From 19437cd6948bf6a5a8cea40d944e72e14890b60c Mon Sep 17 00:00:00 2001 From: Hari Mishal Date: Tue, 2 Dec 2025 19:08:27 +0100 Subject: [PATCH] add base code for the hypertrace project --- hyperdbg/hyperdbg.sln | 8 ++ hyperdbg/hypertrace/CMakeLists.txt | 22 ++++ hyperdbg/hypertrace/code/Tracing.c | 12 ++ hyperdbg/hypertrace/code/UnloadDll.c | 34 +++++ hyperdbg/hypertrace/header/Tracing.h | 25 ++++ hyperdbg/hypertrace/header/UnloadDll.h | 20 +++ hyperdbg/hypertrace/header/pch.h | 51 ++++++++ hyperdbg/hypertrace/hypertrace.def | 6 + hyperdbg/hypertrace/hypertrace.inf | 77 +++++++++++ hyperdbg/hypertrace/hypertrace.vcxproj | 122 ++++++++++++++++++ .../hypertrace/hypertrace.vcxproj.filters | 62 +++++++++ 11 files changed, 439 insertions(+) create mode 100644 hyperdbg/hypertrace/CMakeLists.txt create mode 100644 hyperdbg/hypertrace/code/Tracing.c create mode 100644 hyperdbg/hypertrace/code/UnloadDll.c create mode 100644 hyperdbg/hypertrace/header/Tracing.h create mode 100644 hyperdbg/hypertrace/header/UnloadDll.h create mode 100644 hyperdbg/hypertrace/header/pch.h create mode 100644 hyperdbg/hypertrace/hypertrace.def create mode 100644 hyperdbg/hypertrace/hypertrace.inf create mode 100644 hyperdbg/hypertrace/hypertrace.vcxproj create mode 100644 hyperdbg/hypertrace/hypertrace.vcxproj.filters diff --git a/hyperdbg/hyperdbg.sln b/hyperdbg/hyperdbg.sln index e124d57a..678b9c62 100644 --- a/hyperdbg/hyperdbg.sln +++ b/hyperdbg/hyperdbg.sln @@ -226,6 +226,8 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "config", "config", "{035508 include\config\Definition.h = include\config\Definition.h EndProjectSection EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hypertrace", "hypertrace\hypertrace.vcxproj", "{9FA45E25-DAEB-4C2D-806C-7908A180195D}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution debug|x64 = debug|x64 @@ -279,6 +281,12 @@ Global {B226530A-14B1-40AC-B82E-D9057400E7EE}.debug|x64.Build.0 = debug|x64 {B226530A-14B1-40AC-B82E-D9057400E7EE}.release|x64.ActiveCfg = release|x64 {B226530A-14B1-40AC-B82E-D9057400E7EE}.release|x64.Build.0 = release|x64 + {9FA45E25-DAEB-4C2D-806C-7908A180195D}.debug|x64.ActiveCfg = debug|x64 + {9FA45E25-DAEB-4C2D-806C-7908A180195D}.debug|x64.Build.0 = debug|x64 + {9FA45E25-DAEB-4C2D-806C-7908A180195D}.debug|x64.Deploy.0 = debug|x64 + {9FA45E25-DAEB-4C2D-806C-7908A180195D}.release|x64.ActiveCfg = release|x64 + {9FA45E25-DAEB-4C2D-806C-7908A180195D}.release|x64.Build.0 = release|x64 + {9FA45E25-DAEB-4C2D-806C-7908A180195D}.release|x64.Deploy.0 = release|x64 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE diff --git a/hyperdbg/hypertrace/CMakeLists.txt b/hyperdbg/hypertrace/CMakeLists.txt new file mode 100644 index 00000000..56d3af1d --- /dev/null +++ b/hyperdbg/hypertrace/CMakeLists.txt @@ -0,0 +1,22 @@ +# Code generated by Visual Studio kit, DO NOT EDIT. +set(SourceFiles + "../include/components/spinlock/code/Spinlock.c" + "../include/platform/kernel/code/Mem.c" + "code/Logging.c" + "code/UnloadDll.c" + "../include/components/spinlock/header/Spinlock.h" + "../include/platform/kernel/header/Environment.h" + "../include/platform/kernel/header/Mem.h" + "header/Logging.h" + "header/pch.h" + "header/UnloadDll.h" + "hypertrace.def" +) +include_directories( + "../include" + "header" +) +wdk_add_library(hypertrace SHARED + KMDF 1.15 + ${SourceFiles} +) diff --git a/hyperdbg/hypertrace/code/Tracing.c b/hyperdbg/hypertrace/code/Tracing.c new file mode 100644 index 00000000..fc4e6396 --- /dev/null +++ b/hyperdbg/hypertrace/code/Tracing.c @@ -0,0 +1,12 @@ +/** + * @file Tracing.c + * @author Hari Mishal (harimishal6@gmail.com) + * @brief Message logging and tracing implementation + * @details + * @version 0.18 + * @date 2025-12-02 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" diff --git a/hyperdbg/hypertrace/code/UnloadDll.c b/hyperdbg/hypertrace/code/UnloadDll.c new file mode 100644 index 00000000..be8c9ba6 --- /dev/null +++ b/hyperdbg/hypertrace/code/UnloadDll.c @@ -0,0 +1,34 @@ +/** + * @file UnloadDll.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Unloading DLL in the target Windows + * + * @version 0.4 + * @date 2023-07-06 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +// +// We'll add these functions, so whenever HyperDbg's driver is unloaded +// DllUnload will be called to unload this dll from the memory. +// this way we can remove the HyperDbg after unloading as there is no +// other module remains loaded in the memory. +// + +NTSTATUS +DllInitialize( + _In_ PUNICODE_STRING RegistryPath) +{ + UNREFERENCED_PARAMETER(RegistryPath); + + return STATUS_SUCCESS; +} + +NTSTATUS +DllUnload(void) +{ + return STATUS_SUCCESS; +} diff --git a/hyperdbg/hypertrace/header/Tracing.h b/hyperdbg/hypertrace/header/Tracing.h new file mode 100644 index 00000000..07d818f9 --- /dev/null +++ b/hyperdbg/hypertrace/header/Tracing.h @@ -0,0 +1,25 @@ +/** + * @file Tracing.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers of Message logging and tracing + * @details + * @version 0.1 + * @date 2020-04-11 + * + * @copyright This project is released under the GNU Public License v3. + * + */ + +#pragma once + +////////////////////////////////////////////////// +// Global Variables // +////////////////////////////////////////////////// + +////////////////////////////////////////////////// +// Structures // +////////////////////////////////////////////////// + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// diff --git a/hyperdbg/hypertrace/header/UnloadDll.h b/hyperdbg/hypertrace/header/UnloadDll.h new file mode 100644 index 00000000..c6388ac7 --- /dev/null +++ b/hyperdbg/hypertrace/header/UnloadDll.h @@ -0,0 +1,20 @@ +/** + * @file UnloadDll.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers for unloading DLL in the target Windows + * + * @version 0.4 + * @date 2023-07-06 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Exported Functions // +////////////////////////////////////////////////// + +__declspec(dllexport) NTSTATUS DllInitialize(_In_ PUNICODE_STRING RegistryPath); + +__declspec(dllexport) NTSTATUS DllUnload(void); diff --git a/hyperdbg/hypertrace/header/pch.h b/hyperdbg/hypertrace/header/pch.h new file mode 100644 index 00000000..d9ec55b6 --- /dev/null +++ b/hyperdbg/hypertrace/header/pch.h @@ -0,0 +1,51 @@ +/** + * @file pch.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers of Message logging and tracing + * @details + * @version 0.2 + * @date 2023-01-23 + * + * @copyright This project is released under the GNU Public License v3. + * + */ + +#pragma once + +#define _NO_CRT_STDIO_INLINE + +#pragma warning(disable : 4201) // Suppress nameless struct/union warning + +// +// Environment headers +// +#include "platform/kernel/header/Environment.h" + +#ifdef ENV_WINDOWS + +// +// Windows defined functions +// +# include +# include +# include + +#endif // ENV_WINDOWS + +// +// Scope definitions +// +#define HYPERDBG_KERNEL_MODE +#define HYPERDBG_HYPER_LOG + +#include "UnloadDll.h" +#include "SDK/HyperDbgSdk.h" +#include "SDK/modules/HyperLog.h" +#include "SDK/imports/kernel/HyperDbgHyperLogImports.h" +#include "components/spinlock/header/Spinlock.h" +#include "Tracing.h" + +// +// Platform independent headers +// +#include "platform/kernel/header/Mem.h" diff --git a/hyperdbg/hypertrace/hypertrace.def b/hyperdbg/hypertrace/hypertrace.def new file mode 100644 index 00000000..54a2d6b2 --- /dev/null +++ b/hyperdbg/hypertrace/hypertrace.def @@ -0,0 +1,6 @@ +LIBRARY hypertrace + +EXPORTS + + DllInitialize PRIVATE + DllUnload PRIVATE \ No newline at end of file diff --git a/hyperdbg/hypertrace/hypertrace.inf b/hyperdbg/hypertrace/hypertrace.inf new file mode 100644 index 00000000..7fe4240f --- /dev/null +++ b/hyperdbg/hypertrace/hypertrace.inf @@ -0,0 +1,77 @@ +; +; hypertrace.inf +; + +[Version] +Signature="$WINDOWS NT$" +Class=System ; TODO: specify appropriate Class +ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318} ; TODO: specify appropriate ClassGuid +Provider=%ManufacturerName% +CatalogFile=hypertrace.cat +DriverVer= ; TODO: set DriverVer in stampinf property pages +PnpLockdown=1 + +[DestinationDirs] +DefaultDestDir = 12 +hypertrace_Device_CoInstaller_CopyFiles = 11 + +[SourceDisksNames] +1 = %DiskName%,,,"" + +[SourceDisksFiles] +hypertrace.sys = 1,, +WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll=1 ; make sure the number matches with SourceDisksNames + +;***************************************** +; Install Section +;***************************************** + +[Manufacturer] +%ManufacturerName%=Standard,NT$ARCH$ + +[Standard.NT$ARCH$] +%hypertrace.DeviceDesc%=hypertrace_Device, Root\hypertrace ; TODO: edit hw-id + +[hypertrace_Device.NT] +CopyFiles=Drivers_Dir + +[Drivers_Dir] +hypertrace.sys + +;-------------- Service installation +[hypertrace_Device.NT.Services] +AddService = hypertrace,%SPSVCINST_ASSOCSERVICE%, hypertrace_Service_Inst + +; -------------- hypertrace driver install sections +[hypertrace_Service_Inst] +DisplayName = %hypertrace.SVCDESC% +ServiceType = 1 ; SERVICE_KERNEL_DRIVER +StartType = 3 ; SERVICE_DEMAND_START +ErrorControl = 1 ; SERVICE_ERROR_NORMAL +ServiceBinary = %12%\hypertrace.sys + +; +;--- hypertrace_Device Coinstaller installation ------ +; + +[hypertrace_Device.NT.CoInstallers] +AddReg=hypertrace_Device_CoInstaller_AddReg +CopyFiles=hypertrace_Device_CoInstaller_CopyFiles + +[hypertrace_Device_CoInstaller_AddReg] +HKR,,CoInstallers32,0x00010000, "WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll,WdfCoInstaller" + +[hypertrace_Device_CoInstaller_CopyFiles] +WdfCoInstaller$KMDFCOINSTALLERVERSION$.dll + +[hypertrace_Device.NT.Wdf] +KmdfService = hypertrace, hypertrace_wdfsect +[hypertrace_wdfsect] +KmdfLibraryVersion = $KMDFVERSION$ + +[Strings] +SPSVCINST_ASSOCSERVICE= 0x00000002 +ManufacturerName="" ;TODO: Replace with your manufacturer name +DiskName = "hypertrace Installation Disk" +hypertrace.DeviceDesc = "hypertrace Device" +hypertrace.SVCDESC = "hypertrace Service" diff --git a/hyperdbg/hypertrace/hypertrace.vcxproj b/hyperdbg/hypertrace/hypertrace.vcxproj new file mode 100644 index 00000000..b0848af2 --- /dev/null +++ b/hyperdbg/hypertrace/hypertrace.vcxproj @@ -0,0 +1,122 @@ + + + + + debug + x64 + + + release + x64 + + + + {9FA45E25-DAEB-4C2D-806C-7908A180195D} + {1bc93793-694f-48fe-9372-81e2b05556fd} + v4.5 + 12.0 + Debug + x64 + hypertrace + $(LatestTargetPlatformVersion) + + + + Windows10 + true + WindowsKernelModeDriver10.0 + DynamicLibrary + KMDF + Universal + false + + + Windows10 + false + WindowsKernelModeDriver10.0 + DynamicLibrary + KMDF + Universal + false + + + + + + + + + + + DbgengKernelDebugger + $(SolutionDir)build\bin\$(Configuration)\ + $(SolutionDir)build\obj\$(ProjectName)\$(Platform)\$(Configuration)\ + false + + + DbgengKernelDebugger + $(SolutionDir)build\bin\$(Configuration)\ + $(SolutionDir)build\obj\$(ProjectName)\$(Platform)\$(Configuration)\ + false + + + + sha256 + + + $(SolutionDir)\include;$(ProjectDir)header;%(AdditionalIncludeDirectories) + true + Create + pch.h + stdcpp20 + + + true + + true + hypertrace.def + + + + + sha256 + + + $(SolutionDir)\include;$(ProjectDir)header;%(AdditionalIncludeDirectories) + true + Create + pch.h + stdcpp20 + Full + + + true + + true + hypertrace.def + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/hyperdbg/hypertrace/hypertrace.vcxproj.filters b/hyperdbg/hypertrace/hypertrace.vcxproj.filters new file mode 100644 index 00000000..47593d3d --- /dev/null +++ b/hyperdbg/hypertrace/hypertrace.vcxproj.filters @@ -0,0 +1,62 @@ + + + + + {8E41214B-6785-4CFE-B992-037D68949A14} + inf;inv;inx;mof;mc; + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hpp;hxx;hm;inl;inc;xsd + + + {1ab177b4-9e6c-460e-834a-8fced04b42a3} + + + {21f0281e-fc2a-4e13-97ac-e4b35a05a31e} + + + + + Driver Files + + + + + code + + + code + + + code + + + code\platform + + + + + header + + + header + + + header + + + header + + + header\platform + + + header\platform + + + \ No newline at end of file