Functions — github.com/DarthTon/HyperBone

hub / github.com/DarthTon/HyperBone / functions

Functions89 in github.com/DarthTon/HyperBone

⨍ Functions 89 ◇ Types & classes 49

↓ 15 callersFunctionVmcsRead

<summary> Read VMCS field </summary> <param name="VmcsFieldId">Field encoding</param> <returns>Data</returns>

src/Arch/Intel/VMCS.h:196

↓ 9 callersFunctionVmxpAdvanceEIP

<summary> Advance guest EIP to the next instruction </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:128

↓ 8 callersFunctionVmxpConvertGdtEntry

<summary> Fill segment data </summary> <param name="GdtBase">GDTR base</param> <param name="Selector">Segment selector value</param> <param name="VmxG

src/Arch/Intel/VMX.c:320

↓ 6 callersFunctionEptUpdateTableRecursive

<summary> Update EPT entry </summary> <param name="pEPTData">CPU EPT data</param> <param name="pTable">EPT table</param> <param name="level">EPT table

src/Arch/Intel/EPT.c:170

↓ 6 callersFunctionVmxInjectEvent

<summary> Inject interrupt or exception into guest </summary> <param name="InterruptType">INterrupt type</param> <param name="Vector">IDT index</param

src/Arch/Intel/VMX.c:114

↓ 5 callersFunctionVmxpAdjustMsr

<summary> Adjust VMX control accordingly to MSR </summary> <param name="ControlValue">MSR value to consult</param> <param name="DesiredValue">Target c

src/Arch/Intel/VMX.c:362

↓ 4 callersFunctionEptpTableOffset

<summary> EPT entry index in table </summary> <param name="pfn">EPT PFN</param> <param name="level">EPT level</param> <returns>Table index</returns>

src/Arch/Intel/EPT.c:69

↓ 4 callersFunctionUtilProtectNonpagedMemory

<summary> Change protection of nonpaged system address </summary> <param name="ptr">Address</param> <param name="size">Size of region</param> <param n

src/Util/Utils.c:235

↓ 3 callersFunctionFreeGlobalData

<summary> Free global data </summary> <param name="pData">Data pointer</param>

src/HyperBone.c:68

↓ 3 callersFunctionPHGetHookEntry

<summary> Get hook data by function pointer </summary> <param name="ptr">Function address</param> <returns>Found entry or NULL</returns>

src/Hooks/PageHook.c:258

↓ 3 callersFunctionTestFn

src/Test/Tests.c:32

↓ 3 callersFunctionUtilCPUVendor

<summary> Get CPU vendor </summary> <returns>Intel or AMD. If failed - Other</returns>

src/Util/Utils.c:15

↓ 3 callersFunctionUtilKernelBase

<summary> Get ntoskrnl base address </summary> <param name="pSize">Size of module</param> <returns>Found address, NULL if not found</returns>

src/Util/Utils.c:37

↓ 3 callersFunctionldasm

src/Util/LDasm.c:605

↓ 2 callersFunctionEptFreeIdentityMap

<summary> Release Guest to Host page mappings </summary> <param name="pEPT">CPU EPT data</param> <returns>Status code</returns>

src/Arch/Intel/EPT.c:289

↓ 2 callersFunctionEptpAllocatePage

<summary> Allocate page for PTE table </summary> <param name="pEPT">CPU EPT data</param> <returns>Allocated page or NULL</returns>

src/Arch/Intel/EPT.c:99

↓ 2 callersFunctionIntelRestoreCPU

src/Core/HVM.c:37

↓ 2 callersFunctionPHHook

<summary> Hook function </summary> <param name="pFunc">Function address</param> <param name="pHook">Hook address</param> /// <param name="Type">Hook t

src/Hooks/PageHook.c:140

↓ 2 callersFunctionPHRestore

<summary> Restore hooked function </summary> <param name="pFunc">Function address</param> <returns>Status code</returns>

src/Hooks/PageHook.c:218

↓ 2 callersFunctionPHpInitJumpThunk

<summary> Construct jump </summary> <param name="pThunk">Data to initialize</param> <param name="To">Address of jump</param>

src/Hooks/PageHook.c:32

↓ 2 callersFunctionStopHV

<summary> Devirtualize each CPU </summary> <returns>Status code</returns>

src/Core/HVM.c:110

↓ 2 callersFunctionUtilSSDTBase

<summary> Gets SSDT base - KiServiceTable </summary> <returns>SSDT base, NULL if not found</returns>

src/Util/Utils.c:109

↓ 2 callersFunctionUtilSSDTEntry

<summary> Gets the SSDT entry address by index. </summary> <param name="index">Service index</param> <returns>Found service address, NULL if not found

src/Util/Utils.c:154

↓ 2 callersFunctionUtilSearchPattern

<summary> Search for pattern </summary> <param name="pattern">Pattern to search for</param> <param name="wildcard">Used wildcard</param> <param name="

src/Util/Utils.c:261

↓ 2 callersFunctioncflags

src/Util/LDasm.c:594

↓ 1 callersFunctionAMDRestoreCPU

src/Core/HVM.c:51

↓ 1 callersFunctionAMDSubvertCPU

src/Core/HVM.c:44

↓ 1 callersFunctionAllocGlobalData

<summary> Allocate global data </summary> <returns>Allocated data or NULL</returns>

src/HyperBone.c:20

↓ 1 callersFunctionEptBuildIdentityMap

<summary> Create Guest to Host page mappings </summary> <param name="pEPT">CPU EPT data</param> <returns>Status code</returns>

src/Arch/Intel/EPT.c:267

↓ 1 callersFunctionEptEnable

<summary> Enable EPT for CPU </summary> <param name="PML4">PML4 pointer to use</param>

src/Arch/Intel/EPT.c:15

↓ 1 callersFunctionEptpAllocatePageHighIRQL

<summary> Allocate page at IRQL > DISPATCH_LEVEL </summary> <param name="pEPT">CPU EPT data</param> <returns>Allocated page or NULL</returns>

src/Arch/Intel/EPT.c:80

↓ 1 callersFunctionEptpFillTable

<summary> Fill PML4 table accordingly to used physical regions </summary> <param name="pEPT">CPU EPT data</param> <param name="PML4Ptr">EPT PML4 point

src/Arch/Intel/EPT.c:229

↓ 1 callersFunctionHvmCheckFeatures

<summary> CPU virtualization features </summary>

src/Core/HVM.c:22

↓ 1 callersFunctionHvmIsHVSupported

<summary> Check if VT-x/AMD-V is supported </summary> <returns>TRUE if supported</returns>

src/Core/HVM.c:10

↓ 1 callersFunctionIntelSubvertCPU

Vendor-specific calls

src/Core/HVM.c:32

↓ 1 callersFunctionPHGetHookEntryByPFN

<summary> Get hook data by Physical page frame number </summary> <param name="pfn">PFN</param> <param name="Type">Page type</param> <returns>Found hoo

src/Hooks/PageHook.c:324

↓ 1 callersFunctionPHGetHookEntryByPage

<summary> Get hook data by page address </summary> <param name="ptr">Function pointer</param> <param name="Type">Page type</param> <returns>Found hook

src/Hooks/PageHook.c:302

↓ 1 callersFunctionPHPageHookCount

<summary> Get number of hooks in one page </summary> <param name="ptr">Function address</param> <param name="Type">Page type</param> <returns>Number o

src/Hooks/PageHook.c:279

↓ 1 callersFunctionPHpCopyCode

<summary> Copy original bytes using LDASM </summary> <param name="pFunc">Original function ptr</param> <param name="OriginalStore">Buffer to store byt

src/Hooks/PageHook.c:69

↓ 1 callersFunctionSHDestroyHook

<summary> Unhook LSTAR </summary> <returns>Status code</returns>

src/Hooks/SyscallHook.c:84

↓ 1 callersFunctionSHHookSyscall

<summary> Hook specific SSDT entry </summary> <param name="index">SSDT index</param> <param name="hookPtr">Hook address</param> <param name="argCount"

src/Hooks/SyscallHook.c:103

↓ 1 callersFunctionSHInitHook

<summary> Perform LSTAR hooking </summary> <returns>Status code</returns>

src/Hooks/SyscallHook.c:40

↓ 1 callersFunctionSHRestoreSyscall

<summary> Restore original SSDT entry </summary> <param name="index">SSDT index</param> <returns>Status code</returns>

src/Hooks/SyscallHook.c:128

↓ 1 callersFunctionStartHV

<summary> Virtualize each CPU </summary> <returns>Status code</returns>

src/Core/HVM.c:86

↓ 1 callersFunctionTestPageHook

src/Test/Tests.c:52

↓ 1 callersFunctionTestPrintResults

src/Test/Tests.c:112

↓ 1 callersFunctionTestStart

src/Test/Tests.c:72

↓ 1 callersFunctionTestStop

src/Test/Tests.c:105

↓ 1 callersFunctionToggleMTF

<summary> Turn MTF on/off </summary> <param name="State">Enable/Disable</param>

src/Arch/Intel/VMX.h:336

↓ 1 callersFunctionUtilQueryPhysicalMemory

<summary> Gather info about used physical pages </summary> <returns>Status code</returns>

src/Util/Utils.c:176

↓ 1 callersFunctionUtilScanSection

<summary> Find pattern in kernel PE section </summary> <param name="section">Section name</param> <param name="pattern">Pattern data</param> <param na

src/Util/Utils.c:305

↓ 1 callersFunctionVmxCheckFeatures

<summary> Check various VMX features: EPT, VPID, VMFUNC, etc. </summary>

src/Arch/Intel/VMX.c:68

↓ 1 callersFunctionVmxEnterRoot

<summary> Switch CPU to root mode </summary> <param name="Vcpu">Virtual CPU data</param> <returns>TRUE on success</returns>

src/Arch/Intel/VMX.c:377

↓ 1 callersFunctionVmxHardSupported

<summary> Check if VT-x is supported </summary> <returns>TRUE if supported</returns>

src/Arch/Intel/VMX.c:37

↓ 1 callersFunctionVmxInitializeCPU

<summary> Virtualize LP </summary> <param name="Vcpu">Virtual CPU data</param> <param name="SystemDirectoryTableBase">Kernel CR3</param>

src/Arch/Intel/VMX.c:133

↓ 1 callersFunctionVmxSetupVMCS

<summary> Setup VMCS fields </summary> <param name="VpData">Virtual CPU data</param>

src/Arch/Intel/VMX.c:451

↓ 1 callersFunctionVmxShutdown

<summary> Revert CPU to non-root mode </summary> <param name="Vcpu">Virtual CPU data</param>

src/Arch/Intel/VMX.c:195

↓ 1 callersFunctionVmxSubvertCPU

<summary> Execute VMLAUNCH </summary> <param name="Vcpu">Virtyal CPU data</param>

src/Arch/Intel/VMX.c:220

↓ 1 callersFunctioncflags_ex

<summary> Disable EPT for CPU </summary>

src/Arch/Intel/EPT.c:49

FunctionEptGetPTEForPhysical

<summary> Get EPT PTE entry for guest physical address </summary> <param name="PML4">PTE PML4 pointer</param> <param name="phys">Guest physical addres

src/Arch/Intel/EPT.c:319

FunctionHBUnload

src/HyperBone.c:154

FunctionHvmpHVCallbackDPC

src/Core/HVM.c:57

FunctionPHpHookCallbackDPC

<summary> Per-CPU page hook/unhook routine </summary> <param name="Dpc">Unused</param> <param name="Context">Valid PHOOK_CONTEXT</param> <param name="

src/Hooks/PageHook.c:50

FunctionResolveJmp

If function address is jmp - get jmp destination

src/Util/LDasm.c:809

FunctionSHpHookCallbackDPC

<summary> Per-CPU LSTAR hook/unhook routine </summary> <param name="Dpc">Unused</param> <param name="Context">New LASTAR value if hooking, 0 if unhook

src/Hooks/SyscallHook.c:27

<summary> CPUID handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:213

FunctionVmExitCR

<summary> CRx mov from/to </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:337

FunctionVmExitEptMisconfig

<summary> EPT misconfiguration handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/EPT.c:423

FunctionVmExitEptViolation

<summary> EPT violation (#VE) handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/EPT.c:355

FunctionVmExitEvent

<summary> Handle exceptions and interrupts </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:529

FunctionVmExitINVD

<summary> INVD handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:198

FunctionVmExitMSRRead

<summary> RDMSR handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:405

FunctionVmExitMSRWrite

<summary> WRMSR handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:470

FunctionVmExitMTF

<summary> Handle MTF exiting </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:579

FunctionVmExitRdtsc

<summary> RDTSC handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:230

FunctionVmExitRdtscp

<summary> RDTSCP handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:244

FunctionVmExitStartFailed

<summary> VMLAUNCH failed </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:614

FunctionVmExitTripleFault

<summary> Triple fault handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:629

FunctionVmExitUnknown

<summary> Default handler </summary> <param name="GuestRegs">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:188

FunctionVmExitVMOP

<summary> VMX instructions (vmxon, vmread, etc.) handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:270

FunctionVmExitVmCall

<summary> VMCALL handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:284

FunctionVmExitXSETBV

<summary> XSETBV handler </summary> <param name="GuestState">Guest VM state</param>

src/Arch/Intel/VmxExitHandlers.c:260

FunctionVmxpExitHandler

src/Arch/Intel/VmxExitHandlers.c:138