vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-10 01:29:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

update symbol structure and stack buffer in script engine

Browse source
This commit is contained in:
xmaple555 2024-08-23 22:33:36 +08:00
parent 8edd118a40
commit 211295bf81
7 changed files with 636 additions and 681 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hyperdbg/hyperkd/code/debugger/core/Debugger.c
View file

@ -162,7 +162,7 @@ DebuggerInitialize()
if (!CurrentDebuggerState->ScriptEngineCoreSpecificStackBuffer)
{
CurrentDebuggerState->ScriptEngineCoreSpecificStackBuffer = PlatformMemAllocateNonPagedPool(MAX_STACK_BUFFER_COUNT * sizeof(SYMBOL));
CurrentDebuggerState->ScriptEngineCoreSpecificStackBuffer = PlatformMemAllocateNonPagedPool(MAX_STACK_BUFFER_COUNT * sizeof(UINT64));
}
if (!CurrentDebuggerState->ScriptEngineCoreSpecificStackBuffer)
@ -176,7 +176,7 @@ DebuggerInitialize()
//
// Zero stack buffer memory
//
RtlZeroMemory(CurrentDebuggerState->ScriptEngineCoreSpecificStackBuffer, MAX_STACK_BUFFER_COUNT * sizeof(SYMBOL));
RtlZeroMemory(CurrentDebuggerState->ScriptEngineCoreSpecificStackBuffer, MAX_STACK_BUFFER_COUNT * sizeof(UINT64));
}
//
@ -1630,7 +1630,7 @@ DebuggerPerformRunScript(PROCESSOR_DEBUGGING_STATE * DbgState,
//
ScriptGeneralRegisters.StackBuffer = DbgState->ScriptEngineCoreSpecificStackBuffer;
ScriptGeneralRegisters.GlobalVariablesList = g_ScriptGlobalVariables;
RtlZeroMemory(ScriptGeneralRegisters.StackBuffer, MAX_STACK_BUFFER_COUNT * sizeof(SYMBOL));
RtlZeroMemory(ScriptGeneralRegisters.StackBuffer, MAX_STACK_BUFFER_COUNT * sizeof(UINT64));
UINT64 EXECUTENUMBER = 0;

3
hyperdbg/include/SDK/headers/ScriptEngineCommonDefinitions.h
View file

@ -6,11 +6,12 @@ typedef struct SYMBOL
{
long long unsigned Type;
long long unsigned Len;
long long unsigned VariableType;
long long unsigned Value;
} SYMBOL, *PSYMBOL;
#define SIZE_SYMBOL_WITHOUT_LEN sizeof(long long unsigned) * 2
typedef struct HWDBG_SHORT_SYMBOL
{
long long unsigned Type;

16
hyperdbg/libhyperdbg/code/debugger/script-engine/script-engine-wrapper.cpp
View file

@ -340,7 +340,7 @@ ScriptEngineEvalWrapper(PGUEST_REGS GuestRegs,
//
if (!g_ScriptStackBuffer)
{
g_ScriptStackBuffer = (UINT64 *)malloc(MAX_STACK_BUFFER_COUNT * sizeof(SYMBOL));
g_ScriptStackBuffer = (UINT64 *)malloc(MAX_STACK_BUFFER_COUNT * sizeof(UINT64));
if (g_ScriptStackBuffer == NULL)
{
@ -350,8 +350,6 @@ ScriptEngineEvalWrapper(PGUEST_REGS GuestRegs,
return;
}
RtlZeroMemory(g_ScriptStackBuffer, MAX_STACK_BUFFER_COUNT * sizeof(SYMBOL));
}
//
@ -373,7 +371,7 @@ ScriptEngineEvalWrapper(PGUEST_REGS GuestRegs,
ScriptGeneralRegisters.StackBuffer = g_ScriptStackBuffer;
ScriptGeneralRegisters.GlobalVariablesList = g_ScriptGlobalVariables;
RtlZeroMemory(g_ScriptStackBuffer, MAX_STACK_BUFFER_COUNT * sizeof(SYMBOL));
RtlZeroMemory(g_ScriptStackBuffer, MAX_STACK_BUFFER_COUNT * sizeof(UINT64));
if (CodeBuffer->Message == NULL)
{
@ -400,15 +398,7 @@ ScriptEngineEvalWrapper(PGUEST_REGS GuestRegs,
printf("Stack Buffer:\n");
for (UINT64 j = 0; j < ScriptGeneralRegisters.StackIndx; j++)
{
PSYMBOL StackSymbol = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters.StackBuffer +
(unsigned long long)(j * sizeof(SYMBOL)));
printf("StackIndx = %lld, Value = %lld", j, StackSymbol->Value);
if (StackSymbol->Type == SYMBOL_RETURN_ADDRESS_TYPE)
{
printf(", Type = SYMBOL_RETURN_ADDRESS_TYPE");
}
printf("StackIndx = %lld, Value = %lld", j, ScriptGeneralRegisters.StackBuffer[j]);
if (j == ScriptGeneralRegisters.StackBaseIndx)
{

1192
hyperdbg/script-engine/code/parse-table.c
View file

File diff suppressed because it is too large Load diff

13
hyperdbg/script-engine/code/script-engine.c
View file

@ -1064,7 +1064,7 @@ CodeGen(PTOKEN_LIST MatchedStack, PSYMBOL_BUFFER CodeBuffer, PTOKEN Operator, PS
for (int i = MatchedStack->Pointer; i > 0; i--)
{
Op1 = Top(MatchedStack);
if (Op1->Type == TEMP || Op1->Type == HEX || Op1->Type == OCTAL || Op1->Type == BINARY)
if (Op1->Type == TEMP || Op1->Type == HEX || Op1->Type == OCTAL || Op1->Type == BINARY || Op1->Type == PSEUDO_REGISTER)
{
*Error = SCRIPT_ENGINE_ERROR_SYNTAX;
Pop(MatchedStack);
@ -1183,7 +1183,7 @@ CodeGen(PTOKEN_LIST MatchedStack, PSYMBOL_BUFFER CodeBuffer, PTOKEN Operator, PS
break;
}
Op1Symbol->VariableType = (unsigned long long)VariableType;
//Op1Symbol->VariableType = (unsigned long long)VariableType;
}
}
@ -2604,7 +2604,6 @@ NewSymbol(void)
Symbol->Value = 0;
Symbol->Len = 0;
Symbol->Type = 0;
Symbol->VariableType = 0;
return Symbol;
}
@ -2618,7 +2617,7 @@ PSYMBOL
NewStringSymbol(PTOKEN Token)
{
PSYMBOL Symbol;
int BufferSize = (3 * sizeof(unsigned long long) + Token->Len) / sizeof(SYMBOL) + 1;
int BufferSize = (SIZE_SYMBOL_WITHOUT_LEN + Token->Len) / sizeof(SYMBOL) + 1;
Symbol = (PSYMBOL)calloc(sizeof(SYMBOL), BufferSize);
if (Symbol == NULL)
@ -2632,7 +2631,6 @@ NewStringSymbol(PTOKEN Token)
memcpy(&Symbol->Value, Token->Value, Token->Len);
SetType(&Symbol->Type, SYMBOL_STRING_TYPE);
Symbol->Len = Token->Len;
Symbol->VariableType = 0;
return Symbol;
}
@ -2646,7 +2644,7 @@ PSYMBOL
NewWstringSymbol(PTOKEN Token)
{
PSYMBOL Symbol;
int BufferSize = (3 * sizeof(unsigned long long) + Token->Len) / sizeof(SYMBOL) + 1;
int BufferSize = (SIZE_SYMBOL_WITHOUT_LEN + Token->Len) / sizeof(SYMBOL) + 1;
Symbol = (PSYMBOL)malloc(BufferSize * sizeof(SYMBOL));
if (Symbol == NULL)
@ -2660,7 +2658,6 @@ NewWstringSymbol(PTOKEN Token)
memcpy(&Symbol->Value, Token->Value, Token->Len);
SetType(&Symbol->Type, SYMBOL_WSTRING_TYPE);
Symbol->Len = Token->Len;
Symbol->VariableType = 0;
return Symbol;
}
@ -2679,7 +2676,7 @@ NewWstringSymbol(PTOKEN Token)
unsigned int
GetSymbolHeapSize(PSYMBOL Symbol)
{
int Temp = (3 * sizeof(unsigned long long) + (int)Symbol->Len) / sizeof(SYMBOL) + 1;
int Temp = (SIZE_SYMBOL_WITHOUT_LEN + (int)Symbol->Len) / sizeof(SYMBOL) + 1;
return Temp;
}

3
hyperdbg/script-engine/python/generator.py
View file

@ -113,11 +113,12 @@ typedef struct SYMBOL
{
long long unsigned Type;
long long unsigned Len;
long long unsigned VariableType;
long long unsigned Value;
} SYMBOL, *PSYMBOL;
#define SIZE_SYMBOL_WITHOUT_LEN sizeof(long long unsigned) * 2
typedef struct HWDBG_SHORT_SYMBOL
{
long long unsigned Type;

84
hyperdbg/script-eval/code/ScriptEngineEval.c
View file

@ -144,24 +144,18 @@ GetValue(PGUEST_REGS GuestRegs,
return ScriptGeneralRegisters->ReturnValue;
case SYMBOL_TEMP_TYPE:
{
PSYMBOL TempSymbol = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters->StackBuffer +
(unsigned long long)((ScriptGeneralRegisters->StackBaseIndx + Symbol->Value) * sizeof(SYMBOL)));
if (ReturnReference)
return (UINT64)&TempSymbol->Value;
return (UINT64)&ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackBaseIndx + Symbol->Value];
else
return TempSymbol->Value;
}
return ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackBaseIndx + Symbol->Value];
case SYMBOL_FUNCTION_PARAMETER_ID_TYPE:
{
PSYMBOL TempSymbol = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters->StackBuffer +
(unsigned long long)((ScriptGeneralRegisters->StackBaseIndx - 3 - Symbol->Value) * sizeof(SYMBOL)));
if (ReturnReference)
return (UINT64)&TempSymbol->Value;
return (UINT64)&ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackBaseIndx - 3 - Symbol->Value];
else
return TempSymbol->Value;
}
return ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackBaseIndx - 3 - Symbol->Value];
}
//
@ -207,23 +201,13 @@ SetValue(PGUEST_REGS GuestRegs,
return;
case SYMBOL_TEMP_TYPE:
{
PSYMBOL TempSymbol = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters->StackBuffer +
(unsigned long long)((ScriptGeneralRegisters->StackBaseIndx + Symbol->Value) * sizeof(SYMBOL)));
TempSymbol->Value = Value;
ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackBaseIndx + Symbol->Value] = Value;
return;
}
case SYMBOL_FUNCTION_PARAMETER_ID_TYPE:
{
PSYMBOL TempSymbol = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters->StackBuffer +
(unsigned long long)((ScriptGeneralRegisters->StackBaseIndx - 3 - Symbol->Value) * sizeof(SYMBOL)));
TempSymbol->Value = Value;
ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackBaseIndx - 3 - Symbol->Value] = Value;
return;
}
}
}
/**
@ -1335,7 +1319,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src0->Type == SYMBOL_STRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src0->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src0->Len) /
sizeof(SYMBOL));
SrcVal0 = (UINT64)&Src0->Value;
}
@ -1403,7 +1387,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src0->Type == SYMBOL_WSTRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src0->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src0->Len) /
sizeof(SYMBOL));
SrcVal0 = (UINT64)&Src0->Value;
}
@ -1718,13 +1702,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
SrcVal0 =
GetValue(GuestRegs, ActionDetail, ScriptGeneralRegisters, Src0, FALSE);
Des = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters->StackBuffer +
(unsigned long long)(ScriptGeneralRegisters->StackIndx * sizeof(SYMBOL)));
Des->Value = SrcVal0;
Des->Len = 0;
Des->Type = 0;
Des->VariableType = 0;
ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackIndx] = SrcVal0;
ScriptGeneralRegisters->StackIndx++;
break;
@ -1732,10 +1710,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
case FUNC_POP:
ScriptGeneralRegisters->StackIndx--;
Src0 = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters->StackBuffer +
(unsigned long long)(ScriptGeneralRegisters->StackIndx * sizeof(SYMBOL)));
SrcVal0 = Src0->Value;
SrcVal0 = ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackIndx];
Des = (PSYMBOL)((unsigned long long)CodeBuffer->Head +
(unsigned long long)(*Indx * sizeof(SYMBOL)));
@ -1752,13 +1727,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
*Indx = *Indx + 1;
Des = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters->StackBuffer +
(unsigned long long)(ScriptGeneralRegisters->StackIndx * sizeof(SYMBOL)));
Des->Value = *Indx;
Des->Len = 0;
Des->Type = SYMBOL_RETURN_ADDRESS_TYPE;
Des->VariableType = 0;
ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackIndx] = *Indx;
ScriptGeneralRegisters->StackIndx++;
@ -1768,11 +1737,8 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
case FUNC_RET:
ScriptGeneralRegisters->StackIndx--;
Src0 = (PSYMBOL)((unsigned long long)ScriptGeneralRegisters->StackBuffer +
(unsigned long long)(ScriptGeneralRegisters->StackIndx * sizeof(SYMBOL)));
SrcVal0 = Src0->Value;
*Indx = SrcVal0;
*Indx = ScriptGeneralRegisters->StackBuffer[ScriptGeneralRegisters->StackIndx];
break;
case FUNC_STRCMP:
@ -1784,7 +1750,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src0->Type == SYMBOL_STRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src0->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src0->Len) /
sizeof(SYMBOL));
SrcVal0 = (UINT64)&Src0->Value;
}
@ -1802,7 +1768,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src1->Type == SYMBOL_STRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src1->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src1->Len) /
sizeof(SYMBOL));
SrcVal1 = (UINT64)&Src1->Value;
}
@ -1833,7 +1799,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src0->Type == SYMBOL_WSTRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src0->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src0->Len) /
sizeof(SYMBOL));
SrcVal0 = (UINT64)&Src0->Value;
}
@ -1851,7 +1817,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src1->Type == SYMBOL_WSTRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src1->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src1->Len) /
sizeof(SYMBOL));
SrcVal1 = (UINT64)&Src1->Value;
}
@ -1890,7 +1856,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src1->Type == SYMBOL_STRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src1->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src1->Len) /
sizeof(SYMBOL));
SrcVal1 = (UINT64)&Src1->Value;
}
@ -1908,7 +1874,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src2->Type == SYMBOL_STRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src2->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src2->Len) /
sizeof(SYMBOL));
SrcVal2 = (UINT64)&Src2->Value;
}
@ -1947,7 +1913,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src1->Type == SYMBOL_STRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src1->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src1->Len) /
sizeof(SYMBOL));
SrcVal1 = (UINT64)&Src1->Value;
}
@ -1965,7 +1931,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src2->Type == SYMBOL_STRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src2->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src2->Len) /
sizeof(SYMBOL));
SrcVal2 = (UINT64)&Src2->Value;
}
@ -2004,7 +1970,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src1->Type == SYMBOL_WSTRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src1->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src1->Len) /
sizeof(SYMBOL));
SrcVal1 = (UINT64)&Src1->Value;
}
@ -2022,7 +1988,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
if (Src2->Type == SYMBOL_WSTRING_TYPE)
{
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src2->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src2->Len) /
sizeof(SYMBOL));
SrcVal2 = (UINT64)&Src2->Value;
}
@ -2054,7 +2020,7 @@ ScriptEngineExecute(PGUEST_REGS GuestRegs,
//
*Indx =
*Indx + ((3 * sizeof(unsigned long long) + Src0->Len) /
*Indx + ((SIZE_SYMBOL_WITHOUT_LEN + Src0->Len) /
sizeof(SYMBOL));
Src1 = (PSYMBOL)((unsigned long long)CodeBuffer->Head +