diff --git a/hyperdbg/Kbuild b/hyperdbg/Kbuild index 1f36a3ef..1f9f898c 100644 --- a/hyperdbg/Kbuild +++ b/hyperdbg/Kbuild @@ -76,9 +76,9 @@ HyperDbg-objs += include/platform/kernel/code/PlatformBroadcast.o HyperDbg-objs += include/platform/kernel/code/PlatformCpu.o HyperDbg-objs += include/platform/kernel/code/PlatformDbg.o HyperDbg-objs += include/platform/kernel/code/PlatformDpc.o -# Still on the WDK (IRQL/event/io/process/spinlock/time). Commented out so -# the module links today; uncomment each as `make one FILE=...` on it goes green. -# HyperDbg-objs += include/platform/kernel/code/PlatformEvent.o +HyperDbg-objs += include/platform/kernel/code/PlatformEvent.o +# Still on the WDK (IRQL/io/process/spinlock/time). Commented out so the module +# links today; uncomment each as `make one FILE=...` on it goes green. # HyperDbg-objs += include/platform/kernel/code/PlatformIo.o # HyperDbg-objs += include/platform/kernel/code/PlatformIrql.o # HyperDbg-objs += include/platform/kernel/code/PlatformProcess.o diff --git a/hyperdbg/include/SDK/headers/BasicTypes.h b/hyperdbg/include/SDK/headers/BasicTypes.h index 7e5ccb0c..1e9b1f9e 100644 --- a/hyperdbg/include/SDK/headers/BasicTypes.h +++ b/hyperdbg/include/SDK/headers/BasicTypes.h @@ -125,6 +125,24 @@ typedef struct _PROCESS_INFORMATION DWORD dwThreadId; } PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION; +// NT status + kernel event/object types (the kernel notify path — see +// PlatformEvent). Scalar/opaque definitions so the shared Windows signatures +// compile on Linux; the event/object backing itself is stubbed for now (a real +// version would map KEVENT onto eventfd). NTSTATUS is fundamental and reused +// across many kernel TUs. +typedef LONG NTSTATUS; +typedef LONG KPRIORITY; +typedef ULONG ACCESS_MASK; +typedef CHAR KPROCESSOR_MODE; + +typedef struct _KEVENT KEVENT, *PKEVENT; // opaque (eventfd-backed later) +typedef PVOID POBJECT_TYPE; // opaque NT object type +typedef PVOID POBJECT_HANDLE_INFORMATION; // opaque access-state out-param + +# define STATUS_SUCCESS ((NTSTATUS)0x00000000L) +# define STATUS_NOT_IMPLEMENTED ((NTSTATUS)0xC0000002L) +# define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) + #endif #define NULL_ZERO 0 diff --git a/hyperdbg/include/platform/kernel/code/PlatformEvent.c b/hyperdbg/include/platform/kernel/code/PlatformEvent.c index aed1673c..9020f986 100644 --- a/hyperdbg/include/platform/kernel/code/PlatformEvent.c +++ b/hyperdbg/include/platform/kernel/code/PlatformEvent.c @@ -30,7 +30,11 @@ PlatformObjectDereference(PVOID Object) #elif defined(__linux__) -# error "Not yet implemented" + // + // STUB: EVENT_BASED notify is unsupported on Linux until an eventfd backing + // lands. TODO(Linux): eventfd_ctx_put((struct eventfd_ctx *)Object). + // + UNREFERENCED_PARAMETER(Object); #else @@ -56,7 +60,15 @@ PlatformEventSet(PKEVENT Event, KPRIORITY Increment, BOOLEAN Wait) #elif defined(__linux__) -# error "Not yet implemented" + // + // STUB. TODO(Linux): eventfd_signal((struct eventfd_ctx *)Event). Returns the + // previous signal state; 0 is a safe default (no caller inspects it). + // + UNREFERENCED_PARAMETER(Event); + UNREFERENCED_PARAMETER(Increment); + UNREFERENCED_PARAMETER(Wait); + + return 0; #else @@ -95,7 +107,22 @@ PlatformObjectReferenceByHandle(HANDLE Handle, #elif defined(__linux__) -# error "Not yet implemented" + // + // STUB. TODO(Linux): eventfd_ctx_fdget((int)(uintptr_t)Handle) into *Object. + // Fail closed so the EVENT_BASED registration path bails cleanly. + // + UNREFERENCED_PARAMETER(Handle); + UNREFERENCED_PARAMETER(DesiredAccess); + UNREFERENCED_PARAMETER(ObjectType); + UNREFERENCED_PARAMETER(AccessMode); + UNREFERENCED_PARAMETER(HandleInformation); + + if (Object != NULL) + { + *Object = NULL; + } + + return STATUS_NOT_IMPLEMENTED; #else diff --git a/hyperdbg/include/platform/kernel/header/PlatformDpc.h b/hyperdbg/include/platform/kernel/header/PlatformDpc.h index a886283e..4c28c041 100644 --- a/hyperdbg/include/platform/kernel/header/PlatformDpc.h +++ b/hyperdbg/include/platform/kernel/header/PlatformDpc.h @@ -19,12 +19,8 @@ // Functions // ////////////////////////////////////////////////// -#if defined(_WIN32) || defined(_WIN64) || defined(__linux__) - VOID PlatformDpcInitialize(PRKDPC Dpc, PKDEFERRED_ROUTINE DeferredRoutine, PVOID DeferredContext); BOOLEAN PlatformDpcInsertQueueDpc(PRKDPC Dpc, PVOID SystemArgument1, PVOID SystemArgument2); - -#endif // defined(_WIN32) || defined(_WIN64) || defined(__linux__) diff --git a/hyperdbg/include/platform/kernel/header/PlatformEvent.h b/hyperdbg/include/platform/kernel/header/PlatformEvent.h index da38a7da..c7ba4fb6 100644 --- a/hyperdbg/include/platform/kernel/header/PlatformEvent.h +++ b/hyperdbg/include/platform/kernel/header/PlatformEvent.h @@ -22,8 +22,6 @@ VOID PlatformObjectDereference(PVOID Object); -#if defined(_WIN32) || defined(_WIN64) - LONG PlatformEventSet(PKEVENT Event, KPRIORITY Increment, BOOLEAN Wait); @@ -34,5 +32,3 @@ PlatformObjectReferenceByHandle(HANDLE Handle, KPROCESSOR_MODE AccessMode, PVOID * Object, POBJECT_HANDLE_INFORMATION HandleInformation); - -#endif // defined(_WIN32) || defined(_WIN64) diff --git a/hyperdbg/linux/PORTING_STATUS.md b/hyperdbg/linux/PORTING_STATUS.md index 28699f51..b197c956 100644 --- a/hyperdbg/linux/PORTING_STATUS.md +++ b/hyperdbg/linux/PORTING_STATUS.md @@ -848,9 +848,9 @@ stops at the first `#error "Not yet implemented"`. | `PlatformCpu.c` | ✅ ported 2026-08-01 — see below | | `PlatformDbg.c` | ✅ ported 2026-08-01 — see below | | `PlatformDpc.c` | ✅ ported 2026-08-11 — tasklet skeleton, see below | +| `PlatformEvent.c` | ✅ ported 2026-08-11 — stub skeleton, see below | | `PlatformIrql.c` | ❌ 2 stubs | -| `PlatformEvent.c` | ❌ 3 stubs — **next to fail** | -| `PlatformIo.c` | ❌ 3 stubs | +| `PlatformIo.c` | ❌ 3 stubs — **next to fail** | | `PlatformSpinlock.c` | ❌ 3 stubs | | `PlatformTime.c` | ❌ 3 stubs | | `PlatformProcess.c` | ❌ 5 stubs | @@ -916,6 +916,33 @@ which matches `KeInsertQueueDpc`'s "FALSE if already queued" — returned direct in a freed `NOTIFY_RECORD` = UAF; needs `cancel_work_sync` before free once hyperlog is ported). No live caller yet (hyperlog not compiled). +### `PlatformEvent.c` — DONE (2026-08-11) — stub skeleton + +The EVENT_BASED half of the same hyperlog notify path: user-mode passes an event +*handle*, the kernel references it to a `KEVENT` and later signals it. No direct +Linux analog (no NT handles/object-manager); the real backing would be **eventfd** +(deferred — it also needs a coordinated user-mode-side change). Stubbed for now. + +Type plumbing added to `BasicTypes.h` Linux block (shared, reused by later kernel +TUs): `NTSTATUS`/`KPRIORITY`/`ACCESS_MASK`/`KPROCESSOR_MODE` scalars, opaque +`KEVENT`/`POBJECT_TYPE`/`POBJECT_HANDLE_INFORMATION`, and +`STATUS_SUCCESS`/`STATUS_NOT_IMPLEMENTED`/`NT_SUCCESS`. Sole definitions (no +collision — the two other `NTSTATUS` hits are *uses* in kernel headers). + +| Windows | Linux stub | eventfd TODO | +|---------|-----------|--------------| +| `ObDereferenceObject` | no-op | `eventfd_ctx_put` | +| `KeSetEvent` | return 0 | `eventfd_signal` | +| `ObReferenceObjectByHandle` | `*Object=NULL`, return `STATUS_NOT_IMPLEMENTED` | `eventfd_ctx_fdget` | + +Consequence: EVENT_BASED notify is a no-op/fail-closed on Linux until eventfd +lands. No live caller yet (hyperlog not compiled). + +**Header cleanup (both Dpc + Event):** the `#if _WIN32 || _WIN64 || __linux__` +wrappers around the prototypes were removed — that condition is every supported +platform (the `.c` files `#error` on anything else), so the prototypes are now +declared unconditionally. + --- ## Building