mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-07-10 01:29:59 +00:00
95 lines
2.2 KiB
NASM
95 lines
2.2 KiB
NASM
PUBLIC AsmDebuggerCustomCodeHandler
|
|
PUBLIC AsmDebuggerConditionCodeHandler
|
|
PUBLIC AsmDebuggerSpinOnThread
|
|
|
|
.code _text
|
|
|
|
;------------------------------------------------------------------------
|
|
|
|
AsmDebuggerCustomCodeHandler PROC PUBLIC
|
|
|
|
; Generally, The registers RAX, RCX, RDX, R8, R9, R10, R11 are considered volatile (caller-saved)
|
|
; and registers RBX, RBP, RDI, RSI, RSP, R12, R13, R14, and R15 are considered nonvolatile (callee-saved).
|
|
|
|
|
|
SaveTheRegisters:
|
|
push RBX
|
|
push RBP
|
|
push RDI
|
|
push RSI
|
|
push R12
|
|
push R13
|
|
push R14
|
|
push R15
|
|
|
|
; The function will be called as DebuggerRunCustomCodeFunc(PVOID PreAllocatedBufferAddress, PGUEST_REGS Regs, PVOID Context);
|
|
call R9 ; Because R9 contains the 4th argument and a pointer to the function of target custom code
|
|
|
|
RestoreTheRegisters:
|
|
pop R15
|
|
pop R14
|
|
pop R13
|
|
pop R12
|
|
pop RSI
|
|
pop RDI
|
|
pop RBP
|
|
pop RBX
|
|
|
|
ret ; jump back to the trampoline
|
|
|
|
AsmDebuggerCustomCodeHandler ENDP
|
|
|
|
;------------------------------------------------------------------------
|
|
|
|
AsmDebuggerConditionCodeHandler PROC PUBLIC
|
|
|
|
; Generally, The registers RAX, RCX, RDX, R8, R9, R10, R11 are considered volatile (caller-saved)
|
|
; and registers RBX, RBP, RDI, RSI, RSP, R12, R13, R14, and R15 are considered nonvolatile (callee-saved).
|
|
|
|
SaveTheRegisters:
|
|
push RBX
|
|
push RBP
|
|
push RDI
|
|
push RSI
|
|
push R12
|
|
push R13
|
|
push R14
|
|
push R15
|
|
|
|
; The function will be called as DebuggerCheckForCondition(PGUEST_REGS Regs, PVOID Context);
|
|
call R8 ; Because R8 contains the 3th argument and a pointer to the function of target condition code
|
|
|
|
RestoreTheRegisters:
|
|
pop R15
|
|
pop R14
|
|
pop R13
|
|
pop R12
|
|
pop RSI
|
|
pop RDI
|
|
pop RBP
|
|
pop RBX
|
|
|
|
ret ; jump back to the trampoline
|
|
|
|
AsmDebuggerConditionCodeHandler ENDP
|
|
|
|
;------------------------------------------------------------------------
|
|
|
|
AsmDebuggerSpinOnThread PROC PUBLIC
|
|
|
|
; DO NOT CHANGE THE NOPS, THIS FUNCTION'S SIZE IS 7 BYTES (WITHOUT INT 3 AND RET)
|
|
NopLoop:
|
|
nop
|
|
nop
|
|
nop
|
|
nop
|
|
nop
|
|
jmp NopLoop
|
|
|
|
int 3 ; we should never reach here
|
|
|
|
ret
|
|
|
|
AsmDebuggerSpinOnThread ENDP
|
|
|
|
END
|