From e0af5afd4f23e5a196b9287c79a3d46e309fd8be Mon Sep 17 00:00:00 2001 From: sina Date: Sun, 31 May 2026 21:03:02 +0200 Subject: [PATCH] fix independently unloading the kd module --- .../SDK/imports/user/HyperDbgLibImports.h | 5 +++- hyperdbg/libhyperdbg/code/app/libhyperdbg.cpp | 29 +++++++++++++++---- .../commands/debugging-commands/exit.cpp | 8 +++++ .../commands/debugging-commands/unload.cpp | 14 +++++++-- hyperdbg/libhyperdbg/code/export/export.cpp | 19 +++++++++--- hyperdbg/libhyperdbg/header/libhyperdbg.h | 5 +++- 6 files changed, 66 insertions(+), 14 deletions(-) diff --git a/hyperdbg/include/SDK/imports/user/HyperDbgLibImports.h b/hyperdbg/include/SDK/imports/user/HyperDbgLibImports.h index ca498404..467a3bd7 100644 --- a/hyperdbg/include/SDK/imports/user/HyperDbgLibImports.h +++ b/hyperdbg/include/SDK/imports/user/HyperDbgLibImports.h @@ -42,6 +42,9 @@ hyperdbg_u_load_vmm(); IMPORT_EXPORT_LIBHYPERDBG INT hyperdbg_u_unload_vmm(); +IMPORT_EXPORT_LIBHYPERDBG INT +hyperdbg_u_unload_kd(); + IMPORT_EXPORT_LIBHYPERDBG INT hyperdbg_u_install_kd_driver(); @@ -49,7 +52,7 @@ IMPORT_EXPORT_LIBHYPERDBG INT hyperdbg_u_uninstall_kd_driver(); IMPORT_EXPORT_LIBHYPERDBG INT -hyperdbg_u_stop_vmm_driver(); +hyperdbg_u_stop_kd_driver(); IMPORT_EXPORT_LIBHYPERDBG GENERIC_PROCESSOR_VENDOR hyperdbg_u_get_processor_vendor(); diff --git a/hyperdbg/libhyperdbg/code/app/libhyperdbg.cpp b/hyperdbg/libhyperdbg/code/app/libhyperdbg.cpp index 82239fde..cb099b32 100644 --- a/hyperdbg/libhyperdbg/code/app/libhyperdbg.cpp +++ b/hyperdbg/libhyperdbg/code/app/libhyperdbg.cpp @@ -108,13 +108,12 @@ HyperDbgStopDriver(LPCTSTR DriverName) } /** - * @brief Stop VMM driver + * @brief Stop KD driver * - * @return INT return zero if it was successful or non-zero if there - * was error + * @return INT return zero if it was successful or non-zero if there was error */ INT -HyperDbgStopVmmDriver() +HyperDbgStopKdDriver() { return HyperDbgStopDriver(g_DriverName); } @@ -423,7 +422,25 @@ HyperDbgUnloadVmm() // g_IsVmxOffProcessStart = TRUE; - Sleep(1000); // Wait so next thread can return from IRP Pending + // + // Hypervisor (VMM) module is not loaded anymore + // + g_IsVmmModuleLoaded = FALSE; + + ShowMessages("you're not on HyperDbg's hypervisor anymore!\n"); + + return 0; +} + +/** + * @brief Unload KD driver + * + * @return INT return zero if it was successful or non-zero if there was error + */ +INT +HyperDbgUnloadKd() +{ + AssertShowMessageReturnStmt(g_DeviceHandle, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne); // // Send IRP_MJ_CLOSE to driver to terminate Vmxs @@ -450,7 +467,7 @@ HyperDbgUnloadVmm() // SymbolDeleteSymTable(); - ShowMessages("you're not on HyperDbg's hypervisor anymore!\n"); + ShowMessages("the debugger module is unloaded!\n"); return 0; } diff --git a/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/exit.cpp b/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/exit.cpp index 45f315e5..00c74c82 100644 --- a/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/exit.cpp +++ b/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/exit.cpp @@ -62,7 +62,15 @@ CommandExit(vector CommandTokens, string Command) // if (g_DeviceHandle) { + // + // Unload the VMM module first because it is using the driver and then unload the KD module + // HyperDbgUnloadVmm(); + + // + // Unload the KD module + // + HyperDbgUnloadKd(); } } else if (g_IsSerialConnectedToRemoteDebuggee) diff --git a/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/unload.cpp b/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/unload.cpp index 25b37947..255e91ce 100644 --- a/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/unload.cpp +++ b/hyperdbg/libhyperdbg/code/debugger/commands/debugging-commands/unload.cpp @@ -16,6 +16,7 @@ // extern BOOLEAN g_IsConnectedToHyperDbgLocally; extern BOOLEAN g_IsKdModuleLoaded; +extern BOOLEAN g_IsVmmModuleLoaded; extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee; extern BOOLEAN g_IsSerialConnectedToRemoteDebugger; @@ -81,7 +82,7 @@ CommandUnload(vector CommandTokens, string Command) return; } - if (g_IsKdModuleLoaded) + if (g_IsVmmModuleLoaded) { HyperDbgUnloadVmm(); } @@ -95,10 +96,19 @@ CommandUnload(vector CommandTokens, string Command) // if (CompareLowerCaseStrings(CommandTokens.at(1), "remove")) { + // + // Unload the KD module + // + if (HyperDbgUnloadKd()) + { + ShowMessages("err, failed to unload the kd (kernel debugger) driver\n"); + return; + } + // // Stop the driver // - if (HyperDbgStopVmmDriver()) + if (HyperDbgStopKdDriver()) { ShowMessages("err, failed to stop driver\n"); return; diff --git a/hyperdbg/libhyperdbg/code/export/export.cpp b/hyperdbg/libhyperdbg/code/export/export.cpp index 71cb064d..8328e978 100644 --- a/hyperdbg/libhyperdbg/code/export/export.cpp +++ b/hyperdbg/libhyperdbg/code/export/export.cpp @@ -53,7 +53,7 @@ hyperdbg_u_load_vmm() } /** - * @brief Unload the VMM + * @brief Unload the VMM module * * @return INT Returns 0 if it was successful and 1 if it was failed */ @@ -63,6 +63,17 @@ hyperdbg_u_unload_vmm() return HyperDbgUnloadVmm(); } +/** + * @brief Unload the KD module + * + * @return INT Returns 0 if it was successful and 1 if it was failed + */ +INT +hyperdbg_u_unload_kd() +{ + return HyperDbgUnloadKd(); +} + /** * @brief Install the KD driver * @@ -86,14 +97,14 @@ hyperdbg_u_uninstall_kd_driver() } /** - * @brief Stop the VMM driver + * @brief Stop the KD driver * * @return INT Returns 0 if it was successful and 1 if it was failed */ INT -hyperdbg_u_stop_vmm_driver() +hyperdbg_u_stop_kd_driver() { - return HyperDbgStopVmmDriver(); + return HyperDbgStopKdDriver(); } /** diff --git a/hyperdbg/libhyperdbg/header/libhyperdbg.h b/hyperdbg/libhyperdbg/header/libhyperdbg.h index 2a112eed..6d83b73c 100644 --- a/hyperdbg/libhyperdbg/header/libhyperdbg.h +++ b/hyperdbg/libhyperdbg/header/libhyperdbg.h @@ -21,6 +21,9 @@ HyperDbgInitHyperTraceModule(); INT HyperDbgUnloadVmm(); +INT +HyperDbgUnloadKd(); + INT HyperDbgInstallKdDriver(); @@ -37,7 +40,7 @@ INT HyperDbgLoadHyperTraceModule(); INT -HyperDbgStopVmmDriver(); +HyperDbgStopKdDriver(); INT HyperDbgInterpreter(CHAR * Command);