vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-10 01:29:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add tree view for function tracking mechanism

Browse source
This commit is contained in:
unknown 2023-05-07 02:45:44 +09:00
parent 51854f1aa9
commit 746320b359
6 changed files with 92 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
hyperdbg/hprdbgctrl/code/debugger/commands/extension-commands/track.cpp
View file

Binary file not shown.

2
hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp
View file

@ -336,7 +336,7 @@ StartAgain:
//
CommandTrackHandleReceivedInstructions(&PausePacket->InstructionBytesOnRip[0],
MAXIMUM_INSTR_SIZE,
PausePacket->Is32BitAddress,
PausePacket->Is32BitAddress ? FALSE : TRUE,
PausePacket->Rip);
//

90
hyperdbg/hprdbgctrl/code/debugger/misc/disassembler.cpp
View file

@ -456,7 +456,7 @@ HyperDbgIsConditionalJumpTaken(unsigned char * BufferToDisassemble,
// `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
//
ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
// ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
switch (instruction.mnemonic)
{
@ -893,7 +893,7 @@ HyperDbgLengthDisassemblerEngine(
// We have to pass a `runtime_address` different to
// `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
//
ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
// ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
//
// Return len of buffer
@ -907,10 +907,65 @@ HyperDbgLengthDisassemblerEngine(
return 0;
}
/**
* @brief Print addresses
*
* @param formatter
* @param buffer
* @param context
* @return ZyanStatus
*/
static ZyanStatus
ZydisFormatterPrintAddressAbsoluteForTrackingInstructions(const ZydisFormatter * formatter,
ZydisFormatterBuffer * buffer,
ZydisFormatterContext * context)
{
ZyanU64 address;
std::map<UINT64, LOCAL_FUNCTION_DESCRIPTION>::iterator Iterate;
ZYAN_CHECK(ZydisCalcAbsoluteAddress(context->instruction, context->operand, context->runtime_address, &address));
//
// Apply addressconversion of settings here
//
if (g_AddressConversion)
{
//
// Check to find the symbol of address
//
Iterate = g_DisassemblerSymbolMap.find(address);
if (Iterate != g_DisassemblerSymbolMap.end())
{
ZYAN_CHECK(ZydisFormatterBufferAppend(buffer, ZYDIS_TOKEN_SYMBOL));
ZyanString * string;
ZYAN_CHECK(ZydisFormatterBufferGetString(buffer, &string));
//
// Call the tracker callback (with function name)
//
CommandTrackHandleReceivedCallInstructions(Iterate->second.ObjectName.c_str(), Iterate->first);
return ZyanStringAppendFormat(string,
"<%s (%s)>",
Iterate->second.ObjectName.c_str(),
SeparateTo64BitValue(Iterate->first).c_str());
}
}
//
// Call the tracker callback (without function name)
//
CommandTrackHandleReceivedCallInstructions(NULL, address);
return default_print_address_absolute(formatter, buffer, context);
}
/**
* @brief Check whether the current instruction is a 'call' or 'ret' or not
*
* @param BufferToDisassemble Current Bytes of assembly
* @param CurrentRip Address of current RIP
* @param BuffLength Length of buffer
* @param Isx86_64 Whether it's an x86 or x64
* @param IsRet Whether it's a 'ret' or not
@ -920,14 +975,14 @@ HyperDbgLengthDisassemblerEngine(
BOOLEAN
HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet(
unsigned char * BufferToDisassemble,
UINT64 BuffLength,
UINT64 CurrentRip,
UINT32 BuffLength,
BOOLEAN Isx86_64,
PBOOLEAN IsRet)
{
ZydisDecoder decoder;
ZydisFormatter formatter;
ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT];
UINT64 CurrentRip = 0;
int instr_decoded = 0;
ZydisDecodedInstruction instruction;
char buffer[256];
@ -939,7 +994,7 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet(
return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR;
}
if (Isx86_64)
if (!Isx86_64)
{
ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64);
}
@ -958,22 +1013,15 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet(
// formats the absolute addresses
//
default_print_address_absolute =
(ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute;
(ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsoluteForTrackingInstructions;
ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute);
while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands)))
{
//
// We have to pass a `runtime_address` different to
// `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
//
ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_CALL)
{
//
// It's a call
// It's a 'call' instruction
//
//
@ -981,6 +1029,13 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet(
//
// ShowMessages("call length : 0x%x\n", instruction.length);
//
// We have to pass a `runtime_address` different to
// `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
//
ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL);
*IsRet = FALSE;
return TRUE;
@ -988,7 +1043,7 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet(
else if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_RET)
{
//
// It's a ret
// It's a 'ret' instruction
//
//
@ -996,6 +1051,11 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet(
//
// ShowMessages("ret length : 0x%x\n", instruction.length);
//
// Call the tracker callback
//
CommandTrackHandleReceivedRetInstructions(CurrentRip);
*IsRet = TRUE;
return TRUE;

3
hyperdbg/hprdbgctrl/header/commands.h
View file

@ -102,7 +102,8 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCall(
BOOLEAN
HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet(
unsigned char * BufferToDisassemble,
UINT64 BuffLength,
UINT64 CurrentRip,
UINT32 BuffLength,
BOOLEAN Isx86_64,
PBOOLEAN IsRet);

9
hyperdbg/hprdbgctrl/header/debugger.h
View file

@ -235,6 +235,13 @@ CommandGRequest();
VOID
CommandTrackHandleReceivedInstructions(unsigned char * BufferToDisassemble,
UINT64 BuffLength,
UINT32 BuffLength,
BOOLEAN Isx86_64,
UINT64 RipAddress);
VOID
CommandTrackHandleReceivedCallInstructions(const char * NameOfFunctionFromSymbols,
UINT64 ComputedAbsoluteAddress);
VOID
CommandTrackHandleReceivedRetInstructions(UINT64 CurrentRip);

7
hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp
View file

@ -1,4 +1,4 @@
/**
/**
* @file hyperdbg-cli.cpp
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Main HyperDbg Cli source coede
@ -36,6 +36,11 @@ main(int argc, char * argv[])
string PreviousCommand;
bool Reset = false;
//
// Set console output code page to UTF-8
//
SetConsoleOutputCP(CP_UTF8);
printf("HyperDbg Debugger [version: %s, build: %s]\n", CompleteVersion, BuildVersion);
printf("Please visit https://docs.hyperdbg.org for more information...\n");
printf("HyperDbg is released under the GNU Public License v3 (GPLv3).\n\n");