diff --git a/hyperdbg/hyperhv/code/hooks/ept-hook/ExecTrap.c b/hyperdbg/hyperhv/code/hooks/ept-hook/ExecTrap.c index 3cdfd1ba..fd7da237 100644 --- a/hyperdbg/hyperhv/code/hooks/ept-hook/ExecTrap.c +++ b/hyperdbg/hyperhv/code/hooks/ept-hook/ExecTrap.c @@ -802,7 +802,7 @@ ExecTrapHandleEptViolationVmexit(VIRTUAL_MACHINE_STATE * VCpu, // // Trigger the event // - DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_USER_MODE, TRUE); + DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_USER_MODE); return TRUE; } @@ -821,7 +821,7 @@ ExecTrapHandleEptViolationVmexit(VIRTUAL_MACHINE_STATE * VCpu, // // Trigger the event // - DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE, TRUE); + DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE); } else { @@ -872,7 +872,7 @@ ExecTrapHandleCr3Vmexit(VIRTUAL_MACHINE_STATE * VCpu) // // Trigger the event // - DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE, TRUE); + DispatchEventMode(VCpu, DEBUGGER_EVENT_MODE_TYPE_KERNEL_MODE); } else if (VCpu->MbecEnabled) { diff --git a/hyperdbg/hyperhv/code/interface/Dispatch.c b/hyperdbg/hyperhv/code/interface/Dispatch.c index 689d8480..5024ed2b 100644 --- a/hyperdbg/hyperhv/code/interface/Dispatch.c +++ b/hyperdbg/hyperhv/code/interface/Dispatch.c @@ -303,12 +303,11 @@ DispatchEventVmcall(VIRTUAL_MACHINE_STATE * VCpu) * @param VCpu The virtual processor's state * @param IsUserMode Whether the execution event caused by a switch from kernel-to-user * or otherwise user-to-kernel - * @param HandleState whether the state should be handled by dispatcher or not * * @return VOID */ VOID -DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode, BOOLEAN HandleState) +DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode) { VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE EventTriggerResult; BOOLEAN PostEventTriggerReq = FALSE; @@ -321,7 +320,7 @@ DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetM // // check for user-mode thread interception // - if (DebuggingCallbackCheckThreadInterception(VCpu->CoreId)) + if (TargetMode == DEBUGGER_EVENT_MODE_TYPE_USER_MODE && DebuggingCallbackCheckThreadInterception(VCpu->CoreId)) { // // If the thread is intercepted, we should not trigger the event @@ -349,7 +348,7 @@ DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetM // // Check whether we need to short-circuiting event emulation or not // - if (EventTriggerResult != VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_IGNORE_EVENT && HandleState) + if (EventTriggerResult != VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_IGNORE_EVENT) { // // Handle the user-mode/kernel-mode execution trap event in the case of triggering event @@ -367,10 +366,7 @@ DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetM // Otherwise and if there is no event, we should handle the // user-mode/kernel-mode execution trap normally // - if (HandleState) - { - ExecTrapHandleMoveToAdjustedTrapState(VCpu, (UINT64)TargetMode); - } + ExecTrapHandleMoveToAdjustedTrapState(VCpu, (UINT64)TargetMode); } } diff --git a/hyperdbg/hyperhv/header/interface/Dispatch.h b/hyperdbg/hyperhv/header/interface/Dispatch.h index 7ec91d77..f771bdd8 100644 --- a/hyperdbg/hyperhv/header/interface/Dispatch.h +++ b/hyperdbg/hyperhv/header/interface/Dispatch.h @@ -32,7 +32,7 @@ VOID DispatchEventVmcall(VIRTUAL_MACHINE_STATE * VCpu); VOID -DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode, BOOLEAN HandleState); +DispatchEventMode(VIRTUAL_MACHINE_STATE * VCpu, DEBUGGER_EVENT_MODE_TYPE TargetMode); VOID DispatchEventMovToCr3(VIRTUAL_MACHINE_STATE * VCpu); diff --git a/hyperdbg/hyperkd/code/debugger/user-level/Attaching.c b/hyperdbg/hyperkd/code/debugger/user-level/Attaching.c index 58d3bdaa..f9b4f2fd 100644 --- a/hyperdbg/hyperkd/code/debugger/user-level/Attaching.c +++ b/hyperdbg/hyperkd/code/debugger/user-level/Attaching.c @@ -627,17 +627,6 @@ AttachingCheckThreadInterceptionWithUserDebugger(UINT32 CoreId) return FALSE; } - // - // Check if thread is in user-mode - // - if (VmFuncGetLastVmexitRip(DbgState->CoreId) & 0xf000000000000000) - { - // - // We won't intercept threads in kernel-mode - // - return FALSE; - } - ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(HANDLE_TO_UINT32(PsGetCurrentProcessId())); // @@ -735,6 +724,9 @@ AttachingConfigureInterceptingThreads(UINT64 ProcessDebuggingToken, BOOLEAN Enab } else { + // + // Remove the process from the watching list + // ConfigureExecTrapRemoveProcessFromWatchingList(ProcessDebuggingDetail->ProcessId); } @@ -1102,13 +1094,16 @@ AttachingContinueProcess(PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS ContinueReque return FALSE; } + // + // Unpause the threads of the target process + // + ThreadHolderUnpauseAllThreadsInProcess(ProcessDebuggingDetails); + + // + // Configure the intercepting threads to be disabled + // if (AttachingConfigureInterceptingThreads(ContinueRequest->Token, FALSE)) { - // - // Unpause the threads of the target process - // - ThreadHolderUnpauseAllThreadsInProcess(ProcessDebuggingDetails); - // // The continuing operation was successful // diff --git a/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/g.cpp b/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/g.cpp index bd651073..5530df30 100644 --- a/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/g.cpp +++ b/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/g.cpp @@ -76,7 +76,7 @@ CommandGRequest() } else { - ShowMessages("err, target process is already running\n"); + ShowMessages("the target process is already running\n"); } } } diff --git a/hyperdbg/libhyperdbg/code/debugger/user-level/ud.cpp b/hyperdbg/libhyperdbg/code/debugger/user-level/ud.cpp index 333f375b..4e7ecd09 100644 --- a/hyperdbg/libhyperdbg/code/debugger/user-level/ud.cpp +++ b/hyperdbg/libhyperdbg/code/debugger/user-level/ud.cpp @@ -776,7 +776,7 @@ UdDetachProcess(UINT32 TargetPid, UINT64 ProcessDetailToken) // Send the continue command to the target process as we // want to continue the debuggee process before detaching // - UdPauseProcess(ProcessDetailToken); + UdContinueProcess(ProcessDetailToken); // // We wanna detach a process