/** * @file Logging.h * @author Sina Karvandi (sina@hyperdbg.org) * @brief Headers of Message logging and tracing * @details * @version 0.1 * @date 2020-04-11 * * @copyright This project is released under the GNU Public License v3. * */ #pragma once ////////////////////////////////////////////////// // Global Variables // ////////////////////////////////////////////////// /** * @brief VMX buffer for logging messages * */ CHAR * g_VmxLogMessage; /** * @brief VMX temporary buffer for logging messages * */ CHAR * g_VmxTempMessage; ////////////////////////////////////////////////// // Structures // ////////////////////////////////////////////////// /** * @brief The usermode request * */ typedef struct _NOTIFY_RECORD { NOTIFY_TYPE Type; union { PKEVENT Event; PIRP PendingIrp; } Message; KDPC Dpc; BOOLEAN CheckVmxRootMessagePool; // Set so that notify callback can understand where to check (Vmx root or Vmx non-root) } NOTIFY_RECORD, *PNOTIFY_RECORD; /** * @brief Message buffer structure * */ typedef struct _BUFFER_HEADER { UINT32 OperationNumber; // Operation ID to user-mode UINT32 BufferLength; // The actual length BOOLEAN Valid; // Determine whether the buffer was valid to send or not } BUFFER_HEADER, *PBUFFER_HEADER; /** * @brief Core-specific buffers * */ typedef struct _LOG_BUFFER_INFORMATION { KSPIN_LOCK BufferLock; // SpinLock to protect access to the queue KSPIN_LOCK BufferLockForNonImmMessage; // SpinLock to protect access to the queue of non-imm messages UINT64 BufferForMultipleNonImmediateMessage; // Start address of the buffer for accumulating non-immediate messages UINT32 CurrentLengthOfNonImmBuffer; // the current size of the buffer for accumulating non-immediate messages // // Regular buffers // UINT64 BufferStartAddress; // Start address of the buffer UINT64 BufferEndAddress; // End address of the buffer UINT32 CurrentIndexToSend; // Current buffer index to send to user-mode UINT32 CurrentIndexToWrite; // Current buffer index to write new messages // // Priority buffers // UINT64 BufferStartAddressPriority; // Start address of the buffer UINT64 BufferEndAddressPriority; // End address of the buffer UINT32 CurrentIndexToSendPriority; // Current buffer index to send to user-mode for priority buffers UINT32 CurrentIndexToWritePriority; // Current buffer index to write new messages for priority buffers } LOG_BUFFER_INFORMATION, *PLOG_BUFFER_INFORMATION; ////////////////////////////////////////////////// // Global Variables // ////////////////////////////////////////////////// /** * @brief Global Variable for buffer on all cores * */ LOG_BUFFER_INFORMATION * g_MessageBufferInformation; /** * @brief Vmx-root lock for logging * */ volatile LONG g_VmxRootLoggingLock; /** * @brief Vmx-root lock for logging * */ volatile LONG g_VmxRootLoggingLockForNonImmBuffers; ////////////////////////////////////////////////// // Illustration // ////////////////////////////////////////////////// /* A core buffer is like this , it's divided into MaximumPacketsCapacity chucks, each chunk has PacketChunkSize + sizeof(BUFFER_HEADER) size _________________________ | BUFFER_HEADER | |_________________________| | | | BODY | | (Buffer) | | size = PacketChunkSize | | | |_________________________| | BUFFER_HEADER | |_________________________| | | | BODY | | (Buffer) | | size = PacketChunkSize | | | |_________________________| | | | | | | | | | | | . | | . | | . | | | | | | | |_________________________| | BUFFER_HEADER | |_________________________| | | | BODY | | (Buffer) | | size = PacketChunkSize | | | |_________________________| */ ////////////////////////////////////////////////// // Global Variables // ////////////////////////////////////////////////// /** * @brief Save the state of the thread that waits for messages to deliver to user-mode * */ NOTIFY_RECORD * g_GlobalNotifyRecord; /** * @brief Global variable that holds callbacks * */ MESSAGE_TRACING_CALLBACKS g_MsgTracingCallbacks; ////////////////////////////////////////////////// // Functions // ////////////////////////////////////////////////// BOOLEAN LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLength); VOID LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2);