vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

change setting LBR kernel status code

Browse source
This commit is contained in:
sina 2026-05-02 16:53:36 +02:00
parent aa80cd9d6b
commit 02e459d5f6
6 changed files with 44 additions and 59 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hyperdbg/hyperdbg.sln
View file

@ -148,15 +148,15 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "kernel", "kernel", "{D0E5A2
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{6498728B-D9B0-4CAB-A9E3-ACE5BC371010}"
ProjectSection(SolutionItems) = preProject
include\platform\kernel\code\Intrinsics.c = include\platform\kernel\code\Intrinsics.c
include\platform\kernel\code\PlatformMem.c = include\platform\kernel\code\PlatformMem.c
include\platform\kernel\code\PlatformIntrinsics.c = include\platform\kernel\code\PlatformIntrinsics.c
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{AA41FFF1-A730-433E-8D26-13DA5B653825}"
ProjectSection(SolutionItems) = preProject
include\platform\kernel\header\Intrinsics.h = include\platform\kernel\header\Intrinsics.h
include\platform\kernel\header\pch.h = include\platform\kernel\header\pch.h
include\platform\kernel\header\PlatformMem.h = include\platform\kernel\header\PlatformMem.h
include\platform\kernel\header\PlatformIntrinsics.h = include\platform\kernel\header\PlatformIntrinsics.h
include\platform\kernel\header\PlatformModuleInfo.h = include\platform\kernel\header\PlatformModuleInfo.h
EndProjectSection
EndProject

83
hyperdbg/hypertrace/code/api/LbrApi.c
View file

@ -19,7 +19,7 @@
VOID
HyperTraceLbrExamplePerformTrace()
{
if (LbrStart(LBR_SELECT))
if (LbrStart(LBR_SELECT_WITHOUT_FILTER))
{
for (volatile int i = 0; i < 50; i++)
{
@ -57,6 +57,25 @@ HyperTraceLbrQueryStateOfLbrSaveAndLoadVmExitAndEntryControls(UINT32 CoreId)
return g_LastBranchRecordEnabled;
}
/**
* @brief Set the kernel status in the HyperTrace operation request structure
*
* @param HyperTraceOperationRequest
* @param Status
*
* @return VOID
*/
VOID
HyperTraceSetKernelStatus(
HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest,
UINT32 Status)
{
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = Status;
}
}
/**
* @brief Enable LBR tracing for HyperTrace
*
@ -72,7 +91,7 @@ HyperTraceLbrEnable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReques
//
if (g_LastBranchRecordEnabled)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_ENABLED;
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_ENABLED);
return FALSE;
}
@ -86,7 +105,7 @@ HyperTraceLbrEnable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReques
//
if (!LbrCheckAndReadLegacyLbrDetails())
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_NOT_SUPPORTED;
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_NOT_SUPPORTED);
return FALSE;
}
}
@ -99,7 +118,7 @@ HyperTraceLbrEnable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReques
if ((g_ArchBasedLastBranchRecord && !g_Callbacks.VmFuncCheckCpuSupportForLoadAndClearGuestIa32LbrCtlControls()) ||
(!g_ArchBasedLastBranchRecord && !g_Callbacks.VmFuncCheckCpuSupportForSaveAndLoadDebugControls()))
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_NOT_SUPPORTED_ON_VMCS;
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_NOT_SUPPORTED_ON_VMCS);
return FALSE;
}
}
@ -117,7 +136,7 @@ HyperTraceLbrEnable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReques
//
// Set successful status
//
HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL);
return TRUE;
}
@ -137,11 +156,7 @@ HyperTraceLbrDisable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReque
//
if (!g_LastBranchRecordEnabled)
{
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED);
return FALSE;
}
@ -158,10 +173,7 @@ HyperTraceLbrDisable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReque
//
// Set successful status
//
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL);
return TRUE;
}
@ -181,11 +193,7 @@ HyperTraceLbrFlush(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest
//
if (!g_LastBranchRecordEnabled)
{
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED);
return FALSE;
}
@ -197,10 +205,7 @@ HyperTraceLbrFlush(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest
//
// Set successful status
//
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL);
return TRUE;
}
@ -220,11 +225,7 @@ HyperTraceLbrSave(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest)
//
if (!g_LastBranchRecordEnabled)
{
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED);
return FALSE;
}
@ -238,10 +239,7 @@ HyperTraceLbrSave(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest)
//
// The operation was successful
//
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL);
return TRUE;
}
@ -261,11 +259,7 @@ HyperTraceLbrDump(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest)
//
if (!g_LastBranchRecordEnabled)
{
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED);
return FALSE;
}
@ -279,10 +273,7 @@ HyperTraceLbrDump(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest)
//
// The operation was successful
//
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL);
return TRUE;
}
@ -302,10 +293,7 @@ HyperTraceLbrUpdateFilterOptions(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOp
//
if (!g_LastBranchRecordEnabled)
{
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED);
return FALSE;
}
@ -317,10 +305,7 @@ HyperTraceLbrUpdateFilterOptions(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOp
//
// The operation was successful
//
if (HyperTraceOperationRequest != NULL)
{
HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
}
HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL);
return TRUE;
}

2
hyperdbg/hypertrace/code/broadcast/DpcRoutines.c
View file

@ -56,7 +56,7 @@ DpcRoutineEnableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PV
// Enable LBR on all cores from VMX-root mode by VMCALL
// By default, all filter options are disabled, which means all branch types will be captured
//
LbrStart(LBR_SELECT);
LbrStart(LBR_SELECT_WITHOUT_FILTER);
//
// Wait for all DPCs to synchronize at this point

10
hyperdbg/hypertrace/header/lbr/Lbr.h
View file

@ -14,11 +14,11 @@
// Constants //
//////////////////////////////////////////////////
#define MSR_LBR_TOS 0x000001C9
#define MSR_LBR_NHM_FROM 0x00000680
#define MSR_LBR_NHM_TO 0x000006C0
#define MSR_LASTBRANCH_INFO_0 0x00000DC0
#define LBR_SELECT 0x00000000
#define MSR_LBR_TOS 0x000001C9
#define MSR_LBR_NHM_FROM 0x00000680
#define MSR_LBR_NHM_TO 0x000006C0
#define MSR_LASTBRANCH_INFO_0 0x00000DC0
#define LBR_SELECT_WITHOUT_FILTER 0x00000000
#define CPUID_ARCH_LAST_BRANCH_RECORD_INFORMATION 0x1c

2
hyperdbg/include/platform/kernel/code/Intrinsics.c → hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c
View file

@ -1,5 +1,5 @@
/**
* @file Intrinsics.c
* @file PlatformIntrinsics.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for intrinsic functions
* @details

2
hyperdbg/include/platform/kernel/header/Intrinsics.h → hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h
View file

@ -1,5 +1,5 @@
/**
* @file Intrinsics.h
* @file PlatformIntrinsics.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for intrinsic functions
* @details