NtKernel.hh

Go to the documentation of this file.

/*
 * Copyright 2021 Assured Information Security, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *         http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#pragma once
 
#include <introvirt/core/memory/guest_ptr.hh>
#include <introvirt/windows/kernel/nt/types/LDR_DATA_TABLE_ENTRY.hh>
 
#include <introvirt/core/fwd.hh>
#include <introvirt/windows/fwd.hh>
 
#include <mspdb/PDB.hh>
 
#include <cstdint>
#include <memory>
#include <string>
 
namespace introvirt {
namespace windows {
namespace nt {
 
class NtKernel {
  public:
    virtual const DBGKD_GET_VERSION64& KdVersionBlock() const = 0;
 
    virtual const KDDEBUGGER_DATA64& KdDebuggerDataBlock() const = 0;
 
    virtual const ServiceDescriptorTable& KeServiceDescriptorTable() const = 0;
 
    virtual const ServiceDescriptorTable& KeServiceDescriptorTableShadow() const = 0;
 
    virtual bool hasObHeaderCookie() const = 0;
 
    virtual uint8_t ObHeaderCookie() const = 0;
 
    virtual const nt::NtBuildLab& NtBuildLab() const = 0;
 
    virtual uint16_t NtBuildNumber() const = 0;
 
    virtual uint16_t MajorVersion() const = 0;
 
    virtual uint16_t MinorVersion() const = 0;
 
    virtual unsigned int cpu_count() const = 0;
 
    // virtual bool x64() const = 0;
 
    virtual guest_ptr<void> symbol(const std::string& name) const = 0;
 
    virtual const guest_ptr<void>& ptr() const = 0;
 
    virtual uint64_t InvalidPteMask() const = 0;
 
    virtual const TypeTable& types() const = 0;
 
    virtual const pe::PE& pe() const = 0;
 
    // virtual const mspdb::PDB& pdb() const = 0;
 
    virtual std::shared_ptr<OBJECT_DIRECTORY> RootDirectoryObject() const = 0;
 
    virtual std::unique_ptr<HANDLE_TABLE> CidTable() = 0;
 
    virtual std::unique_ptr<const HANDLE_TABLE> CidTable() const = 0;
 
    virtual std::vector<std::shared_ptr<const LDR_DATA_TABLE_ENTRY>> PsLoadedModuleList() const = 0;
 
    virtual std::string get_device_drive_letter(const nt::DEVICE_OBJECT& device) const = 0;
 
    virtual KPCR& kpcr(const Vcpu& vcpu) = 0;
 
    virtual const KPCR& kpcr(const Vcpu& vcpu) const = 0;
 
    virtual const WindowsGuest& guest() const = 0;
 
    virtual bool x64() const = 0;
 
    virtual const mspdb::PDB& pdb() const = 0;
 
    virtual std::shared_ptr<THREAD> thread(const guest_ptr<void>& ptr) const = 0;
 
    virtual std::shared_ptr<PROCESS> process(const guest_ptr<void>& ptr) const = 0;
 
    virtual std::string profile_path() const = 0;
 
    virtual ~NtKernel() = default;
};
 
} // namespace nt
} // namespace windows
} // namespace introvirt