Merge pull request #17 from 8damon/dev

Usermode Sensor Overhaul, C++ port & bug fixes #11 #14 #15 #16

Author: 8damon

.gitignore

@@ -30,6 +30,9 @@ test-results/
 *.tmp
 *.cache
 
+./interface
+/interface
+
 ./$документы
 $документы
 
@@ -79,3 +82,5 @@ FUTURE.md
 /SVR
 ./SVR
 
+
+SimpleVisor-master.zip

ABI/Blackbird_ipc.h

@@ -33,8 +33,7 @@ typedef enum _BLACKBIRD_IPC_COMMAND
     BlackbirdIpcCommandNotifyHookReady = 13,
     BlackbirdIpcCommandControlProcessExecution = 14,
     BlackbirdIpcCommandSetRuntimeConfig = 15,
-    BlackbirdIpcCommandGetRuntimeConfig = 16,
-    BlackbirdIpcCommandMarkInterfaceReady = 17
+    BlackbirdIpcCommandGetRuntimeConfig = 16
 } BLACKBIRD_IPC_COMMAND;
 
 typedef struct _BLACKBIRD_IPC_HANDSHAKE_REQUEST
@@ -81,7 +80,8 @@ typedef enum _BLACKBIRD_IPC_HOOK_EVENT_KIND
     BlackbirdIpcHookEventKi = 3,
     BlackbirdIpcHookEventExceptionLowNoise = 4,
     BlackbirdIpcHookEventExceptionHighPriv = 5,
-    BlackbirdIpcHookEventIntegrity = 6
+    BlackbirdIpcHookEventIntegrity = 6,
+    BlackbirdIpcHookEventModule = 7
 } BLACKBIRD_IPC_HOOK_EVENT_KIND;
 
 #define BLACKBIRD_IPC_MAX_HOOK_API_NAME 64
@@ -119,15 +119,25 @@ typedef enum _BLACKBIRD_IPC_USER_HOOK_TARGET_MODE
 } BLACKBIRD_IPC_USER_HOOK_TARGET_MODE;
 
 #define BLACKBIRD_IPC_USER_HOOK_FLAG_LAUNCH_EARLYBIRD_APC 0x00000001u
+#define BLACKBIRD_IPC_USER_HOOK_FLAG_DEFER_LAUNCH_GATE_RELEASE 0x00000002u
 #define BLACKBIRD_IPC_MAX_LAUNCH_ENVIRONMENT_CHARS 4096
 
 #define BLACKBIRD_IPC_HOOK_READY_FLAG_IPC_CONNECTED 0x00000001u
 #define BLACKBIRD_IPC_HOOK_READY_FLAG_WINSOCK 0x00000002u
 #define BLACKBIRD_IPC_HOOK_READY_FLAG_NT 0x00000004u
 #define BLACKBIRD_IPC_HOOK_READY_FLAG_KI 0x00000008u
+#define BLACKBIRD_IPC_HOOK_READY_FLAG_MODULE 0x00000010u
 #define BLACKBIRD_IPC_HOOK_READY_REQUIRED_MASK                                             \
     (BLACKBIRD_IPC_HOOK_READY_FLAG_IPC_CONNECTED | BLACKBIRD_IPC_HOOK_READY_FLAG_WINSOCK | \
-     BLACKBIRD_IPC_HOOK_READY_FLAG_NT | BLACKBIRD_IPC_HOOK_READY_FLAG_KI)
+     BLACKBIRD_IPC_HOOK_READY_FLAG_NT | BLACKBIRD_IPC_HOOK_READY_FLAG_KI | BLACKBIRD_IPC_HOOK_READY_FLAG_MODULE)
+
+// IntegrityLevel values for BLACKBIRD_IPC_SET_USER_HOOK_TARGET_REQUEST
+#define BLACKBIRD_LAUNCH_INTEGRITY_DEFAULT 0u
+#define BLACKBIRD_LAUNCH_INTEGRITY_UNTRUSTED 1u
+#define BLACKBIRD_LAUNCH_INTEGRITY_LOW 2u
+#define BLACKBIRD_LAUNCH_INTEGRITY_MEDIUM 3u
+#define BLACKBIRD_LAUNCH_INTEGRITY_HIGH 4u
+#define BLACKBIRD_LAUNCH_INTEGRITY_SYSTEM 5u
 
 typedef struct _BLACKBIRD_IPC_SET_USER_HOOK_TARGET_REQUEST
 {
@@ -137,7 +147,7 @@ typedef struct _BLACKBIRD_IPC_SET_USER_HOOK_TARGET_REQUEST
     UINT32 ParentProcessId;
     UINT32 PriorityClass;
     UINT32 InheritHandles;
-    UINT32 Reserved;
+    UINT32 IntegrityLevel;
     UINT64 AffinityMask;
     WCHAR ImagePath[BLACKBIRD_MAX_IMAGE_PATH_CHARS];
     WCHAR HookDllPath[BLACKBIRD_MAX_IMAGE_PATH_CHARS];
@@ -368,7 +378,6 @@ typedef union _BLACKBIRD_IPC_PAYLOAD
     BLACKBIRD_CONTROL_EXECUTION_REQUEST ControlProcessExecutionRequest;
     BLACKBIRD_SET_RUNTIME_CONFIG_REQUEST SetRuntimeConfigRequest;
     BLACKBIRD_RUNTIME_CONFIG_RESPONSE RuntimeConfigResponse;
-    BLACKBIRD_MARK_INTERFACE_READY_REQUEST MarkInterfaceReadyRequest;
 } BLACKBIRD_IPC_PAYLOAD, *PBLACKBIRD_IPC_PAYLOAD;
 
 typedef struct _BLACKBIRD_IPC_PACKET

ABI/blackbird_ioctl.h

@@ -21,7 +21,6 @@
 #define IOCTL_BLACKBIRD_CONTROL_EXECUTION CTL_CODE(FILE_DEVICE_BLACKBIRD, 0x80A, METHOD_BUFFERED, FILE_WRITE_DATA)
 #define IOCTL_BLACKBIRD_SET_RUNTIME_CONFIG CTL_CODE(FILE_DEVICE_BLACKBIRD, 0x80B, METHOD_BUFFERED, FILE_WRITE_DATA)
 #define IOCTL_BLACKBIRD_GET_RUNTIME_CONFIG CTL_CODE(FILE_DEVICE_BLACKBIRD, 0x80C, METHOD_BUFFERED, FILE_READ_DATA)
-#define IOCTL_BLACKBIRD_MARK_INTERFACE_READY CTL_CODE(FILE_DEVICE_BLACKBIRD, 0x80D, METHOD_BUFFERED, FILE_WRITE_DATA)
 #define IOCTL_BLACKBIRD_MARK_CONTROLLER_READY CTL_CODE(FILE_DEVICE_BLACKBIRD, 0x80E, METHOD_BUFFERED, FILE_WRITE_DATA)
 
 #define BLACKBIRD_STREAM_HANDLE 0x00000001
@@ -36,6 +35,7 @@
 #define BLACKBIRD_MAX_DEEP_SAMPLE_BYTES 64
 #define BLACKBIRD_MAX_STACK_SNAPSHOT_BYTES 256
 #define BLACKBIRD_MAX_FILE_PATH_CHARS 520
+#define BLACKBIRD_TEMPUS_SUBSYSTEM_COUNT 14
 
 typedef enum _BLACKBIRD_EVENT_TYPE
 {
@@ -95,9 +95,7 @@ typedef struct _BLACKBIRD_SET_PIDS_REQUEST
 #define BLACKBIRD_RUNTIME_FLAG_SELF_HIDE 0x00000002u
 #define BLACKBIRD_RUNTIME_FLAG_INTERFACE_PROTECTED_ACCESS 0x00000004u
 #define BLACKBIRD_RUNTIME_FLAG_CONTROLLER_PROTECTED_ACCESS 0x00000008u
-#define BLACKBIRD_RUNTIME_FLAG_PROTECTED_ACCESS \
-    (BLACKBIRD_RUNTIME_FLAG_INTERFACE_PROTECTED_ACCESS | BLACKBIRD_RUNTIME_FLAG_CONTROLLER_PROTECTED_ACCESS)
-
+#define BLACKBIRD_RUNTIME_FLAG_NTAPI_HOOKS_DISARMED 0x00000010u
 typedef enum _BLACKBIRD_RUNTIME_MODE
 {
     BLACKBIRD_RUNTIME_MODE_LOITER = 0,
@@ -138,12 +136,6 @@ typedef struct _BLACKBIRD_CONTROL_EXECUTION_REQUEST
     UINT32 Suspend; /* 1 = suspend, 0 = resume */
 } BLACKBIRD_CONTROL_EXECUTION_REQUEST, *PBLACKBIRD_CONTROL_EXECUTION_REQUEST;
 
-typedef struct _BLACKBIRD_MARK_INTERFACE_READY_REQUEST
-{
-    UINT32 ProcessId;
-    UINT32 Reserved;
-} BLACKBIRD_MARK_INTERFACE_READY_REQUEST, *PBLACKBIRD_MARK_INTERFACE_READY_REQUEST;
-
 typedef struct _BLACKBIRD_MARK_CONTROLLER_READY_REQUEST
 {
     UINT32 ProcessId;
@@ -266,12 +258,42 @@ typedef struct _BLACKBIRD_EVENT_RECORD
     } Data;
 } BLACKBIRD_EVENT_RECORD, *PBLACKBIRD_EVENT_RECORD;
 
+typedef enum _BLACKBIRD_TEMPUS_SUBSYSTEM
+{
+    BlackbirdTempusSubsystemDriver = 0,
+    BlackbirdTempusSubsystemControl = 1,
+    BlackbirdTempusSubsystemEtw = 2,
+    BlackbirdTempusSubsystemHandleMonitor = 3,
+    BlackbirdTempusSubsystemThreadMonitor = 4,
+    BlackbirdTempusSubsystemProcessMonitor = 5,
+    BlackbirdTempusSubsystemImageMonitor = 6,
+    BlackbirdTempusSubsystemRegistryMonitor = 7,
+    BlackbirdTempusSubsystemFileSystemMonitor = 8,
+    BlackbirdTempusSubsystemApcMonitor = 9,
+    BlackbirdTempusSubsystemCorrelation = 10,
+    BlackbirdTempusSubsystemHollowingEngine = 11,
+    BlackbirdTempusSubsystemNtApiMonitor = 12,
+    BlackbirdTempusSubsystemAntiTamper = 13
+} BLACKBIRD_TEMPUS_SUBSYSTEM;
+
+typedef struct _BLACKBIRD_TEMPUS_BUCKET
+{
+    UINT64 SampleCount;
+    UINT64 TotalQpc;
+    UINT64 MaxQpc;
+    UINT64 LastQpc;
+} BLACKBIRD_TEMPUS_BUCKET, *PBLACKBIRD_TEMPUS_BUCKET;
+
 typedef struct _BLACKBIRD_STATS_RESPONSE
 {
     UINT32 SubscriptionCount;
     UINT32 QueueDepth;
     UINT32 DroppedEvents;
+    UINT32 TempusEnabled;
+    UINT64 TempusQpcFrequency;
+    UINT32 TempusSubsystemCount;
     UINT32 Reserved;
+    BLACKBIRD_TEMPUS_BUCKET Tempus[BLACKBIRD_TEMPUS_SUBSYSTEM_COUNT];
 } BLACKBIRD_STATS_RESPONSE, *PBLACKBIRD_STATS_RESPONSE;
 
 typedef struct _BLACKBIRD_HEALTH_RESPONSE