vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-08-22 15:05:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

send kernel results based on event tags

Browse source
This commit is contained in:
SinaKarvandi 2020-11-18 08:59:26 -08:00
parent b4d54b0eda
commit 7fcb7a2cfb
8 changed files with 110 additions and 55 deletions
Download patch file Download diff file Expand all files Collapse all files

28
hyperdbg/hprdbgctrl/debugger.cpp
View file

@ -1480,7 +1480,7 @@ BOOLEAN InterpretGeneralEventAndActionsFields(
BOOLEAN IsNextCommandCoreId = FALSE;
BOOLEAN IsNextCommandBufferSize = FALSE;
BOOLEAN IsNextCommandImmediateMessaging = FALSE;
BOOLEAN ImmediateMessagePassing = TRUE;
BOOLEAN ImmediateMessagePassing = UseImmediateMessagingByDefaultOnEvents;
UINT32 CoreId;
UINT32 ProcessId;
UINT32 RequestBuffer = 0;
@ -1910,19 +1910,6 @@ BOOLEAN InterpretGeneralEventAndActionsFields(
return FALSE;
}
//
// Set the specific requested immediate message passing
//
if (TempActionBreak != NULL) {
TempActionBreak->ImmediateMessagePassing = ImmediateMessagePassing;
}
if (TempActionScript != NULL) {
TempActionScript->ImmediateMessagePassing = ImmediateMessagePassing;
}
if (TempActionCustomCode != NULL) {
TempActionCustomCode->ImmediateMessagePassing = ImmediateMessagePassing;
}
IsNextCommandImmediateMessaging = FALSE;
//
@ -2124,6 +2111,19 @@ BOOLEAN InterpretGeneralEventAndActionsFields(
return FALSE;
}
//
// Set the specific requested immediate message passing
//
if (TempActionBreak != NULL) {
TempActionBreak->ImmediateMessagePassing = ImmediateMessagePassing;
}
if (TempActionScript != NULL) {
TempActionScript->ImmediateMessagePassing = ImmediateMessagePassing;
}
if (TempActionCustomCode != NULL) {
TempActionCustomCode->ImmediateMessagePassing = ImmediateMessagePassing;
}
//
// Fill the address and length of event before release
//

77
hyperdbg/hprdbgctrl/hprdbgctrl.cpp
View file

@ -81,7 +81,7 @@ void ShowMessages(const char *Fmt, ...) {
LogopenSaveToFile(TempMessage);
}
if (g_MessageHandler != NULL) {
//
// There is another handler
//
@ -106,8 +106,10 @@ void ReadIrpBasedBuffer() {
DWORD ErrorNum;
HANDLE Handle;
/*
ShowMessages(" =============================== Kernel-Mode Logs (Driver) "
"===============================\n");
*/
RegisterEvent.hEvent = NULL;
RegisterEvent.Type = IRP_BASED;
@ -183,38 +185,53 @@ void ReadIrpBasedBuffer() {
continue;
}
/*
ShowMessages("========================= Kernel Mode (Buffer) "
"=========================\n");
*/
OperationCode = 0;
memcpy(&OperationCode, OutputBuffer, sizeof(UINT32));
/*
ShowMessages("Returned Length : 0x%x \n", ReturnedLength);
ShowMessages("Operation Code : 0x%x \n", OperationCode);
*/
switch (OperationCode) {
case OPERATION_LOG_NON_IMMEDIATE_MESSAGE:
/*
ShowMessages(
"A buffer of messages (OPERATION_LOG_NON_IMMEDIATE_MESSAGE) :\n");
ShowMessages("%s\n", OutputBuffer + sizeof(UINT32));
*/
ShowMessages("%s", OutputBuffer + sizeof(UINT32));
break;
case OPERATION_LOG_INFO_MESSAGE:
ShowMessages("Information log (OPERATION_LOG_INFO_MESSAGE) :\n");
ShowMessages("%s\n", OutputBuffer + sizeof(UINT32));
/*
ShowMessages("Information log (OPERATION_LOG_INFO_MESSAGE) :\n");
*/
ShowMessages("%s", OutputBuffer + sizeof(UINT32));
break;
case OPERATION_LOG_ERROR_MESSAGE:
ShowMessages("Error log (OPERATION_LOG_ERROR_MESSAGE) :\n");
ShowMessages("%s\n", OutputBuffer + sizeof(UINT32));
/*
ShowMessages("Error log (OPERATION_LOG_ERROR_MESSAGE) :\n");
*/
ShowMessages("%s", OutputBuffer + sizeof(UINT32));
break;
case OPERATION_LOG_WARNING_MESSAGE:
ShowMessages("Warning log (OPERATION_LOG_WARNING_MESSAGE) :\n");
ShowMessages("%s\n", OutputBuffer + sizeof(UINT32));
/*
ShowMessages("Warning log (OPERATION_LOG_WARNING_MESSAGE) :\n");
*/
ShowMessages("%s", OutputBuffer + sizeof(UINT32));
break;
default:
ShowMessages("Message From Debugger :\n");
ShowMessages("%s\n", OutputBuffer + sizeof(UINT32));
/*
ShowMessages("Message From Debugger :\n");
*/
ShowMessages("%s", OutputBuffer + sizeof(UINT32));
break;
}
} else {
@ -241,9 +258,9 @@ void ReadIrpBasedBuffer() {
DWORD WINAPI ThreadFunc(void *data) {
//
// Do stuff. This will be the first function called on the new thread.
// When this function returns, the thread goes away. See MSDN for more
// details. Test Irp Based Notifications
// Do stuff. This will be the first function called on the new
// thread. When this function returns, the thread goes away. See
// MSDN for more details. Test Irp Based Notifications
//
ReadIrpBasedBuffer();
@ -254,7 +271,8 @@ DWORD WINAPI ThreadFunc(void *data) {
/**
* @brief Install the driver
*
* @return int return zero if it was successful or non-zero if there was error
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int HyperdbgInstallVmmDriver() {
@ -285,7 +303,8 @@ HPRDBGCTRL_API int HyperdbgInstallVmmDriver() {
/**
* @brief Uninstall the driver
*
* @return int return zero if it was successful or non-zero if there was error
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int HyperdbgUninstallDriver() {
@ -301,7 +320,8 @@ HPRDBGCTRL_API int HyperdbgUninstallDriver() {
/**
* @brief Load the driver
*
* @return int return zero if it was successful or non-zero if there was error
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int HyperdbgLoadVmm() {
@ -323,8 +343,8 @@ HPRDBGCTRL_API int HyperdbgLoadVmm() {
if (CpuID == "GenuineIntel") {
ShowMessages("The Processor virtualization technology is VT-x.\n");
} else {
ShowMessages(
"This program is not designed to run in a non-VT-x environemnt !\n");
ShowMessages("This program is not designed to run in a non-VT-x "
"environemnt !\n");
return 1;
}
@ -370,8 +390,8 @@ HPRDBGCTRL_API int HyperdbgLoadVmm() {
// Register the CTRL+C and CTRL+BREAK Signals handler
//
if (!SetConsoleCtrlHandler(BreakController, TRUE)) {
ShowMessages(
"Error in registering CTRL+C and CTRL+BREAK Signals handler\n");
ShowMessages("Error in registering CTRL+C and CTRL+BREAK Signals "
"handler\n");
return 1;
}
@ -381,13 +401,15 @@ HPRDBGCTRL_API int HyperdbgLoadVmm() {
/**
* @brief Unload driver
*
* @return int return zero if it was successful or non-zero if there was error
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int HyperdbgUnload() {
BOOL Status;
if (!g_DeviceHandle) {
ShowMessages("Handle not found, probably the driver is not initialized.\n");
ShowMessages("Handle not found, probably the driver is not "
"initialized.\n");
return 1;
}
@ -419,10 +441,12 @@ HPRDBGCTRL_API int HyperdbgUnload() {
//
Status = DeviceIoControl(
g_DeviceHandle, // Handle to device
IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL, // IO Control code
IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL, // IO
// Control
// code
NULL, // Input Buffer to driver.
0, // Length of input buffer in bytes. (x 2 is bcuz as the driver is x64
// and has 64 bit values)
0, // Length of input buffer in bytes. (x 2 is bcuz as the
// driver is x64 and has 64 bit values)
NULL, // Output Buffer from driver.
0, // Length of output buffer in bytes.
NULL, // Bytes placed in buffer.
@ -451,7 +475,8 @@ HPRDBGCTRL_API int HyperdbgUnload() {
};
//
// Null the handle to indicate that the driver's device is not ready to use
// Null the handle to indicate that the driver's device is not ready
// to use
//
g_DeviceHandle = NULL;

8
hyperdbg/hprdbgctrl/sewrapper.cpp
View file

@ -52,9 +52,8 @@ VOID ScriptEngineWrapperTestPerformAction(PGUEST_REGS_USER_MODE GuestRegs,
//
PSYMBOL_BUFFER CodeBuffer = ScriptEngineParse((char *)Expr.c_str());
UINT64 g_TempList[MAX_TEMP_COUNT] = { 0 };
UINT64 g_VariableList[MAX_VAR_COUNT] = { 0 };
UINT64 g_TempList[MAX_TEMP_COUNT] = {0};
UINT64 g_VariableList[MAX_VAR_COUNT] = {0};
if (CodeBuffer->Message == NULL) {
PrintSymbolBuffer(CodeBuffer);
@ -62,7 +61,8 @@ VOID ScriptEngineWrapperTestPerformAction(PGUEST_REGS_USER_MODE GuestRegs,
for (int i = 0; i < CodeBuffer->Pointer;) {
printf("%d\n", i);
ScriptEngineExecute(GuestRegs, (UINT64*)g_TempList, (UINT64*) g_VariableList, CodeBuffer, &i);
ScriptEngineExecute(GuestRegs, NULL, FALSE, (UINT64 *)g_TempList,
(UINT64 *)g_VariableList, CodeBuffer, &i);
}
RemoveSymbolBuffer(CodeBuffer);
} else {

11
hyperdbg/hprdbghv/Common.h
View file

@ -533,6 +533,17 @@ typedef enum _LOG_TYPE
format "\n", \
__VA_ARGS__)
/**
* @brief Log without any prefix
*
*/
# define LogSimpleWithTag(tag, isimmdte, format, ...) \
LogSendMessageToQueue(tag, \
isimmdte, \
FALSE, \
format, \
__VA_ARGS__)
#endif // UseDbgPrintInsteadOfUsermodeMessageTracking
//////////////////////////////////////////////////

3
hyperdbg/hprdbghv/Debugger.c
View file

@ -465,6 +465,7 @@ DebuggerAddActionToEvent(PDEBUGGER_EVENT Event, DEBUGGER_EVENT_ACTION_TYPE_ENUM
//
Action->ImmediatelySendTheResults = SendTheResultsImmediately;
Action->ActionType = ActionType;
Action->Tag = Event->Tag;
//
// Now we should add the action to the event's LIST_ENTRY of actions
@ -996,7 +997,7 @@ DebuggerPerformRunScript(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS
for (int i = 0; i < CodeBuffer.Pointer;)
{
ScriptEngineExecute(Regs, (UINT64 *)g_TempList, (UINT64 *)g_VariableList, &CodeBuffer, &i);
ScriptEngineExecute(Regs, Action->Tag, Action->ImmediatelySendTheResults, (UINT64 *)g_TempList, (UINT64 *)g_VariableList, &CodeBuffer, &i);
}
}

14
hyperdbg/include/Configuration.h
View file

@ -35,8 +35,8 @@
/**
* @brief Show debug messages in both usermode app and debugger,
* it works only if you set UseDbgPrintInsteadOfUsermodeMessageTracking to FALSE
* @details Should be FALSE, I realized that if we enable this flag, we end up in a
* situation that DbgPrint halts the system because it is executing in
* @details Should be FALSE, I realized that if we enable this flag, we end up
* in a situation that DbgPrint halts the system because it is executing in
* Dispatch-level in a DPC routine, I left it to FALSE for future attention
*/
#define ShowMessagesOnDebugger FALSE
@ -46,4 +46,12 @@
* recieved and do not accumulate them) it works only if you set
* UseDbgPrintInsteadOfUsermodeMessageTracking to FALSE
*/
#define UseImmediateMessaging FALSE
#define UseImmediateMessaging TRUE
/**
* @brief Use immediate messaging (means that it sends each message when they
* recieved and do not accumulate them) its the default value on events,
* a user can change this behavior by selecting 'imm yes' or 'imm no' in the
* case of events
*/
#define UseImmediateMessagingByDefaultOnEvents TRUE

1
hyperdbg/include/Definition.h
View file

@ -726,6 +726,7 @@ typedef struct _DEBUGGER_EVENT_REQUEST_CUSTOM_CODE {
*
*/
typedef struct _DEBUGGER_EVENT_ACTION {
UINT64 Tag; // Action tag is same as Event's tag
UINT32 ActionOrderCode; // The code for this action (it also shows the order)
LIST_ENTRY ActionsList; // Holds the link list of next actions
DEBUGGER_EVENT_ACTION_TYPE_ENUM ActionType; // What action we wanna perform

23
hyperdbg/include/ScriptEngineCommon.h
View file

@ -38,6 +38,13 @@ typedef unsigned __int64 ULONG64, *PULONG64;
typedef unsigned __int64 DWORD64, *PDWORD64;
#define VOID void
typedef unsigned char UCHAR;
typedef unsigned short USHORT;
typedef unsigned long ULONG;
typedef UCHAR BOOLEAN; // winnt
typedef BOOLEAN *PBOOLEAN; // winnt
typedef signed char INT8, *PINT8;
typedef signed short INT16, *PINT16;
typedef signed int INT32, *PINT32;
@ -304,7 +311,8 @@ QWORD ScriptEngineKeywordDq(PUINT64 Address) {
//
// Functions
//
VOID ScriptEngineFunctionPrint(UINT64 Value) {
VOID ScriptEngineFunctionPrint(UINT64 Tag, BOOLEAN ImmediateMessagePassing,
UINT64 Value) {
#ifdef SCRIPT_ENGINE_USER_MODE
printf("Result is: %llx\n", Value);
@ -312,7 +320,7 @@ VOID ScriptEngineFunctionPrint(UINT64 Value) {
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
LogInfo("Result is : %llx\n", Value);
LogSimpleWithTag(Tag, ImmediateMessagePassing, "Result is : %llx\n", Value);
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -402,7 +410,8 @@ VOID SetValue(PGUEST_REGS_USER_MODE GuestRegs, UINT64 *g_TempList,
}
//
VOID ScriptEngineExecute(PGUEST_REGS_USER_MODE GuestRegs, UINT64 *g_TempList,
VOID ScriptEngineExecute(PGUEST_REGS_USER_MODE GuestRegs, UINT64 Tag,
BOOLEAN ImmediateMessagePassing, UINT64 *g_TempList,
UINT64 *g_VariableList, PSYMBOL_BUFFER CodeBuffer,
int *Indx) {
@ -787,10 +796,10 @@ VOID ScriptEngineExecute(PGUEST_REGS_USER_MODE GuestRegs, UINT64 *g_TempList,
case FUNC_PRINT:
//
// Call the target function
//
ScriptEngineFunctionPrint(SrcVal0);
//
// Call the target function
//
ScriptEngineFunctionPrint(Tag, ImmediateMessagePassing, SrcVal0);
return;
}
}