From e331ead8e9583f8b4fcd2cc5d4414b051bbad55e Mon Sep 17 00:00:00 2001 From: SinaKarvandi Date: Thu, 4 Feb 2021 08:37:49 -0800 Subject: [PATCH] perform script in print command --- hyperdbg/hprdbgctrl/debugger.cpp | 2 +- hyperdbg/hprdbgctrl/print.cpp | 1 + hyperdbg/hprdbghv/Debugger.c | 103 +++++++++++++++++--------- hyperdbg/hprdbghv/Debugger.h | 4 +- hyperdbg/hprdbghv/GlobalVariables.h | 6 ++ hyperdbg/hprdbghv/IdtEmulation.c | 7 +- hyperdbg/hprdbghv/Kd.c | 47 +++++++----- hyperdbg/hprdbghv/Kd.h | 5 +- hyperdbg/hprdbghv/Mtf.c | 3 +- hyperdbg/hprdbghv/Vmcall.c | 3 +- hyperdbg/include/Definition.h | 2 +- hyperdbg/include/ScriptEngineCommon.h | 8 +- 12 files changed, 127 insertions(+), 64 deletions(-) diff --git a/hyperdbg/hprdbgctrl/debugger.cpp b/hyperdbg/hprdbgctrl/debugger.cpp index fa279bd7..911ad2d3 100644 --- a/hyperdbg/hprdbgctrl/debugger.cpp +++ b/hyperdbg/hprdbgctrl/debugger.cpp @@ -130,7 +130,7 @@ ShowErrorMessage(UINT32 Error) { ShowMessages("err, unable to switch to new process (%x)\n", Error); break; - case DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPTRD: + case DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPT: ShowMessages("err, unable to run script on remote debuggee (%x)\n", Error); break; diff --git a/hyperdbg/hprdbgctrl/print.cpp b/hyperdbg/hprdbgctrl/print.cpp index b9072f9c..26f247d9 100644 --- a/hyperdbg/hprdbgctrl/print.cpp +++ b/hyperdbg/hprdbgctrl/print.cpp @@ -89,6 +89,7 @@ VOID CommandPrint(vector SplittedCommand, string Expr) { // // return to show that this item contains an script // + ShowMessages("err, syntax error\n"); return; } diff --git a/hyperdbg/hprdbghv/Debugger.c b/hyperdbg/hprdbghv/Debugger.c index a48e326f..0740fcc9 100644 --- a/hyperdbg/hprdbghv/Debugger.c +++ b/hyperdbg/hprdbghv/Debugger.c @@ -948,7 +948,7 @@ DebuggerPerformActions(PDEBUGGER_EVENT Event, PGUEST_REGS Regs, PVOID Context) DebuggerPerformBreakToDebugger(Event->Tag, CurrentAction, Regs, Context); break; case RUN_SCRIPT: - DebuggerPerformRunScript(Event->Tag, CurrentAction, Regs, Context); + DebuggerPerformRunScript(Event->Tag, CurrentAction, NULL, Regs, Context); break; case RUN_CUSTOM_CODE: DebuggerPerformRunTheCustomCode(Event->Tag, CurrentAction, Regs, Context); @@ -962,21 +962,6 @@ DebuggerPerformActions(PDEBUGGER_EVENT Event, PGUEST_REGS Regs, PVOID Context) } } -/** - * @brief Manage breaking to the debugger action - * - * @param Tag Tag of event - * @param Action Action object - * @param Regs Guest registers - * @param Context Optional parameter - * @return VOID - */ -VOID -DebuggerPerformBreakToDebugger(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS Regs, PVOID Context) -{ - DbgBreakPoint(); -} - /** * @brief Managing run script action * @@ -984,28 +969,59 @@ DebuggerPerformBreakToDebugger(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST * @param Action Action object * @param Regs Guest registers * @param Context Optional parameter - * @return VOID + * @return BOOLEAN */ -VOID -DebuggerPerformRunScript(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS Regs, PVOID Context) +BOOLEAN +DebuggerPerformRunScript(UINT64 Tag, + PDEBUGGER_EVENT_ACTION Action, + PDEBUGGEE_SCRIPT_PACKET ScriptDetails, + PGUEST_REGS Regs, + PVOID Context) { SYMBOL_BUFFER CodeBuffer = {0}; ACTION_BUFFER ActionBuffer = {0}; - // - // Fill the action buffer - // - ActionBuffer.Context = Context; - ActionBuffer.ImmediatelySendTheResults = Action->ImmediatelySendTheResults; - ActionBuffer.CurrentAction = Action; - ActionBuffer.Tag = Tag; + if (Action != NULL) + { + // + // Fill the action buffer + // + ActionBuffer.Context = Context; + ActionBuffer.ImmediatelySendTheResults = Action->ImmediatelySendTheResults; + ActionBuffer.CurrentAction = Action; + ActionBuffer.Tag = Tag; - // - // Context point to the registers - // - CodeBuffer.Head = Action->ScriptConfiguration.ScriptBuffer; - CodeBuffer.Size = Action->ScriptConfiguration.ScriptLength; - CodeBuffer.Pointer = Action->ScriptConfiguration.ScriptPointer; + // + // Context point to the registers + // + CodeBuffer.Head = Action->ScriptConfiguration.ScriptBuffer; + CodeBuffer.Size = Action->ScriptConfiguration.ScriptLength; + CodeBuffer.Pointer = Action->ScriptConfiguration.ScriptPointer; + } + else if (ScriptDetails != NULL) + { + // + // Fill the action buffer + // + ActionBuffer.Context = Context; + ActionBuffer.ImmediatelySendTheResults = TRUE; + ActionBuffer.CurrentAction = NULL; + ActionBuffer.Tag = Tag; + + // + // Context point to the registers + // + CodeBuffer.Head = ((CHAR *)ScriptDetails + sizeof(DEBUGGEE_SCRIPT_PACKET)); + CodeBuffer.Size = ScriptDetails->ScriptBufferSize; + CodeBuffer.Pointer = ScriptDetails->ScriptBufferPointer; + } + else + { + // + // The parameters are wrong ! + // + return FALSE; + } UINT64 g_TempList[MAX_TEMP_COUNT] = {0}; UINT64 g_VariableList[MAX_VAR_COUNT] = {0}; @@ -1014,6 +1030,8 @@ DebuggerPerformRunScript(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS { ScriptEngineExecute(Regs, ActionBuffer, (UINT64 *)g_TempList, (UINT64 *)g_VariableList, &CodeBuffer, &i); } + + return TRUE; } /** @@ -1042,9 +1060,9 @@ DebuggerPerformRunTheCustomCode(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUES // // LogInfo("%x Called from : %llx", Tag, Context); // - - LogInfo("Process Id : %x , Rax : %llx , R8 : %llx , Context : 0x%llx ", PsGetCurrentProcessId(), Regs->rax, Regs->r8, Context); - return; + // + // LogInfo("Process Id : %x , Rax : %llx , R8 : %llx , Context : 0x%llx ", PsGetCurrentProcessId(), Regs->rax, Regs->r8, Context); + // return; // // ----------------------------------------------------------------------------------------------------- // @@ -1068,6 +1086,21 @@ DebuggerPerformRunTheCustomCode(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUES } } +/** + * @brief Manage breaking to the debugger action + * + * @param Tag Tag of event + * @param Action Action object + * @param Regs Guest registers + * @param Context Optional parameter + * @return VOID + */ +VOID +DebuggerPerformBreakToDebugger(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS Regs, PVOID Context) +{ + DbgBreakPoint(); +} + /** * @brief Find event object by tag * diff --git a/hyperdbg/hprdbghv/Debugger.h b/hyperdbg/hprdbghv/Debugger.h index a543cc9f..01e82d62 100644 --- a/hyperdbg/hprdbghv/Debugger.h +++ b/hyperdbg/hprdbghv/Debugger.h @@ -196,8 +196,8 @@ DebuggerPerformActions(PDEBUGGER_EVENT Event, PGUEST_REGS Regs, PVOID Context); VOID DebuggerPerformBreakToDebugger(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS Regs, PVOID Context); -VOID -DebuggerPerformRunScript(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS Regs, PVOID Context); +BOOLEAN +DebuggerPerformRunScript(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PDEBUGGEE_SCRIPT_PACKET ScriptDetails, PGUEST_REGS Regs, PVOID Context); VOID DebuggerPerformRunTheCustomCode(UINT64 Tag, PDEBUGGER_EVENT_ACTION Action, PGUEST_REGS Regs, PVOID Context); diff --git a/hyperdbg/hprdbghv/GlobalVariables.h b/hyperdbg/hprdbghv/GlobalVariables.h index ed07413a..709f6042 100644 --- a/hyperdbg/hprdbghv/GlobalVariables.h +++ b/hyperdbg/hprdbghv/GlobalVariables.h @@ -129,6 +129,12 @@ VOID * g_ApicBase; */ DEBUGGEE_PAUSING_REASON g_DebuggeeHaltReason; +/** + * @brief Optional context as the debuggee is halted + * + */ +PVOID g_DebuggeeHaltContext; + /** * @brief Dpc state for debuggee * diff --git a/hyperdbg/hprdbghv/IdtEmulation.c b/hyperdbg/hprdbghv/IdtEmulation.c index 220b5033..fee83ace 100644 --- a/hyperdbg/hprdbghv/IdtEmulation.c +++ b/hyperdbg/hprdbghv/IdtEmulation.c @@ -115,7 +115,9 @@ IdtEmulationHandleExceptionAndNmi(VMEXIT_INTERRUPT_INFO InterruptExit, UINT32 Cu // KdHandleBreakpointAndDebugBreakpoints(CurrentProcessorIndex, GuestRegs, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT); + DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT, + g_GuestState[CurrentProcessorIndex].LastVmexitRip); + g_GuestState[CurrentProcessorIndex].IncrementRip = TRUE; } else @@ -194,7 +196,8 @@ IdtEmulationHandleExceptionAndNmi(VMEXIT_INTERRUPT_INFO InterruptExit, UINT32 Cu // KdHandleBreakpointAndDebugBreakpoints(CurrentProcessorIndex, GuestRegs, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_HARDWARE_DEBUG_REGISTER_HIT); + DEBUGGEE_PAUSING_REASON_DEBUGGEE_HARDWARE_DEBUG_REGISTER_HIT, + g_GuestState[CurrentProcessorIndex].LastVmexitRip); } else if (InterruptExit.Vector == EXCEPTION_VECTOR_DEBUG_BREAKPOINT) { diff --git a/hyperdbg/hprdbghv/Kd.c b/hyperdbg/hprdbghv/Kd.c index 18c6512d..4a1aed94 100644 --- a/hyperdbg/hprdbghv/Kd.c +++ b/hyperdbg/hprdbghv/Kd.c @@ -372,21 +372,6 @@ KdFireDpc(PVOID Routine, PVOID Paramter, UINT32 ProcessorNumber) KeInsertQueueDpc(&g_DebuggeeDpc, NULL, NULL); } -/** - * @brief Run the parsed script in debuggee - * @param ScriptDetails - * - * @return BOOLEAN - */ -BOOL Test = FALSE; -BOOLEAN -KdRunScript(PDEBUGGEE_SCRIPT_PACKET ScriptDetails) -{ - LogInfo("running script"); - Test = !Test; - return Test; -} - /** * @brief change the current process * @param PidRequest @@ -492,7 +477,10 @@ KdCloseConnectionAndUnloadDebuggee() * @return VOID */ VOID -KdHandleBreakpointAndDebugBreakpoints(UINT32 CurrentProcessorIndex, PGUEST_REGS GuestRegs, DEBUGGEE_PAUSING_REASON Reason) +KdHandleBreakpointAndDebugBreakpoints(UINT32 CurrentProcessorIndex, + PGUEST_REGS GuestRegs, + DEBUGGEE_PAUSING_REASON Reason, + PVOID Context) { // // Lock current core @@ -504,6 +492,11 @@ KdHandleBreakpointAndDebugBreakpoints(UINT32 CurrentProcessorIndex, PGUEST_REGS // g_DebuggeeHaltReason = Reason; + // + // Set the context + // + g_DebuggeeHaltContext = Context; + if (g_GuestState[CurrentProcessorIndex].DebuggingState.DoNotNmiNotifyOtherCoresByThisCore == FALSE) { // @@ -528,6 +521,11 @@ KdHandleBreakpointAndDebugBreakpoints(UINT32 CurrentProcessorIndex, PGUEST_REGS // Clear the halting reason // g_DebuggeeHaltReason = DEBUGGEE_PAUSING_REASON_NOT_PAUSED; + + // + // Clear the context + // + g_DebuggeeHaltContext = NULL; } /** @@ -558,7 +556,7 @@ KdChangeCr3AndTriggerBreakpointHandler(UINT32 CurrentProcessorI // // Trigger the breakpoint // - KdHandleBreakpointAndDebugBreakpoints(CurrentProcessorIndex, GuestRegs, Reason); + KdHandleBreakpointAndDebugBreakpoints(CurrentProcessorIndex, GuestRegs, Reason, NULL); // // Restore the original process @@ -809,13 +807,24 @@ KdDispatchAndPerformCommandsFromDebugger(ULONG CurrentCore, PGUEST_REGS GuestReg // // Run the script in debuggee // - if (KdRunScript(ScriptPacket)) + + if (DebuggerPerformRunScript(OPERATION_LOG_INFO_MESSAGE /* simple print */, + NULL, + ScriptPacket, + GuestRegs, + g_DebuggeeHaltContext)) { + // + // Set status + // ScriptPacket->Result = DEBUGEER_OPERATION_WAS_SUCCESSFULL; } else { - ScriptPacket->Result = DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPTRD; + // + // Set status + // + ScriptPacket->Result = DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPT; } // diff --git a/hyperdbg/hprdbghv/Kd.h b/hyperdbg/hprdbghv/Kd.h index 448cbadf..28fe5166 100644 --- a/hyperdbg/hprdbghv/Kd.h +++ b/hyperdbg/hprdbghv/Kd.h @@ -31,7 +31,10 @@ VOID KdUninitializeKernelDebugger(); VOID -KdHandleBreakpointAndDebugBreakpoints(UINT32 CurrentProcessorIndex, PGUEST_REGS GuestRegs, DEBUGGEE_PAUSING_REASON Reason); +KdHandleBreakpointAndDebugBreakpoints(UINT32 CurrentProcessorIndex, + PGUEST_REGS GuestRegs, + DEBUGGEE_PAUSING_REASON Reason, + PVOID Context); VOID KdChangeCr3AndTriggerBreakpointHandler(UINT32 CurrentProcessorIndex, diff --git a/hyperdbg/hprdbghv/Mtf.c b/hyperdbg/hprdbghv/Mtf.c index 5bac958f..3c166737 100644 --- a/hyperdbg/hprdbghv/Mtf.c +++ b/hyperdbg/hprdbghv/Mtf.c @@ -53,7 +53,8 @@ MtfHandleVmexit(ULONG CurrentProcessorIndex, PGUEST_REGS GuestRegs) // KdHandleBreakpointAndDebugBreakpoints(CurrentProcessorIndex, GuestRegs, - DEBUGGEE_PAUSING_REASON_DEBUGGEE_STEPPED); + DEBUGGEE_PAUSING_REASON_DEBUGGEE_STEPPED, + g_GuestState[CurrentProcessorIndex].LastVmexitRip); } else if (g_GuestState[CurrentProcessorIndex].MtfTest) { diff --git a/hyperdbg/hprdbghv/Vmcall.c b/hyperdbg/hprdbghv/Vmcall.c index 2f20a1c8..fb4317e1 100644 --- a/hyperdbg/hprdbghv/Vmcall.c +++ b/hyperdbg/hprdbghv/Vmcall.c @@ -355,7 +355,8 @@ VmxVmcallHandler(UINT64 VmcallNumber, { KdHandleBreakpointAndDebugBreakpoints(CurrentCoreIndex, GuestRegs, - DEBUGGEE_PAUSING_REASON_REQUEST_FROM_DEBUGGER); + DEBUGGEE_PAUSING_REASON_REQUEST_FROM_DEBUGGER, + NULL); VmcallStatus = STATUS_SUCCESS; break; } diff --git a/hyperdbg/include/Definition.h b/hyperdbg/include/Definition.h index dac9a3bc..f7fe6b6b 100644 --- a/hyperdbg/include/Definition.h +++ b/hyperdbg/include/Definition.h @@ -1211,7 +1211,7 @@ typedef struct _DEBUGGEE_SCRIPT_PACKET { * @brief error, unable to run script in remote debuggee * */ -#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPTRD 0xc0000016 +#define DEBUGGER_ERROR_PREPARING_DEBUGGEE_TO_RUN_SCRIPT 0xc0000016 // // WHEN YOU ADD ANYTHING TO THIS LIST OF ERRORS, THEN diff --git a/hyperdbg/include/ScriptEngineCommon.h b/hyperdbg/include/ScriptEngineCommon.h index 17024659..2e5bbe76 100644 --- a/hyperdbg/include/ScriptEngineCommon.h +++ b/hyperdbg/include/ScriptEngineCommon.h @@ -531,7 +531,13 @@ UINT64 GetPseudoRegValue(PSYMBOL Symbol, ACTION_BUFFER ActionBuffer) { case PSEUDO_REGISTER_IP: return ScriptEnginePseudoRegGetIp(); case PSEUDO_REGISTER_BUFFER: - return ScriptEnginePseudoRegGetBuffer((UINT64 *)ActionBuffer.CurrentAction); + if (ActionBuffer.CurrentAction != NULL) { + return ScriptEnginePseudoRegGetBuffer( + (UINT64 *)ActionBuffer.CurrentAction); + + } else { + return NULL; + } case PSEUDO_REGISTER_CONTEXT: return ActionBuffer.Context; case INVALID: