vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

refactoring codes for platform independence of hyperlog and hypertrace and script-eval

Browse source
This commit is contained in:
sina 2026-05-10 00:58:47 +02:00
parent af3b3e2f71
commit 90337d37f7
35 changed files with 1238 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

7
.github/git/git-help.md vendored
View file

@ -44,6 +44,13 @@ To remove the effects of `git add .` and `git commit -m "test"` or just `git add
git reset --soft HEAD~1
```
To remove **all uncommitted and untracked changes** in Git and reset your working tree to the last commit:
```bash
git reset --hard
git clean -fd
```
---------------
## Releasing instructions

18
hyperdbg/hyperdbg.sln
View file

@ -149,19 +149,37 @@ EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{6498728B-D9B0-4CAB-A9E3-ACE5BC371010}"
ProjectSection(SolutionItems) = preProject
include\platform\kernel\code\PlatformBroadcast.c = include\platform\kernel\code\PlatformBroadcast.c
include\platform\kernel\code\PlatformCpu.c = include\platform\kernel\code\PlatformCpu.c
include\platform\kernel\code\PlatformDbg.c = include\platform\kernel\code\PlatformDbg.c
include\platform\kernel\code\PlatformDpc.c = include\platform\kernel\code\PlatformDpc.c
include\platform\kernel\code\PlatformEvent.c = include\platform\kernel\code\PlatformEvent.c
include\platform\kernel\code\PlatformIntrinsics.c = include\platform\kernel\code\PlatformIntrinsics.c
include\platform\kernel\code\PlatformIntrinsicsVmx.c = include\platform\kernel\code\PlatformIntrinsicsVmx.c
include\platform\kernel\code\PlatformIo.c = include\platform\kernel\code\PlatformIo.c
include\platform\kernel\code\PlatformIrql.c = include\platform\kernel\code\PlatformIrql.c
include\platform\kernel\code\PlatformMem.c = include\platform\kernel\code\PlatformMem.c
include\platform\kernel\code\PlatformProcess.c = include\platform\kernel\code\PlatformProcess.c
include\platform\kernel\code\PlatformSpinlock.c = include\platform\kernel\code\PlatformSpinlock.c
include\platform\kernel\code\PlatformTime.c = include\platform\kernel\code\PlatformTime.c
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{AA41FFF1-A730-433E-8D26-13DA5B653825}"
ProjectSection(SolutionItems) = preProject
include\platform\kernel\header\pch.h = include\platform\kernel\header\pch.h
include\platform\kernel\header\PlatformBroadcast.h = include\platform\kernel\header\PlatformBroadcast.h
include\platform\kernel\header\PlatformCpu.h = include\platform\kernel\header\PlatformCpu.h
include\platform\kernel\header\PlatformDbg.h = include\platform\kernel\header\PlatformDbg.h
include\platform\kernel\header\PlatformDpc.h = include\platform\kernel\header\PlatformDpc.h
include\platform\kernel\header\PlatformEvent.h = include\platform\kernel\header\PlatformEvent.h
include\platform\kernel\header\PlatformIntrinsics.h = include\platform\kernel\header\PlatformIntrinsics.h
include\platform\kernel\header\PlatformIntrinsicsVmx.h = include\platform\kernel\header\PlatformIntrinsicsVmx.h
include\platform\kernel\header\PlatformIo.h = include\platform\kernel\header\PlatformIo.h
include\platform\kernel\header\PlatformIrql.h = include\platform\kernel\header\PlatformIrql.h
include\platform\kernel\header\PlatformMem.h = include\platform\kernel\header\PlatformMem.h
include\platform\kernel\header\PlatformModuleInfo.h = include\platform\kernel\header\PlatformModuleInfo.h
include\platform\kernel\header\PlatformProcess.h = include\platform\kernel\header\PlatformProcess.h
include\platform\kernel\header\PlatformSpinlock.h = include\platform\kernel\header\PlatformSpinlock.h
include\platform\kernel\header\PlatformTime.h = include\platform\kernel\header\PlatformTime.h
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{4BF590C3-1032-4DD2-BF87-BB9E5781977C}"

4
hyperdbg/hyperhv/pch.h
View file

@ -63,10 +63,6 @@
#include "platform/kernel/header/PlatformMem.h"
#include "platform/kernel/header/PlatformIntrinsics.h"
#include "platform/kernel/header/PlatformBroadcast.h"
//
// Platform intrinsics headers
//
#include "platform/kernel/header/PlatformIntrinsicsVmx.h"
//

2
hyperdbg/hyperkd/header/pch.h
View file

@ -87,6 +87,8 @@
#include "platform/kernel/header/PlatformMem.h"
#include "platform/kernel/header/PlatformIntrinsics.h"
#include "platform/kernel/header/PlatformBroadcast.h"
#include "platform/kernel/header/PlatformProcess.h"
#include "platform/kernel/header/PlatformCpu.h"
//
// Optimization algorithms

4
hyperdbg/hyperkd/hyperkd.vcxproj
View file

@ -109,8 +109,10 @@
<ClCompile Include="..\include\components\optimizations\code\OptimizationsExamples.c" />
<ClCompile Include="..\include\components\spinlock\code\Spinlock.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsics.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformProcess.c" />
<ClCompile Include="..\script-eval\code\Functions.c" />
<ClCompile Include="..\script-eval\code\Keywords.c" />
<ClCompile Include="..\script-eval\code\PseudoRegisters.c" />
@ -157,8 +159,10 @@
<ClInclude Include="..\include\components\spinlock\header\Spinlock.h" />
<ClInclude Include="..\include\macros\MetaMacros.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsics.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformProcess.h" />
<ClInclude Include="header\assembly\Assembly.h" />
<ClInclude Include="header\common\Common.h" />
<ClInclude Include="header\common\Synchronization.h" />

12
hyperdbg/hyperkd/hyperkd.vcxproj.filters
View file

@ -273,6 +273,12 @@
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformProcess.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c">
<Filter>code\platform</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="header\pch.h">
@ -410,6 +416,12 @@
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformProcess.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h">
<Filter>header\platform</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<MASM Include="code\assembly\AsmDebugger.asm">

108
hyperdbg/hyperlog/code/Logging.c
View file

@ -99,7 +99,7 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks)
{
ULONG ProcessorsCount;
ProcessorsCount = KeQueryActiveProcessorCount(0);
ProcessorsCount = PlatformCpuGetActiveProcessorCount();
//
// Initialize buffers for trace message and data messages
@ -155,8 +155,8 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks)
// for both but the second buffer spinlock is useless
// as we use our custom spinlock
//
KeInitializeSpinLock(&MessageBufferInformation[i].BufferLock);
KeInitializeSpinLock(&MessageBufferInformation[i].BufferLockForNonImmMessage);
PlatformSpinlockInitialize(&MessageBufferInformation[i].BufferLock);
PlatformSpinlockInitialize(&MessageBufferInformation[i].BufferLockForNonImmMessage);
//
// allocate the buffer for regular buffers
@ -183,9 +183,9 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks)
//
// Zeroing the buffer
//
RtlZeroMemory((void *)MessageBufferInformation[i].BufferStartAddress, LogBufferSize);
RtlZeroMemory((void *)MessageBufferInformation[i].BufferForMultipleNonImmediateMessage, PacketChunkSize);
RtlZeroMemory((void *)MessageBufferInformation[i].BufferStartAddressPriority, LogBufferSizePriority);
PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferStartAddress, LogBufferSize);
PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferForMultipleNonImmediateMessage, PacketChunkSize);
PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferStartAddressPriority, LogBufferSizePriority);
//
// Set the end address
@ -197,7 +197,7 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks)
//
// Copy the callbacks into the global callback holder
//
RtlCopyBytes(&g_MsgTracingCallbacks, MsgTracingCallbacks, sizeof(MESSAGE_TRACING_CALLBACKS));
PlatformWriteMemory(&g_MsgTracingCallbacks, MsgTracingCallbacks, sizeof(MESSAGE_TRACING_CALLBACKS));
return TRUE;
}
@ -384,7 +384,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// vmx non-root
//
OldIRQL = KeRaiseIrqlToDpcLevel();
OldIRQL = PlatformIrqlRaiseToDpcLevel();
}
//
@ -403,7 +403,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// vmx non-root
//
KeLowerIrql(OldIRQL);
PlatformIrqlLower(OldIRQL);
}
return TRUE;
@ -431,7 +431,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// Acquire the lock
//
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
}
//
@ -500,7 +500,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// Copy the buffer
//
RtlCopyBytes(SavingBuffer, Buffer, BufferLength);
PlatformWriteMemory(SavingBuffer, Buffer, BufferLength);
//
// Increment the next index to write
@ -531,7 +531,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// Insert dpc to queue
//
KeInsertQueueDpc(&g_GlobalNotifyRecord->Dpc, g_GlobalNotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&g_GlobalNotifyRecord->Dpc, g_GlobalNotifyRecord, NULL);
//
// set notify routine to null
@ -552,7 +552,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return TRUE;
@ -598,7 +598,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
//
// Acquire the lock
//
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
}
//
@ -632,7 +632,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return ResultsOfBuffersSetToRead;
@ -658,7 +658,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
// there might be multiple messages on the start of the queue that didn't read yet)
// we don't free the header
//
RtlZeroMemory(SendingBuffer, Header->BufferLength);
PlatformZeroMemory(SendingBuffer, Header->BufferLength);
//
// Check to see whether we passed the index or not
@ -689,7 +689,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return ResultsOfBuffersSetToRead;
@ -737,7 +737,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
// Acquire the lock
//
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
}
//
@ -776,7 +776,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return FALSE;
@ -794,7 +794,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
// First copy the header
//
RtlCopyBytes(BufferToSaveMessage, &Header->OperationNumber, sizeof(UINT32));
PlatformWriteMemory(BufferToSaveMessage, &Header->OperationNumber, sizeof(UINT32));
//
// Second, save the buffer contents
@ -815,7 +815,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
PVOID SavingAddress = (PVOID)((UINT64)BufferToSaveMessage + sizeof(UINT32));
RtlCopyBytes(SavingAddress, SendingBuffer, Header->BufferLength);
PlatformWriteMemory(SavingAddress, SendingBuffer, Header->BufferLength);
#if ShowMessagesOnDebugger
@ -834,17 +834,17 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
{
if (i != 0)
{
DbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i) - 2));
PlatformDbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i) - 2));
}
else
{
DbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i)));
PlatformDbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i)));
}
}
}
else
{
DbgPrint("%s", (char *)SendingBuffer);
PlatformDbgPrint("%s", (char *)SendingBuffer);
}
}
#endif
@ -864,7 +864,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
// there might be multiple messages on the start of the queue that didn't read yet)
// we don't free the header
//
RtlZeroMemory(SendingBuffer, Header->BufferLength);
PlatformZeroMemory(SendingBuffer, Header->BufferLength);
if (PriorityMessageIsAvailable)
{
@ -914,7 +914,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return TRUE;
@ -998,7 +998,7 @@ LogCallbackPrepareAndSendMessageToQueueWrapper(UINT32 OperationCode,
char * LogMessage = NULL;
char * TempMessage = NULL;
char TimeBuffer[20] = {0};
ULONG CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
ULONG CurrentCore = PlatformCpuGetCurrentProcessorNumber();
//
// Set Vmx State
@ -1069,9 +1069,9 @@ LogCallbackPrepareAndSendMessageToQueueWrapper(UINT32 OperationCode,
//
TIME_FIELDS TimeFields;
LARGE_INTEGER SystemTime, LocalTime;
KeQuerySystemTime(&SystemTime);
ExSystemTimeToLocalTime(&SystemTime, &LocalTime);
RtlTimeToTimeFields(&LocalTime, &TimeFields);
PlatformTimeQuerySystemTime(&SystemTime);
PlatformTimeConvertToLocalTime(&SystemTime, &LocalTime);
PlatformTimeConvertToTimeFields(&LocalTime, &TimeFields);
//
// We won't use this because we can't use in any IRQL
@ -1287,7 +1287,7 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage,
//
// Acquire the lock
//
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, &OldIRQL);
PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLockForNonImmMessage, &OldIRQL);
}
//
// Set the result to True
@ -1312,13 +1312,13 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage,
// Free the immediate buffer
//
MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer = 0;
RtlZeroMemory((void *)MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage, PacketChunkSize);
PlatformZeroMemory((PVOID)MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage, PacketChunkSize);
}
//
// We have to save the message
//
RtlCopyBytes((void *)(MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage +
PlatformWriteMemory((PVOID)(MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage +
MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer),
LogMessage,
BufferLen);
@ -1340,7 +1340,7 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage,
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLockForNonImmMessage, OldIRQL);
}
return Result;
@ -1390,18 +1390,18 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument
//
if (!(Irp->CurrentLocation <= Irp->StackCount + 1))
{
DbgPrint("Err, probably two or more functions called DPC for an object");
PlatformDbgPrint("Err, probably two or more functions called DPC for an object");
return;
}
IrpSp = IoGetCurrentIrpStackLocation(Irp);
IrpSp = PlatformIoGetCurrentIrpStackLocation(Irp);
InBuffLength = IrpSp->Parameters.DeviceIoControl.InputBufferLength;
OutBuffLength = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;
if (!InBuffLength || !OutBuffLength)
{
Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT);
break;
}
@ -1428,14 +1428,14 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument
// we have to return here as there is nothing to send here
//
Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT);
break;
}
Irp->IoStatus.Information = Length;
Irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT);
}
break;
@ -1443,12 +1443,12 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument
//
// Signal the Event created in user-mode.
//
KeSetEvent(NotifyRecord->Message.Event, 0, FALSE);
PlatformEventSet(NotifyRecord->Message.Event, 0, FALSE);
//
// Dereference the object as we are done with it.
//
ObDereferenceObject(NotifyRecord->Message.Event);
PlatformObjectDereference(NotifyRecord->Message.Event);
break;
@ -1488,7 +1488,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
if (g_GlobalNotifyRecord == NULL)
{
IrpStack = IoGetCurrentIrpStackLocation(Irp);
IrpStack = PlatformIoGetCurrentIrpStackLocation(Irp);
RegisterEvent = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
//
@ -1505,12 +1505,12 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
NotifyRecord->Type = IRP_BASED;
NotifyRecord->Message.PendingIrp = Irp;
KeInitializeDpc(&NotifyRecord->Dpc, // Dpc
PlatformDpcInitialize(&NotifyRecord->Dpc, // Dpc
LogNotifyUsermodeCallback, // DeferredRoutine
NotifyRecord // DeferredContext
);
IoMarkIrpPending(Irp);
PlatformIoMarkIrpPending(Irp);
//
// check for new message (for both Vmx-root mode or Vmx non root-mode)
@ -1527,7 +1527,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
//
// Insert dpc to queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
}
else if (LogCheckForNewMessage(TRUE, TRUE))
{
@ -1538,7 +1538,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
//
// Insert dpc to queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
}
else if (LogCheckForNewMessage(FALSE, FALSE))
{
@ -1550,7 +1550,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
//
// Insert dpc to queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
}
else if (LogCheckForNewMessage(TRUE, FALSE))
{
@ -1561,7 +1561,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
//
// Insert dpc to queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
}
else
{
@ -1599,7 +1599,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
PREGISTER_NOTIFY_BUFFER RegisterEvent;
PIRP Irp = (PIRP)TargetIrp;
IrpStack = IoGetCurrentIrpStackLocation(Irp);
IrpStack = PlatformIoGetCurrentIrpStackLocation(Irp);
RegisterEvent = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
//
@ -1609,13 +1609,13 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
if (NULL == NotifyRecord)
{
DbgPrint("Err, unable to allocate memory for notify record\n");
PlatformDbgPrint("Err, unable to allocate memory for notify record\n");
return FALSE;
}
NotifyRecord->Type = EVENT_BASED;
KeInitializeDpc(&NotifyRecord->Dpc, // Dpc
PlatformDpcInitialize(&NotifyRecord->Dpc, // Dpc
LogNotifyUsermodeCallback, // DeferredRoutine
NotifyRecord // DeferredContext
);
@ -1624,7 +1624,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
// Get the object pointer from the handle
// Note we must be in the context of the process that created the handle
//
Status = ObReferenceObjectByHandle(RegisterEvent->hEvent,
Status = PlatformObjectReferenceByHandle(RegisterEvent->hEvent,
SYNCHRONIZE | EVENT_MODIFY_STATE,
*ExEventObjectType,
Irp->RequestorMode,
@ -1633,7 +1633,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
if (!NT_SUCCESS(Status))
{
DbgPrint("Err, unable to reference user mode event object, status = 0x%x\n", Status);
PlatformDbgPrint("Err, unable to reference user mode event object, status = 0x%x\n", Status);
PlatformMemFreePool(NotifyRecord);
return FALSE;
}
@ -1641,7 +1641,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
//
// Insert dpc to the queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
return TRUE;
}

9
hyperdbg/hyperlog/header/pch.h
View file

@ -48,5 +48,12 @@
//
// Platform independent headers
//
#include "platform/kernel/header/PlatformCpu.h"
#include "platform/kernel/header/PlatformDbg.h"
#include "platform/kernel/header/PlatformDpc.h"
#include "platform/kernel/header/PlatformEvent.h"
#include "platform/kernel/header/PlatformIo.h"
#include "platform/kernel/header/PlatformIrql.h"
#include "platform/kernel/header/PlatformMem.h"
#include "platform/kernel/header/PlatformIntrinsics.h"
#include "platform/kernel/header/PlatformSpinlock.h"
#include "platform/kernel/header/PlatformTime.h"

15
hyperdbg/hyperlog/hyperlog.vcxproj
View file

@ -104,13 +104,28 @@
</ItemGroup>
<ItemGroup>
<ClCompile Include="..\include\components\spinlock\code\Spinlock.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformDbg.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformDpc.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformEvent.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIo.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIrql.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformSpinlock.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformTime.c" />
<ClCompile Include="code\Logging.c" />
<ClCompile Include="code\UnloadDll.c" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\include\components\spinlock\header\Spinlock.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformDpc.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformEvent.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIo.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIrql.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformSpinlock.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformTime.h" />
<ClInclude Include="header\Logging.h" />
<ClInclude Include="header\pch.h" />
<ClInclude Include="header\UnloadDll.h" />

45
hyperdbg/hyperlog/hyperlog.vcxproj.filters
View file

@ -38,6 +38,30 @@
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformDbg.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformIrql.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformEvent.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformIo.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformSpinlock.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformTime.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformDpc.c">
<Filter>code\platform</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="header\Logging.h">
@ -55,5 +79,26 @@
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformDpc.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformIrql.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformEvent.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformIo.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformSpinlock.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformTime.h">
<Filter>header\platform</Filter>
</ClInclude>
</ItemGroup>
</Project>

4
hyperdbg/hypertrace/code/api/TraceApi.c
View file

@ -43,12 +43,12 @@ HyperTraceInitCallback(HYPERTRACE_CALLBACKS * HypertraceCallbacks,
//
// Save the callbacks
//
RtlCopyMemory(&g_Callbacks, HypertraceCallbacks, sizeof(HYPERTRACE_CALLBACKS));
PlatformWriteMemory(&g_Callbacks, HypertraceCallbacks, sizeof(HYPERTRACE_CALLBACKS));
//
// Query the number of processors in the system to initialize the global LBR state list accordingly
//
ProcessorsCount = KeQueryActiveProcessorCount(0);
ProcessorsCount = PlatformCpuGetActiveProcessorCount();
//
// Initialize the global LBR state list to hold LBR states for each core

8
hyperdbg/hypertrace/header/pch.h
View file

@ -58,6 +58,14 @@
#include "platform/kernel/header/PlatformMem.h"
#include "platform/kernel/header/PlatformIntrinsics.h"
#include "platform/kernel/header/PlatformBroadcast.h"
#include "platform/kernel/header/PlatformCpu.h"
#include "platform/kernel/header/PlatformSpinlock.h"
#include "platform/kernel/header/PlatformIrql.h"
#include "platform/kernel/header/PlatformDpc.h"
#include "platform/kernel/header/PlatformTime.h"
#include "platform/kernel/header/PlatformDbg.h"
#include "platform/kernel/header/PlatformIo.h"
#include "platform/kernel/header/PlatformEvent.h"
//
// DPC and broadcasting function headers

2
hyperdbg/hypertrace/hypertrace.vcxproj
View file

@ -102,6 +102,7 @@
<ItemGroup>
<ClCompile Include="..\include\components\interface\HyperLogCallback.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsics.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c" />
<ClCompile Include="code\api\LbrApi.c" />
@ -116,6 +117,7 @@
<ItemGroup>
<ClInclude Include="..\include\components\interface\HyperLogCallback.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsics.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h" />
<ClInclude Include="header\api\LbrApi.h" />

6
hyperdbg/hypertrace/hypertrace.vcxproj.filters
View file

@ -92,6 +92,9 @@
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c">
<Filter>code\broadcast</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c">
<Filter>code\platform</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="header\pch.h">
@ -136,5 +139,8 @@
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h">
<Filter>header\platform</Filter>
</ClInclude>
</ItemGroup>
</Project>

62
hyperdbg/include/platform/kernel/code/PlatformCpu.c Normal file
View file

@ -0,0 +1,62 @@
/**
* @file PlatformCpu.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for CPU and processor queries
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformCpu.h"
#endif // defined(__linux__)
/**
* @brief Get the count of active logical processors
*
* @return ULONG
*/
ULONG
PlatformCpuGetActiveProcessorCount(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return KeQueryActiveProcessorCount(0);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the current logical processor number
*
* @return ULONG
*/
ULONG
PlatformCpuGetCurrentProcessorNumber(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return KeGetCurrentProcessorNumberEx(NULL);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

44
hyperdbg/include/platform/kernel/code/PlatformDbg.c Normal file
View file

@ -0,0 +1,44 @@
/**
* @file PlatformDbg.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for kernel debug output
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformDbg.h"
#endif // defined(__linux__)
/**
* @brief Print a debug message to the kernel debugger
*
* @param Format printf-style format string
* @param ... Variable arguments
* @return VOID
*/
VOID
PlatformDbgPrint(const CHAR * Format, ...)
{
#if defined(_WIN32) || defined(_WIN64)
va_list ArgList;
va_start(ArgList, Format);
vDbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Format, ArgList);
va_end(ArgList);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

68
hyperdbg/include/platform/kernel/code/PlatformDpc.c Normal file
View file

@ -0,0 +1,68 @@
/**
* @file PlatformDpc.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for Deferred Procedure Call (DPC) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformDpc.h"
#endif // defined(__linux__)
/**
* @brief Initialize a DPC object
*
* @param Dpc Pointer to the KDPC structure to initialize
* @param DeferredRoutine The deferred procedure to be called
* @param DeferredContext Optional context passed to the deferred routine
* @return VOID
*/
VOID
PlatformDpcInitialize(PRKDPC Dpc, PKDEFERRED_ROUTINE DeferredRoutine, PVOID DeferredContext)
{
#if defined(_WIN32) || defined(_WIN64)
KeInitializeDpc(Dpc, DeferredRoutine, DeferredContext);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Insert a DPC into the system DPC queue for execution
*
* @param Dpc Pointer to the initialized KDPC structure
* @param SystemArgument1 First system-defined argument passed to the deferred routine
* @param SystemArgument2 Second system-defined argument passed to the deferred routine
* @return BOOLEAN TRUE if the DPC was successfully queued, FALSE if it was already in the queue
*/
BOOLEAN
PlatformDpcInsertQueueDpc(PRKDPC Dpc, PVOID SystemArgument1, PVOID SystemArgument2)
{
#if defined(_WIN32) || defined(_WIN64)
return KeInsertQueueDpc(Dpc, SystemArgument1, SystemArgument2);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

105
hyperdbg/include/platform/kernel/code/PlatformEvent.c Normal file
View file

@ -0,0 +1,105 @@
/**
* @file PlatformEvent.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for kernel event and object management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformEvent.h"
#endif // defined(__linux__)
/**
* @brief Dereference a kernel object, decrementing its reference count
*
* @param Object Pointer to the kernel object to dereference
* @return VOID
*/
VOID
PlatformObjectDereference(PVOID Object)
{
#if defined(_WIN32) || defined(_WIN64)
ObDereferenceObject(Object);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Signal (set) a kernel event object
*
* @param Event Pointer to the KEVENT to signal
* @param Increment Priority increment for any waiting threads to be awakened
* @param Wait If TRUE, the caller intends to immediately call a wait routine after this call
* @return LONG The previous signal state of the event
*/
LONG
PlatformEventSet(PKEVENT Event, KPRIORITY Increment, BOOLEAN Wait)
{
#if defined(_WIN32) || defined(_WIN64)
return KeSetEvent(Event, Increment, Wait);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Obtain a pointer to a kernel object by its user-mode handle and increment its reference count
*
* @param Handle User-mode handle referencing the kernel object
* @param DesiredAccess Access mask for the requested access rights
* @param ObjectType Pointer to the object type object (e.g., *ExEventObjectType); NULL to skip type check
* @param AccessMode Processor mode to use for access checks (KernelMode or UserMode)
* @param Object Receives a pointer to the referenced kernel object body
* @param HandleInformation Optional; receives access state information
* @return NTSTATUS STATUS_SUCCESS on success, or an error code on failure
*/
NTSTATUS
PlatformObjectReferenceByHandle(HANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID * Object,
POBJECT_HANDLE_INFORMATION HandleInformation)
{
#if defined(_WIN32) || defined(_WIN64)
return ObReferenceObjectByHandle(Handle,
DesiredAccess,
ObjectType,
AccessMode,
Object,
HandleInformation);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

89
hyperdbg/include/platform/kernel/code/PlatformIo.c Normal file
View file

@ -0,0 +1,89 @@
/**
* @file PlatformIo.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for I/O Request Packet (IRP) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformIo.h"
#endif // defined(__linux__)
/**
* @brief Get the current I/O stack location from an IRP
*
* @param Irp Pointer to the IRP (I/O Request Packet)
* @return PIO_STACK_LOCATION Pointer to the current stack location
*/
PIO_STACK_LOCATION
PlatformIoGetCurrentIrpStackLocation(PIRP Irp)
{
#if defined(_WIN32) || defined(_WIN64)
return IoGetCurrentIrpStackLocation(Irp);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Complete an IRP and release it back to the I/O manager
*
* @param Irp Pointer to the IRP to complete
* @param PriorityBoost Priority boost value (e.g., IO_NO_INCREMENT)
* @return VOID
*/
VOID
PlatformIoCompleteRequest(PIRP Irp, CCHAR PriorityBoost)
{
#if defined(_WIN32) || defined(_WIN64)
IoCompleteRequest(Irp, PriorityBoost);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Mark the current IRP stack location as pending
*
* @param Irp Pointer to the IRP to mark as pending
* @return VOID
*/
VOID
PlatformIoMarkIrpPending(PIRP Irp)
{
#if defined(_WIN32) || defined(_WIN64)
IoMarkIrpPending(Irp);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

63
hyperdbg/include/platform/kernel/code/PlatformIrql.c Normal file
View file

@ -0,0 +1,63 @@
/**
* @file PlatformIrql.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for IRQL management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformIrql.h"
#endif // defined(__linux__)
/**
* @brief Raise the current IRQL to DISPATCH_LEVEL
*
* @return KIRQL The previous IRQL before the raise
*/
KIRQL
PlatformIrqlRaiseToDpcLevel(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return KeRaiseIrqlToDpcLevel();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Lower the current IRQL to the previously saved value
*
* @param OldIrql The previous IRQL to restore
* @return VOID
*/
VOID
PlatformIrqlLower(KIRQL OldIrql)
{
#if defined(_WIN32) || defined(_WIN64)
KeLowerIrql(OldIrql);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

22
hyperdbg/include/platform/kernel/code/PlatformMem.c
View file

@ -121,6 +121,28 @@ PlatformSetMemory(
#endif
}
/**
* @brief Zeros a memory block.
* @param Destination Memory address.
* @param Size Number of bytes.
*/
VOID
PlatformZeroMemory(
PVOID Destination,
SIZE_T Size)
{
if (!Destination)
return;
#ifdef _WIN32
RtlZeroMemory(Destination, Size);
#elif defined(__linux__)
memset(Destination, 0, Size);
#else
# error "Unsupported platform"
#endif
}
/////////////////////////////////////////////////
/// ... Backward Compatibility / Specific APIs ...
/////////////////////////////////////////////////

131
hyperdbg/include/platform/kernel/code/PlatformProcess.c Normal file
View file

@ -0,0 +1,131 @@
/**
* @file PlatformProcess.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for process and thread queries
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformProcess.h"
#endif // defined(__linux__)
/**
* @brief Get the current thread ID
*
* @return HANDLE
*/
HANDLE
PlatformProcessGetCurrentThreadId(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return PsGetCurrentThreadId();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the current process ID
*
* @return HANDLE
*/
HANDLE
PlatformProcessGetCurrentProcessId(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return PsGetCurrentProcessId();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the current process (PEPROCESS)
*
* @return PVOID Pointer to the EPROCESS structure for the current process
*/
PVOID
PlatformProcessGetCurrentProcess(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return (PVOID)PsGetCurrentProcess();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the current thread (PETHREAD)
*
* @return PVOID Pointer to the ETHREAD structure for the current thread
*/
PVOID
PlatformProcessGetCurrentThread(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return (PVOID)PsGetCurrentThread();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the TEB (Thread Environment Block) of the current thread
*
* @return PVOID Pointer to the TEB of the current thread
*/
PVOID
PlatformProcessGetCurrentThreadTeb(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return PsGetCurrentThreadTeb();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

90
hyperdbg/include/platform/kernel/code/PlatformSpinlock.c Normal file
View file

@ -0,0 +1,90 @@
/**
* @file PlatformSpinlock.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for kernel spinlock operations
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformSpinlock.h"
#endif // defined(__linux__)
/**
* @brief Initialize a kernel spinlock
*
* @param SpinLock Pointer to the KSPIN_LOCK to initialize
* @return VOID
*/
VOID
PlatformSpinlockInitialize(PKSPIN_LOCK SpinLock)
{
#if defined(_WIN32) || defined(_WIN64)
KeInitializeSpinLock(SpinLock);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Acquire a kernel spinlock, raising IRQL to DISPATCH_LEVEL
*
* @param SpinLock Pointer to the KSPIN_LOCK to acquire
* @param OldIrql Receives the previous IRQL value to be restored on release
* @return VOID
*/
VOID
PlatformSpinlockAcquire(PKSPIN_LOCK SpinLock, PKIRQL OldIrql)
{
#if defined(_WIN32) || defined(_WIN64)
KeAcquireSpinLock(SpinLock, OldIrql);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Release a previously acquired kernel spinlock and restore IRQL
*
* @param SpinLock Pointer to the KSPIN_LOCK to release
* @param OldIrql The previous IRQL value saved during acquire
* @return VOID
*/
VOID
PlatformSpinlockRelease(PKSPIN_LOCK SpinLock, KIRQL OldIrql)
{
#if defined(_WIN32) || defined(_WIN64)
KeReleaseSpinLock(SpinLock, OldIrql);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

90
hyperdbg/include/platform/kernel/code/PlatformTime.c Normal file
View file

@ -0,0 +1,90 @@
/**
* @file PlatformTime.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for system time operations
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformTime.h"
#endif // defined(__linux__)
/**
* @brief Query the current system time
*
* @param SystemTime Receives the current system time as a LARGE_INTEGER (100-nanosecond units since January 1, 1601)
* @return VOID
*/
VOID
PlatformTimeQuerySystemTime(PLARGE_INTEGER SystemTime)
{
#if defined(_WIN32) || defined(_WIN64)
KeQuerySystemTime(SystemTime);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Convert system time (UTC) to local time
*
* @param SystemTime Pointer to the system time value in UTC
* @param LocalTime Receives the converted local time value
* @return VOID
*/
VOID
PlatformTimeConvertToLocalTime(PLARGE_INTEGER SystemTime, PLARGE_INTEGER LocalTime)
{
#if defined(_WIN32) || defined(_WIN64)
ExSystemTimeToLocalTime(SystemTime, LocalTime);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Convert a LARGE_INTEGER time value to a TIME_FIELDS structure
*
* @param Time Pointer to the time value to convert
* @param TimeFields Receives the broken-down time fields (year, month, day, hour, minute, etc.)
* @return VOID
*/
VOID
PlatformTimeConvertToTimeFields(PLARGE_INTEGER Time, PTIME_FIELDS TimeFields)
{
#if defined(_WIN32) || defined(_WIN64)
RtlTimeToTimeFields(Time, TimeFields);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

26
hyperdbg/include/platform/kernel/header/PlatformCpu.h Normal file
View file

@ -0,0 +1,26 @@
/**
* @file PlatformCpu.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for CPU and processor queries
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
ULONG
PlatformCpuGetActiveProcessorCount(VOID);
ULONG
PlatformCpuGetCurrentProcessorNumber(VOID);

23
hyperdbg/include/platform/kernel/header/PlatformDbg.h Normal file
View file

@ -0,0 +1,23 @@
/**
* @file PlatformDbg.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for kernel debug output
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
VOID
PlatformDbgPrint(const CHAR * Format, ...);

30
hyperdbg/include/platform/kernel/header/PlatformDpc.h Normal file
View file

@ -0,0 +1,30 @@
/**
* @file PlatformDpc.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for Deferred Procedure Call (DPC) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
VOID
PlatformDpcInitialize(PRKDPC Dpc, PKDEFERRED_ROUTINE DeferredRoutine, PVOID DeferredContext);
BOOLEAN
PlatformDpcInsertQueueDpc(PRKDPC Dpc, PVOID SystemArgument1, PVOID SystemArgument2);
#endif // defined(_WIN32) || defined(_WIN64)

38
hyperdbg/include/platform/kernel/header/PlatformEvent.h Normal file
View file

@ -0,0 +1,38 @@
/**
* @file PlatformEvent.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for kernel event and object management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
VOID
PlatformObjectDereference(PVOID Object);
#if defined(_WIN32) || defined(_WIN64)
LONG
PlatformEventSet(PKEVENT Event, KPRIORITY Increment, BOOLEAN Wait);
NTSTATUS
PlatformObjectReferenceByHandle(HANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID * Object,
POBJECT_HANDLE_INFORMATION HandleInformation);
#endif // defined(_WIN32) || defined(_WIN64)

33
hyperdbg/include/platform/kernel/header/PlatformIo.h Normal file
View file

@ -0,0 +1,33 @@
/**
* @file PlatformIo.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for I/O Request Packet (IRP) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
PIO_STACK_LOCATION
PlatformIoGetCurrentIrpStackLocation(PIRP Irp);
VOID
PlatformIoCompleteRequest(PIRP Irp, CCHAR PriorityBoost);
VOID
PlatformIoMarkIrpPending(PIRP Irp);
#endif // defined(_WIN32) || defined(_WIN64)

30
hyperdbg/include/platform/kernel/header/PlatformIrql.h Normal file
View file

@ -0,0 +1,30 @@
/**
* @file PlatformIrql.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for IRQL (Interrupt Request Level) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
KIRQL
PlatformIrqlRaiseToDpcLevel(VOID);
VOID
PlatformIrqlLower(KIRQL OldIrql);
#endif // defined(_WIN32) || defined(_WIN64)

3
hyperdbg/include/platform/kernel/header/PlatformMem.h
View file

@ -31,6 +31,9 @@ PlatformWriteMemory(PVOID Address, PVOID Buffer, SIZE_T Size);
VOID
PlatformSetMemory(PVOID Destination, int Value, SIZE_T Size);
VOID
PlatformZeroMemory(PVOID Destination, SIZE_T Size);
VOID
PlatformFreeMemory(PVOID Memory);

35
hyperdbg/include/platform/kernel/header/PlatformProcess.h Normal file
View file

@ -0,0 +1,35 @@
/**
* @file PlatformProcess.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for process and thread queries
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
HANDLE
PlatformProcessGetCurrentThreadId(VOID);
HANDLE
PlatformProcessGetCurrentProcessId(VOID);
PVOID
PlatformProcessGetCurrentProcess(VOID);
PVOID
PlatformProcessGetCurrentThread(VOID);
PVOID
PlatformProcessGetCurrentThreadTeb(VOID);

33
hyperdbg/include/platform/kernel/header/PlatformSpinlock.h Normal file
View file

@ -0,0 +1,33 @@
/**
* @file PlatformSpinlock.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for kernel spinlock operations
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
VOID
PlatformSpinlockInitialize(PKSPIN_LOCK SpinLock);
VOID
PlatformSpinlockAcquire(PKSPIN_LOCK SpinLock, PKIRQL OldIrql);
VOID
PlatformSpinlockRelease(PKSPIN_LOCK SpinLock, KIRQL OldIrql);
#endif // defined(_WIN32) || defined(_WIN64)

33
hyperdbg/include/platform/kernel/header/PlatformTime.h Normal file
View file

@ -0,0 +1,33 @@
/**
* @file PlatformTime.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for system time operations
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
VOID
PlatformTimeQuerySystemTime(PLARGE_INTEGER SystemTime);
VOID
PlatformTimeConvertToLocalTime(PLARGE_INTEGER SystemTime, PLARGE_INTEGER LocalTime);
VOID
PlatformTimeConvertToTimeFields(PLARGE_INTEGER Time, PTIME_FIELDS TimeFields);
#endif // defined(_WIN32) || defined(_WIN64)

14
hyperdbg/script-eval/code/PseudoRegisters.c
View file

@ -29,7 +29,7 @@ ScriptEnginePseudoRegGetTid()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentThreadId();
return (UINT64)PlatformProcessGetCurrentThreadId();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -46,7 +46,7 @@ ScriptEnginePseudoRegGetCore()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)KeGetCurrentProcessorNumberEx(NULL);
return (UINT64)PlatformCpuGetCurrentProcessorNumber();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -63,7 +63,7 @@ ScriptEnginePseudoRegGetPid()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentProcessId();
return (UINT64)PlatformProcessGetCurrentProcessId();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -112,7 +112,7 @@ ScriptEnginePseudoRegGetPname()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return CommonGetProcessNameFromProcessControlBlock(PsGetCurrentProcess());
return CommonGetProcessNameFromProcessControlBlock(PlatformProcessGetCurrentProcess());
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -129,7 +129,7 @@ ScriptEnginePseudoRegGetProc()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentProcess();
return (UINT64)PlatformProcessGetCurrentProcess();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -146,7 +146,7 @@ ScriptEnginePseudoRegGetThread()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentThread();
return (UINT64)PlatformProcessGetCurrentThread();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -293,7 +293,7 @@ ScriptEnginePseudoRegGetTeb()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentThreadTeb();
return (UINT64)PlatformProcessGetCurrentThreadTeb();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}