vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-10 01:29:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

show bytes of opcodes in disassembly

Browse source
This commit is contained in:
SinaKarvandi 2020-04-28 02:08:23 -07:00
parent adc30fd3f3
commit 8fa7645f89
5 changed files with 74 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

10
hyperdbg/hprdbgctrl/Commands.h
View file

@ -1,5 +1,5 @@
/**
* @file interpreter.cpp
* @file commands.h
* @author Sina Karvandi (sina@rayanfam.com)
* @brief The hyperdbg command interpreter and driver connector
* @details
@ -10,6 +10,7 @@
*
*/
#pragma once
#include "pch.h"
using namespace std;
@ -20,7 +21,12 @@ std::string ReadVendorString();
void ShowMessages(const char* Fmt, ...);
int CommandLm(vector<string> SplittedCommand);
void HyperDbgReadMemory(DEBUGGER_SHOW_MEMORY_STYLE Style, UINT64 Address, DEBUGGER_READ_MEMORY_TYPE MemoryType, DEBUGGER_READ_READING_TYPE ReadingType, UINT32 Pid, UINT Size);
void HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_MEMORY_STYLE Style, UINT64 Address,
DEBUGGER_READ_MEMORY_TYPE MemoryType,
DEBUGGER_READ_READING_TYPE ReadingType, UINT32 Pid,
UINT Size);
string SeparateTo64BitValue(UINT64 Value);
int HyperDbgDisassembler(unsigned char* BufferToDisassemble, UINT64 BaseAddress, UINT64 Size);
// Exports

24
hyperdbg/hprdbgctrl/disassembler.cpp
View file

@ -128,12 +128,32 @@ void DisassembleBuffer(ZydisDecoder *decoder, ZyanU64 runtime_address,
char buffer[256];
while (ZYAN_SUCCESS(
ZydisDecoderDecodeBuffer(decoder, data, length, &instruction))) {
ZYAN_PRINTF("%016" PRIX64 " ", runtime_address);
// ZYAN_PRINTF("%016" PRIX64 " ", runtime_address);
ShowMessages("%s", SeparateTo64BitValue(runtime_address).c_str());
// We have to pass a `runtime_address` different to
// `ZYDIS_RUNTIME_ADDRESS_NONE` to enable printing of absolute addresses
ZydisFormatterFormatInstruction(&formatter, &instruction, &buffer[0],
sizeof(buffer), runtime_address);
ZYAN_PRINTF(" %s\n", &buffer[0]);
//
// Show the memory for this instruction
//
for (size_t i = 0; i < instruction.length; i++) {
ZyanU8 MemoryContent = data[i];
ShowMessages(" %02X", MemoryContent);
}
//
// Add padding (we assume that each instruction should be at least 10 bytes)
//
#define PaddingLength 12
if (instruction.length < PaddingLength) {
for (size_t i = 0; i < PaddingLength - instruction.length; i++) {
ShowMessages(" ");
}
}
ShowMessages(" %s\n", &buffer[0]);
data += instruction.length;
length -= instruction.length;
runtime_address += instruction.length;

2
hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj
View file

@ -103,7 +103,7 @@
<None Include="cpp.hint" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="Commands.h" />
<ClInclude Include="commands.h" />
<ClInclude Include="framework.h" />
<ClInclude Include="hprdbgctrl.h" />
<ClInclude Include="pch.h" />

2
hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters
View file

@ -33,7 +33,7 @@
<ClInclude Include="pch.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="Commands.h">
<ClInclude Include="commands.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>

78
hyperdbg/hprdbgctrl/interpreter.cpp
View file

@ -39,13 +39,14 @@ string SeparateTo64BitValue(UINT64 Value) {
}
/**
* @brief Read memory
* @brief Read memory and disassembler
*
*/
void HyperDbgReadMemory(DEBUGGER_SHOW_MEMORY_STYLE Style, UINT64 Address,
DEBUGGER_READ_MEMORY_TYPE MemoryType,
DEBUGGER_READ_READING_TYPE ReadingType, UINT32 Pid,
UINT Size) {
void HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_MEMORY_STYLE Style,
UINT64 Address,
DEBUGGER_READ_MEMORY_TYPE MemoryType,
DEBUGGER_READ_READING_TYPE ReadingType,
UINT32 Pid, UINT Size) {
BOOL Status;
ULONG ReturnedLength;
@ -351,6 +352,7 @@ void CommandReadMemoryHelp() {
ShowMessages("You can also disassemble physical memory using '!u'\n");
ShowMessages("syntax : \t[!]d[b|c|d|q] [address] l [length (hex)] pid "
"[process id (hex)]"
"[process id (hex)]\n");
ShowMessages("\t\te.g : db fffff8077356f010 \n");
ShowMessages("\t\te.g : !dq 100000\n");
@ -450,7 +452,11 @@ void CommandReadMemoryAndDisassembler(vector<string> SplittedCommand) {
//
// Default length (user doesn't specified)
//
Length = 0x80;
if (!FirstCommand.compare("u") || !FirstCommand.compare("!u")) {
Length = 0x40;
} else {
Length = 0x80;
}
}
if (Pid == 0) {
@ -461,50 +467,50 @@ void CommandReadMemoryAndDisassembler(vector<string> SplittedCommand) {
}
if (!FirstCommand.compare("db")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DB, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_COMMAND_DB, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS,
READ_FROM_KERNEL, Pid, Length);
} else if (!FirstCommand.compare("dc")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DC, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_COMMAND_DC, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS,
READ_FROM_KERNEL, Pid, Length);
} else if (!FirstCommand.compare("dd")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DD, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_COMMAND_DD, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS,
READ_FROM_KERNEL, Pid, Length);
} else if (!FirstCommand.compare("dq")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DQ, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_COMMAND_DQ, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS,
READ_FROM_KERNEL, Pid, Length);
} else if (!FirstCommand.compare("!db")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DB, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_COMMAND_DB, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS,
READ_FROM_KERNEL, Pid, Length);
} else if (!FirstCommand.compare("!dc")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DC, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_COMMAND_DC, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS,
READ_FROM_KERNEL, Pid, Length);
} else if (!FirstCommand.compare("!dd")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DD, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_COMMAND_DD, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS,
READ_FROM_KERNEL, Pid, Length);
} else if (!FirstCommand.compare("!dq")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DQ, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(DEBUGGER_SHOW_COMMAND_DQ, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS,
READ_FROM_KERNEL, Pid, Length);
}
//
// Disassembler (!u or u)
//
else if (!FirstCommand.compare("u")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DISASSEMBLE, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(
DEBUGGER_SHOW_COMMAND_DISASSEMBLE, TargetAddress,
DEBUGGER_READ_VIRTUAL_ADDRESS, READ_FROM_KERNEL, Pid, Length);
} else if (!FirstCommand.compare("!u")) {
HyperDbgReadMemory(DEBUGGER_SHOW_COMMAND_DISASSEMBLE, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS, READ_FROM_KERNEL, Pid,
Length);
HyperDbgReadMemoryAndDisassemble(
DEBUGGER_SHOW_COMMAND_DISASSEMBLE, TargetAddress,
DEBUGGER_READ_PHYSICAL_ADDRESS, READ_FROM_KERNEL, Pid, Length);
}
}