diff --git a/.github/git/git-help.md b/.github/git/git-help.md index 9505f465..4a418ae9 100644 --- a/.github/git/git-help.md +++ b/.github/git/git-help.md @@ -44,6 +44,13 @@ To remove the effects of `git add .` and `git commit -m "test"` or just `git add git reset --soft HEAD~1 ``` +To remove **all uncommitted and untracked changes** in Git and reset your working tree to the last commit: + +```bash +git reset --hard +git clean -fd +``` + --------------- ## Releasing instructions diff --git a/hyperdbg/hyperdbg.sln b/hyperdbg/hyperdbg.sln index 204dbf54..2c4bf22d 100644 --- a/hyperdbg/hyperdbg.sln +++ b/hyperdbg/hyperdbg.sln @@ -148,24 +148,48 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "kernel", "kernel", "{D0E5A2 EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{6498728B-D9B0-4CAB-A9E3-ACE5BC371010}" ProjectSection(SolutionItems) = preProject + include\platform\kernel\code\PlatformBroadcast.c = include\platform\kernel\code\PlatformBroadcast.c + include\platform\kernel\code\PlatformCpu.c = include\platform\kernel\code\PlatformCpu.c + include\platform\kernel\code\PlatformDbg.c = include\platform\kernel\code\PlatformDbg.c + include\platform\kernel\code\PlatformDpc.c = include\platform\kernel\code\PlatformDpc.c + include\platform\kernel\code\PlatformEvent.c = include\platform\kernel\code\PlatformEvent.c include\platform\kernel\code\PlatformIntrinsics.c = include\platform\kernel\code\PlatformIntrinsics.c include\platform\kernel\code\PlatformIntrinsicsVmx.c = include\platform\kernel\code\PlatformIntrinsicsVmx.c + include\platform\kernel\code\PlatformIo.c = include\platform\kernel\code\PlatformIo.c + include\platform\kernel\code\PlatformIrql.c = include\platform\kernel\code\PlatformIrql.c include\platform\kernel\code\PlatformMem.c = include\platform\kernel\code\PlatformMem.c + include\platform\kernel\code\PlatformProcess.c = include\platform\kernel\code\PlatformProcess.c + include\platform\kernel\code\PlatformSpinlock.c = include\platform\kernel\code\PlatformSpinlock.c + include\platform\kernel\code\PlatformTime.c = include\platform\kernel\code\PlatformTime.c EndProjectSection EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{AA41FFF1-A730-433E-8D26-13DA5B653825}" ProjectSection(SolutionItems) = preProject include\platform\kernel\header\pch.h = include\platform\kernel\header\pch.h + include\platform\kernel\header\PlatformBroadcast.h = include\platform\kernel\header\PlatformBroadcast.h + include\platform\kernel\header\PlatformCpu.h = include\platform\kernel\header\PlatformCpu.h + include\platform\kernel\header\PlatformDbg.h = include\platform\kernel\header\PlatformDbg.h + include\platform\kernel\header\PlatformDpc.h = include\platform\kernel\header\PlatformDpc.h + include\platform\kernel\header\PlatformEvent.h = include\platform\kernel\header\PlatformEvent.h include\platform\kernel\header\PlatformIntrinsics.h = include\platform\kernel\header\PlatformIntrinsics.h include\platform\kernel\header\PlatformIntrinsicsVmx.h = include\platform\kernel\header\PlatformIntrinsicsVmx.h + include\platform\kernel\header\PlatformIo.h = include\platform\kernel\header\PlatformIo.h + include\platform\kernel\header\PlatformIrql.h = include\platform\kernel\header\PlatformIrql.h include\platform\kernel\header\PlatformMem.h = include\platform\kernel\header\PlatformMem.h include\platform\kernel\header\PlatformModuleInfo.h = include\platform\kernel\header\PlatformModuleInfo.h + include\platform\kernel\header\PlatformProcess.h = include\platform\kernel\header\PlatformProcess.h + include\platform\kernel\header\PlatformSpinlock.h = include\platform\kernel\header\PlatformSpinlock.h + include\platform\kernel\header\PlatformTime.h = include\platform\kernel\header\PlatformTime.h EndProjectSection EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{4BF590C3-1032-4DD2-BF87-BB9E5781977C}" + ProjectSection(SolutionItems) = preProject + include\platform\user\code\platform-intrinsics.c = include\platform\user\code\platform-intrinsics.c + EndProjectSection EndProject Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{DBE32379-8D5A-4454-A1B6-ACC407881898}" ProjectSection(SolutionItems) = preProject + include\platform\user\header\platform-intrinsics.h = include\platform\user\header\platform-intrinsics.h include\platform\user\header\Windows.h = include\platform\user\header\Windows.h EndProjectSection EndProject diff --git a/hyperdbg/hyperhv/code/broadcast/DpcRoutines.c b/hyperdbg/hyperhv/code/broadcast/DpcRoutines.c index 89bce798..0f1e491d 100644 --- a/hyperdbg/hyperhv/code/broadcast/DpcRoutines.c +++ b/hyperdbg/hyperhv/code/broadcast/DpcRoutines.c @@ -135,15 +135,10 @@ DpcRoutinePerformVirtualization(KDPC * Dpc, PVOID DeferredContext, PVOID SystemA // VmxPerformVirtualizationOnSpecificCore(); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); return TRUE; } @@ -454,15 +449,10 @@ DpcRoutineEnableMovToCr3Exiting(KDPC * Dpc, PVOID DeferredContext, PVOID SystemA // AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_CR3_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -485,15 +475,10 @@ DpcRoutineChangeToMbecSupportedEptp(KDPC * Dpc, PVOID DeferredContext, PVOID Sys // AsmVmxVmcall(VMCALL_CHANGE_TO_MBEC_SUPPORTED_EPTP, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -516,15 +501,10 @@ DpcRoutineRestoreToNormalEptp(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArg // AsmVmxVmcall(VMCALL_RESTORE_TO_NORMAL_EPTP, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -547,15 +527,10 @@ DpcRoutineEnableOrDisableMbec(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArg // AsmVmxVmcall(VMCALL_DISABLE_OR_ENABLE_MBEC, (UINT64)DeferredContext, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -578,15 +553,10 @@ DpcRoutineDisableMovToCr3Exiting(KDPC * Dpc, PVOID DeferredContext, PVOID System // AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CR3_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -609,15 +579,10 @@ DpcRoutineEnableEferSyscallEvents(KDPC * Dpc, PVOID DeferredContext, PVOID Syste // AsmVmxVmcall(VMCALL_ENABLE_SYSCALL_HOOK_EFER, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -640,15 +605,10 @@ DpcRoutineDisableEferSyscallEvents(KDPC * Dpc, PVOID DeferredContext, PVOID Syst // AsmVmxVmcall(VMCALL_DISABLE_SYSCALL_HOOK_EFER, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -671,15 +631,10 @@ DpcRoutineEnablePml(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PV // AsmVmxVmcall(VMCALL_ENABLE_DIRTY_LOGGING_MECHANISM, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -702,15 +657,10 @@ DpcRoutineDisablePml(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, P // AsmVmxVmcall(VMCALL_DISABLE_DIRTY_LOGGING_MECHANISM, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -732,15 +682,10 @@ DpcRoutineChangeMsrBitmapReadOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID // AsmVmxVmcall(VMCALL_CHANGE_MSR_BITMAP_READ, (UINT64)DeferredContext, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -763,15 +708,10 @@ DpcRoutineResetMsrBitmapReadOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID // AsmVmxVmcall(VMCALL_RESET_MSR_BITMAP_READ, NULL64_ZERO, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -793,15 +733,10 @@ DpcRoutineChangeMsrBitmapWriteOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOI // AsmVmxVmcall(VMCALL_CHANGE_MSR_BITMAP_WRITE, (UINT64)DeferredContext, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -824,15 +759,10 @@ DpcRoutineResetMsrBitmapWriteOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID // AsmVmxVmcall(VMCALL_RESET_MSR_BITMAP_WRITE, NULL64_ZERO, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -855,15 +785,10 @@ DpcRoutineEnableRdtscExitingAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Sy // AsmVmxVmcall(VMCALL_SET_RDTSC_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -886,15 +811,10 @@ DpcRoutineDisableRdtscExitingAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID S // AsmVmxVmcall(VMCALL_UNSET_RDTSC_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -919,15 +839,10 @@ DpcRoutineDisableRdtscExitingForClearingTscEventsAllCores(KDPC * Dpc, PVOID Defe // AsmVmxVmcall(VMCALL_DISABLE_RDTSC_EXITING_ONLY_FOR_TSC_EVENTS, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -951,15 +866,10 @@ DpcRoutineDisableMov2DrExitingForClearingDrEventsAllCores(KDPC * Dpc, PVOID Defe // AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_HW_DR_EXITING_ONLY_FOR_DR_EVENTS, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -982,15 +892,10 @@ DpcRoutineDisableMov2CrExitingForClearingCrEventsAllCores(KDPC * Dpc, DEBUGGER_E // AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CR_EXITING_ONLY_FOR_CR_EVENTS, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1013,15 +918,10 @@ DpcRoutineEnableRdpmcExitingAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Sy // AsmVmxVmcall(VMCALL_SET_RDPMC_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1044,15 +944,10 @@ DpcRoutineDisableRdpmcExitingAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID S // AsmVmxVmcall(VMCALL_UNSET_RDPMC_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1074,15 +969,10 @@ DpcRoutineSetExceptionBitmapOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID // AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, (UINT64)DeferredContext, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1104,15 +994,10 @@ DpcRoutineUnsetExceptionBitmapOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOI // AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, (UINT64)DeferredContext, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1139,15 +1024,10 @@ DpcRoutineResetExceptionBitmapOnlyOnClearingExceptionEventsOnAllCores(KDPC * Dpc // AsmVmxVmcall(VMCALL_RESET_EXCEPTION_BITMAP_ONLY_ON_CLEARING_EXCEPTION_EVENTS, NULL64_ZERO, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1170,15 +1050,10 @@ DpcRoutineEnableMovDebigRegisterExitingAllCores(KDPC * Dpc, PVOID DeferredContex // AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_DEBUG_REGS_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1200,15 +1075,10 @@ DpcRoutineEnableMovControlRegisterExitingAllCores(KDPC * Dpc, DEBUGGER_EVENT_OPT // AsmVmxVmcall(VMCALL_ENABLE_MOV_TO_CONTROL_REGS_EXITING, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1230,15 +1100,10 @@ DpcRoutineDisableMovControlRegisterExitingAllCores(KDPC * Dpc, DEBUGGER_EVENT_OP // AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_CONTROL_REGS_EXITING, EventOptions->OptionalParam1, EventOptions->OptionalParam2, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1261,15 +1126,10 @@ DpcRoutineDisableMovDebigRegisterExitingAllCores(KDPC * Dpc, PVOID DeferredConte // AsmVmxVmcall(VMCALL_DISABLE_MOV_TO_DEBUG_REGS_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1292,15 +1152,10 @@ DpcRoutineSetEnableExternalInterruptExitingOnAllCores(KDPC * Dpc, PVOID Deferred // AsmVmxVmcall(VMCALL_ENABLE_EXTERNAL_INTERRUPT_EXITING, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1326,15 +1181,10 @@ DpcRoutineSetDisableExternalInterruptExitingOnlyOnClearingInterruptEventsOnAllCo // AsmVmxVmcall(VMCALL_DISABLE_EXTERNAL_INTERRUPT_EXITING_ONLY_TO_CLEAR_INTERRUPT_COMMANDS, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1356,15 +1206,10 @@ DpcRoutineChangeIoBitmapOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Syst // AsmVmxVmcall(VMCALL_CHANGE_IO_BITMAP, (UINT64)DeferredContext, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1387,15 +1232,10 @@ DpcRoutineResetIoBitmapOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Syste // AsmVmxVmcall(VMCALL_RESET_IO_BITMAP, NULL64_ZERO, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1418,15 +1258,10 @@ DpcRoutineEnableBreakpointOnExceptionBitmapOnAllCores(KDPC * Dpc, PVOID Deferred // AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_BREAKPOINT, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1449,15 +1284,10 @@ DpcRoutineDisableBreakpointOnExceptionBitmapOnAllCores(KDPC * Dpc, PVOID Deferre // AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_BREAKPOINT, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1480,15 +1310,10 @@ DpcRoutineEnableNmiVmexitOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Sys // AsmVmxVmcall(VMCALL_SET_VM_EXIT_ON_NMIS, NULL64_ZERO, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1511,15 +1336,10 @@ DpcRoutineDisableNmiVmexitOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Sy // AsmVmxVmcall(VMCALL_UNSET_VM_EXIT_ON_NMIS, NULL64_ZERO, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1547,15 +1367,10 @@ DpcRoutineEnableDbAndBpExitingOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOI // AsmVmxVmcall(VMCALL_SET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_DEBUG_BREAKPOINT, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1583,15 +1398,10 @@ DpcRoutineDisableDbAndBpExitingOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVO // AsmVmxVmcall(VMCALL_UNSET_EXCEPTION_BITMAP, EXCEPTION_VECTOR_DEBUG_BREAKPOINT, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1614,15 +1424,10 @@ DpcRoutineRemoveHookAndInvalidateAllEntriesOnAllCores(KDPC * Dpc, PVOID Deferred // AsmVmxVmcall(VMCALL_UNHOOK_ALL_PAGES, NULL64_ZERO, NULL64_ZERO, NULL64_ZERO); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1647,15 +1452,10 @@ DpcRoutineRemoveHookAndInvalidateSingleEntryOnAllCores(KDPC * Dpc, PVOID Deferre // AsmVmxVmcall(VMCALL_UNHOOK_SINGLE_PAGE, UnhookingDetail->PhysicalAddress, UnhookingDetail->OriginalEntry, NULL64_ZERO); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1690,15 +1490,10 @@ DpcRoutineInvalidateEptOnAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID Syste NULL64_ZERO); } + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1721,15 +1516,10 @@ DpcRoutineInitializeGuest(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgumen // AsmVmxSaveState(); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -1755,13 +1545,8 @@ DpcRoutineTerminateGuest(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument LogError("Err, there were an error terminating vmx"); } + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } diff --git a/hyperdbg/hyperhv/header/common/Dpc.h b/hyperdbg/hyperhv/header/common/Dpc.h deleted file mode 100644 index 30b419ec..00000000 --- a/hyperdbg/hyperhv/header/common/Dpc.h +++ /dev/null @@ -1,39 +0,0 @@ -/** - * @file Dpc.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Definition for Windows DPC functions - * @details - * @version 0.1 - * @date 2020-04-10 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Functions // -////////////////////////////////////////////////// - -NTKERNELAPI -_IRQL_requires_max_(APC_LEVEL) -_IRQL_requires_min_(PASSIVE_LEVEL) -_IRQL_requires_same_ -VOID -KeGenericCallDpc( - _In_ PKDEFERRED_ROUTINE Routine, - _In_opt_ PVOID Context); - -NTKERNELAPI -_IRQL_requires_(DISPATCH_LEVEL) -_IRQL_requires_same_ -VOID -KeSignalCallDpcDone( - _In_ PVOID SystemArgument1); - -NTKERNELAPI -_IRQL_requires_(DISPATCH_LEVEL) -_IRQL_requires_same_ -LOGICAL -KeSignalCallDpcSynchronize( - _In_ PVOID SystemArgument2); diff --git a/hyperdbg/hyperhv/hyperhv.vcxproj b/hyperdbg/hyperhv/hyperhv.vcxproj index 799267cd..e81659f7 100644 --- a/hyperdbg/hyperhv/hyperhv.vcxproj +++ b/hyperdbg/hyperhv/hyperhv.vcxproj @@ -132,6 +132,7 @@ + @@ -240,6 +241,7 @@ + @@ -248,7 +250,6 @@ - diff --git a/hyperdbg/hyperhv/hyperhv.vcxproj.filters b/hyperdbg/hyperhv/hyperhv.vcxproj.filters index 8af5ccbe..ab96d623 100644 --- a/hyperdbg/hyperhv/hyperhv.vcxproj.filters +++ b/hyperdbg/hyperhv/hyperhv.vcxproj.filters @@ -335,6 +335,9 @@ code\platform + + code\platform + @@ -343,9 +346,6 @@ header\common - - header\common - header\common @@ -619,6 +619,9 @@ header\platform + + header\platform + diff --git a/hyperdbg/hyperhv/pch.h b/hyperdbg/hyperhv/pch.h index a80e7b97..5e809dde 100644 --- a/hyperdbg/hyperhv/pch.h +++ b/hyperdbg/hyperhv/pch.h @@ -62,10 +62,7 @@ // #include "platform/kernel/header/PlatformMem.h" #include "platform/kernel/header/PlatformIntrinsics.h" - -// -// Platform intrinsics headers -// +#include "platform/kernel/header/PlatformBroadcast.h" #include "platform/kernel/header/PlatformIntrinsicsVmx.h" // @@ -97,7 +94,6 @@ #include "vmm/vmx/VmxBroadcast.h" #include "memory/MemoryMapper.h" #include "interface/Dispatch.h" -#include "common/Dpc.h" #include "common/Msr.h" #include "memory/PoolManager.h" #include "common/Trace.h" diff --git a/hyperdbg/hyperkd/code/debugger/broadcast/DpcRoutines.c b/hyperdbg/hyperkd/code/debugger/broadcast/DpcRoutines.c index e41bf88f..9296f576 100644 --- a/hyperdbg/hyperkd/code/debugger/broadcast/DpcRoutines.c +++ b/hyperdbg/hyperkd/code/debugger/broadcast/DpcRoutines.c @@ -202,15 +202,10 @@ DpcRoutineWriteMsrToAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgu // CpuWriteMsr((ULONG)CurrentDebuggingState->MsrState.Msr, CurrentDebuggingState->MsrState.Value); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -236,15 +231,10 @@ DpcRoutineReadMsrToAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgum // CurrentDebuggingState->MsrState.Value = CpuReadMsr((ULONG)CurrentDebuggingState->MsrState.Msr); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -267,15 +257,10 @@ DpcRoutineVmExitAndHaltSystemAllCores(KDPC * Dpc, PVOID DeferredContext, PVOID S // VmFuncVmxVmcall(DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM, 0, 0, 0); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); } /** @@ -298,15 +283,10 @@ DpcRoutineSetHardwareDebugRegisters(KDPC * Dpc, PVOID DeferredContext, PVOID Sys // UdApplyHardwareDebugRegister(DeferredContext); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); return TRUE; } diff --git a/hyperdbg/hyperkd/header/common/Dpc.h b/hyperdbg/hyperkd/header/common/Dpc.h deleted file mode 100644 index 30b419ec..00000000 --- a/hyperdbg/hyperkd/header/common/Dpc.h +++ /dev/null @@ -1,39 +0,0 @@ -/** - * @file Dpc.h - * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Definition for Windows DPC functions - * @details - * @version 0.1 - * @date 2020-04-10 - * - * @copyright This project is released under the GNU Public License v3. - * - */ -#pragma once - -////////////////////////////////////////////////// -// Functions // -////////////////////////////////////////////////// - -NTKERNELAPI -_IRQL_requires_max_(APC_LEVEL) -_IRQL_requires_min_(PASSIVE_LEVEL) -_IRQL_requires_same_ -VOID -KeGenericCallDpc( - _In_ PKDEFERRED_ROUTINE Routine, - _In_opt_ PVOID Context); - -NTKERNELAPI -_IRQL_requires_(DISPATCH_LEVEL) -_IRQL_requires_same_ -VOID -KeSignalCallDpcDone( - _In_ PVOID SystemArgument1); - -NTKERNELAPI -_IRQL_requires_(DISPATCH_LEVEL) -_IRQL_requires_same_ -LOGICAL -KeSignalCallDpcSynchronize( - _In_ PVOID SystemArgument2); diff --git a/hyperdbg/hyperkd/header/pch.h b/hyperdbg/hyperkd/header/pch.h index d611422f..8da24baa 100644 --- a/hyperdbg/hyperkd/header/pch.h +++ b/hyperdbg/hyperkd/header/pch.h @@ -86,6 +86,9 @@ // #include "platform/kernel/header/PlatformMem.h" #include "platform/kernel/header/PlatformIntrinsics.h" +#include "platform/kernel/header/PlatformBroadcast.h" +#include "platform/kernel/header/PlatformProcess.h" +#include "platform/kernel/header/PlatformCpu.h" // // Optimization algorithms @@ -135,11 +138,6 @@ #include "header/debugger/broadcast/HaltedRoutines.h" #include "header/debugger/broadcast/HaltedBroadcast.h" -// -// DPC Headers -// -#include "header/common/Dpc.h" - // // Events & Meta events // diff --git a/hyperdbg/hyperkd/hyperkd.vcxproj b/hyperdbg/hyperkd/hyperkd.vcxproj index 31fa0abd..2438e56a 100644 --- a/hyperdbg/hyperkd/hyperkd.vcxproj +++ b/hyperdbg/hyperkd/hyperkd.vcxproj @@ -108,8 +108,11 @@ + + + @@ -155,11 +158,13 @@ + + + - diff --git a/hyperdbg/hyperkd/hyperkd.vcxproj.filters b/hyperdbg/hyperkd/hyperkd.vcxproj.filters index c547d5e5..375ef4fa 100644 --- a/hyperdbg/hyperkd/hyperkd.vcxproj.filters +++ b/hyperdbg/hyperkd/hyperkd.vcxproj.filters @@ -270,6 +270,15 @@ code\platform + + code\platform + + + code\platform + + + code\platform + @@ -353,9 +362,6 @@ header\macros - - header\common - header\assembly @@ -407,6 +413,15 @@ header\platform + + header\platform + + + header\platform + + + header\platform + diff --git a/hyperdbg/hyperlog/code/Logging.c b/hyperdbg/hyperlog/code/Logging.c index ae30cbd8..27e80cc4 100644 --- a/hyperdbg/hyperlog/code/Logging.c +++ b/hyperdbg/hyperlog/code/Logging.c @@ -99,7 +99,7 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks) { ULONG ProcessorsCount; - ProcessorsCount = KeQueryActiveProcessorCount(0); + ProcessorsCount = PlatformCpuGetActiveProcessorCount(); // // Initialize buffers for trace message and data messages @@ -155,8 +155,8 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks) // for both but the second buffer spinlock is useless // as we use our custom spinlock // - KeInitializeSpinLock(&MessageBufferInformation[i].BufferLock); - KeInitializeSpinLock(&MessageBufferInformation[i].BufferLockForNonImmMessage); + PlatformSpinlockInitialize(&MessageBufferInformation[i].BufferLock); + PlatformSpinlockInitialize(&MessageBufferInformation[i].BufferLockForNonImmMessage); // // allocate the buffer for regular buffers @@ -183,9 +183,9 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks) // // Zeroing the buffer // - RtlZeroMemory((void *)MessageBufferInformation[i].BufferStartAddress, LogBufferSize); - RtlZeroMemory((void *)MessageBufferInformation[i].BufferForMultipleNonImmediateMessage, PacketChunkSize); - RtlZeroMemory((void *)MessageBufferInformation[i].BufferStartAddressPriority, LogBufferSizePriority); + PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferStartAddress, LogBufferSize); + PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferForMultipleNonImmediateMessage, PacketChunkSize); + PlatformZeroMemory((PVOID)MessageBufferInformation[i].BufferStartAddressPriority, LogBufferSizePriority); // // Set the end address @@ -197,7 +197,7 @@ LogInitialize(MESSAGE_TRACING_CALLBACKS * MsgTracingCallbacks) // // Copy the callbacks into the global callback holder // - RtlCopyBytes(&g_MsgTracingCallbacks, MsgTracingCallbacks, sizeof(MESSAGE_TRACING_CALLBACKS)); + PlatformWriteMemory(&g_MsgTracingCallbacks, MsgTracingCallbacks, sizeof(MESSAGE_TRACING_CALLBACKS)); return TRUE; } @@ -384,7 +384,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B // // vmx non-root // - OldIRQL = KeRaiseIrqlToDpcLevel(); + OldIRQL = PlatformIrqlRaiseToDpcLevel(); } // @@ -403,7 +403,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B // // vmx non-root // - KeLowerIrql(OldIRQL); + PlatformIrqlLower(OldIRQL); } return TRUE; @@ -431,7 +431,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B // // Acquire the lock // - KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL); + PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL); } // @@ -500,7 +500,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B // // Copy the buffer // - RtlCopyBytes(SavingBuffer, Buffer, BufferLength); + PlatformWriteMemory(SavingBuffer, Buffer, BufferLength); // // Increment the next index to write @@ -531,7 +531,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B // // Insert dpc to queue // - KeInsertQueueDpc(&g_GlobalNotifyRecord->Dpc, g_GlobalNotifyRecord, NULL); + PlatformDpcInsertQueueDpc(&g_GlobalNotifyRecord->Dpc, g_GlobalNotifyRecord, NULL); // // set notify routine to null @@ -552,7 +552,7 @@ LogCallbackSendBuffer(UINT32 OperationCode, PVOID Buffer, UINT32 BufferLength, B // // Release the lock // - KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL); + PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL); } return TRUE; @@ -598,7 +598,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot) // // Acquire the lock // - KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL); + PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL); } // @@ -632,7 +632,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot) // // Release the lock // - KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL); + PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL); } return ResultsOfBuffersSetToRead; @@ -658,7 +658,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot) // there might be multiple messages on the start of the queue that didn't read yet) // we don't free the header // - RtlZeroMemory(SendingBuffer, Header->BufferLength); + PlatformZeroMemory(SendingBuffer, Header->BufferLength); // // Check to see whether we passed the index or not @@ -689,7 +689,7 @@ LogMarkAllAsRead(BOOLEAN IsVmxRoot) // // Release the lock // - KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL); + PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL); } return ResultsOfBuffersSetToRead; @@ -737,7 +737,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen // // Acquire the lock // - KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLock, &OldIRQL); + PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLock, &OldIRQL); } // @@ -776,7 +776,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen // // Release the lock // - KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL); + PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL); } return FALSE; @@ -794,7 +794,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen // // First copy the header // - RtlCopyBytes(BufferToSaveMessage, &Header->OperationNumber, sizeof(UINT32)); + PlatformWriteMemory(BufferToSaveMessage, &Header->OperationNumber, sizeof(UINT32)); // // Second, save the buffer contents @@ -815,7 +815,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen // PVOID SavingAddress = (PVOID)((UINT64)BufferToSaveMessage + sizeof(UINT32)); - RtlCopyBytes(SavingAddress, SendingBuffer, Header->BufferLength); + PlatformWriteMemory(SavingAddress, SendingBuffer, Header->BufferLength); #if ShowMessagesOnDebugger @@ -834,17 +834,17 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen { if (i != 0) { - DbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i) - 2)); + PlatformDbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i) - 2)); } else { - DbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i))); + PlatformDbgPrint("%s", (char *)((UINT64)SendingBuffer + (DbgPrintLimitation * i))); } } } else { - DbgPrint("%s", (char *)SendingBuffer); + PlatformDbgPrint("%s", (char *)SendingBuffer); } } #endif @@ -864,7 +864,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen // there might be multiple messages on the start of the queue that didn't read yet) // we don't free the header // - RtlZeroMemory(SendingBuffer, Header->BufferLength); + PlatformZeroMemory(SendingBuffer, Header->BufferLength); if (PriorityMessageIsAvailable) { @@ -914,7 +914,7 @@ LogReadBuffer(BOOLEAN IsVmxRoot, PVOID BufferToSaveMessage, UINT32 * ReturnedLen // // Release the lock // - KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLock, OldIRQL); + PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLock, OldIRQL); } return TRUE; @@ -998,7 +998,7 @@ LogCallbackPrepareAndSendMessageToQueueWrapper(UINT32 OperationCode, char * LogMessage = NULL; char * TempMessage = NULL; char TimeBuffer[20] = {0}; - ULONG CurrentCore = KeGetCurrentProcessorNumberEx(NULL); + ULONG CurrentCore = PlatformCpuGetCurrentProcessorNumber(); // // Set Vmx State @@ -1069,9 +1069,9 @@ LogCallbackPrepareAndSendMessageToQueueWrapper(UINT32 OperationCode, // TIME_FIELDS TimeFields; LARGE_INTEGER SystemTime, LocalTime; - KeQuerySystemTime(&SystemTime); - ExSystemTimeToLocalTime(&SystemTime, &LocalTime); - RtlTimeToTimeFields(&LocalTime, &TimeFields); + PlatformTimeQuerySystemTime(&SystemTime); + PlatformTimeConvertToLocalTime(&SystemTime, &LocalTime); + PlatformTimeConvertToTimeFields(&LocalTime, &TimeFields); // // We won't use this because we can't use in any IRQL @@ -1287,7 +1287,7 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, // // Acquire the lock // - KeAcquireSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, &OldIRQL); + PlatformSpinlockAcquire(&MessageBufferInformation[Index].BufferLockForNonImmMessage, &OldIRQL); } // // Set the result to True @@ -1312,13 +1312,13 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, // Free the immediate buffer // MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer = 0; - RtlZeroMemory((void *)MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage, PacketChunkSize); + PlatformZeroMemory((PVOID)MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage, PacketChunkSize); } // // We have to save the message // - RtlCopyBytes((void *)(MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage + + PlatformWriteMemory((PVOID)(MessageBufferInformation[Index].BufferForMultipleNonImmediateMessage + MessageBufferInformation[Index].CurrentLengthOfNonImmBuffer), LogMessage, BufferLen); @@ -1340,7 +1340,7 @@ LogCallbackSendMessageToQueue(UINT32 OperationCode, BOOLEAN IsImmediateMessage, // // Release the lock // - KeReleaseSpinLock(&MessageBufferInformation[Index].BufferLockForNonImmMessage, OldIRQL); + PlatformSpinlockRelease(&MessageBufferInformation[Index].BufferLockForNonImmMessage, OldIRQL); } return Result; @@ -1390,18 +1390,18 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument // if (!(Irp->CurrentLocation <= Irp->StackCount + 1)) { - DbgPrint("Err, probably two or more functions called DPC for an object"); + PlatformDbgPrint("Err, probably two or more functions called DPC for an object"); return; } - IrpSp = IoGetCurrentIrpStackLocation(Irp); + IrpSp = PlatformIoGetCurrentIrpStackLocation(Irp); InBuffLength = IrpSp->Parameters.DeviceIoControl.InputBufferLength; OutBuffLength = IrpSp->Parameters.DeviceIoControl.OutputBufferLength; if (!InBuffLength || !OutBuffLength) { Irp->IoStatus.Status = STATUS_INVALID_PARAMETER; - IoCompleteRequest(Irp, IO_NO_INCREMENT); + PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT); break; } @@ -1428,14 +1428,14 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument // we have to return here as there is nothing to send here // Irp->IoStatus.Status = STATUS_INVALID_PARAMETER; - IoCompleteRequest(Irp, IO_NO_INCREMENT); + PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT); break; } Irp->IoStatus.Information = Length; Irp->IoStatus.Status = STATUS_SUCCESS; - IoCompleteRequest(Irp, IO_NO_INCREMENT); + PlatformIoCompleteRequest(Irp, IO_NO_INCREMENT); } break; @@ -1443,12 +1443,12 @@ LogNotifyUsermodeCallback(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument // // Signal the Event created in user-mode. // - KeSetEvent(NotifyRecord->Message.Event, 0, FALSE); + PlatformEventSet(NotifyRecord->Message.Event, 0, FALSE); // // Dereference the object as we are done with it. // - ObDereferenceObject(NotifyRecord->Message.Event); + PlatformObjectDereference(NotifyRecord->Message.Event); break; @@ -1488,7 +1488,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status) if (g_GlobalNotifyRecord == NULL) { - IrpStack = IoGetCurrentIrpStackLocation(Irp); + IrpStack = PlatformIoGetCurrentIrpStackLocation(Irp); RegisterEvent = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer; // @@ -1505,12 +1505,12 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status) NotifyRecord->Type = IRP_BASED; NotifyRecord->Message.PendingIrp = Irp; - KeInitializeDpc(&NotifyRecord->Dpc, // Dpc + PlatformDpcInitialize(&NotifyRecord->Dpc, // Dpc LogNotifyUsermodeCallback, // DeferredRoutine NotifyRecord // DeferredContext ); - IoMarkIrpPending(Irp); + PlatformIoMarkIrpPending(Irp); // // check for new message (for both Vmx-root mode or Vmx non root-mode) @@ -1527,7 +1527,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status) // // Insert dpc to queue // - KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); + PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); } else if (LogCheckForNewMessage(TRUE, TRUE)) { @@ -1538,7 +1538,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status) // // Insert dpc to queue // - KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); + PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); } else if (LogCheckForNewMessage(FALSE, FALSE)) { @@ -1550,7 +1550,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status) // // Insert dpc to queue // - KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); + PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); } else if (LogCheckForNewMessage(TRUE, FALSE)) { @@ -1561,7 +1561,7 @@ LogRegisterIrpBasedNotification(PVOID TargetIrp, LONG * Status) // // Insert dpc to queue // - KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); + PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); } else { @@ -1599,7 +1599,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp) PREGISTER_NOTIFY_BUFFER RegisterEvent; PIRP Irp = (PIRP)TargetIrp; - IrpStack = IoGetCurrentIrpStackLocation(Irp); + IrpStack = PlatformIoGetCurrentIrpStackLocation(Irp); RegisterEvent = (PREGISTER_NOTIFY_BUFFER)Irp->AssociatedIrp.SystemBuffer; // @@ -1609,13 +1609,13 @@ LogRegisterEventBasedNotification(PVOID TargetIrp) if (NULL == NotifyRecord) { - DbgPrint("Err, unable to allocate memory for notify record\n"); + PlatformDbgPrint("Err, unable to allocate memory for notify record\n"); return FALSE; } NotifyRecord->Type = EVENT_BASED; - KeInitializeDpc(&NotifyRecord->Dpc, // Dpc + PlatformDpcInitialize(&NotifyRecord->Dpc, // Dpc LogNotifyUsermodeCallback, // DeferredRoutine NotifyRecord // DeferredContext ); @@ -1624,7 +1624,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp) // Get the object pointer from the handle // Note we must be in the context of the process that created the handle // - Status = ObReferenceObjectByHandle(RegisterEvent->hEvent, + Status = PlatformObjectReferenceByHandle(RegisterEvent->hEvent, SYNCHRONIZE | EVENT_MODIFY_STATE, *ExEventObjectType, Irp->RequestorMode, @@ -1633,7 +1633,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp) if (!NT_SUCCESS(Status)) { - DbgPrint("Err, unable to reference user mode event object, status = 0x%x\n", Status); + PlatformDbgPrint("Err, unable to reference user mode event object, status = 0x%x\n", Status); PlatformMemFreePool(NotifyRecord); return FALSE; } @@ -1641,7 +1641,7 @@ LogRegisterEventBasedNotification(PVOID TargetIrp) // // Insert dpc to the queue // - KeInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); + PlatformDpcInsertQueueDpc(&NotifyRecord->Dpc, NotifyRecord, NULL); return TRUE; } diff --git a/hyperdbg/hyperlog/header/pch.h b/hyperdbg/hyperlog/header/pch.h index 021a8c5a..17cd5fec 100644 --- a/hyperdbg/hyperlog/header/pch.h +++ b/hyperdbg/hyperlog/header/pch.h @@ -48,5 +48,12 @@ // // Platform independent headers // +#include "platform/kernel/header/PlatformCpu.h" +#include "platform/kernel/header/PlatformDbg.h" +#include "platform/kernel/header/PlatformDpc.h" +#include "platform/kernel/header/PlatformEvent.h" +#include "platform/kernel/header/PlatformIo.h" +#include "platform/kernel/header/PlatformIrql.h" #include "platform/kernel/header/PlatformMem.h" -#include "platform/kernel/header/PlatformIntrinsics.h" +#include "platform/kernel/header/PlatformSpinlock.h" +#include "platform/kernel/header/PlatformTime.h" diff --git a/hyperdbg/hyperlog/hyperlog.vcxproj b/hyperdbg/hyperlog/hyperlog.vcxproj index 189b0dd0..4147f9d2 100644 --- a/hyperdbg/hyperlog/hyperlog.vcxproj +++ b/hyperdbg/hyperlog/hyperlog.vcxproj @@ -104,13 +104,28 @@ + + + + + + + + + + + + + + + diff --git a/hyperdbg/hyperlog/hyperlog.vcxproj.filters b/hyperdbg/hyperlog/hyperlog.vcxproj.filters index 0dba5ff5..f6867f82 100644 --- a/hyperdbg/hyperlog/hyperlog.vcxproj.filters +++ b/hyperdbg/hyperlog/hyperlog.vcxproj.filters @@ -38,6 +38,30 @@ code\platform + + code\platform + + + code\platform + + + code\platform + + + code\platform + + + code\platform + + + code\platform + + + code\platform + + + code\platform + @@ -55,5 +79,26 @@ header\platform + + header\platform + + + header\platform + + + header\platform + + + header\platform + + + header\platform + + + header\platform + + + header\platform + \ No newline at end of file diff --git a/hyperdbg/hypertrace/code/api/TraceApi.c b/hyperdbg/hypertrace/code/api/TraceApi.c index 950a5532..0f2d951b 100644 --- a/hyperdbg/hypertrace/code/api/TraceApi.c +++ b/hyperdbg/hypertrace/code/api/TraceApi.c @@ -43,12 +43,12 @@ HyperTraceInitCallback(HYPERTRACE_CALLBACKS * HypertraceCallbacks, // // Save the callbacks // - RtlCopyMemory(&g_Callbacks, HypertraceCallbacks, sizeof(HYPERTRACE_CALLBACKS)); + PlatformWriteMemory(&g_Callbacks, HypertraceCallbacks, sizeof(HYPERTRACE_CALLBACKS)); // // Query the number of processors in the system to initialize the global LBR state list accordingly // - ProcessorsCount = KeQueryActiveProcessorCount(0); + ProcessorsCount = PlatformCpuGetActiveProcessorCount(); // // Initialize the global LBR state list to hold LBR states for each core diff --git a/hyperdbg/hypertrace/code/broadcast/DpcRoutines.c b/hyperdbg/hypertrace/code/broadcast/DpcRoutines.c index 24b125a6..40d666bf 100644 --- a/hyperdbg/hypertrace/code/broadcast/DpcRoutines.c +++ b/hyperdbg/hypertrace/code/broadcast/DpcRoutines.c @@ -58,15 +58,10 @@ DpcRoutineEnableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PV // LbrStart(LBR_SELECT_WITHOUT_FILTER); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); return TRUE; } @@ -117,15 +112,10 @@ DpcRoutineDisableLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, P } } + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); return TRUE; } @@ -150,15 +140,10 @@ DpcRoutineFlushLbr(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVO // LbrFlush(); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); return TRUE; } @@ -182,15 +167,10 @@ DpcRoutineFilterLbrOptions(KDPC * Dpc, PVOID DeferredContext, PVOID SystemArgume // LbrFilter((UINT64)DeferredContext); + // ------------------------------------------------------------------------------ + // Synchronize the end of this routine with the caller // - // Wait for all DPCs to synchronize at this point - // - KeSignalCallDpcSynchronize(SystemArgument2); - - // - // Mark the DPC as being complete - // - KeSignalCallDpcDone(SystemArgument1); + PlatformBroadcastSynchronizeEndOfRoutine(SystemArgument1, SystemArgument2); return TRUE; } diff --git a/hyperdbg/hypertrace/header/pch.h b/hyperdbg/hypertrace/header/pch.h index cfdb570f..574f5cc5 100644 --- a/hyperdbg/hypertrace/header/pch.h +++ b/hyperdbg/hypertrace/header/pch.h @@ -57,11 +57,19 @@ // #include "platform/kernel/header/PlatformMem.h" #include "platform/kernel/header/PlatformIntrinsics.h" +#include "platform/kernel/header/PlatformBroadcast.h" +#include "platform/kernel/header/PlatformCpu.h" +#include "platform/kernel/header/PlatformSpinlock.h" +#include "platform/kernel/header/PlatformIrql.h" +#include "platform/kernel/header/PlatformDpc.h" +#include "platform/kernel/header/PlatformTime.h" +#include "platform/kernel/header/PlatformDbg.h" +#include "platform/kernel/header/PlatformIo.h" +#include "platform/kernel/header/PlatformEvent.h" // // DPC and broadcasting function headers // -#include "broadcast/Dpc.h" #include "broadcast/DpcRoutines.h" #include "broadcast/Broadcast.h" diff --git a/hyperdbg/hypertrace/hypertrace.vcxproj b/hyperdbg/hypertrace/hypertrace.vcxproj index aae58804..804c776e 100644 --- a/hyperdbg/hypertrace/hypertrace.vcxproj +++ b/hyperdbg/hypertrace/hypertrace.vcxproj @@ -101,6 +101,8 @@ + + @@ -114,13 +116,14 @@ + + - diff --git a/hyperdbg/hypertrace/hypertrace.vcxproj.filters b/hyperdbg/hypertrace/hypertrace.vcxproj.filters index 09ee1571..c81ca949 100644 --- a/hyperdbg/hypertrace/hypertrace.vcxproj.filters +++ b/hyperdbg/hypertrace/hypertrace.vcxproj.filters @@ -89,6 +89,12 @@ code\platform + + code\broadcast + + + code\platform + @@ -106,9 +112,6 @@ header\broadcast - - header\broadcast - header\broadcast @@ -133,5 +136,11 @@ header\platform + + header\platform + + + header\platform + \ No newline at end of file diff --git a/hyperdbg/include/SDK/HyperDbgSdk.h b/hyperdbg/include/SDK/HyperDbgSdk.h index 3e00bb86..dce21ddc 100644 --- a/hyperdbg/include/SDK/HyperDbgSdk.h +++ b/hyperdbg/include/SDK/HyperDbgSdk.h @@ -1,5 +1,18 @@ #pragma once +// +// General SDK Headers +// +#include "SDK/headers/Constants.h" +#include "SDK/headers/BasicTypes.h" +#include "SDK/headers/ErrorCodes.h" +#include "SDK/headers/Connection.h" +#include "SDK/headers/DataTypes.h" +#include "SDK/headers/Ioctls.h" +#include "SDK/headers/Events.h" +#include "SDK/headers/Symbols.h" +#include "SDK/headers/HardwareDebugger.h" + // // Devices // @@ -11,18 +24,9 @@ #include "SDK/headers/LbrDefinitions.h" // -// General SDK Headers +// Request Packets // -#include "SDK/headers/Constants.h" -#include "SDK/headers/BasicTypes.h" -#include "SDK/headers/ErrorCodes.h" -#include "SDK/headers/Connection.h" -#include "SDK/headers/DataTypes.h" -#include "SDK/headers/Ioctls.h" -#include "SDK/headers/Events.h" #include "SDK/headers/RequestStructures.h" -#include "SDK/headers/Symbols.h" -#include "SDK/headers/HardwareDebugger.h" // // Asserts diff --git a/hyperdbg/include/SDK/headers/BasicTypes.h b/hyperdbg/include/SDK/headers/BasicTypes.h index be71e634..0b0d1963 100644 --- a/hyperdbg/include/SDK/headers/BasicTypes.h +++ b/hyperdbg/include/SDK/headers/BasicTypes.h @@ -63,6 +63,9 @@ typedef unsigned __int64 UINT64, *PUINT64; typedef unsigned __int64 ULONG64, *PULONG64; typedef unsigned __int64 DWORD64, *PDWORD64; +typedef unsigned __int64 ULONG_PTR, *PULONG_PTR; +typedef unsigned __int64 ULONGLONG; + typedef wchar_t WCHAR; #elif defined(__linux__) // Linux @@ -77,6 +80,9 @@ typedef unsigned long long UINT64, *PUINT64; typedef unsigned long long ULONG64, *PULONG64; typedef unsigned long long DWORD64, *PDWORD64; +typedef unsigned long long ULONGLONG; +typedef unsigned long long ULONG_PTR, *PULONG_PTR; + // // To be fixed later, linux wchar_t is 4 bytes, but windows wchar_t is 2 bytes // diff --git a/hyperdbg/include/platform/kernel/code/PlatformBroadcast.c b/hyperdbg/include/platform/kernel/code/PlatformBroadcast.c new file mode 100644 index 00000000..4c097194 --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformBroadcast.c @@ -0,0 +1,44 @@ +/** + * @file PlatformBroadcast.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for broadcasting routines + * @details + * @version 0.19 + * @date 2026-05-08 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformBroadcast.h" +#endif // defined(__linux__) + +/** + * @brief This function synchronize the function execution for a single core + * + * @return VOID + */ +VOID +PlatformBroadcastSynchronizeEndOfRoutine(PVOID SystemArgument1, PVOID SystemArgument2) +{ +#if defined(_WIN32) || defined(_WIN64) + // + // Wait for all DPCs to synchronize at this point + // + KeSignalCallDpcSynchronize(SystemArgument2); + + // + // Mark the DPC as being complete + // + KeSignalCallDpcDone(SystemArgument1); + +#elif defined(__linux__) + // + // Not needed for Linux + // +#else +# error "Unsupported platform" +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformCpu.c b/hyperdbg/include/platform/kernel/code/PlatformCpu.c new file mode 100644 index 00000000..eaece365 --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformCpu.c @@ -0,0 +1,62 @@ +/** + * @file PlatformCpu.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for CPU and processor queries + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformCpu.h" +#endif // defined(__linux__) + +/** + * @brief Get the count of active logical processors + * + * @return ULONG + */ +ULONG +PlatformCpuGetActiveProcessorCount(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + + return KeQueryActiveProcessorCount(0); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Get the current logical processor number + * + * @return ULONG + */ +ULONG +PlatformCpuGetCurrentProcessorNumber(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + + return KeGetCurrentProcessorNumberEx(NULL); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformDbg.c b/hyperdbg/include/platform/kernel/code/PlatformDbg.c new file mode 100644 index 00000000..f1f866ec --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformDbg.c @@ -0,0 +1,44 @@ +/** + * @file PlatformDbg.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for kernel debug output + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformDbg.h" +#endif // defined(__linux__) + +/** + * @brief Print a debug message to the kernel debugger + * + * @param Format printf-style format string + * @param ... Variable arguments + * @return VOID + */ +VOID +PlatformDbgPrint(const CHAR * Format, ...) +{ +#if defined(_WIN32) || defined(_WIN64) + + va_list ArgList; + va_start(ArgList, Format); + vDbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_INFO_LEVEL, Format, ArgList); + va_end(ArgList); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformDpc.c b/hyperdbg/include/platform/kernel/code/PlatformDpc.c new file mode 100644 index 00000000..6c459699 --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformDpc.c @@ -0,0 +1,68 @@ +/** + * @file PlatformDpc.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for Deferred Procedure Call (DPC) management + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformDpc.h" +#endif // defined(__linux__) + +/** + * @brief Initialize a DPC object + * + * @param Dpc Pointer to the KDPC structure to initialize + * @param DeferredRoutine The deferred procedure to be called + * @param DeferredContext Optional context passed to the deferred routine + * @return VOID + */ +VOID +PlatformDpcInitialize(PRKDPC Dpc, PKDEFERRED_ROUTINE DeferredRoutine, PVOID DeferredContext) +{ +#if defined(_WIN32) || defined(_WIN64) + + KeInitializeDpc(Dpc, DeferredRoutine, DeferredContext); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Insert a DPC into the system DPC queue for execution + * + * @param Dpc Pointer to the initialized KDPC structure + * @param SystemArgument1 First system-defined argument passed to the deferred routine + * @param SystemArgument2 Second system-defined argument passed to the deferred routine + * @return BOOLEAN TRUE if the DPC was successfully queued, FALSE if it was already in the queue + */ +BOOLEAN +PlatformDpcInsertQueueDpc(PRKDPC Dpc, PVOID SystemArgument1, PVOID SystemArgument2) +{ +#if defined(_WIN32) || defined(_WIN64) + + return KeInsertQueueDpc(Dpc, SystemArgument1, SystemArgument2); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformEvent.c b/hyperdbg/include/platform/kernel/code/PlatformEvent.c new file mode 100644 index 00000000..aed1673c --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformEvent.c @@ -0,0 +1,105 @@ +/** + * @file PlatformEvent.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for kernel event and object management + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformEvent.h" +#endif // defined(__linux__) + +/** + * @brief Dereference a kernel object, decrementing its reference count + * + * @param Object Pointer to the kernel object to dereference + * @return VOID + */ +VOID +PlatformObjectDereference(PVOID Object) +{ +#if defined(_WIN32) || defined(_WIN64) + + ObDereferenceObject(Object); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Signal (set) a kernel event object + * + * @param Event Pointer to the KEVENT to signal + * @param Increment Priority increment for any waiting threads to be awakened + * @param Wait If TRUE, the caller intends to immediately call a wait routine after this call + * @return LONG The previous signal state of the event + */ +LONG +PlatformEventSet(PKEVENT Event, KPRIORITY Increment, BOOLEAN Wait) +{ +#if defined(_WIN32) || defined(_WIN64) + + return KeSetEvent(Event, Increment, Wait); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Obtain a pointer to a kernel object by its user-mode handle and increment its reference count + * + * @param Handle User-mode handle referencing the kernel object + * @param DesiredAccess Access mask for the requested access rights + * @param ObjectType Pointer to the object type object (e.g., *ExEventObjectType); NULL to skip type check + * @param AccessMode Processor mode to use for access checks (KernelMode or UserMode) + * @param Object Receives a pointer to the referenced kernel object body + * @param HandleInformation Optional; receives access state information + * @return NTSTATUS STATUS_SUCCESS on success, or an error code on failure + */ +NTSTATUS +PlatformObjectReferenceByHandle(HANDLE Handle, + ACCESS_MASK DesiredAccess, + POBJECT_TYPE ObjectType, + KPROCESSOR_MODE AccessMode, + PVOID * Object, + POBJECT_HANDLE_INFORMATION HandleInformation) +{ +#if defined(_WIN32) || defined(_WIN64) + + return ObReferenceObjectByHandle(Handle, + DesiredAccess, + ObjectType, + AccessMode, + Object, + HandleInformation); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c b/hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c index 8891b9c1..caf93924 100644 --- a/hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c +++ b/hyperdbg/include/platform/kernel/code/PlatformIntrinsics.c @@ -1,4 +1,4 @@ -/** +/** * @file PlatformIntrinsics.c * @author Sina Karvandi (sina@hyperdbg.org) * @brief Implementation of cross platform APIs for intrinsic functions (x86 instructions) @@ -30,7 +30,9 @@ CpuReadCr0(VOID) #if defined(_WIN32) || defined(_WIN64) return __readcr0(); #elif defined(__linux__) -# error "Not implemented" + ULONG_PTR __val; + __asm__ __volatile__("mov %%cr0, %0" : "=r"(__val)); + return __val; #else # error "Unsupported platform" #endif @@ -47,7 +49,7 @@ CpuWriteCr0(ULONG_PTR Cr0Value) #if defined(_WIN32) || defined(_WIN64) __writecr0(Cr0Value); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("mov %0, %%cr0" : : "r"(Cr0Value) : "memory"); #else # error "Unsupported platform" #endif @@ -64,7 +66,9 @@ CpuReadCr2(VOID) #if defined(_WIN32) || defined(_WIN64) return __readcr2(); #elif defined(__linux__) -# error "Not implemented" + ULONG_PTR __val; + __asm__ __volatile__("mov %%cr2, %0" : "=r"(__val)); + return __val; #else # error "Unsupported platform" #endif @@ -81,7 +85,7 @@ CpuWriteCr2(ULONG_PTR Cr2Value) #if defined(_WIN32) || defined(_WIN64) __writecr2(Cr2Value); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("mov %0, %%cr2" : : "r"(Cr2Value) : "memory"); #else # error "Unsupported platform" #endif @@ -98,7 +102,9 @@ CpuReadCr3(VOID) #if defined(_WIN32) || defined(_WIN64) return __readcr3(); #elif defined(__linux__) -# error "Not implemented" + ULONG_PTR __val; + __asm__ __volatile__("mov %%cr3, %0" : "=r"(__val)); + return __val; #else # error "Unsupported platform" #endif @@ -115,7 +121,7 @@ CpuWriteCr3(ULONG_PTR Cr3Value) #if defined(_WIN32) || defined(_WIN64) __writecr3(Cr3Value); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("mov %0, %%cr3" : : "r"(Cr3Value) : "memory"); #else # error "Unsupported platform" #endif @@ -132,7 +138,9 @@ CpuReadCr4(VOID) #if defined(_WIN32) || defined(_WIN64) return __readcr4(); #elif defined(__linux__) -# error "Not implemented" + ULONG_PTR __val; + __asm__ __volatile__("mov %%cr4, %0" : "=r"(__val)); + return __val; #else # error "Unsupported platform" #endif @@ -149,7 +157,7 @@ CpuWriteCr4(ULONG_PTR Cr4Value) #if defined(_WIN32) || defined(_WIN64) __writecr4(Cr4Value); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("mov %0, %%cr4" : : "r"(Cr4Value) : "memory"); #else # error "Unsupported platform" #endif @@ -166,7 +174,9 @@ CpuReadCr8(VOID) #if defined(_WIN32) || defined(_WIN64) return __readcr8(); #elif defined(__linux__) -# error "Not implemented" + ULONG_PTR __val; + __asm__ __volatile__("mov %%cr8, %0" : "=r"(__val)); + return __val; #else # error "Unsupported platform" #endif @@ -183,7 +193,7 @@ CpuWriteCr8(ULONG_PTR Cr8Value) #if defined(_WIN32) || defined(_WIN64) __writecr8(Cr8Value); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("mov %0, %%cr8" : : "r"(Cr8Value) : "memory"); #else # error "Unsupported platform" #endif @@ -205,7 +215,9 @@ CpuReadMsr(ULONG MsrAddress) #if defined(_WIN32) || defined(_WIN64) return __readmsr(MsrAddress); #elif defined(__linux__) -# error "Not implemented" + UINT32 __lo, __hi; + __asm__ __volatile__("rdmsr" : "=a"(__lo), "=d"(__hi) : "c"(MsrAddress)); + return ((UINT64)__hi << 32) | __lo; #else # error "Unsupported platform" #endif @@ -223,7 +235,7 @@ CpuWriteMsr(ULONG MsrAddress, UINT64 MsrValue) #if defined(_WIN32) || defined(_WIN64) __writemsr(MsrAddress, MsrValue); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("wrmsr" : : "c"(MsrAddress), "a"((UINT32)MsrValue), "d"((UINT32)(MsrValue >> 32))); #else # error "Unsupported platform" #endif @@ -245,7 +257,7 @@ CpuCpuId(INT32 * CpuInfo, INT32 FunctionId) #if defined(_WIN32) || defined(_WIN64) __cpuid(CpuInfo, FunctionId); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("cpuid" : "=a"(CpuInfo[0]), "=b"(CpuInfo[1]), "=c"(CpuInfo[2]), "=d"(CpuInfo[3]) : "a"(FunctionId), "c"(0)); #else # error "Unsupported platform" #endif @@ -264,7 +276,7 @@ CpuCpuIdEx(INT32 * CpuInfo, INT32 FunctionId, INT32 SubFunctionId) #if defined(_WIN32) || defined(_WIN64) __cpuidex(CpuInfo, FunctionId, SubFunctionId); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("cpuid" : "=a"(CpuInfo[0]), "=b"(CpuInfo[1]), "=c"(CpuInfo[2]), "=d"(CpuInfo[3]) : "a"(FunctionId), "c"(SubFunctionId)); #else # error "Unsupported platform" #endif @@ -285,7 +297,9 @@ CpuReadTsc(VOID) #if defined(_WIN32) || defined(_WIN64) return __rdtsc(); #elif defined(__linux__) -# error "Not implemented" + UINT32 __lo, __hi; + __asm__ __volatile__("rdtsc" : "=a"(__lo), "=d"(__hi)); + return ((UINT64)__hi << 32) | __lo; #else # error "Unsupported platform" #endif @@ -303,7 +317,9 @@ CpuReadTscp(UINT32 * Aux) #if defined(_WIN32) || defined(_WIN64) return __rdtscp(Aux); #elif defined(__linux__) -# error "Not implemented" + UINT32 __lo, __hi; + __asm__ __volatile__("rdtscp" : "=a"(__lo), "=d"(__hi), "=c"(*Aux)); + return ((UINT64)__hi << 32) | __lo; #else # error "Unsupported platform" #endif @@ -324,7 +340,7 @@ CpuSidt(VOID * Idtr) #if defined(_WIN32) || defined(_WIN64) __sidt(Idtr); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("sidt %0" : "=m"(*(char *)Idtr) : : "memory"); #else # error "Unsupported platform" #endif @@ -345,7 +361,7 @@ CpuInvlpg(VOID * Address) #if defined(_WIN32) || defined(_WIN64) __invlpg(Address); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("invlpg (%0)" : : "r"(Address) : "memory"); #else # error "Unsupported platform" #endif @@ -368,7 +384,7 @@ CpuStosQ(UINT64 * Destination, UINT64 Value, SIZE_T Count) #if defined(_WIN32) || defined(_WIN64) __stosq((unsigned __int64 *)Destination, Value, Count); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("rep stosq" : "+D"(Destination), "+c"(Count) : "a"(Value) : "memory"); #else # error "Unsupported platform" #endif @@ -391,7 +407,10 @@ CpuBitScanForward64(ULONG * Index, UINT64 Mask) #if defined(_WIN32) || defined(_WIN64) return (UCHAR)_BitScanForward64((unsigned long *)Index, Mask); #elif defined(__linux__) -# error "Not implemented" + if (!Mask) + return 0; + *Index = (ULONG)__builtin_ctzll(Mask); + return 1; #else # error "Unsupported platform" #endif @@ -410,7 +429,7 @@ CpuNop(VOID) #if defined(_WIN32) || defined(_WIN64) __nop(); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("nop"); #else # error "Unsupported platform" #endif @@ -425,7 +444,7 @@ CpuPause(VOID) #if defined(_WIN32) || defined(_WIN64) _mm_pause(); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("pause"); #else # error "Unsupported platform" #endif @@ -443,7 +462,17 @@ CpuSegmentLimit(UINT32 Selector) #if defined(_WIN32) || defined(_WIN64) return __segmentlimit(Selector); #elif defined(__linux__) -# error "Not implemented" + + UINT32 Limit; + + __asm__ __volatile__( + "lsl %1, %0" + : "=r"(Limit) + : "rm"(Selector) + : "cc"); + + return Limit; + #else # error "Unsupported platform" #endif @@ -465,7 +494,9 @@ CpuIoInByte(UINT16 Port) #if defined(_WIN32) || defined(_WIN64) return __inbyte(Port); #elif defined(__linux__) -# error "Not implemented" + UINT8 __val; + __asm__ __volatile__("inb %1, %0" : "=a"(__val) : "Nd"(Port)); + return __val; #else # error "Unsupported platform" #endif @@ -483,7 +514,9 @@ CpuIoInWord(UINT16 Port) #if defined(_WIN32) || defined(_WIN64) return __inword(Port); #elif defined(__linux__) -# error "Not implemented" + UINT16 __val; + __asm__ __volatile__("inw %1, %0" : "=a"(__val) : "Nd"(Port)); + return __val; #else # error "Unsupported platform" #endif @@ -501,7 +534,9 @@ CpuIoInDword(UINT16 Port) #if defined(_WIN32) || defined(_WIN64) return __indword(Port); #elif defined(__linux__) -# error "Not implemented" + UINT32 __val; + __asm__ __volatile__("inl %1, %0" : "=a"(__val) : "Nd"(Port)); + return __val; #else # error "Unsupported platform" #endif @@ -520,7 +555,7 @@ CpuIoInByteString(UINT16 Port, UINT8 * Data, UINT32 Size) #if defined(_WIN32) || defined(_WIN64) __inbytestring(Port, Data, Size); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("rep insb" : "+D"(Data), "+c"(Size) : "d"(Port) : "memory"); #else # error "Unsupported platform" #endif @@ -539,7 +574,7 @@ CpuIoInWordString(UINT16 Port, UINT16 * Data, UINT32 Size) #if defined(_WIN32) || defined(_WIN64) __inwordstring(Port, Data, Size); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("rep insw" : "+D"(Data), "+c"(Size) : "d"(Port) : "memory"); #else # error "Unsupported platform" #endif @@ -558,7 +593,7 @@ CpuIoInDwordString(UINT16 Port, UINT32 * Data, UINT32 Size) #if defined(_WIN32) || defined(_WIN64) __indwordstring(Port, (unsigned long *)Data, Size); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("rep insl" : "+D"(Data), "+c"(Size) : "d"(Port) : "memory"); #else # error "Unsupported platform" #endif @@ -576,7 +611,7 @@ CpuIoOutByte(UINT16 Port, UINT8 Value) #if defined(_WIN32) || defined(_WIN64) __outbyte(Port, Value); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("outb %0, %1" : : "a"(Value), "Nd"(Port)); #else # error "Unsupported platform" #endif @@ -594,7 +629,7 @@ CpuIoOutWord(UINT16 Port, UINT16 Value) #if defined(_WIN32) || defined(_WIN64) __outword(Port, Value); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("outw %0, %1" : : "a"(Value), "Nd"(Port)); #else # error "Unsupported platform" #endif @@ -612,7 +647,7 @@ CpuIoOutDword(UINT16 Port, UINT32 Value) #if defined(_WIN32) || defined(_WIN64) __outdword(Port, Value); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("outl %0, %1" : : "a"(Value), "Nd"(Port)); #else # error "Unsupported platform" #endif @@ -631,7 +666,7 @@ CpuIoOutByteString(UINT16 Port, UINT8 * Data, UINT32 Count) #if defined(_WIN32) || defined(_WIN64) __outbytestring(Port, Data, Count); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("rep outsb" : "+S"(Data), "+c"(Count) : "d"(Port) : "memory"); #else # error "Unsupported platform" #endif @@ -650,7 +685,7 @@ CpuIoOutWordString(UINT16 Port, UINT16 * Data, UINT32 Count) #if defined(_WIN32) || defined(_WIN64) __outwordstring(Port, Data, Count); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("rep outsw" : "+S"(Data), "+c"(Count) : "d"(Port) : "memory"); #else # error "Unsupported platform" #endif @@ -669,7 +704,7 @@ CpuIoOutDwordString(UINT16 Port, UINT32 * Data, UINT32 Count) #if defined(_WIN32) || defined(_WIN64) __outdwordstring(Port, (unsigned long *)Data, Count); #elif defined(__linux__) -# error "Not implemented" + __asm__ __volatile__("rep outsl" : "+S"(Data), "+c"(Count) : "d"(Port) : "memory"); #else # error "Unsupported platform" #endif diff --git a/hyperdbg/include/platform/kernel/code/PlatformIo.c b/hyperdbg/include/platform/kernel/code/PlatformIo.c new file mode 100644 index 00000000..36af0a73 --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformIo.c @@ -0,0 +1,89 @@ +/** + * @file PlatformIo.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for I/O Request Packet (IRP) management + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformIo.h" +#endif // defined(__linux__) + +/** + * @brief Get the current I/O stack location from an IRP + * + * @param Irp Pointer to the IRP (I/O Request Packet) + * @return PIO_STACK_LOCATION Pointer to the current stack location + */ +PIO_STACK_LOCATION +PlatformIoGetCurrentIrpStackLocation(PIRP Irp) +{ +#if defined(_WIN32) || defined(_WIN64) + + return IoGetCurrentIrpStackLocation(Irp); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Complete an IRP and release it back to the I/O manager + * + * @param Irp Pointer to the IRP to complete + * @param PriorityBoost Priority boost value (e.g., IO_NO_INCREMENT) + * @return VOID + */ +VOID +PlatformIoCompleteRequest(PIRP Irp, CCHAR PriorityBoost) +{ +#if defined(_WIN32) || defined(_WIN64) + + IoCompleteRequest(Irp, PriorityBoost); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Mark the current IRP stack location as pending + * + * @param Irp Pointer to the IRP to mark as pending + * @return VOID + */ +VOID +PlatformIoMarkIrpPending(PIRP Irp) +{ +#if defined(_WIN32) || defined(_WIN64) + + IoMarkIrpPending(Irp); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformIrql.c b/hyperdbg/include/platform/kernel/code/PlatformIrql.c new file mode 100644 index 00000000..dd44f269 --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformIrql.c @@ -0,0 +1,63 @@ +/** + * @file PlatformIrql.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for IRQL management + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformIrql.h" +#endif // defined(__linux__) + +/** + * @brief Raise the current IRQL to DISPATCH_LEVEL + * + * @return KIRQL The previous IRQL before the raise + */ +KIRQL +PlatformIrqlRaiseToDpcLevel(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + + return KeRaiseIrqlToDpcLevel(); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Lower the current IRQL to the previously saved value + * + * @param OldIrql The previous IRQL to restore + * @return VOID + */ +VOID +PlatformIrqlLower(KIRQL OldIrql) +{ +#if defined(_WIN32) || defined(_WIN64) + + KeLowerIrql(OldIrql); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformMem.c b/hyperdbg/include/platform/kernel/code/PlatformMem.c index e3f75db8..f93164ae 100644 --- a/hyperdbg/include/platform/kernel/code/PlatformMem.c +++ b/hyperdbg/include/platform/kernel/code/PlatformMem.c @@ -121,6 +121,28 @@ PlatformSetMemory( #endif } +/** + * @brief Zeros a memory block. + * @param Destination Memory address. + * @param Size Number of bytes. + */ +VOID +PlatformZeroMemory( + PVOID Destination, + SIZE_T Size) +{ + if (!Destination) + return; + +#ifdef _WIN32 + RtlZeroMemory(Destination, Size); +#elif defined(__linux__) + memset(Destination, 0, Size); +#else +# error "Unsupported platform" +#endif +} + ///////////////////////////////////////////////// /// ... Backward Compatibility / Specific APIs ... ///////////////////////////////////////////////// diff --git a/hyperdbg/include/platform/kernel/code/PlatformProcess.c b/hyperdbg/include/platform/kernel/code/PlatformProcess.c new file mode 100644 index 00000000..5943df34 --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformProcess.c @@ -0,0 +1,131 @@ +/** + * @file PlatformProcess.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for process and thread queries + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformProcess.h" +#endif // defined(__linux__) + +/** + * @brief Get the current thread ID + * + * @return HANDLE + */ +HANDLE +PlatformProcessGetCurrentThreadId(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + + return PsGetCurrentThreadId(); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Get the current process ID + * + * @return HANDLE + */ +HANDLE +PlatformProcessGetCurrentProcessId(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + + return PsGetCurrentProcessId(); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Get the current process (PEPROCESS) + * + * @return PVOID Pointer to the EPROCESS structure for the current process + */ +PVOID +PlatformProcessGetCurrentProcess(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + + return (PVOID)PsGetCurrentProcess(); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Get the current thread (PETHREAD) + * + * @return PVOID Pointer to the ETHREAD structure for the current thread + */ +PVOID +PlatformProcessGetCurrentThread(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + + return (PVOID)PsGetCurrentThread(); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Get the TEB (Thread Environment Block) of the current thread + * + * @return PVOID Pointer to the TEB of the current thread + */ +PVOID +PlatformProcessGetCurrentThreadTeb(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + + return PsGetCurrentThreadTeb(); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformSpinlock.c b/hyperdbg/include/platform/kernel/code/PlatformSpinlock.c new file mode 100644 index 00000000..7e091499 --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformSpinlock.c @@ -0,0 +1,90 @@ +/** + * @file PlatformSpinlock.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for kernel spinlock operations + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformSpinlock.h" +#endif // defined(__linux__) + +/** + * @brief Initialize a kernel spinlock + * + * @param SpinLock Pointer to the KSPIN_LOCK to initialize + * @return VOID + */ +VOID +PlatformSpinlockInitialize(PKSPIN_LOCK SpinLock) +{ +#if defined(_WIN32) || defined(_WIN64) + + KeInitializeSpinLock(SpinLock); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Acquire a kernel spinlock, raising IRQL to DISPATCH_LEVEL + * + * @param SpinLock Pointer to the KSPIN_LOCK to acquire + * @param OldIrql Receives the previous IRQL value to be restored on release + * @return VOID + */ +VOID +PlatformSpinlockAcquire(PKSPIN_LOCK SpinLock, PKIRQL OldIrql) +{ +#if defined(_WIN32) || defined(_WIN64) + + KeAcquireSpinLock(SpinLock, OldIrql); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Release a previously acquired kernel spinlock and restore IRQL + * + * @param SpinLock Pointer to the KSPIN_LOCK to release + * @param OldIrql The previous IRQL value saved during acquire + * @return VOID + */ +VOID +PlatformSpinlockRelease(PKSPIN_LOCK SpinLock, KIRQL OldIrql) +{ +#if defined(_WIN32) || defined(_WIN64) + + KeReleaseSpinLock(SpinLock, OldIrql); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/include/platform/kernel/code/PlatformTime.c b/hyperdbg/include/platform/kernel/code/PlatformTime.c new file mode 100644 index 00000000..dcb80a8d --- /dev/null +++ b/hyperdbg/include/platform/kernel/code/PlatformTime.c @@ -0,0 +1,90 @@ +/** + * @file PlatformTime.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for system time operations + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/PlatformTime.h" +#endif // defined(__linux__) + +/** + * @brief Query the current system time + * + * @param SystemTime Receives the current system time as a LARGE_INTEGER (100-nanosecond units since January 1, 1601) + * @return VOID + */ +VOID +PlatformTimeQuerySystemTime(PLARGE_INTEGER SystemTime) +{ +#if defined(_WIN32) || defined(_WIN64) + + KeQuerySystemTime(SystemTime); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Convert system time (UTC) to local time + * + * @param SystemTime Pointer to the system time value in UTC + * @param LocalTime Receives the converted local time value + * @return VOID + */ +VOID +PlatformTimeConvertToLocalTime(PLARGE_INTEGER SystemTime, PLARGE_INTEGER LocalTime) +{ +#if defined(_WIN32) || defined(_WIN64) + + ExSystemTimeToLocalTime(SystemTime, LocalTime); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} + +/** + * @brief Convert a LARGE_INTEGER time value to a TIME_FIELDS structure + * + * @param Time Pointer to the time value to convert + * @param TimeFields Receives the broken-down time fields (year, month, day, hour, minute, etc.) + * @return VOID + */ +VOID +PlatformTimeConvertToTimeFields(PLARGE_INTEGER Time, PTIME_FIELDS TimeFields) +{ +#if defined(_WIN32) || defined(_WIN64) + + RtlTimeToTimeFields(Time, TimeFields); + +#elif defined(__linux__) + +# error "Not yet implemented" + +#else + +# error "Unsupported platform" + +#endif +} diff --git a/hyperdbg/hypertrace/header/broadcast/Dpc.h b/hyperdbg/include/platform/kernel/header/PlatformBroadcast.h similarity index 58% rename from hyperdbg/hypertrace/header/broadcast/Dpc.h rename to hyperdbg/include/platform/kernel/header/PlatformBroadcast.h index 46b6d58b..97b2bab1 100644 --- a/hyperdbg/hypertrace/header/broadcast/Dpc.h +++ b/hyperdbg/include/platform/kernel/header/PlatformBroadcast.h @@ -1,21 +1,26 @@ - /** - * @file Dpc.h + * @file PlatformBroadcast.h * @author Sina Karvandi (sina@hyperdbg.org) - * @brief Definition for Windows DPC functions + * @brief Cross platform APIs for broadcasting routines * @details * @version 0.19 - * @date 2026-04-19 + * @date 2026-05-08 * * @copyright This project is released under the GNU Public License v3. * */ #pragma once +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + ////////////////////////////////////////////////// // Functions // ////////////////////////////////////////////////// +#if defined(_WIN32) || defined(_WIN64) + NTKERNELAPI _IRQL_requires_max_(APC_LEVEL) _IRQL_requires_min_(PASSIVE_LEVEL) @@ -38,3 +43,12 @@ _IRQL_requires_same_ LOGICAL KeSignalCallDpcSynchronize( _In_ PVOID SystemArgument2); + +#endif // defined(_WIN32) || defined(_WIN64) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +VOID +PlatformBroadcastSynchronizeEndOfRoutine(PVOID SystemArgument1, PVOID SystemArgument2); diff --git a/hyperdbg/include/platform/kernel/header/PlatformCpu.h b/hyperdbg/include/platform/kernel/header/PlatformCpu.h new file mode 100644 index 00000000..fb3413f9 --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformCpu.h @@ -0,0 +1,26 @@ +/** + * @file PlatformCpu.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for CPU and processor queries + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +ULONG +PlatformCpuGetActiveProcessorCount(VOID); + +ULONG +PlatformCpuGetCurrentProcessorNumber(VOID); diff --git a/hyperdbg/include/platform/kernel/header/PlatformDbg.h b/hyperdbg/include/platform/kernel/header/PlatformDbg.h new file mode 100644 index 00000000..c10e6cc3 --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformDbg.h @@ -0,0 +1,23 @@ +/** + * @file PlatformDbg.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for kernel debug output + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +VOID +PlatformDbgPrint(const CHAR * Format, ...); diff --git a/hyperdbg/include/platform/kernel/header/PlatformDpc.h b/hyperdbg/include/platform/kernel/header/PlatformDpc.h new file mode 100644 index 00000000..72476ae8 --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformDpc.h @@ -0,0 +1,30 @@ +/** + * @file PlatformDpc.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for Deferred Procedure Call (DPC) management + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +#if defined(_WIN32) || defined(_WIN64) + +VOID +PlatformDpcInitialize(PRKDPC Dpc, PKDEFERRED_ROUTINE DeferredRoutine, PVOID DeferredContext); + +BOOLEAN +PlatformDpcInsertQueueDpc(PRKDPC Dpc, PVOID SystemArgument1, PVOID SystemArgument2); + +#endif // defined(_WIN32) || defined(_WIN64) diff --git a/hyperdbg/include/platform/kernel/header/PlatformEvent.h b/hyperdbg/include/platform/kernel/header/PlatformEvent.h new file mode 100644 index 00000000..da38a7da --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformEvent.h @@ -0,0 +1,38 @@ +/** + * @file PlatformEvent.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for kernel event and object management + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +VOID +PlatformObjectDereference(PVOID Object); + +#if defined(_WIN32) || defined(_WIN64) + +LONG +PlatformEventSet(PKEVENT Event, KPRIORITY Increment, BOOLEAN Wait); + +NTSTATUS +PlatformObjectReferenceByHandle(HANDLE Handle, + ACCESS_MASK DesiredAccess, + POBJECT_TYPE ObjectType, + KPROCESSOR_MODE AccessMode, + PVOID * Object, + POBJECT_HANDLE_INFORMATION HandleInformation); + +#endif // defined(_WIN32) || defined(_WIN64) diff --git a/hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h b/hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h index c22c63a7..318b878b 100644 --- a/hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h +++ b/hyperdbg/include/platform/kernel/header/PlatformIntrinsics.h @@ -105,7 +105,35 @@ CpuWriteMsr(ULONG MsrAddress, UINT64 MsrValue); #if defined(_WIN32) || defined(_WIN64) # define CpuReadDr(DrNumber) __readdr(DrNumber) #elif defined(__linux__) -# error "Not implemented" +# define CpuReadDr(DrNumber) \ + ({ \ + ULONG_PTR __val; \ + switch (DrNumber) \ + { \ + case 0: \ + __asm__ volatile("mov %%dr0, %0" : "=r"(__val)); \ + break; \ + case 1: \ + __asm__ volatile("mov %%dr1, %0" : "=r"(__val)); \ + break; \ + case 2: \ + __asm__ volatile("mov %%dr2, %0" : "=r"(__val)); \ + break; \ + case 3: \ + __asm__ volatile("mov %%dr3, %0" : "=r"(__val)); \ + break; \ + case 6: \ + __asm__ volatile("mov %%dr6, %0" : "=r"(__val)); \ + break; \ + case 7: \ + __asm__ volatile("mov %%dr7, %0" : "=r"(__val)); \ + break; \ + default: \ + __val = 0; \ + break; \ + } \ + __val; \ + }) #else # error "Unsupported platform" #endif @@ -116,7 +144,33 @@ CpuWriteMsr(ULONG MsrAddress, UINT64 MsrValue); #if defined(_WIN32) || defined(_WIN64) # define CpuWriteDr(DrNumber, DrValue) __writedr(DrNumber, DrValue) #elif defined(__linux__) -# error "Not implemented" +# define CpuWriteDr(DrNumber, DrValue) \ + do \ + { \ + switch (DrNumber) \ + { \ + case 0: \ + __asm__ volatile("mov %0, %%dr0" : : "r"((ULONG_PTR)(DrValue))); \ + break; \ + case 1: \ + __asm__ volatile("mov %0, %%dr1" : : "r"((ULONG_PTR)(DrValue))); \ + break; \ + case 2: \ + __asm__ volatile("mov %0, %%dr2" : : "r"((ULONG_PTR)(DrValue))); \ + break; \ + case 3: \ + __asm__ volatile("mov %0, %%dr3" : : "r"((ULONG_PTR)(DrValue))); \ + break; \ + case 6: \ + __asm__ volatile("mov %0, %%dr6" : : "r"((ULONG_PTR)(DrValue))); \ + break; \ + case 7: \ + __asm__ volatile("mov %0, %%dr7" : : "r"((ULONG_PTR)(DrValue))); \ + break; \ + default: \ + break; \ + } \ + } while (0) #else # error "Unsupported platform" #endif diff --git a/hyperdbg/include/platform/kernel/header/PlatformIo.h b/hyperdbg/include/platform/kernel/header/PlatformIo.h new file mode 100644 index 00000000..e6df744e --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformIo.h @@ -0,0 +1,33 @@ +/** + * @file PlatformIo.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for I/O Request Packet (IRP) management + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +#if defined(_WIN32) || defined(_WIN64) + +PIO_STACK_LOCATION +PlatformIoGetCurrentIrpStackLocation(PIRP Irp); + +VOID +PlatformIoCompleteRequest(PIRP Irp, CCHAR PriorityBoost); + +VOID +PlatformIoMarkIrpPending(PIRP Irp); + +#endif // defined(_WIN32) || defined(_WIN64) diff --git a/hyperdbg/include/platform/kernel/header/PlatformIrql.h b/hyperdbg/include/platform/kernel/header/PlatformIrql.h new file mode 100644 index 00000000..8ebaa70c --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformIrql.h @@ -0,0 +1,30 @@ +/** + * @file PlatformIrql.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for IRQL (Interrupt Request Level) management + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +#if defined(_WIN32) || defined(_WIN64) + +KIRQL +PlatformIrqlRaiseToDpcLevel(VOID); + +VOID +PlatformIrqlLower(KIRQL OldIrql); + +#endif // defined(_WIN32) || defined(_WIN64) diff --git a/hyperdbg/include/platform/kernel/header/PlatformMem.h b/hyperdbg/include/platform/kernel/header/PlatformMem.h index af8d5656..c7398722 100644 --- a/hyperdbg/include/platform/kernel/header/PlatformMem.h +++ b/hyperdbg/include/platform/kernel/header/PlatformMem.h @@ -31,6 +31,9 @@ PlatformWriteMemory(PVOID Address, PVOID Buffer, SIZE_T Size); VOID PlatformSetMemory(PVOID Destination, int Value, SIZE_T Size); +VOID +PlatformZeroMemory(PVOID Destination, SIZE_T Size); + VOID PlatformFreeMemory(PVOID Memory); diff --git a/hyperdbg/include/platform/kernel/header/PlatformProcess.h b/hyperdbg/include/platform/kernel/header/PlatformProcess.h new file mode 100644 index 00000000..4eedd377 --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformProcess.h @@ -0,0 +1,35 @@ +/** + * @file PlatformProcess.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for process and thread queries + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +HANDLE +PlatformProcessGetCurrentThreadId(VOID); + +HANDLE +PlatformProcessGetCurrentProcessId(VOID); + +PVOID +PlatformProcessGetCurrentProcess(VOID); + +PVOID +PlatformProcessGetCurrentThread(VOID); + +PVOID +PlatformProcessGetCurrentThreadTeb(VOID); diff --git a/hyperdbg/include/platform/kernel/header/PlatformSpinlock.h b/hyperdbg/include/platform/kernel/header/PlatformSpinlock.h new file mode 100644 index 00000000..e8327e8e --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformSpinlock.h @@ -0,0 +1,33 @@ +/** + * @file PlatformSpinlock.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for kernel spinlock operations + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +#if defined(_WIN32) || defined(_WIN64) + +VOID +PlatformSpinlockInitialize(PKSPIN_LOCK SpinLock); + +VOID +PlatformSpinlockAcquire(PKSPIN_LOCK SpinLock, PKIRQL OldIrql); + +VOID +PlatformSpinlockRelease(PKSPIN_LOCK SpinLock, KIRQL OldIrql); + +#endif // defined(_WIN32) || defined(_WIN64) diff --git a/hyperdbg/include/platform/kernel/header/PlatformTime.h b/hyperdbg/include/platform/kernel/header/PlatformTime.h new file mode 100644 index 00000000..b760c184 --- /dev/null +++ b/hyperdbg/include/platform/kernel/header/PlatformTime.h @@ -0,0 +1,33 @@ +/** + * @file PlatformTime.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Cross platform APIs for system time operations + * @details + * @version 0.19 + * @date 2026-05-09 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// Functions // +////////////////////////////////////////////////// + +#if defined(_WIN32) || defined(_WIN64) + +VOID +PlatformTimeQuerySystemTime(PLARGE_INTEGER SystemTime); + +VOID +PlatformTimeConvertToLocalTime(PLARGE_INTEGER SystemTime, PLARGE_INTEGER LocalTime); + +VOID +PlatformTimeConvertToTimeFields(PLARGE_INTEGER Time, PTIME_FIELDS TimeFields); + +#endif // defined(_WIN32) || defined(_WIN64) diff --git a/hyperdbg/include/platform/user/code/.gitkeep b/hyperdbg/include/platform/user/code/.gitkeep deleted file mode 100644 index e69de29b..00000000 diff --git a/hyperdbg/include/platform/user/code/platform-intrinsics.c b/hyperdbg/include/platform/user/code/platform-intrinsics.c new file mode 100644 index 00000000..7340662f --- /dev/null +++ b/hyperdbg/include/platform/user/code/platform-intrinsics.c @@ -0,0 +1,99 @@ +/** + * @file platform-intrinsics.c + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief Implementation of cross platform APIs for intrinsic functions (x86 instructions) + * @details + * @version 0.19 + * @date 2026-05-06 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#include "pch.h" + +#if defined(__linux__) +# include "../header/platform-intrinsics.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// CPUID Instructions // +////////////////////////////////////////////////// + +/** + * @brief Execute CPUID + * + * @param CpuInfo + * @param FunctionId + */ + VOID +CpuCpuId(INT32 * CpuInfo, INT32 FunctionId) +{ +#if defined(_WIN32) || defined(_WIN64) + __cpuid(CpuInfo, FunctionId); +#elif defined(__linux__) + __asm__ __volatile__("cpuid" : "=a"(CpuInfo[0]), "=b"(CpuInfo[1]), "=c"(CpuInfo[2]), "=d"(CpuInfo[3]) : "a"(FunctionId), "c"(0)); +#else +# error "Unsupported platform" +#endif +} + +/** + * @brief Execute CPUID with sub-leaf + * + * @param CpuInfo + * @param FunctionId + * @param SubFunctionId + */ + VOID +CpuCpuIdEx(INT32 * CpuInfo, INT32 FunctionId, INT32 SubFunctionId) +{ +#if defined(_WIN32) || defined(_WIN64) + __cpuidex(CpuInfo, FunctionId, SubFunctionId); +#elif defined(__linux__) + __asm__ __volatile__("cpuid" : "=a"(CpuInfo[0]), "=b"(CpuInfo[1]), "=c"(CpuInfo[2]), "=d"(CpuInfo[3]) : "a"(FunctionId), "c"(SubFunctionId)); +#else +# error "Unsupported platform" +#endif +} + +////////////////////////////////////////////////// +// TSC Instructions // +////////////////////////////////////////////////// + +/** + * @brief Read Time-Stamp Counter + * + * @return UINT64 + */ + UINT64 +CpuReadTsc(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + return __rdtsc(); +#elif defined(__linux__) + UINT32 __lo, __hi; + __asm__ __volatile__("rdtsc" : "=a"(__lo), "=d"(__hi)); + return ((UINT64)__hi << 32) | __lo; +#else +# error "Unsupported platform" +#endif +} + +////////////////////////////////////////////////// +// Misc Instructions // +////////////////////////////////////////////////// + +/** + * @brief Execute PAUSE (spin-wait hint) + */ + VOID +CpuPause(VOID) +{ +#if defined(_WIN32) || defined(_WIN64) + _mm_pause(); +#elif defined(__linux__) + __asm__ __volatile__("pause"); +#else +# error "Unsupported platform" +#endif +} diff --git a/hyperdbg/include/platform/user/header/platform-intrinsics.h b/hyperdbg/include/platform/user/header/platform-intrinsics.h new file mode 100644 index 00000000..c2334a1d --- /dev/null +++ b/hyperdbg/include/platform/user/header/platform-intrinsics.h @@ -0,0 +1,52 @@ +/** + * @file platform-intrinsics.h + * @author Sina Karvandi (sina@hyperdbg.org) + * @brief User mode Cross platform APIs for intrinsic functions (x86 instructions) + * @details + * @version 0.19 + * @date 2026-05-06 + * + * @copyright This project is released under the GNU Public License v3. + * + */ +#pragma once + +#if defined(__linux__) +# include "../../../../include/SDK/HyperDbgSdk.h" +#endif // defined(__linux__) + +////////////////////////////////////////////////// +// CPUID Instructions // +////////////////////////////////////////////////// + +// +// CPUID +// +VOID +CpuCpuId(INT32 * CpuInfo, INT32 FunctionId); + +// +// CPUID (with sub-leaf) +// +VOID +CpuCpuIdEx(INT32 * CpuInfo, INT32 FunctionId, INT32 SubFunctionId); + +////////////////////////////////////////////////// +// TSC Instructions // +////////////////////////////////////////////////// + +// +// RDTSC +// +UINT64 +CpuReadTsc(VOID); + +////////////////////////////////////////////////// +// Misc Instructions // +////////////////////////////////////////////////// + +// +// PAUSE +// +VOID + CpuPause(VOID); diff --git a/hyperdbg/libhyperdbg/code/common/common.cpp b/hyperdbg/libhyperdbg/code/common/common.cpp index 6cf6e689..bad53e8d 100644 --- a/hyperdbg/libhyperdbg/code/common/common.cpp +++ b/hyperdbg/libhyperdbg/code/common/common.cpp @@ -922,7 +922,7 @@ ConvertStringVectorToCharPointerArray(const std::string & s) VOID CommonCpuidInstruction(UINT32 Func, UINT32 SubFunc, int * CpuInfo) { - __cpuidex(CpuInfo, Func, SubFunc); + CpuIdEx(CpuInfo, Func, SubFunc); } /** diff --git a/hyperdbg/libhyperdbg/code/common/spinlock.cpp b/hyperdbg/libhyperdbg/code/common/spinlock.cpp index 4303a100..7668f21d 100644 --- a/hyperdbg/libhyperdbg/code/common/spinlock.cpp +++ b/hyperdbg/libhyperdbg/code/common/spinlock.cpp @@ -57,7 +57,7 @@ SpinlockLock(volatile LONG * Lock) { for (unsigned i = 0; i < wait; ++i) { - _mm_pause(); + CpuPause(); } // @@ -91,7 +91,7 @@ SpinlockLockWithCustomWait(volatile LONG * Lock, unsigned MaximumWait) { for (unsigned i = 0; i < wait; ++i) { - _mm_pause(); + CpuPause(); } // diff --git a/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/cpu.cpp b/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/cpu.cpp index 6cf56b30..017a1ae0 100644 --- a/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/cpu.cpp +++ b/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/cpu.cpp @@ -140,12 +140,12 @@ private: // Calling __cpuid with 0x0 as the function_id argument // gets the number of the highest valid function ID. // - __cpuid(cpui.data(), 0); + CpuCpuId(cpui.data(), 0); nIds_ = cpui[0]; for (int i = 0; i <= nIds_; ++i) { - __cpuidex(cpui.data(), i, 0); + CpuIdEx(cpui.data(), i, 0); data_.push_back(cpui); } @@ -189,7 +189,7 @@ private: // Calling __cpuid with 0x80000000 as the function_id argument // gets the number of the highest valid extended ID. // - __cpuid(cpui.data(), 0x80000000); + CpuCpuId(cpui.data(), 0x80000000); nExIds_ = cpui[0]; char brand[0x40]; @@ -197,7 +197,7 @@ private: for (int i = 0x80000000; i <= nExIds_; ++i) { - __cpuidex(cpui.data(), i, 0); + CpuIdEx(cpui.data(), i, 0); extdata_.push_back(cpui); } diff --git a/hyperdbg/libhyperdbg/code/debugger/transparency/transparency.cpp b/hyperdbg/libhyperdbg/code/debugger/transparency/transparency.cpp index 48250170..5bf59f65 100644 --- a/hyperdbg/libhyperdbg/code/debugger/transparency/transparency.cpp +++ b/hyperdbg/libhyperdbg/code/debugger/transparency/transparency.cpp @@ -33,7 +33,7 @@ TransparentModeRdtscDiffVmexit() // // Win32 // - ret = __rdtsc(); + ret = CpuReadTsc(); /* vm exit forced here. it uses: eax = 0; cpuid; */ @@ -45,7 +45,7 @@ TransparentModeRdtscDiffVmexit() // // WIN32 // - __cpuid(cpuid_result, 0); + CpuCpuId(cpuid_result, 0); // // GCC @@ -56,7 +56,7 @@ TransparentModeRdtscDiffVmexit() // // WIN32 // - ret2 = __rdtsc(); + ret2 = CpuReadTsc(); return ret2 - ret; } @@ -80,7 +80,7 @@ TransparentModeRdtscVmexitTracing() // // WIN32 // - ret = __rdtsc(); + ret = CpuReadTsc(); // // GCC @@ -91,7 +91,7 @@ TransparentModeRdtscVmexitTracing() // // WIN32 // - ret2 = __rdtsc(); + ret2 = CpuReadTsc(); return ret2 - ret; } diff --git a/hyperdbg/libhyperdbg/libhyperdbg.vcxproj b/hyperdbg/libhyperdbg/libhyperdbg.vcxproj index 208441b8..70f6d526 100644 --- a/hyperdbg/libhyperdbg/libhyperdbg.vcxproj +++ b/hyperdbg/libhyperdbg/libhyperdbg.vcxproj @@ -127,6 +127,7 @@ + @@ -158,6 +159,7 @@ + diff --git a/hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters b/hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters index c520e640..9443bd3c 100644 --- a/hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters +++ b/hyperdbg/libhyperdbg/libhyperdbg.vcxproj.filters @@ -173,6 +173,9 @@ header + + header\platform + @@ -604,6 +607,9 @@ code\debugger\commands\extension-commands + + code\platform + diff --git a/hyperdbg/libhyperdbg/pch.h b/hyperdbg/libhyperdbg/pch.h index 632ea77a..c8ade1aa 100644 --- a/hyperdbg/libhyperdbg/pch.h +++ b/hyperdbg/libhyperdbg/pch.h @@ -140,6 +140,11 @@ typedef const wchar_t *LPCWCHAR, *PCWCHAR; #include "SDK/imports/user/HyperDbgScriptImports.h" #include "SDK/imports/user/HyperDbgLibImports.h" +// +// Platform-specific intrinsics +// +#include "platform/user/header/platform-intrinsics.h" + // // PCI IDs // diff --git a/hyperdbg/linux/mock/kernel/Makefile b/hyperdbg/linux/mock/kernel/Makefile index a780931f..b8e5c4e6 100644 --- a/hyperdbg/linux/mock/kernel/Makefile +++ b/hyperdbg/linux/mock/kernel/Makefile @@ -3,21 +3,25 @@ PWD := $(shell pwd) obj-m := HyperDbg.o HyperDbg-objs := mock.o \ PlatformMem.o \ - PlatformIntrinsicsVmx.o + PlatformIntrinsicsVmx.o \ + PlatformIntrinsics.o ccflags-y += -I$(PWD)/../../../include ccflags-y += -I$(PWD)/../../../include/platform/kernel/header ccflags-y += -I$(PWD)/../../../include/platform/kernel/code -all: clean PlatformMem.c PlatformIntrinsicsVmx.c +all: clean PlatformMem.c PlatformIntrinsicsVmx.c PlatformIntrinsics.c $(MAKE) -C $(KDIR) M=$(PWD) modules PlatformMem.c: cp ../../../include/platform/kernel/code/PlatformMem.c $(PWD)/PlatformMem.c +PlatformIntrinsics.c: + cp ../../../include/platform/kernel/code/PlatformIntrinsics.c $(PWD)/PlatformIntrinsics.c PlatformIntrinsicsVmx.c: cp ../../../include/platform/kernel/code/PlatformIntrinsicsVmx.c $(PWD)/PlatformIntrinsicsVmx.c clean: $(MAKE) -C $(KDIR) M=$(PWD) clean rm -f $(PWD)/PlatformMem.c + rm -f $(PWD)/PlatformIntrinsics.c rm -f $(PWD)/PlatformIntrinsicsVmx.c \ No newline at end of file diff --git a/hyperdbg/linux/mock/kernel/mock.c b/hyperdbg/linux/mock/kernel/mock.c index ed830f83..47d0d516 100644 --- a/hyperdbg/linux/mock/kernel/mock.c +++ b/hyperdbg/linux/mock/kernel/mock.c @@ -66,6 +66,8 @@ mock_init(void) VmxVmread64(0, 0); // Just to test the intrinsic wrapper compiles and links correctly + CpuReadMsr(0x1); // Just to test the intrinsic wrapper compiles and links correctly + ///////////////////////////////////////////////////////////////////////////////////// return 0; diff --git a/hyperdbg/linux/mock/user/Makefile b/hyperdbg/linux/mock/user/Makefile index 6ba7944e..229a6c0c 100644 --- a/hyperdbg/linux/mock/user/Makefile +++ b/hyperdbg/linux/mock/user/Makefile @@ -1,12 +1,17 @@ CC = gcc -CFLAGS = -Wall -Wextra -std=c11 -O2 -I../../../include +PWD := $(shell pwd) +CFLAGS = -Wall -Wextra -std=c11 -O2 +CFLAGS += -I$(PWD)/../../../include +CFLAGS += -I$(PWD)/../../../include/platform/user/header +CFLAGS += -I$(PWD)/../../../include/platform/user/code TARGET = mock -SRCS = mock.c +SRCS = mock.c \ + platform-intrinsics.c OBJS = $(SRCS:.c=.o) .PHONY: all clean -all: $(TARGET) +all: clean platform-intrinsics.c $(TARGET) $(TARGET): $(OBJS) $(CC) $(CFLAGS) -o $@ $^ @@ -14,5 +19,9 @@ $(TARGET): $(OBJS) %.o: %.c pch.h $(CC) $(CFLAGS) -c -o $@ $< +platform-intrinsics.c: + cp $(PWD)/../../../include/platform/user/code/platform-intrinsics.c $(PWD)/platform-intrinsics.c + clean: - rm -f $(OBJS) $(TARGET) \ No newline at end of file + rm -f $(OBJS) $(TARGET) + rm -f $(PWD)/platform-intrinsics.c \ No newline at end of file diff --git a/hyperdbg/linux/mock/user/mock.c b/hyperdbg/linux/mock/user/mock.c index 9e3acac9..fea47233 100644 --- a/hyperdbg/linux/mock/user/mock.c +++ b/hyperdbg/linux/mock/user/mock.c @@ -15,5 +15,15 @@ int main(void) { printf("Hello world HyperDbg!\n"); + + ////////////////////////////////////////////////////////////// + // + // Test for working intrinsics + // + CpuReadTsc(); + CpuCpuId(NULL, 0); + + ////////////////////////////////////////////////////////////// + return 0; } diff --git a/hyperdbg/linux/mock/user/pch.h b/hyperdbg/linux/mock/user/pch.h index c35600c1..6bc2c282 100644 --- a/hyperdbg/linux/mock/user/pch.h +++ b/hyperdbg/linux/mock/user/pch.h @@ -12,6 +12,12 @@ #ifndef PCH_H #define PCH_H +// +// Scope definitions +// +#define HYPERDBG_USER_MODE +#define HYPERDBG_LINUX + #include #include #include @@ -23,4 +29,9 @@ // #include "../../../include/SDK/HyperDbgSdk.h" +// +// Platform headers +// +#include "../../../include/platform/user/header/platform-intrinsics.h" + #endif // PCH_H diff --git a/hyperdbg/script-eval/code/PseudoRegisters.c b/hyperdbg/script-eval/code/PseudoRegisters.c index aeaf9a46..a3a46178 100644 --- a/hyperdbg/script-eval/code/PseudoRegisters.c +++ b/hyperdbg/script-eval/code/PseudoRegisters.c @@ -29,7 +29,7 @@ ScriptEnginePseudoRegGetTid() #endif // SCRIPT_ENGINE_USER_MODE #ifdef SCRIPT_ENGINE_KERNEL_MODE - return (UINT64)PsGetCurrentThreadId(); + return (UINT64)PlatformProcessGetCurrentThreadId(); #endif // SCRIPT_ENGINE_KERNEL_MODE } @@ -46,7 +46,7 @@ ScriptEnginePseudoRegGetCore() #endif // SCRIPT_ENGINE_USER_MODE #ifdef SCRIPT_ENGINE_KERNEL_MODE - return (UINT64)KeGetCurrentProcessorNumberEx(NULL); + return (UINT64)PlatformCpuGetCurrentProcessorNumber(); #endif // SCRIPT_ENGINE_KERNEL_MODE } @@ -63,7 +63,7 @@ ScriptEnginePseudoRegGetPid() #endif // SCRIPT_ENGINE_USER_MODE #ifdef SCRIPT_ENGINE_KERNEL_MODE - return (UINT64)PsGetCurrentProcessId(); + return (UINT64)PlatformProcessGetCurrentProcessId(); #endif // SCRIPT_ENGINE_KERNEL_MODE } @@ -112,7 +112,7 @@ ScriptEnginePseudoRegGetPname() #endif // SCRIPT_ENGINE_USER_MODE #ifdef SCRIPT_ENGINE_KERNEL_MODE - return CommonGetProcessNameFromProcessControlBlock(PsGetCurrentProcess()); + return CommonGetProcessNameFromProcessControlBlock(PlatformProcessGetCurrentProcess()); #endif // SCRIPT_ENGINE_KERNEL_MODE } @@ -129,7 +129,7 @@ ScriptEnginePseudoRegGetProc() #endif // SCRIPT_ENGINE_USER_MODE #ifdef SCRIPT_ENGINE_KERNEL_MODE - return (UINT64)PsGetCurrentProcess(); + return (UINT64)PlatformProcessGetCurrentProcess(); #endif // SCRIPT_ENGINE_KERNEL_MODE } @@ -146,7 +146,7 @@ ScriptEnginePseudoRegGetThread() #endif // SCRIPT_ENGINE_USER_MODE #ifdef SCRIPT_ENGINE_KERNEL_MODE - return (UINT64)PsGetCurrentThread(); + return (UINT64)PlatformProcessGetCurrentThread(); #endif // SCRIPT_ENGINE_KERNEL_MODE } @@ -293,7 +293,7 @@ ScriptEnginePseudoRegGetTeb() #endif // SCRIPT_ENGINE_USER_MODE #ifdef SCRIPT_ENGINE_KERNEL_MODE - return (UINT64)PsGetCurrentThreadTeb(); + return (UINT64)PlatformProcessGetCurrentThreadTeb(); #endif // SCRIPT_ENGINE_KERNEL_MODE }