInode,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Inode),
     .MembersCount = lixFieldInodeEnd},

    {.StructureTag = lixStructureSocket,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Socket),
     .MembersCount = lixFieldSocketEnd},

    {.StructureTag = lixStructureSock,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Sock),
     .MembersCount = lixFieldSockEnd},

    {.StructureTag = lixStructureCred,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Cred),
     .MembersCount = lixFieldCredEnd},

    {.StructureTag = lixStructureNsProxy,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.NsProxy),
     .MembersCount = lixFieldNsProxyEnd},

    {.StructureTag = lixStructureUngrouped,
     .Offset = OFFSET_OF(LINUX_GUEST, OsSpecificFields.OpaqueFields.Ungrouped),
     .MembersCount = lixFieldUngroupedEnd},
};

static const CAMI_STRUCTURE gWinKmStructures[winKmStructureEnd] =
{
    {.StructureTag = winKmStructureProcess,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.Process),
     .MembersCount = winKmFieldProcessEnd},

    {.StructureTag = winKmStructureThread,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.Thread),
     .MembersCount = winKmFieldThreadEnd},

    {.StructureTag = winKmStructureDrvObj,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.DrvObj),
     .MembersCount = winKmFieldDrvObjEnd},

    {.StructureTag = winKmStructurePcr,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.Pcr),
     .MembersCount = winKmFieldPcrEnd},

    {.StructureTag = winKmStructurePoolDescriptor,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.PoolDescriptor),
     .MembersCount = winKmFieldPoolDescriptorEnd},

    {.StructureTag = winKmStructureMmpfn,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.Mmpfn),
     .MembersCount = winKmFieldMmpfnEnd},

    {.StructureTag = winKmStructureToken,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.Token),
     .MembersCount = winKmFieldTokenEnd},

    {.StructureTag = winKmStructureUngrouped,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.Ungrouped),
     .MembersCount = winKmFieldUngroupedEnd},

    {.StructureTag = winKmStructureEprocessFlags,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.EprocessFlags),
     .MembersCount = winKmFieldEprocessFlagsEnd},

    {.StructureTag = winKmStructureVadShort,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.VadShort),
     .MembersCount = winKmFieldVadShortEnd},

    {.StructureTag = winKmStructureVadLong,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.VadLong),
     .MembersCount = winKmFieldVadLongEnd},

    {.StructureTag = winKmStructureVadFlags,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.VadFlags),
     .MembersCount = winKmFieldVadFlagsEnd},

    {.StructureTag = winKmStructureSyscallNumbers,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.SyscallNumbers),
     .MembersCount = winKmFieldSyscallNumbersEnd},

    {.StructureTag = winKmStructureFileObject,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Km.FileObject),
     .MembersCount = winKmFieldFileObjectEnd},
};

static const CAMI_STRUCTURE gWinUmStructures[winUmStructureEnd] =
{
    {.StructureTag = winUmStructureDll,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Um.Dll),
     .MembersCount = winUmFieldDllEnd },

    {.StructureTag = winUmStructurePeb,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Um.Peb),
     .MembersCount = winUmFieldPebEnd },

    {.StructureTag = winUmStructureTeb,
     .Offset = OFFSET_OF(WINDOWS_GUEST, OsSpecificFields.Um.Teb),
     .MembersCount = winUmFieldTebEnd },
};


static BOOLEAN
IntCamiCheckIntroVersion(
    _In_ QWORD MinIntroVersion,
    _In_ QWORD MaxIntroVersion
    )
{
    INT_VERSION_INFO minVer, maxVer;

    minVer.Raw = MinIntroVersion;
    maxVer.Raw = MaxIntroVersion;

    // Make sure we don't compare build numbers.
    minVer.VersionInfo.Build = 0;
    maxVer.VersionInfo.Build = WORD_MAX;

    return IntHviVersion.Raw >= minVer.Raw && IntHviVersion.Raw <= maxVer.Raw;
}


static const CAMI_SECTION_HEADER *
IntCamiFindSectionHeaderByHint(
    _In_ const CAMI_HEADER *CamiHeader,
    _In_ DWORD SectionHint
    )
{
    const CAMI_SECTION_HEADER *pHeaders;

    pHeaders = GET_CAMI_STRUCT(const CAMI_SECTION_HEADER *, CamiHeader->PointerToSectionsHeaders);
    if (!IS_CAMI_ARRAY_OK(pHeaders, CamiHeader->NumberOfSections))
    {
        ERROR("[ERROR] Sections table entries are outside the update buffer!\n");
        return NULL;
    }

    for (DWORD i = 0; i < CamiHeader->NumberOfSections; i++)
    {
        if ((pHeaders[i].Hint & SectionHint) == SectionHint)
        {
            return (pHeaders + i);
        }
    }

    return NULL;
}


static INTSTATUS
IntCamiLoadOpaqueFields(
    _In_ const CAMI_OPAQUE_STRUCTURE *CamiStructures,
    _In_ const CAMI_STRUCTURE *ToLoad,
    _In_ DWORD Count,
    _In_ INTRO_GUEST_TYPE OsType
    )
{
    char *pBasePtr = NULL;

    switch (OsType)
    {
    case introGuestLinux:
        pBasePtr = (char *)gLixGuest;
        break;

    case introGuestWindows:
        pBasePtr = (char *)gWinGuest;
        break;

    default:
        return INT_STATUS_INVALID_PARAMETER_4;
    }

    for (DWORD iStruct = 0; iStruct < Count; iStruct++)
    {
        const DWORD *pFields;

        if (CamiStructures->MembersCount < ToLoad->MembersCount)
        {
            ERROR("[ERROR] For structure %d we need at least %d fields, got only %d\n",
                  iStruct, ToLoad->MembersCount, CamiStructures->MembersCount);
            return INT_STATUS_NOT_SUPPORTED;
        }

        pFields = GET_CAMI_STRUCT(const DWORD *, CamiStructures->Members);
        if (!IS_CAMI_ARRAY_OK(pFields, CamiStructures->MembersCount))
        {
            ERROR("[ERROR] Members for structure %d are outside the update buffer!\n", iStruct);
            return INT_STATUS_INVALID_DATA_SIZE;
        }

        memcpy(pBasePtr + ToLoad->Offset, pFields, sizeof(DWORD) * ToLoad->MembersCount);

        CamiStructures++;
        ToLoad++;
    }

    return INT_STATUS_SUCCESS;

}


static INTSTATUS
IntCamiLoadPatternSignatures(
    _In_ const CAMI_SECTION_HEADER *SectionHeader,
    _Out_ PATTERN_SIGNATURE **PatternSignatures,
    _Out_ DWORD *PatternSignaturesCount
    )
{
    const CAMI_PATTERN_SIGNATURE *pCamiSignatures;

    pCamiSignatures = GET_CAMI_STRUCT(const CAMI_PATTERN_SIGNATURE *, SectionHeader->DescriptorTable);
    if (!IS_CAMI_ARRAY_OK(pCamiSignatures, SectionHeader->EntryCount))
    {
        LOG("[ERROR] Pattern signature descriptors are outside the update buffer!");
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    if (SectionHeader->EntryCount == 0)
    {
        ERROR("[ERROR] Invalid entry count for the pattern signature array: %u\n", SectionHeader->EntryCount);
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    *PatternSignatures = HpAllocWithTag(sizeof(PATTERN_SIGNATURE) * SectionHeader->EntryCount, IC_TAG_CAMI);
    if (NULL == *PatternSignatures)
    {
        return INT_STATUS_INSUFFICIENT_RESOURCES;
    }

    *PatternSignaturesCount = 0;

    for (DWORD i = 0; i < SectionHeader->EntryCount; i++)
    {
        const CAMI_PATTERN_SIGNATURE *pCamiPat;
        PPATTERN_SIGNATURE pPat;
        const WORD *pPatternHash;

        pCamiPat = pCamiSignatures + i;
        pPat = *PatternSignatures + i;

        pPatternHash = GET_CAMI_STRUCT(const WORD *, pCamiPat->PatternOffset);
        if (!IS_CAMI_ARRAY_OK(pPatternHash, pCamiPat->PatternLength))
        {
            ERROR("[ERROR] Hash for signature %d is outside the update buffer!\n", i);

            HpFreeAndNullWithTag(PatternSignatures, IC_TAG_CAMI);
            return INT_STATUS_INVALID_DATA_SIZE;
        }

        pPat->SignatureId = pCamiPat->SignatureId;
        pPat->Offset = pCamiPat->Offset;
        pPat->Length = MIN(pCamiPat->PatternLength, ARRAYSIZE(pPat->Pattern));

        memcpy(pPat->Pattern, pPatternHash, pPat->Length * sizeof(pPat->Pattern[0]));
    }

    *PatternSignaturesCount = SectionHeader->EntryCount;

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntCamiLoadSyscalls(
    _In_ const CAMI_HEADER *CamiHeader
    )
{
    const CAMI_SECTION_HEADER *pSec;

    pSec = IntCamiFindSectionHeaderByHint(CamiHeader, CAMI_SECTION_HINT_SYSCALLS);
    if (NULL == pSec)
    {
        ERROR("[ERROR] Failed to find syscalls section header\n");
        return INT_STATUS_NOT_FOUND;
    }

    return IntCamiLoadPatternSignatures(pSec, &gSysenterSignatures, &gSysenterSignaturesCount);
}


static INTSTATUS
IntCamiLoadLixDistSigs(
    _In_ const CAMI_HEADER *CamiHeader
    )
{
    const CAMI_SECTION_HEADER *pSec;

    pSec = IntCamiFindSectionHeaderByHint(CamiHeader, CAMI_SECTION_HINT_LINUX | CAMI_SECTION_HINT_DIST_SIG);
    if (NULL == pSec)
    {
        ERROR("[ERROR] Failed to find syscalls section header\n");
        return INT_STATUS_NOT_FOUND;
    }

    return IntCamiLoadPatternSignatures(pSec, &gLinuxDistSigs, &gLinuxDistSigsCount);
}


static void
IntCamiUpdateProtOptions(
    _In_ const CAMI_PROT_OPTIONS *Src,
    _Inout_ INTRO_PROT_OPTIONS *Dst
    )
{
    if (Dst->ForceOff != Src->ForceOff)
    {
        LOG("[CAMI] New force off options: 0x%016llx\n", Src->ForceOff);
    }

    Dst->ForceOff = Src->ForceOff;

    if (Dst->Beta != Src->ForceBeta)
    {
        LOG("[CAMI] New force beta options: 0x%016llx\n", Src->ForceBeta);
    }

    Dst->Beta = Src->ForceBeta;

    if (Dst->Feedback != Src->ForceFeedback)
    {
        LOG("[CAMI] New force feedback options: 0x%016llx\n", Src->ForceFeedback);
    }

    Dst->Feedback = Src->ForceFeedback;
}


static INTSTATUS
IntCamiSetCoreOptions(
    _In_ const CAMI_PROT_OPTIONS *Options
    )
{
    LOG("[CAMI] Will set new core options!\n");

    IntCamiUpdateProtOptions(Options, &gGuest.CoreOptions);

    IntGuestUpdateCoreOptions(gGuest.CoreOptions.Original);

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntCamiSetShemuOptions(
    _In_ const CAMI_PROT_OPTIONS *Options
    )
{
    LOG("[CAMI] Will set new shemu options!\n");

    IntCamiUpdateProtOptions(Options, &gGuest.ShemuOptions);

    IntGuestUpdateShemuOptions(gGuest.ShemuOptions.Original);

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntCamiUpdateProcessProtectionInfoLix(
    _In_ LIX_PROTECTED_PROCESS *ProtectedProcess
    )
{
    for (DWORD index = 0; index < gCamiProcessProtectionData.Count; index++)
    {
        BOOLEAN match = FALSE;
        if (gCamiProcessProtectionData.Items[index].Name.Encoding != CAMI_STRING_ENCODING_UTF8)
        {
            WARNING("[WARNING] Unsupported process name encoding: %d. Will skip...\n",
                    gCamiProcessProtectionData.Items[index].Name.Encoding);
        }
        else
        {
            if (IntMatchPatternUtf8(gCamiProcessProtectionData.Items[index].Name.Name8,
                                    ProtectedProcess->CommPattern,
                                    0))
            {
                match = TRUE;
            }
        }

        if (match)
        {
            ProtectedProcess->Protection.Current =
                ProtectedProcess->Protection.Original & ~(gCamiProcessProtectionData.Items[index].Options.ForceOff);
            ProtectedProcess->Protection.Beta = gCamiProcessProtectionData.Items[index].Options.ForceBeta;
            ProtectedProcess->Protection.Feedback = gCamiProcessProtectionData.Items[index].Options.ForceFeedback;

            TRACE("[CAMI] Protection options for '%s': %llx %llx %llx", ProtectedProcess->CommPattern,
                  ProtectedProcess->Protection.Current, ProtectedProcess->Protection.Beta,
                  ProtectedProcess->Protection.Feedback);
        }
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntCamiUpdateProcessProtectionInfoWin(
    _In_ PROTECTED_PROCESS_INFO *ProtectedProcess
    )
{
    for (DWORD index = 0; index < gCamiProcessProtectionData.Count; index++)
    {
        BOOLEAN match = FALSE;
        switch (gCamiProcessProtectionData.Items[index].Name.Encoding)
        {
        case CAMI_STRING_ENCODING_UTF16:
        {
            if (IntMatchPatternUtf16(gCamiProcessProtectionData.Items[index].Name.Name16,
                                     ProtectedProcess->FullNamePattern,
                                     0))
            {
                match = TRUE;
            }
            break;
        }
        case CAMI_STRING_ENCODING_UTF8:
        {
            if (IntMatchPatternUtf8(gCamiProcessProtectionData.Items[index].Name.Name8,
                                    ProtectedProcess->ImageBaseNamePattern,
                                    0))
            {
                match = TRUE;
            }
            break;
        }
        default:
        {
            WARNING("[WARNING] Unsupported process name encoding: %d. Will skip...\n",
                    gCamiProcessProtectionData.Items[index].Name.Encoding);
        }
        }

        if (match)
        {
            ProtectedProcess->Protection.Current =
                ProtectedProcess->Protection.Original & ~(gCamiProcessProtectionData.Items[index].Options.ForceOff);
            ProtectedProcess->Protection.Beta = gCamiProcessProtectionData.Items[index].Options.ForceBeta;
            ProtectedProcess->Protection.Feedback = gCamiProcessProtectionData.Items[index].Options.ForceFeedback;

            TRACE("[CAMI] Protection options for '%s': %x %llx %llx", ProtectedProcess->ImageBaseNamePattern,
                  ProtectedProcess->Protection.Current, ProtectedProcess->Protection.Beta,
                  ProtectedProcess->Protection.Feedback);

        }
    }

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntCamiUpdateProcessProtectionInfo(
    _In_ void *ProtectedProcess
    )
{
    if (gGuest.OSType == introGuestWindows)
    {
        return IntCamiUpdateProcessProtectionInfoWin(ProtectedProcess);
    }
    else if (gGuest.OSType == introGuestLinux)
    {
        return IntCamiUpdateProcessProtectionInfoLix(ProtectedProcess);
    }

    return INT_STATUS_NOT_SUPPORTED;
}


void
IntCamiUpdateProcessProtectionItems(
    _In_ void *Name,
    _In_ CAMI_STRING_ENCODING Encoding,
    _In_ CAMI_PROT_OPTIONS *Options
    )
{
    if (gGuest.OSType == introGuestWindows)
    {
        IntWinProcUpdateProtectedProcess(Name, Encoding, Options);
    }
    else if (gGuest.OSType == introGuestLinux)
    {
        IntLixProcUpdateProtectedProcess(Name, Encoding, Options);
    }
}


static INTSTATUS
IntCamiSetProcProtOptions(
    _In_ const CAMI_PROC_PROT_OPTIONS *Table,
    _In_ DWORD TableCount
    )
{
    for (DWORD index = 0; index < TableCount; index++)
    {
        const CAMI_PROT_OPTIONS *pOptions = GET_CAMI_STRUCT(const CAMI_PROT_OPTIONS *, Table[index].OptionsOffset);
        if (!IS_CAMI_STRUCTURE_OK(pOptions))
        {
            ERROR("[ERROR] CAMI_PROT_OPTIONS struct is invalid! (%p)", pOptions);
            return INT_STATUS_INVALID_DATA_TYPE;
        }

        memcpy(gCamiProcessProtectionData.Items[index].Name.Name8, Table[index].Name8, 64);
        gCamiProcessProtectionData.Items[index].Name.Encoding = Table[index].Encoding;
        gCamiProcessProtectionData.Items[index].Options = *pOptions;

        TRACE("[CAMI] NameHash : %s -> ForceOff : 0x%llx, ForceBeta: 0x%llx, ForceFeedback: 0x%llx",
              Table[index].Name8, pOptions->ForceOff, pOptions->ForceBeta, pOptions->ForceFeedback);

        IntCamiUpdateProcessProtectionItems(gCamiProcessProtectionData.Items[index].Name.Name8,
                                            gCamiProcessProtectionData.Items[index].Name.Encoding,
                                            &gCamiProcessProtectionData.Items[index].Options);
    }

    if (gGuest.OSType == introGuestWindows)
    {
        IntWinProcUpdateProtection();
    }
    else if (gGuest.OSType == introGuestLinux)
    {
        IntLixTaskUpdateProtection();
    }
    else
    {
        return INT_STATUS_NOT_SUPPORTED;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntCamiResetCoreOptions(
    void
    )
{
    const CAMI_PROT_OPTIONS defaultOpts = {0};

    return IntCamiSetCoreOptions(&defaultOpts);
}


static INTSTATUS
IntCamiResetShemuOptions(
    void
    )
{
    const CAMI_PROT_OPTIONS defaultOpts = {0};

    return IntCamiSetShemuOptions(&defaultOpts);
}


static INTSTATUS
IntCamiLoadOsOptions(
    _In_ DWORD OptionsFileOffset
    )
{
    INTSTATUS status;
    const CAMI_CUSTOM_OS_PROTECTION *pOsProt;

    if (0 == OptionsFileOffset)
    {
        IntCamiResetCoreOptions();
        IntCamiResetShemuOptions();

        return INT_STATUS_SUCCESS;
    }

    if (!IS_CAMI_FILEOFFSET_OK(OptionsFileOffset))
    {
        ERROR("[ERROR] Invalid file offset: %d / %d\n", OptionsFileOffset, gUpdateBufferSize);
        return INT_STATUS_INVALID_DATA_TYPE;
    }

    pOsProt = GET_CAMI_STRUCT(const CAMI_CUSTOM_OS_PROTECTION *, OptionsFileOffset);

    if (!IS_CAMI_FILEOFFSET_OK(pOsProt->CoreOptionsOffset))
    {
        ERROR("[ERROR] Invalid CoreOptionsOffset: 0x%x / %08x\n", pOsProt->CoreOptionsOffset, gUpdateBufferSize);
        return INT_STATUS_INVALID_DATA_TYPE;
    }

    if (!IS_CAMI_FILEOFFSET_OK(pOsProt->ShemuOptionsOffset))
    {
        ERROR("[ERROR] Invalid ShemuOptionsOffset: 0x%x / %08x\n", pOsProt->ShemuOptionsOffset, gUpdateBufferSize);
        return INT_STATUS_INVALID_DATA_TYPE;
    }

    if (pOsProt->ProcOptionsCount > 0)
    {
        const CAMI_PROC_PROT_OPTIONS *pProcProt = GET_CAMI_STRUCT(const CAMI_PROC_PROT_OPTIONS *,
                                                                  pOsProt->ProcOptionsTable);
        if (!IS_CAMI_ARRAY_OK(pProcProt, pOsProt->ProcOptionsCount))
        {
            ERROR("[ERROR] Invalid ProcOptionsTable : 0x%0x / %08x.\n", pOsProt->ProcOptionsTable, gUpdateBufferSize);
            return INT_STATUS_INVALID_DATA_TYPE;
        }

        IntCamiProtectedProcessFree();

        status = IntCamiProtectedProcessAllocate(pOsProt->ProcOptionsCount);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntCamiProtectedProcessAllocate failed with status: 0x%08x.", status);
            return status;
        }

        status = IntCamiSetProcProtOptions(pProcProt, pOsProt->ProcOptionsCount);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntCamiSetProcProtOptions failed with status: 0x%08x.\n", status);
            return status;
        }
    }

    status = IntCamiSetCoreOptions(GET_CAMI_STRUCT(const CAMI_PROT_OPTIONS *, pOsProt->CoreOptionsOffset));
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntCamiSetCoreOptions failed with status: 0x%08x.\n", status);
        return status;
    }

    status = IntCamiSetShemuOptions(GET_CAMI_STRUCT(const CAMI_PROT_OPTIONS *, pOsProt->ShemuOptionsOffset));
    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] IntCamiSetShemuOptions failed with status: 0x%08x.\n", status);
        return status;
    }

    return INT_STATUS_SUCCESS;
}


static INTSTATUS
IntCamiLoadLinux(
    _In_ const CAMI_HEADER *CamiHeader
    )
{
    const CAMI_SECTION_HEADER *pSec;
    const CAMI_LIX_DESCRIPTOR *pLixOsList;
    INTSTATUS status;

    pSec = IntCamiFindSectionHeaderByHint(CamiHeader, CAMI_SECTION_HINT_SUPPORTED_OS | CAMI_SECTION_HINT_LINUX);
    if (NULL == pSec)
    {
        ERROR("[ERROR] Failed to find Linux section header\n");
        return INT_STATUS_NOT_FOUND;
    }

    pLixOsList = GET_CAMI_STRUCT(const CAMI_LIX_DESCRIPTOR *, pSec->DescriptorTable);
    if (!IS_CAMI_ARRAY_OK(pLixOsList, pSec->EntryCount))
    {
        ERROR("[ERROR] Linux supported OS descriptors are outside the update buffer!");
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    for (DWORD i = 0; i < pSec->EntryCount; i++)
    {
        const CAMI_LIX_DESCRIPTOR *pLix;
        const CAMI_LIX_HOOK *pHooks;
        const CAMI_OPAQUE_STRUCTURE *pStructures;

        pLix = pLixOsList + i;

        if (!glob_match_numeric_utf8(pLix->VersionString, gLixGuest->VersionString))
        {
            continue;
        }

        if (!IntCamiCheckIntroVersion(pLix->MinIntroVersion, pLix->MaxIntroVersion))
        {
            LOG("[WARNING] This OS is no longer supported by introcore!\n");
            continue;
        }

        if (lixStructureEnd > pLix->StructuresCount)
        {
            ERROR("[ERROR] Expected %d fields, got %d.", lixStructureEnd, pLix->StructuresCount);
            return INT_STATUS_NOT_SUPPORTED;
        }

        if (pLix->HooksCount > LIX_MAX_HOOKED_FN_COUNT || pLix->HooksCount == 0)
        {
            ERROR("[ERROR] Unsupported number of hooks! Got %d, expected a max of %d!\n",
                  pLix->HooksCount, LIX_MAX_HOOKED_FN_COUNT);
            return INT_STATUS_NOT_SUPPORTED;
        }

        pStructures = GET_CAMI_STRUCT(const CAMI_OPAQUE_STRUCTURE *, pLix->StructuresTable);
        if (!IS_CAMI_ARRAY_OK(pStructures, pLix->StructuresCount))
        {
            ERROR("[ERROR] Fields for OS %s are outside the update buffer.", pLix->VersionString);
            return INT_STATUS_INVALID_DATA_SIZE;
        }

        pHooks = GET_CAMI_STRUCT(const CAMI_LIX_HOOK *, pLix->HooksTable);
        if (!IS_CAMI_ARRAY_OK(pHooks, pLix->HooksCount))
        {
            ERROR("[ERROR] Hooks for OS %s are outside the update buffer.", pLix->VersionString);
            return INT_STATUS_INVALID_DATA_SIZE;
        }

        status = IntCamiLoadOsOptions(pLix->CustomProtectionOffset);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to load introcore options for this OS. Status: 0x%08x\n", status);
            // Shall we bail out?
        }

        status = IntCamiLoadOpaqueFields(pStructures, gLinuxStructures, lixStructureEnd, introGuestLinux);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntCamiLoadOpaqueFields failed for linux fields. Status: 0x%08x\n", status);
            return status;
        }

        ASSERT(NULL == gLixGuest->OsSpecificFields.Functions);

        gLixGuest->OsSpecificFields.Functions =
            HpAllocWithTag(pLix->HooksCount * sizeof(gLixGuest->OsSpecificFields.Functions[0]), IC_TAG_CAMI);

        if (NULL == gLixGuest->OsSpecificFields.Functions)
        {
            return INT_STATUS_INSUFFICIENT_RESOURCES;
        }

        for (DWORD j = 0; j < pLix->HooksCount; j++)
        {
            LIX_FUNCTION *pFun = &gLixGuest->OsSpecificFields.Functions[j];

            pFun->NameHash = pHooks[j].NameHash;
            pFun->SkipOnBoot = pHooks[j].SkipOnBoot;
            pFun->HookHandler = pHooks[j].HookHandler;
        }

        gLixGuest->OsSpecificFields.FunctionsCount = pLix->HooksCount;

        return INT_STATUS_SUCCESS;
    }

    return INT_STATUS_NOT_SUPPORTED;
}


static INTSTATUS
IntCamiLoadWindows(
    _In_ const CAMI_HEADER *CamiHeader
    )
{
    const CAMI_SECTION_HEADER *pSec;
    const CAMI_WIN_DESCRIPTOR *pWinOsList;
    INTSTATUS status;

    pSec = IntCamiFindSectionHeaderByHint(CamiHeader, CAMI_SECTION_HINT_SUPPORTED_OS | CAMI_SECTION_HINT_WINDOWS);
    if (NULL == pSec)
    {
        ERROR("[ERROR] Failed to find Windows section header\n");
        return INT_STATUS_NOT_FOUND;
    }

    pWinOsList = GET_CAMI_STRUCT(const CAMI_WIN_DESCRIPTOR *, pSec->DescriptorTable);
    if (!IS_CAMI_ARRAY_OK(pWinOsList, pSec->EntryCount))
    {
        ERROR("[ERROR] Windows supported OS descriptors are outside the update buffer!");
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    for (DWORD i = 0; i < pSec->EntryCount; i++)
    {
        const CAMI_WIN_DESCRIPTOR *pWin;
        const CAMI_OPAQUE_STRUCTURE *pKmStructures, *pUmStructures;
        const CAMI_WIN_FUNCTION *pFunTable;
        const CAMI_WIN_VERSION_STRING *pCamiVersionString;

        pWin = pWinOsList + i;

        if (gGuest.OSVersion != pWin->BuildNumber ||
            gGuest.Guest64 != pWin->Is64 ||
            gGuest.KptiInstalled != pWin->Kpti)
        {
            continue;
        }

        if (!IntCamiCheckIntroVersion(pWin->MinIntroVersion, pWin->MaxIntroVersion))
        {
            LOG("[WARNING] This OS is no longer supported by introcore!\n");
            continue;
        }

        pFunTable = GET_CAMI_STRUCT(const CAMI_WIN_FUNCTION *, pWin->FunctionTable);
        if (!IS_CAMI_ARRAY_OK(pFunTable, pWin->FunctionCount))
        {
            ERROR("[ERROR] Functions for OS %d KPTI %d is64 %d are outside the update buffer. ",
                  pWin->BuildNumber, pWin->Kpti, pWin->Is64);
            return INT_STATUS_INVALID_DATA_SIZE;
        }

        pKmStructures = GET_CAMI_STRUCT(const CAMI_OPAQUE_STRUCTURE *, pWin->KmStructuresTable);
        if (!IS_CAMI_ARRAY_OK(pKmStructures, pWin->KmStructuresCount))
        {
            ERROR("[ERROR] Km Structures for OS %d KPTI %d is64 %d are outside the update buffer. \n",
                  pWin->BuildNumber, pWin->Kpti, pWin->Is64);
            return INT_STATUS_INVALID_DATA_SIZE;
        }

        pCamiVersionString = GET_CAMI_STRUCT(const CAMI_WIN_VERSION_STRING *, pWin->VersionStringOffset);
        if (!IS_CAMI_STRUCTURE_OK(pCamiVersionString))
        {
            ERROR("[ERROR] CAMI_WIN_VERSION_STRING struct is invalid! (%p)", pCamiVersionString);
            return INT_STATUS_INVALID_DATA_TYPE;
        }

        if (pCamiVersionString->VersionStringSize > MAX_VERSION_STRING_SIZE ||
            pCamiVersionString->VersionStringSize == 0)
        {
            ERROR("[ERROR] VersionString size is too big (%llx)\n", pCamiVersionString->VersionStringSize);
            return INT_STATUS_INVALID_DATA_SIZE;
        }

        gWinGuest->VersionString = HpAllocWithTag(pCamiVersionString->VersionStringSize, IC_TAG_NAME);
        if (NULL == gWinGuest->VersionString)
        {
            return INT_STATUS_INSUFFICIENT_RESOURCES;
        }

        strlcpy(gWinGuest->VersionString, pCamiVersionString->VersionString, pCamiVersionString->VersionStringSize);

        if (pCamiVersionString->ServerVersionStringSize > MAX_VERSION_STRING_SIZE ||
            pCamiVersionString->ServerVersionStringSize == 0)
        {
            ERROR("[ERROR] VersionString size is too big (%llx)\n", pCamiVersionString->ServerVersionStringSize);
            return INT_STATUS_INVALID_DATA_SIZE;
        }

        gWinGuest->ServerVersionString = HpAllocWithTag(pCamiVersionString->ServerVersionStringSize, IC_TAG_NAME);
        if (NULL == gWinGuest->ServerVersionString)
        {
            return INT_STATUS_INSUFFICIENT_RESOURCES;
        }

        strlcpy(gWinGuest->ServerVersionString, pCamiVersionString->ServerVersionString,
                pCamiVersionString->ServerVersionStringSize);

        pUmStructures = GET_CAMI_STRUCT(const CAMI_OPAQUE_STRUCTURE *, pWin->UmStructuresTable);
        if (!IS_CAMI_ARRAY_OK(pUmStructures, pWin->UmStructuresCount))
        {
            ERROR("[ERROR] Um Structures for OS %d KPTI %d is64 %d are outside the update buffer. \n",
                  pWin->BuildNumber, pWin->Kpti, pWin->Is64);
            return INT_STATUS_INVALID_DATA_STATE;
        }

        if (winKmStructureEnd > pWin->KmStructuresCount)
        {
            ERROR("[ERROR] Expected %d structures, got %d.", winKmStructureEnd, pWin->KmStructuresCount);
            return INT_STATUS_NOT_SUPPORTED;
        }

        if (winUmStructureEnd > pWin->UmStructuresCount)
        {
            ERROR("[ERROR] Expected %d structures, got %d.", winUmStructureEnd, pWin->UmStructuresCount);
            return INT_STATUS_NOT_SUPPORTED;
        }

        status = IntCamiLoadOsOptions(pWin->CustomProtectionOffset);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to load introcore options for this OS. Status: 0x%08x\n", status);
            // Shall we bail out?
        }

        status = IntCamiLoadOpaqueFields(pKmStructures, gWinKmStructures, winKmStructureEnd, introGuestWindows);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntCamiLoadOpaqueFields failed for win km structures: 0x%08x\n", status);
            return status;
        }

        status = IntCamiLoadOpaqueFields(pUmStructures, gWinUmStructures, winUmStructureEnd, introGuestWindows);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] IntCamiLoadOpaqueFields failed for win um structures: 0x%08x\n", status);
            return status;
        }

        for (DWORD j = 0; j < pWin->FunctionCount; j++)
        {
            PWIN_UNEXPORTED_FUNCTION pWf;
            const CAMI_WIN_FUNCTION_PATTERN *pPatterns;
            const DWORD *pArgs;

            pPatterns = GET_CAMI_STRUCT(const CAMI_WIN_FUNCTION_PATTERN *, pFunTable[j].PatternsTable);
            if (!IS_CAMI_ARRAY_OK(pPatterns, pFunTable[j].PatternsCount))
            {
                ERROR("[ERROR] Function %d has patterns outside the update buffer. \n", j);
                return INT_STATUS_INVALID_DATA_STATE;
            }

            pArgs = GET_CAMI_STRUCT(const DWORD *, pFunTable[j].ArgumentsTable);
            if (!IS_CAMI_ARRAY_OK(pArgs, pFunTable[j].ArgumentsCount))
            {
                ERROR("[ERROR] Function %d has arguments outside the update buffer. Will skip!\n", j);
                continue;
            }

            pWf = HpAllocWithTag(sizeof(*pWf) + pFunTable[j].PatternsCount * sizeof(pWf->Patterns[0]), IC_TAG_CAMI);
            if (NULL == pWf)
            {
                // Bail out if we ran out of memory, we won't be able to
                // load the rest anyway and we'll basically be useless
                // without function hooks...
                return INT_STATUS_INSUFFICIENT_RESOURCES;
            }

            for (DWORD k = 0; k < pFunTable[j].PatternsCount; k++)
            {
                const WORD *pPatHash;

                pPatHash = GET_CAMI_STRUCT(const WORD *, pPatterns[k].HashOffset);
                if (!IS_CAMI_ARRAY_OK(pPatHash, pPatterns[k].HashLength))
                {
                    ERROR("[ERROR] Hash for pattern %d of function %d spills outside the update buffer. Will skip!",
                          k, j);
                    HpFreeAndNullWithTag(&pWf, IC_TAG_CAMI);
                    return INT_STATUS_INVALID_DATA_STATE;
                }

                memcpy(pWf->Patterns[k].SectionHint, pPatterns[k].SectionHint, 8);

                pWf->Patterns[k].Signature.Length = MIN(SIG_MAX_PATTERN, pPatterns[k].HashLength);
                memcpy(pWf->Patterns[k].Signature.Pattern, pPatHash, 2ull * pWf->Patterns[k].Signature.Length);
            }

            pWf->NameHash = pFunTable[j].NameHash;
            pWf->PatternsCount = pFunTable[j].PatternsCount;

            status = IntWinApiUpdateHookDescriptor(pWf, pFunTable[j].ArgumentsCount, pArgs);
            if (!INT_SUCCESS(status))
            {
                WARNING("[WARNING] Failed to add function %d %x to a hook descriptor: 0x%08x\n",
                        j, pFunTable[j].NameHash, status);
                HpFreeAndNullWithTag(&pWf, IC_TAG_CAMI);
            }
        }

        return INT_STATUS_SUCCESS;
    }

    return INT_STATUS_NOT_SUPPORTED;
}


static INTSTATUS
IntCamiLoadProtOptionsLinux(
    _In_ const CAMI_HEADER *CamiHeader
    )
{
    const CAMI_SECTION_HEADER *pSec;
    const CAMI_LIX_DESCRIPTOR *pLixOsList;
    INTSTATUS status;

    pSec = IntCamiFindSectionHeaderByHint(CamiHeader, CAMI_SECTION_HINT_SUPPORTED_OS | CAMI_SECTION_HINT_LINUX);
    if (NULL == pSec)
    {
        ERROR("[ERROR] Failed to find Linux section header\n");
        return INT_STATUS_NOT_FOUND;
    }

    pLixOsList = GET_CAMI_STRUCT(const CAMI_LIX_DESCRIPTOR *, pSec->DescriptorTable);
    if (!IS_CAMI_ARRAY_OK(pLixOsList, pSec->EntryCount))
    {
        ERROR("[ERROR] Linux supported OS descriptors are outside the update buffer!");
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    for (DWORD i = 0; i < pSec->EntryCount; i++)
    {
        const CAMI_LIX_DESCRIPTOR *pLix = pLixOsList + i;

        if (!glob_match_numeric_utf8(pLix->VersionString, gLixGuest->VersionString))
        {
            continue;
        }

        if (!IntCamiCheckIntroVersion(pLix->MinIntroVersion, pLix->MaxIntroVersion))
        {
            continue;
        }

        if (lixStructureEnd > pLix->StructuresCount)
        {
            ERROR("[ERROR] Expected %d fields, got %d.", lixStructureEnd, pLix->StructuresCount);
            return INT_STATUS_NOT_SUPPORTED;
        }

        status = IntCamiLoadOsOptions(pLix->CustomProtectionOffset);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to load introcore options for this OS. Status: 0x%08x\n", status);
        }

        return status;
    }

    return INT_STATUS_NOT_NEEDED_HINT;
}


static INTSTATUS
IntCamiLoadProtOptionsWin(
    _In_ const CAMI_HEADER *CamiHeader
    )
{
    const CAMI_SECTION_HEADER *pSec;
    const CAMI_WIN_DESCRIPTOR *pWinOsList;
    INTSTATUS status;

    pSec = IntCamiFindSectionHeaderByHint(CamiHeader, CAMI_SECTION_HINT_SUPPORTED_OS | CAMI_SECTION_HINT_WINDOWS);
    if (NULL == pSec)
    {
        ERROR("[ERROR] Failed to find windows section header\n");
        return INT_STATUS_NOT_FOUND;
    }

    pWinOsList = GET_CAMI_STRUCT(const CAMI_WIN_DESCRIPTOR *, pSec->DescriptorTable);
    if (!IS_CAMI_ARRAY_OK(pWinOsList, pSec->EntryCount))
    {
        ERROR("[ERROR] Windows supported OS descriptors are outside the update buffer!");
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    for (DWORD i = 0; i < pSec->EntryCount; i++)
    {
        const CAMI_WIN_DESCRIPTOR *pWin = pWinOsList + i;

        if ((gGuest.OSVersion != pWin->BuildNumber) ||
            (gGuest.Guest64 != pWin->Is64) ||
            (gGuest.KptiInstalled != pWin->Kpti))
        {
            continue;
        }

        if (!IntCamiCheckIntroVersion(pWin->MinIntroVersion, pWin->MaxIntroVersion))
        {
            continue;
        }

        status = IntCamiLoadOsOptions(pWin->CustomProtectionOffset);
        if (!INT_SUCCESS(status))
        {
            ERROR("[ERROR] Failed to load introcore options for this OS: 0x%08x\n", status);
        }

        return status;
    }

    return INT_STATUS_NOT_NEEDED_HINT;
}


INTSTATUS
IntCamiGetWinSupportedList(
    _In_ BOOLEAN KptiInstalled,
    _In_ BOOLEAN Guest64,
    _Out_opt_ DWORD *NtBuildNumberList,
    _Inout_ DWORD *Count
    )
{
    const CAMI_SECTION_HEADER *pSec;
    const CAMI_WIN_DESCRIPTOR *pWinOsList;
    const CAMI_WIN_DESCRIPTOR *pWin;
    DWORD i, lastNt, cnt;

    if (NULL == Count)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL != NtBuildNumberList && 0 == *Count)
    {
        return INT_STATUS_INVALID_PARAMETER_MIX;
    }

    if (NULL == gUpdateBuffer || 0 == gUpdateBufferSize)
    {
        return INT_STATUS_NOT_INITIALIZED;
    }

    pSec = IntCamiFindSectionHeaderByHint((const CAMI_HEADER *)gUpdateBuffer,
                                          CAMI_SECTION_HINT_SUPPORTED_OS | CAMI_SECTION_HINT_WINDOWS);
    if (NULL == pSec)
    {
        ERROR("[ERROR] Failed to find windows section header\n");
        return INT_STATUS_NOT_FOUND;
    }

    pWinOsList = GET_CAMI_STRUCT(const CAMI_WIN_DESCRIPTOR *, pSec->DescriptorTable);
    if (!IS_CAMI_ARRAY_OK(pWinOsList, pSec->EntryCount))
    {
        ERROR("[ERROR] Windows supported OS descriptors are outside the update buffer!");
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    lastNt = cnt = 0;
    // the OS list from CAMI is sorted by NtBuildNumber, so it's fine.
    for (i = 0; i < pSec->EntryCount; i++)
    {
        pWin = pWinOsList + i;

        if (!IntCamiCheckIntroVersion(pWin->MinIntroVersion, pWin->MaxIntroVersion) ||
            Guest64 != pWin->Is64 || KptiInstalled != pWin->Kpti)
        {
            continue;
        }

        if (pWin->BuildNumber != lastNt)
        {
            lastNt = pWin->BuildNumber;

            if (NULL != NtBuildNumberList)
            {
                if (cnt >= *Count)
                {
                    return INT_STATUS_SUCCESS;
                }

                NtBuildNumberList[cnt] = lastNt;
            }

            cnt++;
        }
    }

    *Count = cnt;

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntCamiLoadSection(
    _In_ DWORD CamiSectionHint
    )
{
    INTSTATUS status;
    const CAMI_HEADER *pCami;

    if (NULL == gUpdateBuffer || 0 == gUpdateBufferSize)
    {
        return INT_STATUS_NOT_INITIALIZED;
    }

    pCami = (const CAMI_HEADER *)gUpdateBuffer;

    status = INT_STATUS_NOT_FOUND;
    if (CamiSectionHint & CAMI_SECTION_HINT_SUPPORTED_OS)
    {
        if (CamiSectionHint & CAMI_SECTION_HINT_WINDOWS)
        {
            status = IntCamiLoadWindows(pCami);
        }
        else if (CamiSectionHint & CAMI_SECTION_HINT_LINUX)
        {
            status = IntCamiLoadLinux(pCami);
        }
        else
        {
            return INT_STATUS_NOT_SUPPORTED;
        }
    }
    else if (CamiSectionHint & CAMI_SECTION_HINT_SYSCALLS)
    {
        status = IntCamiLoadSyscalls(pCami);
    }
    else if (CamiSectionHint & CAMI_SECTION_HINT_DIST_SIG)
    {
        if (CamiSectionHint & CAMI_SECTION_HINT_LINUX)
        {
            status = IntCamiLoadLixDistSigs(pCami);
        }
        else
        {
            status = INT_STATUS_NOT_SUPPORTED;
        }
    }
    else if (CamiSectionHint & CAMI_SECTION_HINT_PROT_OPTIONS)
    {
        if (CamiSectionHint & CAMI_SECTION_HINT_WINDOWS)
        {
            status = IntCamiLoadProtOptionsWin(pCami);
        }
        else if (CamiSectionHint & CAMI_SECTION_HINT_LINUX)
        {
            status = IntCamiLoadProtOptionsLinux(pCami);
        }
    }

    if (!INT_SUCCESS(status))
    {
        ERROR("[ERROR] Failed loading from hint 0x%08x: 0x%08x\n", CamiSectionHint, status);
    }

    return status;
}


INTSTATUS
IntCamiSetUpdateBuffer(
    _In_ const BYTE *UpdateBuffer,
    _In_ DWORD BufferLength
    )
{
    const CAMI_HEADER *pHeader;

    if (NULL == UpdateBuffer)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (0 == BufferLength)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    if (sizeof(*pHeader) > BufferLength)
    {
        ERROR("[ERROR] BufferLength is smaller than file header (%d vs %zu)\n", BufferLength, sizeof(*pHeader));
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    pHeader = (const CAMI_HEADER *)UpdateBuffer;

    if (pHeader->Magic != CAMI_MAGIC_WORD)
    {
        LOG("[ERROR] Invalid cami magic word! Expected 0x%x, got  0x%x\n", CAMI_MAGIC_WORD, pHeader->Magic);
        return INT_STATUS_INVALID_DATA_TYPE;
    }

    if (BufferLength != pHeader->FileSize)
    {
        LOG("[ERROR] Buffer length is not equal with header file size. (%d vs %d)\n", BufferLength, pHeader->FileSize);
        return INT_STATUS_INVALID_DATA_SIZE;
    }

    LOG("[INFO] Loaded cami version %u.%u build %u\n",
        pHeader->Version.Major, pHeader->Version.Minor, pHeader->Version.BuildNumber);

    memcpy(&gCamiVersion, &pHeader->Version, sizeof(pHeader->Version));

    if (gCamiVersion.Major != UPDATE_CAMI_MIN_VER_MAJOR)
    {
        ERROR("[ERROR] Update's file major (%d.%d) version is different form ours (%d.%d)\n",
              gCamiVersion.Major, gCamiVersion.Minor, UPDATE_CAMI_MIN_VER_MAJOR, UPDATE_CAMI_MIN_VER_MINOR);

        return INT_STATUS_NOT_SUPPORTED;
    }

    if (gCamiVersion.Minor > UPDATE_CAMI_MIN_VER_MINOR)
    {
        WARNING("[WARNING] Update's file minor (%d.%d) version is newer than ours (%d.%d). "
                "Not all features will be available!\n",
                gCamiVersion.Major, gCamiVersion.Minor, UPDATE_CAMI_MIN_VER_MAJOR, UPDATE_CAMI_MIN_VER_MINOR);
    }
    else if (gCamiVersion.Minor < UPDATE_CAMI_MIN_VER_MINOR)
    {
        ERROR("[ERROR] Update's file minor (%d.%d) version is older than ours (%d.%d). Will not load.\n",
              gCamiVersion.Major, gCamiVersion.Minor, UPDATE_CAMI_MIN_VER_MAJOR, UPDATE_CAMI_MIN_VER_MINOR);

        return INT_STATUS_NOT_SUPPORTED;
    }

    gUpdateBuffer = UpdateBuffer;
    gUpdateBufferSize = BufferLength;

    return INT_STATUS_SUCCESS;
}


void
IntCamiClearUpdateBuffer(
    void
    )
{
    INTSTATUS status;

    if (NULL == gUpdateBuffer)
    {
        ASSERT( gUpdateBufferSize == 0 );
        return;
    }

#ifdef INT_COMPILER_GNUC
# pragma GCC diagnostic push
# pragma GCC diagnostic ignored "-Wcast-qual"
#endif

    status = IntReleaseBuffer((void *)gUpdateBuffer, gUpdateBufferSize);

#ifdef INT_COMPILER_GNUC
# pragma GCC diagnostic pop
#endif

    if (!INT_SUCCESS(status))
    {
        WARNING("[WARNING] IntReleaseBuffer failed: 0x%08x\n", status);
    }

    gUpdateBuffer = NULL;
    gUpdateBufferSize = 0;
}


INTSTATUS
IntCamiGetVersion(
    _Out_ DWORD *MajorVersion,
    _Out_ DWORD *MinorVersion,
    _Out_ DWORD *BuildNumber
    )
{
    if (NULL == MajorVersion)
    {
        return INT_STATUS_INVALID_PARAMETER_1;
    }

    if (NULL == MinorVersion)
    {
        return INT_STATUS_INVALID_PARAMETER_2;
    }

    if (NULL == BuildNumber)
    {
        return INT_STATUS_INVALID_PARAMETER_3;
    }

    *MajorVersion = gCamiVersion.Major;
    *MinorVersion = gCamiVersion.Minor;
    *BuildNumber = gCamiVersion.BuildNumber;

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntCamiProtectedProcessAllocate(
    _In_ DWORD Items
    )
{
    if (gCamiProcessProtectionData.Items != NULL)
    {
        ERROR("[ERROR] Cami protected processes array already allocated!");
        return INT_STATUS_NOT_SUPPORTED;
    }

    if (Items == 0)
    {
        return INT_STATUS_NOT_NEEDED_HINT;
    }

    gCamiProcessProtectionData.Items = HpAllocWithTag(Items * sizeof(CAMI_PROCESS_PROTECTION_INFO), IC_TAG_CAMI);
    if (gCamiProcessProtectionData.Items == NULL)
    {
        return INT_STATUS_INSUFFICIENT_RESOURCES;
    }

    gCamiProcessProtectionData.Count = Items;

    return INT_STATUS_SUCCESS;
}


INTSTATUS
IntCamiProtectedProcessFree(
    void
    )
{
    if (gCamiProcessProtectionData.Items == NULL)
    {
        return INT_STATUS_SUCCESS;
    }

    HpFreeAndNullWithTag(&gCamiProcessProtectionData.Items, IC_TAG_CAMI);
    gCamiProcessProtectionData.Items = NULL;
    gCamiProcessProtectionData.Count = 0;

    return INT_STATUS_SUCCESS;
}