ExecTrap.h

Go to the documentation of this file.

#include "pch.h"

//                  Definitions                 //

#define MAXIMUM_NUMBER_OF_PROCESSES_FOR_USER_KERNEL_EXEC_THREAD 100

//                    Locks                     //

volatile LONG ExecTrapProcessListLock;

//                  Structures                  //

typedef struct _USER_KERNEL_EXECUTION_TRAP_STATE
{
    UINT32 NumberOfItems;
    UINT64 InterceptionProcessIds[MAXIMUM_NUMBER_OF_PROCESSES_FOR_USER_KERNEL_EXEC_THREAD];
 
} USER_KERNEL_EXECUTION_TRAP_STATE, *PUSER_KERNEL_EXECUTION_TRAP_STATE;

//                    Functions                 //
 
VOID
ExecTrapHandleCr3Vmexit(VIRTUAL_MACHINE_STATE * VCpu);
 
VOID
ExecTrapChangeToUserDisabledMbecEptp(VIRTUAL_MACHINE_STATE * VCpu);
 
VOID
ExecTrapChangeToKernelDisabledMbecEptp(VIRTUAL_MACHINE_STATE * VCpu);
 
VOID
ExecTrapRestoreToNormalEptp(VIRTUAL_MACHINE_STATE * VCpu);
 
VOID
ExecTrapHandleMoveToAdjustedTrapState(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode);
 
VOID
ExecTrapUninitialize();
 
BOOLEAN
ExecTrapInitialize();
 
VOID
ExecTrapApplyMbecConfiguratinFromKernelSide(VIRTUAL_MACHINE_STATE * VCpu);
 
BOOLEAN
ExecTrapHandleEptViolationVmexit(VIRTUAL_MACHINE_STATE *                VCpu,
                                 VMX_EXIT_QUALIFICATION_EPT_VIOLATION * ViolationQualification);
 
BOOLEAN
ExecTrapAddProcessToWatchingList(UINT32 ProcessId);
 
BOOLEAN
ExecTrapRemoveProcessFromWatchingList(UINT32 ProcessId);