New HideVM plugin

configure.ac

@@ -522,6 +522,16 @@ if test x$plugin_spraymon = xyes; then
   AC_DEFINE_UNQUOTED(ENABLE_PLUGIN_SPRAYMON, 1, "")
 fi
 
+AC_ARG_ENABLE([plugin_hidevm],
+  [AS_HELP_STRING([--disable-plugin-hidevm],
+    [Enable the HIDEVM plugin @<:@yes@:>@])],
+  [plugin_hidevm="$enableval"],
+  [plugin_hidevm="yes"])
+AM_CONDITIONAL([PLUGIN_HIDEVM], [test x$plugin_hidevm = xyes])
+if test x$plugin_hidevm = xyes; then
+  AC_DEFINE_UNQUOTED(ENABLE_PLUGIN_HIDEVM, 1, "")
+fi
+
 #####################################################
 
 AC_ARG_ENABLE([repl],
@@ -827,6 +837,7 @@ HidSim:        $plugin_hidsim
 Rootkitmon:    $plugin_rootkitmon
 Spraymon:      $plugin_spraymon
 Callbackmon:   $plugin_callbackmon
+HideVM:        $plugin_hidevm
 -------------------------------------------------------------------------------
 Deprecated Plugins
 WMIMon:        $plugin_wmimon

src/plugins/Makefile.am

@@ -359,6 +359,12 @@ sources += callbackmon/callbackmon.cpp
 sources += callbackmon/callbackmon.h
 endif
 
+if PLUGIN_HIDEVM
+sources += hidevm/hidevm.cpp
+sources += hidevm/hidevm.h
+sources += hidevm/private.h
+endif
+
 ###############################################################################
 sources += plugins.cpp plugins.h plugins_ex.cpp plugins_ex.h plugin_utils.cpp plugin_utils.h private.h type_traits_helpers.h hook_helpers.h
 sources += output_format.h output_format/common.h output_format/csvfmt.h output_format/deffmt.h output_format/jsonfmt.h output_format/kvfmt.h

src/plugins/hidevm/hidevm.h

@@ -0,0 +1,162 @@
+/*********************IMPORTANT DRAKVUF LICENSE TERMS***********************
+ *                                                                         *
+ * DRAKVUF (C) 2014-2022 Tamas K Lengyel.                                  *
+ * Tamas K Lengyel is hereinafter referred to as the author.               *
+ * This program is free software; you may redistribute and/or modify it    *
+ * under the terms of the GNU General Public License as published by the   *
+ * Free Software Foundation; Version 2 ("GPL"), BUT ONLY WITH ALL OF THE   *
+ * CLARIFICATIONS AND EXCEPTIONS DESCRIBED HEREIN.  This guarantees your   *
+ * right to use, modify, and redistribute this software under certain      *
+ * conditions.  If you wish to embed DRAKVUF technology into proprietary   *
+ * software, alternative licenses can be acquired from the author.         *
+ *                                                                         *
+ * Note that the GPL places important restrictions on "derivative works",  *
+ * yet it does not provide a detailed definition of that term.  To avoid   *
+ * misunderstandings, we interpret that term as broadly as copyright law   *
+ * allows.  For example, we consider an application to constitute a        *
+ * derivative work for the purpose of this license if it does any of the   *
+ * following with any software or content covered by this license          *
+ * ("Covered Software"):                                                   *
+ *                                                                         *
+ * o Integrates source code from Covered Software.                         *
+ *                                                                         *
+ * o Reads or includes copyrighted data files.                             *
+ *                                                                         *
+ * o Is designed specifically to execute Covered Software and parse the    *
+ * results (as opposed to typical shell or execution-menu apps, which will *
+ * execute anything you tell them to).                                     *
+ *                                                                         *
+ * o Includes Covered Software in a proprietary executable installer.  The *
+ * installers produced by InstallShield are an example of this.  Including *
+ * DRAKVUF with other software in compressed or archival form does not     *
+ * trigger this provision, provided appropriate open source decompression  *
+ * or de-archiving software is widely available for no charge.  For the    *
+ * purposes of this license, an installer is considered to include Covered *
+ * Software even if it actually retrieves a copy of Covered Software from  *
+ * another source during runtime (such as by downloading it from the       *
+ * Internet).                                                              *
+ *                                                                         *
+ * o Links (statically or dynamically) to a library which does any of the  *
+ * above.                                                                  *
+ *                                                                         *
+ * o Executes a helper program, module, or script to do any of the above.  *
+ *                                                                         *
+ * This list is not exclusive, but is meant to clarify our interpretation  *
+ * of derived works with some common examples.  Other people may interpret *
+ * the plain GPL differently, so we consider this a special exception to   *
+ * the GPL that we apply to Covered Software.  Works which meet any of     *
+ * these conditions must conform to all of the terms of this license,      *
+ * particularly including the GPL Section 3 requirements of providing      *
+ * source code and allowing free redistribution of the work as a whole.    *
+ *                                                                         *
+ * Any redistribution of Covered Software, including any derived works,    *
+ * must obey and carry forward all of the terms of this license, including *
+ * obeying all GPL rules and restrictions.  For example, source code of    *
+ * the whole work must be provided and free redistribution must be         *
+ * allowed.  All GPL references to "this License", are to be treated as    *
+ * including the terms and conditions of this license text as well.        *
+ *                                                                         *
+ * Because this license imposes special exceptions to the GPL, Covered     *
+ * Work may not be combined (even as part of a larger work) with plain GPL *
+ * software.  The terms, conditions, and exceptions of this license must   *
+ * be included as well.  This license is incompatible with some other open *
+ * source licenses as well.  In some cases we can relicense portions of    *
+ * DRAKVUF or grant special permissions to use it in other open source     *
+ * software.  Please contact tamas.k.lengyel@gmail.com with any such       *
+ * requests.  Similarly, we don't incorporate incompatible open source     *
+ * software into Covered Software without special permission from the      *
+ * copyright holders.                                                      *
+ *                                                                         *
+ * If you have any questions about the licensing restrictions on using     *
+ * DRAKVUF in other works, are happy to help.  As mentioned above,         *
+ * alternative license can be requested from the author to integrate       *
+ * DRAKVUF into proprietary applications and appliances.  Please email     *
+ * tamas.k.lengyel@gmail.com for further information.                      *
+ *                                                                         *
+ * If you have received a written license agreement or contract for        *
+ * Covered Software stating terms other than these, you may choose to use  *
+ * and redistribute Covered Software under those terms instead of these.   *
+ *                                                                         *
+ * Source is provided to this software because we believe users have a     *
+ * right to know exactly what a program is going to do before they run it. *
+ * This also allows you to audit the software for security holes.          *
+ *                                                                         *
+ * Source code also allows you to port DRAKVUF to new platforms, fix bugs, *
+ * and add new features.  You are highly encouraged to submit your changes *
+ * on https://github.com/tklengyel/drakvuf, or by other methods.           *
+ * By sending these changes, it is understood (unless you specify          *
+ * otherwise) that you are offering unlimited, non-exclusive right to      *
+ * reuse, modify, and relicense the code.  DRAKVUF will always be          *
+ * available Open Source, but this is important because the inability to   *
+ * relicense code has caused devastating problems for other Free Software  *
+ * projects (such as KDE and NASM).                                        *
+ * To specify special license conditions of your contributions, just say   *
+ * so when you send them.                                                  *
+ *                                                                         *
+ * This program is distributed in the hope that it will be useful, but     *
+ * WITHOUT ANY WARRANTY; without even the implied warranty of              *
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the DRAKVUF   *
+ * license file for more details (it's in a COPYING file included with     *
+ * DRAKVUF, and also available from                                        *
+ * https://github.com/tklengyel/drakvuf/COPYING)                           *
+ *                                                                         *
+ ***************************************************************************/
+
+#ifndef HIDEVM_H
+#define HIDEVM_H
+
+#include <libusermode/userhook.hpp>
+#include "plugins/private.h"
+#include "plugins/plugins_ex.h"
+#include "private.h"
+
+struct hidevm_config
+{
+    uint64_t delay;
+};
+
+class hidevm: public pluginex
+{
+public:
+    drakvuf_t drakvuf;
+    const output_format_t format;
+
+    uint8_t stage = 0;
+    uint8_t query_stage = 0;
+
+    std::unique_ptr<libhook::SyscallHook> NtDeviceIoControlFile_hook;
+    std::unordered_map<uint64_t, std::unique_ptr<libhook::ReturnHook>> ret_hooks;
+    std::unordered_map<uint64_t, std::unique_ptr<libhook::SyscallHook>> NtClose_hook;
+
+    addr_t objattr_length;
+    addr_t objattr_name;
+    addr_t iostatusblock_information;
+
+    uint64_t pid_tid;
+
+    // Stage 1
+    // Address of WMI_KM_REQUEST_OPEN_BLOCK.Handle field, where WmiGuid handle should be stored on return of NtDeviceIoControlFile(IOCTL_WMI_OPEN_GUID_BLOCK)
+    addr_t addr_WmiKmRequestOpenBlock_Handle = 0;
+    uint64_t FakeWmiGuidHandle = 0xFACEDEAD;
+
+    // Stage 2
+    /*
+    * On enter InputBuffer -> WMI_KM_REQUEST_GUID_INFO.Handle should be equal to FakeWmiGuidHandle
+    * On return set IoStatusBlock.Information = 0, WMI_KM_REQUEST_GUID_INFO.Status = 0
+    */
+    addr_t addr_InputBuffer_Status = 0;
+    addr_t addr_IoStatusBlock_Information = 0;
+
+    // Stage 3
+    addr_t addr_InputBuffer = 0;
+
+    // WQL hook
+    wanted_hooks_t wanted_hooks;
+    size_t* m_offsets;
+
+    hidevm(drakvuf_t drakvuf, const hidevm_config* config, output_format_t output);
+    ~hidevm();
+
+};
+
+#endif