vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-10 01:29:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix problem for loading and unloading drivers

Browse source
This commit is contained in:
SinaKarvandi 2021-04-02 01:12:32 +04:30
parent fd20f40e60
commit c5cd7974cb
12 changed files with 123 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hyperdbg/hprdbgctrl/common.cpp
View file

@ -248,6 +248,8 @@ ConvertStringToUInt64(string TextToConvert, PUINT64 Result)
{
return TRUE;
}
return TRUE;
}
/**
@ -286,6 +288,8 @@ ConvertStringToUInt32(string TextToConvert, PUINT32 Result)
// Apply the results
//
*Result = TempResult;
return TRUE;
}
/**
@ -459,4 +463,4 @@ RemoveSpaces(std::string str)
{
str.erase(remove(str.begin(), str.end(), ' '), str.end());
return str;
}
}

8
hyperdbg/hprdbgctrl/exit.cpp
View file

@ -53,14 +53,6 @@ CommandExit(vector<string> SplittedCommand, string Command)
if (g_IsDebuggerModulesLoaded)
{
HyperdbgUnload();
//
// Uninstalling Driver
//
if (HyperdbgUninstallDriver())
{
ShowMessages("Failed to uninstall driver\n");
}
}
exit(0);

1
hyperdbg/hprdbgctrl/exports.h
View file

@ -24,6 +24,7 @@ __declspec(dllexport) int HyperdbgLoadVmm();
__declspec(dllexport) int HyperdbgUnload();
__declspec(dllexport) int HyperdbgInstallVmmDriver();
__declspec(dllexport) int HyperdbgUninstallDriver();
__declspec(dllexport) int HyperdbgStopDriver();
__declspec(dllexport) void HyperdbgSetTextMessageCallback(Callback handler);
__declspec(dllexport) int HyperdbgInterpreter(const char * Command);
__declspec(dllexport) void HyperdbgShowSignature();

44
hyperdbg/hprdbgctrl/hprdbgctrl.cpp
View file

@ -160,6 +160,8 @@ ReadIrpBasedBuffer()
{
ShowMessages("CreateFile failed with error: 0x%x\n", ErrorNum);
}
g_DeviceHandle = NULL;
return;
}
@ -291,6 +293,13 @@ ReadIrpBasedBuffer()
break;
case OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS:
//
// End of receiving messages (IRPs), nothing to do
//
break;
default:
/*
ShowMessages("Message From Debugger :\n");
@ -423,11 +432,31 @@ HyperdbgInstallVmmDriver()
return 1;
}
return 0;
}
/**
* @brief Uninstall the driver
* @brief Stop the driver
*
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int
HyperdbgStopDriver()
{
//
// Unload the driver if loaded. Ignore any errors.
//
if (g_DriverLocation[0] != (TCHAR)0)
{
ManageDriver(DRIVER_NAME, g_DriverLocation, DRIVER_FUNC_STOP);
}
return 0;
}
/**
* @brief Remove the driver
*
* @return int return zero if it was successful or non-zero if there
* was error
@ -491,6 +520,15 @@ HyperdbgLoadVmm()
return 1;
}
//
// Make sure that this variable is false, because it might be set to
// true as the result of a previous load
//
g_IsVmxOffProcessStart = FALSE;
//
// Init entering vmx
//
g_DeviceHandle = CreateFileA(
"\\\\.\\HyperdbgHypervisorDevice",
GENERIC_READ | GENERIC_WRITE,
@ -512,6 +550,8 @@ HyperdbgLoadVmm()
{
ShowMessages("CreateFile failed with error: 0x%x\n", ErrorNum);
}
g_DeviceHandle = NULL;
return 1;
}
@ -561,7 +601,7 @@ HyperdbgUnload()
return 1;
}
ShowMessages("Start terminating VMX\n");
ShowMessages("Start terminating VMX...\n");
//
// Send IOCTL to mark complete all IRP Pending

49
hyperdbg/hprdbgctrl/install.cpp
View file

@ -159,6 +159,7 @@ ManageDriver(LPCTSTR DriverName, LPCTSTR ServiceName, USHORT Function)
//
// Install the driver service.
//
if (InstallDriver(schSCManager, DriverName, ServiceName))
{
//
@ -176,13 +177,22 @@ ManageDriver(LPCTSTR DriverName, LPCTSTR ServiceName, USHORT Function)
break;
case DRIVER_FUNC_REMOVE:
case DRIVER_FUNC_STOP:
//
// Stop the driver.
//
StopDriver(schSCManager, DriverName);
//
// Ignore all errors.
//
rCode = TRUE;
break;
case DRIVER_FUNC_REMOVE:
//
// Remove the driver service.
//
@ -229,7 +239,7 @@ RemoveDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName)
BOOLEAN rCode;
//
// Open the handle to the existing service.
// Open the handle to the existing service
//
schService = OpenService(SchSCManager, DriverName, SERVICE_ALL_ACCESS);
@ -238,18 +248,18 @@ RemoveDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName)
ShowMessages("OpenService failed! Error = %d \n", GetLastError());
//
// Indicate error.
// Indicate error
//
return FALSE;
}
//
// Mark the service for deletion from the service control manager database.
// Mark the service for deletion from the service control manager database
//
if (DeleteService(schService))
{
//
// Indicate success.
// Indicate success
//
rCode = TRUE;
}
@ -258,13 +268,13 @@ RemoveDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName)
ShowMessages("DeleteService failed! Error = %d \n", GetLastError());
//
// Indicate failure. Fall through to properly close the service handle.
// Indicate failure. Fall through to properly close the service handle
//
rCode = FALSE;
}
//
// Close the service object.
// Close the service object
//
if (schService)
{
@ -284,8 +294,10 @@ RemoveDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName)
BOOLEAN
StartDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName)
{
SC_HANDLE schService;
DWORD err;
SC_HANDLE schService;
DWORD err;
SERVICE_STATUS serviceStatus;
UINT64 Status = TRUE;
//
// Open the handle to the existing service.
@ -297,7 +309,7 @@ StartDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName)
ShowMessages("OpenService failed! Error = %d \n", GetLastError());
//
// Indicate failure.
// Indicate failure
//
return FALSE;
}
@ -315,42 +327,41 @@ StartDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName)
if (err == ERROR_SERVICE_ALREADY_RUNNING)
{
//
// Ignore this error.
// Ignore this error
//
return TRUE;
}
else if (err == 577)
{
ShowMessages(
"Err 577, it's because you driver signature enforcement is enabled. "
"You should disable driver signature enforcement by attaching Windbg "
"or from the boot menu.");
"or from the boot menu\n");
//
// Indicate failure. Fall through to properly close the service handle.
// Indicate failure. Fall through to properly close the service handle
//
return FALSE;
Status = FALSE;
}
else
{
ShowMessages("StartService failure! Error = %d \n", err);
//
// Indicate failure. Fall through to properly close the service handle.
// Indicate failure. Fall through to properly close the service handle
//
return FALSE;
Status = FALSE;
}
}
//
// Close the service object.
// Close the service object
//
if (schService)
{
CloseServiceHandle(schService);
}
return TRUE;
return Status;
}
/**

3
hyperdbg/hprdbgctrl/install.h
View file

@ -50,7 +50,8 @@ fnhprdbgctrl(void);
//////////////////////////////////////////////////
#define DRIVER_FUNC_INSTALL 0x01
#define DRIVER_FUNC_REMOVE 0x02
#define DRIVER_FUNC_STOP 0x02
#define DRIVER_FUNC_REMOVE 0x03
BOOLEAN
ManageDriver(_In_ LPCTSTR DriverName, _In_ LPCTSTR ServiceName, _In_ USHORT Function);

8
hyperdbg/hprdbgctrl/kd.cpp
View file

@ -2018,14 +2018,6 @@ KdCloseConnection()
if (g_IsConnectedToHyperDbgLocally && g_IsDebuggerModulesLoaded)
{
HyperdbgUnload();
//
// Uninstalling Driver
//
if (HyperdbgUninstallDriver())
{
ShowMessages("Failed to uninstall driver\n");
}
}
}
else if (g_IsSerialConnectedToRemoteDebuggee)

15
hyperdbg/hprdbgctrl/load.cpp
View file

@ -15,6 +15,7 @@
// Global Variables
//
extern HANDLE g_IsDriverLoadedSuccessfully;
extern HANDLE g_DeviceHandle;
extern BOOLEAN g_IsConnectedToHyperDbgLocally;
extern BOOLEAN g_IsDebuggerModulesLoaded;
@ -60,7 +61,7 @@ CommandLoadVmmModule()
return FALSE;
}
if (HyperdbgInstallVmmDriver())
if (HyperdbgInstallVmmDriver() == 1)
{
return FALSE;
}
@ -130,6 +131,16 @@ CommandLoad(vector<string> SplittedCommand, string Command)
//
if (!SplittedCommand.at(1).compare("vmm"))
{
//
// Check to make sure that the driver is not already loaded
//
if (g_DeviceHandle)
{
ShowMessages("Handle of driver found, if you use 'load' before, please "
"first unload it then call 'unload'.\n");
return;
}
//
// Load VMM Module
//
@ -146,7 +157,7 @@ CommandLoad(vector<string> SplittedCommand, string Command)
//
// Module not found
//
ShowMessages("module not found, currently, 'vmm' is the only available "
ShowMessages("module not found, currently 'vmm' is the only available "
"module for HyperDbg.\n");
}
}

31
hyperdbg/hprdbgctrl/unload.cpp
View file

@ -27,8 +27,9 @@ CommandUnloadHelp()
{
ShowMessages(
"unload : unloads the kernel modules and uninstalls the drivers.\n\n");
ShowMessages("syntax : \tunload [Module Name]\n");
ShowMessages("syntax : \tunload [remove] [Module Name]\n");
ShowMessages("\t\te.g : unload vmm\n");
ShowMessages("\t\te.g : unload remove vmm\n");
}
/**
@ -41,7 +42,7 @@ CommandUnloadHelp()
VOID
CommandUnload(vector<string> SplittedCommand, string Command)
{
if (SplittedCommand.size() != 2)
if (SplittedCommand.size() != 2 && SplittedCommand.size() != 3)
{
ShowMessages("incorrect use of 'unload'\n\n");
CommandUnloadHelp();
@ -51,7 +52,8 @@ CommandUnload(vector<string> SplittedCommand, string Command)
//
// Check for the module
//
if (!SplittedCommand.at(1).compare("vmm"))
if ((SplittedCommand.size() == 2 && !SplittedCommand.at(1).compare("vmm")) ||
(SplittedCommand.size() == 3 && !SplittedCommand.at(2).compare("vmm") && !SplittedCommand.at(1).compare("remove")))
{
if (!g_IsConnectedToHyperDbgLocally)
{
@ -64,12 +66,23 @@ CommandUnload(vector<string> SplittedCommand, string Command)
{
HyperdbgUnload();
//
// Uninstalling Driver
//
if (HyperdbgUninstallDriver())
if (!SplittedCommand.at(1).compare("remove"))
{
ShowMessages("Failed to uninstall driver\n");
//
// Stop the driver
//
if (HyperdbgStopDriver())
{
ShowMessages("Failed to stop driver\n");
}
//
// Uninstall the driver
//
if (HyperdbgUninstallDriver())
{
ShowMessages("Failed to uninstall the driver\n");
}
}
}
else
@ -82,7 +95,7 @@ CommandUnload(vector<string> SplittedCommand, string Command)
//
// Module not found
//
ShowMessages("module not found, currently, 'vmm' is the only available "
ShowMessages("module not found, currently 'vmm' is the only available "
"module for HyperDbg.\n");
}
}

5
hyperdbg/hprdbghv/Ioctl.c
View file

@ -106,7 +106,10 @@ DrvDispatchIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
//
// Send an immediate message, and we're no longer get new IRP
//
LogInfoImmediate("An immediate message recieved, we no longer recieve IRPs from user-mode ");
LogSendBuffer(OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS,
"$",
1);
Status = STATUS_SUCCESS;
break;
case IOCTL_TERMINATE_VMX:

1
hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp
View file

@ -30,6 +30,7 @@ __declspec(dllimport) int HyperdbgLoadVmm();
__declspec(dllimport) int HyperdbgUnload();
__declspec(dllimport) int HyperdbgInstallVmmDriver();
__declspec(dllimport) int HyperdbgUninstallDriver();
__declspec(dllimport) int HyperdbgStopDriver();
__declspec(dllimport) int HyperdbgInterpreter(const char * Command);
__declspec(dllexport) void HyperdbgShowSignature();
__declspec(dllimport) void HyperdbgSetTextMessageCallback(Callback handler);

4
hyperdbg/include/Definition.h
View file

@ -170,6 +170,8 @@
#define OPERATION_DEBUGGEE_CLEAR_EVENTS 0xA | OPERATION_MANDATORY_DEBUGGEE_BIT
#define OPERATION_HYPERVISOR_DRIVER_IS_SUCCESSFULLY_LOADED \
0xB | OPERATION_MANDATORY_DEBUGGEE_BIT
#define OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS \
0xC | OPERATION_MANDATORY_DEBUGGEE_BIT
//////////////////////////////////////////////////
// Test Cases //
@ -1865,4 +1867,4 @@ typedef struct _DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET
*
*/
#define IOCTL_SEND_GENERAL_BUFFER_FROM_DEBUGGEE_TO_DEBUGGER \
CTL_CODE(FILE_DEVICE_UNKNOWN, 0x815, METHOD_BUFFERED, FILE_ANY_ACCESS)
CTL_CODE(FILE_DEVICE_UNKNOWN, 0x815, METHOD_BUFFERED, FILE_ANY_ACCESS)