Callback.h File Reference

Header for VMM callback interface routines. More...

Go to the source code of this file.

Functions
BOOLEAN	LogCallbackPrepareAndSendMessageToQueue (UINT32 OperationCode, BOOLEAN IsImmediateMessage, BOOLEAN ShowCurrentSystemTime, BOOLEAN Priority, const char *Fmt,...)
	routines callback for preparing and sending message to queue
BOOLEAN	LogCallbackSendMessageToQueue (UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR *LogMessage, UINT32 BufferLen, BOOLEAN Priority)
	routines callback for sending message to queue
BOOLEAN	LogCallbackCheckIfBufferIsFull (BOOLEAN Priority)
	routines callback for checking if buffer is full
BOOLEAN	LogCallbackSendBuffer (_In_ UINT32 OperationCode, _In_reads_bytes_(BufferLength) PVOID Buffer, _In_ UINT32 BufferLength, _In_ BOOLEAN Priority)
	routines callback for sending buffer
VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE	VmmCallbackTriggerEvents (VMM_EVENT_TYPE_ENUM EventType, VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE CallingStage, PVOID Context, BOOLEAN *PostEventRequired, GUEST_REGS *Regs)
	routines callback to trigger events
BOOLEAN	VmmCallbackVmcallHandler (UINT32 CoreId, UINT64 VmcallNumber, UINT64 OptionalParam1, UINT64 OptionalParam2, UINT64 OptionalParam3)
	routine callback to handle external VMCALLs
BOOLEAN	VmmCallbackQueryTerminateProtectedResource (UINT32 CoreId, PROTECTED_HV_RESOURCES_TYPE ResourceType, PVOID Context, PROTECTED_HV_RESOURCES_PASSING_OVERS PassOver)
	routine callback to query for termination of protected resources
BOOLEAN	VmmCallbackRestoreEptState (UINT32 CoreId)
	routine callback to restore EPT state
BOOLEAN	VmmCallbackUnhandledEptViolation (UINT32 CoreId, UINT64 ViolationQualification, UINT64 GuestPhysicalAddr)
	routine callback to handle unhandled EPT violations
VOID	VmmCallbackSetLastError (UINT32 LastError)
	routine callback to set last error
VOID	VmmCallbackRegisteredMtfHandler (UINT32 CoreId)
	routine callback to handle registered MTF
VOID	VmmCallbackNmiBroadcastRequestHandler (UINT32 CoreId, BOOLEAN IsOnVmxNmiHandler)
	routine callback to handle NMI requests
BOOLEAN	DebuggingCallbackHandleBreakpointException (UINT32 CoreId)
	routine callback to handle breakpoint exception
BOOLEAN	DebuggingCallbackHandleDebugBreakpointException (UINT32 CoreId)
	routine callback to handle debug breakpoint exception
BOOLEAN	DebuggingCallbackConditionalPageFaultException (UINT32 CoreId, UINT64 Address, UINT32 PageFaultErrorCode)
	routine callback to handle conditional page-fault exception
VOID	InterceptionCallbackTriggerCr3ProcessChange (UINT32 CoreId)
	routine callback to handle cr3 process change
VOID	InterceptionCallbackCr3VmexitsForThreadInterception (UINT32 CoreId, CR3_TYPE NewCr3)
	routine callback to handle cr3 process change

Detailed Description

Header for VMM callback interface routines.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.2

Date

2023-01-29

Copyright

This project is released under the GNU Public License v3.

Function Documentation

DebuggingCallbackConditionalPageFaultException()

BOOLEAN DebuggingCallbackConditionalPageFaultException	(	UINT32	CoreId,
		UINT64	Address,
		UINT32	PageFaultErrorCode )

routine callback to handle conditional page-fault exception

Parameters

CoreId
Address
PageFaultErrorCode

Returns

BOOLEAN

{
    if (g_Callbacks.DebuggingCallbackConditionalPageFaultException == NULL)
    {
        //
        // re-inject it to not disrupt system normal execution
        //
        return FALSE;
    }
 
    return g_Callbacks.DebuggingCallbackConditionalPageFaultException(CoreId, Address, PageFaultErrorCode);
}

DebuggingCallbackHandleBreakpointException()

BOOLEAN DebuggingCallbackHandleBreakpointException

(

UINT32

CoreId

)

routine callback to handle breakpoint exception

Parameters

CoreId

Returns

BOOLEAN

{
    if (g_Callbacks.DebuggingCallbackHandleBreakpointException == NULL)
    {
        //
        // re-inject it to not disrupt system normal execution
        //
        return FALSE;
    }
 
    return g_Callbacks.DebuggingCallbackHandleBreakpointException(CoreId);
}

DebuggingCallbackHandleDebugBreakpointException()

BOOLEAN DebuggingCallbackHandleDebugBreakpointException

(

UINT32

CoreId

)

routine callback to handle debug breakpoint exception

Parameters

CoreId

Returns

BOOLEAN

{
    if (g_Callbacks.DebuggingCallbackHandleDebugBreakpointException == NULL)
    {
        //
        // re-inject it to not disrupt system normal execution
        //
        return FALSE;
    }
 
    return g_Callbacks.DebuggingCallbackHandleDebugBreakpointException(CoreId);
}

InterceptionCallbackCr3VmexitsForThreadInterception()

VOID InterceptionCallbackCr3VmexitsForThreadInterception	(	UINT32	CoreId,
		CR3_TYPE	NewCr3 )

routine callback to handle cr3 process change

Parameters

CoreId
NewCr3

Returns

VOID

{
    if (g_Callbacks.AttachingHandleCr3VmexitsForThreadInterception == NULL)
    {
        //
        // ignore it
        //
        return;
    }
 
    g_Callbacks.AttachingHandleCr3VmexitsForThreadInterception(CoreId, NewCr3);
}

InterceptionCallbackTriggerCr3ProcessChange()

VOID InterceptionCallbackTriggerCr3ProcessChange

(

UINT32

CoreId

)

routine callback to handle cr3 process change

Parameters

CoreId

Returns

VOID

{
    if (g_Callbacks.InterceptionCallbackTriggerCr3ProcessChange == NULL)
    {
        //
        // ignore it
        //
        return;
    }
 
    g_Callbacks.InterceptionCallbackTriggerCr3ProcessChange(CoreId);
}

LogCallbackCheckIfBufferIsFull()

BOOLEAN LogCallbackCheckIfBufferIsFull

(

BOOLEAN

Priority

)

routines callback for checking if buffer is full

Parameters

Priority

Returns

BOOLEAN

routines callback for checking if buffer is full

Parameters

Priority

Whether the buffer has priority

Returns

BOOLEAN Returns true if the buffer is full, otherwise, return false

{
    if (g_Callbacks.LogCallbackCheckIfBufferIsFull == NULL)
    {
        //
        // Ignore sending message to queue
        //
        return FALSE;
    }
 
    return g_Callbacks.LogCallbackCheckIfBufferIsFull(Priority);
}

LogCallbackPrepareAndSendMessageToQueue()

BOOLEAN LogCallbackPrepareAndSendMessageToQueue	(	UINT32	OperationCode,
		BOOLEAN	IsImmediateMessage,
		BOOLEAN	ShowCurrentSystemTime,
		BOOLEAN	Priority,
		const char *	Fmt,
			... )

routines callback for preparing and sending message to queue

Parameters

OperationCode
IsImmediateMessage
ShowCurrentSystemTime
Priority
Fmt
...

Returns

BOOLEAN

routines callback for preparing and sending message to queue

Parameters

OperationCode	Optional operation code
IsImmediateMessage	Should be sent immediately
ShowCurrentSystemTime	Show system-time
Priority	Whether the message has priority
Fmt	Message format-string
...

Returns

BOOLEAN if it was successful then return TRUE, otherwise returns FALSE

{
    BOOLEAN Result;
    va_list ArgList;
 
    if (g_Callbacks.LogCallbackPrepareAndSendMessageToQueueWrapper == NULL)
    {
        //
        // Ignore sending message to queue
        //
        return FALSE;
    }
 
    va_start(ArgList, Fmt);
 
    Result = g_Callbacks.LogCallbackPrepareAndSendMessageToQueueWrapper(OperationCode,
                                                                        IsImmediateMessage,
                                                                        ShowCurrentSystemTime,
                                                                        Priority,
                                                                        Fmt,
                                                                        ArgList);
    va_end(ArgList);
 
    return Result;
}

LogCallbackSendBuffer()

BOOLEAN LogCallbackSendBuffer	(	_In_ UINT32	OperationCode,
		_In_reads_bytes_(BufferLength) PVOID	Buffer,
		_In_ UINT32	BufferLength,
		_In_ BOOLEAN	Priority )

routines callback for sending buffer

Parameters

OperationCode
Buffer
BufferLength
Priority

Returns

BOOLEAN

{
    if (g_Callbacks.LogCallbackSendBuffer == NULL)
    {
        //
        // Ignore sending buffer
        //
        return FALSE;
    }
 
    return g_Callbacks.LogCallbackSendBuffer(OperationCode,
                                             Buffer,
                                             BufferLength,
                                             Priority);
}

LogCallbackSendMessageToQueue()

BOOLEAN LogCallbackSendMessageToQueue	(	UINT32	OperationCode,
		BOOLEAN	IsImmediateMessage,
		CHAR *	LogMessage,
		UINT32	BufferLen,
		BOOLEAN	Priority )

routines callback for sending message to queue

Parameters

OperationCode
IsImmediateMessage
LogMessage
BufferLen
Priority

Returns

BOOLEAN

routines callback for sending message to queue

Parameters

OperationCode	Optional operation code
IsImmediateMessage	Should be sent immediately
LogMessage	Link of message buffer
BufferLen	Length of buffer
Priority	Whether the buffer has priority

Returns

BOOLEAN if it was successful then return TRUE, otherwise returns FALSE

{
    if (g_Callbacks.LogCallbackSendMessageToQueue == NULL)
    {
        //
        // Ignore sending message to queue
        //
        return FALSE;
    }
 
    return g_Callbacks.LogCallbackSendMessageToQueue(OperationCode,
                                                     IsImmediateMessage,
                                                     LogMessage,
                                                     BufferLen,
                                                     Priority);
}

VmmCallbackNmiBroadcastRequestHandler()

VOID VmmCallbackNmiBroadcastRequestHandler	(	UINT32	CoreId,
		BOOLEAN	IsOnVmxNmiHandler )

routine callback to handle NMI requests

Parameters

CoreId
IsOnVmxNmiHandler

Returns

VOID

{
    if (g_Callbacks.VmmCallbackNmiBroadcastRequestHandler == NULL)
    {
        //
        // ignore it
        //
        return;
    }
 
    g_Callbacks.VmmCallbackNmiBroadcastRequestHandler(CoreId, IsOnVmxNmiHandler);
}

VmmCallbackQueryTerminateProtectedResource()

BOOLEAN VmmCallbackQueryTerminateProtectedResource	(	UINT32	CoreId,
		PROTECTED_HV_RESOURCES_TYPE	ResourceType,
		PVOID	Context,
		PROTECTED_HV_RESOURCES_PASSING_OVERS	PassOver )

routine callback to query for termination of protected resources

Parameters

CoreId
ResourceType
Context
PassOver

Returns

BOOLEAN

{
    if (g_Callbacks.VmmCallbackQueryTerminateProtectedResource == NULL)
    {
        //
        // ignore it
        //
        return FALSE;
    }
 
    return g_Callbacks.VmmCallbackQueryTerminateProtectedResource(CoreId, ResourceType, Context, PassOver);
}

VmmCallbackRegisteredMtfHandler()

VOID VmmCallbackRegisteredMtfHandler

(

UINT32

CoreId

)

routine callback to handle registered MTF

Parameters

CoreId

Returns

VOID

{
    if (g_Callbacks.VmmCallbackRegisteredMtfHandler == NULL)
    {
        //
        // ignore it
        //
        return;
    }
 
    g_Callbacks.VmmCallbackRegisteredMtfHandler(CoreId);
}

VmmCallbackRestoreEptState()

BOOLEAN VmmCallbackRestoreEptState

(

UINT32

CoreId

)

routine callback to restore EPT state

Parameters

CoreId

Returns

BOOLEAN

{
    if (g_Callbacks.VmmCallbackRestoreEptState == NULL)
    {
        //
        // ignore it as it's not handled
        //
        return FALSE;
    }
 
    return g_Callbacks.VmmCallbackRestoreEptState(CoreId);
}

VmmCallbackSetLastError()

VOID VmmCallbackSetLastError

(

UINT32

LastError

)

routine callback to set last error

Parameters

LastError

Returns

VOID

{
    if (g_Callbacks.VmmCallbackSetLastError == NULL)
    {
        //
        // Ignore setting the last error
        //
        return;
    }
 
    g_Callbacks.VmmCallbackSetLastError(LastError);
}

VmmCallbackTriggerEvents()

VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE VmmCallbackTriggerEvents	(	VMM_EVENT_TYPE_ENUM	EventType,
		VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE	CallingStage,
		PVOID	Context,
		BOOLEAN *	PostEventRequired,
		GUEST_REGS *	Regs )

routines callback to trigger events

Parameters

EventType
CallingStage
Context
PostEventRequired
Regs

Returns

VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE

{
    if (g_Callbacks.VmmCallbackTriggerEvents == NULL)
    {
        return VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_NO_INITIALIZED;
    }
 
    return g_Callbacks.VmmCallbackTriggerEvents(EventType, CallingStage, Context, PostEventRequired, Regs);
}

VmmCallbackUnhandledEptViolation()

BOOLEAN VmmCallbackUnhandledEptViolation	(	UINT32	CoreId,
		UINT64	ViolationQualification,
		UINT64	GuestPhysicalAddr )

routine callback to handle unhandled EPT violations

Parameters

CoreId
ViolationQualification
GuestPhysicalAddr

Returns

BOOLEAN

{
    if (g_Callbacks.VmmCallbackCheckUnhandledEptViolations == NULL)
    {
        //
        // ignore it as it's not handled
        //
        return FALSE;
    }
 
    return g_Callbacks.VmmCallbackCheckUnhandledEptViolations(CoreId, ViolationQualification, GuestPhysicalAddr);
}

VmmCallbackVmcallHandler()

BOOLEAN VmmCallbackVmcallHandler	(	UINT32	CoreId,
		UINT64	VmcallNumber,
		UINT64	OptionalParam1,
		UINT64	OptionalParam2,
		UINT64	OptionalParam3 )

routine callback to handle external VMCALLs

Parameters

CoreId
VmcallNumber
OptionalParam1
OptionalParam2
OptionalParam3

Returns

BOOLEAN

{
    if (g_Callbacks.VmmCallbackVmcallHandler == NULL)
    {
        //
        // Ignore handling external VMCALLs
        //
        return FALSE;
    }
 
    return g_Callbacks.VmmCallbackVmcallHandler(CoreId, VmcallNumber, OptionalParam1, OptionalParam2, OptionalParam3);
}