Checks whether the #BP occurred up on completion of #PF handler, and so, restores an original IP to continue guest execution as it should be

Change guest's IP to kPfpBreakPoint up on #PF on kernel address space so that #BP VM-exit occurs on completion of #PF handler

Registers power callback

Returns the next integer (mod 2**64) that is greater than or equal to \p Value and is a multiple of \p Align. \p Align must be non-zero. Examples: \c

/

Set a va associated with 0xfd5fa000 as a dest range

token*/

Apply ranges to EPT attributes

Allocates per-processor shadow hook data

Allocates processor-shared shadow hook data

Disables page shadowing for all hooks

Enables page shadowing for all hooks

Frees per-processor shadow hook data

Frees processor-shared shadow hook data

Handles #BP. Checks if the #BP happened on where DdiMon set a break point, and if so, modifies the contents of guest's IP to execute a corresponding h

Handles EPT violation VM-exit.

Handles MTF VM-exit. Re-enables the shadow hook and clears MTF.

Set up inline hook at the address without activating it

Stop showing a shadow page

Show a shadowed page for read and write

Returns a size of an instruction at the address

Returns code bytes for inline hooking

Saves HookInformation as the last one for reusing it on up coming MTF VM-exit

Builds a trampoline code for calling an original code and embeds 0xcc on the shadow_exec_page

map instruction name to instruction ID (public)

map internal raw register to 'public' register

Destructor; prints out accumulated performance results.

Runs a set of tests for MemoryMonRWE

Executes callback for each driver currently loaded

Allocates continuous physical memory

Queues a given DPC routine on all processors. Returns STATUS_SUCCESS when DPC is queued for all processors.

Frees an address allocated by UtilAllocateContiguousMemory()

Initializes utility functions

Executes the INVVPID instruction (type 0)

Executes the INVVPID instruction (type 3)

memmem().

PNF -> PA

PA -> VA

/

Initializes g_utilp_p*e_base, g_utilp_p*i_shift and g_utilp_p*i_mask.

Initializes the physical memory ranges

Locates RtlPcToFileHeader

Virtualizes the specified processor

CPUID

MOV to / from CRx

MOV to / from DRx

EXIT_REASON_EPT_MISCONFIG

EXIT_REASON_EPT_VIOLATION

Interrupt

LIDT, SIDT, LGDT and SGDT

INVD

INVLPG

IN, INS, OUT, OUTS

LLDT, LTR, SLDT, and STR