vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add query IDT command

Browse source
This commit is contained in:
SinaKarvandi 2024-12-30 04:37:15 +01:00
parent dc9496749a
commit 23702ca4f1
20 changed files with 516 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

1
CHANGELOG.md
View file

@ -11,6 +11,7 @@ New release of the HyperDbg Debugger.
- Added the PCI tree command ([link](https://docs.hyperdbg.org/commands/extension-commands/pcitree))
- Added the proper handling for the xsetbv VM exits thanks to [@Shtan7](https://github.com/Shtan7) ([link](https://github.com/HyperDbg/HyperDbg/pull/491))
- Added the IDT command for interpreting Interrupt Descriptor Table (IDT) ([link](https://docs.hyperdbg.org/commands/extension-commands/idt))
- Export SDK APIs for getting Interrupt Descriptor Table (IDT) entries
### Changed
- Fix buffer overflow in the symbols path converter thanks to [@binophism](https://github.com/binophism) ([link](https://github.com/HyperDbg/HyperDbg/pull/490))

2
examples/README.md
View file

@ -1,3 +1,3 @@
# User-Mode and Kernel-Mode Examples
Examples for user-mode and kernel-mode are not yet completed and are currently under construction.
Examples for user-mode and kernel-mode are **NOT** yet completed and are currently **under construction**!

90
hyperdbg/hyperkd/code/debugger/commands/ExtensionCommands.c
View file

@ -80,6 +80,96 @@ ExtensionCommandPerformActionsForApicRequests(PDEBUGGER_APIC_REQUEST ApicRequest
}
}
/**
* @brief Perform query for IDT entries
*
* @param IdtQueryRequest
*
* @return VOID
*/
#pragma pack(push, 1)
typedef struct _SIDT_ENTRY
{
USHORT IdtLimit;
ULONG_PTR IdtBase;
} SIDT_ENTRY, *PSIDT_ENTRY;
typedef struct _KIDT_ENTRY
{
ULONG LowPart : 16;
ULONG SegmentSelector : 16;
ULONG Reserved1 : 5;
ULONG Reserved2 : 3;
ULONG Type : 3;
ULONG Size : 1;
ULONG Reserved3 : 1;
ULONG Dpl : 2;
ULONG Present : 1;
ULONG HighPart : 16;
#if defined _M_AMD64
ULONG HighestPart;
ULONG Reserved;
#endif
} KIDT_ENTRY, *PKIDT_ENTRY;
#pragma pack(pop)
/**
* @brief Perform query for IDT entries
*
* @param IdtQueryRequest
* @param ReadFromVmxRoot
*
* @return VOID
*/
VOID
ExtensionCommandPerformQueryIdtEntriesRequest(PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtQueryRequest,
BOOLEAN ReadFromVmxRoot)
{
SIDT_ENTRY IdtrReg;
KIDT_ENTRY * IdtEntries;
//
// Read IDTR register
//
if (!ReadFromVmxRoot)
{
//
// Since it's not in VMX Root, we can directly read the IDTR register
//
__sidt(&IdtrReg);
//
// Get the IDT base address
//
IdtEntries = (KIDT_ENTRY *)IdtrReg.IdtBase;
}
else
{
//
// Since it's in VMX Root, we need to read the IDTR register from the VMCS
//
IdtEntries = (KIDT_ENTRY *)GetGuestIdtr();
}
//
// Gather a list of IDT entries
//
for (UINT32 i = 0; i < MAX_NUMBER_OF_IDT_ENTRIES; i++)
{
IdtQueryRequest->IdtEntry[i] = (UINT64)((unsigned long long)IdtEntries[i].HighestPart << 32) |
((unsigned long long)IdtEntries[i].HighPart << 16) |
(unsigned long long)IdtEntries[i].LowPart;
}
//
// Operation was successful
//
IdtQueryRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
}
/**
* @brief routines for !va2pa and !pa2va commands
*

20
hyperdbg/hyperkd/code/debugger/kernel-level/Kd.c
View file

@ -2309,6 +2309,7 @@ KdDispatchAndPerformCommandsFromDebugger(PROCESSOR_DEBUGGING_STATE * DbgState)
PDEBUGGEE_BP_PACKET BpPacket;
PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PtePacket;
PDEBUGGER_APIC_REQUEST ApicPacket;
PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtEntryPacket;
PDEBUGGER_PAGE_IN_REQUEST PageinPacket;
PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS Va2paPa2vaPacket;
PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET BpListOrModifyPacket;
@ -3015,6 +3016,25 @@ KdDispatchAndPerformCommandsFromDebugger(PROCESSOR_DEBUGGING_STATE * DbgState)
break;
case DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_IDT_ENTRIES:
IdtEntryPacket = (INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS *)(((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET));
//
// Call IDT query handler (read from VMX root-mode)
//
ExtensionCommandPerformQueryIdtEntriesRequest(IdtEntryPacket, TRUE);
//
// Send the result of the IDT entries requests to the debuggee
//
KdResponsePacketToDebugger(DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER,
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_QUERY_IDT_ENTRIES_REQUESTS,
(CHAR *)IdtEntryPacket,
SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS);
break;
case DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_INJECT_PAGE_FAULT:
PageinPacket = (DEBUGGER_PAGE_IN_REQUEST *)(((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET));

44
hyperdbg/hyperkd/code/driver/Ioctl.c
View file

@ -41,6 +41,7 @@ DrvDispatchIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
PDEBUGGER_PREALLOC_COMMAND DebuggerReservePreallocPoolRequest;
PDEBUGGER_PREACTIVATE_COMMAND DebuggerPreactivationRequest;
PDEBUGGER_APIC_REQUEST DebuggerApicRequest;
PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS DebuggerQueryIdtRequest;
PDEBUGGER_UD_COMMAND_PACKET DebuggerUdCommandRequest;
PUSERMODE_LOADED_MODULE_DETAILS DebuggerUsermodeModulesRequest;
PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS DebuggerUsermodeProcessOrThreadQueryRequest;
@ -1149,6 +1150,49 @@ DrvDispatchIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
break;
case IOCTL_QUERY_IDT_ENTRY:
//
// First validate the parameters.
//
if (IrpStack->Parameters.DeviceIoControl.InputBufferLength < SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS ||
Irp->AssociatedIrp.SystemBuffer == NULL)
{
Status = STATUS_INVALID_PARAMETER;
LogError("Err, invalid parameter to IOCTL dispatcher");
break;
}
InBuffLength = IrpStack->Parameters.DeviceIoControl.InputBufferLength;
OutBuffLength = IrpStack->Parameters.DeviceIoControl.OutputBufferLength;
if (!InBuffLength || !OutBuffLength)
{
Status = STATUS_INVALID_PARAMETER;
break;
}
//
// Both usermode and to send to usermode and the coming buffer are
// at the same place
//
DebuggerQueryIdtRequest = (PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS)Irp->AssociatedIrp.SystemBuffer;
//
// Perform the query of IDT entries (not from vmx-root)
//
ExtensionCommandPerformQueryIdtEntriesRequest(DebuggerQueryIdtRequest, FALSE);
Irp->IoStatus.Information = SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS;
Status = STATUS_SUCCESS;
//
// Avoid zeroing it
//
DoNotChangeInformation = TRUE;
break;
case IOCTL_SEND_USER_DEBUGGER_COMMANDS:
//

3
hyperdbg/hyperkd/header/debugger/commands/ExtensionCommands.h
View file

@ -21,6 +21,9 @@ ExtensionCommandPte(PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PteDetails, BOOLEA
UINT32
ExtensionCommandPerformActionsForApicRequests(PDEBUGGER_APIC_REQUEST ApicRequest);
VOID
ExtensionCommandPerformQueryIdtEntriesRequest(PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtQueryRequest, BOOLEAN ReadFromVmxRoot);
VOID
ExtensionCommandVa2paAndPa2va(PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS AddressDetails, BOOLEAN OperateOnVmxRoot);

2
hyperdbg/include/SDK/headers/Connection.h
View file

@ -98,6 +98,7 @@ typedef enum _DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_WRITE_REGISTER,
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_QUERY_PCITREE,
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_PERFORM_ACTIONS_ON_APIC,
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_IDT_ENTRIES,
//
// Debuggee to debugger
@ -133,6 +134,7 @@ typedef enum _DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_WRITE_REGISTER,
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_PCITREE,
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_APIC_REQUESTS,
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_QUERY_IDT_ENTRIES_REQUESTS,
//
// hardware debuggee to debugger

7
hyperdbg/include/SDK/headers/Ioctls.h
View file

@ -302,3 +302,10 @@
*/
#define IOCTL_PERFROM_ACTIONS_ON_APIC \
CTL_CODE(FILE_DEVICE_UNKNOWN, 0x822, METHOD_BUFFERED, FILE_ANY_ACCESS)
/**
* @brief ioctl, to query the IDT entries
*
*/
#define IOCTL_QUERY_IDT_ENTRY \
CTL_CODE(FILE_DEVICE_UNKNOWN, 0x823, METHOD_BUFFERED, FILE_ANY_ACCESS)

7
hyperdbg/include/SDK/headers/RequestStructures.h
View file

@ -1211,6 +1211,13 @@ typedef struct _INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS
} INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS, *PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS;
/**
* @brief Debugger size of INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS
*
*/
#define SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS \
sizeof(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS)
/**
* @brief check so the INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS should be smaller than packet size
*

241
hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/idt.cpp Normal file
View file

@ -0,0 +1,241 @@
/**
* @file idt.cpp
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief !idt command
* @details
* @version 0.12
* @date 2024-12-30
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
//
// Global Variables
//
extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee;
extern BOOLEAN g_AddressConversion;
/**
* @brief help of the !idt command
*
* @return VOID
*/
VOID
CommandIdtHelp()
{
ShowMessages("!ioapic : shows entries of Interrupt Descriptor Table (IDT).\n\n");
ShowMessages("syntax : \t!idt [IdtEntry (hex)]\n");
ShowMessages("\n");
ShowMessages("\t\te.g : !idt\n");
ShowMessages("\t\te.g : !idt 1d\n");
}
/**
* @brief Send IDT entry requests
*
* @param IdtPacket
*
* @return VOID
*/
BOOLEAN
HyperDbgGetIdtEntry(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS * IdtPacket)
{
BOOL Status;
ULONG ReturnedLength;
if (g_IsSerialConnectedToRemoteDebuggee)
{
//
// Send the request over serial kernel debugger
//
if (!KdSendQueryIdtPacketsToDebuggee(IdtPacket))
{
return FALSE;
}
else
{
return TRUE;
}
}
else
{
AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnFalse);
//
// Send IOCTL
//
Status = DeviceIoControl(
g_DeviceHandle, // Handle to device
IOCTL_QUERY_IDT_ENTRY, // IO Control Code (IOCTL)
IdtPacket, // Input Buffer to driver.
SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS, // Input buffer length (not used in this case)
IdtPacket, // Output Buffer from driver.
SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS, // Length of output buffer in bytes.
&ReturnedLength, // Bytes placed in buffer.
NULL // synchronous call
);
if (!Status)
{
ShowMessages("ioctl failed with code 0x%x\n", GetLastError());
return FALSE;
}
if (IdtPacket->KernelStatus == DEBUGGER_OPERATION_WAS_SUCCESSFUL)
{
return TRUE;
}
else
{
//
// An err occurred, no results
//
ShowErrorMessage(IdtPacket->KernelStatus);
return FALSE;
}
}
}
/**
* @brief !idt command handler
*
* @param CommandTokens
* @param Command
*
* @return VOID
*/
VOID
CommandIdt(vector<CommandToken> CommandTokens, string Command)
{
UINT32 IdtEntry;
INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS * IdtPacket = NULL;
BOOLEAN ShowAllEntries = TRUE;
UINT64 UsedBaseAddress = NULL;
//
// Check if the command should show all entries or just one entry
//
if (CommandTokens.size() == 1)
{
ShowAllEntries = TRUE;
}
else if (CommandTokens.size() == 2)
{
ShowAllEntries = FALSE;
//
// Get the IDT entry number
//
if (ConvertTokenToUInt32(CommandTokens.at(1), &IdtEntry) == FALSE)
{
ShowMessages("err, invalid IDT entry number\n");
return;
}
if (IdtEntry > MAX_NUMBER_OF_IDT_ENTRIES)
{
ShowMessages("err, invalid IDT entry number\n");
return;
}
}
else
{
ShowMessages("incorrect use of the '%s'\n\n",
GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
CommandIdtHelp();
return;
}
//
// Allocate buffer for IDT entry
//
IdtPacket = (INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS *)malloc(sizeof(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS));
if (IdtPacket == NULL)
{
ShowMessages("err, allocating buffer for receiving IDT entries");
}
RtlZeroMemory(IdtPacket, sizeof(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS));
/////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////
//
// Get the IDT buffer
//
if (HyperDbgGetIdtEntry(IdtPacket) == TRUE)
{
//
// Show (dump) entries
//
if (ShowAllEntries)
{
ShowMessages("IDT Entries:\n\n");
for (UINT32 i = 0; i < MAX_NUMBER_OF_IDT_ENTRIES; i++)
{
ShowMessages("IDT[0x%x:%d]\t: %s\t",
i,
i,
SeparateTo64BitValue(IdtPacket->IdtEntry[i]).c_str());
//
// Apply addressconversion of settings here
//
if (g_AddressConversion)
{
//
// Showing function names here
//
if (SymbolShowFunctionNameBasedOnAddress(IdtPacket->IdtEntry[i], &UsedBaseAddress))
{
//
// The symbol address is showed (nothing to do)
//
}
}
ShowMessages("\n");
}
}
else
{
ShowMessages("IDT[0x%x:%d] : %s\t",
IdtEntry,
IdtEntry,
SeparateTo64BitValue(IdtPacket->IdtEntry[IdtEntry]).c_str());
//
// Apply addressconversion of settings here
//
if (g_AddressConversion)
{
//
// Showing function names here
//
if (SymbolShowFunctionNameBasedOnAddress(IdtPacket->IdtEntry[IdtEntry], &UsedBaseAddress))
{
//
// The symbol address is showed (nothing to do)
//
}
ShowMessages("\n");
}
}
}
//
// Deallocate the buffer
//
free(IdtPacket);
}

2
hyperdbg/libhyperdbg/code/debugger/core/interpreter.cpp
View file

@ -1607,6 +1607,8 @@ InitializeCommandsDictionary()
g_CommandsList["!pcitree"] = {&CommandPcitree, &CommandPcitreeHelp, DEBUGGER_COMMAND_PCITREE_ATTRIBUTES};
g_CommandsList["!pcietree"] = {&CommandPcitree, &CommandPcitreeHelp, DEBUGGER_COMMAND_PCITREE_ATTRIBUTES};
g_CommandsList["!idt"] = {&CommandIdt, &CommandIdtHelp, DEBUGGER_COMMAND_IDT_ATTRIBUTES};
//
// hwdbg commands
//

34
hyperdbg/libhyperdbg/code/debugger/kernel-level/kd.cpp
View file

@ -1020,6 +1020,40 @@ KdSendApicActionPacketsToDebuggee(PDEBUGGER_APIC_REQUEST ApicRequest, UINT32 Exp
return TRUE;
}
/**
* @brief Send requests for IDT packet to the debuggee
* @param IdtRequest
*
* @return BOOLEAN
*/
BOOLEAN
KdSendQueryIdtPacketsToDebuggee(PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtRequest)
{
//
// Set the request data
//
DbgWaitSetRequestData(DEBUGGER_SYNCRONIZATION_OBJECT_KERNEL_DEBUGGER_IDT_ENTRIES,
IdtRequest,
sizeof(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS));
//
// Send the IDT request packets
//
if (!KdCommandPacketToDebuggee(
DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGER_TO_DEBUGGEE_EXECUTE_ON_VMX_ROOT,
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_ON_VMX_ROOT_READ_IDT_ENTRIES))
{
return FALSE;
}
//
// Wait until the result of actions to IDT is received
//
DbgWaitForKernelResponse(DEBUGGER_SYNCRONIZATION_OBJECT_KERNEL_DEBUGGER_IDT_ENTRIES);
return TRUE;
}
/**
* @brief Sends a breakpoint set or 'bp' command packet to the debuggee
* @param BpPacket

22
hyperdbg/libhyperdbg/code/debugger/kernel-level/kernel-listening.cpp
View file

@ -64,6 +64,7 @@ ListeningSerialPortInDebugger()
PDEBUGGEE_REGISTER_READ_DESCRIPTION ReadRegisterPacket;
PDEBUGGEE_REGISTER_WRITE_DESCRIPTION WriteRegisterPacket;
PDEBUGGER_APIC_REQUEST ApicRequestPacket;
PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtEntryRequestPacket;
PDEBUGGER_READ_MEMORY ReadMemoryPacket;
PDEBUGGER_EDIT_MEMORY EditMemoryPacket;
PDEBUGGEE_BP_PACKET BpPacket;
@ -854,6 +855,27 @@ StartAgain:
break;
case DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_QUERY_IDT_ENTRIES_REQUESTS:
IdtEntryRequestPacket = (INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS *)(((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET));
//
// Get the address and size of the caller
//
DbgWaitGetRequestData(DEBUGGER_SYNCRONIZATION_OBJECT_KERNEL_DEBUGGER_IDT_ENTRIES, &CallerAddress, &CallerSize);
//
// Copy the memory buffer for the caller
//
memcpy(CallerAddress, IdtEntryRequestPacket, CallerSize);
//
// Signal the event relating to receiving result of querying IDT entries
//
DbgReceivedKernelResponse(DEBUGGER_SYNCRONIZATION_OBJECT_KERNEL_DEBUGGER_IDT_ENTRIES);
break;
case DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_RESULT_OF_READING_MEMORY:
ReadMemoryPacket = (DEBUGGER_READ_MEMORY *)(((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET));

13
hyperdbg/libhyperdbg/code/export/export.cpp
View file

@ -713,6 +713,19 @@ hyperdbg_u_get_io_apic(IO_APIC_ENTRY_PACKETS * io_apic)
return HyperDbgGetIoApic(io_apic);
}
/**
* @brief Get IDT entry
*
* @param idt_packet
*
* @return BOOLEAN
*/
BOOLEAN
hyperdbg_u_get_idt_entry(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS * idt_packet)
{
return HyperDbgGetIdtEntry(idt_packet);
}
/**
* @brief Run hwdbg script
*

6
hyperdbg/libhyperdbg/header/commands.h
View file

@ -459,6 +459,9 @@ typedef std::map<std::string, COMMAND_DETAIL> CommandType;
#define DEBUGGER_COMMAND_PCITREE_ATTRIBUTES \
DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
#define DEBUGGER_COMMAND_IDT_ATTRIBUTES \
DEBUGGER_COMMAND_ATTRIBUTE_LOCAL_COMMAND_IN_DEBUGGER_MODE
//////////////////////////////////////////////////
// Command Functions //
//////////////////////////////////////////////////
@ -733,6 +736,9 @@ CommandAssemble(vector<CommandToken> CommandTokens, string Command);
VOID
CommandPcitree(vector<CommandToken> CommandTokens, string Command);
VOID
CommandIdt(vector<CommandToken> CommandTokens, string Command);
//
// hwdbg commands
//

18
hyperdbg/libhyperdbg/header/debugger.h
View file

@ -58,6 +58,7 @@
#define DEBUGGER_SYNCRONIZATION_OBJECT_KERNEL_DEBUGGER_WRITE_REGISTER 0x1a
#define DEBUGGER_SYNCRONIZATION_OBJECT_KERNEL_DEBUGGER_PCITREE_RESULT 0x1b
#define DEBUGGER_SYNCRONIZATION_OBJECT_KERNEL_DEBUGGER_APIC_ACTIONS 0x1c
#define DEBUGGER_SYNCRONIZATION_OBJECT_KERNEL_DEBUGGER_IDT_ENTRIES 0x1d
//////////////////////////////////////////////////
// Event Details //
@ -250,7 +251,17 @@ HyperDbgWriteMemory(PVOID DestinationAddress,
UINT32 NumberOfBytes);
//////////////////////////////////////////////////
// Registers //
// Misc //
//////////////////////////////////////////////////
BOOLEAN
CommandApicSendRequest(DEBUGGER_APIC_REQUEST_TYPE ApicType,
PVOID ApicBuffer,
UINT32 ExpectedRequestSize,
PBOOLEAN IsUsingX2APIC);
//////////////////////////////////////////////////
// SDK Servicing Routines //
//////////////////////////////////////////////////
BOOLEAN
@ -287,7 +298,4 @@ BOOLEAN
HyperDbgGetIoApic(IO_APIC_ENTRY_PACKETS * IoApic);
BOOLEAN
CommandApicSendRequest(DEBUGGER_APIC_REQUEST_TYPE ApicType,
PVOID ApicBuffer,
UINT32 ExpectedRequestSize,
PBOOLEAN IsUsingX2APIC);
HyperDbgGetIdtEntry(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS * IdtPacket);

3
hyperdbg/libhyperdbg/header/help.h
View file

@ -297,6 +297,9 @@ CommandAssembleHelp();
VOID
CommandPcitreeHelp();
VOID
CommandIdtHelp();
//
// hwdbg commands
//

3
hyperdbg/libhyperdbg/header/kd.h
View file

@ -201,6 +201,9 @@ KdSendVa2paAndPa2vaPacketToDebuggee(PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS Va2paAndP
BOOLEAN
KdSendApicActionPacketsToDebuggee(PDEBUGGER_APIC_REQUEST ApicRequest, UINT32 ExpectedRequestSize);
BOOLEAN
KdSendQueryIdtPacketsToDebuggee(PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtRequest);
BOOLEAN
KdSendPtePacketToDebuggee(PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PtePacket);

1
hyperdbg/libhyperdbg/libhyperdbg.vcxproj
View file

@ -172,6 +172,7 @@
<ClCompile Include="code\debugger\commands\debugging-commands\prealloc.cpp" />
<ClCompile Include="code\debugger\commands\extension-commands\apic.cpp" />
<ClCompile Include="code\debugger\commands\extension-commands\crwrite.cpp" />
<ClCompile Include="code\debugger\commands\extension-commands\idt.cpp" />
<ClCompile Include="code\debugger\commands\extension-commands\ioapic.cpp" />
<ClCompile Include="code\debugger\commands\extension-commands\pcitree.cpp" />
<ClCompile Include="code\debugger\commands\extension-commands\rev.cpp" />

3
hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters
View file

@ -583,6 +583,9 @@
<ClCompile Include="pci-id.cpp">
<Filter>code\debugger\misc</Filter>
</ClCompile>
<ClCompile Include="code\debugger\commands\extension-commands\idt.cpp">
<Filter>code\debugger\commands\extension-commands</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<MASM Include="code\assembly\asm-vmx-checks.asm">