diff --git a/hyperdbg/hprdbgctrl/code/debugger/commands/extension-commands/track.cpp b/hyperdbg/hprdbgctrl/code/debugger/commands/extension-commands/track.cpp index 1da22323..ae4604ef 100644 Binary files a/hyperdbg/hprdbgctrl/code/debugger/commands/extension-commands/track.cpp and b/hyperdbg/hprdbgctrl/code/debugger/commands/extension-commands/track.cpp differ diff --git a/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp b/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp index d28dbc08..1b216eac 100644 --- a/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp +++ b/hyperdbg/hprdbgctrl/code/debugger/kernel-level/kernel-listening.cpp @@ -336,7 +336,7 @@ StartAgain: // CommandTrackHandleReceivedInstructions(&PausePacket->InstructionBytesOnRip[0], MAXIMUM_INSTR_SIZE, - PausePacket->Is32BitAddress, + PausePacket->Is32BitAddress ? FALSE : TRUE, PausePacket->Rip); // diff --git a/hyperdbg/hprdbgctrl/code/debugger/misc/disassembler.cpp b/hyperdbg/hprdbgctrl/code/debugger/misc/disassembler.cpp index 9d1b5d71..f7542072 100644 --- a/hyperdbg/hprdbgctrl/code/debugger/misc/disassembler.cpp +++ b/hyperdbg/hprdbgctrl/code/debugger/misc/disassembler.cpp @@ -456,7 +456,7 @@ HyperDbgIsConditionalJumpTaken(unsigned char * BufferToDisassemble, // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses // - ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL); + // ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL); switch (instruction.mnemonic) { @@ -893,7 +893,7 @@ HyperDbgLengthDisassemblerEngine( // We have to pass a `runtime_address` different to // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses // - ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL); + // ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL); // // Return len of buffer @@ -907,10 +907,65 @@ HyperDbgLengthDisassemblerEngine( return 0; } +/** + * @brief Print addresses + * + * @param formatter + * @param buffer + * @param context + * @return ZyanStatus + */ +static ZyanStatus +ZydisFormatterPrintAddressAbsoluteForTrackingInstructions(const ZydisFormatter * formatter, + ZydisFormatterBuffer * buffer, + ZydisFormatterContext * context) +{ + ZyanU64 address; + std::map::iterator Iterate; + + ZYAN_CHECK(ZydisCalcAbsoluteAddress(context->instruction, context->operand, context->runtime_address, &address)); + + // + // Apply addressconversion of settings here + // + if (g_AddressConversion) + { + // + // Check to find the symbol of address + // + Iterate = g_DisassemblerSymbolMap.find(address); + + if (Iterate != g_DisassemblerSymbolMap.end()) + { + ZYAN_CHECK(ZydisFormatterBufferAppend(buffer, ZYDIS_TOKEN_SYMBOL)); + ZyanString * string; + ZYAN_CHECK(ZydisFormatterBufferGetString(buffer, &string)); + + // + // Call the tracker callback (with function name) + // + CommandTrackHandleReceivedCallInstructions(Iterate->second.ObjectName.c_str(), Iterate->first); + + return ZyanStringAppendFormat(string, + "<%s (%s)>", + Iterate->second.ObjectName.c_str(), + SeparateTo64BitValue(Iterate->first).c_str()); + } + } + + // + // Call the tracker callback (without function name) + // + CommandTrackHandleReceivedCallInstructions(NULL, address); + + return default_print_address_absolute(formatter, buffer, context); +} + /** * @brief Check whether the current instruction is a 'call' or 'ret' or not * * @param BufferToDisassemble Current Bytes of assembly + * @param CurrentRip Address of current RIP * @param BuffLength Length of buffer * @param Isx86_64 Whether it's an x86 or x64 * @param IsRet Whether it's a 'ret' or not @@ -920,14 +975,14 @@ HyperDbgLengthDisassemblerEngine( BOOLEAN HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet( unsigned char * BufferToDisassemble, - UINT64 BuffLength, + UINT64 CurrentRip, + UINT32 BuffLength, BOOLEAN Isx86_64, PBOOLEAN IsRet) { ZydisDecoder decoder; ZydisFormatter formatter; ZydisDecodedOperand operands[ZYDIS_MAX_OPERAND_COUNT]; - UINT64 CurrentRip = 0; int instr_decoded = 0; ZydisDecodedInstruction instruction; char buffer[256]; @@ -939,7 +994,7 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet( return DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR; } - if (Isx86_64) + if (!Isx86_64) { ZydisDecoderInit(&decoder, ZYDIS_MACHINE_MODE_LONG_64, ZYDIS_STACK_WIDTH_64); } @@ -958,22 +1013,15 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet( // formats the absolute addresses // default_print_address_absolute = - (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsolute; + (ZydisFormatterFunc)&ZydisFormatterPrintAddressAbsoluteForTrackingInstructions; ZydisFormatterSetHook(&formatter, ZYDIS_FORMATTER_FUNC_PRINT_ADDRESS_ABS, (const void **)&default_print_address_absolute); while (ZYAN_SUCCESS(ZydisDecoderDecodeFull(&decoder, BufferToDisassemble, BuffLength, &instruction, operands))) { - // - // We have to pass a `runtime_address` different to - // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses - // - - ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL); - if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_CALL) { // - // It's a call + // It's a 'call' instruction // // @@ -981,6 +1029,13 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet( // // ShowMessages("call length : 0x%x\n", instruction.length); + // + // We have to pass a `runtime_address` different to + // `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses + // + + ZydisFormatterFormatInstruction(&formatter, &instruction, operands, instruction.operand_count_visible, &buffer[0], sizeof(buffer), (ZyanU64)CurrentRip, ZYAN_NULL); + *IsRet = FALSE; return TRUE; @@ -988,7 +1043,7 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet( else if (instruction.mnemonic == ZydisMnemonic::ZYDIS_MNEMONIC_RET) { // - // It's a ret + // It's a 'ret' instruction // // @@ -996,6 +1051,11 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet( // // ShowMessages("ret length : 0x%x\n", instruction.length); + // + // Call the tracker callback + // + CommandTrackHandleReceivedRetInstructions(CurrentRip); + *IsRet = TRUE; return TRUE; diff --git a/hyperdbg/hprdbgctrl/header/commands.h b/hyperdbg/hprdbgctrl/header/commands.h index 50118ed9..b8d3d906 100644 --- a/hyperdbg/hprdbgctrl/header/commands.h +++ b/hyperdbg/hprdbgctrl/header/commands.h @@ -102,7 +102,8 @@ HyperDbgCheckWhetherTheCurrentInstructionIsCall( BOOLEAN HyperDbgCheckWhetherTheCurrentInstructionIsCallOrRet( unsigned char * BufferToDisassemble, - UINT64 BuffLength, + UINT64 CurrentRip, + UINT32 BuffLength, BOOLEAN Isx86_64, PBOOLEAN IsRet); diff --git a/hyperdbg/hprdbgctrl/header/debugger.h b/hyperdbg/hprdbgctrl/header/debugger.h index 230f0281..a8a413a1 100644 --- a/hyperdbg/hprdbgctrl/header/debugger.h +++ b/hyperdbg/hprdbgctrl/header/debugger.h @@ -235,6 +235,13 @@ CommandGRequest(); VOID CommandTrackHandleReceivedInstructions(unsigned char * BufferToDisassemble, - UINT64 BuffLength, + UINT32 BuffLength, BOOLEAN Isx86_64, UINT64 RipAddress); + +VOID +CommandTrackHandleReceivedCallInstructions(const char * NameOfFunctionFromSymbols, + UINT64 ComputedAbsoluteAddress); + +VOID +CommandTrackHandleReceivedRetInstructions(UINT64 CurrentRip); diff --git a/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp b/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp index 1e429db9..f797341f 100644 --- a/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp +++ b/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp @@ -1,4 +1,4 @@ -/** +/** * @file hyperdbg-cli.cpp * @author Sina Karvandi (sina@hyperdbg.org) * @brief Main HyperDbg Cli source coede @@ -36,6 +36,11 @@ main(int argc, char * argv[]) string PreviousCommand; bool Reset = false; + // + // Set console output code page to UTF-8 + // + SetConsoleOutputCP(CP_UTF8); + printf("HyperDbg Debugger [version: %s, build: %s]\n", CompleteVersion, BuildVersion); printf("Please visit https://docs.hyperdbg.org for more information...\n"); printf("HyperDbg is released under the GNU Public License v3 (GPLv3).\n\n");