Logging.h File Reference

Headers of Message logging and tracing. More...

Go to the source code of this file.

Classes
struct	_NOTIFY_RECORD
	The usermode request. More...
struct	_BUFFER_HEADER
	Message buffer structure. More...
struct	_LOG_BUFFER_INFORMATION
	Core-specific buffers. More...

Typedefs
typedef struct _NOTIFY_RECORD	NOTIFY_RECORD
	The usermode request.
typedef struct _NOTIFY_RECORD *	PNOTIFY_RECORD
typedef struct _BUFFER_HEADER	BUFFER_HEADER
	Message buffer structure.
typedef struct _BUFFER_HEADER *	PBUFFER_HEADER
typedef struct _LOG_BUFFER_INFORMATION	LOG_BUFFER_INFORMATION
	Core-specific buffers.
typedef struct _LOG_BUFFER_INFORMATION *	PLOG_BUFFER_INFORMATION

Functions
BOOLEAN	LogReadBuffer (BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 *ReturnedLength)
	Attempt to read the buffer.
VOID	LogNotifyUsermodeCallback (PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
	Complete the IRP in IRP Pending state and fill the usermode buffers with pool data.

Variables
char *	VmxLogMessage
	VMX buffer for logging messages.
char *	VmxTempMessage
	VMX temporary buffer for logging messages.
LOG_BUFFER_INFORMATION *	MessageBufferInformation
	Global Variable for buffer on all cores.
volatile LONG	VmxRootLoggingLock
	Vmx-root lock for logging.
volatile LONG	VmxRootLoggingLockForNonImmBuffers
	Vmx-root lock for logging.
NOTIFY_RECORD *	g_GlobalNotifyRecord
	Save the state of the thread that waits for messages to deliver to user-mode.
MESSAGE_TRACING_CALLBACKS	g_MsgTracingCallbacks
	Global variable that holds callbacks.

Detailed Description

Headers of Message logging and tracing.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-04-11

Copyright

This project is released under the GNU Public License v3.

Typedef Documentation

BUFFER_HEADER

typedef struct _BUFFER_HEADER BUFFER_HEADER

Message buffer structure.

LOG_BUFFER_INFORMATION

typedef struct _LOG_BUFFER_INFORMATION LOG_BUFFER_INFORMATION

Core-specific buffers.

NOTIFY_RECORD

typedef struct _NOTIFY_RECORD NOTIFY_RECORD

The usermode request.

PBUFFER_HEADER

typedef struct _BUFFER_HEADER * PBUFFER_HEADER

PLOG_BUFFER_INFORMATION

typedef struct _LOG_BUFFER_INFORMATION * PLOG_BUFFER_INFORMATION

PNOTIFY_RECORD

typedef struct _NOTIFY_RECORD * PNOTIFY_RECORD

Function Documentation

LogNotifyUsermodeCallback()

VOID LogNotifyUsermodeCallback	(	PKDPC	Dpc,
		PVOID	DeferredContext,
		PVOID	SystemArgument1,
		PVOID	SystemArgument2 )

Complete the IRP in IRP Pending state and fill the usermode buffers with pool data.

Parameters

Dpc
DeferredContext
SystemArgument1
SystemArgument2

Returns

VOID

{
    PNOTIFY_RECORD NotifyRecord;
    PIRP           Irp;
    UINT32         Length;
 
    UNREFERENCED_PARAMETER(Dpc);
    UNREFERENCED_PARAMETER(SystemArgument1);
    UNREFERENCED_PARAMETER(SystemArgument2);
 
    NotifyRecord = DeferredContext;
 
    ASSERT(NotifyRecord != NULL); // can't be NULL
    _Analysis_assume_(NotifyRecord != NULL);
 
    switch (NotifyRecord->Type)
    {
    case IRP_BASED:
        Irp = NotifyRecord->Message.PendingIrp;
 
        if (Irp != NULL)
        {
            PCHAR              OutBuff;       // pointer to output buffer
            ULONG              InBuffLength;  // Input buffer length
            ULONG              OutBuffLength; // Output buffer length
            PIO_STACK_LOCATION IrpSp;
 
            //
            // Make suree that concurrent calls to notify function never occurs
            //
            if (!(Irp->CurrentLocation <= Irp->StackCount + 1))
            {
                DbgPrint("Err, probably two or more functions called DPC for an object");
                return;
            }
 
            IrpSp         = IoGetCurrentIrpStackLocation(Irp);
            InBuffLength  = IrpSp->Parameters.DeviceIoControl.InputBufferLength;
            OutBuffLength = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;
 
            if (!InBuffLength || !OutBuffLength)
            {
                Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
                IoCompleteRequest(Irp, IO_NO_INCREMENT);
                break;
            }
 
            //
            // Check again that SystemBuffer is not null
            //
            if (!Irp->AssociatedIrp.SystemBuffer)
            {
                //
                // Buffer is invalid
                //
                return;
            }
 
            OutBuff = Irp->AssociatedIrp.SystemBuffer;
            Length  = 0;
 
            //
            // Read Buffer might be empty (nothing to send)
            //
            if (!LogReadBuffer(NotifyRecord->CheckVmxRootMessagePool, OutBuff, &Length))
            {
                //
                // we have to return here as there is nothing to send here
                //
                Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
                IoCompleteRequest(Irp, IO_NO_INCREMENT);
                break;
            }
 
            Irp->IoStatus.Information = Length;
 
            Irp->IoStatus.Status = STATUS_SUCCESS;
            IoCompleteRequest(Irp, IO_NO_INCREMENT);
        }
        break;
 
    case EVENT_BASED:
        //
        // Signal the Event created in user-mode.
        //
        KeSetEvent(NotifyRecord->Message.Event, 0, FALSE);
 
        //
        // Dereference the object as we are done with it.
        //
        ObDereferenceObject(NotifyRecord->Message.Event);
 
        break;
 
    default:
        ASSERT(FALSE);
        break;
    }
 
    if (NotifyRecord != NULL)
    {
        PlatformMemFreePool(NotifyRecord);
    }
}

LogReadBuffer()

BOOLEAN LogReadBuffer	(	BOOLEAN	IsVmxRoot,
		PVOID	BufferToSaveMessage,
		UINT32 *	ReturnedLength )

Attempt to read the buffer.

Parameters

IsVmxRoot	Determine whether you want to read vmx root buffer or vmx non root buffer
BufferToSaveMessage	Target buffer to save the message
ReturnedLength	The actual length of the buffer that this function used it

Returns

BOOLEAN return of this function shows whether the read was successful or not (e.g FALSE shows there's no new buffer available.)

{
    UINT32  Index;
    BOOLEAN PriorityMessageIsAvailable = FALSE;
    KIRQL   OldIRQL                    = NULL_ZERO;
 
    //
    // Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock,
    // if not we use the windows spinlock
    //
    if (IsVmxRoot)
    {
        //
        // Set the index
        //
        Index = 1;
 
        //
        // Acquire the lock
        //
        SpinlockLock(&VmxRootLoggingLock);
    }
    else
    {
        //
        // Set the index
        //
        Index = 0;
 
        //
        // Acquire the lock
        //
        KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
    }
 
    //
    // Compute the current buffer to read
    //
    BUFFER_HEADER * Header;
 
    //
    // Check for priority message
    //
    Header = (BUFFER_HEADER *)((UINT64)MessageBufferInformation[Index].BufferStartAddressPriority + (MessageBufferInformation[Index].CurrentIndexToSendPriority * (PacketChunkSize + sizeof(BUFFER_HEADER))));
 
    if (!Header->Valid)
    {
        //
        // Check for regular message
        //
        Header = (BUFFER_HEADER *)((UINT64)MessageBufferInformation[Index].BufferStartAddress + (MessageBufferInformation[Index].CurrentIndexToSend * (PacketChunkSize + sizeof(BUFFER_HEADER))));
 
        if (!Header->Valid)
        {
            //
            // there is nothing to send
            //
 
            //
            // Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock,
            // if not we use the windows spinlock
            //
            if (IsVmxRoot)
            {
                SpinlockUnlock(&VmxRootLoggingLock);
            }
            else
            {
                //
                // Release the lock
                //
                KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
            }
 
            return FALSE;
        }
    }
    else
    {
        PriorityMessageIsAvailable = TRUE;
    }
 
    //
    // If we reached here, means that there is sth to send
    //
 
    //
    // First copy the header
    //
    RtlCopyBytes(BufferToSaveMessage, &Header->OperationNumber, sizeof(UINT32));
 
    //
    // Second, save the buffer contents
    //
    PVOID SendingBuffer;
 
    if (PriorityMessageIsAvailable)
    {
        SendingBuffer = (PVOID)((UINT64)MessageBufferInformation[Index].BufferStartAddressPriority + (MessageBufferInformation[Index].CurrentIndexToSendPriority * (PacketChunkSize + sizeof(BUFFER_HEADER))) + sizeof(BUFFER_HEADER));
    }
    else
    {
        SendingBuffer = (PVOID)((UINT64)MessageBufferInformation[Index].BufferStartAddress + (MessageBufferInformation[Index].CurrentIndexToSend * (PacketChunkSize + sizeof(BUFFER_HEADER))) + sizeof(BUFFER_HEADER));
    }
 
    //
    // Because we want to pass the header of usermode header
    //
    PVOID SavingAddress = (PVOID)((UINT64)BufferToSaveMessage + sizeof(UINT32));
 
    RtlCopyBytes(SavingAddress, SendingBuffer, Header->BufferLength);
 
#if ShowMessagesOnDebugger
 
    //
    // Means that show just messages
    //
    if (Header->OperationNumber <= OPERATION_LOG_NON_IMMEDIATE_MESSAGE)
    {
        //
        // We're in Dpc level here so it's safe to use DbgPrint
        // DbgPrint limitation is 512 Byte
        //
        if (Header->BufferLength > DbgPrintLimitation)
        {
            for (size_t i = 0; i <= Header->BufferLength / DbgPrintLimitation; i++)
            {
                if (i != 0)
                {
                    DbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i) - 2));
                }
                else
                {
                    DbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i)));
                }
            }
        }
        else
        {
            DbgPrint("%s", (char *)SendingBuffer);
        }
    }
#endif
 
    //
    // Finally, set the current index to invalid as we sent it
    //
    Header->Valid = FALSE;
 
    //
    // Set the length to show as the ReturnedByted in usermode ioctl function + size of header
    //
    *ReturnedLength = Header->BufferLength + sizeof(UINT32);
 
    //
    // Last step is to clear the current buffer (we can't do it once when CurrentIndexToSend is zero because
    // there might be multiple messages on the start of the queue that didn't read yet)
    // we don't free the header
    //
    RtlZeroMemory(SendingBuffer, Header->BufferLength);
 
    if (PriorityMessageIsAvailable)
    {
        //
        // Check to see whether we passed the index or not
        //
        if (MessageBufferInformation[Index].CurrentIndexToSendPriority > MaximumPacketsCapacityPriority - 2)
        {
            MessageBufferInformation[Index].CurrentIndexToSendPriority = 0;
        }
        else
        {
            //
            // Increment the next index to read
            //
            MessageBufferInformation[Index].CurrentIndexToSendPriority = MessageBufferInformation[Index].CurrentIndexToSendPriority + 1;
        }
    }
    else
    {
        //
        // Check to see whether we passed the index or not
        //
        if (MessageBufferInformation[Index].CurrentIndexToSend > MaximumPacketsCapacity - 2)
        {
            MessageBufferInformation[Index].CurrentIndexToSend = 0;
        }
        else
        {
            //
            // Increment the next index to read
            //
            MessageBufferInformation[Index].CurrentIndexToSend = MessageBufferInformation[Index].CurrentIndexToSend + 1;
        }
    }
 
    //
    // Check if we're in Vmx-root, if it is then we use our customized HIGH_IRQL Spinlock,
    // if not we use the windows spinlock
    //
    if (IsVmxRoot)
    {
        SpinlockUnlock(&VmxRootLoggingLock);
    }
    else
    {
        //
        // Release the lock
        //
        KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
    }
 
    return TRUE;
}

Variable Documentation

g_GlobalNotifyRecord

NOTIFY_RECORD* g_GlobalNotifyRecord

Save the state of the thread that waits for messages to deliver to user-mode.

g_MsgTracingCallbacks

MESSAGE_TRACING_CALLBACKS g_MsgTracingCallbacks

Global variable that holds callbacks.

MessageBufferInformation

LOG_BUFFER_INFORMATION* MessageBufferInformation

Global Variable for buffer on all cores.

VmxLogMessage

char* VmxLogMessage

VMX buffer for logging messages.

VmxRootLoggingLock

volatile LONG VmxRootLoggingLock

Vmx-root lock for logging.

VmxRootLoggingLockForNonImmBuffers

volatile LONG VmxRootLoggingLockForNonImmBuffers

Vmx-root lock for logging.

VmxTempMessage

char* VmxTempMessage

VMX temporary buffer for logging messages.