From 02e459d5f6d4e1738a314bf414fbcfefc40acb0c Mon Sep 17 00:00:00 2001 From: sina Date: Sat, 2 May 2026 16:53:36 +0200 Subject: [PATCH] change setting LBR kernel status code --- hyperdbg/hyperdbg.sln | 4 +- hyperdbg/hypertrace/code/api/LbrApi.c | 83 ++++++++----------- .../hypertrace/code/broadcast/DpcRoutines.c | 2 +- hyperdbg/hypertrace/header/lbr/Lbr.h | 10 +-- .../{Intrinsics.c => PlatformIntrinsics.c} | 2 +- .../{Intrinsics.h => PlatformIntrinsics.h} | 2 +- 6 files changed, 44 insertions(+), 59 deletions(-) rename hyperdbg/include/platform/kernel/code/{Intrinsics.c => PlatformIntrinsics.c} (89%) rename hyperdbg/include/platform/kernel/header/{Intrinsics.h => PlatformIntrinsics.h} (93%) diff --git a/hyperdbg/hyperdbg.sln b/hyperdbg/hyperdbg.sln index 849f0b52..7495fe84 100644 --- a/hyperdbg/hyperdbg.sln +++ b/hyperdbg/hyperdbg.sln @@ -148,15 +148,15 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "kernel", "kernel", "{D0E5A2 EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{6498728B-D9B0-4CAB-A9E3-ACE5BC371010}" ProjectSection(SolutionItems) = preProject - include\platform\kernel\code\Intrinsics.c = include\platform\kernel\code\Intrinsics.c include\platform\kernel\code\PlatformMem.c = include\platform\kernel\code\PlatformMem.c + include\platform\kernel\code\PlatformIntrinsics.c = include\platform\kernel\code\PlatformIntrinsics.c EndProjectSection EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{AA41FFF1-A730-433E-8D26-13DA5B653825}" ProjectSection(SolutionItems) = preProject - include\platform\kernel\header\Intrinsics.h = include\platform\kernel\header\Intrinsics.h include\platform\kernel\header\pch.h = include\platform\kernel\header\pch.h include\platform\kernel\header\PlatformMem.h = include\platform\kernel\header\PlatformMem.h + include\platform\kernel\header\PlatformIntrinsics.h = include\platform\kernel\header\PlatformIntrinsics.h include\platform\kernel\header\PlatformModuleInfo.h = include\platform\kernel\header\PlatformModuleInfo.h EndProjectSection EndProject diff --git a/hyperdbg/hypertrace/code/api/LbrApi.c b/hyperdbg/hypertrace/code/api/LbrApi.c index 1607ebda..998f3fbd 100644 --- a/hyperdbg/hypertrace/code/api/LbrApi.c +++ b/hyperdbg/hypertrace/code/api/LbrApi.c @@ -19,7 +19,7 @@ VOID HyperTraceLbrExamplePerformTrace() { - if (LbrStart(LBR_SELECT)) + if (LbrStart(LBR_SELECT_WITHOUT_FILTER)) { for (volatile int i = 0; i < 50; i++) { @@ -57,6 +57,25 @@ HyperTraceLbrQueryStateOfLbrSaveAndLoadVmExitAndEntryControls(UINT32 CoreId) return g_LastBranchRecordEnabled; } +/** + * @brief Set the kernel status in the HyperTrace operation request structure + * + * @param HyperTraceOperationRequest + * @param Status + * + * @return VOID + */ +VOID +HyperTraceSetKernelStatus( + HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest, + UINT32 Status) +{ + if (HyperTraceOperationRequest != NULL) + { + HyperTraceOperationRequest->KernelStatus = Status; + } +} + /** * @brief Enable LBR tracing for HyperTrace * @@ -72,7 +91,7 @@ HyperTraceLbrEnable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReques // if (g_LastBranchRecordEnabled) { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_ENABLED; + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_ENABLED); return FALSE; } @@ -86,7 +105,7 @@ HyperTraceLbrEnable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReques // if (!LbrCheckAndReadLegacyLbrDetails()) { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_NOT_SUPPORTED; + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_NOT_SUPPORTED); return FALSE; } } @@ -99,7 +118,7 @@ HyperTraceLbrEnable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReques if ((g_ArchBasedLastBranchRecord && !g_Callbacks.VmFuncCheckCpuSupportForLoadAndClearGuestIa32LbrCtlControls()) || (!g_ArchBasedLastBranchRecord && !g_Callbacks.VmFuncCheckCpuSupportForSaveAndLoadDebugControls())) { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_NOT_SUPPORTED_ON_VMCS; + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_NOT_SUPPORTED_ON_VMCS); return FALSE; } } @@ -117,7 +136,7 @@ HyperTraceLbrEnable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReques // // Set successful status // - HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL; + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL); return TRUE; } @@ -137,11 +156,7 @@ HyperTraceLbrDisable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReque // if (!g_LastBranchRecordEnabled) { - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED; - } - + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED); return FALSE; } @@ -158,10 +173,7 @@ HyperTraceLbrDisable(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationReque // // Set successful status // - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL; - } + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL); return TRUE; } @@ -181,11 +193,7 @@ HyperTraceLbrFlush(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest // if (!g_LastBranchRecordEnabled) { - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED; - } - + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED); return FALSE; } @@ -197,10 +205,7 @@ HyperTraceLbrFlush(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest // // Set successful status // - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL; - } + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL); return TRUE; } @@ -220,11 +225,7 @@ HyperTraceLbrSave(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest) // if (!g_LastBranchRecordEnabled) { - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED; - } - + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED); return FALSE; } @@ -238,10 +239,7 @@ HyperTraceLbrSave(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest) // // The operation was successful // - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL; - } + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL); return TRUE; } @@ -261,11 +259,7 @@ HyperTraceLbrDump(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest) // if (!g_LastBranchRecordEnabled) { - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED; - } - + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED); return FALSE; } @@ -279,10 +273,7 @@ HyperTraceLbrDump(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOperationRequest) // // The operation was successful // - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL; - } + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL); return TRUE; } @@ -302,10 +293,7 @@ HyperTraceLbrUpdateFilterOptions(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOp // if (!g_LastBranchRecordEnabled) { - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_ERROR_LBR_ALREADY_DISABLED; - } + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_ERROR_LBR_ALREADY_DISABLED); return FALSE; } @@ -317,10 +305,7 @@ HyperTraceLbrUpdateFilterOptions(HYPERTRACE_LBR_OPERATION_PACKETS * HyperTraceOp // // The operation was successful // - if (HyperTraceOperationRequest != NULL) - { - HyperTraceOperationRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL; - } + HyperTraceSetKernelStatus(HyperTraceOperationRequest, DEBUGGER_OPERATION_WAS_SUCCESSFUL); return TRUE; } diff --git a/hyperdbg/hypertrace/code/broadcast/DpcRoutines.c b/hyperdbg/hypertrace/code/broadcast/DpcRoutines.c index 98de8082..24b125a6 100644 --- a/hyperdbg/hypertrace/code/broadcast/DpcRoutines.c +++ b/hyperdbg/hypertrace/code/broadcast/DpcRoutines.c @@ -56,7 +56,7 @@ DpcRoutineEnableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PV // Enable LBR on all cores from VMX-root mode by VMCALL // By default, all filter options are disabled, which means all branch types will be captured // - LbrStart(LBR_SELECT); + LbrStart(LBR_SELECT_WITHOUT_FILTER); // // Wait for all DPCs to synchronize at this point diff --git a/hyperdbg/hypertrace/header/lbr/Lbr.h b/hyperdbg/hypertrace/header/lbr/Lbr.h index 8c20781f..db03e950 100644 --- a/hyperdbg/hypertrace/header/lbr/Lbr.h +++ b/hyperdbg/hypertrace/header/lbr/Lbr.h @@ -14,11 +14,11 @@ // Constants // ////////////////////////////////////////////////// -#define MSR_LBR_TOS 0x000001C9 -#define MSR_LBR_NHM_FROM 0x00000680 -#define MSR_LBR_NHM_TO 0x000006C0 -#define MSR_LASTBRANCH_INFO_0 0x00000DC0 -#define LBR_SELECT 0x00000000 +#define MSR_LBR_TOS 0x000001C9 +#define MSR_LBR_NHM_FROM 0x00000680 +#define MSR_LBR_NHM_TO 0x000006C0 +#define MSR_LASTBRANCH_INFO_0 0x00000DC0 +#define LBR_SELECT_WITHOUT_FILTER 0x00000000 #define CPUID_ARCH_LAST_BRANCH_RECORD_INFORMATION 0x1c diff --git a/hyperdbg/include/platform/kernel/code/Intrinsics.c b/hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c similarity index 89% rename from hyperdbg/include/platform/kernel/code/Intrinsics.c rename to hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c index fd35b5dc..ec0b212e 100644 --- a/hyperdbg/include/platform/kernel/code/Intrinsics.c +++ b/hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c @@ -1,5 +1,5 @@ /** - * @file Intrinsics.c + * @file PlatformIntrinsics.c * @author Sina Karvandi (sina@hyperdbg.org) * @brief Implementation of cross platform APIs for intrinsic functions * @details diff --git a/hyperdbg/include/platform/kernel/header/Intrinsics.h b/hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h similarity index 93% rename from hyperdbg/include/platform/kernel/header/Intrinsics.h rename to hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h index 66eaebe5..76c4adf8 100644 --- a/hyperdbg/include/platform/kernel/header/Intrinsics.h +++ b/hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h @@ -1,5 +1,5 @@ /** - * @file Intrinsics.h + * @file PlatformIntrinsics.h * @author Sina Karvandi (sina@hyperdbg.org) * @brief Cross platform APIs for intrinsic functions * @details