diff --git a/hyperdbg/hyperkd/code/debugger/user-level/Attaching.c b/hyperdbg/hyperkd/code/debugger/user-level/Attaching.c index 17143f54..23325b88 100644 --- a/hyperdbg/hyperkd/code/debugger/user-level/Attaching.c +++ b/hyperdbg/hyperkd/code/debugger/user-level/Attaching.c @@ -93,7 +93,6 @@ AttachingInitialize() * @param Is32Bit * @param Eprocess * @param PebAddressToMonitor - * @param UsermodeReservedBuffer * @return UINT64 returns the unique token */ UINT64 @@ -102,8 +101,7 @@ AttachingCreateProcessDebuggingDetails(UINT32 ProcessId, BOOLEAN Is32Bit, BOOLEAN CheckCallbackAtFirstInstruction, PEPROCESS Eprocess, - UINT64 PebAddressToMonitor, - UINT64 UsermodeReservedBuffer) + UINT64 PebAddressToMonitor) { PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail; @@ -132,7 +130,6 @@ AttachingCreateProcessDebuggingDetails(UINT32 ProcessId, ProcessDebuggingDetail->CheckCallBackForInterceptingFirstInstruction = CheckCallbackAtFirstInstruction; ProcessDebuggingDetail->Eprocess = Eprocess; ProcessDebuggingDetail->PebAddressToMonitor = (PVOID)PebAddressToMonitor; - ProcessDebuggingDetail->UsermodeReservedBuffer = UsermodeReservedBuffer; // // Allocate a thread holder buffer for this process @@ -780,7 +777,6 @@ AttachingPerformAttachToProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS Attach PEPROCESS SourceProcess; UINT64 ProcessDebuggingToken; UINT64 PebAddressToMonitor; - UINT64 UsermodeReservedBuffer; BOOLEAN ResultOfApplyingEvent; BOOLEAN Is32Bit; PUSERMODE_DEBUGGING_PROCESS_DETAILS TempProcessDebuggingDetail; @@ -852,32 +848,6 @@ AttachingPerformAttachToProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS Attach return FALSE; } - // - // allocate memory in the target user-mode process - // - UsermodeReservedBuffer = MemoryMapperReserveUsermodeAddressOnTargetProcess(AttachRequest->ProcessId, TRUE); - - if (UsermodeReservedBuffer == (UINT64)NULL) - { - AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS; - return FALSE; - } - - // - // Adjust the nop sled buffer - // - if (!AttachingAdjustNopSledBuffer(UsermodeReservedBuffer, - AttachRequest->ProcessId)) - { - AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS; - return FALSE; - } - - // - // Log for test - // - // LogInfo("Reserved address on the target process: %llx\n", UsermodeReservedBuffer); - // // Create the debugging detail for process // @@ -886,8 +856,7 @@ AttachingPerformAttachToProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS Attach Is32Bit, AttachRequest->CheckCallbackAtFirstInstruction, SourceProcess, - PebAddressToMonitor, - UsermodeReservedBuffer); + PebAddressToMonitor); // // Check if we successfully get the token @@ -1235,18 +1204,6 @@ AttachingPerformDetach(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS DetachRequest) return FALSE; } - // - // Free the reserved memory in the target process - // - if (!MemoryMapperFreeMemoryOnTargetProcess(DetachRequest->ProcessId, - (PVOID)ProcessDebuggingDetail->UsermodeReservedBuffer)) - { - // - // Still, we continue, no need to abort the operation - // - LogError("Err, cannot deallocate reserved buffer in the detached process"); - } - // // Remove the entry from the process debugging details list // diff --git a/hyperdbg/hyperkd/code/debugger/user-level/Ud.c b/hyperdbg/hyperkd/code/debugger/user-level/Ud.c index 07759514..01ccbe85 100644 --- a/hyperdbg/hyperkd/code/debugger/user-level/Ud.c +++ b/hyperdbg/hyperkd/code/debugger/user-level/Ud.c @@ -379,26 +379,23 @@ UdDispatchUsermodeCommands(PDEBUGGER_UD_COMMAND_PACKET ActionRequest) } /** - * @brief Spin on nop sled in user-mode to halt the debuggee + * @brief Set the thread pausing state * * @param ThreadDebuggingDetails * @param ProcessDebuggingDetails * @return VOID */ VOID -UdSpinThreadOnNop(PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadDebuggingDetails, - PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails) +UdSetThreadPausingState(PUSERMODE_DEBUGGING_THREAD_DETAILS ThreadDebuggingDetails, + PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails) { + UNREFERENCED_PARAMETER(ProcessDebuggingDetails); + // // Save the RIP for future return // ThreadDebuggingDetails->ThreadRip = VmFuncGetRip(); - // - // Set the rip to new spinning address - // - VmFuncSetRip(ProcessDebuggingDetails->UsermodeReservedBuffer); - // // Indicate that it's spinning // @@ -497,6 +494,17 @@ UdCheckAndHandleBreakpointsAndDebugBreaks(PROCESSOR_DEBUGGING_STATE * DbgS return FALSE; } + // + // Check if the thread is already paused or not + // + if (ThreadDebuggingDetails->IsPaused) + { + // + // The thread is already paused, so we don't need to pause it again + // + return TRUE; + } + // // Set it as active thread debugging // @@ -609,9 +617,9 @@ UdCheckAndHandleBreakpointsAndDebugBreaks(PROCESSOR_DEBUGGING_STATE * DbgS TRUE); // - // Halt the thread on nop sleds + // Set the thread debugging details // - UdSpinThreadOnNop(ThreadDebuggingDetails, ProcessDebuggingDetails); + UdSetThreadPausingState(ThreadDebuggingDetails, ProcessDebuggingDetails); // // Everything was okay diff --git a/hyperdbg/hyperkd/header/debugger/user-level/Attaching.h b/hyperdbg/hyperkd/header/debugger/user-level/Attaching.h index 7e343400..ca813b71 100644 --- a/hyperdbg/hyperkd/header/debugger/user-level/Attaching.h +++ b/hyperdbg/hyperkd/header/debugger/user-level/Attaching.h @@ -45,7 +45,6 @@ typedef struct _USERMODE_DEBUGGING_PROCESS_DETAILS GUEST_REGS Registers; // active thread UINT64 Context; // $context LIST_ENTRY AttachedProcessList; - UINT64 UsermodeReservedBuffer; UINT64 EntrypointOfMainModule; UINT64 BaseAddressOfMainModule; PEPROCESS Eprocess;