vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix LBR filter on ARCH LBR CTL
Some checks failed
vs2022-ci / win-amd64-build (debug, x64) (push) Has been cancelled
Details
vs2022-ci / win-amd64-build (release, x64) (push) Has been cancelled
Details
vs2022-ci / Deploy release (push) Has been cancelled
Details

Browse source
This commit is contained in:
sina 2026-05-15 20:23:52 +02:00
parent f6fd116274
commit 4ea5b142f4
1 changed files with 38 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

50
hyperdbg/hypertrace/code/lbr/Lbr.c
View file

@ -204,45 +204,71 @@ LbrCheckAndReadLegacyLbrDetails()
VOID
LbrBuildArchBasedFilterOptions(UINT64 FilterOptions, IA32_LBR_CTL_REGISTER * Ia32LbrCtl)
{
//
// By default, we are enabling all of them
//
Ia32LbrCtl->Bits.OS = 1;
Ia32LbrCtl->Bits.USR = 1;
Ia32LbrCtl->Bits.JCC = 1;
Ia32LbrCtl->Bits.NearRelCall = 1;
Ia32LbrCtl->Bits.NearIndCall = 1;
Ia32LbrCtl->Bits.NearRet = 1;
Ia32LbrCtl->Bits.NearIndJmp = 1;
Ia32LbrCtl->Bits.NearRelJmp = 1;
Ia32LbrCtl->Bits.OtherBranch = 1;
Ia32LbrCtl->Bits.CallStack = 1;
//
// Perform filtering the results
//
if (FilterOptions & LBR_KERNEL)
{
Ia32LbrCtl->Bits.OS = 1;
Ia32LbrCtl->Bits.OS = 0;
}
if (FilterOptions & LBR_USER)
{
Ia32LbrCtl->Bits.USR = 1;
Ia32LbrCtl->Bits.USR = 0;
}
if (FilterOptions & LBR_JCC)
{
Ia32LbrCtl->Bits.JCC = 1;
Ia32LbrCtl->Bits.JCC = 0;
}
if (FilterOptions & LBR_REL_CALL)
{
Ia32LbrCtl->Bits.NearRelCall = 1;
Ia32LbrCtl->Bits.NearRelCall = 0;
}
if (FilterOptions & LBR_IND_CALL)
{
Ia32LbrCtl->Bits.NearIndCall = 1;
Ia32LbrCtl->Bits.NearIndCall = 0;
}
if (FilterOptions & LBR_RETURN)
{
Ia32LbrCtl->Bits.NearRet = 1;
Ia32LbrCtl->Bits.NearRet = 0;
}
if (FilterOptions & LBR_IND_JMP)
{
Ia32LbrCtl->Bits.NearIndJmp = 1;
Ia32LbrCtl->Bits.NearIndJmp = 0;
}
if (FilterOptions & LBR_REL_JMP)
{
Ia32LbrCtl->Bits.NearRelJmp = 1;
Ia32LbrCtl->Bits.NearRelJmp = 0;
}
if (FilterOptions & LBR_FAR)
{
Ia32LbrCtl->Bits.OtherBranch = 1;
Ia32LbrCtl->Bits.OtherBranch = 0;
}
if (FilterOptions & LBR_CALL_STACK)
{
Ia32LbrCtl->Bits.CallStack = 1;
Ia32LbrCtl->Bits.CallStack = 0;
}
}
@ -804,7 +830,7 @@ LbrStop()
VOID
LbrFlush()
{
LogInfo("Flush LBR on cpu core: %d\n", KeGetCurrentProcessorNumberEx(NULL));
// LogInfo("Flush LBR on cpu core: %d\n", KeGetCurrentProcessorNumberEx(NULL));
//
// Stop LBR collection and save any remaining entries
@ -833,7 +859,7 @@ LbrFlush()
VOID
LbrFilter(UINT64 FilterOptions)
{
LogInfo("Updating LBR filter options: 0x%llx\n", FilterOptions);
// LogInfo("Updating LBR filter options: 0x%llx\n", FilterOptions);
//
// First, we flush the LBR to clear out any existing entries that may not meet the new filter criteria