From 7602b07b33ea1d47bafa8c29012d28e4ec9da318 Mon Sep 17 00:00:00 2001 From: SinaKarvandi Date: Fri, 24 Jul 2020 14:38:53 -0700 Subject: [PATCH] support to pausing --- hyperdbg/hprdbgctrl/Commands.h | 2 + hyperdbg/hprdbgctrl/breakcontrol.cpp | 51 ++++++++++ hyperdbg/hprdbgctrl/debugger.h | 2 + hyperdbg/hprdbgctrl/events.cpp | 99 +++++++++++++++++++ hyperdbg/hprdbgctrl/globals.h | 2 + hyperdbg/hprdbgctrl/help.h | 1 + hyperdbg/hprdbgctrl/hprdbgctrl.cpp | 18 ++++ hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj | 2 + .../hprdbgctrl/hprdbgctrl.vcxproj.filters | 6 ++ hyperdbg/hprdbgctrl/interpreter.cpp | 16 +++ hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp | 5 + 11 files changed, 204 insertions(+) create mode 100644 hyperdbg/hprdbgctrl/breakcontrol.cpp create mode 100644 hyperdbg/hprdbgctrl/events.cpp diff --git a/hyperdbg/hprdbgctrl/Commands.h b/hyperdbg/hprdbgctrl/Commands.h index 980a9dd6..0c3e62fe 100644 --- a/hyperdbg/hprdbgctrl/Commands.h +++ b/hyperdbg/hprdbgctrl/Commands.h @@ -120,3 +120,5 @@ VOID CommandLogclose(vector SplittedCommand); VOID CommandVa2pa(vector SplittedCommand); VOID CommandPa2va(vector SplittedCommand); + +VOID CommandEvents(vector SplittedCommand); diff --git a/hyperdbg/hprdbgctrl/breakcontrol.cpp b/hyperdbg/hprdbgctrl/breakcontrol.cpp new file mode 100644 index 00000000..04b05407 --- /dev/null +++ b/hyperdbg/hprdbgctrl/breakcontrol.cpp @@ -0,0 +1,51 @@ +/** + * @file breakcontrol.cpp + * @author Sina Karvandi (sina@rayanfam.com) + * @brief break control is the handler for CTRL+C and CTRL+BREAK Signals + * @details + * @version 0.1 + * @date 2020-07-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +extern BOOLEAN g_BreakPrintingOutput; + +BOOL WINAPI BreakController(DWORD CtrlType) { + switch (CtrlType) { + // Handle the CTRL-C signal. + case CTRL_C_EVENT: + ShowMessages("pause\npausing debugger...\n\nHyperDbg >"); + g_BreakPrintingOutput = TRUE; + return TRUE; + + // CTRL-CLOSE: confirm that the user wants to exit. + case CTRL_CLOSE_EVENT: + return TRUE; + + // Pass other signals to the next handler. + case CTRL_BREAK_EVENT: + ShowMessages("pause\npausing debugger...\n\nHyperDbg >"); + g_BreakPrintingOutput = TRUE; + return TRUE; + + case CTRL_LOGOFF_EVENT: + return FALSE; + + case CTRL_SHUTDOWN_EVENT: + return FALSE; + + default: + // + // Return TRUE if handled this message, further handler functions won't be + // called. + // Return FALSE to pass this message to further handlers until default + // handler calls ExitProcess(). + // + + return FALSE; + return FALSE; + } +} diff --git a/hyperdbg/hprdbgctrl/debugger.h b/hyperdbg/hprdbgctrl/debugger.h index 6b67ff6d..f6b50d19 100644 --- a/hyperdbg/hprdbgctrl/debugger.h +++ b/hyperdbg/hprdbgctrl/debugger.h @@ -37,3 +37,5 @@ BOOLEAN InterpretGeneralEventAndActionsFields( UINT64 GetNewDebuggerEventTag(); VOID LogopenSaveToFile(const char *Text); + +BOOL WINAPI BreakController(DWORD CtrlType); diff --git a/hyperdbg/hprdbgctrl/events.cpp b/hyperdbg/hprdbgctrl/events.cpp new file mode 100644 index 00000000..aa2dd0db --- /dev/null +++ b/hyperdbg/hprdbgctrl/events.cpp @@ -0,0 +1,99 @@ +/** + * @file events.cpp + * @author Sina Karvandi (sina@rayanfam.com) + * @brief events commands + * @details + * @version 0.1 + * @date 2020-07-24 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +// +// Global Variables +// +extern LIST_ENTRY g_EventTrace; +extern BOOLEAN g_EventTraceInitialized; + +VOID CommandEventsHelp() { + ShowMessages("events : show active and disabled events\n"); + ShowMessages("syntax : \tevents [e|d|c] [event number (hex value)]\n"); + + ShowMessages("\t\te.g : events \n"); + ShowMessages("\t\te.g : events e 12\n"); + ShowMessages("\t\te.g : events d 10\n"); + ShowMessages("\t\te.g : events c 10\n"); +} + +VOID CommandEvents(vector SplittedCommand) { + + PDEBUGGER_GENERAL_EVENT_DETAIL CommandDetail; + + if (!g_EventTraceInitialized) { + ShowMessages("no active/disabled events \n"); + return; + } + + PLIST_ENTRY TempList = 0; + TempList = &g_EventTrace; + while (&g_EventTrace != TempList->Blink) { + TempList = TempList->Blink; + + CommandDetail = CONTAINING_RECORD(TempList, DEBUGGER_GENERAL_EVENT_DETAIL, + CommandsEventList); + + ShowMessages("%x\t(%s)\t %s\n", CommandDetail->Tag - 0x1000000, + CommandDetail->IsEnabled ? "enabled" : "disabled", + CommandDetail->CommandStringBuffer); + } +} + +VOID CommandEventsModifyEvents(UINT64 Tag) { + + BOOLEAN Status; + ULONG ReturnedLength; + /* + // + // Check if debugger is loaded or not + // + if (!g_DeviceHandle) { + ShowMessages("Handle not found, probably the driver is not loaded.\n"); + return; + } + + // + // Send the request to the kernel + // + + Status = DeviceIoControl( + g_DeviceHandle, // Handle to device + IOCTL_DEBUGGER_HIDE_AND_UNHIDE_TO_TRANSPARENT_THE_DEBUGGER, // IO Control + // code + &HideRequest, // Input Buffer to driver. + SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE, // Input buffer length + &HideRequest, // Output Buffer from driver. + SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE, // Length of output + // buffer in bytes. + &ReturnedLength, // Bytes placed in buffer. + NULL // synchronous call + ); + + if (!Status) { + ShowMessages("Ioctl failed with code 0x%x\n", GetLastError()); + return; + } + + if (HideRequest.KernelStatus == DEBUGEER_OPERATION_WAS_SUCCESSFULL) { + ShowMessages("transparent debugging successfully enabled :)\n"); + + } else if (HideRequest.KernelStatus == + DEBUGEER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER) { + ShowMessages("unable to hide the debugger (transparent-debugging) :(\n"); + + } else { + ShowMessages("unknown error occured :(\n"); + } + */ +} diff --git a/hyperdbg/hprdbgctrl/globals.h b/hyperdbg/hprdbgctrl/globals.h index 41c6b4db..5f3e57d1 100644 --- a/hyperdbg/hprdbgctrl/globals.h +++ b/hyperdbg/hprdbgctrl/globals.h @@ -38,3 +38,5 @@ BOOLEAN g_LogOpened = FALSE; ofstream g_LogOpenFile; BOOLEAN g_ExecutingScript = FALSE; + +BOOLEAN g_BreakPrintingOutput = FALSE; diff --git a/hyperdbg/hprdbgctrl/help.h b/hyperdbg/hprdbgctrl/help.h index 1a46103c..87038f77 100644 --- a/hyperdbg/hprdbgctrl/help.h +++ b/hyperdbg/hprdbgctrl/help.h @@ -51,3 +51,4 @@ VOID CommandLogopenHelp(); VOID CommandLogcloseHelp(); VOID CommandVa2paHelp(); VOID CommandPa2vaHelp(); +VOID CommandEventsHelp(); diff --git a/hyperdbg/hprdbgctrl/hprdbgctrl.cpp b/hyperdbg/hprdbgctrl/hprdbgctrl.cpp index a62a2750..303a8347 100644 --- a/hyperdbg/hprdbgctrl/hprdbgctrl.cpp +++ b/hyperdbg/hprdbgctrl/hprdbgctrl.cpp @@ -23,6 +23,7 @@ extern TCHAR g_DriverLocation[MAX_PATH]; extern LIST_ENTRY g_EventTrace; extern BOOLEAN g_EventTraceInitialized; extern BOOLEAN g_LogOpened; +extern BOOLEAN g_BreakPrintingOutput; /** * @brief Set the function callback that will be called if anything received @@ -45,6 +46,14 @@ void ShowMessages(const char *Fmt, ...) { va_list Args; char TempMessage[PacketChunkSize]; + if (g_BreakPrintingOutput) { + // + // means that the user asserts a CTRL+C or CTRL+BREAK Signal + // we shouldn't show or save anything in this case + // + return; + } + if (g_MessageHandler == NULL) { va_start(Args, Fmt); @@ -346,6 +355,15 @@ HPRDBGCTRL_API int HyperdbgLoad() { } #endif + // + // Register the CTRL+C and CTRL+BREAK Signals handler + // + if (!SetConsoleCtrlHandler(BreakController, TRUE)) { + ShowMessages( + "Error in registering CTRL+C and CTRL+BREAK Signals handler\n"); + return 1; + } + return 0; } diff --git a/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj b/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj index fdccd9ba..06f691cd 100644 --- a/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj +++ b/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj @@ -116,6 +116,7 @@ + @@ -124,6 +125,7 @@ + diff --git a/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters b/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters index e4022e93..01625b88 100644 --- a/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters +++ b/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters @@ -233,6 +233,12 @@ Source Files\Debugger\Commands\Extension Commands + + Source Files\Debugger\Commands\Debugging Commands + + + Source Files\Debugger\Essentials + diff --git a/hyperdbg/hprdbgctrl/interpreter.cpp b/hyperdbg/hprdbgctrl/interpreter.cpp index 041a01e8..e9ee8acf 100644 --- a/hyperdbg/hprdbgctrl/interpreter.cpp +++ b/hyperdbg/hprdbgctrl/interpreter.cpp @@ -22,8 +22,21 @@ extern BOOLEAN g_ExecutingScript; * @return int returns return zero if it was successful or non-zero if there was * error */ +BOOL A = FALSE; int _cdecl HyperdbgInterpreter(const char *Command) { + if (!A) { + // + // Register the CTRL+C and CTRL+BREAK Signals handler + // + if (!SetConsoleCtrlHandler(BreakController, TRUE)) { + ShowMessages( + "Error in registering CTRL+C and CTRL+BREAK Signals handler\n"); + return 1; + } + A = TRUE; + } + string CommandString(Command); // @@ -58,6 +71,9 @@ int _cdecl HyperdbgInterpreter(const char *Command) { CommandClearScreen(); } else if (!FirstCommand.compare(".connect")) { CommandConnect(SplittedCommand); + } else if (!FirstCommand.compare("event") || + !FirstCommand.compare("events")) { + CommandEvents(SplittedCommand); } else if (!FirstCommand.compare("connect")) { ShowMessages("Couldn't resolve error at '%s', did you mean '.connect'?", FirstCommand.c_str()); diff --git a/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp b/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp index 35096ff1..5552e1d5 100644 --- a/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp +++ b/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp @@ -98,6 +98,11 @@ int main(int argc, char* argv[]) { string command; getline(cin, command); + + if (cin.fail() || cin.eof()) { + cin.clear(); // reset cin state + } + int CommandExecutionResult = HyperdbgInterpreter(command.c_str()); printf("\n");