Commit graph

169 commits

Author SHA1 Message Date
Nikzad
123e0dd790 fixed problem for user i/o instruction 2026-08-17 22:08:37 +03:30
Nikzad
2dfbf46e51 c/cpp files 2026-08-06 21:13:03 +03:30
Nikzad
128c9fac77 header files 2026-08-06 21:11:59 +03:30
sina
a24c8c0a91 cleanup for resync serial codes and update CHANGELOG.md
Some checks are pending
vs2026-ci / win-amd64-build (debug, x64) (push) Waiting to run
vs2026-ci / win-amd64-build (release, x64) (push) Waiting to run
vs2026-ci / Deploy release (push) Blocked by required conditions
2026-08-01 20:49:02 +02:00
munraimix
2cd78897c0 Resync serial stream on framing overflow instead of flooding the debuggee
When the debugger drops the serial link uncleanly mid-frame (no CLOSE_AND_UNLOAD packet), SerialConnectionRecvBuffer overflowed without an end-of-buffer marker and returned FALSE into the KD dispatch loop retry. The loop re-entered the same desynced stream, so it overflowed again at once and flooded 'buffer exceeds the buffer limitation' (and could wedge the KD driver on the next reconnect). Discard bytes to the next end-of-buffer marker to re-align, start a fresh frame, and log once per desync episode with LogWarning. Framing and protocol are unchanged.

Refs #661
2026-07-26 22:43:57 +10:00
sina
f4c77abb75 update and cleanup CPUID 2 plus fixing build error 2026-07-21 15:27:22 +02:00
sina
39c4b2f127 update and cleanup CPUID 2026-07-21 15:12:04 +02:00
Sina Karvandi
6324c1d718
Merge pull request #650 from nikzad66/feature-cpuid-command
Feature cpuid command
2026-07-21 14:28:37 +02:00
sina
d37352fd7e fix the error for referencing guest registers twice in both kd and vmx codes 2026-07-19 19:39:33 +02:00
Nikzad
38cbfd80b1 build: update project files and SDK version 2026-07-19 18:18:10 +03:30
Nikzad
0564b729c9 kernel: implement CPUID command handling in kernel mode- Add DebuggerCommandCpuid() for CPUID execution
- Implement IOCTL_DEBUGGER_CPUID handler
- Fill CPUID response with register values and leaf data
- Add max sub-leaf detection for some special leaves like 0x4, 0xB and...
- Add SGX support detection via leaf 7
2026-07-19 18:12:45 +03:30
Nikzad
b8a4417709 core: add CPUID command definitions and data structures- Add DEBUGGER_CPUID_REQUEST_RESPONSE structure
- Add ucpuid command to commands.h and help.h
- Add IOCTL definitions for CPUID
- Use macros for CPUID leaf decoding
- Update Connection.h with new packet types
2026-07-19 18:09:33 +03:30
munraimix
7436b35fd0 Fix DRIVER_IRQL_NOT_LESS_OR_EQUAL when reading registers on a manually-halted core
In Debugger Mode, breaking the debuggee and then reading registers (e.g. the
'r' command) could bugcheck the debuggee with DRIVER_IRQL_NOT_LESS_OR_EQUAL
(0xD1) at IRQL 0xff.

Root cause: DebuggerCommandReadRegisters() copies GUEST_REGS from
DbgState->Regs, but the per-core DbgState->Regs is only populated on the
event-triggered halt paths. A core halted via a manual break
(DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM) or via the NMI broadcast (KdHandleNmi)
never had DbgState->Regs set, so it was NULL and the GUEST_REGS memcpy
dereferenced address 0.

Fix:
- Add VmFuncGetGuestRegs(CoreId) returning g_GuestState[CoreId].Regs (the
  guest GP registers saved on the last vm-exit).
- Populate DbgState->Regs from it on the two manual-halt entry points
  (DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM and KdHandleNmi) so register reads on a
  manually-halted core return the correct values.
- Add a defensive NULL check in DebuggerCommandReadRegisters().
2026-07-19 16:53:34 +10:00
sina
5bccbff58b fix IPT kernel structure based on the new model
Some checks are pending
vs2026-ci / win-amd64-build (debug, x64) (push) Waiting to run
vs2026-ci / win-amd64-build (release, x64) (push) Waiting to run
vs2026-ci / Deploy release (push) Blocked by required conditions
2026-07-01 19:44:15 +02:00
jtaw5649
a0973894e8 fix: avoid pool list cursor use after free 2026-06-24 16:45:25 +01:00
sina
5a0fad4901 add WDK and SDK NuGet packages and Fix CI/CD
Some checks are pending
vs2026-ci / win-amd64-build (debug, x64) (push) Waiting to run
vs2026-ci / win-amd64-build (release, x64) (push) Waiting to run
vs2026-ci / Deploy release (push) Blocked by required conditions
2026-06-21 03:02:49 +02:00
Masoud Rahimi Jafari
dabf132d31 Fixed ioctl pt operation size bug 2026-06-14 16:29:26 +02:00
sina
df12e9fd79 Fix adding missing IOCTL for Intel PT 2026-06-10 23:56:36 +02:00
Sina Karvandi
b38b43eef9
Merge branch 'dev' into feat/intel-pt-integration 2026-06-10 23:14:26 +02:00
sina
5e5f277e21 fix race condition error in pool manager 2026-06-09 19:34:58 +02:00
sina
cd52174d82 fix and remove unused VMM callbacks 2026-06-09 15:04:20 +02:00
sina
bb3b09beb9 replace VMM callbacks 2026-06-09 01:37:48 +02:00
sina
aa09f9cde3 check to unload the trace module before unloading vmm 2026-06-06 23:45:18 +02:00
sina
0aedc66ed0 add load and unload hyper trace module 2026-06-06 17:18:14 +02:00
Sina Karvandi
67d8d461bd
Merge pull request #603 from HyperDbg/trace-module
Some checks failed
vs2022-ci / win-amd64-build (debug, x64) (push) Has been cancelled
vs2022-ci / win-amd64-build (release, x64) (push) Has been cancelled
vs2022-ci / Deploy release (push) Has been cancelled
Trace module
2026-06-06 00:34:16 +02:00
sina
5309211043 Fix pool manager corruption of linked lists 2026-06-06 00:33:21 +02:00
sina
f274e1aaa0 check for pool manager initialization 2026-06-05 20:12:30 +02:00
sina
2cd620b521 move IRP closing to basic IOCTLs 2026-06-05 18:29:00 +02:00
jtaw5649
986ef9f085 fix(debugger): unlink actions before free 2026-06-05 14:59:18 +01:00
Masoud Rahimi Jafari
2dc1a26f1c Added user app example for pt tracing 2026-06-04 01:55:42 +02:00
sina
adfe5f7d14 uninit VMM and KD separately 2026-06-04 00:55:05 +02:00
sina
b6b8320518 moving pool mananger from hyperhv to hyperkd 2026-06-04 00:06:41 +02:00
sina
0a874d31a9 create multiple IOCTL handlers for different modules 2026-06-02 14:04:47 +02:00
sina
ef2a482c45 refactor doxygen, variables, function names 6 2026-05-31 18:59:52 +02:00
sina
cb5a83096d load trace module 2026-05-28 20:26:33 +02:00
sina
0a279b5dba check IOCTL to load VMM module 2026-05-27 20:21:21 +02:00
sina
167931fc01 load the vmm module over IOCTL instead of CreateFile 2026-05-26 19:52:04 +02:00
sina
81f3d9f3d2 export HyperTrace LBR support and capacity function to the VMM and HyperEvade module
Some checks failed
vs2022-ci / win-amd64-build (debug, x64) (push) Has been cancelled
vs2022-ci / win-amd64-build (release, x64) (push) Has been cancelled
vs2022-ci / Deploy release (push) Has been cancelled
2026-05-26 16:41:23 +02:00
sina
5fb797c201 fix output buffer IOCTL checks for WRMSR 2026-05-17 20:18:36 +02:00
sina
1369aa777b refactor IOCTL codes 2026-05-17 17:07:59 +02:00
sina
90337d37f7 refactoring codes for platform independence of hyperlog and hypertrace and script-eval 2026-05-10 00:58:47 +02:00
sina
10dd66d416 add synchronization functions for DPC routines of Windows 2026-05-08 16:44:42 +02:00
sina
de0c56b466 create platform independent intrinsics functions 2026-05-05 21:25:20 +02:00
sina
09416e7fe1 add lbrdump command and sdk function 2026-05-04 00:29:54 +02:00
sina
aa80cd9d6b Apply all ARCH Based LBR controls on API level 2026-05-01 20:39:13 +02:00
sina
6f004f1ffd Add ARCH LBR functions from hypervisor 2026-05-01 18:40:39 +02:00
sina
c5ba5ccd89 compile HyperDbg SDK for Linux 2026-04-28 14:39:54 +02:00
sina
b35e0dd43c clearing the headers for Windows and Linux 2026-04-28 01:24:43 +02:00
sina
dc085fbe2a remove PlatformTypes and merge it to GeneralTypes 2026-04-27 23:55:04 +02:00
sina
af50093b9b apply LBR filters from VMX-root mode 2026-04-27 03:16:41 +02:00