diff --git a/hyperdbg/hprdbgctrl/debugger.cpp b/hyperdbg/hprdbgctrl/debugger.cpp index 538ee696..df6e2086 100644 --- a/hyperdbg/hprdbgctrl/debugger.cpp +++ b/hyperdbg/hprdbgctrl/debugger.cpp @@ -1480,7 +1480,7 @@ BOOLEAN InterpretGeneralEventAndActionsFields( BOOLEAN IsNextCommandCoreId = FALSE; BOOLEAN IsNextCommandBufferSize = FALSE; BOOLEAN IsNextCommandImmediateMessaging = FALSE; - BOOLEAN ImmediateMessagePassing = TRUE; + BOOLEAN ImmediateMessagePassing = UseImmediateMessagingByDefaultOnEvents; UINT32 CoreId; UINT32 ProcessId; UINT32 RequestBuffer = 0; @@ -1910,19 +1910,6 @@ BOOLEAN InterpretGeneralEventAndActionsFields( return FALSE; } - // - // Set the specific requested immediate message passing - // - if (TempActionBreak != NULL) { - TempActionBreak->ImmediateMessagePassing = ImmediateMessagePassing; - } - if (TempActionScript != NULL) { - TempActionScript->ImmediateMessagePassing = ImmediateMessagePassing; - } - if (TempActionCustomCode != NULL) { - TempActionCustomCode->ImmediateMessagePassing = ImmediateMessagePassing; - } - IsNextCommandImmediateMessaging = FALSE; // @@ -2124,6 +2111,19 @@ BOOLEAN InterpretGeneralEventAndActionsFields( return FALSE; } + // + // Set the specific requested immediate message passing + // + if (TempActionBreak != NULL) { + TempActionBreak->ImmediateMessagePassing = ImmediateMessagePassing; + } + if (TempActionScript != NULL) { + TempActionScript->ImmediateMessagePassing = ImmediateMessagePassing; + } + if (TempActionCustomCode != NULL) { + TempActionCustomCode->ImmediateMessagePassing = ImmediateMessagePassing; + } + // // Fill the address and length of event before release // diff --git a/hyperdbg/hprdbgctrl/hprdbgctrl.cpp b/hyperdbg/hprdbgctrl/hprdbgctrl.cpp index 12d7a6d2..0d891aab 100644 --- a/hyperdbg/hprdbgctrl/hprdbgctrl.cpp +++ b/hyperdbg/hprdbgctrl/hprdbgctrl.cpp @@ -81,7 +81,7 @@ void ShowMessages(const char *Fmt, ...) { LogopenSaveToFile(TempMessage); } if (g_MessageHandler != NULL) { - + // // There is another handler // @@ -106,8 +106,10 @@ void ReadIrpBasedBuffer() { DWORD ErrorNum; HANDLE Handle; + /* ShowMessages(" =============================== Kernel-Mode Logs (Driver) " "===============================\n"); + */ RegisterEvent.hEvent = NULL; RegisterEvent.Type = IRP_BASED; @@ -183,38 +185,53 @@ void ReadIrpBasedBuffer() { continue; } + /* ShowMessages("========================= Kernel Mode (Buffer) " "=========================\n"); + */ OperationCode = 0; memcpy(&OperationCode, OutputBuffer, sizeof(UINT32)); + /* ShowMessages("Returned Length : 0x%x \n", ReturnedLength); ShowMessages("Operation Code : 0x%x \n", OperationCode); + */ switch (OperationCode) { case OPERATION_LOG_NON_IMMEDIATE_MESSAGE: + /* ShowMessages( "A buffer of messages (OPERATION_LOG_NON_IMMEDIATE_MESSAGE) :\n"); - ShowMessages("%s\n", OutputBuffer + sizeof(UINT32)); + */ + ShowMessages("%s", OutputBuffer + sizeof(UINT32)); break; case OPERATION_LOG_INFO_MESSAGE: - ShowMessages("Information log (OPERATION_LOG_INFO_MESSAGE) :\n"); - ShowMessages("%s\n", OutputBuffer + sizeof(UINT32)); + + /* + ShowMessages("Information log (OPERATION_LOG_INFO_MESSAGE) :\n"); + */ + ShowMessages("%s", OutputBuffer + sizeof(UINT32)); break; case OPERATION_LOG_ERROR_MESSAGE: - ShowMessages("Error log (OPERATION_LOG_ERROR_MESSAGE) :\n"); - ShowMessages("%s\n", OutputBuffer + sizeof(UINT32)); + /* + ShowMessages("Error log (OPERATION_LOG_ERROR_MESSAGE) :\n"); + */ + ShowMessages("%s", OutputBuffer + sizeof(UINT32)); break; case OPERATION_LOG_WARNING_MESSAGE: - ShowMessages("Warning log (OPERATION_LOG_WARNING_MESSAGE) :\n"); - ShowMessages("%s\n", OutputBuffer + sizeof(UINT32)); + /* + ShowMessages("Warning log (OPERATION_LOG_WARNING_MESSAGE) :\n"); + */ + ShowMessages("%s", OutputBuffer + sizeof(UINT32)); break; default: - ShowMessages("Message From Debugger :\n"); - ShowMessages("%s\n", OutputBuffer + sizeof(UINT32)); + /* + ShowMessages("Message From Debugger :\n"); + */ + ShowMessages("%s", OutputBuffer + sizeof(UINT32)); break; } } else { @@ -241,9 +258,9 @@ void ReadIrpBasedBuffer() { DWORD WINAPI ThreadFunc(void *data) { // - // Do stuff. This will be the first function called on the new thread. - // When this function returns, the thread goes away. See MSDN for more - // details. Test Irp Based Notifications + // Do stuff. This will be the first function called on the new + // thread. When this function returns, the thread goes away. See + // MSDN for more details. Test Irp Based Notifications // ReadIrpBasedBuffer(); @@ -254,7 +271,8 @@ DWORD WINAPI ThreadFunc(void *data) { /** * @brief Install the driver * - * @return int return zero if it was successful or non-zero if there was error + * @return int return zero if it was successful or non-zero if there + * was error */ HPRDBGCTRL_API int HyperdbgInstallVmmDriver() { @@ -285,7 +303,8 @@ HPRDBGCTRL_API int HyperdbgInstallVmmDriver() { /** * @brief Uninstall the driver * - * @return int return zero if it was successful or non-zero if there was error + * @return int return zero if it was successful or non-zero if there + * was error */ HPRDBGCTRL_API int HyperdbgUninstallDriver() { @@ -301,7 +320,8 @@ HPRDBGCTRL_API int HyperdbgUninstallDriver() { /** * @brief Load the driver * - * @return int return zero if it was successful or non-zero if there was error + * @return int return zero if it was successful or non-zero if there + * was error */ HPRDBGCTRL_API int HyperdbgLoadVmm() { @@ -323,8 +343,8 @@ HPRDBGCTRL_API int HyperdbgLoadVmm() { if (CpuID == "GenuineIntel") { ShowMessages("The Processor virtualization technology is VT-x.\n"); } else { - ShowMessages( - "This program is not designed to run in a non-VT-x environemnt !\n"); + ShowMessages("This program is not designed to run in a non-VT-x " + "environemnt !\n"); return 1; } @@ -370,8 +390,8 @@ HPRDBGCTRL_API int HyperdbgLoadVmm() { // Register the CTRL+C and CTRL+BREAK Signals handler // if (!SetConsoleCtrlHandler(BreakController, TRUE)) { - ShowMessages( - "Error in registering CTRL+C and CTRL+BREAK Signals handler\n"); + ShowMessages("Error in registering CTRL+C and CTRL+BREAK Signals " + "handler\n"); return 1; } @@ -381,13 +401,15 @@ HPRDBGCTRL_API int HyperdbgLoadVmm() { /** * @brief Unload driver * - * @return int return zero if it was successful or non-zero if there was error + * @return int return zero if it was successful or non-zero if there + * was error */ HPRDBGCTRL_API int HyperdbgUnload() { BOOL Status; if (!g_DeviceHandle) { - ShowMessages("Handle not found, probably the driver is not initialized.\n"); + ShowMessages("Handle not found, probably the driver is not " + "initialized.\n"); return 1; } @@ -419,10 +441,12 @@ HPRDBGCTRL_API int HyperdbgUnload() { // Status = DeviceIoControl( g_DeviceHandle, // Handle to device - IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL, // IO Control code + IOCTL_RETURN_IRP_PENDING_PACKETS_AND_DISALLOW_IOCTL, // IO + // Control + // code NULL, // Input Buffer to driver. - 0, // Length of input buffer in bytes. (x 2 is bcuz as the driver is x64 - // and has 64 bit values) + 0, // Length of input buffer in bytes. (x 2 is bcuz as the + // driver is x64 and has 64 bit values) NULL, // Output Buffer from driver. 0, // Length of output buffer in bytes. NULL, // Bytes placed in buffer. @@ -451,7 +475,8 @@ HPRDBGCTRL_API int HyperdbgUnload() { }; // - // Null the handle to indicate that the driver's device is not ready to use + // Null the handle to indicate that the driver's device is not ready + // to use // g_DeviceHandle = NULL; diff --git a/hyperdbg/hprdbgctrl/sewrapper.cpp b/hyperdbg/hprdbgctrl/sewrapper.cpp index 7be5950d..4e6f52b1 100644 --- a/hyperdbg/hprdbgctrl/sewrapper.cpp +++ b/hyperdbg/hprdbgctrl/sewrapper.cpp @@ -52,9 +52,8 @@ VOID ScriptEngineWrapperTestPerformAction(PGUEST_REGS_USER_MODE GuestRegs, // PSYMBOL_BUFFER CodeBuffer = ScriptEngineParse((char *)Expr.c_str()); - UINT64 g_TempList[MAX_TEMP_COUNT] = { 0 }; - UINT64 g_VariableList[MAX_VAR_COUNT] = { 0 }; - + UINT64 g_TempList[MAX_TEMP_COUNT] = {0}; + UINT64 g_VariableList[MAX_VAR_COUNT] = {0}; if (CodeBuffer->Message == NULL) { PrintSymbolBuffer(CodeBuffer); @@ -62,7 +61,8 @@ VOID ScriptEngineWrapperTestPerformAction(PGUEST_REGS_USER_MODE GuestRegs, for (int i = 0; i < CodeBuffer->Pointer;) { printf("%d\n", i); - ScriptEngineExecute(GuestRegs, (UINT64*)g_TempList, (UINT64*) g_VariableList, CodeBuffer, &i); + ScriptEngineExecute(GuestRegs, NULL, FALSE, (UINT64 *)g_TempList, + (UINT64 *)g_VariableList, CodeBuffer, &i); } RemoveSymbolBuffer(CodeBuffer); } else { diff --git a/hyperdbg/hprdbghv/Common.h b/hyperdbg/hprdbghv/Common.h index bb325bef..4564c890 100644 --- a/hyperdbg/hprdbghv/Common.h +++ b/hyperdbg/hprdbghv/Common.h @@ -533,6 +533,17 @@ typedef enum _LOG_TYPE format "\n", \ __VA_ARGS__) +/** + * @brief Log without any prefix + * + */ +# define LogSimpleWithTag(tag, isimmdte, format, ...) \ + LogSendMessageToQueue(tag, \ + isimmdte, \ + FALSE, \ + format, \ + __VA_ARGS__) + #endif // UseDbgPrintInsteadOfUsermodeMessageTracking ////////////////////////////////////////////////// diff --git a/hyperdbg/hprdbghv/Debugger.c b/hyperdbg/hprdbghv/Debugger.c index c66170c0..9ffaa642 100644 --- a/hyperdbg/hprdbghv/Debugger.c +++ b/hyperdbg/hprdbghv/Debugger.c @@ -465,6 +465,7 @@ DebuggerAddActionToEvent(PDEBUGGER_EVENT Event, DEBUGGER_EVENT_ACTION_TYPE_ENUM // Action->ImmediatelySendTheResults = SendTheResultsImmediately; Action->ActionType = ActionType; + Action->Tag = Event->Tag; // // Now we should add the action to the event's LIST_ENTRY of actions @@ -996,7 +997,7 @@ DebuggerPerformRunScript(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS for (int i = 0; i < CodeBuffer.Pointer;) { - ScriptEngineExecute(Regs, (UINT64 *)g_TempList, (UINT64 *)g_VariableList, &CodeBuffer, &i); + ScriptEngineExecute(Regs, Action->Tag, Action->ImmediatelySendTheResults, (UINT64 *)g_TempList, (UINT64 *)g_VariableList, &CodeBuffer, &i); } } diff --git a/hyperdbg/include/Configuration.h b/hyperdbg/include/Configuration.h index d3c88e94..d411f27c 100644 --- a/hyperdbg/include/Configuration.h +++ b/hyperdbg/include/Configuration.h @@ -35,8 +35,8 @@ /** * @brief Show debug messages in both usermode app and debugger, * it works only if you set UseDbgPrintInsteadOfUsermodeMessageTracking to FALSE - * @details Should be FALSE, I realized that if we enable this flag, we end up in a - * situation that DbgPrint halts the system because it is executing in + * @details Should be FALSE, I realized that if we enable this flag, we end up + * in a situation that DbgPrint halts the system because it is executing in * Dispatch-level in a DPC routine, I left it to FALSE for future attention */ #define ShowMessagesOnDebugger FALSE @@ -46,4 +46,12 @@ * recieved and do not accumulate them) it works only if you set * UseDbgPrintInsteadOfUsermodeMessageTracking to FALSE */ -#define UseImmediateMessaging FALSE +#define UseImmediateMessaging TRUE + +/** + * @brief Use immediate messaging (means that it sends each message when they + * recieved and do not accumulate them) its the default value on events, + * a user can change this behavior by selecting 'imm yes' or 'imm no' in the + * case of events + */ +#define UseImmediateMessagingByDefaultOnEvents TRUE diff --git a/hyperdbg/include/Definition.h b/hyperdbg/include/Definition.h index 8267f805..a9993121 100644 --- a/hyperdbg/include/Definition.h +++ b/hyperdbg/include/Definition.h @@ -726,6 +726,7 @@ typedef struct _DEBUGGER_EVENT_REQUEST_CUSTOM_CODE { * */ typedef struct _DEBUGGER_EVENT_ACTION { + UINT64 Tag; // Action tag is same as Event's tag UINT32 ActionOrderCode; // The code for this action (it also shows the order) LIST_ENTRY ActionsList; // Holds the link list of next actions DEBUGGER_EVENT_ACTION_TYPE_ENUM ActionType; // What action we wanna perform diff --git a/hyperdbg/include/ScriptEngineCommon.h b/hyperdbg/include/ScriptEngineCommon.h index fe1a6a69..311ba1ef 100644 --- a/hyperdbg/include/ScriptEngineCommon.h +++ b/hyperdbg/include/ScriptEngineCommon.h @@ -38,6 +38,13 @@ typedef unsigned __int64 ULONG64, *PULONG64; typedef unsigned __int64 DWORD64, *PDWORD64; #define VOID void +typedef unsigned char UCHAR; +typedef unsigned short USHORT; +typedef unsigned long ULONG; + +typedef UCHAR BOOLEAN; // winnt +typedef BOOLEAN *PBOOLEAN; // winnt + typedef signed char INT8, *PINT8; typedef signed short INT16, *PINT16; typedef signed int INT32, *PINT32; @@ -304,7 +311,8 @@ QWORD ScriptEngineKeywordDq(PUINT64 Address) { // // Functions // -VOID ScriptEngineFunctionPrint(UINT64 Value) { +VOID ScriptEngineFunctionPrint(UINT64 Tag, BOOLEAN ImmediateMessagePassing, + UINT64 Value) { #ifdef SCRIPT_ENGINE_USER_MODE printf("Result is: %llx\n", Value); @@ -312,7 +320,7 @@ VOID ScriptEngineFunctionPrint(UINT64 Value) { #endif // SCRIPT_ENGINE_USER_MODE #ifdef SCRIPT_ENGINE_KERNEL_MODE - LogInfo("Result is : %llx\n", Value); + LogSimpleWithTag(Tag, ImmediateMessagePassing, "Result is : %llx\n", Value); #endif // SCRIPT_ENGINE_KERNEL_MODE } @@ -402,7 +410,8 @@ VOID SetValue(PGUEST_REGS_USER_MODE GuestRegs, UINT64 *g_TempList, } // -VOID ScriptEngineExecute(PGUEST_REGS_USER_MODE GuestRegs, UINT64 *g_TempList, +VOID ScriptEngineExecute(PGUEST_REGS_USER_MODE GuestRegs, UINT64 Tag, + BOOLEAN ImmediateMessagePassing, UINT64 *g_TempList, UINT64 *g_VariableList, PSYMBOL_BUFFER CodeBuffer, int *Indx) { @@ -787,10 +796,10 @@ VOID ScriptEngineExecute(PGUEST_REGS_USER_MODE GuestRegs, UINT64 *g_TempList, case FUNC_PRINT: - // - // Call the target function - // - ScriptEngineFunctionPrint(SrcVal0); + // + // Call the target function + // + ScriptEngineFunctionPrint(Tag, ImmediateMessagePassing, SrcVal0); return; } }