mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-08-14 11:05:01 +00:00
220 lines
4.3 KiB
C
220 lines
4.3 KiB
C
/**
|
|
* @file GlobalVariables.h
|
|
* @author Sina Karvandi (sina@hyperdbg.org)
|
|
* @brief Here we put global variables that are used more or less in all part of our hypervisor (not all of them)
|
|
* @details Note : All the global variables are not here, just those that
|
|
* will be used in all project. Special use global variables are located
|
|
* in their corresponding headers
|
|
*
|
|
* @version 0.1
|
|
* @date 2020-04-11
|
|
*
|
|
* @copyright This project is released under the GNU Public License v3.
|
|
*
|
|
*/
|
|
#pragma once
|
|
|
|
//////////////////////////////////////////////////
|
|
// Global Variables //
|
|
//////////////////////////////////////////////////
|
|
|
|
/**
|
|
* @brief Different attributes and compatibility checks
|
|
* of the current processor
|
|
*
|
|
*/
|
|
COMPATIBILITY_CHECKS_STATUS g_CompatibilityCheck;
|
|
|
|
/**
|
|
* @brief List of callbacks
|
|
*
|
|
*/
|
|
VMM_CALLBACKS g_Callbacks;
|
|
|
|
/**
|
|
* @brief Save the state and variables related to virtualization on each to logical core
|
|
*
|
|
*/
|
|
VIRTUAL_MACHINE_STATE * g_GuestState;
|
|
|
|
/**
|
|
* @brief Save the state of memory mapper
|
|
*
|
|
*/
|
|
MEMORY_MAPPER_ADDRESSES * g_MemoryMapper;
|
|
|
|
/**
|
|
* @brief Save the state and variables related to EPT
|
|
*
|
|
*/
|
|
EPT_STATE * g_EptState;
|
|
|
|
/**
|
|
* @brief List header of hidden hooks detour
|
|
*
|
|
*/
|
|
LIST_ENTRY g_EptHook2sDetourListHead;
|
|
|
|
/**
|
|
* @brief List header of hidden hooks detour
|
|
*
|
|
*/
|
|
BOOLEAN g_IsEptHook2sDetourListInitialized;
|
|
|
|
/**
|
|
* @brief Local APIC Base
|
|
*
|
|
*/
|
|
VOID * g_ApicBase;
|
|
|
|
/**
|
|
* @brief I/O APIC Base
|
|
*
|
|
*/
|
|
VOID * g_IoApicBase;
|
|
|
|
/**
|
|
* @brief check for broadcasting NMI mechanism support and its
|
|
* initialization
|
|
*
|
|
*/
|
|
BOOLEAN g_NmiBroadcastingInitialized;
|
|
|
|
/**
|
|
* @brief NMI handler pointer for KeDeregisterNmiCallback
|
|
*
|
|
*/
|
|
PVOID g_NmiHandlerForKeDeregisterNmiCallback;
|
|
|
|
/**
|
|
* @brief Shows whether the debuggee is waiting for an
|
|
* trap step or not
|
|
*
|
|
*/
|
|
BOOLEAN g_IsUnsafeSyscallOrSysretHandling;
|
|
|
|
/**
|
|
* @brief Bitmap of MSRs that cause #GP
|
|
*
|
|
*/
|
|
UINT64 * g_MsrBitmapInvalidMsrs;
|
|
|
|
/**
|
|
* @brief Enable interception of Cr3 for Mode-based Execution detection
|
|
*
|
|
*/
|
|
BOOLEAN g_ModeBasedExecutionControlState;
|
|
|
|
/**
|
|
* @brief State of syscall callback trap flags
|
|
*
|
|
*/
|
|
SYSCALL_CALLBACK_TRAP_FLAG_STATE * g_SyscallCallbackTrapFlagState;
|
|
|
|
/**
|
|
* @brief Shows whether the syscall callback is enabled or not
|
|
*
|
|
*/
|
|
BOOLEAN g_SyscallCallbackStatus;
|
|
|
|
/**
|
|
* @brief Target hook address for the system call handler
|
|
*
|
|
*/
|
|
PVOID g_SystemCallHookAddress;
|
|
|
|
/**
|
|
* @brief Shows whether the footprints (anti-debugging and
|
|
* anti-hypervisor) should be checked or not
|
|
*
|
|
*/
|
|
BOOLEAN g_CheckForFootprints;
|
|
|
|
//////////////////////////////////////////////////
|
|
// Global Variable (debugger-related) //
|
|
//////////////////////////////////////////////////
|
|
|
|
/**
|
|
* @brief Showes whether the vmcall handler is
|
|
* allowed to trigger an event or not
|
|
*
|
|
*/
|
|
BOOLEAN g_TriggerEventForVmcalls;
|
|
|
|
/**
|
|
* @brief Showes whether the cpuid handler is
|
|
* allowed to trigger an event or not
|
|
*
|
|
*/
|
|
BOOLEAN g_TriggerEventForCpuids;
|
|
|
|
BOOLEAN g_TriggerEventForXsetbvs;
|
|
|
|
//////////////////////////////////////////////////
|
|
// Global Variable (Execution Trap) //
|
|
//////////////////////////////////////////////////
|
|
|
|
/**
|
|
* @brief Showes whether the execution trap handler is
|
|
* allowed to trigger an event or not
|
|
*
|
|
*/
|
|
BOOLEAN g_ExecTrapInitialized;
|
|
|
|
/**
|
|
* @brief Showes whether the uninitialization of the exec trap is
|
|
* started or not
|
|
*
|
|
*/
|
|
BOOLEAN g_ExecTrapUnInitializationStarted;
|
|
|
|
/**
|
|
* @brief State of the trap-flag
|
|
*
|
|
*/
|
|
USER_KERNEL_EXECUTION_TRAP_STATE g_ExecTrapState;
|
|
|
|
/**
|
|
* @brief Test value for intercepting instructions
|
|
*
|
|
*/
|
|
BOOLEAN g_IsInterceptingInstructions;
|
|
|
|
//////////////////////////////////////////////////
|
|
// Global Variable (page-fault injection) //
|
|
//////////////////////////////////////////////////
|
|
|
|
/**
|
|
* @brief Shows whether the VMM is waiting to inject a page-fault
|
|
* or not
|
|
*
|
|
*/
|
|
BOOLEAN g_WaitingForInterruptWindowToInjectPageFault;
|
|
|
|
/**
|
|
* @brief The (from) address for page-fault injection
|
|
*
|
|
*/
|
|
UINT64 g_PageFaultInjectionAddressFrom;
|
|
|
|
/**
|
|
* @brief The (to) address for page-fault injection
|
|
*
|
|
*/
|
|
UINT64 g_PageFaultInjectionAddressTo;
|
|
|
|
/**
|
|
* @brief The error code for page-fault injection
|
|
*
|
|
*/
|
|
UINT32 g_PageFaultInjectionErrorCode;
|
|
|
|
/**
|
|
* @brief Whether VPID is supported or not
|
|
*/
|
|
BOOLEAN g_IsVpidSupported;
|
|
|
|
/**
|
|
* @brief Whether the top level hypervisor is Hyper-V or not
|
|
*/
|
|
BOOLEAN g_IsTopLevelHypervisorHyperV;
|