vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: correct HyperEvade hide guard

Browse source
This commit is contained in:
jtaw5649 2026-06-01 11:46:43 +01:00
parent e0af5afd4f
commit 83b507e672
6 changed files with 15 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hyperdbg/hyperevade/code/SyscallFootprints.c
View file

@ -11,6 +11,8 @@
*/
#include "pch.h"
#if ActivateHyperEvadeProject != TRUE
/**
* @brief Handle The triggered hook on KiSystemCall64 system call handler
* when the Transparency mode is disabled
@ -50,7 +52,7 @@ TransparentCallbackHandleAfterSyscall(GUEST_REGS * Regs,
UNREFERENCED_PARAMETER(Params);
}
#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
#else // ActivateHyperEvadeProject != TRUE
/**
* @brief Handle The triggered hook on KiSystemCall64 system call handler
@ -1968,4 +1970,4 @@ TransparentCallbackHandleAfterSyscall(GUEST_REGS * Regs,
Params->OptionalParam4);
}
}
#endif
#endif // ActivateHyperEvadeProject != TRUE

2
hyperdbg/hyperevade/code/Transparency.c
View file

@ -54,7 +54,7 @@ TransparentHideDebugger(HYPEREVADE_CALLBACKS * Hyperevade
RtlCopyBytes(&g_SystemCallNumbersInformation,
&TransparentModeRequest->SystemCallNumbersInformation,
sizeof(SYSTEM_CALL_NUMBERS_INFORMATION));
#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
#if ActivateHyperEvadeProject == TRUE
//
// Choose a random genuine vendor string to replace hypervisor vendor data
//

2
hyperdbg/hyperevade/header/SyscallFootprints.h
View file

@ -161,7 +161,7 @@ SYSTEM_CALL_NUMBERS_INFORMATION g_SystemCallNumbersInformation;
// Constants //
//////////////////////////////////////////////////
#if DISABLE_HYPERDBG_HYPEREVADE == FALSE
#if ActivateHyperEvadeProject == TRUE
/**
* @brief A list of windows processes, for which to ignore systemcall requests

7
hyperdbg/hyperevade/header/pch.h
View file

@ -23,13 +23,6 @@
#ifdef HYPERDBG_ENV_WINDOWS
//
// The DLL is flagged by antivirus software, since it contains anti-debugging and anti-hypervisor methods
// as well as different anti-debugging strings
// For now, we disable the HyperDbg Hyperevade module
//
# define DISABLE_HYPERDBG_HYPEREVADE TRUE
//
// Windows defined functions
//

2
hyperdbg/include/config/Configuration.h
View file

@ -77,4 +77,4 @@
/**
* @brief Activates the hyperevade project
*/
#define ActivateHyperEvadeProject TRUE
#define ActivateHyperEvadeProject FALSE

10
hyperdbg/libhyperdbg/code/debugger/commands/extension-commands/hide.cpp
View file

@ -217,7 +217,7 @@ CommandHideFillSystemCalls(SYSTEM_CALL_NUMBERS_INFORMATION * SyscallNumberDetail
Result = FALSE;
}
return TRUE;
return Result;
}
/**
@ -267,6 +267,12 @@ HyperDbgEnableTransparentMode(UINT32 ProcessId, CHAR * ProcessName, BOOLEAN IsPr
RequestBufferSize = sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE) + HideRequest.LengthOfProcessName;
}
if (!CommandHideFillSystemCalls(&HideRequest.SystemCallNumbersInformation))
{
ShowMessages("warning, failed to resolve one or more syscall numbers for transparent-mode\n");
return FALSE;
}
//
// Allocate the requested buffer
//
@ -365,7 +371,7 @@ CommandHide(vector<CommandToken> CommandTokens, string Command)
UINT32 TargetPid;
BOOLEAN TrueIfProcessIdAndFalseIfProcessName;
#if ActivateHyperEvadeProject == TRUE
#if ActivateHyperEvadeProject != TRUE
ShowMessages("warning, the !hide command (hyperevade project) is in the Beta phase and is not yet well-tested, "
"so it is disabled in this version. If you want to test, you can enable it "