vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-08-31 01:56:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix triggering multiple monitor hooks with different contexts (#415)

Browse source
This commit is contained in:
SinaKarvandi 2024-07-08 17:50:40 +09:00
parent 547415a9be
commit c8113aa796
3 changed files with 20 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

1
CHANGELOG.md
View file

@ -14,6 +14,7 @@ New release of the HyperDbg Debugger.
### Changed
- Fix clearing '!monitor' hooks on a different process or if the process is closed (#409) ([link](https://github.com/HyperDbg/HyperDbg/issues/409))
- Fix triggering multiple '!monitor' hooks with different contexts (#415) ([link](https://github.com/HyperDbg/HyperDbg/issues/415))
## [0.9.1.0] - 2024-06-30
New release of the HyperDbg Debugger.

27
hyperdbg/hyperkd/code/debugger/core/Debugger.c
View file

@ -1113,12 +1113,13 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType,
BOOLEAN * PostEventRequired,
GUEST_REGS * Regs)
{
PROCESSOR_DEBUGGING_STATE * DbgState = NULL;
DebuggerCheckForCondition * ConditionFunc;
DEBUGGER_TRIGGERED_EVENT_DETAILS EventTriggerDetail = {0};
PEPT_HOOKS_CONTEXT EptContext;
PLIST_ENTRY TempList = 0;
PLIST_ENTRY TempList2 = 0;
PROCESSOR_DEBUGGING_STATE * DbgState = NULL;
PLIST_ENTRY TempList = 0;
PLIST_ENTRY TempList2 = 0;
const PVOID OriginalContext = Context;
//
// Check if triggering debugging actions are allowed or not
@ -1224,14 +1225,17 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType,
// we get the events for all hidden hooks in a page granularity
//
EptContext = (PEPT_HOOKS_CONTEXT)Context;
//
// Here the OriginalContext is used because the context
// might be changed but the OriginalContext is constant
//
EptContext = (PEPT_HOOKS_CONTEXT)OriginalContext;
//
// Context should be checked with hooking tag
// EPT context should be checked with hooking tag
// The hooking tag is same as the event tag if both
// of them match together
//
if (EptContext->HookingTag != CurrentEvent->Tag)
{
//
@ -1273,6 +1277,12 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType,
case HIDDEN_HOOK_EXEC_DETOURS:
//
// Here the OriginalContext is used because the context
// might be changed but the OriginalContext is constant
//
EptContext = (PEPT_HOOKS_CONTEXT)OriginalContext;
//
// Here we check if it's HIDDEN_HOOK_EXEC_DETOURS
// then it means that it's detours hidden hook exec so we have
@ -1284,7 +1294,7 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType,
// This way we are sure that no one can bypass our hook by remapping
// address to another virtual address as everything is physical
//
if (((PEPT_HOOKS_CONTEXT)Context)->PhysicalAddress != CurrentEvent->Options.OptionalParam1)
if (EptContext->PhysicalAddress != CurrentEvent->Options.OptionalParam1)
{
//
// Context is the physical address
@ -1300,7 +1310,7 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType,
//
// Convert it to virtual address
//
Context = (PVOID)(((PEPT_HOOKS_CONTEXT)Context)->VirtualAddress);
Context = (PVOID)(EptContext->VirtualAddress);
}
break;
@ -1789,7 +1799,6 @@ DebuggerPerformRunTheCustomCode(PROCESSOR_DEBUGGING_STATE * DbgState,
* @param DbgState The state of the debugger on the current core
* @param Tag Tag of event
* @param Action Action object
* @param Context Optional parameter
* @param EventTriggerDetail Event trigger detail
*
* @return VOID

1
hyperdbg/libhyperdbg/code/debugger/commands/meta-commands/sym.cpp
View file

@ -37,6 +37,7 @@ CommandSymHelp()
ShowMessages("\n");
ShowMessages("\t\te.g : .sym table\n");
ShowMessages("\t\te.g : .sym reload\n");
ShowMessages("\t\te.g : .sym reload pid 3a24\n");
ShowMessages("\t\te.g : .sym load\n");
ShowMessages("\t\te.g : .sym download\n");
ShowMessages("\t\te.g : .sym add base fffff8077356000 path c:\\symbols\\my_dll.pdb\n");