diff --git a/hyperdbg/hprdbgctrl/bp.cpp b/hyperdbg/hprdbgctrl/bp.cpp index 6b50cf33..76c83167 100644 --- a/hyperdbg/hprdbgctrl/bp.cpp +++ b/hyperdbg/hprdbgctrl/bp.cpp @@ -134,7 +134,7 @@ CommandBp(vector SplittedCommand, string Command) if (!SetAddress) { - if (!SymConvertObjectNameOrStringToUInt64(Section, &Address)) + if (!SymbolConvertNameToAddress(Section, &Address)) { ShowMessages("please specify a correct hex value or a function name as address\n\n"); CommandBpHelp(); diff --git a/hyperdbg/hprdbgctrl/d-u.cpp b/hyperdbg/hprdbgctrl/d-u.cpp index afb0d7ea..2b3a8f1f 100644 --- a/hyperdbg/hprdbgctrl/d-u.cpp +++ b/hyperdbg/hprdbgctrl/d-u.cpp @@ -122,7 +122,7 @@ CommandReadMemoryAndDisassembler(vector SplittedCommand, // if (TargetAddress == 0) { - if (!SymConvertObjectNameOrStringToUInt64(Section, &TargetAddress)) + if (!SymbolConvertNameToAddress(Section, &TargetAddress)) { ShowMessages("err, you should enter a valid address or object name\n"); return; diff --git a/hyperdbg/hprdbgctrl/debugger.cpp b/hyperdbg/hprdbgctrl/debugger.cpp index 26d7b757..94c9546d 100644 --- a/hyperdbg/hprdbgctrl/debugger.cpp +++ b/hyperdbg/hprdbgctrl/debugger.cpp @@ -185,6 +185,37 @@ ShowErrorMessage(UINT32 Error) return TRUE; } +/** + * @brief Get ntoskrnl.exe base in the kernel + * + * @return UINT64 Base address of ntoskrnl.exe + */ +UINT64 +DebuggerGetNtoskrnlBase() +{ + UINT64 NtoskrnlBase = NULL; + PRTL_PROCESS_MODULES Modules = NULL; + + Modules = (PRTL_PROCESS_MODULES)malloc(1024 * 1024); + + NtQuerySystemInformation((SYSTEM_INFORMATION_CLASS)11, Modules, 1024 * 1024, NULL); + + for (int i = 0; i < Modules->NumberOfModules; i++) + { + if (!strcmp((const char *)Modules->Modules[i].FullPathName + + Modules->Modules[i].OffsetToFileName, + "ntoskrnl.exe")) + { + NtoskrnlBase = (UINT64)Modules->Modules[i].ImageBase; + break; + } + } + + free(Modules); + + return NtoskrnlBase; +} + /** * @brief pauses the debuggee * diff --git a/hyperdbg/hprdbgctrl/debugger.h b/hyperdbg/hprdbgctrl/debugger.h index 1a848a2b..864d76a6 100644 --- a/hyperdbg/hprdbgctrl/debugger.h +++ b/hyperdbg/hprdbgctrl/debugger.h @@ -15,7 +15,10 @@ // Pdb Parser Wrapper (from script-engine) // ////////////////////////////////////////////////// UINT64 -ScriptEnginePdbParserWrapper(const char * FunctionName, PBOOLEAN WasFound); +ScriptEngineConvertNameToAddressWrapper(const char * FunctionName, PBOOLEAN WasFound); + +UINT64 +ScriptEngineLoadFileSymbolWrapper(UINT64 BaseAddress, const char * FileName, const char * Guid); ////////////////////////////////////////////////// // Script Engine Wrapper // @@ -27,7 +30,7 @@ ScriptEngineWrapperTestParser(string Expr); PVOID ScriptEngineParseWrapper(char * str); -void +VOID PrintSymbolBufferWrapper(PVOID SymbolBuffer); UINT64 @@ -52,7 +55,10 @@ ListeningSerialPauseDebuggerThread(PVOID Param); // For symbol (pdb) parsing // BOOLEAN -SymConvertObjectNameOrStringToUInt64(string TextToConvert, PUINT64 Result); +SymbolConvertNameToAddress(string TextToConvert, PUINT64 Result); + +BOOLEAN +SymbolLoadNtoskrnlSymbol(UINT64 BaseAddress); ////////////////////////////////////////////////// // Structures // @@ -92,6 +98,9 @@ IsConnectedToAnyInstanceOfDebuggerOrDebuggee(); BOOLEAN IsTagExist(UINT64 Tag); +UINT64 +DebuggerGetNtoskrnlBase(); + BOOLEAN DebuggerPauseDebuggee(); diff --git a/hyperdbg/hprdbgctrl/e.cpp b/hyperdbg/hprdbgctrl/e.cpp index 04d729c6..84a8bd28 100644 --- a/hyperdbg/hprdbgctrl/e.cpp +++ b/hyperdbg/hprdbgctrl/e.cpp @@ -151,7 +151,7 @@ CommandEditMemory(vector SplittedCommand, string Command) if (!SetAddress) { - if (!SymConvertObjectNameOrStringToUInt64(Section, &Address)) + if (!SymbolConvertNameToAddress(Section, &Address)) { ShowMessages("please specify a correct hex address or object name to edit\n\n"); CommandEditMemoryHelp(); diff --git a/hyperdbg/hprdbgctrl/epthook.cpp b/hyperdbg/hprdbgctrl/epthook.cpp index e7c4397d..16addaaf 100644 --- a/hyperdbg/hprdbgctrl/epthook.cpp +++ b/hyperdbg/hprdbgctrl/epthook.cpp @@ -93,7 +93,7 @@ CommandEptHook(vector SplittedCommand, string Command) // // It's probably address // - if (!SymConvertObjectNameOrStringToUInt64(Section, &OptionalParam1)) + if (!SymbolConvertNameToAddress(Section, &OptionalParam1)) { // // Unkonwn parameter diff --git a/hyperdbg/hprdbgctrl/epthook2.cpp b/hyperdbg/hprdbgctrl/epthook2.cpp index 3069352d..4585764c 100644 --- a/hyperdbg/hprdbgctrl/epthook2.cpp +++ b/hyperdbg/hprdbgctrl/epthook2.cpp @@ -93,7 +93,7 @@ CommandEptHook2(vector SplittedCommand, string Command) // // It's probably address // - if (!SymConvertObjectNameOrStringToUInt64(Section, &OptionalParam1)) + if (!SymbolConvertNameToAddress(Section, &OptionalParam1)) { // // Unkonwn parameter diff --git a/hyperdbg/hprdbgctrl/hprdbgctrl.cpp b/hyperdbg/hprdbgctrl/hprdbgctrl.cpp index 6fd963ff..4f82e196 100644 --- a/hyperdbg/hprdbgctrl/hprdbgctrl.cpp +++ b/hyperdbg/hprdbgctrl/hprdbgctrl.cpp @@ -28,6 +28,7 @@ extern BOOLEAN g_BreakPrintingOutput; extern BOOLEAN g_IsConnectedToRemoteDebugger; extern BOOLEAN g_OutputSourcesInitialized; extern BOOLEAN g_IsSerialConnectedToRemoteDebugger; +extern BOOLEAN g_IsConnectedToHyperDbgLocally; extern LIST_ENTRY g_OutputSources; /** diff --git a/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj b/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj index 852f3137..921ebe27 100644 --- a/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj +++ b/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj @@ -183,7 +183,7 @@ - + diff --git a/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters b/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters index df1b0053..7b4d461e 100644 --- a/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters +++ b/hyperdbg/hprdbgctrl/hprdbgctrl.vcxproj.filters @@ -308,9 +308,6 @@ Resource Files\Source Files\Debugger\Commands\Debugging Commands - - Resource Files\Source Files\Debugger\Implementations - Resource Files\Source Files\Debugger\Communication @@ -377,6 +374,9 @@ Resource Files\Source Files\Debugger\Commands\Meta Commands + + Resource Files\Source Files\Debugger\Implementations + diff --git a/hyperdbg/hprdbgctrl/interpreter.cpp b/hyperdbg/hprdbgctrl/interpreter.cpp index 4953aab5..f247ca45 100644 --- a/hyperdbg/hprdbgctrl/interpreter.cpp +++ b/hyperdbg/hprdbgctrl/interpreter.cpp @@ -475,5 +475,5 @@ InitializeCommandsDictionary() g_CommandList[".sympath"] = {&CommandSympath, &CommandSympathHelp, DEBUGGER_COMMAND_SYMPATH_ATTRIBUTES}; - g_CommandList[".sym"] = {&CommandSym, &CommandSymHelp, DEBUGGER_COMMAND_SYM_ATTRIBUTES}; + g_CommandList[".sym"] = {&CommandSym, &CommandSymHelp, DEBUGGER_COMMAND_SYM_ATTRIBUTES}; } diff --git a/hyperdbg/hprdbgctrl/kd.cpp b/hyperdbg/hprdbgctrl/kd.cpp index 9547f2a5..6716c3f7 100644 --- a/hyperdbg/hprdbgctrl/kd.cpp +++ b/hyperdbg/hprdbgctrl/kd.cpp @@ -1748,6 +1748,11 @@ KdPrepareAndConnectDebugPort(const char * PortName, DWORD Baudrate, UINT32 Port, DebuggeeRequest->PortAddress = Port; DebuggeeRequest->Baudrate = Baudrate; + // + // Get base address of ntoskrnl + // + DebuggeeRequest->NtoskrnlBaseAddress = DebuggerGetNtoskrnlBase(); + // // Set the debuggee name, version, and build number // @@ -1756,7 +1761,7 @@ KdPrepareAndConnectDebugPort(const char * PortName, DWORD Baudrate, UINT32 Port, // // It's not an error if it returned null // - /*return FALSE;*/ + // return FALSE; } // diff --git a/hyperdbg/hprdbgctrl/listening.cpp b/hyperdbg/hprdbgctrl/listening.cpp index db7d7968..7f66d533 100644 --- a/hyperdbg/hprdbgctrl/listening.cpp +++ b/hyperdbg/hprdbgctrl/listening.cpp @@ -40,6 +40,7 @@ extern DEBUGGER_EVENT_AND_ACTION_REG_BUFFER BOOLEAN ListeningSerialPortInDebugger() { + PDEBUGGER_PREPARE_DEBUGGEE InitPacket; PDEBUGGER_REMOTE_PACKET TheActualPacket; PDEBUGGEE_PAUSED_PACKET PausePacket; PDEBUGGEE_MESSAGE_PACKET MessagePacket; @@ -136,8 +137,17 @@ StartAgain: { case DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_STARTED: - ShowMessages("connected to debuggee %s\n", - ((CHAR *)TheActualPacket) + sizeof(DEBUGGER_REMOTE_PACKET)); + InitPacket = + (DEBUGGER_PREPARE_DEBUGGEE *)(((CHAR *)TheActualPacket) + + sizeof(DEBUGGER_REMOTE_PACKET)); + + ShowMessages("connected to debuggee %s\n", InitPacket->OsName); + + // + // initialize symbol (pdb) server for debuggee's ntoskrnl + // + SymbolLoadNtoskrnlSymbol(InitPacket->NtoskrnlBaseAddress); + ShowMessages("press CTRL+C to pause the debuggee\n"); // diff --git a/hyperdbg/hprdbgctrl/load.cpp b/hyperdbg/hprdbgctrl/load.cpp index 530916d7..70e74e90 100644 --- a/hyperdbg/hprdbgctrl/load.cpp +++ b/hyperdbg/hprdbgctrl/load.cpp @@ -155,6 +155,11 @@ CommandLoad(vector SplittedCommand, string Command) ShowMessages("failed to install or load the driver\n"); return; } + + // + // If in vmi-mode then initialize the symbol server for local debugging + // + SymbolLoadNtoskrnlSymbol(DebuggerGetNtoskrnlBase()); } else { diff --git a/hyperdbg/hprdbgctrl/monitor.cpp b/hyperdbg/hprdbgctrl/monitor.cpp index 833f0ecc..798c5ebf 100644 --- a/hyperdbg/hprdbgctrl/monitor.cpp +++ b/hyperdbg/hprdbgctrl/monitor.cpp @@ -115,7 +115,7 @@ CommandMonitor(vector SplittedCommand, string Command) // if (!SetFrom) { - if (!SymConvertObjectNameOrStringToUInt64(Section, &OptionalParam1)) + if (!SymbolConvertNameToAddress(Section, &OptionalParam1)) { // // Unkonwn parameter @@ -128,7 +128,7 @@ CommandMonitor(vector SplittedCommand, string Command) } else if (!SetTo) { - if (!SymConvertObjectNameOrStringToUInt64(Section, &OptionalParam2)) + if (!SymbolConvertNameToAddress(Section, &OptionalParam2)) { // // Unkonwn parameter diff --git a/hyperdbg/hprdbgctrl/pa2va.cpp b/hyperdbg/hprdbgctrl/pa2va.cpp index 6a437266..111fde04 100644 --- a/hyperdbg/hprdbgctrl/pa2va.cpp +++ b/hyperdbg/hprdbgctrl/pa2va.cpp @@ -61,7 +61,7 @@ CommandPa2va(vector SplittedCommand, string Command) // // It's just a address for current process // - if (!SymConvertObjectNameOrStringToUInt64(SplittedCommand.at(1), &TargetPa)) + if (!SymbolConvertNameToAddress(SplittedCommand.at(1), &TargetPa)) { ShowMessages("incorrect address or object name, please enter a valid physical" " address\n\n"); @@ -80,7 +80,7 @@ CommandPa2va(vector SplittedCommand, string Command) ShowMessages("incorrect address, please enter a valid process id\n\n"); return; } - if (!SymConvertObjectNameOrStringToUInt64(SplittedCommand.at(3), &TargetPa)) + if (!SymbolConvertNameToAddress(SplittedCommand.at(3), &TargetPa)) { ShowMessages("incorrect address or object name, please enter a valid physical" " address\n\n"); @@ -89,7 +89,7 @@ CommandPa2va(vector SplittedCommand, string Command) } else if (!SplittedCommand.at(2).compare("pid")) { - if (!SymConvertObjectNameOrStringToUInt64(SplittedCommand.at(1), &TargetPa)) + if (!SymbolConvertNameToAddress(SplittedCommand.at(1), &TargetPa)) { ShowMessages("incorrect address or object name, please enter a valid physical" " address\n\n"); diff --git a/hyperdbg/hprdbgctrl/pte.cpp b/hyperdbg/hprdbgctrl/pte.cpp index 837d661c..fa1f06e7 100644 --- a/hyperdbg/hprdbgctrl/pte.cpp +++ b/hyperdbg/hprdbgctrl/pte.cpp @@ -47,7 +47,7 @@ CommandPte(vector SplittedCommand, string Command) return; } - if (!SymConvertObjectNameOrStringToUInt64(SplittedCommand.at(1), &TargetVa)) + if (!SymbolConvertNameToAddress(SplittedCommand.at(1), &TargetVa)) { ShowMessages("incorrect address or object name, please enter a valid virtual" " address\n\n"); diff --git a/hyperdbg/hprdbgctrl/s.cpp b/hyperdbg/hprdbgctrl/s.cpp index 40fc1448..4fbbfd96 100644 --- a/hyperdbg/hprdbgctrl/s.cpp +++ b/hyperdbg/hprdbgctrl/s.cpp @@ -192,7 +192,7 @@ CommandSearchMemory(vector SplittedCommand, string Command) if (!SetAddress) { - if (!SymConvertObjectNameOrStringToUInt64(Section, &Address)) + if (!SymbolConvertNameToAddress(Section, &Address)) { ShowMessages("please specify a correct hex address or object name to search\n\n"); CommandSearchMemoryHelp(); diff --git a/hyperdbg/hprdbgctrl/sewrapper.cpp b/hyperdbg/hprdbgctrl/script-engine-wrapper.cpp similarity index 75% rename from hyperdbg/hprdbgctrl/sewrapper.cpp rename to hyperdbg/hprdbgctrl/script-engine-wrapper.cpp index 5b0ea8f1..ad741c1e 100644 --- a/hyperdbg/hprdbgctrl/sewrapper.cpp +++ b/hyperdbg/hprdbgctrl/script-engine-wrapper.cpp @@ -1,5 +1,5 @@ /** - * @file debugger.cpp + * @file script-engine-wrapper.cpp * @author M.H. Gholamrezei (gholamrezaei.mh@gmail.com) * @author Sina Karvandi (sina@rayanfam.com) * @brief Interpret general fields @@ -24,17 +24,49 @@ extern UINT64 * g_ScriptGlobalVariables; // -// Pdb parse wrapper +// *********************** Pdb parse wrapper *********************** // + +/** + * @brief ScriptEngineConvertNameToAddress wrapper + * + * @param FunctionName + * @param WasFound + * + * @return UINT64 + */ UINT64 -ScriptEnginePdbParserWrapper(const char * FunctionName, PBOOLEAN WasFound) +ScriptEngineConvertNameToAddressWrapper(const char * FunctionName, PBOOLEAN WasFound) { - return ScriptEnginePdbParser(FunctionName, WasFound); + return ScriptEngineConvertNameToAddress(FunctionName, WasFound); +} + +/** + * @brief ScriptEngineLoadFileSymbol wrapper + * + * @param BaseAddress + * @param FileName + * @param Guid + * + * @return UINT64 + */ +UINT64 +ScriptEngineLoadFileSymbolWrapper(UINT64 BaseAddress, const char * FileName, const char * Guid) +{ + return ScriptEngineLoadFileSymbol(BaseAddress, FileName, Guid); } // -// Function links (wrapper) +// *********************** Function links (wrapper) *********************** // + +/** + * @brief ScriptEngineParse wrapper + * + * @param str + * + * @return PVOID + */ PVOID ScriptEngineParseWrapper(char * str) { @@ -59,18 +91,26 @@ ScriptEngineParseWrapper(char * str) } } -// -// Print symbol buffer wrapper -// -void +/** + * @brief PrintSymbolBuffer wrapper + * @details Print symbol buffer wrapper + * @param SymbolBuffer + * + * @return PVOID + */ +VOID PrintSymbolBufferWrapper(PVOID SymbolBuffer) { PrintSymbolBuffer((PSYMBOL_BUFFER)SymbolBuffer); } -// -// test function -// +/** + * @brief test function + * @param GuestRegs + * @param Expr + * + * @return VOID + */ VOID ScriptEngineWrapperTestPerformAction(PGUEST_REGS GuestRegs, string Expr) @@ -122,6 +162,12 @@ ScriptEngineWrapperTestPerformAction(PGUEST_REGS GuestRegs, return; } +/** + * @brief test parser + * @param Expr + * + * @return VOID + */ VOID ScriptEngineWrapperTestParser(string Expr) { @@ -176,12 +222,24 @@ ScriptEngineWrapperTestParser(string Expr) free(TestStruct); } +/** + * @brief wrapper for getting head + * @param SymbolBuffer + * + * @return UINT64 + */ UINT64 ScriptEngineWrapperGetHead(PVOID SymbolBuffer) { return (UINT64)((PSYMBOL_BUFFER)SymbolBuffer)->Head; } +/** + * @brief wrapper for getting size + * @param SymbolBuffer + * + * @return UINT32 + */ UINT32 ScriptEngineWrapperGetSize(PVOID SymbolBuffer) { @@ -190,12 +248,24 @@ ScriptEngineWrapperGetSize(PVOID SymbolBuffer) return Size; } +/** + * @brief wrapper for getting pointer + * @param SymbolBuffer + * + * @return UINT32 + */ UINT32 ScriptEngineWrapperGetPointer(PVOID SymbolBuffer) { return (UINT32)((PSYMBOL_BUFFER)SymbolBuffer)->Pointer; } +/** + * @brief wrapper for removing symbol buffer + * @param SymbolBuffer + * + * @return UINT32 + */ VOID ScriptEngineWrapperRemoveSymbolBuffer(PVOID SymbolBuffer) { diff --git a/hyperdbg/hprdbgctrl/symbol.cpp b/hyperdbg/hprdbgctrl/symbol.cpp index 1d8158cf..5a2c2c7b 100644 --- a/hyperdbg/hprdbgctrl/symbol.cpp +++ b/hyperdbg/hprdbgctrl/symbol.cpp @@ -12,6 +12,21 @@ */ #include "pch.h" +/** + * @brief Load symbol for ntoskrnl + * + * @param BaseAddress Base address of ntoskrnl + * + * @return BOOLEAN shows whether the conversion was successful or not + */ +BOOLEAN +SymbolLoadNtoskrnlSymbol(UINT64 BaseAddress) +{ + ScriptEngineLoadFileSymbolWrapper(BaseAddress, "ntoskrnl.exe", "123"); + + return TRUE; +} + /** * @brief check and convert string to a 64 bit unsigned interger and also * check for symbol object names @@ -22,7 +37,7 @@ * @return BOOLEAN shows whether the conversion was successful or not */ BOOLEAN -SymConvertObjectNameOrStringToUInt64(string TextToConvert, PUINT64 Result) +SymbolConvertNameToAddress(string TextToConvert, PUINT64 Result) { BOOLEAN IsFound = FALSE; UINT64 Address = NULL; @@ -32,7 +47,7 @@ SymConvertObjectNameOrStringToUInt64(string TextToConvert, PUINT64 Result) // // Check for symbol object names // - Address = ScriptEnginePdbParserWrapper(TextToConvert.c_str(), &IsFound); + Address = ScriptEngineConvertNameToAddressWrapper(TextToConvert.c_str(), &IsFound); if (!IsFound) { diff --git a/hyperdbg/hprdbgctrl/va2pa.cpp b/hyperdbg/hprdbgctrl/va2pa.cpp index 47010fc2..ea2362a2 100644 --- a/hyperdbg/hprdbgctrl/va2pa.cpp +++ b/hyperdbg/hprdbgctrl/va2pa.cpp @@ -61,7 +61,7 @@ CommandVa2pa(vector SplittedCommand, string Command) // // It's just an address for current process // - if (!SymConvertObjectNameOrStringToUInt64(SplittedCommand.at(1), &TargetVa)) + if (!SymbolConvertNameToAddress(SplittedCommand.at(1), &TargetVa)) { ShowMessages("incorrect address or object name, please enter a valid virtual" " address\n\n"); @@ -81,7 +81,7 @@ CommandVa2pa(vector SplittedCommand, string Command) return; } - if (!SymConvertObjectNameOrStringToUInt64(SplittedCommand.at(3), &TargetVa)) + if (!SymbolConvertNameToAddress(SplittedCommand.at(3), &TargetVa)) { ShowMessages("incorrect address or object name, please enter a valid virtual" " address\n\n"); @@ -90,7 +90,7 @@ CommandVa2pa(vector SplittedCommand, string Command) } else if (!SplittedCommand.at(2).compare("pid")) { - if (!SymConvertObjectNameOrStringToUInt64(SplittedCommand.at(1), &TargetVa)) + if (!SymbolConvertNameToAddress(SplittedCommand.at(1), &TargetVa)) { ShowMessages("incorrect address or object name, please enter a valid virtual" " address\n\n"); diff --git a/hyperdbg/hprdbghv/SerialConnection.c b/hyperdbg/hprdbghv/SerialConnection.c index b7233853..db76f76a 100644 --- a/hyperdbg/hprdbghv/SerialConnection.c +++ b/hyperdbg/hprdbghv/SerialConnection.c @@ -260,7 +260,7 @@ SerialConnectionPrepare(PDEBUGGER_PREPARE_DEBUGGEE DebuggeeRequest) // KdResponsePacketToDebugger(DEBUGGER_REMOTE_PACKET_TYPE_DEBUGGEE_TO_DEBUGGER, DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION_DEBUGGEE_STARTED, - DebuggeeRequest->OsName, + DebuggeeRequest, MAXIMUM_CHARACTER_FOR_OS_NAME); // diff --git a/hyperdbg/include/Definition.h b/hyperdbg/include/Definition.h index 698bd0f5..75f9c295 100644 --- a/hyperdbg/include/Definition.h +++ b/hyperdbg/include/Definition.h @@ -1101,6 +1101,7 @@ typedef struct _DEBUGGER_PREPARE_DEBUGGEE { UINT32 PortAddress; UINT32 Baudrate; + UINT64 NtoskrnlBaseAddress; UINT32 Result; // Result from the kernel CHAR OsName[MAXIMUM_CHARACTER_FOR_OS_NAME]; diff --git a/hyperdbg/include/ScriptEngineCommon.h b/hyperdbg/include/ScriptEngineCommon.h index 40b88199..9b9287fa 100644 --- a/hyperdbg/include/ScriptEngineCommon.h +++ b/hyperdbg/include/ScriptEngineCommon.h @@ -135,7 +135,9 @@ __declspec(dllimport) void RemoveSymbolBuffer(PSYMBOL_BUFFER SymbolBuffer); // pdb parser // __declspec(dllimport) UINT64 - ScriptEnginePdbParser(const char * FunctionName, PBOOLEAN WasFound); + ScriptEngineConvertNameToAddress(const char * FunctionName, PBOOLEAN WasFound); +__declspec(dllimport) UINT64 + ScriptEngineLoadFileSymbol(UINT64 BaseAddress, const char * FileName, const char * Guid); } #endif // SCRIPT_ENGINE_USER_MODE diff --git a/hyperdbg/script-engine/ScriptEngine.c b/hyperdbg/script-engine/ScriptEngine.c index d1a210c1..aea115af 100644 --- a/hyperdbg/script-engine/ScriptEngine.c +++ b/hyperdbg/script-engine/ScriptEngine.c @@ -1,6 +1,7 @@ /** * @file ScriptEngine.c * @author M.H. Gholamrezei (gholamrezaei.mh@gmail.com) + * @author Sina Karvandi (sina@rayanfam.com) * @brief Script engine parser and codegen * @details * @version 0.1 @@ -28,12 +29,25 @@ * */ UINT64 -ScriptEnginePdbParser(const char * FunctionName, PBOOLEAN WasFound) +ScriptEngineConvertNameToAddress(const char * FunctionName, PBOOLEAN WasFound) { // // A wrapper for pdb parser // - SymConvertNameToAddress(FunctionName, WasFound); + return SymConvertNameToAddress(FunctionName, WasFound); +} + +/** +* +* +*/ +UINT64 +ScriptEngineLoadFileSymbol(UINT64 BaseAddress, const char * FileName, const char * Guid) +{ + // + // A wrapper for pdb parser + // + return SymLoadFileSymbol(BaseAddress, FileName, Guid); } /** diff --git a/hyperdbg/script-engine/ScriptEngine.h b/hyperdbg/script-engine/ScriptEngine.h index 62d64b2c..28231797 100644 --- a/hyperdbg/script-engine/ScriptEngine.h +++ b/hyperdbg/script-engine/ScriptEngine.h @@ -23,12 +23,15 @@ // *** import pdb parser functions *** // __declspec(dllimport) UINT64 SymConvertNameToAddress(const char * FunctionName, PBOOLEAN WasFound); +__declspec(dllimport) UINT64 SymLoadFileSymbol(UINT64 BaseAddress, const char * FileName, const char * Guid); // // *** export pdb wrapper as script engine function *** // __declspec(dllexport) UINT64 - ScriptEnginePdbParser(const char * FunctionName, PBOOLEAN WasFound); + ScriptEngineConvertNameToAddress(const char * FunctionName, PBOOLEAN WasFound); +__declspec(dllexport) UINT64 + ScriptEngineLoadFileSymbol(UINT64 BaseAddress, const char * FileName, const char * Guid); // // *** Exoort script engine functions *** diff --git a/hyperdbg/symbol-parser/symbol-parser.cpp b/hyperdbg/symbol-parser/symbol-parser.cpp index 4cfe7fe8..16e6ec35 100644 --- a/hyperdbg/symbol-parser/symbol-parser.cpp +++ b/hyperdbg/symbol-parser/symbol-parser.cpp @@ -12,6 +12,22 @@ */ #include "pch.h" +/** + * @brief Convert function name to address + * + * @param BaseAddress + * @param FileName + * @param Guid + * + * @return UINT64 + */ +UINT64 +SymLoadFileSymbol(UINT64 BaseAddress, const char * FileName, const char * Guid) +{ + // printf("hello from symbol loaded base address is : %llx !\n", BaseAddress); + return 0x55; +} + /** * @brief Convert function name to address * diff --git a/hyperdbg/symbol-parser/symbol-parser.h b/hyperdbg/symbol-parser/symbol-parser.h index 30d2f40a..12569d8b 100644 --- a/hyperdbg/symbol-parser/symbol-parser.h +++ b/hyperdbg/symbol-parser/symbol-parser.h @@ -15,6 +15,7 @@ // Exports // ////////////////////////////////////////////////// extern "C" { +__declspec(dllexport) UINT64 SymLoadFileSymbol(UINT64 BaseAddress, const char * FileName, const char * Guid); __declspec(dllexport) UINT64 SymConvertNameToAddress(const char * FunctionName, PBOOLEAN WasFound); }