vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

only apply thread interception to user mode

Browse source
This commit is contained in:
sina 2025-06-24 18:12:02 +02:00
parent a05cdcdd1c
commit cc8167c089
No known key found for this signature in database
6 changed files with 21 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hyperdbg/hyperhv/code/hooks/ept-hook/ExecTrap.c
View file

@ -802,7 +802,7 @@ ExecTrapHandleEptViolationVmexit(VIRTUAL_MACHINE_STATE * VCpu,
//
// Trigger the event
//
DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_USER_MODE, TRUE);
DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_USER_MODE);
return TRUE;
}
@ -821,7 +821,7 @@ ExecTrapHandleEptViolationVmexit(VIRTUAL_MACHINE_STATE * VCpu,
//
// Trigger the event
//
DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE, TRUE);
DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE);
}
else
{
@ -872,7 +872,7 @@ ExecTrapHandleCr3Vmexit(VIRTUAL_MACHINE_STATE * VCpu)
//
// Trigger the event
//
DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE, TRUE);
DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE);
}
else if (VCpu->MbecEnabled)
{

12
hyperdbg/hyperhv/code/interface/Dispatch.c
View file

@ -303,12 +303,11 @@ DispatchEventVmcall(VIRTUAL_MACHINE_STATE * VCpu)
* @param VCpu The virtual processor's state
* @param IsUserMode Whether the execution event caused by a switch from kernel-to-user
* or otherwise user-to-kernel
* @param HandleState whether the state should be handled by dispatcher or not
*
* @return VOID
*/
VOID
DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode, BOOLEAN HandleState)
DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode)
{
VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE EventTriggerResult;
BOOLEAN PostEventTriggerReq = FALSE;
@ -321,7 +320,7 @@ DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetM
//
// check for user-mode thread interception
//
if (DebuggingCallbackCheckThreadInterception(VCpu->CoreId))
if (TargetMode == DEBUGGER_EVENT_MODE_TYPE_USER_MODE && DebuggingCallbackCheckThreadInterception(VCpu->CoreId))
{
//
// If the thread is intercepted, we should not trigger the event
@ -349,7 +348,7 @@ DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetM
//
// Check whether we need to short-circuiting event emulation or not
//
if (EventTriggerResult != VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_IGNORE_EVENT && HandleState)
if (EventTriggerResult != VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_IGNORE_EVENT)
{
//
// Handle the user-mode/kernel-mode execution trap event in the case of triggering event
@ -367,10 +366,7 @@ DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetM
// Otherwise and if there is no event, we should handle the
// user-mode/kernel-mode execution trap normally
//
if (HandleState)
{
ExecTrapHandleMoveToAdjustedTrapState(VCpu, (UINT64)TargetMode);
}
ExecTrapHandleMoveToAdjustedTrapState(VCpu, (UINT64)TargetMode);
}
}

2
hyperdbg/hyperhv/header/interface/Dispatch.h
View file

@ -32,7 +32,7 @@ VOID
DispatchEventVmcall(VIRTUAL_MACHINE_STATE * VCpu);
VOID
DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode, BOOLEAN HandleState);
DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode);
VOID
DispatchEventMovToCr3(VIRTUAL_MACHINE_STATE * VCpu);

27
hyperdbg/hyperkd/code/debugger/user-level/Attaching.c
View file

@ -627,17 +627,6 @@ AttachingCheckThreadInterceptionWithUserDebugger(UINT32 CoreId)
return FALSE;
}
//
// Check if thread is in user-mode
//
if (VmFuncGetLastVmexitRip(DbgState->CoreId) & 0xf000000000000000)
{
//
// We won't intercept threads in kernel-mode
//
return FALSE;
}
ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(HANDLE_TO_UINT32(PsGetCurrentProcessId()));
//
@ -735,6 +724,9 @@ AttachingConfigureInterceptingThreads(UINT64 ProcessDebuggingToken, BOOLEAN Enab
}
else
{
//
// Remove the process from the watching list
//
ConfigureExecTrapRemoveProcessFromWatchingList(ProcessDebuggingDetail->ProcessId);
}
@ -1102,13 +1094,16 @@ AttachingContinueProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS ContinueReque
return FALSE;
}
//
// Unpause the threads of the target process
//
ThreadHolderUnpauseAllThreadsInProcess(ProcessDebuggingDetails);
//
// Configure the intercepting threads to be disabled
//
if (AttachingConfigureInterceptingThreads(ContinueRequest->Token, FALSE))
{
//
// Unpause the threads of the target process
//
ThreadHolderUnpauseAllThreadsInProcess(ProcessDebuggingDetails);
//
// The continuing operation was successful
//

2
hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/g.cpp
View file

@ -76,7 +76,7 @@ CommandGRequest()
}
else
{
ShowMessages("err, target process is already running\n");
ShowMessages("the target process is already running\n");
}
}
}

2
hyperdbg/libhyperdbg/code/debugger/user-level/ud.cpp
View file

@ -776,7 +776,7 @@ UdDetachProcess(UINT32 TargetPid, UINT64 ProcessDetailToken)
// Send the continue command to the target process as we
// want to continue the debuggee process before detaching
//
UdPauseProcess(ProcessDetailToken);
UdContinueProcess(ProcessDetailToken);
//
// We wanna detach a process