diff --git a/hyperdbg/hypertrace/code/Broadcast.c b/hyperdbg/hypertrace/code/Broadcast.c new file mode 100644 index 00000000..fd3a5520 --- /dev/null +++ b/hyperdbg/hypertrace/code/Broadcast.c @@ -0,0 +1,40 @@ +/** + * @file Broadcast.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Broadcasting functions + * + * @version 0.19 + * @date 2026-04-19 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +/** + * @brief Routines to enable LBR on all cores + * + * @return VOID + */ +VOID +BroadcastEnableLbrOnAllCores() +{ + // + // Broadcast to all cores + // + KeGenericCallDpc(DpcRoutineEnableLbr, NULL); +} + +/** + * @brief Routines to disable LBR on all cores + * + * @return VOID + */ +VOID +BroadcastDisableLbrOnAllCores() +{ + // + // Broadcast to all cores + // + KeGenericCallDpc(DpcRoutineDisableLbr, NULL); +} diff --git a/hyperdbg/hypertrace/code/DpcRoutines.c b/hyperdbg/hypertrace/code/DpcRoutines.c new file mode 100644 index 00000000..c3d97e9d --- /dev/null +++ b/hyperdbg/hypertrace/code/DpcRoutines.c @@ -0,0 +1,94 @@ +/** + * @file DpcRoutines.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief DPC routines + * + * @version 0.19 + * @date 2026-04-19 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +/** + * @brief Broadcast enabling LBR + * + * @param Dpc + * @param DeferredContext + * @param SystemArgument1 + * @param SystemArgument2 + * @return BOOLEAN + */ +BOOLEAN +DpcRoutineEnableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2) +{ + LBR_IOCTL_REQUEST * CurrentRequest; + + UNREFERENCED_PARAMETER(Dpc); + UNREFERENCED_PARAMETER(DeferredContext); + + // + // Get the current request (for current core) + // + CurrentRequest = &g_LbrRequestState[KeGetCurrentProcessorNumberEx(NULL)]; + + // + // Enable LBR on all cores from VMX-root mode by VMCALL + // + + // LbrStartLbr(CurrentRequest, TRUE, TRUE); + HyperTraceExamplePerformLbrTrace(TRUE, TRUE); + + // + // Wait for all DPCs to synchronize at this point + // + KeSignalCallDpcSynchronize(SystemArgument2); + + // + // Mark the DPC as being complete + // + KeSignalCallDpcDone(SystemArgument1); + + return TRUE; +} + +/** + * @brief Broadcast disabling LBR + * + * @param Dpc + * @param DeferredContext + * @param SystemArgument1 + * @param SystemArgument2 + * @return BOOLEAN + */ +BOOLEAN +DpcRoutineDisableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2) +{ + LBR_IOCTL_REQUEST * CurrentRequest; + + UNREFERENCED_PARAMETER(Dpc); + UNREFERENCED_PARAMETER(DeferredContext); + + // + // Get the current request (for current core) + // + CurrentRequest = &g_LbrRequestState[KeGetCurrentProcessorNumberEx(NULL)]; + + // + // Disable LBR on all cores from VMX-root mode by VMCALL + // + LbrStopLbr(CurrentRequest, TRUE, TRUE); + + // + // Wait for all DPCs to synchronize at this point + // + KeSignalCallDpcSynchronize(SystemArgument2); + + // + // Mark the DPC as being complete + // + KeSignalCallDpcDone(SystemArgument1); + + return TRUE; +} diff --git a/hyperdbg/hypertrace/code/Tracing.c b/hyperdbg/hypertrace/code/Tracing.c index fa65ff8a..4121c4f4 100644 --- a/hyperdbg/hypertrace/code/Tracing.c +++ b/hyperdbg/hypertrace/code/Tracing.c @@ -10,24 +10,6 @@ */ #include "pch.h" -/** - * @brief The flag indicating whether the hypertrace module callbacks is initialized or not - * - */ -BOOLEAN g_HyperTraceCallbacksInitialized = FALSE; - -/** - * @brief The flag indicating whether the hypertrace LBR tracing is initialized or not - * - */ -BOOLEAN g_LastBranchRecordEnabled = FALSE; - -/** - * @brief Core specific state - * - */ -LBR_IOCTL_REQUEST * g_LbrRequestState = NULL; - /** * @brief Example of performing LBR trace * @@ -195,116 +177,6 @@ HyperTraceInitCallback(HYPERTRACE_CALLBACKS * HypertraceCallbacks) return TRUE; } -/** - * @brief Broadcast enabling LBR - * - * @param Dpc - * @param DeferredContext - * @param SystemArgument1 - * @param SystemArgument2 - * @return BOOLEAN - */ -BOOLEAN -DpcRoutineEnableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2) -{ - LBR_IOCTL_REQUEST * CurrentRequest; - - UNREFERENCED_PARAMETER(Dpc); - UNREFERENCED_PARAMETER(DeferredContext); - - // - // Get the current request (for current core) - // - CurrentRequest = &g_LbrRequestState[KeGetCurrentProcessorNumberEx(NULL)]; - - // - // Enable LBR on all cores from VMX-root mode by VMCALL - // - - // LbrStartLbr(CurrentRequest, TRUE, TRUE); - HyperTraceExamplePerformLbrTrace(TRUE, TRUE); - - // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); - - return TRUE; -} - -/** - * @brief Routines to enable LBR on all cores - * - * @return VOID - */ -VOID -BroadcastEnableLbrOnAllCores() -{ - // - // Broadcast to all cores - // - KeGenericCallDpc(DpcRoutineEnableLbr, NULL); -} - -/** - * @brief Broadcast disabling LBR - * - * @param Dpc - * @param DeferredContext - * @param SystemArgument1 - * @param SystemArgument2 - * @return BOOLEAN - */ -BOOLEAN -DpcRoutineDisableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2) -{ - LBR_IOCTL_REQUEST * CurrentRequest; - - UNREFERENCED_PARAMETER(Dpc); - UNREFERENCED_PARAMETER(DeferredContext); - - // - // Get the current request (for current core) - // - CurrentRequest = &g_LbrRequestState[KeGetCurrentProcessorNumberEx(NULL)]; - - // - // Disable LBR on all cores from VMX-root mode by VMCALL - // - LbrStopLbr(CurrentRequest, TRUE, TRUE); - - // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); - - return TRUE; -} - -/** - * @brief Routines to disable LBR on all cores - * - * @return VOID - */ -VOID -BroadcastDisableLbrOnAllCores() -{ - // - // Broadcast to all cores - // - KeGenericCallDpc(DpcRoutineDisableLbr, NULL); -} - /** * @brief Enable LBR tracing for HyperTrace * diff --git a/hyperdbg/hypertrace/header/Broadcast.h b/hyperdbg/hypertrace/header/Broadcast.h new file mode 100644 index 00000000..e73850ba --- /dev/null +++ b/hyperdbg/hypertrace/header/Broadcast.h @@ -0,0 +1,23 @@ + +/** + * @file Broadcast.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Headers for broadcasting functions + * @details + * @version 0.19 + * @date 2026-04-19 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +VOID +BroadcastEnableLbrOnAllCores(); + +VOID +BroadcastDisableLbrOnAllCores(); diff --git a/hyperdbg/hypertrace/header/Dpc.h b/hyperdbg/hypertrace/header/Dpc.h index 5362e006..46b6d58b 100644 --- a/hyperdbg/hypertrace/header/Dpc.h +++ b/hyperdbg/hypertrace/header/Dpc.h @@ -4,8 +4,8 @@ * @author Sina Karvandi (sina@hyperdbg.org) * @brief Definition for Windows DPC functions * @details - * @version 0.1 - * @date 2020-04-10 + * @version 0.19 + * @date 2026-04-19 * * @copyright This project is released under the GNU Public License v3. * diff --git a/hyperdbg/hypertrace/header/DpcRoutines.h b/hyperdbg/hypertrace/header/DpcRoutines.h new file mode 100644 index 00000000..814847f2 --- /dev/null +++ b/hyperdbg/hypertrace/header/DpcRoutines.h @@ -0,0 +1,23 @@ + +/** + * @file DpcRoutines.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Definition for DPC functions + * @details + * @version 0.19 + * @date 2026-04-19 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +BOOLEAN +DpcRoutineEnableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2); + +BOOLEAN +DpcRoutineDisableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2); diff --git a/hyperdbg/hypertrace/header/GlobalVariables.h b/hyperdbg/hypertrace/header/GlobalVariables.h new file mode 100644 index 00000000..ec46782f --- /dev/null +++ b/hyperdbg/hypertrace/header/GlobalVariables.h @@ -0,0 +1,35 @@ + +/** + * @file GlobalVariables.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Definition for global variables + * @details + * @version 0.19 + * @date 2026-04-19 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +////////////////////////////////////////////////// +// Global Variables // +////////////////////////////////////////////////// + +/** + * @brief The flag indicating whether the hypertrace module callbacks is initialized or not + * + */ +BOOLEAN g_HyperTraceCallbacksInitialized; + +/** + * @brief The flag indicating whether the hypertrace LBR tracing is initialized or not + * + */ +BOOLEAN g_LastBranchRecordEnabled; + +/** + * @brief Core specific state + * + */ +LBR_IOCTL_REQUEST * g_LbrRequestState; diff --git a/hyperdbg/hypertrace/header/pch.h b/hyperdbg/hypertrace/header/pch.h index 3f24c392..9dba8f90 100644 --- a/hyperdbg/hypertrace/header/pch.h +++ b/hyperdbg/hypertrace/header/pch.h @@ -43,9 +43,11 @@ #include "ia32-doc/out/ia32.h" // -// DPC headers +// DPC and broadcasting function headers // #include "Dpc.h" +#include "DpcRoutines.h" +#include "Broadcast.h" // // Unload function (to be called when the driver is unloaded) @@ -93,3 +95,8 @@ // Export functions // #include "SDK/imports/kernel/HyperDbgHyperTrace.h" + +// +// Global variables +// +#include "GlobalVariables.h" diff --git a/hyperdbg/hypertrace/hypertrace.vcxproj b/hyperdbg/hypertrace/hypertrace.vcxproj index a966c738..7d9ec5e4 100644 --- a/hyperdbg/hypertrace/hypertrace.vcxproj +++ b/hyperdbg/hypertrace/hypertrace.vcxproj @@ -103,6 +103,8 @@ + + @@ -112,7 +114,10 @@ + + + diff --git a/hyperdbg/hypertrace/hypertrace.vcxproj.filters b/hyperdbg/hypertrace/hypertrace.vcxproj.filters index 8a60127e..79fc73b9 100644 --- a/hyperdbg/hypertrace/hypertrace.vcxproj.filters +++ b/hyperdbg/hypertrace/hypertrace.vcxproj.filters @@ -41,6 +41,12 @@ code + + code + + + code + @@ -70,5 +76,14 @@ header + + header + + + header + + + header + \ No newline at end of file