From 1b4d3f448b71a9bd606e8d7fe1a6a4e923698dfa Mon Sep 17 00:00:00 2001 From: Sinaei Date: Sun, 15 Oct 2023 00:08:45 +0900 Subject: [PATCH] remove the dependency of the termination to event changes --- .../code/debugger/core/debugger.cpp | 24 +- .../code/debugger/kernel-level/kd.cpp | 28 +- .../kernel-level/kernel-listening.cpp | 42 +-- hyperdbg/hprdbgctrl/header/globals.h | 4 +- hyperdbg/hprdbgctrl/header/kd.h | 4 +- .../hprdbgkd/code/debugger/core/Debugger.c | 85 +----- .../hprdbgkd/code/debugger/core/Termination.c | 253 +++++------------- hyperdbg/hprdbgkd/code/driver/Ioctl.c | 10 +- .../hprdbgkd/header/debugger/core/Debugger.h | 6 +- hyperdbg/include/SDK/Headers/Events.h | 4 +- 10 files changed, 133 insertions(+), 327 deletions(-) diff --git a/hyperdbg/hprdbgctrl/code/debugger/core/debugger.cpp b/hyperdbg/hprdbgctrl/code/debugger/core/debugger.cpp index 2eac940a..9f4cc9f9 100644 --- a/hyperdbg/hprdbgctrl/code/debugger/core/debugger.cpp +++ b/hyperdbg/hprdbgctrl/code/debugger/core/debugger.cpp @@ -1727,8 +1727,8 @@ SendEventToKernel(PDEBUGGER_GENERAL_EVENT_DETAIL Event, { BOOL Status; ULONG ReturnedLength; - DEBUGGER_EVENT_AND_ACTION_REG_BUFFER ReturnedBuffer = {0}; - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER TempRegResult; + DEBUGGER_EVENT_AND_ACTION_RESULT ReturnedBuffer = {0}; + PDEBUGGER_EVENT_AND_ACTION_RESULT TempRegResult; if (g_IsSerialConnectedToRemoteDebuggee) { @@ -1745,7 +1745,7 @@ SendEventToKernel(PDEBUGGER_GENERAL_EVENT_DETAIL Event, // // Move the buffer to local buffer // - memcpy(&ReturnedBuffer, TempRegResult, sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER)); + memcpy(&ReturnedBuffer, TempRegResult, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT)); } else { @@ -1764,7 +1764,7 @@ SendEventToKernel(PDEBUGGER_GENERAL_EVENT_DETAIL Event, Event, // Input Buffer to driver. EventBufferLength, // Input buffer length &ReturnedBuffer, // Output Buffer from driver. - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER), // Length + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length // of // output // buffer @@ -1849,8 +1849,8 @@ RegisterActionToEvent(PDEBUGGER_GENERAL_EVENT_DETAIL Event, { BOOL Status; ULONG ReturnedLength; - DEBUGGER_EVENT_AND_ACTION_REG_BUFFER ReturnedBuffer = {0}; - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER TempAddingResult; + DEBUGGER_EVENT_AND_ACTION_RESULT ReturnedBuffer = {0}; + PDEBUGGER_EVENT_AND_ACTION_RESULT TempAddingResult; if (g_IsSerialConnectedToRemoteDebuggee) { @@ -1873,7 +1873,7 @@ RegisterActionToEvent(PDEBUGGER_GENERAL_EVENT_DETAIL Event, // // Move the buffer to local buffer // - memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER)); + memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT)); } // @@ -1891,7 +1891,7 @@ RegisterActionToEvent(PDEBUGGER_GENERAL_EVENT_DETAIL Event, // // Move the buffer to local buffer // - memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER)); + memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT)); } // @@ -1909,7 +1909,7 @@ RegisterActionToEvent(PDEBUGGER_GENERAL_EVENT_DETAIL Event, // // Move the buffer to local buffer // - memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER)); + memcpy(&ReturnedBuffer, TempAddingResult, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT)); } } else @@ -1935,7 +1935,7 @@ RegisterActionToEvent(PDEBUGGER_GENERAL_EVENT_DETAIL Event, ActionBreakToDebugger, // Input Buffer to driver. ActionBreakToDebuggerLength, // Input buffer length &ReturnedBuffer, // Output Buffer from driver. - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER), // Length + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length // of // output // buffer @@ -1963,7 +1963,7 @@ RegisterActionToEvent(PDEBUGGER_GENERAL_EVENT_DETAIL Event, ActionCustomCode, // Input Buffer to driver. ActionCustomCodeLength, // Input buffer length &ReturnedBuffer, // Output Buffer from driver. - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER), // Length + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length // of // output // buffer @@ -1991,7 +1991,7 @@ RegisterActionToEvent(PDEBUGGER_GENERAL_EVENT_DETAIL Event, ActionScript, // Input Buffer to driver. ActionScriptLength, // Input buffer length &ReturnedBuffer, // Output Buffer from driver. - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER), // Length + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length // of // output // buffer diff --git a/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kd.cpp b/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kd.cpp index fc04f55c..6f426d58 100644 --- a/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kd.cpp +++ b/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kd.cpp @@ -27,8 +27,8 @@ extern BOOLEAN g_IsConnectedToHyperDbgLocally; extern OVERLAPPED g_OverlappedIoStructureForReadDebugger; extern OVERLAPPED g_OverlappedIoStructureForWriteDebugger; extern OVERLAPPED g_OverlappedIoStructureForReadDebuggee; -extern DEBUGGER_EVENT_AND_ACTION_REG_BUFFER g_DebuggeeResultOfRegisteringEvent; -extern DEBUGGER_EVENT_AND_ACTION_REG_BUFFER +extern DEBUGGER_EVENT_AND_ACTION_RESULT g_DebuggeeResultOfRegisteringEvent; +extern DEBUGGER_EVENT_AND_ACTION_RESULT g_DebuggeeResultOfAddingActionsToEvent; extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee; extern BOOLEAN g_IsSerialConnectedToRemoteDebugger; @@ -626,9 +626,9 @@ KdSendEditMemoryPacketToDebuggee(PDEBUGGER_EDIT_MEMORY EditMem, UINT32 Size) * @param Event * @param EventBufferLength * - * @return PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER + * @return PDEBUGGER_EVENT_AND_ACTION_RESULT */ -PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER +PDEBUGGER_EVENT_AND_ACTION_RESULT KdSendRegisterEventPacketToDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL Event, UINT32 EventBufferLength) { @@ -661,7 +661,7 @@ KdSendRegisterEventPacketToDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL Event, EventBufferLength); RtlZeroMemory(&g_DebuggeeResultOfRegisteringEvent, - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER)); + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT)); // // Send register event packet @@ -693,9 +693,9 @@ KdSendRegisterEventPacketToDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL Event, * @param GeneralAction * @param GeneralActionLength * - * @return PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER + * @return PDEBUGGER_EVENT_AND_ACTION_RESULT */ -PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER +PDEBUGGER_EVENT_AND_ACTION_RESULT KdSendAddActionToEventPacketToDebuggee(PDEBUGGER_GENERAL_ACTION GeneralAction, UINT32 GeneralActionLength) { @@ -728,7 +728,7 @@ KdSendAddActionToEventPacketToDebuggee(PDEBUGGER_GENERAL_ACTION GeneralAction, GeneralActionLength); RtlZeroMemory(&g_DebuggeeResultOfAddingActionsToEvent, - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER)); + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT)); // // Send add action to event packet @@ -2839,7 +2839,7 @@ KdRegisterEventInDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL EventRegBuffer, { BOOL Status; ULONG ReturnedLength; - DEBUGGER_EVENT_AND_ACTION_REG_BUFFER ReturnedBuffer = {0}; + DEBUGGER_EVENT_AND_ACTION_RESULT ReturnedBuffer = {0}; AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse); @@ -2853,7 +2853,7 @@ KdRegisterEventInDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL EventRegBuffer, Length // Input Buffer to driver. , // Input buffer length &ReturnedBuffer, // Output Buffer from driver. - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER), // Length + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length // of // output // buffer @@ -2876,7 +2876,7 @@ KdRegisterEventInDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL EventRegBuffer, return KdSendGeneralBuffersFromDebuggeeToDebugger( DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_REGISTERING_EVENT, &ReturnedBuffer, - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER), + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), TRUE); } @@ -2893,7 +2893,7 @@ KdAddActionToEventInDebuggee(PDEBUGGER_GENERAL_ACTION ActionAddingBuffer, { BOOL Status; ULONG ReturnedLength; - DEBUGGER_EVENT_AND_ACTION_REG_BUFFER ReturnedBuffer = {0}; + DEBUGGER_EVENT_AND_ACTION_RESULT ReturnedBuffer = {0}; AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse); @@ -2903,7 +2903,7 @@ KdAddActionToEventInDebuggee(PDEBUGGER_GENERAL_ACTION ActionAddingBuffer, ActionAddingBuffer, // Input Buffer to driver. Length, // Input buffer length &ReturnedBuffer, // Output Buffer from driver. - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER), // Length + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), // Length // of // output // buffer @@ -2926,7 +2926,7 @@ KdAddActionToEventInDebuggee(PDEBUGGER_GENERAL_ACTION ActionAddingBuffer, return KdSendGeneralBuffersFromDebuggeeToDebugger( DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_ADDING_ACTION_TO_EVENT, &ReturnedBuffer, - sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER), + sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT), TRUE); } diff --git a/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp b/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp index 32cdedae..acbf4f83 100644 --- a/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp +++ b/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp @@ -16,22 +16,22 @@ // Global Variables // extern DEBUGGER_SYNCRONIZATION_EVENTS_STATE - g_KernelSyncronizationObjectsHandleTable[DEBUGGER_MAXIMUM_SYNCRONIZATION_KERNEL_DEBUGGER_OBJECTS]; -extern BYTE g_CurrentRunningInstruction[MAXIMUM_INSTR_SIZE]; -extern OVERLAPPED g_OverlappedIoStructureForReadDebugger; -extern OVERLAPPED g_OverlappedIoStructureForWriteDebugger; -extern HANDLE g_SerialRemoteComPortHandle; -extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee; -extern BOOLEAN g_IsDebuggeeRunning; -extern BOOLEAN g_IgnoreNewLoggingMessages; -extern BOOLEAN g_SharedEventStatus; -extern BOOLEAN g_IsRunningInstruction32Bit; -extern BOOLEAN g_OutputSourcesInitialized; -extern ULONG g_CurrentRemoteCore; -extern DEBUGGER_EVENT_AND_ACTION_REG_BUFFER g_DebuggeeResultOfRegisteringEvent; -extern DEBUGGER_EVENT_AND_ACTION_REG_BUFFER g_DebuggeeResultOfAddingActionsToEvent; -extern UINT64 g_ResultOfEvaluatedExpression; -extern UINT32 g_ErrorStateOfResultOfEvaluatedExpression; + g_KernelSyncronizationObjectsHandleTable[DEBUGGER_MAXIMUM_SYNCRONIZATION_KERNEL_DEBUGGER_OBJECTS]; +extern BYTE g_CurrentRunningInstruction[MAXIMUM_INSTR_SIZE]; +extern OVERLAPPED g_OverlappedIoStructureForReadDebugger; +extern OVERLAPPED g_OverlappedIoStructureForWriteDebugger; +extern HANDLE g_SerialRemoteComPortHandle; +extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee; +extern BOOLEAN g_IsDebuggeeRunning; +extern BOOLEAN g_IgnoreNewLoggingMessages; +extern BOOLEAN g_SharedEventStatus; +extern BOOLEAN g_IsRunningInstruction32Bit; +extern BOOLEAN g_OutputSourcesInitialized; +extern ULONG g_CurrentRemoteCore; +extern DEBUGGER_EVENT_AND_ACTION_RESULT g_DebuggeeResultOfRegisteringEvent; +extern DEBUGGER_EVENT_AND_ACTION_RESULT g_DebuggeeResultOfAddingActionsToEvent; +extern UINT64 g_ResultOfEvaluatedExpression; +extern UINT32 g_ErrorStateOfResultOfEvaluatedExpression; /** * @brief Check if the remote debuggee needs to pause the system @@ -49,7 +49,7 @@ ListeningSerialPortInDebugger() PDEBUGGEE_CHANGE_CORE_PACKET ChangeCorePacket; PDEBUGGEE_SCRIPT_PACKET ScriptPacket; PDEBUGGEE_FORMATS_PACKET FormatsPacket; - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER EventAndActionPacket; + PDEBUGGER_EVENT_AND_ACTION_RESULT EventAndActionPacket; PDEBUGGER_UPDATE_SYMBOL_TABLE SymbolUpdatePacket; PDEBUGGER_MODIFY_EVENTS EventModifyAndQueryPacket; PDEBUGGEE_SYMBOL_UPDATE_RESULT SymbolReloadFinishedPacket; @@ -667,12 +667,12 @@ StartAgain: case DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_REGISTERING_EVENT: - EventAndActionPacket = (DEBUGGER_EVENT_AND_ACTION_REG_BUFFER *)(((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET)); + EventAndActionPacket = (DEBUGGER_EVENT_AND_ACTION_RESULT *)(((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET)); // // Move the buffer to the global variable // - memcpy(&g_DebuggeeResultOfRegisteringEvent, EventAndActionPacket, sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER)); + memcpy(&g_DebuggeeResultOfRegisteringEvent, EventAndActionPacket, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT)); // // Signal the event relating to receiving result of register event @@ -683,12 +683,12 @@ StartAgain: case DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_ADDING_ACTION_TO_EVENT: - EventAndActionPacket = (DEBUGGER_EVENT_AND_ACTION_REG_BUFFER *)(((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET)); + EventAndActionPacket = (DEBUGGER_EVENT_AND_ACTION_RESULT *)(((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET)); // // Move the buffer to the global variable // - memcpy(&g_DebuggeeResultOfAddingActionsToEvent, EventAndActionPacket, sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER)); + memcpy(&g_DebuggeeResultOfAddingActionsToEvent, EventAndActionPacket, sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT)); // // Signal the event relating to receiving result of adding action to event diff --git a/hyperdbg/hprdbgctrl/header/globals.h b/hyperdbg/hprdbgctrl/header/globals.h index 451b99ff..40d0a09b 100644 --- a/hyperdbg/hprdbgctrl/header/globals.h +++ b/hyperdbg/hprdbgctrl/header/globals.h @@ -280,13 +280,13 @@ HANDLE g_DebuggeeStopCommandEventHandle = NULL; * @brief Holds the result of registering events from the remote debuggee * */ -DEBUGGER_EVENT_AND_ACTION_REG_BUFFER g_DebuggeeResultOfRegisteringEvent = {0}; +DEBUGGER_EVENT_AND_ACTION_RESULT g_DebuggeeResultOfRegisteringEvent = {0}; /** * @brief Holds the result of adding action to events from the remote debuggee * */ -DEBUGGER_EVENT_AND_ACTION_REG_BUFFER g_DebuggeeResultOfAddingActionsToEvent = { +DEBUGGER_EVENT_AND_ACTION_RESULT g_DebuggeeResultOfAddingActionsToEvent = { 0}; /** diff --git a/hyperdbg/hprdbgctrl/header/kd.h b/hyperdbg/hprdbgctrl/header/kd.h index 35bf01c7..57502848 100644 --- a/hyperdbg/hprdbgctrl/header/kd.h +++ b/hyperdbg/hprdbgctrl/header/kd.h @@ -135,11 +135,11 @@ KdSendReadMemoryPacketToDebuggee(PDEBUGGER_READ_MEMORY ReadMem); BOOLEAN KdSendEditMemoryPacketToDebuggee(PDEBUGGER_EDIT_MEMORY EditMem, UINT32 Size); -PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER +PDEBUGGER_EVENT_AND_ACTION_RESULT KdSendRegisterEventPacketToDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL Event, UINT32 EventBufferLength); -PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER +PDEBUGGER_EVENT_AND_ACTION_RESULT KdSendAddActionToEventPacketToDebuggee(PDEBUGGER_GENERAL_ACTION GeneralAction, UINT32 GeneralActionLength); diff --git a/hyperdbg/hprdbgkd/code/debugger/core/Debugger.c b/hyperdbg/hprdbgkd/code/debugger/core/Debugger.c index e5d4d3d4..a013962a 100644 --- a/hyperdbg/hprdbgkd/code/debugger/core/Debugger.c +++ b/hyperdbg/hprdbgkd/code/debugger/core/Debugger.c @@ -2116,9 +2116,9 @@ DebuggerRemoveEvent(UINT64 Tag) * @return BOOLEAN TRUE if the event was valid otherwise returns FALSE */ BOOLEAN -DebuggerValidateEvent(PDEBUGGER_GENERAL_EVENT_DETAIL EventDetails, - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER ResultsToReturn, - BOOLEAN InputFromVmxRoot) +DebuggerValidateEvent(PDEBUGGER_GENERAL_EVENT_DETAIL EventDetails, + PDEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn, + BOOLEAN InputFromVmxRoot) { UINT32 TempPid; @@ -2379,9 +2379,9 @@ DebuggerValidateEvent(PDEBUGGER_GENERAL_EVENT_DETAIL EventDetails, * @return BOOLEAN TRUE if the event was applied otherwise returns FALSE */ BOOLEAN -DebuggerApplyEvent(PDEBUGGER_EVENT Event, - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER ResultsToReturn, - BOOLEAN InputFromVmxRoot) +DebuggerApplyEvent(PDEBUGGER_EVENT Event, + PDEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn, + BOOLEAN InputFromVmxRoot) { UINT32 TempProcessId; UINT64 PagesBytes; @@ -2613,12 +2613,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case RDMSR_INSTRUCTION_EXECUTION: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - // // Let's see if it is for all cores or just one core // @@ -2646,12 +2640,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case WRMSR_INSTRUCTION_EXECUTION: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - // // Let's see if it is for all cores or just one core // @@ -2707,12 +2695,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case TSC_INSTRUCTION_EXECUTION: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - // // Let's see if it is for all cores or just one core // @@ -2735,12 +2717,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case PMC_INSTRUCTION_EXECUTION: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - // // Let's see if it is for all cores or just one core // @@ -2763,12 +2739,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case DEBUG_REGISTERS_ACCESSED: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - // // Let's see if it is for all cores or just one core // @@ -2791,12 +2761,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case CONTROL_REGISTER_MODIFIED: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - // // Setting an indicator to CR // @@ -2825,16 +2789,9 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case EXCEPTION_OCCURRED: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - // // Let's see if it is for all cores or just one core // - if (Event->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) { // @@ -2859,12 +2816,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case EXTERNAL_INTERRUPT_OCCURRED: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - // // Let's see if it is for all cores or just one core // @@ -2892,12 +2843,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case SYSCALL_HOOK_EFER_SYSCALL: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE SyscallHookType = DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY; // @@ -2941,12 +2886,6 @@ DebuggerApplyEvent(PDEBUGGER_EVENT Event, } case SYSCALL_HOOK_EFER_SYSRET: { - // - // KEEP IN MIND, WE USED THIS METHOD TO RE-APPLY THE EVENT ON - // TERMINATION ROUTINES, IF YOU WANT TO CHANGE IT, YOU SHOULD - // CHANGE THE TERMINATION.C RELATED FUNCTION TOO - // - DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE SyscallHookType = DEBUGGER_EVENT_SYSCALL_SYSRET_SAFE_ACCESS_MEMORY; // @@ -3079,9 +3018,9 @@ ClearTheEventAfterCreatingEvent: * otherwise returns FALSE */ BOOLEAN -DebuggerParseEvent(PDEBUGGER_GENERAL_EVENT_DETAIL EventDetails, - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER ResultsToReturn, - BOOLEAN InputFromVmxRoot) +DebuggerParseEvent(PDEBUGGER_GENERAL_EVENT_DETAIL EventDetails, + PDEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn, + BOOLEAN InputFromVmxRoot) { PDEBUGGER_EVENT Event; @@ -3217,9 +3156,9 @@ DebuggerParseEvent(PDEBUGGER_GENERAL_EVENT_DETAIL EventDetails, * otherwise, returns FALSE */ BOOLEAN -DebuggerParseAction(PDEBUGGER_GENERAL_ACTION Action, - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER ResultsToReturn, - BOOLEAN InputFromVmxRoot) +DebuggerParseAction(PDEBUGGER_GENERAL_ACTION Action, + PDEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn, + BOOLEAN InputFromVmxRoot) { // // Check if Tag is valid or not diff --git a/hyperdbg/hprdbgkd/code/debugger/core/Termination.c b/hyperdbg/hprdbgkd/code/debugger/core/Termination.c index c61e956a..a4e7bf98 100644 --- a/hyperdbg/hprdbgkd/code/debugger/core/Termination.c +++ b/hyperdbg/hprdbgkd/code/debugger/core/Termination.c @@ -23,7 +23,8 @@ VOID TerminateExternalInterruptEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; if (DebuggerEventListCount(&g_Events->ExternalInterruptOccurredEventsHead) > 1) { @@ -58,23 +59,11 @@ TerminateExternalInterruptEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandSetExternalInterruptExitingAllCores(); - } - else - { - // - // Just one core - // - ConfigureSetExternalInterruptExitingOnSingleCore(CurrentEvent->CoreId); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -197,7 +186,8 @@ TerminateHiddenHookExecDetoursEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxR VOID TerminateRdmsrExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; if (DebuggerEventListCount(&g_Events->RdmsrInstructionExecutionEventsHead) > 1) { @@ -232,23 +222,11 @@ TerminateRdmsrExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandChangeAllMsrBitmapReadAllCores(CurrentEvent->Options.OptionalParam1); - } - else - { - // - // Just one core - // - ConfigureChangeMsrBitmapReadOnSingleCore(CurrentEvent->CoreId, CurrentEvent->Options.OptionalParam1); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -278,7 +256,8 @@ TerminateRdmsrExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminateWrmsrExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; if (DebuggerEventListCount(&g_Events->WrmsrInstructionExecutionEventsHead) > 1) { @@ -313,23 +292,11 @@ TerminateWrmsrExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandChangeAllMsrBitmapWriteAllCores(CurrentEvent->Options.OptionalParam1); - } - else - { - // - // Just one core - // - ConfigureChangeMsrBitmapWriteOnSingleCore(CurrentEvent->CoreId, CurrentEvent->Options.OptionalParam1); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -359,7 +326,8 @@ TerminateWrmsrExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminateExceptionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; if (DebuggerEventListCount(&g_Events->ExceptionOccurredEventsHead) > 1) { @@ -394,24 +362,11 @@ TerminateExceptionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandSetExceptionBitmapAllCores(CurrentEvent->Options.OptionalParam1); - } - else - { - // - // Just one core - // - ConfigureSetExceptionBitmapOnSingleCore(CurrentEvent->CoreId, CurrentEvent->Options.OptionalParam1); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -441,7 +396,8 @@ TerminateExceptionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminateInInstructionExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; // // For this event we should also check for out instructions events too @@ -483,23 +439,11 @@ TerminateInInstructionExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmx // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandIoBitmapChangeAllCores(CurrentEvent->Options.OptionalParam1); - } - else - { - // - // Just one core - // - ConfigureChangeIoBitmapOnSingleCore(CurrentEvent->CoreId, CurrentEvent->Options.OptionalParam1); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -529,7 +473,8 @@ TerminateInInstructionExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmx VOID TerminateOutInstructionExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; // // For this event we should also check for out instructions events too @@ -571,23 +516,11 @@ TerminateOutInstructionExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVm // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandIoBitmapChangeAllCores(CurrentEvent->Options.OptionalParam1); - } - else - { - // - // Just one core - // - ConfigureChangeIoBitmapOnSingleCore(CurrentEvent->CoreId, CurrentEvent->Options.OptionalParam1); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -745,7 +678,8 @@ TerminateCpuidExecutionEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminateTscEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; if (DebuggerEventListCount(&g_Events->TscInstructionExecutionEventsHead) > 1) { @@ -780,23 +714,11 @@ TerminateTscEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandEnableRdtscExitingAllCores(); - } - else - { - // - // Just one core - // - ConfigureEnableRdtscExitingOnSingleCore(CurrentEvent->CoreId); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -826,7 +748,8 @@ TerminateTscEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminatePmcEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; if (DebuggerEventListCount(&g_Events->PmcInstructionExecutionEventsHead) > 1) { @@ -861,23 +784,11 @@ TerminatePmcEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandEnableRdpmcExitingAllCores(); - } - else - { - // - // Just one core - // - ConfigureEnableRdpmcExitingOnSingleCore(CurrentEvent->CoreId); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -907,7 +818,8 @@ TerminatePmcEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminateControlRegistersEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; if (DebuggerEventListCount(&g_Events->ControlRegisterModifiedEventsHead) > 1) { @@ -942,23 +854,11 @@ TerminateControlRegistersEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandEnableMovControlRegisterExitingAllCores(CurrentEvent); - } - else - { - // - // Just one core - // - ConfigureEnableMovToControlRegisterExitingOnSingleCore(CurrentEvent->CoreId, &CurrentEvent->Options); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -988,7 +888,8 @@ TerminateControlRegistersEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminateDebugRegistersEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; if (DebuggerEventListCount(&g_Events->DebugRegistersAccessedEventsHead) > 1) { @@ -1023,23 +924,11 @@ TerminateDebugRegistersEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - ExtensionCommandEnableMovDebugRegistersExitingAllCores(); - } - else - { - // - // Just one core - // - ConfigureEnableMovToDebugRegistersExitingOnSingleCore(CurrentEvent->CoreId); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -1069,7 +958,8 @@ TerminateDebugRegistersEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminateSyscallHookEferEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; // // For this event we should also check for sysret instructions events too @@ -1111,23 +1001,11 @@ TerminateSyscallHookEferEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - DebuggerEventEnableEferOnAllProcessors((DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE)CurrentEvent->Options.OptionalParam2); - } - else - { - // - // Just one core - // - ConfigureEnableEferSyscallHookOnSingleCore(CurrentEvent->CoreId, (DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE)CurrentEvent->Options.OptionalParam2); + LogInfo("Err, unable to re-apply previous events"); } } } @@ -1157,7 +1035,8 @@ TerminateSyscallHookEferEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) VOID TerminateSysretHookEferEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) { - PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList = 0; + DEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn = {0}; // // For this event we should also check for syscall instructions events too @@ -1199,23 +1078,11 @@ TerminateSysretHookEferEvent(PDEBUGGER_EVENT Event, BOOLEAN InputFromVmxRoot) // // re-apply the event // + DebuggerApplyEvent(CurrentEvent, &ResultsToReturn, InputFromVmxRoot); - // - // Let's see if it is for all cores or just one core - // - if (CurrentEvent->CoreId == DEBUGGER_EVENT_APPLY_TO_ALL_CORES) + if (!ResultsToReturn.IsSuccessful) { - // - // All cores - // - DebuggerEventEnableEferOnAllProcessors((DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE)CurrentEvent->Options.OptionalParam2); - } - else - { - // - // Just one core - // - ConfigureEnableEferSyscallHookOnSingleCore(CurrentEvent->CoreId, (DEBUGGER_EVENT_SYSCALL_SYSRET_TYPE)CurrentEvent->Options.OptionalParam2); + LogInfo("Err, unable to re-apply previous events"); } } } diff --git a/hyperdbg/hprdbgkd/code/driver/Ioctl.c b/hyperdbg/hprdbgkd/code/driver/Ioctl.c index 67a0805d..65bc9f55 100644 --- a/hyperdbg/hprdbgkd/code/driver/Ioctl.c +++ b/hyperdbg/hprdbgkd/code/driver/Ioctl.c @@ -32,7 +32,7 @@ DrvDispatchIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS DebuggerVa2paAndPa2vaRequest; PDEBUGGER_EDIT_MEMORY DebuggerEditMemoryRequest; PDEBUGGER_SEARCH_MEMORY DebuggerSearchMemoryRequest; - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER RegBufferResult; + PDEBUGGER_EVENT_AND_ACTION_RESULT RegBufferResult; PDEBUGGER_GENERAL_EVENT_DETAIL DebuggerNewEventRequest; PDEBUGGER_MODIFY_EVENTS DebuggerModifyEventRequest; PDEBUGGER_FLUSH_LOGGING_BUFFERS DebuggerFlushBuffersRequest; @@ -313,10 +313,10 @@ DrvDispatchIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) // at the same place (not comming from the VMX-root mode) // DebuggerParseEvent(DebuggerNewEventRequest, - (PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER)Irp->AssociatedIrp.SystemBuffer, + (PDEBUGGER_EVENT_AND_ACTION_RESULT)Irp->AssociatedIrp.SystemBuffer, FALSE); - Irp->IoStatus.Information = sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER); + Irp->IoStatus.Information = sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT); Status = STATUS_SUCCESS; // @@ -354,10 +354,10 @@ DrvDispatchIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) // at the same place // DebuggerParseAction(DebuggerNewActionRequest, - (PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER)Irp->AssociatedIrp.SystemBuffer, + (PDEBUGGER_EVENT_AND_ACTION_RESULT)Irp->AssociatedIrp.SystemBuffer, FALSE); - Irp->IoStatus.Information = sizeof(DEBUGGER_EVENT_AND_ACTION_REG_BUFFER); + Irp->IoStatus.Information = sizeof(DEBUGGER_EVENT_AND_ACTION_RESULT); Status = STATUS_SUCCESS; // diff --git a/hyperdbg/hprdbgkd/header/debugger/core/Debugger.h b/hyperdbg/hprdbgkd/header/debugger/core/Debugger.h index 93c08e47..3f742be5 100644 --- a/hyperdbg/hprdbgkd/header/debugger/core/Debugger.h +++ b/hyperdbg/hprdbgkd/header/debugger/core/Debugger.h @@ -231,17 +231,17 @@ DebuggerQueryDebuggerStatus(); BOOLEAN DebuggerParseEvent(PDEBUGGER_GENERAL_EVENT_DETAIL EventDetails, - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER ResultsToReturn, + PDEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn, BOOLEAN InputFromVmxRoot); BOOLEAN DebuggerApplyEvent(PDEBUGGER_EVENT Event, - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER ResultsToReturn, + PDEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn, BOOLEAN InputFromVmxRoot); BOOLEAN DebuggerParseAction(PDEBUGGER_GENERAL_ACTION Action, - PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER ResultsToReturn, + PDEBUGGER_EVENT_AND_ACTION_RESULT ResultsToReturn, BOOLEAN InputFromVmxRoot); BOOLEAN diff --git a/hyperdbg/include/SDK/Headers/Events.h b/hyperdbg/include/SDK/Headers/Events.h index cb6b97e0..ad018f7e 100644 --- a/hyperdbg/include/SDK/Headers/Events.h +++ b/hyperdbg/include/SDK/Headers/Events.h @@ -404,11 +404,11 @@ typedef struct _DEBUGGER_GENERAL_ACTION * @brief Status of register buffers * */ -typedef struct _DEBUGGER_EVENT_AND_ACTION_REG_BUFFER +typedef struct _DEBUGGER_EVENT_AND_ACTION_RESULT { BOOLEAN IsSuccessful; UINT32 Error; // If IsSuccessful was, FALSE -} DEBUGGER_EVENT_AND_ACTION_REG_BUFFER, *PDEBUGGER_EVENT_AND_ACTION_REG_BUFFER; +} DEBUGGER_EVENT_AND_ACTION_RESULT, *PDEBUGGER_EVENT_AND_ACTION_RESULT; #define SIZEOF_REGISTER_EVENT sizeof(REGISTER_NOTIFY_BUFFER)