vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

intercept threads only once

Browse source
This commit is contained in:
sina 2025-06-23 17:18:41 +02:00
parent 6893c1b19f
commit 4afe2daef2
No known key found for this signature in database
3 changed files with 20 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

47
hyperdbg/hyperkd/code/debugger/user-level/Attaching.c
View file

@ -93,7 +93,6 @@ AttachingInitialize()
* @param Is32Bit
* @param Eprocess
* @param PebAddressToMonitor
* @param UsermodeReservedBuffer
* @return UINT64 returns the unique token
*/
UINT64
@ -102,8 +101,7 @@ AttachingCreateProcessDebuggingDetails(UINT32 ProcessId,
BOOLEAN Is32Bit,
BOOLEAN CheckCallbackAtFirstInstruction,
PEPROCESS Eprocess,
UINT64 PebAddressToMonitor,
UINT64 UsermodeReservedBuffer)
UINT64 PebAddressToMonitor)
{
PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
@ -132,7 +130,6 @@ AttachingCreateProcessDebuggingDetails(UINT32 ProcessId,
ProcessDebuggingDetail->CheckCallBackForInterceptingFirstInstruction = CheckCallbackAtFirstInstruction;
ProcessDebuggingDetail->Eprocess = Eprocess;
ProcessDebuggingDetail->PebAddressToMonitor = (PVOID)PebAddressToMonitor;
ProcessDebuggingDetail->UsermodeReservedBuffer = UsermodeReservedBuffer;
//
// Allocate a thread holder buffer for this process
@ -780,7 +777,6 @@ AttachingPerformAttachToProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS Attach
PEPROCESS SourceProcess;
UINT64 ProcessDebuggingToken;
UINT64 PebAddressToMonitor;
UINT64 UsermodeReservedBuffer;
BOOLEAN ResultOfApplyingEvent;
BOOLEAN Is32Bit;
PUSERMODE_DEBUGGING_PROCESS_DETAILS TempProcessDebuggingDetail;
@ -852,32 +848,6 @@ AttachingPerformAttachToProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS Attach
return FALSE;
}
//
// allocate memory in the target user-mode process
//
UsermodeReservedBuffer = MemoryMapperReserveUsermodeAddressOnTargetProcess(AttachRequest->ProcessId, TRUE);
if (UsermodeReservedBuffer == (UINT64)NULL)
{
AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS;
return FALSE;
}
//
// Adjust the nop sled buffer
//
if (!AttachingAdjustNopSledBuffer(UsermodeReservedBuffer,
AttachRequest->ProcessId))
{
AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS;
return FALSE;
}
//
// Log for test
//
// LogInfo("Reserved address on the target process: %llx\n", UsermodeReservedBuffer);
//
// Create the debugging detail for process
//
@ -886,8 +856,7 @@ AttachingPerformAttachToProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS Attach
Is32Bit,
AttachRequest->CheckCallbackAtFirstInstruction,
SourceProcess,
PebAddressToMonitor,
UsermodeReservedBuffer);
PebAddressToMonitor);
//
// Check if we successfully get the token
@ -1235,18 +1204,6 @@ AttachingPerformDetach(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS DetachRequest)
return FALSE;
}
//
// Free the reserved memory in the target process
//
if (!MemoryMapperFreeMemoryOnTargetProcess(DetachRequest->ProcessId,
(PVOID)ProcessDebuggingDetail->UsermodeReservedBuffer))
{
//
// Still, we continue, no need to abort the operation
//
LogError("Err, cannot deallocate reserved buffer in the detached process");
}
//
// Remove the entry from the process debugging details list
//

28
hyperdbg/hyperkd/code/debugger/user-level/Ud.c
View file

@ -379,26 +379,23 @@ UdDispatchUsermodeCommands(PDEBUGGER_UD_COMMAND_PACKET ActionRequest)
}
/**
* @brief Spin on nop sled in user-mode to halt the debuggee
* @brief Set the thread pausing state
*
* @param ThreadDebuggingDetails
* @param ProcessDebuggingDetails
* @return VOID
*/
VOID
UdSpinThreadOnNop(PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadDebuggingDetails,
PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails)
UdSetThreadPausingState(PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadDebuggingDetails,
PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails)
{
UNREFERENCED_PARAMETER(ProcessDebuggingDetails);
//
// Save the RIP for future return
//
ThreadDebuggingDetails->ThreadRip = VmFuncGetRip();
//
// Set the rip to new spinning address
//
VmFuncSetRip(ProcessDebuggingDetails->UsermodeReservedBuffer);
//
// Indicate that it's spinning
//
@ -497,6 +494,17 @@ UdCheckAndHandleBreakpointsAndDebugBreaks(PROCESSOR_DEBUGGING_STATE * DbgS
return FALSE;
}
//
// Check if the thread is already paused or not
//
if (ThreadDebuggingDetails->IsPaused)
{
//
// The thread is already paused, so we don't need to pause it again
//
return TRUE;
}
//
// Set it as active thread debugging
//
@ -609,9 +617,9 @@ UdCheckAndHandleBreakpointsAndDebugBreaks(PROCESSOR_DEBUGGING_STATE * DbgS
TRUE);
//
// Halt the thread on nop sleds
// Set the thread debugging details
//
UdSpinThreadOnNop(ThreadDebuggingDetails, ProcessDebuggingDetails);
UdSetThreadPausingState(ThreadDebuggingDetails, ProcessDebuggingDetails);
//
// Everything was okay

1
hyperdbg/hyperkd/header/debugger/user-level/Attaching.h
View file

@ -45,7 +45,6 @@ typedef struct _USERMODE_DEBUGGING_PROCESS_DETAILS
GUEST_REGS Registers; // active thread
UINT64 Context; // $context
LIST_ENTRY AttachedProcessList;
UINT64 UsermodeReservedBuffer;
UINT64 EntrypointOfMainModule;
UINT64 BaseAddressOfMainModule;
PEPROCESS Eprocess;