vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

IsOnVmxRootMode is converted to a function

Browse source
This commit is contained in:
unknown 2022-12-07 15:47:15 +09:00
parent 1ce0692a39
commit 4cd3b8e3d8
11 changed files with 122 additions and 87 deletions
Download patch file Download diff file Expand all files Collapse all files

76
hyperdbg/hprdbghv/code/common/Logging.c
View file

@ -5,17 +5,17 @@
* @details
* @version 0.1
* @date 2020-04-11
*
*
* @copyright This project is released under the GNU Public License v3.
*
*
*/
#include "pch.h"
#include "Logging.tmh"
/**
* @brief Initialize the buffer relating to log message tracing
*
* @return BOOLEAN
*
* @return BOOLEAN
*/
BOOLEAN
LogInitialize()
@ -94,8 +94,8 @@ LogInitialize()
/**
* @brief Uninitialize the buffer relating to log message tracing
*
* @return VOID
*
* @return VOID
*/
VOID
LogUnInitialize()
@ -121,12 +121,12 @@ LogUnInitialize()
/**
* @brief Save buffer to the pool
*
*
* @param OperationCode The operation code that will be send to user mode
* @param Buffer Buffer to be send to user mode
* @param BufferLength Length of the buffer
* @param Priority Whether the buffer has priority
* @return BOOLEAN Returns true if the buffer succssfully set to be
* @return BOOLEAN Returns true if the buffer succssfully set to be
* send to user mode and false if there was an error
*/
_Use_decl_annotations_
@ -148,7 +148,7 @@ LogSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, BOOLEAN P
//
// Check that if we're in vmx root-mode
//
IsVmxRoot = g_GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode;
IsVmxRoot = VmxGetCurrentExecutionMode();
//
// Check if we're connected to remote debugger, send it directly to the debugger
@ -341,11 +341,11 @@ LogSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, BOOLEAN P
}
/**
* @brief Mark all buffers as read
* @brief Mark all buffers as read
* @details Priority buffers won't be set as read
*
*
* @param IsVmxRoot Determine whether you want to read vmx root buffer or vmx non root buffer
* @return UINT32 return count of messages that set to invalid
* @return UINT32 return count of messages that set to invalid
*/
UINT32
LogMarkAllAsRead(BOOLEAN IsVmxRoot)
@ -478,12 +478,12 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
}
/**
* @brief Attempt to read the buffer
*
* @brief Attempt to read the buffer
*
* @param IsVmxRoot Determine whether you want to read vmx root buffer or vmx non root buffer
* @param BufferToSaveMessage Target buffer to save the message
* @param ReturnedLength The actual length of the buffer that this function used it
* @return BOOLEAN return of this function shows whether the read was successfull
* @return BOOLEAN return of this function shows whether the read was successfull
* or not (e.g FALSE shows there's no new buffer available.)
*/
BOOLEAN
@ -700,10 +700,10 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
/**
* @brief Check if new message is available or not
*
*
* @param IsVmxRoot Check vmx root pool for message or check vmx non root pool
* @param Priority Whether the buffer has priority
*
*
* @return BOOLEAN return of this function shows whether the read was successfull or not
* (e.g FALSE shows there's no new buffer available.)
*/
@ -753,13 +753,13 @@ LogCheckForNewMessage(BOOLEAN IsVmxRoot, BOOLEAN Priority)
/**
* @brief Prepare a printf-style message mapping and send string messages
* and tracing for logging and monitoring
*
*
* @param OperationCode Optional operation code
* @param IsImmediateMessage Should be sent immediately
* @param ShowCurrentSystemTime Show system-time
* @param Priority Whether the message has priority
* @param Fmt Message format-string
* @param ...
* @param ...
* @return BOOLEAN if it was successful then return TRUE, otherwise returns FALSE
*/
BOOLEAN
@ -781,7 +781,7 @@ LogPrepareAndSendMessageToQueue(UINT32 OperationCode,
//
// Set Vmx State
//
IsVmxRootMode = g_GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode;
IsVmxRootMode = VmxGetCurrentExecutionMode();
if (ShowCurrentSystemTime)
{
@ -899,13 +899,13 @@ LogPrepareAndSendMessageToQueue(UINT32 OperationCode,
/**
* @brief Send string messages and tracing for logging and monitoring
*
*
* @param OperationCode Optional operation code
* @param IsImmediateMessage Should be sent immediately
* @param LogMessage Link of message buffer
* @param BufferLen Length of buffer
* @param Priority Whether the buffer has priority
*
*
* @return BOOLEAN if it was successful then return TRUE, otherwise returns FALSE
*/
BOOLEAN
@ -919,7 +919,7 @@ LogSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR * L
//
// Set Vmx State
//
IsVmxRootMode = g_GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode;
IsVmxRootMode = VmxGetCurrentExecutionMode();
#if UseWPPTracing
@ -988,7 +988,7 @@ LogSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR * L
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, &OldIRQL);
}
//
//Set the result to True
// Set the result to True
//
Result = TRUE;
@ -1048,12 +1048,12 @@ LogSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, CHAR * L
/**
* @brief Complete the IRP in IRP Pending state and fill the usermode buffers with pool data
*
* @param Dpc
* @param DeferredContext
* @param SystemArgument1
* @param SystemArgument2
* @return VOID
*
* @param Dpc
* @param DeferredContext
* @param SystemArgument1
* @param SystemArgument2
* @return VOID
*/
VOID
LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2)
@ -1163,10 +1163,10 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument
/**
* @brief Register a new IRP Pending thread which listens for new buffers
*
* @param DeviceObject
* @param Irp
* @return NTSTATUS
*
* @param DeviceObject
* @param Irp
* @return NTSTATUS
*/
NTSTATUS
LogRegisterIrpBasedNotification(PDEVICE_OBJECT DeviceObject, PIRP Irp)
@ -1279,10 +1279,10 @@ LogRegisterIrpBasedNotification(PDEVICE_OBJECT DeviceObject, PIRP Irp)
/**
* @brief Create an event-based usermode notifying mechanism
*
* @param DeviceObject
* @param Irp
* @return NTSTATUS
*
* @param DeviceObject
* @param Irp
* @return NTSTATUS
*/
NTSTATUS
LogRegisterEventBasedNotification(PDEVICE_OBJECT DeviceObject, PIRP Irp)

14
hyperdbg/hprdbghv/code/debugger/core/Debugger.c
View file

@ -314,7 +314,7 @@ DebuggerCreateEvent(BOOLEAN Enabled,
// As this function uses ExAllocatePoolWithTag,
// we have to make sure that it will not be called in vmx root
//
if (g_GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode)
if (VmxGetCurrentExecutionMode() == TRUE)
{
return NULL;
}
@ -392,7 +392,11 @@ DebuggerCreateEvent(BOOLEAN Enabled,
* @return PDEBUGGER_EVENT_ACTION
*/
PDEBUGGER_EVENT_ACTION
DebuggerAddActionToEvent(PDEBUGGER_EVENT Event, DEBUGGER_EVENT_ACTION_TYPE_ENUM ActionType, BOOLEAN SendTheResultsImmediately, PDEBUGGER_EVENT_REQUEST_CUSTOM_CODE InTheCaseOfCustomCode, PDEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION InTheCaseOfRunScript)
DebuggerAddActionToEvent(PDEBUGGER_EVENT Event,
DEBUGGER_EVENT_ACTION_TYPE_ENUM ActionType,
BOOLEAN SendTheResultsImmediately,
PDEBUGGER_EVENT_REQUEST_CUSTOM_CODE InTheCaseOfCustomCode,
PDEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION InTheCaseOfRunScript)
{
PDEBUGGER_EVENT_ACTION Action;
SIZE_T Size;
@ -401,7 +405,7 @@ DebuggerAddActionToEvent(PDEBUGGER_EVENT Event, DEBUGGER_EVENT_ACTION_TYPE_ENUM
// As this function uses ExAllocatePoolWithTag,
// we have to make sure that it will not be called in vmx root
//
if (g_GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode)
if (VmxGetCurrentExecutionMode() == TRUE)
{
return NULL;
}
@ -1378,7 +1382,7 @@ DebuggerPerformBreakToDebugger(VIRTUAL_MACHINE_STATE * VCpu, UINT64 Tag, PDEBUGG
{
DEBUGGER_TRIGGERED_EVENT_DETAILS ContextAndTag = {0};
if (VCpu->IsOnVmxRootMode)
if (VmxGetCurrentExecutionMode() == TRUE)
{
//
// The guest is already in vmx-root mode
@ -1625,7 +1629,7 @@ DebuggerEventListCount(PLIST_ENTRY TargetEventList)
UINT32
DebuggerEventListCountByCore(PLIST_ENTRY TargetEventList, UINT32 TargetCore)
{
PLIST_ENTRY TempList = 0;
PLIST_ENTRY TempList = 0;
UINT32 Counter = 0;
//

30
hyperdbg/hprdbghv/code/debugger/features/hooks/ept-hook/EptHook.c
View file

@ -13,22 +13,6 @@
*/
#include "pch.h"
typedef enum _VMX_EXECUTION_MODE
{
VmxExecutionModeRoot,
VmxExecutionModeNonRoot,
} VMX_EXECUTION_MODE;
_Must_inspect_result_
inline static VMX_EXECUTION_MODE
GetCurrentVmxExecutionMode()
{
ULONG CurrentCore = KeGetCurrentProcessorIndex();
VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
return CurrentVmState->IsOnVmxRootMode ? VmxExecutionModeRoot : VmxExecutionModeNonRoot;
}
/**
* @brief Check whether the desired PhysicalAddress is already in the g_EptState->HookedPagesList hooks or not
*
@ -496,7 +480,7 @@ EptHookRestoreSingleHookToOrginalEntry(SIZE_T PhysicalAddress)
//
// Should be called from vmx-root, for calling from vmx non-root use the corresponding VMCALL
//
if (!g_GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode)
if (VmxGetCurrentExecutionMode() == FALSE)
{
return FALSE;
}
@ -531,8 +515,10 @@ EptHookRestoreAllHooksToOrginalEntry()
//
// Should be called from vmx-root, for calling from vmx non-root use the corresponding VMCALL
//
if (GetCurrentVmxExecutionMode() == VmxExecutionModeNonRoot)
if (VmxGetCurrentExecutionMode() == FALSE)
{
return;
}
LIST_FOR_EACH_LINK(g_EptState->HookedPagesList, EPT_HOOKED_PAGE_DETAIL, PageHookList, CurrEntity)
{
@ -1114,7 +1100,7 @@ EptHook2(PVOID TargetAddress, PVOID HookFunction, UINT32 ProcessId, BOOLEAN SetH
return FALSE;
}
if (g_GuestState[LogicalCoreIndex].HasLaunched)
if (VmxGetCurrentLaunchState())
{
//
// Move Attribute Mask to the upper 32 bits of the VMCALL Number
@ -1129,7 +1115,7 @@ EptHook2(PVOID TargetAddress, PVOID HookFunction, UINT32 ProcessId, BOOLEAN SetH
// LogInfo("Hook applied from VMX Root Mode");
//
if (!g_GuestState[LogicalCoreIndex].IsOnVmxRootMode)
if (VmxGetCurrentExecutionMode() == FALSE)
{
//
// Now we have to notify all the core to invalidate their EPT
@ -1536,7 +1522,7 @@ EptHookUnHookSingleAddress(UINT64 VirtualAddress, UINT64 PhysAddress, UINT32 Pro
//
// Should be called from vmx non-root
//
if (GetCurrentVmxExecutionMode() == VmxExecutionModeRoot)
if (VmxGetCurrentExecutionMode() == TRUE)
{
return FALSE;
}
@ -1600,7 +1586,7 @@ EptHookUnHookAll()
//
// Should be called from vmx non-root
//
if (GetCurrentVmxExecutionMode() != VmxExecutionModeNonRoot)
if (VmxGetCurrentExecutionMode() == TRUE)
{
return;
}

6
hyperdbg/hprdbghv/code/debugger/script-engine/ScriptEngine.c
View file

@ -13,7 +13,7 @@
/**
* @brief Get current ip from the debugger frame
*
*
* @return UINT64 returns the rip of the current debuggee state frame
*/
UINT64
@ -27,7 +27,7 @@ ScriptEngineWrapperGetInstructionPointer()
//
// Check if we are in vmx-root or not
//
if (g_GuestState[CurrentProcessorIndex].IsOnVmxRootMode)
if (VmxGetCurrentExecutionMode() == TRUE)
{
__vmx_vmread(VMCS_GUEST_RIP, &GuestRip);
return GuestRip;
@ -43,7 +43,7 @@ ScriptEngineWrapperGetInstructionPointer()
/**
* @brief Get the address of reserved buffer
*
*
* @param Action Corresponding action
* @return UINT64 returns the requested buffer address from user
*/

2
hyperdbg/hprdbghv/code/debugger/user-level/Attaching.c
View file

@ -403,7 +403,7 @@ AttachingHandleEntrypointDebugBreak(VIRTUAL_MACHINE_STATE * VCpu)
//
// Show a message that we reached to the entrypoint
//
// Log("Reached to the main module entrypoint (%016llx)\n", g_GuestState[CurrentProcessorIndex].LastVmexitRip);
// Log("Reached to the main module entrypoint (%016llx)\n", VCpu->LastVmexitRip);
//
// Not waiting for these event anymore

2
hyperdbg/hprdbghv/code/debugger/user-level/Ud.c
View file

@ -475,7 +475,7 @@ UdCheckAndHandleBreakpointsAndDebugBreaks(VIRTUAL_MACHINE_STATE * VCpu
// Breaking only supported in vmx-root mode, and if user-debugger is
// loaded
//
if (!g_UserDebuggerState && !VCpu->IsOnVmxRootMode)
if (!g_UserDebuggerState && VmxGetCurrentExecutionMode() == FALSE)
{
return FALSE;
}

33
hyperdbg/hprdbghv/code/memory/PoolManager.c
View file

@ -4,12 +4,12 @@
* @brief The pool manager used in vmx root
* @details As we cannot allocate pools in vmx root, we need a pool
* manager to manage the pools
*
*
* @version 0.1
* @date 2020-04-11
*
*
* @copyright This project is released under the GNU Public License v3.
*
*
*/
#include "pch.h"
@ -34,7 +34,8 @@ PlmgrAllocateRequestNewAllocation(SIZE_T NumberOfBytes)
return TRUE;
}
VOID PlmgrFreeRequestNewAllocation(VOID)
VOID
PlmgrFreeRequestNewAllocation(VOID)
{
ExFreePoolWithTag(g_RequestNewAllocation, POOLTAG);
}
@ -45,8 +46,8 @@ VOID PlmgrFreeRequestNewAllocation(VOID)
/**
* @brief Initializes the pool manager
*
* @return BOOLEAN
*
* @return BOOLEAN
*/
BOOLEAN
PoolManagerInitialize()
@ -106,8 +107,8 @@ PoolManagerInitialize()
/**
* @brief Uninitialize the pool manager (free the buffers, etc.)
*
* @return VOID
*
* @return VOID
*/
VOID
PoolManagerUninitialize()
@ -150,9 +151,9 @@ PoolManagerUninitialize()
/**
* @brief This function set a pool flag to be freed, and it will be freed
* on the next IOCTL when it's safe to remove
*
*
* @param AddressToFree The pool address that was previously obtained from the pool manager
* @return BOOLEAN If the address was already in the list of allocated pools by pool
* @return BOOLEAN If the address was already in the list of allocated pools by pool
* manager then it returns TRUE; otherwise, FALSE
*/
BOOLEAN
@ -195,7 +196,7 @@ PoolManagerFreePool(UINT64 AddressToFree)
* @brief This function should be called from vmx-root in order to get a pool from the list
* @details If RequestNewPool is TRUE then Size is used, otherwise Size is useless
* Note : Most of the times this function called from vmx root but not all the time
*
*
* @param Intention The intention why we need this pool for (buffer tag)
* @param RequestNewPool Create a request to allocate a new pool with the same size, next time
* that it's safe to allocate (this way we never ran out of pools for this "Intention")
@ -236,7 +237,7 @@ PoolManagerRequestPool(POOL_ALLOCATION_INTENTION Intention, BOOLEAN RequestNewPo
/**
* @brief Allocate the new pools and add them to pool table
* @details This function doesn't need lock as it just calls once from PASSIVE_LEVEL
*
*
* @param Size Size of each chunk
* @param Count Count of chunks
* @param Intention The Intention of the buffer (buffer tag)
@ -287,7 +288,7 @@ PoolManagerAllocateAndAddToPoolTable(SIZE_T Size, UINT32 Count, POOL_ALLOCATION_
/**
* @brief This function performs allocations from VMX non-root based on g_RequestNewAllocation
*
*
* @return BOOLEAN If the the pool manager allocates buffer or there was no buffer to allocate
* then it returns true, if there was any error then it returns false
*/
@ -301,7 +302,7 @@ PoolManagerCheckAndPerformAllocationAndDeallocation()
//
// let's make sure we're on vmx non-root and also we have new allocation
//
if (g_GuestState[KeGetCurrentProcessorNumber()].IsOnVmxRootMode)
if (VmxGetCurrentExecutionMode() == TRUE)
{
//
// allocation's can't be done from vmx root
@ -396,8 +397,8 @@ PoolManagerCheckAndPerformAllocationAndDeallocation()
/**
* @brief Request to allocate new buffers
*
* @param Size Request new buffer to allocate
*
* @param Size Request new buffer to allocate
* @param Count Count of chunks
* @param Intention The intention of chunks (buffer tag)
* @return BOOLEAN If the request is save it returns true otherwise it returns false

28
hyperdbg/hprdbghv/code/vmm/vmx/Vmx.c
View file

@ -67,6 +67,34 @@ VmxCheckVmxSupport()
return TRUE;
}
/**
* @brief Check current execution mode (vmx-root and non-root)
*
* @return BOOLEAN Returns true if the execution is on vmx-root, otherwise false
*/
BOOLEAN
VmxGetCurrentExecutionMode()
{
ULONG CurrentCore = KeGetCurrentProcessorIndex();
VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
return CurrentVmState->IsOnVmxRootMode ? VmxExecutionModeRoot : VmxExecutionModeNonRoot;
}
/**
* @brief Check if the VMX is launched or not
*
* @return BOOLEAN Returns true if it's launched, otherwise false
*/
BOOLEAN
VmxGetCurrentLaunchState()
{
ULONG CurrentCore = KeGetCurrentProcessorIndex();
VIRTUAL_MACHINE_STATE * CurrentVmState = &g_GuestState[CurrentCore];
return CurrentVmState->HasLaunched;
}
/**
* @brief Initialize Vmx operation
*

6
hyperdbg/hprdbghv/header/vmm/vmx/Vmx.h
View file

@ -379,3 +379,9 @@ VmxReturnStackPointerForVmxoff();
UINT64
VmxReturnInstructionPointerForVmxoff();
BOOLEAN
VmxGetCurrentExecutionMode();
BOOLEAN
VmxGetCurrentLaunchState();

10
hyperdbg/include/SDK/Headers/Datatypes.h
View file

@ -12,6 +12,16 @@
*/
#pragma once
//////////////////////////////////////////////////
// Execution Stages //
//////////////////////////////////////////////////
typedef enum _VMX_EXECUTION_MODE
{
VmxExecutionModeNonRoot = FALSE,
VmxExecutionModeRoot = TRUE
} VMX_EXECUTION_MODE;
//////////////////////////////////////////////////
// Callback Definitions //
//////////////////////////////////////////////////

2
hyperdbg/script-eval/code/Functions.c
View file

@ -749,7 +749,7 @@ ScriptEngineFunctionPause(UINT64 Tag,
DEBUGGER_TRIGGERED_EVENT_DETAILS ContextAndTag = {0};
UINT32 CurrentProcessorIndex = KeGetCurrentProcessorNumber();
if (g_GuestState[CurrentProcessorIndex].IsOnVmxRootMode)
if (VmxGetCurrentExecutionMode() == TRUE)
{
//
// The guest is already in vmx-root mode