Invept.c File Reference

Implementation of functions that perform different INVEPT functions. More...

#include "pch.h"

Functions
UCHAR	EptInvept (_In_ UINT32 Type, _In_ INVEPT_DESCRIPTOR *Descriptor)
	Invoke the Invept instruction.
UCHAR	EptInveptSingleContext (_In_ UINT64 EptPointer)
	Invalidates a single context in ept cache table.
UCHAR	EptInveptAllContexts ()
	Invalidates all contexts in EPT cache table.

Detailed Description

Implementation of functions that perform different INVEPT functions.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Function Documentation

EptInvept()

UCHAR EptInvept	(	_In_ UINT32	Type,
		_In_ INVEPT_DESCRIPTOR *	Descriptor )

Invoke the Invept instruction.

Parameters

Type
Descriptor

Returns

UCHAR

{
    INVEPT_DESCRIPTOR ZeroDescriptor = {0};
    if (!Descriptor)
    {
        Descriptor                       = &ZeroDescriptor;
    }
 
    return AsmInvept(Type, Descriptor);
}

EptInveptAllContexts()

UCHAR EptInveptAllContexts

(

)

Invalidates all contexts in EPT cache table.

Returns

UCHAR

{
    return EptInvept(InveptAllContext, NULL);
}

EptInveptSingleContext()

UCHAR EptInveptSingleContext

(

_In_ UINT64

EptPointer

)

Invalidates a single context in ept cache table.

Parameters

EptPointer

Returns

UCHAR

{
    INVEPT_DESCRIPTOR Descriptor = {0};
    Descriptor.EptPointer        = EptPointer;
    Descriptor.Reserved          = 0;
    return EptInvept(InveptSingleContext, &Descriptor);
}