SyscallCallback.h

Go to the documentation of this file.

#include "pch.h"

//                    Locks                     //

volatile LONG SyscallCallbackModeTrapListLock;

//                 Definitions                  //

#define MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_SYSCALL_CALLBACK_TRAPS 500

//                  Structures                  //

typedef struct _SYSCALL_CALLBACK_PROCESS_THREAD_INFORMATION
{
    union
    {
        UINT64 asUInt;
 
        struct
        {
            UINT32 ProcessId;
            UINT32 ThreadId;
        } Fields;
    };
 
} SYSCALL_CALLBACK_PROCESS_THREAD_INFORMATION, *PSYSCALL_CALLBACK_PROCESS_THREAD_INFORMATION;

typedef struct _SYSCALL_CALLBACK_TRAP_FLAG_STATE
{
    UINT32                                      NumberOfItems;
    SYSCALL_CALLBACK_PROCESS_THREAD_INFORMATION ThreadInformation[MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_SYSCALL_CALLBACK_TRAPS];
    UINT64                                      Context[MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_SYSCALL_CALLBACK_TRAPS];
    SYSCALL_CALLBACK_CONTEXT_PARAMS             Params[MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_SYSCALL_CALLBACK_TRAPS];
 
} SYSCALL_CALLBACK_TRAP_FLAG_STATE, *PSYSCALL_CALLBACK_TRAP_FLAG_STATE;

//                  Functions                   //
 
BOOLEAN
SyscallCallbackInitialize();
 
BOOLEAN
SyscallCallbackIsInitialized();
 
BOOLEAN
SyscallCallbackUninitialize();
 
BOOLEAN
SyscallCallbackSetTrapFlagAfterSyscall(GUEST_REGS *                      Regs,
                                       UINT32                            ProcessId,
                                       UINT32                            ThreadId,
                                       UINT64                            Context,
                                       SYSCALL_CALLBACK_CONTEXT_PARAMS * Params);
 
BOOLEAN
SyscallCallbackCheckAndHandleAfterSyscallTrapFlags(VIRTUAL_MACHINE_STATE * VCpu,
                                                   UINT32                  ProcessId,
                                                   UINT32                  ThreadId);
 
VOID
SyscallCallbackHandleSystemCallHook(VIRTUAL_MACHINE_STATE * VCpu);