diff --git a/examples/kernel/hyperdbg_driver/code/driver/Driver.c b/examples/kernel/hyperdbg_driver/code/driver/Driver.c index 9a44e862..b4092073 100644 --- a/examples/kernel/hyperdbg_driver/code/driver/Driver.c +++ b/examples/kernel/hyperdbg_driver/code/driver/Driver.c @@ -106,7 +106,7 @@ DrvUnload(PDRIVER_OBJECT DriverObject) // // Unloading VMM and Debugger // - LoaderUninitializeLogTracer(); + LoaderUninitLogTracer(); } /** diff --git a/examples/kernel/hyperdbg_driver/code/driver/Loader.c b/examples/kernel/hyperdbg_driver/code/driver/Loader.c index a49fe01f..7a2ed944 100644 --- a/examples/kernel/hyperdbg_driver/code/driver/Loader.c +++ b/examples/kernel/hyperdbg_driver/code/driver/Loader.c @@ -101,7 +101,7 @@ LoaderInitVmmAndReversingMachine() * @return VOID */ VOID -LoaderUninitializeLogTracer() +LoaderUninitLogTracer() { LogDebugInfo("Unloading HyperDbg's debugger...\n"); diff --git a/examples/kernel/hyperdbg_driver/header/driver/Loader.h b/examples/kernel/hyperdbg_driver/header/driver/Loader.h index c12b0d12..7ead903c 100644 --- a/examples/kernel/hyperdbg_driver/header/driver/Loader.h +++ b/examples/kernel/hyperdbg_driver/header/driver/Loader.h @@ -17,7 +17,7 @@ ////////////////////////////////////////////////// VOID -LoaderUninitializeLogTracer(); +LoaderUninitLogTracer(); BOOLEAN LoaderInitVmmAndReversingMachine(); diff --git a/hyperdbg/hyperkd/code/debugger/core/Debugger.c b/hyperdbg/hyperkd/code/debugger/core/Debugger.c index db729fbd..156ecdc8 100644 --- a/hyperdbg/hyperkd/code/debugger/core/Debugger.c +++ b/hyperdbg/hyperkd/code/debugger/core/Debugger.c @@ -139,13 +139,13 @@ DebuggerInitializeTrapsAndBreakpoints() } /** - * @brief Initialize VMX event related state + * @brief Initialize VMM operations (events and related operations) * * @return BOOLEAN Shows whether the initialization process was successful * or not */ BOOLEAN -DebuggerInitializeVmxEvents() +DebuggerInitializeVmmOperations() { // // Initialize lists relating to the debugger events store @@ -215,6 +215,12 @@ DebuggerInitializeVmxEvents() return TRUE; } +/** + * @brief Initialize Debugger Structures and Routines + * + * @return BOOLEAN Shows whether the initialization process was successful + * or not + */ BOOLEAN DebuggerInitialize() { @@ -283,17 +289,13 @@ DebuggerInitialize() } /** - * @brief Uninitialize Debugger Structures and Routines + * @brief Uninitialize Debugger VMM Operations (Events and other related operations) * + * @return VOID */ VOID -DebuggerUninitialize() +DebuggerUninitializeVmmOperations() { - ULONG ProcessorsCount; - PROCESSOR_DEBUGGING_STATE * CurrentDebuggerState = NULL; - - ProcessorsCount = KeQueryActiveProcessorCount(0); - // // *** Disable, terminate and clear all the events *** // @@ -325,11 +327,6 @@ DebuggerUninitialize() DebuggerClearAllEvents(FALSE, FALSE); } - // - // Uninitialize the HyperTrace (if it was initialized) - // - HyperTraceUnInit(); - // // Uninitialize kernel debugger // @@ -344,6 +341,25 @@ DebuggerUninitialize() // Uninitialize NMI broadcasting mechanism // VmFuncVmxBroadcastUninitialize(); +} + +/** + * @brief Uninitialize Debugger Structures and Routines + * + * @return VOID + */ +VOID +DebuggerUninitialize() +{ + ULONG ProcessorsCount; + PROCESSOR_DEBUGGING_STATE * CurrentDebuggerState = NULL; + + ProcessorsCount = KeQueryActiveProcessorCount(0); + + // + // Uninitialize the HyperTrace (if it was initialized) + // + HyperTraceUnInit(); // // Free the Pool manager diff --git a/hyperdbg/hyperkd/code/driver/Driver.c b/hyperdbg/hyperkd/code/driver/Driver.c index 48059898..053eb828 100644 --- a/hyperdbg/hyperkd/code/driver/Driver.c +++ b/hyperdbg/hyperkd/code/driver/Driver.c @@ -103,7 +103,7 @@ DrvUnload(PDRIVER_OBJECT DriverObject) // // Unloading Log Tracer // - LoaderUninitializeLogTracer(); + LoaderUninitLogTracer(); } /** diff --git a/hyperdbg/hyperkd/code/driver/Ioctl.c b/hyperdbg/hyperkd/code/driver/Ioctl.c index c74b1742..39150f4b 100644 --- a/hyperdbg/hyperkd/code/driver/Ioctl.c +++ b/hyperdbg/hyperkd/code/driver/Ioctl.c @@ -145,13 +145,13 @@ IoctlCheckIoctlAllowed(ULONG Ioctl) NTSTATUS DrvDispatchBasicIoControl(PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN * DoNotChangeInformation) { - PREGISTER_NOTIFY_BUFFER RegisterEventRequest; - PDEBUGGER_INIT_VMM_PACKET InitVmmRequest; + PREGISTER_NOTIFY_BUFFER RegisterEventRequest; + PDEBUGGER_INIT_VMM_PACKET InitVmmRequest; PDEBUGGER_INIT_HYPERTRACE_PACKET InitHyperTraceRequest; - ULONG InBuffLength; - ULONG OutBuffLength; - NTSTATUS Status = STATUS_SUCCESS; - UINT32 Ioctl = IrpStack->Parameters.DeviceIoControl.IoControlCode; + ULONG InBuffLength; + ULONG OutBuffLength; + NTSTATUS Status = STATUS_SUCCESS; + UINT32 Ioctl = IrpStack->Parameters.DeviceIoControl.IoControlCode; switch (Ioctl) { @@ -172,9 +172,9 @@ DrvDispatchBasicIoControl(PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN * DoNot } // - // Initialize the vmm and the debugger + // Initialize the debugger and the vmm // - if (LoaderInitVmmAndDebugger(InitVmmRequest)) + if (LoaderInitDebuggerAndVmm(InitVmmRequest)) { Status = STATUS_SUCCESS; } @@ -379,14 +379,9 @@ DrvDispatchVmmIoControl(PIRP Irp, PIO_STACK_LOCATION IrpStack, BOOLEAN * DoNotCh case IOCTL_TERMINATE_VMX: // - // Uninitialize the debugger and its sub-mechanisms + // Uninitialize the VMM and the debugger // - DebuggerUninitialize(); - - // - // Terminate VMX - // - VmFuncUninitVmm(); + LoaderUninitVmmAndDebugger(); Status = STATUS_SUCCESS; diff --git a/hyperdbg/hyperkd/code/driver/Loader.c b/hyperdbg/hyperkd/code/driver/Loader.c index e8455f71..ac431eb8 100644 --- a/hyperdbg/hyperkd/code/driver/Loader.c +++ b/hyperdbg/hyperkd/code/driver/Loader.c @@ -235,9 +235,9 @@ LoaderInitVmm(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket) LogDebugInfo("HyperDbg's hypervisor loaded successfully"); // - // Initialize VMX event related state from the debugger + // Initialize VMM opeartions (event related state from the debugger) // - if (!DebuggerInitializeVmxEvents()) + if (!DebuggerInitializeVmmOperations()) { return FALSE; } @@ -294,14 +294,14 @@ LoaderInitKd() } /** - * @brief Initialize the VMM and Debugger + * @brief Initialize the debugger and the vmm * * @param InitVmmPacket The packet to fill the result of the initialization * * @return BOOLEAN */ BOOLEAN -LoaderInitVmmAndDebugger(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket) +LoaderInitDebuggerAndVmm(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket) { // // First we need to initialize the debugger @@ -334,13 +334,75 @@ LoaderInitVmmAndDebugger(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket) return TRUE; } +/** + * @brief Uninitialize the VMM + * + * @return VOID + */ +VOID +LoaderUninitVmm() +{ + // + // Mark VMM as uninitialized before uninitializing it to avoid any potential reentrancy issues during the uninitialization process + // + g_VmmInitialized = FALSE; + + // + // First remove all VMM related state from the debugger + // + DebuggerUninitializeVmmOperations(); + + // + // Terminate VMM and its sub-mechanisms + // + VmFuncUninitVmm(); +} + +/** + * @brief Uninitialize the debugger + * + * @return VOID + */ +VOID +LoaderUninitKd() +{ + // + // Mark KD as uninitialized before uninitializing it to avoid any potential reentrancy issues during the uninitialization process + // + g_KdInitialized = FALSE; + + // + // Uninitialize the debugger and its sub-mechanisms + // + DebuggerUninitialize(); +} + +/** + * @brief Uninitialize the VMM and the debugger + * + * @return VOID + */ +VOID +LoaderUninitVmmAndDebugger() +{ + // + // Uninitialize the VMM first because it relies on the debugger for some + // + LoaderUninitVmm(); + + // + // Uninitialize the debugger + // + LoaderUninitKd(); +} + /** * @brief Uninitialize the log tracer * * @return VOID */ VOID -LoaderUninitializeLogTracer() +LoaderUninitLogTracer() { #if !UseDbgPrintInsteadOfUsermodeMessageTracking diff --git a/hyperdbg/hyperkd/header/debugger/core/Debugger.h b/hyperdbg/hyperkd/header/debugger/core/Debugger.h index a8fe8f2e..3553e20a 100644 --- a/hyperdbg/hyperkd/header/debugger/core/Debugger.h +++ b/hyperdbg/hyperkd/header/debugger/core/Debugger.h @@ -195,11 +195,14 @@ BOOLEAN DebuggerInitializeTrapsAndBreakpoints(); BOOLEAN -DebuggerInitializeVmxEvents(); +DebuggerInitializeVmmOperations(); BOOLEAN DebuggerInitialize(); +VOID +DebuggerUninitializeVmmOperations(); + VOID DebuggerUninitialize(); diff --git a/hyperdbg/hyperkd/header/driver/Loader.h b/hyperdbg/hyperkd/header/driver/Loader.h index 32a29e7e..9a5dc75a 100644 --- a/hyperdbg/hyperkd/header/driver/Loader.h +++ b/hyperdbg/hyperkd/header/driver/Loader.h @@ -19,17 +19,14 @@ BOOLEAN LoaderInitHyperLog(); -BOOLEAN -LoaderInitKd(); - -BOOLEAN -LoaderInitVmm(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket); - -BOOLEAN -LoaderInitVmmAndDebugger(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket); - BOOLEAN LoaderInitHyperTrace(PDEBUGGER_INIT_HYPERTRACE_PACKET InitHyperTracePacket, BOOLEAN RunningOnHypervisorEnvironment); +BOOLEAN +LoaderInitDebuggerAndVmm(PDEBUGGER_INIT_VMM_PACKET InitVmmPacket); + VOID -LoaderUninitializeLogTracer(); +LoaderUninitVmmAndDebugger(); + +VOID +LoaderUninitLogTracer();