diff --git a/CHANGELOG.md b/CHANGELOG.md index 3ed5e22f..2b8bf402 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,6 +14,7 @@ New release of the HyperDbg Debugger. ### Changed - Fix clearing '!monitor' hooks on a different process or if the process is closed (#409) ([link](https://github.com/HyperDbg/HyperDbg/issues/409)) +- Fix triggering multiple '!monitor' hooks with different contexts (#415) ([link](https://github.com/HyperDbg/HyperDbg/issues/415)) ## [0.9.1.0] - 2024-06-30 New release of the HyperDbg Debugger. diff --git a/hyperdbg/hyperkd/code/debugger/core/Debugger.c b/hyperdbg/hyperkd/code/debugger/core/Debugger.c index 6c8a9167..af800d4c 100644 --- a/hyperdbg/hyperkd/code/debugger/core/Debugger.c +++ b/hyperdbg/hyperkd/code/debugger/core/Debugger.c @@ -1113,12 +1113,13 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType, BOOLEAN * PostEventRequired, GUEST_REGS * Regs) { + PROCESSOR_DEBUGGING_STATE * DbgState = NULL; DebuggerCheckForCondition * ConditionFunc; DEBUGGER_TRIGGERED_EVENT_DETAILS EventTriggerDetail = {0}; PEPT_HOOKS_CONTEXT EptContext; - PLIST_ENTRY TempList = 0; - PLIST_ENTRY TempList2 = 0; - PROCESSOR_DEBUGGING_STATE * DbgState = NULL; + PLIST_ENTRY TempList = 0; + PLIST_ENTRY TempList2 = 0; + const PVOID OriginalContext = Context; // // Check if triggering debugging actions are allowed or not @@ -1224,14 +1225,17 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType, // we get the events for all hidden hooks in a page granularity // - EptContext = (PEPT_HOOKS_CONTEXT)Context; + // + // Here the OriginalContext is used because the context + // might be changed but the OriginalContext is constant + // + EptContext = (PEPT_HOOKS_CONTEXT)OriginalContext; // - // Context should be checked with hooking tag + // EPT context should be checked with hooking tag // The hooking tag is same as the event tag if both // of them match together // - if (EptContext->HookingTag != CurrentEvent->Tag) { // @@ -1273,6 +1277,12 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType, case HIDDEN_HOOK_EXEC_DETOURS: + // + // Here the OriginalContext is used because the context + // might be changed but the OriginalContext is constant + // + EptContext = (PEPT_HOOKS_CONTEXT)OriginalContext; + // // Here we check if it's HIDDEN_HOOK_EXEC_DETOURS // then it means that it's detours hidden hook exec so we have @@ -1284,7 +1294,7 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType, // This way we are sure that no one can bypass our hook by remapping // address to another virtual address as everything is physical // - if (((PEPT_HOOKS_CONTEXT)Context)->PhysicalAddress != CurrentEvent->Options.OptionalParam1) + if (EptContext->PhysicalAddress != CurrentEvent->Options.OptionalParam1) { // // Context is the physical address @@ -1300,7 +1310,7 @@ DebuggerTriggerEvents(VMM_EVENT_TYPE_ENUM EventType, // // Convert it to virtual address // - Context = (PVOID)(((PEPT_HOOKS_CONTEXT)Context)->VirtualAddress); + Context = (PVOID)(EptContext->VirtualAddress); } break; @@ -1789,7 +1799,6 @@ DebuggerPerformRunTheCustomCode(PROCESSOR_DEBUGGING_STATE * DbgState, * @param DbgState The state of the debugger on the current core * @param Tag Tag of event * @param Action Action object - * @param Context Optional parameter * @param EventTriggerDetail Event trigger detail * * @return VOID diff --git a/hyperdbg/libhyperdbg/code/debugger/commands/meta-commands/sym.cpp b/hyperdbg/libhyperdbg/code/debugger/commands/meta-commands/sym.cpp index 04c4c508..4e7ab3da 100644 --- a/hyperdbg/libhyperdbg/code/debugger/commands/meta-commands/sym.cpp +++ b/hyperdbg/libhyperdbg/code/debugger/commands/meta-commands/sym.cpp @@ -37,6 +37,7 @@ CommandSymHelp() ShowMessages("\n"); ShowMessages("\t\te.g : .sym table\n"); ShowMessages("\t\te.g : .sym reload\n"); + ShowMessages("\t\te.g : .sym reload pid 3a24\n"); ShowMessages("\t\te.g : .sym load\n"); ShowMessages("\t\te.g : .sym download\n"); ShowMessages("\t\te.g : .sym add base fffff8077356000 path c:\\symbols\\my_dll.pdb\n");