vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

uninit VMM and KD separately

Browse source
This commit is contained in:
sina 2026-06-04 00:55:05 +02:00
parent b6b8320518
commit adfe5f7d14
9 changed files with 122 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

2
examples/kernel/hyperdbg_driver/code/driver/Driver.c
View file

@ -106,7 +106,7 @@ DrvUnload(PDRIVER_OBJECT DriverObject)
//
// Unloading VMM and Debugger
//
LoaderUninitializeLogTracer();
LoaderUninitLogTracer();
}
/**

2
examples/kernel/hyperdbg_driver/code/driver/Loader.c
View file

@ -101,7 +101,7 @@ LoaderInitVmmAndReversingMachine()
* @return VOID
*/
VOID
LoaderUninitializeLogTracer()
LoaderUninitLogTracer()
{
LogDebugInfo("Unloading HyperDbg's debugger...\n");

2
examples/kernel/hyperdbg_driver/header/driver/Loader.h
View file

@ -17,7 +17,7 @@
//////////////////////////////////////////////////
VOID
LoaderUninitializeLogTracer();
LoaderUninitLogTracer();
BOOLEAN
LoaderInitVmmAndReversingMachine();

44
hyperdbg/hyperkd/code/debugger/core/Debugger.c
View file

@ -139,13 +139,13 @@ DebuggerInitializeTrapsAndBreakpoints()
}
/**
* @brief Initialize VMX event related state
* @brief Initialize VMM operations (events and related operations)
*
* @return BOOLEAN Shows whether the initialization process was successful
* or not
*/
BOOLEAN
DebuggerInitializeVmxEvents()
DebuggerInitializeVmmOperations()
{
//
// Initialize lists relating to the debugger events store
@ -215,6 +215,12 @@ DebuggerInitializeVmxEvents()
return TRUE;
}
/**
* @brief Initialize Debugger Structures and Routines
*
* @return BOOLEAN Shows whether the initialization process was successful
* or not
*/
BOOLEAN
DebuggerInitialize()
{
@ -283,17 +289,13 @@ DebuggerInitialize()
}
/**
* @brief Uninitialize Debugger Structures and Routines
* @brief Uninitialize Debugger VMM Operations (Events and other related operations)
*
* @return VOID
*/
VOID
DebuggerUninitialize()
DebuggerUninitializeVmmOperations()
{
ULONG ProcessorsCount;
PROCESSOR_DEBUGGING_STATE * CurrentDebuggerState = NULL;
ProcessorsCount = KeQueryActiveProcessorCount(0);
//
// *** Disable, terminate and clear all the events ***
//
@ -325,11 +327,6 @@ DebuggerUninitialize()
DebuggerClearAllEvents(FALSE, FALSE);
}
//
// Uninitialize the HyperTrace (if it was initialized)
//
HyperTraceUnInit();
//
// Uninitialize kernel debugger
//
@ -344,6 +341,25 @@ DebuggerUninitialize()
// Uninitialize NMI broadcasting mechanism
//
VmFuncVmxBroadcastUninitialize();
}
/**
* @brief Uninitialize Debugger Structures and Routines
*
* @return VOID
*/
VOID
DebuggerUninitialize()
{
ULONG ProcessorsCount;
PROCESSOR_DEBUGGING_STATE * CurrentDebuggerState = NULL;
ProcessorsCount = KeQueryActiveProcessorCount(0);
//
// Uninitialize the HyperTrace (if it was initialized)
//
HyperTraceUnInit();
//
// Free the Pool manager

2
hyperdbg/hyperkd/code/driver/Driver.c
View file

@ -103,7 +103,7 @@ DrvUnload(PDRIVER_OBJECT DriverObject)
//
// Unloading Log Tracer
//
LoaderUninitializeLogTracer();
LoaderUninitLogTracer();
}
/**

25
hyperdbg/hyperkd/code/driver/Ioctl.c
View file

@ -145,13 +145,13 @@ IoctlCheckIoctlAllowed(ULONG Ioctl)
NTSTATUS
DrvDispatchBasicIoControl(PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN * DoNotChangeInformation)
{
PREGISTER_NOTIFY_BUFFER RegisterEventRequest;
PDEBUGGER_INIT_VMM_PACKET InitVmmRequest;
PREGISTER_NOTIFY_BUFFER RegisterEventRequest;
PDEBUGGER_INIT_VMM_PACKET InitVmmRequest;
PDEBUGGER_INIT_HYPERTRACE_PACKET InitHyperTraceRequest;
ULONG InBuffLength;
ULONG OutBuffLength;
NTSTATUS Status = STATUS_SUCCESS;
UINT32 Ioctl = IrpStack->Parameters.DeviceIoControl.IoControlCode;
ULONG InBuffLength;
ULONG OutBuffLength;
NTSTATUS Status = STATUS_SUCCESS;
UINT32 Ioctl = IrpStack->Parameters.DeviceIoControl.IoControlCode;
switch (Ioctl)
{
@ -172,9 +172,9 @@ DrvDispatchBasicIoControl(PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN * DoNot
}
//
// Initialize the vmm and the debugger
// Initialize the debugger and the vmm
//
if (LoaderInitVmmAndDebugger(InitVmmRequest))
if (LoaderInitDebuggerAndVmm(InitVmmRequest))
{
Status = STATUS_SUCCESS;
}
@ -379,14 +379,9 @@ DrvDispatchVmmIoControl(PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN * DoNotCh
case IOCTL_TERMINATE_VMX:
//
// Uninitialize the debugger and its sub-mechanisms
// Uninitialize the VMM and the debugger
//
DebuggerUninitialize();
//
// Terminate VMX
//
VmFuncUninitVmm();
LoaderUninitVmmAndDebugger();
Status = STATUS_SUCCESS;

72
hyperdbg/hyperkd/code/driver/Loader.c
View file

@ -235,9 +235,9 @@ LoaderInitVmm(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket)
LogDebugInfo("HyperDbg's hypervisor loaded successfully");
//
// Initialize VMX event related state from the debugger
// Initialize VMM opeartions (event related state from the debugger)
//
if (!DebuggerInitializeVmxEvents())
if (!DebuggerInitializeVmmOperations())
{
return FALSE;
}
@ -294,14 +294,14 @@ LoaderInitKd()
}
/**
* @brief Initialize the VMM and Debugger
* @brief Initialize the debugger and the vmm
*
* @param InitVmmPacket The packet to fill the result of the initialization
*
* @return BOOLEAN
*/
BOOLEAN
LoaderInitVmmAndDebugger(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket)
LoaderInitDebuggerAndVmm(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket)
{
//
// First we need to initialize the debugger
@ -334,13 +334,75 @@ LoaderInitVmmAndDebugger(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket)
return TRUE;
}
/**
* @brief Uninitialize the VMM
*
* @return VOID
*/
VOID
LoaderUninitVmm()
{
//
// Mark VMM as uninitialized before uninitializing it to avoid any potential reentrancy issues during the uninitialization process
//
g_VmmInitialized = FALSE;
//
// First remove all VMM related state from the debugger
//
DebuggerUninitializeVmmOperations();
//
// Terminate VMM and its sub-mechanisms
//
VmFuncUninitVmm();
}
/**
* @brief Uninitialize the debugger
*
* @return VOID
*/
VOID
LoaderUninitKd()
{
//
// Mark KD as uninitialized before uninitializing it to avoid any potential reentrancy issues during the uninitialization process
//
g_KdInitialized = FALSE;
//
// Uninitialize the debugger and its sub-mechanisms
//
DebuggerUninitialize();
}
/**
* @brief Uninitialize the VMM and the debugger
*
* @return VOID
*/
VOID
LoaderUninitVmmAndDebugger()
{
//
// Uninitialize the VMM first because it relies on the debugger for some
//
LoaderUninitVmm();
//
// Uninitialize the debugger
//
LoaderUninitKd();
}
/**
* @brief Uninitialize the log tracer
*
* @return VOID
*/
VOID
LoaderUninitializeLogTracer()
LoaderUninitLogTracer()
{
#if !UseDbgPrintInsteadOfUsermodeMessageTracking

5
hyperdbg/hyperkd/header/debugger/core/Debugger.h
View file

@ -195,11 +195,14 @@ BOOLEAN
DebuggerInitializeTrapsAndBreakpoints();
BOOLEAN
DebuggerInitializeVmxEvents();
DebuggerInitializeVmmOperations();
BOOLEAN
DebuggerInitialize();
VOID
DebuggerUninitializeVmmOperations();
VOID
DebuggerUninitialize();

17
hyperdbg/hyperkd/header/driver/Loader.h
View file

@ -19,17 +19,14 @@
BOOLEAN
LoaderInitHyperLog();
BOOLEAN
LoaderInitKd();
BOOLEAN
LoaderInitVmm(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket);
BOOLEAN
LoaderInitVmmAndDebugger(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket);
BOOLEAN
LoaderInitHyperTrace(PDEBUGGER_INIT_HYPERTRACE_PACKET InitHyperTracePacket, BOOLEAN RunningOnHypervisorEnvironment);
BOOLEAN
LoaderInitDebuggerAndVmm(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket);
VOID
LoaderUninitializeLogTracer();
LoaderUninitVmmAndDebugger();
VOID
LoaderUninitLogTracer();