vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #584 from HyperDbg/linux-refactoring
Some checks failed
vs2022-ci / win-amd64-build (debug, x64) (push) Has been cancelled
Details
vs2022-ci / win-amd64-build (release, x64) (push) Has been cancelled
Details
vs2022-ci / Deploy release (push) Has been cancelled
Details

Browse source 
Linux refactoring
This commit is contained in:
Sina Karvandi 2026-05-12 14:58:05 +02:00 • committed by GitHub
commit dfec8d0cb2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
63 changed files with 1851 additions and 643 deletions
Download patch file Download diff file Expand all files Collapse all files

7
.github/git/git-help.md vendored
View file

@ -44,6 +44,13 @@ To remove the effects of `git add .` and `git commit -m "test"` or just `git add
git reset --soft HEAD~1
```
To remove **all uncommitted and untracked changes** in Git and reset your working tree to the last commit:
```bash
git reset --hard
git clean -fd
```
---------------
## Releasing instructions

24
hyperdbg/hyperdbg.sln
View file

@ -148,24 +148,48 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "kernel", "kernel", "{D0E5A2
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{6498728B-D9B0-4CAB-A9E3-ACE5BC371010}"
ProjectSection(SolutionItems) = preProject
include\platform\kernel\code\PlatformBroadcast.c = include\platform\kernel\code\PlatformBroadcast.c
include\platform\kernel\code\PlatformCpu.c = include\platform\kernel\code\PlatformCpu.c
include\platform\kernel\code\PlatformDbg.c = include\platform\kernel\code\PlatformDbg.c
include\platform\kernel\code\PlatformDpc.c = include\platform\kernel\code\PlatformDpc.c
include\platform\kernel\code\PlatformEvent.c = include\platform\kernel\code\PlatformEvent.c
include\platform\kernel\code\PlatformIntrinsics.c = include\platform\kernel\code\PlatformIntrinsics.c
include\platform\kernel\code\PlatformIntrinsicsVmx.c = include\platform\kernel\code\PlatformIntrinsicsVmx.c
include\platform\kernel\code\PlatformIo.c = include\platform\kernel\code\PlatformIo.c
include\platform\kernel\code\PlatformIrql.c = include\platform\kernel\code\PlatformIrql.c
include\platform\kernel\code\PlatformMem.c = include\platform\kernel\code\PlatformMem.c
include\platform\kernel\code\PlatformProcess.c = include\platform\kernel\code\PlatformProcess.c
include\platform\kernel\code\PlatformSpinlock.c = include\platform\kernel\code\PlatformSpinlock.c
include\platform\kernel\code\PlatformTime.c = include\platform\kernel\code\PlatformTime.c
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{AA41FFF1-A730-433E-8D26-13DA5B653825}"
ProjectSection(SolutionItems) = preProject
include\platform\kernel\header\pch.h = include\platform\kernel\header\pch.h
include\platform\kernel\header\PlatformBroadcast.h = include\platform\kernel\header\PlatformBroadcast.h
include\platform\kernel\header\PlatformCpu.h = include\platform\kernel\header\PlatformCpu.h
include\platform\kernel\header\PlatformDbg.h = include\platform\kernel\header\PlatformDbg.h
include\platform\kernel\header\PlatformDpc.h = include\platform\kernel\header\PlatformDpc.h
include\platform\kernel\header\PlatformEvent.h = include\platform\kernel\header\PlatformEvent.h
include\platform\kernel\header\PlatformIntrinsics.h = include\platform\kernel\header\PlatformIntrinsics.h
include\platform\kernel\header\PlatformIntrinsicsVmx.h = include\platform\kernel\header\PlatformIntrinsicsVmx.h
include\platform\kernel\header\PlatformIo.h = include\platform\kernel\header\PlatformIo.h
include\platform\kernel\header\PlatformIrql.h = include\platform\kernel\header\PlatformIrql.h
include\platform\kernel\header\PlatformMem.h = include\platform\kernel\header\PlatformMem.h
include\platform\kernel\header\PlatformModuleInfo.h = include\platform\kernel\header\PlatformModuleInfo.h
include\platform\kernel\header\PlatformProcess.h = include\platform\kernel\header\PlatformProcess.h
include\platform\kernel\header\PlatformSpinlock.h = include\platform\kernel\header\PlatformSpinlock.h
include\platform\kernel\header\PlatformTime.h = include\platform\kernel\header\PlatformTime.h
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{4BF590C3-1032-4DD2-BF87-BB9E5781977C}"
ProjectSection(SolutionItems) = preProject
include\platform\user\code\platform-intrinsics.c = include\platform\user\code\platform-intrinsics.c
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{DBE32379-8D5A-4454-A1B6-ACC407881898}"
ProjectSection(SolutionItems) = preProject
include\platform\user\header\platform-intrinsics.h = include\platform\user\header\platform-intrinsics.h
include\platform\user\header\Windows.h = include\platform\user\header\Windows.h
EndProjectSection
EndProject

473
hyperdbg/hyperhv/code/broadcast/DpcRoutines.c
View file

@ -135,15 +135,10 @@ DpcRoutinePerformVirtualization(KDPC * Dpc, PVOID DeferredContext, PVOID SystemA
//
VmxPerformVirtualizationOnSpecificCore();
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
return TRUE;
}
@ -454,15 +449,10 @@ DpcRoutineEnableMovToCr3Exiting(KDPC * Dpc, PVOID DeferredContext, PVOID SystemA
//
AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_CR3_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -485,15 +475,10 @@ DpcRoutineChangeToMbecSupportedEptp(KDPC * Dpc, PVOID DeferredContext, PVOID Sys
//
AsmVmxVmcall(VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -516,15 +501,10 @@ DpcRoutineRestoreToNormalEptp(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArg
//
AsmVmxVmcall(VMCALL_RESTORE_TO_NORMAL_EPTP, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -547,15 +527,10 @@ DpcRoutineEnableOrDisableMbec(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArg
//
AsmVmxVmcall(VMCALL_DISABLE_OR_ENABLE_MBEC, (UINT64)DeferredContext, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -578,15 +553,10 @@ DpcRoutineDisableMovToCr3Exiting(KDPC * Dpc, PVOID DeferredContext, PVOID System
//
AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CR3_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -609,15 +579,10 @@ DpcRoutineEnableEferSyscallEvents(KDPC * Dpc, PVOID DeferredContext, PVOID Syste
//
AsmVmxVmcall(VMCALL_ENABLE_SYSCALL_HOOK_EFER, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -640,15 +605,10 @@ DpcRoutineDisableEferSyscallEvents(KDPC * Dpc, PVOID DeferredContext, PVOID Syst
//
AsmVmxVmcall(VMCALL_DISABLE_SYSCALL_HOOK_EFER, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -671,15 +631,10 @@ DpcRoutineEnablePml(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PV
//
AsmVmxVmcall(VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -702,15 +657,10 @@ DpcRoutineDisablePml(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, P
//
AsmVmxVmcall(VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -732,15 +682,10 @@ DpcRoutineChangeMsrBitmapReadOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID
//
AsmVmxVmcall(VMCALL_CHANGE_MSR_BITMAP_READ, (UINT64)DeferredContext, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -763,15 +708,10 @@ DpcRoutineResetMsrBitmapReadOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID
//
AsmVmxVmcall(VMCALL_RESET_MSR_BITMAP_READ, NULL64_ZERO, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -793,15 +733,10 @@ DpcRoutineChangeMsrBitmapWriteOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOI
//
AsmVmxVmcall(VMCALL_CHANGE_MSR_BITMAP_WRITE, (UINT64)DeferredContext, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -824,15 +759,10 @@ DpcRoutineResetMsrBitmapWriteOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID
//
AsmVmxVmcall(VMCALL_RESET_MSR_BITMAP_WRITE, NULL64_ZERO, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -855,15 +785,10 @@ DpcRoutineEnableRdtscExitingAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Sy
//
AsmVmxVmcall(VMCALL_SET_RDTSC_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -886,15 +811,10 @@ DpcRoutineDisableRdtscExitingAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID S
//
AsmVmxVmcall(VMCALL_UNSET_RDTSC_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -919,15 +839,10 @@ DpcRoutineDisableRdtscExitingForClearingTscEventsAllCores(KDPC * Dpc, PVOID Defe
//
AsmVmxVmcall(VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -951,15 +866,10 @@ DpcRoutineDisableMov2DrExitingForClearingDrEventsAllCores(KDPC * Dpc, PVOID Defe
//
AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -982,15 +892,10 @@ DpcRoutineDisableMov2CrExitingForClearingCrEventsAllCores(KDPC * Dpc, DEBUGGER_E
//
AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1013,15 +918,10 @@ DpcRoutineEnableRdpmcExitingAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Sy
//
AsmVmxVmcall(VMCALL_SET_RDPMC_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1044,15 +944,10 @@ DpcRoutineDisableRdpmcExitingAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID S
//
AsmVmxVmcall(VMCALL_UNSET_RDPMC_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1074,15 +969,10 @@ DpcRoutineSetExceptionBitmapOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID
//
AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, (UINT64)DeferredContext, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1104,15 +994,10 @@ DpcRoutineUnsetExceptionBitmapOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOI
//
AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, (UINT64)DeferredContext, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1139,15 +1024,10 @@ DpcRoutineResetExceptionBitmapOnlyOnClearingExceptionEventsOnAllCores(KDPC * Dpc
//
AsmVmxVmcall(VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS, NULL64_ZERO, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1170,15 +1050,10 @@ DpcRoutineEnableMovDebigRegisterExitingAllCores(KDPC * Dpc, PVOID DeferredContex
//
AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1200,15 +1075,10 @@ DpcRoutineEnableMovControlRegisterExitingAllCores(KDPC * Dpc, DEBUGGER_EVENT_OPT
//
AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1230,15 +1100,10 @@ DpcRoutineDisableMovControlRegisterExitingAllCores(KDPC * Dpc, DEBUGGER_EVENT_OP
//
AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1261,15 +1126,10 @@ DpcRoutineDisableMovDebigRegisterExitingAllCores(KDPC * Dpc, PVOID DeferredConte
//
AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1292,15 +1152,10 @@ DpcRoutineSetEnableExternalInterruptExitingOnAllCores(KDPC * Dpc, PVOID Deferred
//
AsmVmxVmcall(VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1326,15 +1181,10 @@ DpcRoutineSetDisableExternalInterruptExitingOnlyOnClearingInterruptEventsOnAllCo
//
AsmVmxVmcall(VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1356,15 +1206,10 @@ DpcRoutineChangeIoBitmapOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Syst
//
AsmVmxVmcall(VMCALL_CHANGE_IO_BITMAP, (UINT64)DeferredContext, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1387,15 +1232,10 @@ DpcRoutineResetIoBitmapOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Syste
//
AsmVmxVmcall(VMCALL_RESET_IO_BITMAP, NULL64_ZERO, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1418,15 +1258,10 @@ DpcRoutineEnableBreakpointOnExceptionBitmapOnAllCores(KDPC * Dpc, PVOID Deferred
//
AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_BREAKPOINT, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1449,15 +1284,10 @@ DpcRoutineDisableBreakpointOnExceptionBitmapOnAllCores(KDPC * Dpc, PVOID Deferre
//
AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_BREAKPOINT, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1480,15 +1310,10 @@ DpcRoutineEnableNmiVmexitOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Sys
//
AsmVmxVmcall(VMCALL_SET_VM_EXIT_ON_NMIS, NULL64_ZERO, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1511,15 +1336,10 @@ DpcRoutineDisableNmiVmexitOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Sy
//
AsmVmxVmcall(VMCALL_UNSET_VM_EXIT_ON_NMIS, NULL64_ZERO, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1547,15 +1367,10 @@ DpcRoutineEnableDbAndBpExitingOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOI
//
AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_DEBUG_BREAKPOINT, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1583,15 +1398,10 @@ DpcRoutineDisableDbAndBpExitingOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVO
//
AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_DEBUG_BREAKPOINT, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1614,15 +1424,10 @@ DpcRoutineRemoveHookAndInvalidateAllEntriesOnAllCores(KDPC * Dpc, PVOID Deferred
//
AsmVmxVmcall(VMCALL_UNHOOK_ALL_PAGES, NULL64_ZERO, NULL64_ZERO, NULL64_ZERO);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1647,15 +1452,10 @@ DpcRoutineRemoveHookAndInvalidateSingleEntryOnAllCores(KDPC * Dpc, PVOID Deferre
//
AsmVmxVmcall(VMCALL_UNHOOK_SINGLE_PAGE, UnhookingDetail->PhysicalAddress, UnhookingDetail->OriginalEntry, NULL64_ZERO);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1690,15 +1490,10 @@ DpcRoutineInvalidateEptOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Syste
NULL64_ZERO);
}
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1721,15 +1516,10 @@ DpcRoutineInitializeGuest(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgumen
//
AsmVmxSaveState();
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -1755,13 +1545,8 @@ DpcRoutineTerminateGuest(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument
LogError("Err, there were an error terminating vmx");
}
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}

39
hyperdbg/hyperhv/header/common/Dpc.h
View file

@ -1,39 +0,0 @@
/**
* @file Dpc.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Definition for Windows DPC functions
* @details
* @version 0.1
* @date 2020-04-10
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
NTKERNELAPI
_IRQL_requires_max_(APC_LEVEL)
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_same_
VOID
KeGenericCallDpc(
_In_ PKDEFERRED_ROUTINE Routine,
_In_opt_ PVOID Context);
NTKERNELAPI
_IRQL_requires_(DISPATCH_LEVEL)
_IRQL_requires_same_
VOID
KeSignalCallDpcDone(
_In_ PVOID SystemArgument1);
NTKERNELAPI
_IRQL_requires_(DISPATCH_LEVEL)
_IRQL_requires_same_
LOGICAL
KeSignalCallDpcSynchronize(
_In_ PVOID SystemArgument2);

3
hyperdbg/hyperhv/hyperhv.vcxproj
View file

@ -132,6 +132,7 @@
<ClCompile Include="..\include\components\optimizations\code\InsertionSort.c" />
<ClCompile Include="..\include\components\optimizations\code\OptimizationsExamples.c" />
<ClCompile Include="..\include\components\spinlock\code\Spinlock.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsics.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsicsVmx.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c" />
@ -240,6 +241,7 @@
<ClInclude Include="..\include\components\optimizations\header\OptimizationsExamples.h" />
<ClInclude Include="..\include\components\spinlock\header\Spinlock.h" />
<ClInclude Include="..\include\macros\MetaMacros.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsics.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsicsVmx.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h" />
@ -248,7 +250,6 @@
<ClInclude Include="header\broadcast\DpcRoutines.h" />
<ClInclude Include="header\common\Bitwise.h" />
<ClInclude Include="header\common\Common.h" />
<ClInclude Include="header\common\Dpc.h" />
<ClInclude Include="header\common\Msr.h" />
<ClInclude Include="header\common\State.h" />
<ClInclude Include="header\common\Trace.h" />

9
hyperdbg/hyperhv/hyperhv.vcxproj.filters
View file

@ -335,6 +335,9 @@
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsics.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c">
<Filter>code\platform</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="pch.h">
@ -343,9 +346,6 @@
<ClInclude Include="header\common\Common.h">
<Filter>header\common</Filter>
</ClInclude>
<ClInclude Include="header\common\Dpc.h">
<Filter>header\common</Filter>
</ClInclude>
<ClInclude Include="header\common\Msr.h">
<Filter>header\common</Filter>
</ClInclude>
@ -619,6 +619,9 @@
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsics.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h">
<Filter>header\platform</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<MASM Include="code\assembly\AsmCommon.asm">

6
hyperdbg/hyperhv/pch.h
View file

@ -62,10 +62,7 @@
//
#include "platform/kernel/header/PlatformMem.h"
#include "platform/kernel/header/PlatformIntrinsics.h"
//
// Platform intrinsics headers
//
#include "platform/kernel/header/PlatformBroadcast.h"
#include "platform/kernel/header/PlatformIntrinsicsVmx.h"
//
@ -97,7 +94,6 @@
#include "vmm/vmx/VmxBroadcast.h"
#include "memory/MemoryMapper.h"
#include "interface/Dispatch.h"
#include "common/Dpc.h"
#include "common/Msr.h"
#include "memory/PoolManager.h"
#include "common/Trace.h"

44
hyperdbg/hyperkd/code/debugger/broadcast/DpcRoutines.c
View file

@ -202,15 +202,10 @@ DpcRoutineWriteMsrToAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgu
//
CpuWriteMsr((ULONG)CurrentDebuggingState->MsrState.Msr, CurrentDebuggingState->MsrState.Value);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -236,15 +231,10 @@ DpcRoutineReadMsrToAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgum
//
CurrentDebuggingState->MsrState.Value = CpuReadMsr((ULONG)CurrentDebuggingState->MsrState.Msr);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -267,15 +257,10 @@ DpcRoutineVmExitAndHaltSystemAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID S
//
VmFuncVmxVmcall(DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM, 0, 0, 0);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
}
/**
@ -298,15 +283,10 @@ DpcRoutineSetHardwareDebugRegisters(KDPC * Dpc, PVOID DeferredContext, PVOID Sys
//
UdApplyHardwareDebugRegister(DeferredContext);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
return TRUE;
}

39
hyperdbg/hyperkd/header/common/Dpc.h
View file

@ -1,39 +0,0 @@
/**
* @file Dpc.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Definition for Windows DPC functions
* @details
* @version 0.1
* @date 2020-04-10
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
NTKERNELAPI
_IRQL_requires_max_(APC_LEVEL)
_IRQL_requires_min_(PASSIVE_LEVEL)
_IRQL_requires_same_
VOID
KeGenericCallDpc(
_In_ PKDEFERRED_ROUTINE Routine,
_In_opt_ PVOID Context);
NTKERNELAPI
_IRQL_requires_(DISPATCH_LEVEL)
_IRQL_requires_same_
VOID
KeSignalCallDpcDone(
_In_ PVOID SystemArgument1);
NTKERNELAPI
_IRQL_requires_(DISPATCH_LEVEL)
_IRQL_requires_same_
LOGICAL
KeSignalCallDpcSynchronize(
_In_ PVOID SystemArgument2);

8
hyperdbg/hyperkd/header/pch.h
View file

@ -86,6 +86,9 @@
//
#include "platform/kernel/header/PlatformMem.h"
#include "platform/kernel/header/PlatformIntrinsics.h"
#include "platform/kernel/header/PlatformBroadcast.h"
#include "platform/kernel/header/PlatformProcess.h"
#include "platform/kernel/header/PlatformCpu.h"
//
// Optimization algorithms
@ -135,11 +138,6 @@
#include "header/debugger/broadcast/HaltedRoutines.h"
#include "header/debugger/broadcast/HaltedBroadcast.h"
//
// DPC Headers
//
#include "header/common/Dpc.h"
//
// Events & Meta events
//

7
hyperdbg/hyperkd/hyperkd.vcxproj
View file

@ -108,8 +108,11 @@
<ClCompile Include="..\include\components\optimizations\code\InsertionSort.c" />
<ClCompile Include="..\include\components\optimizations\code\OptimizationsExamples.c" />
<ClCompile Include="..\include\components\spinlock\code\Spinlock.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsics.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformProcess.c" />
<ClCompile Include="..\script-eval\code\Functions.c" />
<ClCompile Include="..\script-eval\code\Keywords.c" />
<ClCompile Include="..\script-eval\code\PseudoRegisters.c" />
@ -155,11 +158,13 @@
<ClInclude Include="..\include\components\optimizations\header\OptimizationsExamples.h" />
<ClInclude Include="..\include\components\spinlock\header\Spinlock.h" />
<ClInclude Include="..\include\macros\MetaMacros.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsics.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformProcess.h" />
<ClInclude Include="header\assembly\Assembly.h" />
<ClInclude Include="header\common\Common.h" />
<ClInclude Include="header\common\Dpc.h" />
<ClInclude Include="header\common\Synchronization.h" />
<ClInclude Include="header\debugger\broadcast\DpcRoutines.h" />
<ClInclude Include="header\debugger\broadcast\HaltedBroadcast.h" />

21
hyperdbg/hyperkd/hyperkd.vcxproj.filters
View file

@ -270,6 +270,15 @@
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsics.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformProcess.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c">
<Filter>code\platform</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="header\pch.h">
@ -353,9 +362,6 @@
<ClInclude Include="..\include\macros\MetaMacros.h">
<Filter>header\macros</Filter>
</ClInclude>
<ClInclude Include="header\common\Dpc.h">
<Filter>header\common</Filter>
</ClInclude>
<ClInclude Include="header\assembly\Assembly.h">
<Filter>header\assembly</Filter>
</ClInclude>
@ -407,6 +413,15 @@
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsics.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformProcess.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h">
<Filter>header\platform</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<MASM Include="code\assembly\AsmDebugger.asm">

108
hyperdbg/hyperlog/code/Logging.c
View file

@ -99,7 +99,7 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks)
{
ULONG ProcessorsCount;
ProcessorsCount = KeQueryActiveProcessorCount(0);
ProcessorsCount = PlatformCpuGetActiveProcessorCount();
//
// Initialize buffers for trace message and data messages
@ -155,8 +155,8 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks)
// for both but the second buffer spinlock is useless
// as we use our custom spinlock
//
KeInitializeSpinLock(&MessageBufferInformation[i].BufferLock);
KeInitializeSpinLock(&MessageBufferInformation[i].BufferLockForNonImmMessage);
PlatformSpinlockInitialize(&MessageBufferInformation[i].BufferLock);
PlatformSpinlockInitialize(&MessageBufferInformation[i].BufferLockForNonImmMessage);
//
// allocate the buffer for regular buffers
@ -183,9 +183,9 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks)
//
// Zeroing the buffer
//
RtlZeroMemory((void *)MessageBufferInformation[i].BufferStartAddress, LogBufferSize);
RtlZeroMemory((void *)MessageBufferInformation[i].BufferForMultipleNonImmediateMessage, PacketChunkSize);
RtlZeroMemory((void *)MessageBufferInformation[i].BufferStartAddressPriority, LogBufferSizePriority);
PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferStartAddress, LogBufferSize);
PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferForMultipleNonImmediateMessage, PacketChunkSize);
PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferStartAddressPriority, LogBufferSizePriority);
//
// Set the end address
@ -197,7 +197,7 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks)
//
// Copy the callbacks into the global callback holder
//
RtlCopyBytes(&g_MsgTracingCallbacks, MsgTracingCallbacks, sizeof(MESSAGE_TRACING_CALLBACKS));
PlatformWriteMemory(&g_MsgTracingCallbacks, MsgTracingCallbacks, sizeof(MESSAGE_TRACING_CALLBACKS));
return TRUE;
}
@ -384,7 +384,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// vmx non-root
//
OldIRQL = KeRaiseIrqlToDpcLevel();
OldIRQL = PlatformIrqlRaiseToDpcLevel();
}
//
@ -403,7 +403,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// vmx non-root
//
KeLowerIrql(OldIRQL);
PlatformIrqlLower(OldIRQL);
}
return TRUE;
@ -431,7 +431,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// Acquire the lock
//
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
}
//
@ -500,7 +500,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// Copy the buffer
//
RtlCopyBytes(SavingBuffer, Buffer, BufferLength);
PlatformWriteMemory(SavingBuffer, Buffer, BufferLength);
//
// Increment the next index to write
@ -531,7 +531,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// Insert dpc to queue
//
KeInsertQueueDpc(&g_GlobalNotifyRecord->Dpc, g_GlobalNotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&g_GlobalNotifyRecord->Dpc, g_GlobalNotifyRecord, NULL);
//
// set notify routine to null
@ -552,7 +552,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return TRUE;
@ -598,7 +598,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
//
// Acquire the lock
//
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
}
//
@ -632,7 +632,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return ResultsOfBuffersSetToRead;
@ -658,7 +658,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
// there might be multiple messages on the start of the queue that didn't read yet)
// we don't free the header
//
RtlZeroMemory(SendingBuffer, Header->BufferLength);
PlatformZeroMemory(SendingBuffer, Header->BufferLength);
//
// Check to see whether we passed the index or not
@ -689,7 +689,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot)
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return ResultsOfBuffersSetToRead;
@ -737,7 +737,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
// Acquire the lock
//
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL);
}
//
@ -776,7 +776,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return FALSE;
@ -794,7 +794,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
// First copy the header
//
RtlCopyBytes(BufferToSaveMessage, &Header->OperationNumber, sizeof(UINT32));
PlatformWriteMemory(BufferToSaveMessage, &Header->OperationNumber, sizeof(UINT32));
//
// Second, save the buffer contents
@ -815,7 +815,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
PVOID SavingAddress = (PVOID)((UINT64)BufferToSaveMessage + sizeof(UINT32));
RtlCopyBytes(SavingAddress, SendingBuffer, Header->BufferLength);
PlatformWriteMemory(SavingAddress, SendingBuffer, Header->BufferLength);
#if ShowMessagesOnDebugger
@ -834,17 +834,17 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
{
if (i != 0)
{
DbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i) - 2));
PlatformDbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i) - 2));
}
else
{
DbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i)));
PlatformDbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i)));
}
}
}
else
{
DbgPrint("%s", (char *)SendingBuffer);
PlatformDbgPrint("%s", (char *)SendingBuffer);
}
}
#endif
@ -864,7 +864,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
// there might be multiple messages on the start of the queue that didn't read yet)
// we don't free the header
//
RtlZeroMemory(SendingBuffer, Header->BufferLength);
PlatformZeroMemory(SendingBuffer, Header->BufferLength);
if (PriorityMessageIsAvailable)
{
@ -914,7 +914,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL);
}
return TRUE;
@ -998,7 +998,7 @@ LogCallbackPrepareAndSendMessageToQueueWrapper(UINT32 OperationCode,
char * LogMessage = NULL;
char * TempMessage = NULL;
char TimeBuffer[20] = {0};
ULONG CurrentCore = KeGetCurrentProcessorNumberEx(NULL);
ULONG CurrentCore = PlatformCpuGetCurrentProcessorNumber();
//
// Set Vmx State
@ -1069,9 +1069,9 @@ LogCallbackPrepareAndSendMessageToQueueWrapper(UINT32 OperationCode,
//
TIME_FIELDS TimeFields;
LARGE_INTEGER SystemTime, LocalTime;
KeQuerySystemTime(&SystemTime);
ExSystemTimeToLocalTime(&SystemTime, &LocalTime);
RtlTimeToTimeFields(&LocalTime, &TimeFields);
PlatformTimeQuerySystemTime(&SystemTime);
PlatformTimeConvertToLocalTime(&SystemTime, &LocalTime);
PlatformTimeConvertToTimeFields(&LocalTime, &TimeFields);
//
// We won't use this because we can't use in any IRQL
@ -1287,7 +1287,7 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage,
//
// Acquire the lock
//
KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, &OldIRQL);
PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLockForNonImmMessage, &OldIRQL);
}
//
// Set the result to True
@ -1312,13 +1312,13 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage,
// Free the immediate buffer
//
MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer = 0;
RtlZeroMemory((void *)MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage, PacketChunkSize);
PlatformZeroMemory((PVOID)MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage, PacketChunkSize);
}
//
// We have to save the message
//
RtlCopyBytes((void *)(MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage +
PlatformWriteMemory((PVOID)(MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage +
MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer),
LogMessage,
BufferLen);
@ -1340,7 +1340,7 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage,
//
// Release the lock
//
KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, OldIRQL);
PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLockForNonImmMessage, OldIRQL);
}
return Result;
@ -1390,18 +1390,18 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument
//
if (!(Irp->CurrentLocation <= Irp->StackCount + 1))
{
DbgPrint("Err, probably two or more functions called DPC for an object");
PlatformDbgPrint("Err, probably two or more functions called DPC for an object");
return;
}
IrpSp = IoGetCurrentIrpStackLocation(Irp);
IrpSp = PlatformIoGetCurrentIrpStackLocation(Irp);
InBuffLength = IrpSp->Parameters.DeviceIoControl.InputBufferLength;
OutBuffLength = IrpSp->Parameters.DeviceIoControl.OutputBufferLength;
if (!InBuffLength || !OutBuffLength)
{
Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT);
break;
}
@ -1428,14 +1428,14 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument
// we have to return here as there is nothing to send here
//
Irp->IoStatus.Status = STATUS_INVALID_PARAMETER;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT);
break;
}
Irp->IoStatus.Information = Length;
Irp->IoStatus.Status = STATUS_SUCCESS;
IoCompleteRequest(Irp, IO_NO_INCREMENT);
PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT);
}
break;
@ -1443,12 +1443,12 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument
//
// Signal the Event created in user-mode.
//
KeSetEvent(NotifyRecord->Message.Event, 0, FALSE);
PlatformEventSet(NotifyRecord->Message.Event, 0, FALSE);
//
// Dereference the object as we are done with it.
//
ObDereferenceObject(NotifyRecord->Message.Event);
PlatformObjectDereference(NotifyRecord->Message.Event);
break;
@ -1488,7 +1488,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
if (g_GlobalNotifyRecord == NULL)
{
IrpStack = IoGetCurrentIrpStackLocation(Irp);
IrpStack = PlatformIoGetCurrentIrpStackLocation(Irp);
RegisterEvent = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
//
@ -1505,12 +1505,12 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
NotifyRecord->Type = IRP_BASED;
NotifyRecord->Message.PendingIrp = Irp;
KeInitializeDpc(&NotifyRecord->Dpc, // Dpc
PlatformDpcInitialize(&NotifyRecord->Dpc, // Dpc
LogNotifyUsermodeCallback, // DeferredRoutine
NotifyRecord // DeferredContext
);
IoMarkIrpPending(Irp);
PlatformIoMarkIrpPending(Irp);
//
// check for new message (for both Vmx-root mode or Vmx non root-mode)
@ -1527,7 +1527,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
//
// Insert dpc to queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
}
else if (LogCheckForNewMessage(TRUE, TRUE))
{
@ -1538,7 +1538,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
//
// Insert dpc to queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
}
else if (LogCheckForNewMessage(FALSE, FALSE))
{
@ -1550,7 +1550,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
//
// Insert dpc to queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
}
else if (LogCheckForNewMessage(TRUE, FALSE))
{
@ -1561,7 +1561,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status)
//
// Insert dpc to queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
}
else
{
@ -1599,7 +1599,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
PREGISTER_NOTIFY_BUFFER RegisterEvent;
PIRP Irp = (PIRP)TargetIrp;
IrpStack = IoGetCurrentIrpStackLocation(Irp);
IrpStack = PlatformIoGetCurrentIrpStackLocation(Irp);
RegisterEvent = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer;
//
@ -1609,13 +1609,13 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
if (NULL == NotifyRecord)
{
DbgPrint("Err, unable to allocate memory for notify record\n");
PlatformDbgPrint("Err, unable to allocate memory for notify record\n");
return FALSE;
}
NotifyRecord->Type = EVENT_BASED;
KeInitializeDpc(&NotifyRecord->Dpc, // Dpc
PlatformDpcInitialize(&NotifyRecord->Dpc, // Dpc
LogNotifyUsermodeCallback, // DeferredRoutine
NotifyRecord // DeferredContext
);
@ -1624,7 +1624,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
// Get the object pointer from the handle
// Note we must be in the context of the process that created the handle
//
Status = ObReferenceObjectByHandle(RegisterEvent->hEvent,
Status = PlatformObjectReferenceByHandle(RegisterEvent->hEvent,
SYNCHRONIZE | EVENT_MODIFY_STATE,
*ExEventObjectType,
Irp->RequestorMode,
@ -1633,7 +1633,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
if (!NT_SUCCESS(Status))
{
DbgPrint("Err, unable to reference user mode event object, status = 0x%x\n", Status);
PlatformDbgPrint("Err, unable to reference user mode event object, status = 0x%x\n", Status);
PlatformMemFreePool(NotifyRecord);
return FALSE;
}
@ -1641,7 +1641,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp)
//
// Insert dpc to the queue
//
KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL);
return TRUE;
}

9
hyperdbg/hyperlog/header/pch.h
View file

@ -48,5 +48,12 @@
//
// Platform independent headers
//
#include "platform/kernel/header/PlatformCpu.h"
#include "platform/kernel/header/PlatformDbg.h"
#include "platform/kernel/header/PlatformDpc.h"
#include "platform/kernel/header/PlatformEvent.h"
#include "platform/kernel/header/PlatformIo.h"
#include "platform/kernel/header/PlatformIrql.h"
#include "platform/kernel/header/PlatformMem.h"
#include "platform/kernel/header/PlatformIntrinsics.h"
#include "platform/kernel/header/PlatformSpinlock.h"
#include "platform/kernel/header/PlatformTime.h"

15
hyperdbg/hyperlog/hyperlog.vcxproj
View file

@ -104,13 +104,28 @@
</ItemGroup>
<ItemGroup>
<ClCompile Include="..\include\components\spinlock\code\Spinlock.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformDbg.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformDpc.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformEvent.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIo.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIrql.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformSpinlock.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformTime.c" />
<ClCompile Include="code\Logging.c" />
<ClCompile Include="code\UnloadDll.c" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\include\components\spinlock\header\Spinlock.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformDpc.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformEvent.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIo.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIrql.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformSpinlock.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformTime.h" />
<ClInclude Include="header\Logging.h" />
<ClInclude Include="header\pch.h" />
<ClInclude Include="header\UnloadDll.h" />

45
hyperdbg/hyperlog/hyperlog.vcxproj.filters
View file

@ -38,6 +38,30 @@
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformDbg.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformIrql.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformEvent.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformIo.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformSpinlock.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformTime.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformDpc.c">
<Filter>code\platform</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="header\Logging.h">
@ -55,5 +79,26 @@
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformDpc.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformIrql.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformEvent.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformIo.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformSpinlock.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformTime.h">
<Filter>header\platform</Filter>
</ClInclude>
</ItemGroup>
</Project>

4
hyperdbg/hypertrace/code/api/TraceApi.c
View file

@ -43,12 +43,12 @@ HyperTraceInitCallback(HYPERTRACE_CALLBACKS * HypertraceCallbacks,
//
// Save the callbacks
//
RtlCopyMemory(&g_Callbacks, HypertraceCallbacks, sizeof(HYPERTRACE_CALLBACKS));
PlatformWriteMemory(&g_Callbacks, HypertraceCallbacks, sizeof(HYPERTRACE_CALLBACKS));
//
// Query the number of processors in the system to initialize the global LBR state list accordingly
//
ProcessorsCount = KeQueryActiveProcessorCount(0);
ProcessorsCount = PlatformCpuGetActiveProcessorCount();
//
// Initialize the global LBR state list to hold LBR states for each core

44
hyperdbg/hypertrace/code/broadcast/DpcRoutines.c
View file

@ -58,15 +58,10 @@ DpcRoutineEnableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PV
//
LbrStart(LBR_SELECT_WITHOUT_FILTER);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
return TRUE;
}
@ -117,15 +112,10 @@ DpcRoutineDisableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, P
}
}
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
return TRUE;
}
@ -150,15 +140,10 @@ DpcRoutineFlushLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVO
//
LbrFlush();
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
return TRUE;
}
@ -182,15 +167,10 @@ DpcRoutineFilterLbrOptions(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgume
//
LbrFilter((UINT64)DeferredContext);
// ------------------------------------------------------------------------------
// Synchronize the end of this routine with the caller
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2);
return TRUE;
}

10
hyperdbg/hypertrace/header/pch.h
View file

@ -57,11 +57,19 @@
//
#include "platform/kernel/header/PlatformMem.h"
#include "platform/kernel/header/PlatformIntrinsics.h"
#include "platform/kernel/header/PlatformBroadcast.h"
#include "platform/kernel/header/PlatformCpu.h"
#include "platform/kernel/header/PlatformSpinlock.h"
#include "platform/kernel/header/PlatformIrql.h"
#include "platform/kernel/header/PlatformDpc.h"
#include "platform/kernel/header/PlatformTime.h"
#include "platform/kernel/header/PlatformDbg.h"
#include "platform/kernel/header/PlatformIo.h"
#include "platform/kernel/header/PlatformEvent.h"
//
// DPC and broadcasting function headers
//
#include "broadcast/Dpc.h"
#include "broadcast/DpcRoutines.h"
#include "broadcast/Broadcast.h"

5
hyperdbg/hypertrace/hypertrace.vcxproj
View file

@ -101,6 +101,8 @@
</ItemGroup>
<ItemGroup>
<ClCompile Include="..\include\components\interface\HyperLogCallback.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsics.c" />
<ClCompile Include="..\include\platform\kernel\code\PlatformMem.c" />
<ClCompile Include="code\api\LbrApi.c" />
@ -114,13 +116,14 @@
</ItemGroup>
<ItemGroup>
<ClInclude Include="..\include\components\interface\HyperLogCallback.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsics.h" />
<ClInclude Include="..\include\platform\kernel\header\PlatformMem.h" />
<ClInclude Include="header\api\LbrApi.h" />
<ClInclude Include="header\api\PtApi.h" />
<ClInclude Include="header\api\TraceApi.h" />
<ClInclude Include="header\broadcast\Broadcast.h" />
<ClInclude Include="header\broadcast\Dpc.h" />
<ClInclude Include="header\broadcast\DpcRoutines.h" />
<ClInclude Include="header\common\UnloadDll.h" />
<ClInclude Include="header\globals\GlobalVariables.h" />

15
hyperdbg/hypertrace/hypertrace.vcxproj.filters
View file

@ -89,6 +89,12 @@
<ClCompile Include="..\include\platform\kernel\code\PlatformIntrinsics.c">
<Filter>code\platform</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformBroadcast.c">
<Filter>code\broadcast</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\kernel\code\PlatformCpu.c">
<Filter>code\platform</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="header\pch.h">
@ -106,9 +112,6 @@
<ClInclude Include="header\broadcast\Broadcast.h">
<Filter>header\broadcast</Filter>
</ClInclude>
<ClInclude Include="header\broadcast\Dpc.h">
<Filter>header\broadcast</Filter>
</ClInclude>
<ClInclude Include="header\broadcast\DpcRoutines.h">
<Filter>header\broadcast</Filter>
</ClInclude>
@ -133,5 +136,11 @@
<ClInclude Include="..\include\platform\kernel\header\PlatformIntrinsics.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformBroadcast.h">
<Filter>header\platform</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\kernel\header\PlatformCpu.h">
<Filter>header\platform</Filter>
</ClInclude>
</ItemGroup>
</Project>

24
hyperdbg/include/SDK/HyperDbgSdk.h
View file

@ -1,5 +1,18 @@
#pragma once
//
// General SDK Headers
//
#include "SDK/headers/Constants.h"
#include "SDK/headers/BasicTypes.h"
#include "SDK/headers/ErrorCodes.h"
#include "SDK/headers/Connection.h"
#include "SDK/headers/DataTypes.h"
#include "SDK/headers/Ioctls.h"
#include "SDK/headers/Events.h"
#include "SDK/headers/Symbols.h"
#include "SDK/headers/HardwareDebugger.h"
//
// Devices
//
@ -11,18 +24,9 @@
#include "SDK/headers/LbrDefinitions.h"
//
// General SDK Headers
// Request Packets
//
#include "SDK/headers/Constants.h"
#include "SDK/headers/BasicTypes.h"
#include "SDK/headers/ErrorCodes.h"
#include "SDK/headers/Connection.h"
#include "SDK/headers/DataTypes.h"
#include "SDK/headers/Ioctls.h"
#include "SDK/headers/Events.h"
#include "SDK/headers/RequestStructures.h"
#include "SDK/headers/Symbols.h"
#include "SDK/headers/HardwareDebugger.h"
//
// Asserts

6
hyperdbg/include/SDK/headers/BasicTypes.h
View file

@ -63,6 +63,9 @@ typedef unsigned __int64 UINT64, *PUINT64;
typedef unsigned __int64 ULONG64, *PULONG64;
typedef unsigned __int64 DWORD64, *PDWORD64;
typedef unsigned __int64 ULONG_PTR, *PULONG_PTR;
typedef unsigned __int64 ULONGLONG;
typedef wchar_t WCHAR;
#elif defined(__linux__) // Linux
@ -77,6 +80,9 @@ typedef unsigned long long UINT64, *PUINT64;
typedef unsigned long long ULONG64, *PULONG64;
typedef unsigned long long DWORD64, *PDWORD64;
typedef unsigned long long ULONGLONG;
typedef unsigned long long ULONG_PTR, *PULONG_PTR;
//
// To be fixed later, linux wchar_t is 4 bytes, but windows wchar_t is 2 bytes
//

44
hyperdbg/include/platform/kernel/code/PlatformBroadcast.c Normal file
View file

@ -0,0 +1,44 @@
/**
* @file PlatformBroadcast.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for broadcasting routines
* @details
* @version 0.19
* @date 2026-05-08
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformBroadcast.h"
#endif // defined(__linux__)
/**
* @brief This function synchronize the function execution for a single core
*
* @return VOID
*/
VOID
PlatformBroadcastSynchronizeEndOfRoutine(PVOID SystemArgument1, PVOID SystemArgument2)
{
#if defined(_WIN32) || defined(_WIN64)
//
// Wait for all DPCs to synchronize at this point
//
KeSignalCallDpcSynchronize(SystemArgument2);
//
// Mark the DPC as being complete
//
KeSignalCallDpcDone(SystemArgument1);
#elif defined(__linux__)
//
// Not needed for Linux
//
#else
# error "Unsupported platform"
#endif
}

62
hyperdbg/include/platform/kernel/code/PlatformCpu.c Normal file
View file

@ -0,0 +1,62 @@
/**
* @file PlatformCpu.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for CPU and processor queries
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformCpu.h"
#endif // defined(__linux__)
/**
* @brief Get the count of active logical processors
*
* @return ULONG
*/
ULONG
PlatformCpuGetActiveProcessorCount(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return KeQueryActiveProcessorCount(0);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the current logical processor number
*
* @return ULONG
*/
ULONG
PlatformCpuGetCurrentProcessorNumber(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return KeGetCurrentProcessorNumberEx(NULL);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

44
hyperdbg/include/platform/kernel/code/PlatformDbg.c Normal file
View file

@ -0,0 +1,44 @@
/**
* @file PlatformDbg.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for kernel debug output
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformDbg.h"
#endif // defined(__linux__)
/**
* @brief Print a debug message to the kernel debugger
*
* @param Format printf-style format string
* @param ... Variable arguments
* @return VOID
*/
VOID
PlatformDbgPrint(const CHAR * Format, ...)
{
#if defined(_WIN32) || defined(_WIN64)
va_list ArgList;
va_start(ArgList, Format);
vDbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Format, ArgList);
va_end(ArgList);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

68
hyperdbg/include/platform/kernel/code/PlatformDpc.c Normal file
View file

@ -0,0 +1,68 @@
/**
* @file PlatformDpc.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for Deferred Procedure Call (DPC) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformDpc.h"
#endif // defined(__linux__)
/**
* @brief Initialize a DPC object
*
* @param Dpc Pointer to the KDPC structure to initialize
* @param DeferredRoutine The deferred procedure to be called
* @param DeferredContext Optional context passed to the deferred routine
* @return VOID
*/
VOID
PlatformDpcInitialize(PRKDPC Dpc, PKDEFERRED_ROUTINE DeferredRoutine, PVOID DeferredContext)
{
#if defined(_WIN32) || defined(_WIN64)
KeInitializeDpc(Dpc, DeferredRoutine, DeferredContext);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Insert a DPC into the system DPC queue for execution
*
* @param Dpc Pointer to the initialized KDPC structure
* @param SystemArgument1 First system-defined argument passed to the deferred routine
* @param SystemArgument2 Second system-defined argument passed to the deferred routine
* @return BOOLEAN TRUE if the DPC was successfully queued, FALSE if it was already in the queue
*/
BOOLEAN
PlatformDpcInsertQueueDpc(PRKDPC Dpc, PVOID SystemArgument1, PVOID SystemArgument2)
{
#if defined(_WIN32) || defined(_WIN64)
return KeInsertQueueDpc(Dpc, SystemArgument1, SystemArgument2);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

105
hyperdbg/include/platform/kernel/code/PlatformEvent.c Normal file
View file

@ -0,0 +1,105 @@
/**
* @file PlatformEvent.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for kernel event and object management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformEvent.h"
#endif // defined(__linux__)
/**
* @brief Dereference a kernel object, decrementing its reference count
*
* @param Object Pointer to the kernel object to dereference
* @return VOID
*/
VOID
PlatformObjectDereference(PVOID Object)
{
#if defined(_WIN32) || defined(_WIN64)
ObDereferenceObject(Object);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Signal (set) a kernel event object
*
* @param Event Pointer to the KEVENT to signal
* @param Increment Priority increment for any waiting threads to be awakened
* @param Wait If TRUE, the caller intends to immediately call a wait routine after this call
* @return LONG The previous signal state of the event
*/
LONG
PlatformEventSet(PKEVENT Event, KPRIORITY Increment, BOOLEAN Wait)
{
#if defined(_WIN32) || defined(_WIN64)
return KeSetEvent(Event, Increment, Wait);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Obtain a pointer to a kernel object by its user-mode handle and increment its reference count
*
* @param Handle User-mode handle referencing the kernel object
* @param DesiredAccess Access mask for the requested access rights
* @param ObjectType Pointer to the object type object (e.g., *ExEventObjectType); NULL to skip type check
* @param AccessMode Processor mode to use for access checks (KernelMode or UserMode)
* @param Object Receives a pointer to the referenced kernel object body
* @param HandleInformation Optional; receives access state information
* @return NTSTATUS STATUS_SUCCESS on success, or an error code on failure
*/
NTSTATUS
PlatformObjectReferenceByHandle(HANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID * Object,
POBJECT_HANDLE_INFORMATION HandleInformation)
{
#if defined(_WIN32) || defined(_WIN64)
return ObReferenceObjectByHandle(Handle,
DesiredAccess,
ObjectType,
AccessMode,
Object,
HandleInformation);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

107
hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c
View file

@ -1,4 +1,4 @@
/**
/**
* @file PlatformIntrinsics.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for intrinsic functions (x86 instructions)
@ -30,7 +30,9 @@ CpuReadCr0(VOID)
#if defined(_WIN32) || defined(_WIN64)
return __readcr0();
#elif defined(__linux__)
# error "Not implemented"
ULONG_PTR __val;
__asm__ __volatile__("mov %%cr0, %0" : "=r"(__val));
return __val;
#else
# error "Unsupported platform"
#endif
@ -47,7 +49,7 @@ CpuWriteCr0(ULONG_PTR Cr0Value)
#if defined(_WIN32) || defined(_WIN64)
__writecr0(Cr0Value);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("mov %0, %%cr0" : : "r"(Cr0Value) : "memory");
#else
# error "Unsupported platform"
#endif
@ -64,7 +66,9 @@ CpuReadCr2(VOID)
#if defined(_WIN32) || defined(_WIN64)
return __readcr2();
#elif defined(__linux__)
# error "Not implemented"
ULONG_PTR __val;
__asm__ __volatile__("mov %%cr2, %0" : "=r"(__val));
return __val;
#else
# error "Unsupported platform"
#endif
@ -81,7 +85,7 @@ CpuWriteCr2(ULONG_PTR Cr2Value)
#if defined(_WIN32) || defined(_WIN64)
__writecr2(Cr2Value);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("mov %0, %%cr2" : : "r"(Cr2Value) : "memory");
#else
# error "Unsupported platform"
#endif
@ -98,7 +102,9 @@ CpuReadCr3(VOID)
#if defined(_WIN32) || defined(_WIN64)
return __readcr3();
#elif defined(__linux__)
# error "Not implemented"
ULONG_PTR __val;
__asm__ __volatile__("mov %%cr3, %0" : "=r"(__val));
return __val;
#else
# error "Unsupported platform"
#endif
@ -115,7 +121,7 @@ CpuWriteCr3(ULONG_PTR Cr3Value)
#if defined(_WIN32) || defined(_WIN64)
__writecr3(Cr3Value);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("mov %0, %%cr3" : : "r"(Cr3Value) : "memory");
#else
# error "Unsupported platform"
#endif
@ -132,7 +138,9 @@ CpuReadCr4(VOID)
#if defined(_WIN32) || defined(_WIN64)
return __readcr4();
#elif defined(__linux__)
# error "Not implemented"
ULONG_PTR __val;
__asm__ __volatile__("mov %%cr4, %0" : "=r"(__val));
return __val;
#else
# error "Unsupported platform"
#endif
@ -149,7 +157,7 @@ CpuWriteCr4(ULONG_PTR Cr4Value)
#if defined(_WIN32) || defined(_WIN64)
__writecr4(Cr4Value);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("mov %0, %%cr4" : : "r"(Cr4Value) : "memory");
#else
# error "Unsupported platform"
#endif
@ -166,7 +174,9 @@ CpuReadCr8(VOID)
#if defined(_WIN32) || defined(_WIN64)
return __readcr8();
#elif defined(__linux__)
# error "Not implemented"
ULONG_PTR __val;
__asm__ __volatile__("mov %%cr8, %0" : "=r"(__val));
return __val;
#else
# error "Unsupported platform"
#endif
@ -183,7 +193,7 @@ CpuWriteCr8(ULONG_PTR Cr8Value)
#if defined(_WIN32) || defined(_WIN64)
__writecr8(Cr8Value);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("mov %0, %%cr8" : : "r"(Cr8Value) : "memory");
#else
# error "Unsupported platform"
#endif
@ -205,7 +215,9 @@ CpuReadMsr(ULONG MsrAddress)
#if defined(_WIN32) || defined(_WIN64)
return __readmsr(MsrAddress);
#elif defined(__linux__)
# error "Not implemented"
UINT32 __lo, __hi;
__asm__ __volatile__("rdmsr" : "=a"(__lo), "=d"(__hi) : "c"(MsrAddress));
return ((UINT64)__hi << 32) | __lo;
#else
# error "Unsupported platform"
#endif
@ -223,7 +235,7 @@ CpuWriteMsr(ULONG MsrAddress, UINT64 MsrValue)
#if defined(_WIN32) || defined(_WIN64)
__writemsr(MsrAddress, MsrValue);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("wrmsr" : : "c"(MsrAddress), "a"((UINT32)MsrValue), "d"((UINT32)(MsrValue >> 32)));
#else
# error "Unsupported platform"
#endif
@ -245,7 +257,7 @@ CpuCpuId(INT32 * CpuInfo, INT32 FunctionId)
#if defined(_WIN32) || defined(_WIN64)
__cpuid(CpuInfo, FunctionId);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("cpuid" : "=a"(CpuInfo[0]), "=b"(CpuInfo[1]), "=c"(CpuInfo[2]), "=d"(CpuInfo[3]) : "a"(FunctionId), "c"(0));
#else
# error "Unsupported platform"
#endif
@ -264,7 +276,7 @@ CpuCpuIdEx(INT32 * CpuInfo, INT32 FunctionId, INT32 SubFunctionId)
#if defined(_WIN32) || defined(_WIN64)
__cpuidex(CpuInfo, FunctionId, SubFunctionId);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("cpuid" : "=a"(CpuInfo[0]), "=b"(CpuInfo[1]), "=c"(CpuInfo[2]), "=d"(CpuInfo[3]) : "a"(FunctionId), "c"(SubFunctionId));
#else
# error "Unsupported platform"
#endif
@ -285,7 +297,9 @@ CpuReadTsc(VOID)
#if defined(_WIN32) || defined(_WIN64)
return __rdtsc();
#elif defined(__linux__)
# error "Not implemented"
UINT32 __lo, __hi;
__asm__ __volatile__("rdtsc" : "=a"(__lo), "=d"(__hi));
return ((UINT64)__hi << 32) | __lo;
#else
# error "Unsupported platform"
#endif
@ -303,7 +317,9 @@ CpuReadTscp(UINT32 * Aux)
#if defined(_WIN32) || defined(_WIN64)
return __rdtscp(Aux);
#elif defined(__linux__)
# error "Not implemented"
UINT32 __lo, __hi;
__asm__ __volatile__("rdtscp" : "=a"(__lo), "=d"(__hi), "=c"(*Aux));
return ((UINT64)__hi << 32) | __lo;
#else
# error "Unsupported platform"
#endif
@ -324,7 +340,7 @@ CpuSidt(VOID * Idtr)
#if defined(_WIN32) || defined(_WIN64)
__sidt(Idtr);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("sidt %0" : "=m"(*(char *)Idtr) : : "memory");
#else
# error "Unsupported platform"
#endif
@ -345,7 +361,7 @@ CpuInvlpg(VOID * Address)
#if defined(_WIN32) || defined(_WIN64)
__invlpg(Address);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("invlpg (%0)" : : "r"(Address) : "memory");
#else
# error "Unsupported platform"
#endif
@ -368,7 +384,7 @@ CpuStosQ(UINT64 * Destination, UINT64 Value, SIZE_T Count)
#if defined(_WIN32) || defined(_WIN64)
__stosq((unsigned __int64 *)Destination, Value, Count);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("rep stosq" : "+D"(Destination), "+c"(Count) : "a"(Value) : "memory");
#else
# error "Unsupported platform"
#endif
@ -391,7 +407,10 @@ CpuBitScanForward64(ULONG * Index, UINT64 Mask)
#if defined(_WIN32) || defined(_WIN64)
return (UCHAR)_BitScanForward64((unsigned long *)Index, Mask);
#elif defined(__linux__)
# error "Not implemented"
if (!Mask)
return 0;
*Index = (ULONG)__builtin_ctzll(Mask);
return 1;
#else
# error "Unsupported platform"
#endif
@ -410,7 +429,7 @@ CpuNop(VOID)
#if defined(_WIN32) || defined(_WIN64)
__nop();
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("nop");
#else
# error "Unsupported platform"
#endif
@ -425,7 +444,7 @@ CpuPause(VOID)
#if defined(_WIN32) || defined(_WIN64)
_mm_pause();
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("pause");
#else
# error "Unsupported platform"
#endif
@ -443,7 +462,17 @@ CpuSegmentLimit(UINT32 Selector)
#if defined(_WIN32) || defined(_WIN64)
return __segmentlimit(Selector);
#elif defined(__linux__)
# error "Not implemented"
UINT32 Limit;
__asm__ __volatile__(
"lsl %1, %0"
: "=r"(Limit)
: "rm"(Selector)
: "cc");
return Limit;
#else
# error "Unsupported platform"
#endif
@ -465,7 +494,9 @@ CpuIoInByte(UINT16 Port)
#if defined(_WIN32) || defined(_WIN64)
return __inbyte(Port);
#elif defined(__linux__)
# error "Not implemented"
UINT8 __val;
__asm__ __volatile__("inb %1, %0" : "=a"(__val) : "Nd"(Port));
return __val;
#else
# error "Unsupported platform"
#endif
@ -483,7 +514,9 @@ CpuIoInWord(UINT16 Port)
#if defined(_WIN32) || defined(_WIN64)
return __inword(Port);
#elif defined(__linux__)
# error "Not implemented"
UINT16 __val;
__asm__ __volatile__("inw %1, %0" : "=a"(__val) : "Nd"(Port));
return __val;
#else
# error "Unsupported platform"
#endif
@ -501,7 +534,9 @@ CpuIoInDword(UINT16 Port)
#if defined(_WIN32) || defined(_WIN64)
return __indword(Port);
#elif defined(__linux__)
# error "Not implemented"
UINT32 __val;
__asm__ __volatile__("inl %1, %0" : "=a"(__val) : "Nd"(Port));
return __val;
#else
# error "Unsupported platform"
#endif
@ -520,7 +555,7 @@ CpuIoInByteString(UINT16 Port, UINT8 * Data, UINT32 Size)
#if defined(_WIN32) || defined(_WIN64)
__inbytestring(Port, Data, Size);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("rep insb" : "+D"(Data), "+c"(Size) : "d"(Port) : "memory");
#else
# error "Unsupported platform"
#endif
@ -539,7 +574,7 @@ CpuIoInWordString(UINT16 Port, UINT16 * Data, UINT32 Size)
#if defined(_WIN32) || defined(_WIN64)
__inwordstring(Port, Data, Size);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("rep insw" : "+D"(Data), "+c"(Size) : "d"(Port) : "memory");
#else
# error "Unsupported platform"
#endif
@ -558,7 +593,7 @@ CpuIoInDwordString(UINT16 Port, UINT32 * Data, UINT32 Size)
#if defined(_WIN32) || defined(_WIN64)
__indwordstring(Port, (unsigned long *)Data, Size);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("rep insl" : "+D"(Data), "+c"(Size) : "d"(Port) : "memory");
#else
# error "Unsupported platform"
#endif
@ -576,7 +611,7 @@ CpuIoOutByte(UINT16 Port, UINT8 Value)
#if defined(_WIN32) || defined(_WIN64)
__outbyte(Port, Value);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("outb %0, %1" : : "a"(Value), "Nd"(Port));
#else
# error "Unsupported platform"
#endif
@ -594,7 +629,7 @@ CpuIoOutWord(UINT16 Port, UINT16 Value)
#if defined(_WIN32) || defined(_WIN64)
__outword(Port, Value);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("outw %0, %1" : : "a"(Value), "Nd"(Port));
#else
# error "Unsupported platform"
#endif
@ -612,7 +647,7 @@ CpuIoOutDword(UINT16 Port, UINT32 Value)
#if defined(_WIN32) || defined(_WIN64)
__outdword(Port, Value);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("outl %0, %1" : : "a"(Value), "Nd"(Port));
#else
# error "Unsupported platform"
#endif
@ -631,7 +666,7 @@ CpuIoOutByteString(UINT16 Port, UINT8 * Data, UINT32 Count)
#if defined(_WIN32) || defined(_WIN64)
__outbytestring(Port, Data, Count);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("rep outsb" : "+S"(Data), "+c"(Count) : "d"(Port) : "memory");
#else
# error "Unsupported platform"
#endif
@ -650,7 +685,7 @@ CpuIoOutWordString(UINT16 Port, UINT16 * Data, UINT32 Count)
#if defined(_WIN32) || defined(_WIN64)
__outwordstring(Port, Data, Count);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("rep outsw" : "+S"(Data), "+c"(Count) : "d"(Port) : "memory");
#else
# error "Unsupported platform"
#endif
@ -669,7 +704,7 @@ CpuIoOutDwordString(UINT16 Port, UINT32 * Data, UINT32 Count)
#if defined(_WIN32) || defined(_WIN64)
__outdwordstring(Port, (unsigned long *)Data, Count);
#elif defined(__linux__)
# error "Not implemented"
__asm__ __volatile__("rep outsl" : "+S"(Data), "+c"(Count) : "d"(Port) : "memory");
#else
# error "Unsupported platform"
#endif

89
hyperdbg/include/platform/kernel/code/PlatformIo.c Normal file
View file

@ -0,0 +1,89 @@
/**
* @file PlatformIo.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for I/O Request Packet (IRP) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformIo.h"
#endif // defined(__linux__)
/**
* @brief Get the current I/O stack location from an IRP
*
* @param Irp Pointer to the IRP (I/O Request Packet)
* @return PIO_STACK_LOCATION Pointer to the current stack location
*/
PIO_STACK_LOCATION
PlatformIoGetCurrentIrpStackLocation(PIRP Irp)
{
#if defined(_WIN32) || defined(_WIN64)
return IoGetCurrentIrpStackLocation(Irp);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Complete an IRP and release it back to the I/O manager
*
* @param Irp Pointer to the IRP to complete
* @param PriorityBoost Priority boost value (e.g., IO_NO_INCREMENT)
* @return VOID
*/
VOID
PlatformIoCompleteRequest(PIRP Irp, CCHAR PriorityBoost)
{
#if defined(_WIN32) || defined(_WIN64)
IoCompleteRequest(Irp, PriorityBoost);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Mark the current IRP stack location as pending
*
* @param Irp Pointer to the IRP to mark as pending
* @return VOID
*/
VOID
PlatformIoMarkIrpPending(PIRP Irp)
{
#if defined(_WIN32) || defined(_WIN64)
IoMarkIrpPending(Irp);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

63
hyperdbg/include/platform/kernel/code/PlatformIrql.c Normal file
View file

@ -0,0 +1,63 @@
/**
* @file PlatformIrql.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for IRQL management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformIrql.h"
#endif // defined(__linux__)
/**
* @brief Raise the current IRQL to DISPATCH_LEVEL
*
* @return KIRQL The previous IRQL before the raise
*/
KIRQL
PlatformIrqlRaiseToDpcLevel(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return KeRaiseIrqlToDpcLevel();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Lower the current IRQL to the previously saved value
*
* @param OldIrql The previous IRQL to restore
* @return VOID
*/
VOID
PlatformIrqlLower(KIRQL OldIrql)
{
#if defined(_WIN32) || defined(_WIN64)
KeLowerIrql(OldIrql);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

22
hyperdbg/include/platform/kernel/code/PlatformMem.c
View file

@ -121,6 +121,28 @@ PlatformSetMemory(
#endif
}
/**
* @brief Zeros a memory block.
* @param Destination Memory address.
* @param Size Number of bytes.
*/
VOID
PlatformZeroMemory(
PVOID Destination,
SIZE_T Size)
{
if (!Destination)
return;
#ifdef _WIN32
RtlZeroMemory(Destination, Size);
#elif defined(__linux__)
memset(Destination, 0, Size);
#else
# error "Unsupported platform"
#endif
}
/////////////////////////////////////////////////
/// ... Backward Compatibility / Specific APIs ...
/////////////////////////////////////////////////

131
hyperdbg/include/platform/kernel/code/PlatformProcess.c Normal file
View file

@ -0,0 +1,131 @@
/**
* @file PlatformProcess.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for process and thread queries
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformProcess.h"
#endif // defined(__linux__)
/**
* @brief Get the current thread ID
*
* @return HANDLE
*/
HANDLE
PlatformProcessGetCurrentThreadId(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return PsGetCurrentThreadId();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the current process ID
*
* @return HANDLE
*/
HANDLE
PlatformProcessGetCurrentProcessId(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return PsGetCurrentProcessId();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the current process (PEPROCESS)
*
* @return PVOID Pointer to the EPROCESS structure for the current process
*/
PVOID
PlatformProcessGetCurrentProcess(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return (PVOID)PsGetCurrentProcess();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the current thread (PETHREAD)
*
* @return PVOID Pointer to the ETHREAD structure for the current thread
*/
PVOID
PlatformProcessGetCurrentThread(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return (PVOID)PsGetCurrentThread();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Get the TEB (Thread Environment Block) of the current thread
*
* @return PVOID Pointer to the TEB of the current thread
*/
PVOID
PlatformProcessGetCurrentThreadTeb(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return PsGetCurrentThreadTeb();
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

90
hyperdbg/include/platform/kernel/code/PlatformSpinlock.c Normal file
View file

@ -0,0 +1,90 @@
/**
* @file PlatformSpinlock.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for kernel spinlock operations
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformSpinlock.h"
#endif // defined(__linux__)
/**
* @brief Initialize a kernel spinlock
*
* @param SpinLock Pointer to the KSPIN_LOCK to initialize
* @return VOID
*/
VOID
PlatformSpinlockInitialize(PKSPIN_LOCK SpinLock)
{
#if defined(_WIN32) || defined(_WIN64)
KeInitializeSpinLock(SpinLock);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Acquire a kernel spinlock, raising IRQL to DISPATCH_LEVEL
*
* @param SpinLock Pointer to the KSPIN_LOCK to acquire
* @param OldIrql Receives the previous IRQL value to be restored on release
* @return VOID
*/
VOID
PlatformSpinlockAcquire(PKSPIN_LOCK SpinLock, PKIRQL OldIrql)
{
#if defined(_WIN32) || defined(_WIN64)
KeAcquireSpinLock(SpinLock, OldIrql);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Release a previously acquired kernel spinlock and restore IRQL
*
* @param SpinLock Pointer to the KSPIN_LOCK to release
* @param OldIrql The previous IRQL value saved during acquire
* @return VOID
*/
VOID
PlatformSpinlockRelease(PKSPIN_LOCK SpinLock, KIRQL OldIrql)
{
#if defined(_WIN32) || defined(_WIN64)
KeReleaseSpinLock(SpinLock, OldIrql);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

90
hyperdbg/include/platform/kernel/code/PlatformTime.c Normal file
View file

@ -0,0 +1,90 @@
/**
* @file PlatformTime.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for system time operations
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/PlatformTime.h"
#endif // defined(__linux__)
/**
* @brief Query the current system time
*
* @param SystemTime Receives the current system time as a LARGE_INTEGER (100-nanosecond units since January 1, 1601)
* @return VOID
*/
VOID
PlatformTimeQuerySystemTime(PLARGE_INTEGER SystemTime)
{
#if defined(_WIN32) || defined(_WIN64)
KeQuerySystemTime(SystemTime);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Convert system time (UTC) to local time
*
* @param SystemTime Pointer to the system time value in UTC
* @param LocalTime Receives the converted local time value
* @return VOID
*/
VOID
PlatformTimeConvertToLocalTime(PLARGE_INTEGER SystemTime, PLARGE_INTEGER LocalTime)
{
#if defined(_WIN32) || defined(_WIN64)
ExSystemTimeToLocalTime(SystemTime, LocalTime);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Convert a LARGE_INTEGER time value to a TIME_FIELDS structure
*
* @param Time Pointer to the time value to convert
* @param TimeFields Receives the broken-down time fields (year, month, day, hour, minute, etc.)
* @return VOID
*/
VOID
PlatformTimeConvertToTimeFields(PLARGE_INTEGER Time, PTIME_FIELDS TimeFields)
{
#if defined(_WIN32) || defined(_WIN64)
RtlTimeToTimeFields(Time, TimeFields);
#elif defined(__linux__)
# error "Not yet implemented"
#else
# error "Unsupported platform"
#endif
}

22
hyperdbg/hypertrace/header/broadcast/Dpc.h → hyperdbg/include/platform/kernel/header/PlatformBroadcast.h
View file

@ -1,21 +1,26 @@
/**
* @file Dpc.h
* @file PlatformBroadcast.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Definition for Windows DPC functions
* @brief Cross platform APIs for broadcasting routines
* @details
* @version 0.19
* @date 2026-04-19
* @date 2026-05-08
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
NTKERNELAPI
_IRQL_requires_max_(APC_LEVEL)
_IRQL_requires_min_(PASSIVE_LEVEL)
@ -38,3 +43,12 @@ _IRQL_requires_same_
LOGICAL
KeSignalCallDpcSynchronize(
_In_ PVOID SystemArgument2);
#endif // defined(_WIN32) || defined(_WIN64)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
VOID
PlatformBroadcastSynchronizeEndOfRoutine(PVOID SystemArgument1, PVOID SystemArgument2);

26
hyperdbg/include/platform/kernel/header/PlatformCpu.h Normal file
View file

@ -0,0 +1,26 @@
/**
* @file PlatformCpu.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for CPU and processor queries
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
ULONG
PlatformCpuGetActiveProcessorCount(VOID);
ULONG
PlatformCpuGetCurrentProcessorNumber(VOID);

23
hyperdbg/include/platform/kernel/header/PlatformDbg.h Normal file
View file

@ -0,0 +1,23 @@
/**
* @file PlatformDbg.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for kernel debug output
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
VOID
PlatformDbgPrint(const CHAR * Format, ...);

30
hyperdbg/include/platform/kernel/header/PlatformDpc.h Normal file
View file

@ -0,0 +1,30 @@
/**
* @file PlatformDpc.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for Deferred Procedure Call (DPC) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
VOID
PlatformDpcInitialize(PRKDPC Dpc, PKDEFERRED_ROUTINE DeferredRoutine, PVOID DeferredContext);
BOOLEAN
PlatformDpcInsertQueueDpc(PRKDPC Dpc, PVOID SystemArgument1, PVOID SystemArgument2);
#endif // defined(_WIN32) || defined(_WIN64)

38
hyperdbg/include/platform/kernel/header/PlatformEvent.h Normal file
View file

@ -0,0 +1,38 @@
/**
* @file PlatformEvent.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for kernel event and object management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
VOID
PlatformObjectDereference(PVOID Object);
#if defined(_WIN32) || defined(_WIN64)
LONG
PlatformEventSet(PKEVENT Event, KPRIORITY Increment, BOOLEAN Wait);
NTSTATUS
PlatformObjectReferenceByHandle(HANDLE Handle,
ACCESS_MASK DesiredAccess,
POBJECT_TYPE ObjectType,
KPROCESSOR_MODE AccessMode,
PVOID * Object,
POBJECT_HANDLE_INFORMATION HandleInformation);
#endif // defined(_WIN32) || defined(_WIN64)

58
hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h
View file

@ -105,7 +105,35 @@ CpuWriteMsr(ULONG MsrAddress, UINT64 MsrValue);
#if defined(_WIN32) || defined(_WIN64)
# define CpuReadDr(DrNumber) __readdr(DrNumber)
#elif defined(__linux__)
# error "Not implemented"
# define CpuReadDr(DrNumber) \
({ \
ULONG_PTR __val; \
switch (DrNumber) \
{ \
case 0: \
__asm__ volatile("mov %%dr0, %0" : "=r"(__val)); \
break; \
case 1: \
__asm__ volatile("mov %%dr1, %0" : "=r"(__val)); \
break; \
case 2: \
__asm__ volatile("mov %%dr2, %0" : "=r"(__val)); \
break; \
case 3: \
__asm__ volatile("mov %%dr3, %0" : "=r"(__val)); \
break; \
case 6: \
__asm__ volatile("mov %%dr6, %0" : "=r"(__val)); \
break; \
case 7: \
__asm__ volatile("mov %%dr7, %0" : "=r"(__val)); \
break; \
default: \
__val = 0; \
break; \
} \
__val; \
})
#else
# error "Unsupported platform"
#endif
@ -116,7 +144,33 @@ CpuWriteMsr(ULONG MsrAddress, UINT64 MsrValue);
#if defined(_WIN32) || defined(_WIN64)
# define CpuWriteDr(DrNumber, DrValue) __writedr(DrNumber, DrValue)
#elif defined(__linux__)
# error "Not implemented"
# define CpuWriteDr(DrNumber, DrValue) \
do \
{ \
switch (DrNumber) \
{ \
case 0: \
__asm__ volatile("mov %0, %%dr0" : : "r"((ULONG_PTR)(DrValue))); \
break; \
case 1: \
__asm__ volatile("mov %0, %%dr1" : : "r"((ULONG_PTR)(DrValue))); \
break; \
case 2: \
__asm__ volatile("mov %0, %%dr2" : : "r"((ULONG_PTR)(DrValue))); \
break; \
case 3: \
__asm__ volatile("mov %0, %%dr3" : : "r"((ULONG_PTR)(DrValue))); \
break; \
case 6: \
__asm__ volatile("mov %0, %%dr6" : : "r"((ULONG_PTR)(DrValue))); \
break; \
case 7: \
__asm__ volatile("mov %0, %%dr7" : : "r"((ULONG_PTR)(DrValue))); \
break; \
default: \
break; \
} \
} while (0)
#else
# error "Unsupported platform"
#endif

33
hyperdbg/include/platform/kernel/header/PlatformIo.h Normal file
View file

@ -0,0 +1,33 @@
/**
* @file PlatformIo.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for I/O Request Packet (IRP) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
PIO_STACK_LOCATION
PlatformIoGetCurrentIrpStackLocation(PIRP Irp);
VOID
PlatformIoCompleteRequest(PIRP Irp, CCHAR PriorityBoost);
VOID
PlatformIoMarkIrpPending(PIRP Irp);
#endif // defined(_WIN32) || defined(_WIN64)

30
hyperdbg/include/platform/kernel/header/PlatformIrql.h Normal file
View file

@ -0,0 +1,30 @@
/**
* @file PlatformIrql.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for IRQL (Interrupt Request Level) management
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
KIRQL
PlatformIrqlRaiseToDpcLevel(VOID);
VOID
PlatformIrqlLower(KIRQL OldIrql);
#endif // defined(_WIN32) || defined(_WIN64)

3
hyperdbg/include/platform/kernel/header/PlatformMem.h
View file

@ -31,6 +31,9 @@ PlatformWriteMemory(PVOID Address, PVOID Buffer, SIZE_T Size);
VOID
PlatformSetMemory(PVOID Destination, int Value, SIZE_T Size);
VOID
PlatformZeroMemory(PVOID Destination, SIZE_T Size);
VOID
PlatformFreeMemory(PVOID Memory);

35
hyperdbg/include/platform/kernel/header/PlatformProcess.h Normal file
View file

@ -0,0 +1,35 @@
/**
* @file PlatformProcess.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for process and thread queries
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
HANDLE
PlatformProcessGetCurrentThreadId(VOID);
HANDLE
PlatformProcessGetCurrentProcessId(VOID);
PVOID
PlatformProcessGetCurrentProcess(VOID);
PVOID
PlatformProcessGetCurrentThread(VOID);
PVOID
PlatformProcessGetCurrentThreadTeb(VOID);

33
hyperdbg/include/platform/kernel/header/PlatformSpinlock.h Normal file
View file

@ -0,0 +1,33 @@
/**
* @file PlatformSpinlock.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for kernel spinlock operations
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
VOID
PlatformSpinlockInitialize(PKSPIN_LOCK SpinLock);
VOID
PlatformSpinlockAcquire(PKSPIN_LOCK SpinLock, PKIRQL OldIrql);
VOID
PlatformSpinlockRelease(PKSPIN_LOCK SpinLock, KIRQL OldIrql);
#endif // defined(_WIN32) || defined(_WIN64)

33
hyperdbg/include/platform/kernel/header/PlatformTime.h Normal file
View file

@ -0,0 +1,33 @@
/**
* @file PlatformTime.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Cross platform APIs for system time operations
* @details
* @version 0.19
* @date 2026-05-09
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// Functions //
//////////////////////////////////////////////////
#if defined(_WIN32) || defined(_WIN64)
VOID
PlatformTimeQuerySystemTime(PLARGE_INTEGER SystemTime);
VOID
PlatformTimeConvertToLocalTime(PLARGE_INTEGER SystemTime, PLARGE_INTEGER LocalTime);
VOID
PlatformTimeConvertToTimeFields(PLARGE_INTEGER Time, PTIME_FIELDS TimeFields);
#endif // defined(_WIN32) || defined(_WIN64)

0
hyperdbg/include/platform/user/code/.gitkeep
View file

99
hyperdbg/include/platform/user/code/platform-intrinsics.c Normal file
View file

@ -0,0 +1,99 @@
/**
* @file platform-intrinsics.c
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Implementation of cross platform APIs for intrinsic functions (x86 instructions)
* @details
* @version 0.19
* @date 2026-05-06
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#include "pch.h"
#if defined(__linux__)
# include "../header/platform-intrinsics.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// CPUID Instructions //
//////////////////////////////////////////////////
/**
* @brief Execute CPUID
*
* @param CpuInfo
* @param FunctionId
*/
VOID
CpuCpuId(INT32 * CpuInfo, INT32 FunctionId)
{
#if defined(_WIN32) || defined(_WIN64)
__cpuid(CpuInfo, FunctionId);
#elif defined(__linux__)
__asm__ __volatile__("cpuid" : "=a"(CpuInfo[0]), "=b"(CpuInfo[1]), "=c"(CpuInfo[2]), "=d"(CpuInfo[3]) : "a"(FunctionId), "c"(0));
#else
# error "Unsupported platform"
#endif
}
/**
* @brief Execute CPUID with sub-leaf
*
* @param CpuInfo
* @param FunctionId
* @param SubFunctionId
*/
VOID
CpuCpuIdEx(INT32 * CpuInfo, INT32 FunctionId, INT32 SubFunctionId)
{
#if defined(_WIN32) || defined(_WIN64)
__cpuidex(CpuInfo, FunctionId, SubFunctionId);
#elif defined(__linux__)
__asm__ __volatile__("cpuid" : "=a"(CpuInfo[0]), "=b"(CpuInfo[1]), "=c"(CpuInfo[2]), "=d"(CpuInfo[3]) : "a"(FunctionId), "c"(SubFunctionId));
#else
# error "Unsupported platform"
#endif
}
//////////////////////////////////////////////////
// TSC Instructions //
//////////////////////////////////////////////////
/**
* @brief Read Time-Stamp Counter
*
* @return UINT64
*/
UINT64
CpuReadTsc(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
return __rdtsc();
#elif defined(__linux__)
UINT32 __lo, __hi;
__asm__ __volatile__("rdtsc" : "=a"(__lo), "=d"(__hi));
return ((UINT64)__hi << 32) | __lo;
#else
# error "Unsupported platform"
#endif
}
//////////////////////////////////////////////////
// Misc Instructions //
//////////////////////////////////////////////////
/**
* @brief Execute PAUSE (spin-wait hint)
*/
VOID
CpuPause(VOID)
{
#if defined(_WIN32) || defined(_WIN64)
_mm_pause();
#elif defined(__linux__)
__asm__ __volatile__("pause");
#else
# error "Unsupported platform"
#endif
}

52
hyperdbg/include/platform/user/header/platform-intrinsics.h Normal file
View file

@ -0,0 +1,52 @@
/**
* @file platform-intrinsics.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief User mode Cross platform APIs for intrinsic functions (x86 instructions)
* @details
* @version 0.19
* @date 2026-05-06
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#if defined(__linux__)
# include "../../../../include/SDK/HyperDbgSdk.h"
#endif // defined(__linux__)
//////////////////////////////////////////////////
// CPUID Instructions //
//////////////////////////////////////////////////
//
// CPUID
//
VOID
CpuCpuId(INT32 * CpuInfo, INT32 FunctionId);
//
// CPUID (with sub-leaf)
//
VOID
CpuCpuIdEx(INT32 * CpuInfo, INT32 FunctionId, INT32 SubFunctionId);
//////////////////////////////////////////////////
// TSC Instructions //
//////////////////////////////////////////////////
//
// RDTSC
//
UINT64
CpuReadTsc(VOID);
//////////////////////////////////////////////////
// Misc Instructions //
//////////////////////////////////////////////////
//
// PAUSE
//
VOID
CpuPause(VOID);

2
hyperdbg/libhyperdbg/code/common/common.cpp
View file

@ -922,7 +922,7 @@ ConvertStringVectorToCharPointerArray(const std::string & s)
VOID
CommonCpuidInstruction(UINT32 Func, UINT32 SubFunc, int * CpuInfo)
{
__cpuidex(CpuInfo, Func, SubFunc);
CpuIdEx(CpuInfo, Func, SubFunc);
}
/**

4
hyperdbg/libhyperdbg/code/common/spinlock.cpp
View file

@ -57,7 +57,7 @@ SpinlockLock(volatile LONG * Lock)
{
for (unsigned i = 0; i < wait; ++i)
{
_mm_pause();
CpuPause();
}
//
@ -91,7 +91,7 @@ SpinlockLockWithCustomWait(volatile LONG * Lock, unsigned MaximumWait)
{
for (unsigned i = 0; i < wait; ++i)
{
_mm_pause();
CpuPause();
}
//

8
hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/cpu.cpp
View file

@ -140,12 +140,12 @@ private:
// Calling __cpuid with 0x0 as the function_id argument
// gets the number of the highest valid function ID.
//
__cpuid(cpui.data(), 0);
CpuCpuId(cpui.data(), 0);
nIds_ = cpui[0];
for (int i = 0; i <= nIds_; ++i)
{
__cpuidex(cpui.data(), i, 0);
CpuIdEx(cpui.data(), i, 0);
data_.push_back(cpui);
}
@ -189,7 +189,7 @@ private:
// Calling __cpuid with 0x80000000 as the function_id argument
// gets the number of the highest valid extended ID.
//
__cpuid(cpui.data(), 0x80000000);
CpuCpuId(cpui.data(), 0x80000000);
nExIds_ = cpui[0];
char brand[0x40];
@ -197,7 +197,7 @@ private:
for (int i = 0x80000000; i <= nExIds_; ++i)
{
__cpuidex(cpui.data(), i, 0);
CpuIdEx(cpui.data(), i, 0);
extdata_.push_back(cpui);
}

10
hyperdbg/libhyperdbg/code/debugger/transparency/transparency.cpp
View file

@ -33,7 +33,7 @@ TransparentModeRdtscDiffVmexit()
//
// Win32
//
ret = __rdtsc();
ret = CpuReadTsc();
/* vm exit forced here. it uses: eax = 0; cpuid; */
@ -45,7 +45,7 @@ TransparentModeRdtscDiffVmexit()
//
// WIN32
//
__cpuid(cpuid_result, 0);
CpuCpuId(cpuid_result, 0);
//
// GCC
@ -56,7 +56,7 @@ TransparentModeRdtscDiffVmexit()
//
// WIN32
//
ret2 = __rdtsc();
ret2 = CpuReadTsc();
return ret2 - ret;
}
@ -80,7 +80,7 @@ TransparentModeRdtscVmexitTracing()
//
// WIN32
//
ret = __rdtsc();
ret = CpuReadTsc();
//
// GCC
@ -91,7 +91,7 @@ TransparentModeRdtscVmexitTracing()
//
// WIN32
//
ret2 = __rdtsc();
ret2 = CpuReadTsc();
return ret2 - ret;
}

2
hyperdbg/libhyperdbg/libhyperdbg.vcxproj
View file

@ -127,6 +127,7 @@
</PreBuildEvent>
</ItemDefinitionGroup>
<ItemGroup>
<ClInclude Include="..\include\platform\user\header\platform-intrinsics.h" />
<ClInclude Include="..\include\platform\user\header\Windows.h" />
<ClInclude Include="header\assembler.h" />
<ClInclude Include="header\commands.h" />
@ -158,6 +159,7 @@
<ClInclude Include="pch.h" />
</ItemGroup>
<ItemGroup>
<ClCompile Include="..\include\platform\user\code\platform-intrinsics.c" />
<ClCompile Include="..\script-eval\code\Functions.c" />
<ClCompile Include="..\script-eval\code\Keywords.c" />
<ClCompile Include="..\script-eval\code\PseudoRegisters.c" />

6
hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters
View file

@ -173,6 +173,9 @@
<ClInclude Include="header\pci-id.h">
<Filter>header</Filter>
</ClInclude>
<ClInclude Include="..\include\platform\user\header\platform-intrinsics.h">
<Filter>header\platform</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<ClCompile Include="pch.cpp">
@ -604,6 +607,9 @@
<ClCompile Include="code\debugger\commands\extension-commands\lbrdump.cpp">
<Filter>code\debugger\commands\extension-commands</Filter>
</ClCompile>
<ClCompile Include="..\include\platform\user\code\platform-intrinsics.c">
<Filter>code\platform</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<MASM Include="code\assembly\asm-vmx-checks.asm">

5
hyperdbg/libhyperdbg/pch.h
View file

@ -140,6 +140,11 @@ typedef const wchar_t *LPCWCHAR, *PCWCHAR;
#include "SDK/imports/user/HyperDbgScriptImports.h"
#include "SDK/imports/user/HyperDbgLibImports.h"
//
// Platform-specific intrinsics
//
#include "platform/user/header/platform-intrinsics.h"
//
// PCI IDs
//

8
hyperdbg/linux/mock/kernel/Makefile
View file

@ -3,21 +3,25 @@ PWD := $(shell pwd)
obj-m := HyperDbg.o
HyperDbg-objs := mock.o \
PlatformMem.o \
PlatformIntrinsicsVmx.o
PlatformIntrinsicsVmx.o \
PlatformIntrinsics.o
ccflags-y += -I$(PWD)/../../../include
ccflags-y += -I$(PWD)/../../../include/platform/kernel/header
ccflags-y += -I$(PWD)/../../../include/platform/kernel/code
all: clean PlatformMem.c PlatformIntrinsicsVmx.c
all: clean PlatformMem.c PlatformIntrinsicsVmx.c PlatformIntrinsics.c
$(MAKE) -C $(KDIR) M=$(PWD) modules
PlatformMem.c:
cp ../../../include/platform/kernel/code/PlatformMem.c $(PWD)/PlatformMem.c
PlatformIntrinsics.c:
cp ../../../include/platform/kernel/code/PlatformIntrinsics.c $(PWD)/PlatformIntrinsics.c
PlatformIntrinsicsVmx.c:
cp ../../../include/platform/kernel/code/PlatformIntrinsicsVmx.c $(PWD)/PlatformIntrinsicsVmx.c
clean:
$(MAKE) -C $(KDIR) M=$(PWD) clean
rm -f $(PWD)/PlatformMem.c
rm -f $(PWD)/PlatformIntrinsics.c
rm -f $(PWD)/PlatformIntrinsicsVmx.c

2
hyperdbg/linux/mock/kernel/mock.c
View file

@ -66,6 +66,8 @@ mock_init(void)
VmxVmread64(0, 0); // Just to test the intrinsic wrapper compiles and links correctly
CpuReadMsr(0x1); // Just to test the intrinsic wrapper compiles and links correctly
/////////////////////////////////////////////////////////////////////////////////////
return 0;

17
hyperdbg/linux/mock/user/Makefile
View file

@ -1,12 +1,17 @@
CC = gcc
CFLAGS = -Wall -Wextra -std=c11 -O2 -I../../../include
PWD := $(shell pwd)
CFLAGS = -Wall -Wextra -std=c11 -O2
CFLAGS += -I$(PWD)/../../../include
CFLAGS += -I$(PWD)/../../../include/platform/user/header
CFLAGS += -I$(PWD)/../../../include/platform/user/code
TARGET = mock
SRCS = mock.c
SRCS = mock.c \
platform-intrinsics.c
OBJS = $(SRCS:.c=.o)
.PHONY: all clean
all: $(TARGET)
all: clean platform-intrinsics.c $(TARGET)
$(TARGET): $(OBJS)
$(CC) $(CFLAGS) -o $@ $^
@ -14,5 +19,9 @@ $(TARGET): $(OBJS)
%.o: %.c pch.h
$(CC) $(CFLAGS) -c -o $@ $<
platform-intrinsics.c:
cp $(PWD)/../../../include/platform/user/code/platform-intrinsics.c $(PWD)/platform-intrinsics.c
clean:
rm -f $(OBJS) $(TARGET)
rm -f $(OBJS) $(TARGET)
rm -f $(PWD)/platform-intrinsics.c

10
hyperdbg/linux/mock/user/mock.c
View file

@ -15,5 +15,15 @@ int
main(void)
{
printf("Hello world HyperDbg!\n");
//////////////////////////////////////////////////////////////
//
// Test for working intrinsics
//
CpuReadTsc();
CpuCpuId(NULL, 0);
//////////////////////////////////////////////////////////////
return 0;
}

11
hyperdbg/linux/mock/user/pch.h
View file

@ -12,6 +12,12 @@
#ifndef PCH_H
#define PCH_H
//
// Scope definitions
//
#define HYPERDBG_USER_MODE
#define HYPERDBG_LINUX
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
@ -23,4 +29,9 @@
//
#include "../../../include/SDK/HyperDbgSdk.h"
//
// Platform headers
//
#include "../../../include/platform/user/header/platform-intrinsics.h"
#endif // PCH_H

14
hyperdbg/script-eval/code/PseudoRegisters.c
View file

@ -29,7 +29,7 @@ ScriptEnginePseudoRegGetTid()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentThreadId();
return (UINT64)PlatformProcessGetCurrentThreadId();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -46,7 +46,7 @@ ScriptEnginePseudoRegGetCore()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)KeGetCurrentProcessorNumberEx(NULL);
return (UINT64)PlatformCpuGetCurrentProcessorNumber();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -63,7 +63,7 @@ ScriptEnginePseudoRegGetPid()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentProcessId();
return (UINT64)PlatformProcessGetCurrentProcessId();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -112,7 +112,7 @@ ScriptEnginePseudoRegGetPname()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return CommonGetProcessNameFromProcessControlBlock(PsGetCurrentProcess());
return CommonGetProcessNameFromProcessControlBlock(PlatformProcessGetCurrentProcess());
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -129,7 +129,7 @@ ScriptEnginePseudoRegGetProc()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentProcess();
return (UINT64)PlatformProcessGetCurrentProcess();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -146,7 +146,7 @@ ScriptEnginePseudoRegGetThread()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentThread();
return (UINT64)PlatformProcessGetCurrentThread();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}
@ -293,7 +293,7 @@ ScriptEnginePseudoRegGetTeb()
#endif // SCRIPT_ENGINE_USER_MODE
#ifdef SCRIPT_ENGINE_KERNEL_MODE
return (UINT64)PsGetCurrentThreadTeb();
return (UINT64)PlatformProcessGetCurrentThreadTeb();
#endif // SCRIPT_ENGINE_KERNEL_MODE
}