fix independently unloading the kd module

hyperdbg/include/SDK/imports/user/HyperDbgLibImports.h

@@ -42,6 +42,9 @@ hyperdbg_u_load_vmm();
 IMPORT_EXPORT_LIBHYPERDBG INT
 hyperdbg_u_unload_vmm();
 
+IMPORT_EXPORT_LIBHYPERDBG INT
+hyperdbg_u_unload_kd();
+
 IMPORT_EXPORT_LIBHYPERDBG INT
 hyperdbg_u_install_kd_driver();
 
@@ -49,7 +52,7 @@ IMPORT_EXPORT_LIBHYPERDBG INT
 hyperdbg_u_uninstall_kd_driver();
 
 IMPORT_EXPORT_LIBHYPERDBG INT
-hyperdbg_u_stop_vmm_driver();
+hyperdbg_u_stop_kd_driver();
 
 IMPORT_EXPORT_LIBHYPERDBG GENERIC_PROCESSOR_VENDOR
 hyperdbg_u_get_processor_vendor();

hyperdbg/libhyperdbg/code/app/libhyperdbg.cpp

@@ -108,13 +108,12 @@ HyperDbgStopDriver(LPCTSTR DriverName)
 }
 
 /**
- * @brief Stop VMM driver
+ * @brief Stop KD driver
  *
- * @return INT return zero if it was successful or non-zero if there
- * was error
+ * @return INT return zero if it was successful or non-zero if there was error
  */
 INT
-HyperDbgStopVmmDriver()
+HyperDbgStopKdDriver()
 {
     return HyperDbgStopDriver(g_DriverName);
 }
@@ -423,7 +422,25 @@ HyperDbgUnloadVmm()
     //
     g_IsVmxOffProcessStart = TRUE;
 
-    Sleep(1000); // Wait so next thread can return from IRP Pending
+    //
+    // Hypervisor (VMM) module is not loaded anymore
+    //
+    g_IsVmmModuleLoaded = FALSE;
+
+    ShowMessages("you're not on HyperDbg's hypervisor anymore!\n");
+
+    return 0;
+}
+
+/**
+ * @brief Unload KD driver
+ *
+ * @return INT return zero if it was successful or non-zero if there was error
+ */
+INT
+HyperDbgUnloadKd()
+{
+    AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
 
     //
     // Send IRP_MJ_CLOSE to driver to terminate Vmxs
@@ -450,7 +467,7 @@ HyperDbgUnloadVmm()
     //
     SymbolDeleteSymTable();
 
-    ShowMessages("you're not on HyperDbg's hypervisor anymore!\n");
+    ShowMessages("the debugger module is unloaded!\n");
 
     return 0;
 }

hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/exit.cpp

@@ -62,7 +62,15 @@ CommandExit(vector<CommandToken> CommandTokens, string Command)
         //
         if (g_DeviceHandle)
         {
+            //
+            // Unload the VMM module first because it is using the driver and then unload the KD module
+            //
             HyperDbgUnloadVmm();
+
+            //
+            // Unload the KD module
+            //
+            HyperDbgUnloadKd();
         }
     }
     else if (g_IsSerialConnectedToRemoteDebuggee)

hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/unload.cpp

@@ -16,6 +16,7 @@
 //
 extern BOOLEAN g_IsConnectedToHyperDbgLocally;
 extern BOOLEAN g_IsKdModuleLoaded;
+extern BOOLEAN g_IsVmmModuleLoaded;
 extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee;
 extern BOOLEAN g_IsSerialConnectedToRemoteDebugger;
 
@@ -81,7 +82,7 @@ CommandUnload(vector<CommandToken> CommandTokens, string Command)
             return;
         }
 
-        if (g_IsKdModuleLoaded)
+        if (g_IsVmmModuleLoaded)
         {
             HyperDbgUnloadVmm();
         }
@@ -95,10 +96,19 @@ CommandUnload(vector<CommandToken> CommandTokens, string Command)
         //
         if (CompareLowerCaseStrings(CommandTokens.at(1), "remove"))
         {
+            //
+            // Unload the KD module
+            //
+            if (HyperDbgUnloadKd())
+            {
+                ShowMessages("err, failed to unload the kd (kernel debugger) driver\n");
+                return;
+            }
+
             //
             // Stop the driver
             //
-            if (HyperDbgStopVmmDriver())
+            if (HyperDbgStopKdDriver())
             {
                 ShowMessages("err, failed to stop driver\n");
                 return;

hyperdbg/libhyperdbg/code/export/export.cpp

@@ -53,7 +53,7 @@ hyperdbg_u_load_vmm()
 }
 
 /**
- * @brief Unload the VMM
+ * @brief Unload the VMM module
  *
  * @return INT Returns 0 if it was successful and 1 if it was failed
  */
@@ -63,6 +63,17 @@ hyperdbg_u_unload_vmm()
     return HyperDbgUnloadVmm();
 }
 
+/**
+ * @brief Unload the KD module
+ *
+ * @return INT Returns 0 if it was successful and 1 if it was failed
+ */
+INT
+hyperdbg_u_unload_kd()
+{
+    return HyperDbgUnloadKd();
+}
+
 /**
  * @brief Install the KD driver
  *
@@ -86,14 +97,14 @@ hyperdbg_u_uninstall_kd_driver()
 }
 
 /**
- * @brief Stop the VMM driver
+ * @brief Stop the KD driver
  *
  * @return INT Returns 0 if it was successful and 1 if it was failed
  */
 INT
-hyperdbg_u_stop_vmm_driver()
+hyperdbg_u_stop_kd_driver()
 {
-    return HyperDbgStopVmmDriver();
+    return HyperDbgStopKdDriver();
 }
 
 /**

hyperdbg/libhyperdbg/header/libhyperdbg.h

@@ -21,6 +21,9 @@ HyperDbgInitHyperTraceModule();
 INT
 HyperDbgUnloadVmm();
 
+INT
+HyperDbgUnloadKd();
+
 INT
 HyperDbgInstallKdDriver();
 
@@ -37,7 +40,7 @@ INT
 HyperDbgLoadHyperTraceModule();
 
 INT
-HyperDbgStopVmmDriver();
+HyperDbgStopKdDriver();
 
 INT
 HyperDbgInterpreter(CHAR * Command);