SyscallFootprints.c File Reference

Try to hide SYSCALL methods from anti-debugging and anti-hypervisor. More...

#include "pch.h"

Functions
VOID	TransparentHandleSystemCallHook (GUEST_REGS *Regs)
	Handle The triggered hook on KiSystemCall64 system call handler when the Transparency mode is enabled.
VOID	TransparentHandleNtQuerySystemInformationSyscall (GUEST_REGS *Regs)
	Handle The NtQuerySystemInformation system call when the Transparent mode is enabled.
PVOID	TransparentGetObjectNameFromAttributesVirtualPointer (UINT64 virtPtr)
	Obtain a copy of the PWCHAR wide character string from a OBJECT_ATTRIBUTES structure at a guest virtual address.
VOID	TransparentHandleNtQueryAttributesFileSyscall (GUEST_REGS *Regs)
	Handle The NtQueryAttributesFile system call when the Transparent mode is enabled.
VOID	TransparentHandleNtOpenDirectoryObjectSyscall (GUEST_REGS *Regs)
	Handle The NtOpenDirectoryObject system call when the Transparent mode is enabled.
VOID	TransparentHandleNtSystemDebugControlSyscall (GUEST_REGS *Regs)
	Handle The NtSystemDebugControl system call when the Transparent mode is enabled.
VOID	TransparentHandleNtQueryInformationProcessSyscall (GUEST_REGS *Regs)
	Handle The NtQueryInformationProcess system call when the Transparent mode is enabled.
VOID	TransparentHandleNtOpenFileSyscall (GUEST_REGS *Regs)
	Handle The NtOpenFile system call when the Transparent mode is enabled.
VOID	TransparentHandleNtOpenKeySyscall (GUEST_REGS *Regs)
	Handle The NtOpenKey system call when the Transparent mode is enabled.
VOID	TransparentHandleNtQueryValueKeySyscall (GUEST_REGS *Regs)
	Handle The NtQueryValueKey system call when the Transparent mode is enabled.
VOID	TransparentHandleNtEnumerateKeySyscall (GUEST_REGS *Regs)
	Handle The NtEnumerateKey system call when the Transparent mode is enabled.
BOOLEAN	TransparentHandleModuleInformationQuery (PVOID Ptr, UINT64 VirtualAddress, UINT32 BufferSize)
	Handle the request for SystemModuleInformation.
BOOLEAN	TransparentHandleProcessInformationQuery (SYSCALL_CALLBACK_CONTEXT_PARAMS *Params)
	Handle the request for SystemProcessInformation.
UINT64	TransparentHandleFirmwareInformationQuery (UINT64 Ptr, UINT32 BufMaxSize, UINT64 BufSizePtr)
	Handle the request for SystemFirmwareTableInformation.
UINT64	TransparentReplaceVendorStringFromBufferWChar (SYSCALL_CALLBACK_CONTEXT_PARAMS *Params, ULONG DataOffset, ULONG DataLenOffset)
	Replace occurrences of a hypervisor specific strings with legitimate vendor strings in a provided buffer.
UINT64	TransparentCallbackHandleAfterNtQueryValueKeySyscall (SYSCALL_CALLBACK_CONTEXT_PARAMS *Params)
	Callback function to handle the returns from the NtQueryValueKey syscall.
UINT64	TransparentCallbackHandleAfterNtEnumerateKeySyscall (SYSCALL_CALLBACK_CONTEXT_PARAMS *Params)
	Callback function to handle the returns from the NtEnumerateKey syscall.
VOID	TransparentCallbackHandleAfterNtQuerySystemInformationSyscall (GUEST_REGS *Regs, SYSCALL_CALLBACK_CONTEXT_PARAMS *Params)
	Callback function to handle the returns from the NtQuerySystemInformation syscall.
VOID	TransparentCallbackHandleAfterSyscall (GUEST_REGS *Regs, UINT32 ProcessId, UINT32 ThreadId, UINT64 Context, SYSCALL_CALLBACK_CONTEXT_PARAMS *Params)
	Callback function to handle returns from the syscall.

Detailed Description

Try to hide SYSCALL methods from anti-debugging and anti-hypervisor.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.14

Date

2025-06-08

Copyright

This project is released under the GNU Public License v3.

Function Documentation

TransparentCallbackHandleAfterNtEnumerateKeySyscall()

UINT64 TransparentCallbackHandleAfterNtEnumerateKeySyscall

(

SYSCALL_CALLBACK_CONTEXT_PARAMS *

Params

)

Callback function to handle the returns from the NtEnumerateKey syscall.

Parameters

Params

The set transparent callback params that contain: in OptionalParam1 the KEY_VALUE_INFORMATION_CLASS enum value in OptionalParam2 a pointer to a valid read/writable memory buffer that contains both, a WCHAR string and its length in bytes in OptionalParam3 max size in bytes of the allocated buffer in OptionalParam4 a pointer to a ULONG containing current size of the buffer

Returns

UINT64

{
    ULONG LenOffset = 0;
    ULONG BufOffset = 0;
 
    //
    // Based on the KEY_INFORMATION_CLASS given, set the struct offsets for the data buffer and its length fields
    //
    switch (Params->OptionalParam1)
    {
        //
        // KeyBasicInformation
        //
    case 0x0:
    {
        LenOffset = sizeof(LARGE_INTEGER) + sizeof(ULONG);
        BufOffset = sizeof(LARGE_INTEGER) + (sizeof(ULONG) * 2);
 
        break;
    }
 
    //
    // KeyNodeInformation
    //
    case 0x1:
    {
        return 0;
    }
 
    //
    // KeyNameInformation
    //
    case 0x3:
    {
        LenOffset = 0;
        BufOffset = sizeof(ULONG);
 
        break;
    }
    default:
    {
        LogInfo("NtEnumerateKey was called with KeyInformationClass 0x%x, a handler for which has not been implemented", Params->OptionalParam1);
        return 0;
    }
    }
 
    //
    // Given the user buffer, read and exchange any Hypervisor vendor strings in the registry key names
    //
    return TransparentReplaceVendorStringFromBufferWChar(Params, BufOffset, LenOffset);
}

TransparentCallbackHandleAfterNtQuerySystemInformationSyscall()

VOID TransparentCallbackHandleAfterNtQuerySystemInformationSyscall	(	GUEST_REGS *	Regs,
		SYSCALL_CALLBACK_CONTEXT_PARAMS *	Params )

Callback function to handle the returns from the NtQuerySystemInformation syscall.

Parameters

Regs	The virtual processor's state of registers
Params	The (optional) parameters of the caller

Returns

VOID

{
    //
    // Handle each defined SYSTEM_INFORMATION_CLASS
    //
    switch (Params->OptionalParam1)
    {
    case SystemCodeIntegrityInformation:
    {
        //
        // Check if the obtained buffer pointer is valid
        //
        if (g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam2, (UINT32)Params->OptionalParam3))
        {
            SYSTEM_CODEINTEGRITY_INFORMATION Temp = {0};
 
            //
            // Read data from the saved pointer of the now filled information buffer
            //
            g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Params->OptionalParam2, &Temp, Params->OptionalParam3);
 
            //
            // Modify the data and write it back to the information buffer to be passed to user mode
            //
            Temp.CodeIntegrityOptions = 0x01;
            g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam2, &Temp, Params->OptionalParam3);
        }
        else
        {
            LogInfo("A call for the NtQuerySystemInformation system call requesting SystemCodeIntegrityInformation structure was made, but the usermode buffer was not captured");
        }
 
        break;
    }
    case SystemProcessInformation:
    case SystemExtendedProcessInformation:
    {
        //
        // Check if the obtained buffer pointer is valid
        //
        if (Params->OptionalParam2 != 0x0 &&
            Params->OptionalParam3 != 0x0 &&
            g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam2, (UINT32)Params->OptionalParam3))
        {
            if (!TransparentHandleProcessInformationQuery(Params))
            {
                //
                // Some internal Windows calls to these system calls use different offsetting/entry structure layout and causes errors
                //
 
                // LogInfo("Error while modifying the buffer for data query 0x02x", Params->OptionalParam1);
            }
        }
        break;
    }
 
    case SystemModuleInformation:
    {
        //
        // Check if the obtained buffer pointer is valid
        //
        if (Params->OptionalParam2 != 0x0 &&
            Params->OptionalParam3 != 0x0 &&
            g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam2, (UINT32)Params->OptionalParam3))
        {
            //
            // Allocate a buffer to copy user buffer data to for modification
            //
            PVOID Buf = PlatformMemAllocateZeroedNonPagedPool(Params->OptionalParam3);
            if (Buf == NULL)
            {
                LogError("Err, insufficient memory");
                break;
            }
 
            //
            // Copy over the data and perform the modifications
            //
            if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Params->OptionalParam2, Buf, Params->OptionalParam3))
            {
                LogInfo("Error reading memory buffer given by the usermode call");
            }
            else
            {
                if (!TransparentHandleModuleInformationQuery(Buf, Params->OptionalParam2, (UINT32)Params->OptionalParam3))
                {
                    //
                    // Some internal Windows calls to these system calls use different offsetting/entry structure layout and causes errors
                    //
 
                    // LogInfo("Error while modifying the buffer for data query 0x02x", Params->OptionalParam1);
                }
            }
 
            PlatformMemFreePool(Buf);
        }
        break;
    }
    case SystemKernelDebuggerInformation:
    {
        //
        // Check if the obtained buffer pointer is valid
        //
        if (g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam2, (UINT32)Params->OptionalParam3))
        {
            //
            // Write to the output buffer 0x0001 for "Debugger not present"
            //
            WORD Temp = 0x0100;
            g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam2, &Temp, 2);
        }
    }
    case SystemFirmwareTableInformation:
    {
        if (g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam2, (UINT32)Params->OptionalParam3))
        {
            UINT64 RetVal = TransparentHandleFirmwareInformationQuery(Params->OptionalParam2, (UINT32)Params->OptionalParam3, Params->OptionalParam4);
            if (RetVal == 0x0)
            {
                LogInfo("A query for SystemFirmwareTableInformation was made, but the transparent mitigation failed");
            }
            else if (RetVal != 0x1)
            {
                LogInfo("Changing to %llx", RetVal);
                Regs->rax = RetVal;
            }
        }
        else
        {
            LogInfo("A query for SystemFirmwareTableInformation was made, but the user-mode buffer was not captured");
        }
        break;
    }
 
    default:
    {
        break;
    }
    }
}

TransparentCallbackHandleAfterNtQueryValueKeySyscall()

UINT64 TransparentCallbackHandleAfterNtQueryValueKeySyscall

(

SYSCALL_CALLBACK_CONTEXT_PARAMS *

Params

)

Callback function to handle the returns from the NtQueryValueKey syscall.

Parameters

Params

The set transparent callback params that contain: in OptionalParam1 the KEY_VALUE_INFORMATION_CLASS enum value in OptionalParam2 a pointer to a valid read/writable memory buffer that contains both, a WCHAR string and its length in bytes in OptionalParam3 max size in bytes of the allocated buffer in OptionalParam4 a pointer to a ULONG containing current size of the buffer

Returns

UINT64

{
    ULONG LenOffset = 0;
    ULONG BufOffset = 0;
 
    //
    // Based on the KEY_VALUE_INFORMATION_CLASS given, set the struct offsets for the data buffer and its length fields
    //
    switch (Params->OptionalParam1)
    {
        //
        // KeyValueBasicInformation and queries for a key that has a hypervisor specific name
        //
    case 0x0:
    {
        if (Params->OptionalParam2 != 0)
            return 0;
 
        //
        // If the key query was for a registry key that has a hypervisor specific name, return an error code
        //
        return (UINT64)(UINT32)STATUS_OBJECT_NAME_NOT_FOUND;
    }
 
    //
    // KeyValuePartialInformation
    //
    case 0x2:
    {
        LenOffset = sizeof(ULONG) * 2;
        BufOffset = sizeof(ULONG) * 3;
 
        break;
    }
 
    //
    // KeyValueFullInformation
    //
    case 0x3:
    case 0x1:
    {
        LenOffset = sizeof(ULONG) * 3;
        BufOffset = sizeof(ULONG) * 4; // Name offset, Data is after it
 
        break;
    }
 
    //
    // KeyValuePartialInformationAlign64
    //
    case 0x4:
    {
        LenOffset = sizeof(ULONG) * 1;
        BufOffset = sizeof(ULONG) * 2;
 
        break;
    }
    default:
    {
        LogInfo("NtQueryValueKey was called with KeyValueInformationClass 0x%x, a handler for which has not been implemented", Params->OptionalParam1);
        return 0;
    }
    }
 
    //
    // Given the user buffer, read and exchange any Hypervisor vendor strings in the registry key data
    //
    return TransparentReplaceVendorStringFromBufferWChar(Params, BufOffset, LenOffset);
}

TransparentCallbackHandleAfterSyscall()

VOID TransparentCallbackHandleAfterSyscall	(	GUEST_REGS *	Regs,
		UINT32	ProcessId,
		UINT32	ThreadId,
		UINT64	Context,
		SYSCALL_CALLBACK_CONTEXT_PARAMS *	Params )

Callback function to handle returns from the syscall.

Parameters

Regs	The virtual processor's state of registers
ProcessId	The process id of the thread
ThreadId	The thread id of the thread
Context	The context of the caller
Params	The (optional) parameters of the caller

Returns

VOID

{
    //
    // Handle each defined system call separately, after the kernel execution has finished(at the SYSRET instruction)
    //
 
    //
    // Handle the memory buffer and return code modification after NtQuerySystemInformation system call
    //
    if (Context == g_SystemCallNumbersInformation.SysNtQuerySystemInformation)
    {
        TransparentCallbackHandleAfterNtQuerySystemInformationSyscall(Regs, Params);
    }
    //
    // Handle the memory buffer and return code modification after NtQueryAttributesFile system call
    //
    else if (Context == g_SystemCallNumbersInformation.SysNtQueryAttributesFile)
    {
        //
        // Check if the obtained buffer pointer is valid
        //
        if (g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam1, sizeof(FILE_BASIC_INFORMATION)))
        {
            FILE_BASIC_INFORMATION Buf = {0};
            //
            // Copy over the data from the output buffer pointer
            //
            if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Params->OptionalParam1, &Buf, sizeof(FILE_BASIC_INFORMATION)))
            {
                LogError("Err, Virtual memory read failed");
            }
            else
            {
                //
                // Modify the file attribute to INVALID_FILE_ATTRIBUTES and write it back to the pointer
                //
                Buf.FileAttributes = ((DWORD)-1);
 
                if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam1, &Buf, sizeof(FILE_BASIC_INFORMATION)))
                {
                    LogError("Err, Virtual memory write failed");
                }
            }
        }
        else
        {
            LogInfo("A call for the NtQueryAttributeFile system call for a marked file was made, but the output buffer was not captured");
        }
    }
 
    //
    // Handle the memory buffer and return code modification after NtOpenDirectoryObject system call.
    //
    // NOTE: No transparent mitigations of this call have been implemented
    //
    else if (Context == g_SystemCallNumbersInformation.SysNtOpenDirectoryObject)
    {
        LogInfo("A NtOpenDirectoryObject system call was made for a known directory that reveals hypervisor presence. process: %x, thread: %x\n",
                ProcessId,
                ThreadId);
        LogInfo("No action to mitigate this was made as a handler for NtOpenDirectoryObject has not been implemented");
    }
    //
    // Handle the memory buffer modification after NtQueryInformationProcess system call
    //
    else if (Context == g_SystemCallNumbersInformation.SysNtQueryInformationProcess)
    {
        switch (Params->OptionalParam1)
        {
        case 0x07:
        {
            if (g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam2, sizeof(DWORD_PTR)))
            {
                //
                // Zero out the return buffer to user-mode
                //
                DWORD_PTR NoDebugPort = 0x0;
 
                g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam2, &NoDebugPort, sizeof(DWORD_PTR));
            }
            break;
        }
        case 0x1f:
        {
            //
            // Zero out the return buffer to user-mode
            //
            ULONG notDebugged = 0x0;
            g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam2, &notDebugged, sizeof(ULONG));
            break;
        }
        case 0x1e:
        {
            if (g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam2, (UINT32)Params->OptionalParam3))
            {
                LogInfo("Process %llx called the NtQueryInformationProcess system call with the ProcessDebugObject class, no transparent mitigations were performed", ProcessId);
            }
            break;
        }
        default:
        {
            break;
        }
        }
    }
    //
    // Handle the return code modification after NtSystemDebugControl system call
    //
    else if (Context == g_SystemCallNumbersInformation.SysNtSystemDebugControl)
    {
        //
        // In the entry handler, the Syscall number was changed to corrupt this call, after the SYSRET, change the return code to STATUS_DEBUGGER_INACTIVE
        //
        Regs->rax = (UINT64)(UINT32)STATUS_DEBUGGER_INACTIVE;
    }
 
    //
    // Handle the return code modification after SysNtOpenFile system call
    //
    else if (Context == g_SystemCallNumbersInformation.SysNtOpenFile)
    {
        //
        // In the entry handler, the Syscall number was changed to corrupt this call if the request was for a known hypervisor file
        // after the SYSRET, change the return code to STATUS_OBJECT_NAME_NOT_FOUND
        //
        Regs->rax = (UINT64)(UINT32)STATUS_OBJECT_NAME_NOT_FOUND;
    }
 
    //
    // Handle the return code modification after NtNtQueryValueKey system call
    //
    // NOTE: The transparent mitigation will replace all occurrences of a hypervisor vendor string in the registry
    // key data to a randomized real hardware vendor string, no matter the meaning of the key,
    // This can cause some keys to produce illogical data, for example,
    // a disk drive ID having a vendor string of ASUS even though (as far as I know) ASUS doesn't produce storage devices.
    //
    else if (Context == g_SystemCallNumbersInformation.SysNtQueryValueKey)
    {
        UINT64 RetVal;
 
        //
        // Call the handler of NtQueryValueKey syscall callback
        //
        RetVal = TransparentCallbackHandleAfterNtQueryValueKeySyscall(Params);
 
        //
        // If a custom(Specific to transparency) error code should be returned,
        // set it to %RAX
        // Else leave it to what the kernel already set it to
        //
        if (RetVal != 0)
        {
            Regs->rax = RetVal;
        }
    }
    //
    // Handle the memory buffer modification after NtOpenKey system call and its derivatives
    //
    else if (Context == g_SystemCallNumbersInformation.SysNtOpenKey || Context == g_SystemCallNumbersInformation.SysNtOpenKeyEx)
    {
        //
        // In the entry handler, the Syscall number was changed to corrupt this call if the request was for a known hypervisor registry key
        // after the SYSRET, change the return code to STATUS_OBJECT_NAME_NOT_FOUND
        //
        Regs->rax = (UINT64)(UINT32)STATUS_OBJECT_NAME_NOT_FOUND;
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtEnumerateKey)
    {
        UINT64 RetVal;
 
        //
        // Call the handler of NtEnumerateKey syscall callback
        //
        RetVal = TransparentCallbackHandleAfterNtEnumerateKeySyscall(Params);
 
        //
        // If a custom(Specific to transparency) error code should be returned,
        // set it to %RAX
        // Else leave it to what the kernel already set it to
        //
        if (RetVal != 0)
        {
            Regs->rax = RetVal;
        }
    }
    else
    {
        //
        // A SYSRET trap flag was inserted for a System call that does not have a transparency handler implemented
        //
        LogInfo("Transparent callback  for an unimplemented system call handle with the trap flag for process: %x, thread: %x, context: %llx RAX: %llx (p1: %llx, p2: %llx, p3: %llx, p4: %llx) \n",
                ProcessId,
                ThreadId,
                Context,
                Regs->rax,
                Params->OptionalParam1,
                Params->OptionalParam2,
                Params->OptionalParam3,
                Params->OptionalParam4);
    }
}

TransparentGetObjectNameFromAttributesVirtualPointer()

PVOID TransparentGetObjectNameFromAttributesVirtualPointer

(

UINT64

virtPtr

)

Obtain a copy of the PWCHAR wide character string from a OBJECT_ATTRIBUTES structure at a guest virtual address.

Returns an allocated tagged memory pointer which needs to be freed with PlatformMemFreePool()

Parameters

virtPtr

A pointer to a guest virtual memory address, containing a OBJECT_ATTRIBUTES structure

Returns

PVOID Pointer to an allocated tagged memory pool, which needs to be freed with PlatformMemFreePool()

{
    // PVOID buf = PlatformMemAllocateZeroedNonPagedPool(sizeof(OBJECT_ATTRIBUTES));
    OBJECT_ATTRIBUTES Buf = {0};
 
    //
    // Read the OBJECT_ATTRIBUTES structure from the virtual address pointer
    //
    if (g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(virtPtr, &Buf, sizeof(OBJECT_ATTRIBUTES)))
    {
        // PVOID Namebuf = PlatformMemAllocateZeroedNonPagedPool(sizeof(UNICODE_STRING));
        UNICODE_STRING NameBuf = {0};
 
        //
        // Read the UNICODE_STRING structure from a virtual address pointer, pointed to by OBJECT_ATTRIBUTES.ObjectName struct entry
        //
        if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Buf.ObjectName, &NameBuf, sizeof(UNICODE_STRING)))
        {
            LogInfo("BadRead");
            return NULL;
        }
 
        //
        // The OBJECT_ATTRIBUTES structure contains a PUNICODE_STRING pointer to a guest virtual address which contains this UNICODE_STRING
        // This in turn will contain another pointer, this time a PWCHAR, to another virtual address, which will contain the wide char string we need
        //
        PVOID ObjectNameBuf = PlatformMemAllocateZeroedNonPagedPool(NameBuf.Length + sizeof(WCHAR));
 
        if (ObjectNameBuf == NULL)
        {
            LogInfo("Error allocating ImageName memory buffer");
 
            return NULL;
        }
 
        //
        // Read the PWCHAR string from a virtual address pointer, pointed to by OBJECT_ATTRIBUTES.ObjectName.Buffer struct entry
        //
        if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess((UINT64)NameBuf.Buffer, ObjectNameBuf, NameBuf.Length + sizeof(WCHAR)))
        {
            LogInfo("BadRead");
            PlatformMemFreePool(ObjectNameBuf);
 
            return NULL;
        }
 
        //
        // The caller is responsible for freeing the memory buffer, using PlatformMemFreePool()
        //
        return ObjectNameBuf;
    }
    return NULL;
}

TransparentHandleFirmwareInformationQuery()

UINT64 TransparentHandleFirmwareInformationQuery	(	UINT64	Ptr,
		UINT32	BufMaxSize,
		UINT64	BufSizePtr )

Handle the request for SystemFirmwareTableInformation.

Parameters

Ptr	The pointer to a valid read/writable SYSTEM_FIRMWARE_TABLE_INFORMATION memory buffer
BufMaxSize	The size of the allocated user-mode buffer
BufSizePtr	A pointer to a ULONG field containing the size of the written data

Returns

BOOLEAN

{
    ULONG BufSize = 0;
 
    //
    // Read the size of the data the kernel wrote in the buffer
    //
    if (!g_Callbacks.CheckAccessValidityAndSafety(BufSizePtr, sizeof(ULONG)) ||
        !g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(BufSizePtr, &BufSize, sizeof(ULONG)))
    {
        return 0;
    }
 
    //
    // If the memory buffer was too small for the kernel to write the needed information, bypass the mitigations
    //
    if (BufSize > BufMaxSize)
    {
        //
        // NOTE: might need zeroing the memory if the kernel did in fact write to the pointer
        //
        return 0;
    }
 
    //
    // If the buffer size is too big, we can't do any mitigations with the current implementation and it exceeds
    // the size of an EPT page, risking corruption when allocating the copy buffer space in root-mode.
    //
    if (BufMaxSize > PAGE_SIZE / 2)
    {
        LogInfo("The intercepted data buffer was too large for modification, in total 0x%x bytes", BufMaxSize);
        LogInfo("The system call return value was set to STATUS_INVALID_INFO_CLASS, but this could be detected as hypervisor intervention");
 
        return (UINT64)(UINT32)STATUS_INVALID_INFO_CLASS;
    }
 
    if (BufSize == 0)
    {
        BufSize = BufMaxSize;
    }
    //
    // From the user-mode pointer, read the SYSTEM_FIRMWARE_TABLE_INFORMATION struct
    //
    PVOID Buf = PlatformMemAllocateZeroedNonPagedPool(BufMaxSize + 1);
    if (Buf == NULL)
    {
        return 0;
    }
 
    if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Ptr, Buf, BufSize))
    {
        PlatformMemFreePool(Buf);
        return 0;
    }
 
    PSYSTEM_FIRMWARE_TABLE_INFORMATION StructBuf = (PSYSTEM_FIRMWARE_TABLE_INFORMATION)Buf;
 
    //
    // The request needs to be a "get" request for an existing table
    // with 'RSMB', 'ACPI' or 'FIRM' table providers
    //
    if (StructBuf->Action == SystemFirmwareTable_Get &&
        StructBuf->TableID != 0 &&
        (StructBuf->ProviderSignature == 0x52534D42 ||
         StructBuf->ProviderSignature == 0x41435049 ||
         StructBuf->ProviderSignature == 0x4649524D))
    {
        PCHAR StringBuf = (PCHAR)StructBuf->TableBuffer;
 
        for (ULONG i = 0; i < (sizeof(HV_FIRM_NAMES) / sizeof(HV_FIRM_NAMES[0])); i++)
        {
            for (ULONG j = 0; j < StructBuf->TableBufferLength; j++)
            {
                WORD  Count      = 0;
                PCHAR MatchStart = strstr(StringBuf + j, HV_FIRM_NAMES[i]);
                if (MatchStart != 0)
                {
                    LogInfo("Found Match for %s", HV_FIRM_NAMES[i]);
 
                    PCHAR NewVendorString  = NULL;
                    ULONG NewSubstringSize = 0;
 
                    //
                    // Replace the first occurace of the vendor string with AMERICAN MEGATRENDS INC.
                    // The rest with To Be Filled By O.E.M.
                    //
                    if (Count == 0)
                    {
                        NewVendorString  = "AMERICAN MEGATRENDS INC.";
                        NewSubstringSize = 24 * sizeof(CHAR);
                    }
                    else
                    {
                        NewVendorString  = "To Be Filled By O.E.M.";
                        NewSubstringSize = 22 * sizeof(CHAR);
                    }
 
                    //
                    // Obtain the lengths of all the strings and substring
                    //
 
                    ULONG MatchedStringLen = (ULONG)strlen(HV_FIRM_NAMES[i]);
                    ULONG OldLength        = StructBuf->TableBufferLength;
 
                    ULONG NewStringSize = OldLength - MatchedStringLen + NewSubstringSize;
 
                    //
                    // Check if the buffer size allows the modification, in case of expansion
                    //
                    if (BufSize - MatchedStringLen + NewSubstringSize > BufMaxSize)
                    {
                        //
                        // If adding the new string exceeds the user allocated size,
                        // zero out the buffer
                        //
                        memset(Buf, 0x0, BufMaxSize);
                        g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Ptr, Buf, BufMaxSize);
 
                        //
                        // Update the required buffer size for the next call
                        //
                        BufSize = (BufSize - OldLength) + NewStringSize;
                        g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(BufSizePtr, &BufSize, sizeof(ULONG));
 
                        //
                        // And return STATUS_BUFFER_TOO_SMALL error
                        //
 
                        PlatformMemFreePool(Buf);
                        return (UINT64)(UINT32)STATUS_BUFFER_TOO_SMALL;
                    }
 
                    //
                    // Calculate the positions of the replacement
                    //
                    ULONG MatchOffset = (ULONG)((MatchStart - StringBuf));
                    PCHAR MatchEnd    = StringBuf + MatchOffset + MatchedStringLen;
 
                    //
                    // Move the data after the matched string forward
                    // and replace the identified hypervisor string with the genuine one
                    //
                    memmove((PVOID)(StringBuf + MatchOffset + NewSubstringSize), (PVOID)MatchEnd, OldLength - MatchedStringLen - MatchOffset);
                    memcpy((PVOID)MatchStart, (PVOID)NewVendorString, NewSubstringSize);
 
                    StructBuf->TableBufferLength = NewStringSize;
                    BufSize                      = BufSize - MatchedStringLen + NewSubstringSize;
 
                    //
                    // Write the changes back to the user buffers
                    //
                    if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Ptr, Buf, BufSize))
                    {
                        LogInfo("Error writing to user-mode buffer: %llx", Ptr);
                    }
 
                    if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(BufSizePtr, &BufSize, sizeof(ULONG)))
                    {
                        LogInfo("Error writing to user-mode buffer: %llx", BufSizePtr);
                    }
                }
            }
        }
    }
 
    PlatformMemFreePool(Buf);
    return 1;
}

TransparentHandleModuleInformationQuery()

BOOLEAN TransparentHandleModuleInformationQuery	(	PVOID	Ptr,
		UINT64	VirtualAddress,
		UINT32	BufferSize )

Handle the request for SystemModuleInformation.

This function removes entries from a list of system drivers that could reveal the presence of hypervisors This depends on an incomplete list HV_DRIVER, of known hypervisor drivers The revealing list entries are removed and overwritten, but the memory buffer is not reallocated, so it is possible to still detect that some tampering was done from the user space

Parameters

Ptr	The pointer to a valid read/writable SYSTEM_MODULE_INFORMATION memory buffer
VirtualAddress	A pointer to a user-mode virtual address
BufferSize	Size of the user-mode buffer

Returns

BOOLEAN

{
    PSYSTEM_MODULE_INFORMATION StructBuf  = (PSYSTEM_MODULE_INFORMATION)Ptr;
    PSYSTEM_MODULE_ENTRY       ModuleList = StructBuf->Module;
 
    //
    // Traverse the list of system modules and remove the system drivers
    // matching a known list of hypervisor drivers based on their filename
    //
    for (UINT16 i = 0; i < StructBuf->Count; i++)
    {
        PCHAR Path = (PCHAR)ModuleList[i].FullPathName;
 
        for (UINT16 j = 0; j < (sizeof(HV_DRIVER) / sizeof(HV_DRIVER[0])); j++)
        {
            if (strstr(Path, HV_DRIVER[j]))
            {
                //
                // If a module file name matches, remove the entry from the list by shifting it forward by one entry
                //
                for (UINT16 k = i; k < StructBuf->Count - 1; k++)
                {
                    ModuleList[k] = ModuleList[k + 1];
                }
 
                //
                // Decrement the list size as one entry has been removed
                //
                i--;
                StructBuf->Count--;
 
                break;
            }
        }
    }
    if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(VirtualAddress, Ptr, BufferSize))
    {
        return FALSE;
    }
    return TRUE;
}

TransparentHandleNtEnumerateKeySyscall()

VOID TransparentHandleNtEnumerateKeySyscall

(

GUEST_REGS *

Regs

)

Handle The NtEnumerateKey system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    //
    // Set up the context parameters for the interception callback
    //
    SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
    ContextParams.OptionalParam1                  = Regs->r8;
    ContextParams.OptionalParam2                  = Regs->r9;
 
    //
    // Read the 5th argument of the system call from the stack at location %RSP + 0x28
    //
    if (g_Callbacks.CheckAccessValidityAndSafety(Regs->rsp + 0x28, sizeof(UINT64)))
    {
        g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess((UINT64)(Regs->rsp + 0x28), &ContextParams.OptionalParam3, sizeof(ULONG));
    }
    else
    {
        LogInfo("Process 0x%llx on thread %llx executed NtEnumerateKey systemcall but reading the provided arguments from %RSP failed", HANDLE_TO_UINT32(PsGetCurrentProcessId()), HANDLE_TO_UINT32(PsGetCurrentThreadId()));
        return;
    }
 
    //
    // Read the 6th argument of the system call from the stack at location %RSP + 0x30
    //
    if (g_Callbacks.CheckAccessValidityAndSafety(Regs->rsp + 0x30, sizeof(UINT64)))
    {
        g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess((UINT64)(Regs->rsp + 0x30), &ContextParams.OptionalParam4, sizeof(UINT64));
    }
    else
    {
        LogInfo("Process 0x%llx on thread %llx executed NtEnumerateKey systemcall but reading the provided arguments from %RSP failed", HANDLE_TO_UINT32(PsGetCurrentProcessId()), HANDLE_TO_UINT32(PsGetCurrentThreadId()));
        return;
    }
 
    //
    // If the call was made without an allocated buffer (with size 0)
    // we have no need to intercept it
    //
    if (ContextParams.OptionalParam3 == 0)
    {
        return;
    }
 
    //
    // Set the trap flag to intercept the SYSRET instruction
    //
    g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                       HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                       HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                       Regs->rax,
                                                       &ContextParams);
}

TransparentHandleNtOpenDirectoryObjectSyscall()

VOID TransparentHandleNtOpenDirectoryObjectSyscall

(

GUEST_REGS *

Regs

)

Handle The NtOpenDirectoryObject system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    //
    // Set up the context data for the callback after SYSRET
    //
    SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
    ContextParams.OptionalParam1                  = Regs->r10;
 
    //
    // Check if the pointer given as the 3rd argument to the system call with type POBJECT_ATTRIBUTES is valid
    //
    if (g_Callbacks.CheckAccessValidityAndSafety(Regs->r8, sizeof(OBJECT_ATTRIBUTES)))
    {
        //
        // From the POBJECT_ATTRIBUTES structure obtain the wide character string of the requested directory path
        //
        PVOID PathBuf = TransparentGetObjectNameFromAttributesVirtualPointer(Regs->r8);
        PWCH  DirPath = (PWCH)PathBuf;
 
        if (DirPath == NULL)
        {
            return;
        }
 
        //
        // If the directory object request is for a listed directory, insert the SYSCALL trap flag and continue execution
        //
        for (UINT16 j = 0; j < (sizeof(HV_DIRS) / sizeof(HV_DIRS[0])); j++)
        {
            if (wcsstr(DirPath, HV_DIRS[j]))
            {
                g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                                   HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                                   HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                                   Regs->rax,
                                                                   &ContextParams);
 
                break;
            }
        }
 
        //
        // Free the allocated copy of the directory path, obtained from TransparentGetObjectNameFromAttributesVirtualPointer()
        //
        PlatformMemFreePool(PathBuf);
    }
}

TransparentHandleNtOpenFileSyscall()

VOID TransparentHandleNtOpenFileSyscall

(

GUEST_REGS *

Regs

)

Handle The NtOpenFile system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    //
    // Check if the user-mode pointer in R8 to a OBJECT_ATTRIBUTES struct is valid
    //
    if (g_Callbacks.CheckAccessValidityAndSafety(Regs->r8, sizeof(OBJECT_ATTRIBUTES)))
    {
        //
        // From the OBJECT_ATTRIBUTES struct pointer extract the file path for which this syscall is called
        //
        PVOID NameBuf  = TransparentGetObjectNameFromAttributesVirtualPointer(Regs->r8);
        PWCH  FileName = (PWCH)NameBuf;
        if (FileName == NULL)
        {
            return;
        }
 
        //
        // Check if the requested file includes any hypervisor specific strings
        // This also checks parent directory names of the requested file
        //
        for (UINT16 j = 0; j < (sizeof(HV_FILES) / sizeof(HV_FILES[0])); j++)
        {
            if (wcsstr(FileName, HV_FILES[j]))
            {
                LogInfo("A call to NtOpenFile systemcall for a hypervisor specific file was made");
 
                //
                // If a match was found, corrupt the user-mode pointers in CPU registers, so that, when the kernel-mode execution continues, it would fail.
                //
                Regs->r8  = 0x0;
                Regs->r10 = 0x0;
 
                //
                // Set the trap flag to intercept the SYSRET instruction
                //
                SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
                g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                                   HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                                   HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                                   Regs->rax,
                                                                   &ContextParams);
 
                break;
            }
        }
        //
        // Clean up the allocated memory
        //
        PlatformMemFreePool(NameBuf);
    }
}

TransparentHandleNtOpenKeySyscall()

VOID TransparentHandleNtOpenKeySyscall

(

GUEST_REGS *

Regs

)

Handle The NtOpenKey system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    //
    // Check if the user-mode pointer in R8 to a OBJECT_ATTRIBUTES struct is valid
    //
    if (g_Callbacks.CheckAccessValidityAndSafety(Regs->r8, sizeof(OBJECT_ATTRIBUTES)))
    {
        //
        // From the OBJECT_ATTRIBUTES struct pointer extract the registry key path for which this syscall is called
        //
        PVOID NameBuf = TransparentGetObjectNameFromAttributesVirtualPointer(Regs->r8);
        PWCH  KeyName = (PWCH)NameBuf;
 
        if (KeyName == NULL)
        {
            LogInfo("BADRET");
            return;
        }
 
        //
        // Check if the requested registry entry path includes any hypervisor specific strings
        //
        for (UINT16 j = 0; j < (sizeof(HV_REGKEYS) / sizeof(HV_REGKEYS[0])); j++)
        {
            if (wcsstr(KeyName, HV_REGKEYS[j]) > 0)
            {
                //
                // If a match was found, corrupt the user-mode pointer in CPU registers, so that, when the kernel-mode execution continues, it would fail.
                //
                Regs->r8 = 0x0;
 
                //
                // Set the trap flag to intercept the SYSRET instruction
                //
                SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
                g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                                   HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                                   HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                                   Regs->rax,
                                                                   &ContextParams);
 
                break;
            }
        }
 
        //
        // Clean up the allocated memory
        //
        PlatformMemFreePool(NameBuf);
    }
}

TransparentHandleNtQueryAttributesFileSyscall()

VOID TransparentHandleNtQueryAttributesFileSyscall

(

GUEST_REGS *

Regs

)

Handle The NtQueryAttributesFile system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
    ContextParams.OptionalParam1                  = Regs->rdx;
 
    //
    // Check if the pointer given as the 3rd argument to the system call with type POBJECT_ATTRIBUTES is valid
    //
    if (g_Callbacks.CheckAccessValidityAndSafety(Regs->r10, sizeof(OBJECT_ATTRIBUTES)))
    {
        //
        // From the POBJECT_ATTRIBUTES structure obtain the wide character string of the requested file path
        //
        PVOID PathBuf  = TransparentGetObjectNameFromAttributesVirtualPointer(Regs->r10);
        PWCH  FilePath = (PWCH)PathBuf;
 
        //
        // If the file Attributes request is for a listed file, insert the SYSCALL trap flag and continue execution
        //
        for (UINT16 j = 0; j < (sizeof(HV_FILES) / sizeof(HV_FILES[0])); j++)
        {
            if (wcsstr(FilePath, HV_FILES[j]))
            {
                g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                                   HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                                   HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                                   Regs->rax,
                                                                   &ContextParams);
 
                break;
            }
        }
 
        //
        // Free the allocated copy of the directory path, obtained from TransparentGetObjectNameFromAttributesVirtualPointer()
        //
        PlatformMemFreePool(PathBuf);
    }
}

TransparentHandleNtQueryInformationProcessSyscall()

VOID TransparentHandleNtQueryInformationProcessSyscall

(

GUEST_REGS *

Regs

)

Handle The NtQueryInformationProcess system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    //
    // Set up the context parameters for the interception callback
    //
    SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
    ContextParams.OptionalParam1                  = Regs->rdx; // ProcessInformationClass
    ContextParams.OptionalParam2                  = Regs->r8;  // BufferPtr
    ContextParams.OptionalParam3                  = Regs->r9;  // BufferSize
 
    //
    // Set the trap flag to intercept the SYSRET instruction
    //
    g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                       HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                       HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                       Regs->rax,
                                                       &ContextParams);
}

TransparentHandleNtQuerySystemInformationSyscall()

VOID TransparentHandleNtQuerySystemInformationSyscall

(

GUEST_REGS *

Regs

)

Handle The NtQuerySystemInformation system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
 
    switch (Regs->r10)
    {
    case SystemProcessInformation:
    case SystemExtendedProcessInformation:
    {
        ContextParams.OptionalParam1 = SystemProcessInformation;
        ContextParams.OptionalParam2 = Regs->rdx;
        ContextParams.OptionalParam3 = Regs->r8 - 0x400;
 
        g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                           HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                           HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                           Regs->rax,
                                                           &ContextParams);
 
        break;
    }
    case SystemModuleInformation:
    {
        ContextParams.OptionalParam1 = SystemModuleInformation;
        ContextParams.OptionalParam2 = Regs->rdx;
        ContextParams.OptionalParam3 = Regs->r8;
 
        g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                           HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                           HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                           Regs->rax,
                                                           &ContextParams);
 
        break;
    }
    case SystemKernelDebuggerInformation:
    {
        ContextParams.OptionalParam1 = SystemKernelDebuggerInformation;
        ContextParams.OptionalParam2 = Regs->rdx;
        ContextParams.OptionalParam3 = Regs->r8;
 
        g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                           HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                           HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                           Regs->rax,
                                                           &ContextParams);
        break;
    }
    case SystemCodeIntegrityInformation:
    {
        ContextParams.OptionalParam1 = SystemCodeIntegrityInformation;
        ContextParams.OptionalParam2 = Regs->rdx;
        ContextParams.OptionalParam3 = 0x8;
 
        g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                           HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                           HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                           Regs->rax,
                                                           &ContextParams);
        break;
    }
 
    //
    // Currently SystemFirmwareTableInformation transparent handler is not implemented
    // As the queries produce a data buffer too large to safely copy and modify in root-mode
    //
 
    //    case SystemFirmwareTableInformation:
    //    {
    //
    //        ContextParams.OptionalParam1                  = SystemFirmwareTableInformation;
    //        ContextParams.OptionalParam2                  = Regs->rdx;
    //        ContextParams.OptionalParam3                  = Regs->r8;
    //        ContextParams.OptionalParam4                  = Regs->r9;
    //
    //        g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
    //                                           HANDLE_TO_UINT32(PsGetCurrentProcessId()),
    //                                           HANDLE_TO_UINT32(PsGetCurrentThreadId()),
    //                                           Regs->rax,
    //                                           &ContextParams);
    //        break;
    //    }
    default:
    {
        return;
    }
    }
}

TransparentHandleNtQueryValueKeySyscall()

VOID TransparentHandleNtQueryValueKeySyscall

(

GUEST_REGS *

Regs

)

Handle The NtQueryValueKey system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    //
    // Check if the user-mode pointer in RDX to a UNICODE_STRING struct is valid
    //
    if (g_Callbacks.CheckAccessValidityAndSafety(Regs->rdx, sizeof(UNICODE_STRING)))
    {
        UNICODE_STRING NameUString = {0};
 
        //
        // Read the UNICODE_STRING structure from a virtual address pointer, pointed to by RDX struct entry
        //
        if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Regs->rdx, &NameUString, sizeof(UNICODE_STRING)))
            return;
 
        //
        // Read the PWCH wide char string from the address pointer in the UNICODE_STRING
        //
        PVOID NameBuf = PlatformMemAllocateZeroedNonPagedPool(NameUString.Length + sizeof(WCHAR));
        if (NameBuf == NULL)
        {
            return;
        }
 
        if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess((UINT64)NameUString.Buffer, NameBuf, NameUString.Length + sizeof(WCHAR)))
        {
            PlatformMemFreePool(NameBuf);
            return;
        }
 
        PWCH KeyName = (PWCH)NameBuf;
 
        //
        // If the registry key request was for kay that could contain hypervisor specific information in its data,
        // the return buffer(%R9) needs to be modified, but the buffer length is in the user mode stack
        //
        for (ULONG i = 0; i < (sizeof(TRANSPARENT_DETECTABLE_REGISTRY_KEYS) / sizeof(TRANSPARENT_DETECTABLE_REGISTRY_KEYS[0])); i++)
        {
            if (!wcscmp(KeyName, TRANSPARENT_DETECTABLE_REGISTRY_KEYS[i]))
            {
                //
                // If a match is found, set up the context values and set the trap flag for the SYSRET callback
                //
 
                SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
 
                ContextParams.OptionalParam1 = Regs->r8;
                ContextParams.OptionalParam2 = Regs->r9;
 
                //
                // Read the 5th argument of the system call from the stack at location %RSP + 0x28
                //
                if (g_Callbacks.CheckAccessValidityAndSafety(Regs->rsp + 0x28, sizeof(UINT64)))
                {
                    g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess((UINT64)(Regs->rsp + 0x28), &ContextParams.OptionalParam3, sizeof(ULONG));
                }
                else
                {
                    LogInfo("Process 0x%llx on thread %llx executed NtQueryValueKey systemcall but reading the provided arguments from %RSP failed", HANDLE_TO_UINT32(PsGetCurrentProcessId()), HANDLE_TO_UINT32(PsGetCurrentThreadId()));
 
                    PlatformMemFreePool(NameBuf);
                    return;
                }
 
                //
                // Read the 6th argument of the system call from the stack at location %RSP + 0x30
                //
                if (g_Callbacks.CheckAccessValidityAndSafety(Regs->rsp + 0x30, sizeof(UINT64)))
                {
                    g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess((UINT64)(Regs->rsp + 0x30), &ContextParams.OptionalParam4, sizeof(UINT64));
                }
                else
                {
                    LogInfo("Process 0x%llx on thread %llx executed NtQueryValueKey systemcall but reading the provided arguments from %RSP failed", HANDLE_TO_UINT32(PsGetCurrentProcessId()), HANDLE_TO_UINT32(PsGetCurrentThreadId()));
 
                    PlatformMemFreePool(NameBuf);
                    return;
                }
 
                //
                // Set the trap flag to intercept the SYSRET instruction
                //
                g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                                   HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                                   HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                                   Regs->rax,
                                                                   &ContextParams);
 
                //
                // Clean-up and return to guest execution
                //
                PlatformMemFreePool(NameBuf);
                return;
            }
        }
 
        //
        // If the call was for a registry key that contains a hypervisor specific string,
        // The user-mode caller should just receive an error return code not a modified data buffer
        //
        for (UINT16 j = 1; j < (sizeof(HV_REGKEYS) / sizeof(HV_REGKEYS[0])); j++)
        {
            if (wcsstr(KeyName, HV_REGKEYS[j]) > 0)
            {
                //
                // When the match is found, corrupt the buffer pointers in the registers
                // and set the SYSRET callback trap flag
                //
                SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
 
                Regs->rdx = 0x0;
                Regs->r9  = 0x0;
 
                //
                // Set the trap flag to intercept the SYSRET instruction
                //
                g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                                   HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                                   HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                                   Regs->rax,
                                                                   &ContextParams);
 
                break;
            }
        }
 
        //
        // Clean up the allocated memory
        //
        PlatformMemFreePool(NameBuf);
    }
}

TransparentHandleNtSystemDebugControlSyscall()

VOID TransparentHandleNtSystemDebugControlSyscall

(

GUEST_REGS *

Regs

)

Handle The NtSystemDebugControl system call when the Transparent mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    //
    // Corrupt the system call arguments, to cause the kernel to return an error
    //
    Regs->r9 = 0x0;
 
    SYSCALL_CALLBACK_CONTEXT_PARAMS ContextParams = {0};
 
    //
    // Set the trap flag to intercept the SYSRET instruction
    //
    g_Callbacks.SyscallCallbackSetTrapFlagAfterSyscall(Regs,
                                                       HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                       HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                       Regs->rax,
                                                       &ContextParams);
}

TransparentHandleProcessInformationQuery()

BOOLEAN TransparentHandleProcessInformationQuery

(

SYSCALL_CALLBACK_CONTEXT_PARAMS *

Params

)

Handle the request for SystemProcessInformation.

This function removes entries from a list of active system processes that could reveal the presence of hypervisors

Parameters

Params

Preset transparent callback params that contain: in OptionalParam2 a pointer to a valid read/writable memory buffer that contains a SYSTEM_PROCESS_INFORMATION structure in OptionalParam3 max size in bytes of the allocated buffer

Returns

BOOLEAN

{
    SYSTEM_PROCESS_INFORMATION PrevStructBuf = {0};
    SYSTEM_PROCESS_INFORMATION CurStructBuf  = {0};
 
    ULONG   ReadOffset, WriteOffset;
    BOOLEAN MatchFound = FALSE;
    ULONG   PrevOffset = 0;
 
    if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Params->OptionalParam2, &PrevStructBuf, sizeof(SYSTEM_PROCESS_INFORMATION)))
    {
        return FALSE;
    }
 
    ReadOffset  = PrevStructBuf.NextEntryOffset;
    WriteOffset = 0;
 
    //
    // The first entry will always be System Idle Process, which can be skipped
    //
    if (PrevStructBuf.NextEntryOffset == 0 ||
        !g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Params->OptionalParam2 + ReadOffset, &CurStructBuf, sizeof(SYSTEM_PROCESS_INFORMATION)))
    {
        return FALSE;
    }
 
    //
    // Loop through all the entries and filter out the offending ones
    //
    do
    {
        MatchFound = FALSE;
 
        if (CurStructBuf.ImageName.Length != 0)
        {
            //
            // We need to search for the Image name of the process which requires extra allocation
            //
            PVOID StringBuf = PlatformMemAllocateZeroedNonPagedPool(CurStructBuf.ImageName.Length + sizeof(WCHAR));
 
            if (StringBuf == NULL)
            {
                LogInfo("Error allocating ImageName memory buffer");
 
                return FALSE;
            }
 
            //
            // Read the WCHAR process image name from the user-mode pointer
            //
            if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess((UINT64)CurStructBuf.ImageName.Buffer, StringBuf, CurStructBuf.ImageName.Length + sizeof(WCHAR)))
            {
                PlatformMemFreePool(StringBuf);
 
                return FALSE;
            }
 
            PWCH ImageName = (PWCH)StringBuf;
 
            if (ImageName == NULL)
            {
                PlatformMemFreePool(StringBuf);
 
                return FALSE;
            }
 
            //
            // Loop through the known list of identifiable hypervisor related processes
            //
            for (UINT16 i = 0; i < (sizeof(HV_PROCESSES) / sizeof(HV_PROCESSES[0])); i++)
            {
                if (!_wcsnicmp(ImageName, HV_PROCESSES[i], (CurStructBuf.ImageName.Length) / sizeof(WCHAR)))
                {
                    //
                    // If the name matches, bypass it by increasing the previous entries .nextEntryOffset value
                    //
 
                    //
                    // The offset to this matching entry need to preserved for zeroing later
                    //
                    PrevOffset = PrevStructBuf.NextEntryOffset;
 
                    PrevStructBuf.NextEntryOffset = PrevStructBuf.NextEntryOffset + CurStructBuf.NextEntryOffset;
 
                    MatchFound = TRUE;
 
                    //
                    // Write the modified offset back to the usermode buffer
                    //
                    if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess((UINT64)(Params->OptionalParam2 + WriteOffset), &PrevStructBuf, sizeof(SYSTEM_PROCESS_INFORMATION)))
                    {
                        LogError("Failed to modify memory buffer for the SystemProcessInformation query system call");
                    }
 
                    //
                    // The entry gets bypassed, but since the Image name is a pointer in the struct, to completely clear any presence of these processes
                    // zero out the name buffer as well
                    //
                    memset(StringBuf, 0x0, CurStructBuf.ImageName.Length);
                    ULONG BufOffset = (ULONG)((PBYTE)&CurStructBuf.ImageName.Length - (PBYTE)&CurStructBuf) + sizeof(USHORT);
 
                    if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess((UINT64)(Params->OptionalParam2 + WriteOffset + PrevOffset + BufOffset), StringBuf, CurStructBuf.ImageName.Length))
                    {
                        LogError("Failed to modify memory buffer for the SystemProcessInformation query system call");
                    }
 
                    break;
                }
            }
 
            PlatformMemFreePool(StringBuf);
        }
 
        //
        // If the last entry been reached, exit
        //
        if (CurStructBuf.NextEntryOffset == 0)
        {
            return TRUE;
        }
 
        //
        // If the current entry did not match any process names, move forward
        //
        if (!MatchFound)
        {
            WriteOffset += PrevStructBuf.NextEntryOffset;
 
            PrevStructBuf = CurStructBuf;
        }
 
        //
        // Move over to the next entry
        //
        ReadOffset += CurStructBuf.NextEntryOffset;
 
        //
        // Some internal Windows calls to this system call use different offsetting/entry structure layout and causes errors
        //
        if (!g_Callbacks.CheckAccessValidityAndSafety((UINT64)(Params->OptionalParam2 + ReadOffset), sizeof(SYSTEM_PROCESS_INFORMATION)))
        {
            return FALSE;
        }
 
        //
        // Zero out the matching entry, so that its data doesn't remain in memory
        //
        if (MatchFound)
        {
            CurStructBuf = (SYSTEM_PROCESS_INFORMATION) {0};
            if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess((UINT64)(Params->OptionalParam2 + WriteOffset + PrevOffset), &CurStructBuf, sizeof(SYSTEM_PROCESS_INFORMATION)))
            {
                return FALSE;
            }
        }
 
        //
        // Read from the user buffer the next process entry
        //
        if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Params->OptionalParam2 + ReadOffset, &CurStructBuf, sizeof(SYSTEM_PROCESS_INFORMATION)))
        {
            return FALSE;
        }
 
    } while (TRUE);
 
    return TRUE;
}

TransparentHandleSystemCallHook()

VOID TransparentHandleSystemCallHook

(

GUEST_REGS *

Regs

)

Handle The triggered hook on KiSystemCall64 system call handler when the Transparency mode is enabled.

Parameters

Regs	The virtual processor's state of registers

Returns

VOID

{
    //
    // If the transparent mode is not enabled, do nothing
    //
    if (!g_TransparentMode)
    {
        return;
    }
 
    PCHAR  CallingProcess = g_Callbacks.CommonGetProcessNameFromProcessControlBlock(PsGetCurrentProcess());
    UINT64 Context        = Regs->rax;
 
    //
    // Skip the transparent mitigations of system calls when the caller process
    // is a Windows process that should receive unmodified data
    //
    for (ULONG i = 0; i < (sizeof(TRANSPARENT_WIN_PROCESS_IGNORE) / sizeof(TRANSPARENT_WIN_PROCESS_IGNORE[0])); i++)
    {
        if (strstr(CallingProcess, TRANSPARENT_WIN_PROCESS_IGNORE[i]))
        {
            return;
        }
    }
 
    if (Context == g_SystemCallNumbersInformation.SysNtQuerySystemInformation ||
        Context == g_SystemCallNumbersInformation.SysNtQuerySystemInformationEx)
    {
        //
        // Handle the NtQuerySystemInformation System call
        //
 
        TransparentHandleNtQuerySystemInformationSyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtSystemDebugControl)
    {
        //
        // Handle the NtSystemDebugControl System call
        //
        TransparentHandleNtSystemDebugControlSyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtQueryAttributesFile)
    {
        //
        // Handle the NtQueryAttributesFile System call
        //
        TransparentHandleNtQueryAttributesFileSyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtOpenDirectoryObject)
    {
        //
        // Handle the NtOpenDirectoryObject System call
        //
        TransparentHandleNtOpenDirectoryObjectSyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtQueryDirectoryObject)
    {
        //
        // Handle the NtQueryDirectoryObject System call
        //
        // TransparentHandleNtQueryDirectoryObjectSyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtQueryInformationProcess)
    {
        //
        // Handle the NtQueryInformationProcess System call
        //
        TransparentHandleNtQueryInformationProcessSyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtQueryInformationThread)
    {
        //
        // Handle the NtQueryInformationThread System call
        //
        // TransparentHandleNtQueryInformationThreadSyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtOpenFile)
    {
        //
        // Handle the NtOpenFile System call
        //
        TransparentHandleNtOpenFileSyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtOpenKeyEx || Context == g_SystemCallNumbersInformation.SysNtOpenKey)
    {
        //
        // Handle the NtOpenKey System call
        //
        TransparentHandleNtOpenKeySyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtQueryValueKey)
    {
        //
        // Handle the NtQueryValueKey System call
        //
        TransparentHandleNtQueryValueKeySyscall(Regs);
    }
    else if (Context == g_SystemCallNumbersInformation.SysNtEnumerateKey)
    {
        //
        // Handle the NtEnumerateKey System call
        //
        TransparentHandleNtEnumerateKeySyscall(Regs);
    }
    else
    {
        //
        // The syscall is not important to us
        //
    }
}

TransparentReplaceVendorStringFromBufferWChar()

UINT64 TransparentReplaceVendorStringFromBufferWChar	(	SYSCALL_CALLBACK_CONTEXT_PARAMS *	Params,
		ULONG	DataOffset,
		ULONG	DataLenOffset )

Replace occurrences of a hypervisor specific strings with legitimate vendor strings in a provided buffer.

Parameters

Params	Set transparent callback params that contain: in OptionalParam2 a pointer to a valid read/writable memory buffer that contains both, a WCHAR string and its length in bytes in OptionalParam3 max size in bytes of the allocated buffer in OptionalParam4 a pointer to a ULONG containing current size of the buffer
DataOffset	Offset in bytes from OptionalParam2 to the start of the WCHAR data string
DataLenOffset	Offset in bytes from OptionalParam2 to a ULONG containing the string length(in bytes)

Returns

UINT64

{
    PVOID   Buf       = NULL;
    BOOLEAN PoolAlloc = FALSE;
 
    //
    // Check that the user provided pointers are safe to read from
    //
    if (g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam4, sizeof(ULONG)))
    {
        //
        // Read the size of the data that the kernel wrote to the buffer
        //
        ULONG BufSize = 0;
        if (!g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Params->OptionalParam4, &BufSize, sizeof(ULONG)))
        {
            goto ReturnWithError;
        }
 
        //
        // If the data the kernel wanted to write is bigger than what was allocated by the user
        //
        if (BufSize > Params->OptionalParam3 || BufSize == 0)
        {
            //
            // NOTE: might need zeroing the memory if the kernel did in fact write to the pointer
            //
 
            return 0;
        }
 
        //
        // Check that the user provided pointers are safe to read from and the buffer is not too large
        //
        if (Params->OptionalParam3 >= 0xC00 || !g_Callbacks.CheckAccessValidityAndSafety(Params->OptionalParam2, (UINT32)Params->OptionalParam3))
        {
            goto ReturnWithError;
        }
 
        //
        // If the buffer is small, e.g. for just a single word, store it on the stack
        // else, allocate a nonpaged memory buffer
        //
        CHAR StackBuf[MAX_PATH] = {0};
 
        if (Params->OptionalParam3 + sizeof(WCHAR) > MAX_PATH)
        {
            Buf       = PlatformMemAllocateZeroedNonPagedPool(Params->OptionalParam3 + sizeof(WCHAR));
            PoolAlloc = TRUE;
        }
        else
        {
            Buf = &StackBuf;
        }
 
        if (!Buf || !g_Callbacks.MemoryMapperReadMemorySafeOnTargetProcess(Params->OptionalParam2, Buf, Params->OptionalParam3))
        {
            goto ReturnWithError;
        }
 
        //
        // Get the actual data we are trying to modify(in wide char form)
        //
        PWCH StringBuf = (PWCH)((PBYTE)Buf + DataOffset);
 
        //
        // Traverse the list of registry key names and vendor strings that are specific to common hypervisors
        // if a match is found perform the modification
        //
        for (UINT16 i = 0; i < (sizeof(HV_REGKEYS) / sizeof(HV_REGKEYS[0])); i++)
        {
            PWCH MatchStart = wcsstr(StringBuf, HV_REGKEYS[i]);
 
            while (MatchStart != 0)
            {
                PWCH NewVendorString = NULL;
 
                //
                // If the match was for a device id, the replacement should be with a different ID string not vendor name
                //
                if (i < 3)
                {
                    //
                    // SPOOFS PCI device ID's(in the registry), This might be implemented in other ways that are not part of this implementation
                    //
                    WORD Idx        = g_TransparentGenuineVendorStringIndex % (sizeof(TRANSPARENT_LEGIT_DEVICE_ID_VENDOR_STRINGS_WCHAR) / sizeof(TRANSPARENT_LEGIT_DEVICE_ID_VENDOR_STRINGS_WCHAR[0]));
                    NewVendorString = TRANSPARENT_LEGIT_DEVICE_ID_VENDOR_STRINGS_WCHAR[Idx];
                }
 
                //
                // Remove common VM strings from the data
                //
                else if (i < 9)
                {
                    NewVendorString = L" ";
                }
                else
                {
                    //
                    // Obtain the replacement vendor name string, randomized when the transparency mode was enabled
                    //
                    NewVendorString = TRANSPARENT_LEGIT_VENDOR_STRINGS_WCHAR[g_TransparentGenuineVendorStringIndex];
                }
 
                //
                // Obtain the lengths of all the strings and substring
                //
                ULONG TempSize = (ULONG)wcslen(NewVendorString) * sizeof(WCHAR);
 
                ULONG MatchedStringLen = (ULONG)wcslen(HV_REGKEYS[i]) * sizeof(WCHAR);
                ULONG OldLength        = *((PBYTE)Buf + DataLenOffset);
 
                ULONG NewStringSize = OldLength - MatchedStringLen + TempSize;
 
                //
                // Check if the buffer size allows the modification, in case of expansion
                //
                if (BufSize - MatchedStringLen + TempSize > Params->OptionalParam3)
                {
                    //
                    // If adding the new string exceeds the user allocated size,
                    // zero out the buffer
                    //
                    memset(Buf, 0x0, Params->OptionalParam3);
                    g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam2, Buf, Params->OptionalParam3);
 
                    //
                    // Update the required buffer size for the next call
                    //
                    BufSize = (TempSize - MatchedStringLen) + OldLength;
                    g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam4, &BufSize, sizeof(ULONG));
 
                    //
                    // And return STATUS_BUFFER_OVERFLOW error
                    //
 
                    if (PoolAlloc)
                        PlatformMemFreePool(Buf);
                    return (UINT64)(UINT32)STATUS_BUFFER_OVERFLOW;
                }
 
                //
                // Calculate the positions of the replacement
                //
                ULONG MatchOffset = (ULONG)((MatchStart - StringBuf));
                PWCH  MatchEnd    = StringBuf + MatchOffset + (MatchedStringLen / sizeof(WCHAR));
 
                //
                // Move the data after the matched string forward
                //
                memmove((PVOID)(StringBuf + MatchOffset + (TempSize / sizeof(WCHAR))), (PVOID)MatchEnd, OldLength - MatchedStringLen - (MatchOffset * sizeof(WCHAR)));
 
                //
                // Replace the identified hypervisor string with the genuine one, if needed
                //
                memcpy((PVOID)MatchStart, (PVOID)NewVendorString, TempSize);
 
                *(PULONG)((PBYTE)Buf + DataLenOffset) = NewStringSize;
                BufSize                               = BufSize - MatchedStringLen + TempSize;
 
                //
                // Write the changes back to the user buffers
                //
                if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam2, Buf, BufSize))
                {
                    goto ReturnWithError;
                }
 
                if (!g_Callbacks.MemoryMapperWriteMemorySafeOnTargetProcess(Params->OptionalParam4, &BufSize, sizeof(ULONG)))
                {
                    goto ReturnWithError;
                }
 
                //
                // Cleanup
                //
 
                MatchStart = wcsstr(StringBuf, HV_REGKEYS[i]);
 
                if (!MatchStart)
                    i = 0;
            }
        }
 
        //
        // The data buffer contained no detectable strings
        //
        if (PoolAlloc)
            PlatformMemFreePool(Buf);
        return 0;
    }
 
    //
    // An error occurred while performing the mitigations, the user buffer might be left unmodified
    //
ReturnWithError:
    LogInfo("A call for to read a registry entry, which could contain hypervisor specific data, was intercepted but the mitigations failed");
    LogInfo("The caller process received the results in this virtual address: %llx", Params->OptionalParam2);
 
    if (Buf != NULL)
    {
        if (PoolAlloc)
            PlatformMemFreePool(Buf);
    }
 
    return 0;
}