diff --git a/hyperdbg/hyperevade/code/Transparency.c b/hyperdbg/hyperevade/code/Transparency.c index 5f6f1efb..6c822c5a 100644 --- a/hyperdbg/hyperevade/code/Transparency.c +++ b/hyperdbg/hyperevade/code/Transparency.c @@ -54,15 +54,6 @@ TransparentHideDebugger(HYPEREVADE_CALLBACKS * Hyperevade &TransparentModeRequest->SystemCallNumbersInformation, sizeof(SYSTEM_CALL_NUMBERS_INFORMATION)); - // - // Initialize the syscall callback mechanism from hypervisor - // - if (!g_Callbacks.SyscallCallbackInitialize()) - { - TransparentModeRequest->KernelStatus = DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER; - return FALSE; - } - // // Choose a random genuine vendor string to replace hypervisor vendor data // @@ -103,11 +94,6 @@ TransparentUnhideDebugger(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * Transpar // g_TransparentMode = FALSE; - // - // Unitialize the syscall callback mechanism from hypervisor - // - g_Callbacks.SyscallCallbackUninitialize(); - TransparentModeRequest->KernelStatus = DEBUGGER_OPERATION_WAS_SUCCESSFUL; return TRUE; } diff --git a/hyperdbg/hyperhv/code/interface/HyperEvade.c b/hyperdbg/hyperhv/code/interface/HyperEvade.c index 0ad8c4f3..59cdce1e 100644 --- a/hyperdbg/hyperhv/code/interface/HyperEvade.c +++ b/hyperdbg/hyperhv/code/interface/HyperEvade.c @@ -30,12 +30,13 @@ TransparentHideDebuggerWrapper(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * Tra // // - // Fill the callbacks for using hyperlog in VMM + // Fill the callbacks for using hyperlog in hyperevade + // We use the callbacks directly to avoid two calls to the same function // - // HyperevadeCallbacks.LogCallbackPrepareAndSendMessageToQueueWrapper = LogCallbackPrepareAndSendMessageToQueue; - HyperevadeCallbacks.LogCallbackSendMessageToQueue = LogCallbackSendMessageToQueue; - HyperevadeCallbacks.LogCallbackSendBuffer = LogCallbackSendBuffer; - HyperevadeCallbacks.LogCallbackCheckIfBufferIsFull = LogCallbackCheckIfBufferIsFull; + HyperevadeCallbacks.LogCallbackPrepareAndSendMessageToQueueWrapper = g_Callbacks.LogCallbackPrepareAndSendMessageToQueueWrapper; + HyperevadeCallbacks.LogCallbackSendMessageToQueue = g_Callbacks.LogCallbackSendMessageToQueue; + HyperevadeCallbacks.LogCallbackSendBuffer = g_Callbacks.LogCallbackSendBuffer; + HyperevadeCallbacks.LogCallbackCheckIfBufferIsFull = g_Callbacks.LogCallbackCheckIfBufferIsFull; // // Memory callbacks @@ -54,8 +55,14 @@ TransparentHideDebuggerWrapper(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * Tra // HyperevadeCallbacks.SyscallCallbackSetTrapFlagAfterSyscall = SyscallCallbackSetTrapFlagAfterSyscall; - // SYSCALL_CALLBACK_INITIALIZE SyscallCallbackInitialize; - // SYSCALL_CALLBACK_UNINITIALIZE SyscallCallbackUninitialize; + // + // Initialize the syscall callback mechanism from hypervisor + // + if (!SyscallCallbackInitialize()) + { + TransparentModeRequest->KernelStatus = DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER; + return FALSE; + } // // Call the hyperevade hide debugger function @@ -72,5 +79,10 @@ TransparentHideDebuggerWrapper(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * Tra BOOLEAN TransparentUnhideDebuggerWrapper(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE * TransparentModeRequest) { + // + // Unitialize the syscall callback mechanism from hypervisor + // + SyscallCallbackUninitialize(); + return TransparentUnhideDebugger(TransparentModeRequest); } diff --git a/hyperdbg/hyperhv/header/hooks/SyscallCallback.h b/hyperdbg/hyperhv/header/hooks/SyscallCallback.h index 5ce28aa2..80c30ac4 100644 --- a/hyperdbg/hyperhv/header/hooks/SyscallCallback.h +++ b/hyperdbg/hyperhv/header/hooks/SyscallCallback.h @@ -74,6 +74,13 @@ typedef struct _SYSCALL_CALLBACK_TRAP_FLAG_STATE ////////////////////////////////////////////////// // Functions // ////////////////////////////////////////////////// + +BOOLEAN +SyscallCallbackInitialize(); + +BOOLEAN +SyscallCallbackUninitialize(); + BOOLEAN SyscallCallbackSetTrapFlagAfterSyscall(GUEST_REGS * Regs, UINT32 ProcessId, diff --git a/hyperdbg/include/SDK/modules/HyperEvade.h b/hyperdbg/include/SDK/modules/HyperEvade.h index b6fc821c..e638c25a 100644 --- a/hyperdbg/include/SDK/modules/HyperEvade.h +++ b/hyperdbg/include/SDK/modules/HyperEvade.h @@ -72,18 +72,6 @@ typedef BOOLEAN (*MEMORY_MAPPER_WRITE_MEMORY_SAFE_ON_TARGET_PROCESS)(UINT64 Dest */ typedef PCHAR (*COMMON_GET_PROCESS_NAME_FROM_PROCESS_CONTROL_BLOCK)(PVOID Eprocess); -/** - * @brief A function that initializes the syscall callback - * - */ -typedef BOOLEAN (*SYSCALL_CALLBACK_INITIALIZE)(); - -/** - * @brief A function that uninitializes the syscall callback - * - */ -typedef BOOLEAN (*SYSCALL_CALLBACK_UNINITIALIZE)(); - /** * @brief A function that sets the trap flag after a syscall * @@ -131,8 +119,6 @@ typedef struct _HYPEREVADE_CALLBACKS // // System call callbacks // - SYSCALL_CALLBACK_INITIALIZE SyscallCallbackInitialize; - SYSCALL_CALLBACK_UNINITIALIZE SyscallCallbackUninitialize; SYSCALL_CALLBACK_SET_TRAP_FLAG_AFTER_SYSCALL SyscallCallbackSetTrapFlagAfterSyscall; } HYPEREVADE_CALLBACKS, *PHYPEREVADE_CALLBACKS;