MMVAD.hh

Go to the documentation of this file.

/*
 * Copyright 2021 Assured Information Security, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *         http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#pragma once
 
#include <introvirt/core/memory/guest_ptr.hh>
#include <introvirt/windows/kernel/nt/const/MEMORY_ALLOCATION_TYPE.hh>
#include <introvirt/windows/kernel/nt/const/PAGE_PROTECTION.hh>
#include <introvirt/windows/kernel/nt/fwd.hh>
 
#include <cstdint>
#include <memory>
#include <string>
#include <vector>
 
namespace introvirt {
namespace windows {
namespace nt {
 
enum class VadStructure {
    MMVAD_SHORT,
    MMVAD,
 
    UNKNOWN
};
 
class MMVAD {
  public:
    enum VadType {
        VadNone = 0,
        VadDevicePhysicalMemory,
        VadImageMap,
        VadAwe,
        VadWriteWatch,
        VadLargePages,
        VadRotatePhysical,
        VadLargePageSection
    };
 
    virtual std::string tag() const = 0;
 
    virtual VadStructure structure() const = 0;
 
    virtual uint64_t CommitCharge() const = 0;
 
    virtual uint64_t StartingVpn() const = 0;
    virtual uint64_t EndingVpn() const = 0;
    virtual const FILE_OBJECT* FileObject() const = 0;
    virtual std::shared_ptr<const MMVAD> LeftChild() const = 0;
    virtual std::shared_ptr<const MMVAD> RightChild() const = 0;
    virtual std::shared_ptr<const MMVAD> Parent() const = 0;
    virtual VadType Type() const = 0;
    virtual PAGE_PROTECTION Protection() const = 0;
    virtual const MEMORY_ALLOCATION_TYPE& Allocation() const = 0;
    virtual bool Private() const = 0;
 
    virtual uint64_t RegionSize() const = 0;
 
    virtual uint64_t StartingAddress() const = 0;
 
    virtual uint64_t EndingAddress() const = 0;
 
    virtual guest_ptr<void> ptr() const = 0;
 
    virtual bool locked() const = 0;
 
    virtual std::vector<std::shared_ptr<const MMVAD>> VadTreeInOrder() const = 0;
 
    virtual uint64_t FirstPrototypePte() const = 0;
    virtual uint64_t LastContiguousPte() const = 0;
 
    virtual std::shared_ptr<const MMVAD> search(uint64_t virtual_address) const = 0;
 
    virtual ~MMVAD() = default;
};
 
const std::string& to_string(MMVAD::VadType);
 
std::ostream& operator<<(std::ostream&, MMVAD::VadType);
 
const std::string& to_string(VadStructure);
 
std::ostream& operator<<(std::ostream&, VadStructure);
 
} // namespace nt
} // namespace windows
} // namespace introvirt