From c5cd7974cbc0adf98ff2627f3004cd92b26ca316 Mon Sep 17 00:00:00 2001 From: SinaKarvandi Date: Fri, 2 Apr 2021 01:12:32 +0430 Subject: [PATCH] fix problem for loading and unloading drivers --- hyperdbg/hprdbgctrl/common.cpp | 6 +++- hyperdbg/hprdbgctrl/exit.cpp | 8 ----- hyperdbg/hprdbgctrl/exports.h | 1 + hyperdbg/hprdbgctrl/hprdbgctrl.cpp | 44 +++++++++++++++++++++-- hyperdbg/hprdbgctrl/install.cpp | 49 ++++++++++++++++---------- hyperdbg/hprdbgctrl/install.h | 3 +- hyperdbg/hprdbgctrl/kd.cpp | 8 ----- hyperdbg/hprdbgctrl/load.cpp | 15 ++++++-- hyperdbg/hprdbgctrl/unload.cpp | 31 +++++++++++----- hyperdbg/hprdbghv/Ioctl.c | 5 ++- hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp | 1 + hyperdbg/include/Definition.h | 4 ++- 12 files changed, 123 insertions(+), 52 deletions(-) diff --git a/hyperdbg/hprdbgctrl/common.cpp b/hyperdbg/hprdbgctrl/common.cpp index b85eb151..ba35d57d 100644 --- a/hyperdbg/hprdbgctrl/common.cpp +++ b/hyperdbg/hprdbgctrl/common.cpp @@ -248,6 +248,8 @@ ConvertStringToUInt64(string TextToConvert, PUINT64 Result) { return TRUE; } + + return TRUE; } /** @@ -286,6 +288,8 @@ ConvertStringToUInt32(string TextToConvert, PUINT32 Result) // Apply the results // *Result = TempResult; + + return TRUE; } /** @@ -459,4 +463,4 @@ RemoveSpaces(std::string str) { str.erase(remove(str.begin(), str.end(), ' '), str.end()); return str; -} \ No newline at end of file +} diff --git a/hyperdbg/hprdbgctrl/exit.cpp b/hyperdbg/hprdbgctrl/exit.cpp index 79c8748c..11f0ba73 100644 --- a/hyperdbg/hprdbgctrl/exit.cpp +++ b/hyperdbg/hprdbgctrl/exit.cpp @@ -53,14 +53,6 @@ CommandExit(vector SplittedCommand, string Command) if (g_IsDebuggerModulesLoaded) { HyperdbgUnload(); - - // - // Uninstalling Driver - // - if (HyperdbgUninstallDriver()) - { - ShowMessages("Failed to uninstall driver\n"); - } } exit(0); diff --git a/hyperdbg/hprdbgctrl/exports.h b/hyperdbg/hprdbgctrl/exports.h index e0382e44..72a1e66a 100644 --- a/hyperdbg/hprdbgctrl/exports.h +++ b/hyperdbg/hprdbgctrl/exports.h @@ -24,6 +24,7 @@ __declspec(dllexport) int HyperdbgLoadVmm(); __declspec(dllexport) int HyperdbgUnload(); __declspec(dllexport) int HyperdbgInstallVmmDriver(); __declspec(dllexport) int HyperdbgUninstallDriver(); +__declspec(dllexport) int HyperdbgStopDriver(); __declspec(dllexport) void HyperdbgSetTextMessageCallback(Callback handler); __declspec(dllexport) int HyperdbgInterpreter(const char * Command); __declspec(dllexport) void HyperdbgShowSignature(); diff --git a/hyperdbg/hprdbgctrl/hprdbgctrl.cpp b/hyperdbg/hprdbgctrl/hprdbgctrl.cpp index c5f3aeb0..4d028b88 100644 --- a/hyperdbg/hprdbgctrl/hprdbgctrl.cpp +++ b/hyperdbg/hprdbgctrl/hprdbgctrl.cpp @@ -160,6 +160,8 @@ ReadIrpBasedBuffer() { ShowMessages("CreateFile failed with error: 0x%x\n", ErrorNum); } + + g_DeviceHandle = NULL; return; } @@ -291,6 +293,13 @@ ReadIrpBasedBuffer() break; + case OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS: + + // + // End of receiving messages (IRPs), nothing to do + // + break; + default: /* ShowMessages("Message From Debugger :\n"); @@ -423,11 +432,31 @@ HyperdbgInstallVmmDriver() return 1; } + return 0; } /** - * @brief Uninstall the driver + * @brief Stop the driver + * + * @return int return zero if it was successful or non-zero if there + * was error + */ +HPRDBGCTRL_API int +HyperdbgStopDriver() +{ + // + // Unload the driver if loaded. Ignore any errors. + // + if (g_DriverLocation[0] != (TCHAR)0) + { + ManageDriver(DRIVER_NAME, g_DriverLocation, DRIVER_FUNC_STOP); + } + return 0; +} + +/** + * @brief Remove the driver * * @return int return zero if it was successful or non-zero if there * was error @@ -491,6 +520,15 @@ HyperdbgLoadVmm() return 1; } + // + // Make sure that this variable is false, because it might be set to + // true as the result of a previous load + // + g_IsVmxOffProcessStart = FALSE; + + // + // Init entering vmx + // g_DeviceHandle = CreateFileA( "\\\\.\\HyperdbgHypervisorDevice", GENERIC_READ | GENERIC_WRITE, @@ -512,6 +550,8 @@ HyperdbgLoadVmm() { ShowMessages("CreateFile failed with error: 0x%x\n", ErrorNum); } + + g_DeviceHandle = NULL; return 1; } @@ -561,7 +601,7 @@ HyperdbgUnload() return 1; } - ShowMessages("Start terminating VMX\n"); + ShowMessages("Start terminating VMX...\n"); // // Send IOCTL to mark complete all IRP Pending diff --git a/hyperdbg/hprdbgctrl/install.cpp b/hyperdbg/hprdbgctrl/install.cpp index 4624e93e..832356cc 100644 --- a/hyperdbg/hprdbgctrl/install.cpp +++ b/hyperdbg/hprdbgctrl/install.cpp @@ -159,6 +159,7 @@ ManageDriver(LPCTSTR DriverName, LPCTSTR ServiceName, USHORT Function) // // Install the driver service. // + if (InstallDriver(schSCManager, DriverName, ServiceName)) { // @@ -176,13 +177,22 @@ ManageDriver(LPCTSTR DriverName, LPCTSTR ServiceName, USHORT Function) break; - case DRIVER_FUNC_REMOVE: + case DRIVER_FUNC_STOP: // // Stop the driver. // StopDriver(schSCManager, DriverName); + // + // Ignore all errors. + // + rCode = TRUE; + + break; + + case DRIVER_FUNC_REMOVE: + // // Remove the driver service. // @@ -229,7 +239,7 @@ RemoveDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName) BOOLEAN rCode; // - // Open the handle to the existing service. + // Open the handle to the existing service // schService = OpenService(SchSCManager, DriverName, SERVICE_ALL_ACCESS); @@ -238,18 +248,18 @@ RemoveDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName) ShowMessages("OpenService failed! Error = %d \n", GetLastError()); // - // Indicate error. + // Indicate error // return FALSE; } // - // Mark the service for deletion from the service control manager database. + // Mark the service for deletion from the service control manager database // if (DeleteService(schService)) { // - // Indicate success. + // Indicate success // rCode = TRUE; } @@ -258,13 +268,13 @@ RemoveDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName) ShowMessages("DeleteService failed! Error = %d \n", GetLastError()); // - // Indicate failure. Fall through to properly close the service handle. + // Indicate failure. Fall through to properly close the service handle // rCode = FALSE; } // - // Close the service object. + // Close the service object // if (schService) { @@ -284,8 +294,10 @@ RemoveDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName) BOOLEAN StartDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName) { - SC_HANDLE schService; - DWORD err; + SC_HANDLE schService; + DWORD err; + SERVICE_STATUS serviceStatus; + UINT64 Status = TRUE; // // Open the handle to the existing service. @@ -297,7 +309,7 @@ StartDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName) ShowMessages("OpenService failed! Error = %d \n", GetLastError()); // - // Indicate failure. + // Indicate failure // return FALSE; } @@ -315,42 +327,41 @@ StartDriver(SC_HANDLE SchSCManager, LPCTSTR DriverName) if (err == ERROR_SERVICE_ALREADY_RUNNING) { // - // Ignore this error. + // Ignore this error // - return TRUE; } else if (err == 577) { ShowMessages( "Err 577, it's because you driver signature enforcement is enabled. " "You should disable driver signature enforcement by attaching Windbg " - "or from the boot menu."); + "or from the boot menu\n"); // - // Indicate failure. Fall through to properly close the service handle. + // Indicate failure. Fall through to properly close the service handle // - return FALSE; + Status = FALSE; } else { ShowMessages("StartService failure! Error = %d \n", err); // - // Indicate failure. Fall through to properly close the service handle. + // Indicate failure. Fall through to properly close the service handle // - return FALSE; + Status = FALSE; } } // - // Close the service object. + // Close the service object // if (schService) { CloseServiceHandle(schService); } - return TRUE; + return Status; } /** diff --git a/hyperdbg/hprdbgctrl/install.h b/hyperdbg/hprdbgctrl/install.h index a4965a38..c20d300f 100644 --- a/hyperdbg/hprdbgctrl/install.h +++ b/hyperdbg/hprdbgctrl/install.h @@ -50,7 +50,8 @@ fnhprdbgctrl(void); ////////////////////////////////////////////////// #define DRIVER_FUNC_INSTALL 0x01 -#define DRIVER_FUNC_REMOVE 0x02 +#define DRIVER_FUNC_STOP 0x02 +#define DRIVER_FUNC_REMOVE 0x03 BOOLEAN ManageDriver(_In_ LPCTSTR DriverName, _In_ LPCTSTR ServiceName, _In_ USHORT Function); diff --git a/hyperdbg/hprdbgctrl/kd.cpp b/hyperdbg/hprdbgctrl/kd.cpp index a1c07017..8a9051b6 100644 --- a/hyperdbg/hprdbgctrl/kd.cpp +++ b/hyperdbg/hprdbgctrl/kd.cpp @@ -2018,14 +2018,6 @@ KdCloseConnection() if (g_IsConnectedToHyperDbgLocally && g_IsDebuggerModulesLoaded) { HyperdbgUnload(); - - // - // Uninstalling Driver - // - if (HyperdbgUninstallDriver()) - { - ShowMessages("Failed to uninstall driver\n"); - } } } else if (g_IsSerialConnectedToRemoteDebuggee) diff --git a/hyperdbg/hprdbgctrl/load.cpp b/hyperdbg/hprdbgctrl/load.cpp index dd247ca9..cbc7d9b2 100644 --- a/hyperdbg/hprdbgctrl/load.cpp +++ b/hyperdbg/hprdbgctrl/load.cpp @@ -15,6 +15,7 @@ // Global Variables // extern HANDLE g_IsDriverLoadedSuccessfully; +extern HANDLE g_DeviceHandle; extern BOOLEAN g_IsConnectedToHyperDbgLocally; extern BOOLEAN g_IsDebuggerModulesLoaded; @@ -60,7 +61,7 @@ CommandLoadVmmModule() return FALSE; } - if (HyperdbgInstallVmmDriver()) + if (HyperdbgInstallVmmDriver() == 1) { return FALSE; } @@ -130,6 +131,16 @@ CommandLoad(vector SplittedCommand, string Command) // if (!SplittedCommand.at(1).compare("vmm")) { + // + // Check to make sure that the driver is not already loaded + // + if (g_DeviceHandle) + { + ShowMessages("Handle of driver found, if you use 'load' before, please " + "first unload it then call 'unload'.\n"); + return; + } + // // Load VMM Module // @@ -146,7 +157,7 @@ CommandLoad(vector SplittedCommand, string Command) // // Module not found // - ShowMessages("module not found, currently, 'vmm' is the only available " + ShowMessages("module not found, currently 'vmm' is the only available " "module for HyperDbg.\n"); } } diff --git a/hyperdbg/hprdbgctrl/unload.cpp b/hyperdbg/hprdbgctrl/unload.cpp index 800f3000..89281bed 100644 --- a/hyperdbg/hprdbgctrl/unload.cpp +++ b/hyperdbg/hprdbgctrl/unload.cpp @@ -27,8 +27,9 @@ CommandUnloadHelp() { ShowMessages( "unload : unloads the kernel modules and uninstalls the drivers.\n\n"); - ShowMessages("syntax : \tunload [Module Name]\n"); + ShowMessages("syntax : \tunload [remove] [Module Name]\n"); ShowMessages("\t\te.g : unload vmm\n"); + ShowMessages("\t\te.g : unload remove vmm\n"); } /** @@ -41,7 +42,7 @@ CommandUnloadHelp() VOID CommandUnload(vector SplittedCommand, string Command) { - if (SplittedCommand.size() != 2) + if (SplittedCommand.size() != 2 && SplittedCommand.size() != 3) { ShowMessages("incorrect use of 'unload'\n\n"); CommandUnloadHelp(); @@ -51,7 +52,8 @@ CommandUnload(vector SplittedCommand, string Command) // // Check for the module // - if (!SplittedCommand.at(1).compare("vmm")) + if ((SplittedCommand.size() == 2 && !SplittedCommand.at(1).compare("vmm")) || + (SplittedCommand.size() == 3 && !SplittedCommand.at(2).compare("vmm") && !SplittedCommand.at(1).compare("remove"))) { if (!g_IsConnectedToHyperDbgLocally) { @@ -64,12 +66,23 @@ CommandUnload(vector SplittedCommand, string Command) { HyperdbgUnload(); - // - // Uninstalling Driver - // - if (HyperdbgUninstallDriver()) + if (!SplittedCommand.at(1).compare("remove")) { - ShowMessages("Failed to uninstall driver\n"); + // + // Stop the driver + // + if (HyperdbgStopDriver()) + { + ShowMessages("Failed to stop driver\n"); + } + + // + // Uninstall the driver + // + if (HyperdbgUninstallDriver()) + { + ShowMessages("Failed to uninstall the driver\n"); + } } } else @@ -82,7 +95,7 @@ CommandUnload(vector SplittedCommand, string Command) // // Module not found // - ShowMessages("module not found, currently, 'vmm' is the only available " + ShowMessages("module not found, currently 'vmm' is the only available " "module for HyperDbg.\n"); } } diff --git a/hyperdbg/hprdbghv/Ioctl.c b/hyperdbg/hprdbghv/Ioctl.c index a4921679..7c25674d 100644 --- a/hyperdbg/hprdbghv/Ioctl.c +++ b/hyperdbg/hprdbghv/Ioctl.c @@ -106,7 +106,10 @@ DrvDispatchIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) // // Send an immediate message, and we're no longer get new IRP // - LogInfoImmediate("An immediate message recieved, we no longer recieve IRPs from user-mode "); + LogSendBuffer(OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS, + "$", + 1); + Status = STATUS_SUCCESS; break; case IOCTL_TERMINATE_VMX: diff --git a/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp b/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp index 18fcafbc..91a78c1e 100644 --- a/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp +++ b/hyperdbg/hyperdbg-cli/hyperdbg-cli.cpp @@ -30,6 +30,7 @@ __declspec(dllimport) int HyperdbgLoadVmm(); __declspec(dllimport) int HyperdbgUnload(); __declspec(dllimport) int HyperdbgInstallVmmDriver(); __declspec(dllimport) int HyperdbgUninstallDriver(); +__declspec(dllimport) int HyperdbgStopDriver(); __declspec(dllimport) int HyperdbgInterpreter(const char * Command); __declspec(dllexport) void HyperdbgShowSignature(); __declspec(dllimport) void HyperdbgSetTextMessageCallback(Callback handler); diff --git a/hyperdbg/include/Definition.h b/hyperdbg/include/Definition.h index 435c00aa..2c759a0d 100644 --- a/hyperdbg/include/Definition.h +++ b/hyperdbg/include/Definition.h @@ -170,6 +170,8 @@ #define OPERATION_DEBUGGEE_CLEAR_EVENTS 0xA | OPERATION_MANDATORY_DEBUGGEE_BIT #define OPERATION_HYPERVISOR_DRIVER_IS_SUCCESSFULLY_LOADED \ 0xB | OPERATION_MANDATORY_DEBUGGEE_BIT +#define OPERATION_HYPERVISOR_DRIVER_END_OF_IRPS \ + 0xC | OPERATION_MANDATORY_DEBUGGEE_BIT ////////////////////////////////////////////////// // Test Cases // @@ -1865,4 +1867,4 @@ typedef struct _DEBUGGEE_EVENT_AND_ACTION_HEADER_FOR_REMOTE_PACKET * */ #define IOCTL_SEND_GENERAL_BUFFER_FROM_DEBUGGEE_TO_DEBUGGER \ - CTL_CODE(FILE_DEVICE_UNKNOWN, 0x815, METHOD_BUFFERED, FILE_ANY_ACCESS) \ No newline at end of file + CTL_CODE(FILE_DEVICE_UNKNOWN, 0x815, METHOD_BUFFERED, FILE_ANY_ACCESS)