vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-08-22 23:14:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

pre-steppings mechanisms

Browse source
This commit is contained in:
SinaKarvandi 2020-08-30 03:11:13 -07:00
parent 4e11a8b9dd
commit 3ed7416798
17 changed files with 297 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hyperdbg/hprdbgctrl/transparency.h
View file

@ -18,6 +18,10 @@
*/
#define TestCount 1000
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
void GuassianGenerateRandom(vector<double> Data, UINT64 *AverageOfData,
UINT64 *StandardDeviationOfData,
UINT64 *MedianOfData);

56
hyperdbg/hprdbghv/Broadcast.c
View file

@ -11,6 +11,62 @@
*/
#include "pch.h"
/**
* @brief Broadcast to enable mov-to-cr3 exitings
*
* @param Dpc
* @param DeferredContext
* @param SystemArgument1
* @param SystemArgument2
* @return VOID
*/
VOID
BroadcastDpcEnableMovToCr3Exiting(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
{
//
// Enable mov-to-cr3 exiting from vmx-root
//
AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_CR3_EXITING, 0, 0, 0);
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
}
/**
* @brief Broadcast to disable mov-to-cr3 exitings
*
* @param Dpc
* @param DeferredContext
* @param SystemArgument1
* @param SystemArgument2
* @return VOID
*/
VOID
BroadcastDpcDisableMovToCr3Exiting(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
{
//
// Disable mov-to-cr3 exiting from vmx-root
//
AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CR3_EXITING, 0, 0, 0);
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
}
/**
* @brief Broadcast syscall hook to all cores
*

6
hyperdbg/hprdbghv/Broadcast.h
View file

@ -15,6 +15,12 @@
// Functions //
//////////////////////////////////////////////////
VOID
BroadcastDpcEnableMovToCr3Exiting(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2);
VOID
BroadcastDpcDisableMovToCr3Exiting(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2);
VOID
BroadcastDpcEnableEferSyscallEvents(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2);

5
hyperdbg/hprdbghv/Debugger.c
View file

@ -86,6 +86,11 @@ DebuggerInitialize()
//
g_TriggerEventForCpuids = FALSE;
//
// Initialize the stepping mechanism
//
SteppingsInitialize();
return TRUE;
}

22
hyperdbg/hprdbghv/DebuggerEvents.c
View file

@ -33,6 +33,28 @@ DebuggerEventDisableEferOnAllProcessors()
KeGenericCallDpc(BroadcastDpcDisableEferSyscallEvents, 0x0);
}
/**
* @brief routines for debugging threads (enable mov-to-cr3 exiting)
*
* @return VOID
*/
VOID
DebuggerEventEnableMovToCr3ExitingOnAllProcessors()
{
KeGenericCallDpc(BroadcastDpcEnableMovToCr3Exiting, 0x0);
}
/**
* @brief routines for debugging threads (disable mov-to-cr3 exiting)
*
* @return VOID
*/
VOID
DebuggerEventDisableMovToCr3ExitingOnAllProcessors()
{
KeGenericCallDpc(BroadcastDpcDisableMovToCr3Exiting, 0x0);
}
/**
* @brief routines to generally handle breakpoint hit for detour
*

6
hyperdbg/hprdbghv/DebuggerEvents.h
View file

@ -18,6 +18,12 @@ DebuggerEventEnableEferOnAllProcessors();
VOID
DebuggerEventDisableEferOnAllProcessors();
VOID
DebuggerEventEnableMovToCr3ExitingOnAllProcessors();
VOID
DebuggerEventDisableMovToCr3ExitingOnAllProcessors();
VOID
DebuggerEventEptHook2GeneralDetourEventHandler(PGUEST_REGS Regs, PVOID CalledFrom);

6
hyperdbg/hprdbghv/GlobalVariables.h
View file

@ -86,3 +86,9 @@ BOOLEAN g_TransparentMode;
*
*/
TRANSPARENCY_MEASUREMENTS * g_TransparentModeMeasurements;
/**
* @brief holds the thread states for debugger on steppings
*
*/
LIST_ENTRY g_ThreadDebuggingStates;

33
hyperdbg/hprdbghv/HypervisorRoutines.c
View file

@ -1062,6 +1062,39 @@ HvSetPmcVmexit(BOOLEAN Set)
{
CpuBasedVmExecControls &= ~CPU_BASED_RDPMC_EXITING;
}
//
// Set the new value
//
__vmx_vmwrite(CPU_BASED_VM_EXEC_CONTROL, CpuBasedVmExecControls);
}
/**
* @brief Set vm-exit for mov-to-cr3
* @details Should be called in vmx-root
*
* @param Set Set or unset the vm-exits
* @return VOID
*/
VOID
HvSetMovToCr3Vmexit(BOOLEAN Set)
{
ULONG CpuBasedVmExecControls = 0;
//
// Read the previous flags
//
__vmx_vmread(CPU_BASED_VM_EXEC_CONTROL, &CpuBasedVmExecControls);
if (Set)
{
CpuBasedVmExecControls |= CPU_BASED_CR3_LOAD_EXITING;
}
else
{
CpuBasedVmExecControls &= ~CPU_BASED_CR3_LOAD_EXITING;
}
//
// Set the new value
//

9
hyperdbg/hprdbghv/HypervisorRoutines.h
View file

@ -290,6 +290,15 @@ HvSetTscVmexit(BOOLEAN Set);
VOID
HvSetPmcVmexit(BOOLEAN Set);
/**
* @brief Set vm-exit for mov-to-cr3
*
* @param Set
* @return VOID
*/
VOID
HvSetMovToCr3Vmexit(BOOLEAN Set);
/**
* @brief Set exception bitmap in VMCS
*

46
hyperdbg/hprdbghv/Steppings.c Normal file
View file

@ -0,0 +1,46 @@
/**
* @file Steppings.h
* @author Sina Karvandi (sina@rayanfam.com)
* @brief Stepping (step in & step out) mechanisms
* @details
* @version 0.1
* @date 2020-08-30
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
VOID
SteppingsInitialize()
{
//
// Initialize the list that holds the debugging
// state for each thread
//
InitializeListHead(&g_ThreadDebuggingStates);
//
// Enable the cr3-exiting (mov to cr3)
//
// DebuggerEventEnableMovToCr3ExitingOnAllProcessors();
}
VOID
SteppingsUninitialize()
{
//
// Disable the cr3-exiting (mov to cr3)
//
DebuggerEventDisableMovToCr3ExitingOnAllProcessors();
}
VOID
SteppingsStartDebuggingThread(UINT32 ProcessId, UINT32 ThreadId)
{
}
VOID
SteppingsHandleMovToCr3Exiting(PGUEST_REGS GuestRegs, UINT64 GuestRip)
{
}

26
hyperdbg/hprdbghv/Steppings.h Normal file
View file

@ -0,0 +1,26 @@
/**
* @file Steppings.h
* @author Sina Karvandi (sina@rayanfam.com)
* @brief Headers of Debugger Steppings Mechanisms
* @details Used in debugger
*
* @version 0.1
* @date 2020-08-30
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
VOID
SteppingsInitialize();
VOID
SteppingsUninitialize();
VOID
SteppingsHandleMovToCr3Exiting(PGUEST_REGS GuestRegs, UINT64 GuestRip);

20
hyperdbg/hprdbghv/Transparency.c
View file

@ -10,10 +10,26 @@
*
*/
#include "pch.h"
/**
* @brief maximum random value
*/
#define MY_RAND_MAX 32768
int TransparentTableLog[] = {0, 69, 110, 139, 161, 179, 195, 208, 220, 230, 240, 248, 256, 264, 271, 277, 283, 289, 294, 300, 304, 309, 314, 318, 322, 326, 330, 333, 337, 340, 343, 347, 350, 353, 356, 358, 361, 364, 366, 369, 371, 374, 376, 378, 381, 383, 385, 387, 389, 391, 393, 395, 397, 399, 401, 403, 404, 406, 408, 409, 411, 413, 414, 416, 417, 419, 420, 422, 423, 425, 426, 428, 429, 430, 432, 433, 434, 436, 437, 438, 439, 441, 442, 443, 444, 445, 447, 448, 449, 450, 451, 452, 453, 454, 455, 456, 457, 458, 460, 461};
/**
* @brief pre-defined log result
* @details we used this because we want to avoid using floating-points in
* kernel
*/
int TransparentTableLog[] =
{
0, 69, 110, 139, 161, 179, 195, 208, 220, 230, 240, 248, 256, 264, 271,
277, 283, 289, 294, 300, 304, 309, 314, 318, 322, 326, 330, 333, 337, 340,
343, 347, 350, 353, 356, 358, 361, 364, 366, 369, 371, 374, 376, 378, 381,
383, 385, 387, 389, 391, 393, 395, 397, 399, 401, 403, 404, 406, 408, 409,
411, 413, 414, 416, 417, 419, 420, 422, 423, 425, 426, 428, 429, 430, 432,
433, 434, 436, 437, 438, 439, 441, 442, 443, 444, 445, 447, 448, 449, 450,
451, 452, 453, 454, 455, 456, 457, 458, 460, 461
};
/**
* @brief Generate a random number by utilizing RDTSC instruction.

12
hyperdbg/hprdbghv/Vmcall.c
View file

@ -302,6 +302,18 @@ VmxVmcallHandler(UINT64 VmcallNumber,
VmcallStatus = STATUS_SUCCESS;
break;
}
case VMCALL_ENABLE_MOV_TO_CR3_EXITING:
{
HvSetMovToCr3Vmexit(TRUE);
VmcallStatus = STATUS_SUCCESS;
break;
}
case VMCALL_DISABLE_MOV_TO_CR3_EXITING:
{
HvSetMovToCr3Vmexit(FALSE);
VmcallStatus = STATUS_SUCCESS;
break;
}
default:
{
LogError("Unsupported VMCALL");

66
hyperdbg/hprdbghv/Vmcall.h
View file

@ -19,115 +19,115 @@
* @brief VMCALL to test hypervisor
*
*/
#define VMCALL_TEST 0x1
#define VMCALL_TEST 0x1
/**
* @brief VMCALL to Call VMXOFF to turn off the hypervisor
*
*/
#define VMCALL_VMXOFF 0x2
#define VMCALL_VMXOFF 0x2
/**
* @brief VMCALL to Hook Change the attribute bits of the EPT Table
*
*/
#define VMCALL_CHANGE_PAGE_ATTRIB 0x3
#define VMCALL_CHANGE_PAGE_ATTRIB 0x3
/**
* @brief VMCALL to invalidate EPT (All Contexts)
*
*/
#define VMCALL_INVEPT_ALL_CONTEXTS 0x4
#define VMCALL_INVEPT_ALL_CONTEXTS 0x4
/**
* @brief VMCALL to invalidate EPT (A Single Context)
*
*/
#define VMCALL_INVEPT_SINGLE_CONTEXT 0x5
#define VMCALL_INVEPT_SINGLE_CONTEXT 0x5
/**
* @brief VMCALL to remove a all physical addresses from hook list
*
*/
#define VMCALL_UNHOOK_ALL_PAGES 0x6
#define VMCALL_UNHOOK_ALL_PAGES 0x6
/**
* @brief VMCALL to remove a single physical address from hook list
*
*/
#define VMCALL_UNHOOK_SINGLE_PAGE 0x7
#define VMCALL_UNHOOK_SINGLE_PAGE 0x7
/**
* @brief VMCALL to enable syscall hook using EFER SCE bit
*
*/
#define VMCALL_ENABLE_SYSCALL_HOOK_EFER 0x8
#define VMCALL_ENABLE_SYSCALL_HOOK_EFER 0x8
/**
* @brief VMCALL to disable syscall hook using EFER SCE bit
*
*/
#define VMCALL_DISABLE_SYSCALL_HOOK_EFER 0x9
#define VMCALL_DISABLE_SYSCALL_HOOK_EFER 0x9
/**
* @brief VMCALL to change MSR Bitmap Read
*
*/
#define VMCALL_CHANGE_MSR_BITMAP_READ 0xa
#define VMCALL_CHANGE_MSR_BITMAP_READ 0xa
/**
* @brief VMCALL to change MSR Bitmap Write
*
*/
#define VMCALL_CHANGE_MSR_BITMAP_WRITE 0xb
#define VMCALL_CHANGE_MSR_BITMAP_WRITE 0xb
/**
* @brief VMCALL to enable rdtsc/rdtscp exiting in primary cpu-based controls
*
*/
#define VMCALL_SET_RDTSC_EXITING 0xc
#define VMCALL_SET_RDTSC_EXITING 0xc
/**
* @brief VMCALL to enable rdpmc exiting in primary cpu-based controls
*
*/
#define VMCALL_SET_RDPMC_EXITING 0xd
#define VMCALL_SET_RDPMC_EXITING 0xd
/**
* @brief VMCALL to set exception bitmap on VMCS
*
*/
#define VMCALL_SET_EXCEPTION_BITMAP 0xe
#define VMCALL_SET_EXCEPTION_BITMAP 0xe
/**
* @brief VMCALL to enable mov to debug registers exiting
*
*/
#define VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING 0xf
#define VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING 0xf
/**
* @brief VMCALL to enable external interrupt exiting
*
*/
#define VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING 0x10
#define VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING 0x10
/**
* @brief VMCALL to change I/O Bitmaps (A & B)
*
*/
#define VMCALL_CHANGE_IO_BITMAP 0x11
#define VMCALL_CHANGE_IO_BITMAP 0x11
/**
* @brief VMCALL to put hidden breakpoints (using EPT)
*
*/
#define VMCALL_SET_HIDDEN_CC_BREAKPOINT 0x12
#define VMCALL_SET_HIDDEN_CC_BREAKPOINT 0x12
/**
* @brief VMCALL to enable breakpoints on exception bitmaps
*
*/
#define VMCALL_ENABLE_BREAKPOINT_ON_EXCEPTION_BITMAP 0x13
#define VMCALL_ENABLE_BREAKPOINT_ON_EXCEPTION_BITMAP 0x13
/**
* @brief VMCALL to disable breakpoints on exception bitmaps
@ -139,49 +139,61 @@
* @brief VMCALL to disable rdtsc/rdtscp exiting in primary cpu-based controls
*
*/
#define VMCALL_UNSET_RDTSC_EXITING 0x15
#define VMCALL_UNSET_RDTSC_EXITING 0x15
/**
* @brief VMCALL to disable external interrupt exiting
*
*/
#define VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING 0x16
#define VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING 0x16
/**
* @brief VMCALL to disable rdpmc exiting in primary cpu-based controls
*
*/
#define VMCALL_UNSET_RDPMC_EXITING 0x17
#define VMCALL_UNSET_RDPMC_EXITING 0x17
/**
* @brief VMCALL to disable mov to debug registers exiting
*
*/
#define VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING 0x18
#define VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING 0x18
/**
* @brief VMCALL to reset MSR Bitmap Read
*
*/
#define VMCALL_RESET_MSR_BITMAP_READ 0x19
#define VMCALL_RESET_MSR_BITMAP_READ 0x19
/**
* @brief VMCALL to reset MSR Bitmap Write
*
*/
#define VMCALL_RESET_MSR_BITMAP_WRITE 0x1a
#define VMCALL_RESET_MSR_BITMAP_WRITE 0x1a
/**
* @brief VMCALL to reset exception bitmap on VMCS
*
*/
#define VMCALL_RESET_EXCEPTION_BITMAP 0x1b
#define VMCALL_RESET_EXCEPTION_BITMAP 0x1b
/**
* @brief VMCALL to reset I/O Bitmaps (A & B)
*
*/
#define VMCALL_RESET_IO_BITMAP 0x1c
#define VMCALL_RESET_IO_BITMAP 0x1c
/**
* @brief VMCALL to enable cr3 exiting
*
*/
#define VMCALL_ENABLE_MOV_TO_CR3_EXITING 0x1d
/**
* @brief VMCALL to disable cr3 exiting
*
*/
#define VMCALL_DISABLE_MOV_TO_CR3_EXITING 0x1e
//////////////////////////////////////////////////
// Functions //

2
hyperdbg/hprdbghv/hprdbghv.vcxproj
View file

@ -112,6 +112,7 @@
<ClCompile Include="EferHook.c" />
<ClCompile Include="Ept.c" />
<ClCompile Include="Events.c" />
<ClCompile Include="Steppings.c" />
<ClCompile Include="Termination.c" />
<ClCompile Include="Transparency.c" />
<ClCompile Include="Vmexit.c" />
@ -167,6 +168,7 @@
<ClInclude Include="Logging.h" />
<ClInclude Include="MemoryMapper.h" />
<ClInclude Include="PoolManager.h" />
<ClInclude Include="Steppings.h" />
<ClInclude Include="Termination.h" />
<ClInclude Include="Trace.h" />
<ClInclude Include="Transparency.h" />

6
hyperdbg/hprdbghv/hprdbghv.vcxproj.filters
View file

@ -188,6 +188,9 @@
<ClCompile Include="Termination.c">
<Filter>Source Files\Debugger\Essentials</Filter>
</ClCompile>
<ClCompile Include="Steppings.c">
<Filter>Source Files\Debugger\Essentials</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="DebuggerCommands.h">
@ -283,6 +286,9 @@
<ClInclude Include="Termination.h">
<Filter>Header Files\Debugger\Essentials</Filter>
</ClInclude>
<ClInclude Include="Steppings.h">
<Filter>Header Files\Debugger\Essentials</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<MASM Include="AsmEpt.asm">

1
hyperdbg/hprdbghv/pch.h
View file

@ -56,3 +56,4 @@
#include "IoHandler.h"
#include "GlobalVariables.h"
#include "Termination.h"
#include "Steppings.h"