vrr/HyperDbg
2
0
Fork 0
mirror of https://github.com/HyperDbg/HyperDbg.git synced 2026-07-09 17:19:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
HyperDbg/hyperdbg/include/SDK/headers/RequestStructures.h
sina 5bccbff58b
Some checks are pending
vs2026-ci / win-amd64-build (debug, x64) (push) Waiting to run
Details
vs2026-ci / win-amd64-build (release, x64) (push) Waiting to run
Details
vs2026-ci / Deploy release (push) Blocked by required conditions
Details
fix IPT kernel structure based on the new model
2026-07-01 19:44:15 +02:00

1732 lines
51 KiB
C
Raw Blame History

/**
* @file RequestStructures.h
* @author Sina Karvandi (sina@hyperdbg.org)
* @author jtaw5649
* @brief HyperDbg's SDK Headers Request Packets
* @details This file contains definitions of request packets (enums, structs)
* @version 0.2
* @date 2022-06-28
*
* @copyright This project is released under the GNU Public License v3.
*
*/
#pragma once
#include "Pcie.h"
#define SIZEOF_DEBUGGER_INIT_VMM_PACKET \
sizeof(DEBUGGER_INIT_VMM_PACKET)
/**
* @brief request for initializing VMM
*
*/
typedef struct _DEBUGGER_INIT_VMM_PACKET
{
UINT32 KernelStatus;
} DEBUGGER_INIT_VMM_PACKET, *PDEBUGGER_INIT_VMM_PACKET;
// ==============================================================================================
#define SIZEOF_DEBUGGER_INIT_HYPERTRACE_PACKET \
sizeof(DEBUGGER_INIT_HYPERTRACE_PACKET)
/**
* @brief request for initializing HyperTrace
*
*/
typedef struct _DEBUGGER_INIT_HYPERTRACE_PACKET
{
UINT32 KernelStatus;
} DEBUGGER_INIT_HYPERTRACE_PACKET, *PDEBUGGER_INIT_HYPERTRACE_PACKET;
// ==============================================================================================
#define SIZEOF_DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS \
sizeof(DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS)
/**
* @brief request for !pte command
*
*/
typedef struct _DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS
{
UINT64 VirtualAddress;
UINT32 ProcessId;
UINT64 Pml4eVirtualAddress;
UINT64 Pml4eValue;
UINT64 PdpteVirtualAddress;
UINT64 PdpteValue;
UINT64 PdeVirtualAddress;
UINT64 PdeValue;
UINT64 PteVirtualAddress;
UINT64 PteValue;
UINT32 KernelStatus;
} DEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS,
*PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS;
// ==============================================================================================
#define SIZEOF_DEBUGGER_VA2PA_AND_PA2VA_COMMANDS \
sizeof(DEBUGGER_VA2PA_AND_PA2VA_COMMANDS)
/**
* @brief requests for !va2pa and !pa2va commands
*
*/
typedef struct _DEBUGGER_VA2PA_AND_PA2VA_COMMANDS
{
UINT64 VirtualAddress;
UINT64 PhysicalAddress;
UINT32 ProcessId;
BOOLEAN IsVirtual2Physical;
UINT32 KernelStatus;
} DEBUGGER_VA2PA_AND_PA2VA_COMMANDS, *PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS;
// ==============================================================================================
#define SIZEOF_DEBUGGER_PAGE_IN_REQUEST \
sizeof(DEBUGGER_PAGE_IN_REQUEST)
/**
* @brief requests for the '.pagein' command
*
*/
typedef struct _DEBUGGER_PAGE_IN_REQUEST
{
UINT64 VirtualAddressFrom;
UINT64 VirtualAddressTo;
UINT32 ProcessId;
UINT32 PageFaultErrorCode;
UINT32 KernelStatus;
} DEBUGGER_PAGE_IN_REQUEST, *PDEBUGGER_PAGE_IN_REQUEST;
// ==============================================================================================
/**
* @brief different modes of reconstruct requests
*
*/
typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE
{
REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_UNKNOWN = 0,
REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_USER_MODE,
REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE_KERNEL_MODE,
} REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE;
/**
* @brief different types of reconstruct requests
*
*/
typedef enum _REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE
{
REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_UNKNOWN = 0,
REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_RECONSTRUCT,
REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE_PATTERN,
} REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE;
#define SIZEOF_REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST \
sizeof(REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST)
/**
* @brief requests for !rev command
*
*/
typedef struct _REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST
{
UINT32 ProcessId;
UINT32 Size;
REVERSING_MACHINE_RECONSTRUCT_MEMORY_MODE Mode;
REVERSING_MACHINE_RECONSTRUCT_MEMORY_TYPE Type;
UINT32 KernelStatus;
} REVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST, *PREVERSING_MACHINE_RECONSTRUCT_MEMORY_REQUEST;
// ==============================================================================================
#define SIZEOF_DEBUGGER_DT_COMMAND_OPTIONS \
sizeof(DEBUGGER_DT_COMMAND_OPTIONS)
/**
* @brief requests options for dt and struct command
*
*/
typedef struct _DEBUGGER_DT_COMMAND_OPTIONS
{
const CHAR * TypeName;
UINT64 SizeOfTypeName;
UINT64 Address;
BOOLEAN IsStruct;
PVOID BufferAddress;
UINT32 TargetPid;
const CHAR * AdditionalParameters;
} DEBUGGER_DT_COMMAND_OPTIONS, *PDEBUGGER_DT_COMMAND_OPTIONS;
// ==============================================================================================
/**
* @brief different types of prealloc requests
*
*/
typedef enum _DEBUGGER_PREALLOC_COMMAND_TYPE
{
DEBUGGER_PREALLOC_COMMAND_TYPE_THREAD_INTERCEPTION,
DEBUGGER_PREALLOC_COMMAND_TYPE_MONITOR,
DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK,
DEBUGGER_PREALLOC_COMMAND_TYPE_EPTHOOK2,
DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_EVENT,
DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_EVENT,
DEBUGGER_PREALLOC_COMMAND_TYPE_REGULAR_SAFE_BUFFER,
DEBUGGER_PREALLOC_COMMAND_TYPE_BIG_SAFE_BUFFER,
} DEBUGGER_PREALLOC_COMMAND_TYPE;
#define SIZEOF_DEBUGGER_PREALLOC_COMMAND \
sizeof(DEBUGGER_PREALLOC_COMMAND)
/**
* @brief requests for the 'prealloc' command
*
*/
typedef struct _DEBUGGER_PREALLOC_COMMAND
{
DEBUGGER_PREALLOC_COMMAND_TYPE Type;
UINT32 Count;
UINT32 KernelStatus;
} DEBUGGER_PREALLOC_COMMAND, *PDEBUGGER_PREALLOC_COMMAND;
// ==============================================================================================
/**
* @brief different types of preactivate requests
*
*/
typedef enum _DEBUGGER_PREACTIVATE_COMMAND_TYPE
{
DEBUGGER_PREACTIVATE_COMMAND_TYPE_MODE,
} DEBUGGER_PREACTIVATE_COMMAND_TYPE;
#define SIZEOF_DEBUGGER_PREACTIVATE_COMMAND \
sizeof(DEBUGGER_PREACTIVATE_COMMAND)
/**
* @brief requests for the 'preactivate' command
*
*/
typedef struct _DEBUGGER_PREACTIVATE_COMMAND
{
DEBUGGER_PREACTIVATE_COMMAND_TYPE Type;
UINT32 KernelStatus;
} DEBUGGER_PREACTIVATE_COMMAND, *PDEBUGGER_PREACTIVATE_COMMAND;
// ==============================================================================================
#define SIZEOF_DEBUGGER_READ_MEMORY sizeof(DEBUGGER_READ_MEMORY)
/**
* @brief different types of reading memory
*
*/
typedef enum _DEBUGGER_READ_READING_TYPE
{
READ_FROM_KERNEL,
READ_FROM_VMX_ROOT
} DEBUGGER_READ_READING_TYPE;
/**
* @brief different type of addresses
*
*/
typedef enum _DEBUGGER_READ_MEMORY_TYPE
{
DEBUGGER_READ_PHYSICAL_ADDRESS,
DEBUGGER_READ_VIRTUAL_ADDRESS
} DEBUGGER_READ_MEMORY_TYPE;
/**
* @brief different address mode
*
*/
typedef enum _DEBUGGER_READ_MEMORY_ADDRESS_MODE
{
DEBUGGER_READ_ADDRESS_MODE_32_BIT,
DEBUGGER_READ_ADDRESS_MODE_64_BIT
} DEBUGGER_READ_MEMORY_ADDRESS_MODE;
/**
* @brief the way that debugger should show
* the details of memory or disassemble them
*
*/
typedef enum _DEBUGGER_SHOW_MEMORY_STYLE
{
DEBUGGER_SHOW_COMMAND_DT = 1,
DEBUGGER_SHOW_COMMAND_DISASSEMBLE64,
DEBUGGER_SHOW_COMMAND_DISASSEMBLE32,
DEBUGGER_SHOW_COMMAND_DB,
DEBUGGER_SHOW_COMMAND_DC,
DEBUGGER_SHOW_COMMAND_DQ,
DEBUGGER_SHOW_COMMAND_DD,
DEBUGGER_SHOW_COMMAND_DUMP
} DEBUGGER_SHOW_MEMORY_STYLE;
/**
* @brief request for reading virtual and physical memory
*
*/
typedef struct _DEBUGGER_READ_MEMORY
{
UINT32 Pid; // Read from cr3 of what process
UINT64 Address;
UINT32 Size;
BOOLEAN GetAddressMode; // Debugger sets whether the read memory is for diassembler or not
DEBUGGER_READ_MEMORY_ADDRESS_MODE AddressMode; // Debuggee sets the mode of address
DEBUGGER_READ_MEMORY_TYPE MemoryType;
DEBUGGER_READ_READING_TYPE ReadingType;
UINT32 ReturnLength; // not used in local debugging
UINT32 KernelStatus; // not used in local debugging
//
// Here is the target buffer (actual memory)
//
} DEBUGGER_READ_MEMORY, *PDEBUGGER_READ_MEMORY;
// ==============================================================================================
#define SIZEOF_DEBUGGER_FLUSH_LOGGING_BUFFERS \
sizeof(DEBUGGER_FLUSH_LOGGING_BUFFERS)
/**
* @brief request for flushing buffers
*
*/
typedef struct _DEBUGGER_FLUSH_LOGGING_BUFFERS
{
UINT32 KernelStatus;
UINT32 CountOfMessagesThatSetAsReadFromVmxRoot;
UINT32 CountOfMessagesThatSetAsReadFromVmxNonRoot;
} DEBUGGER_FLUSH_LOGGING_BUFFERS, *PDEBUGGER_FLUSH_LOGGING_BUFFERS;
// ==============================================================================================
#define SIZEOF_DEBUGGER_TEST_QUERY_BUFFER \
sizeof(DEBUGGER_TEST_QUERY_BUFFER)
/**
* @brief test query used for test purposed
*
*/
typedef enum _DEBUGGER_TEST_QUERY_STATE
{
TEST_QUERY_HALTING_CORE_STATUS = 1, // Query constant to show detail of halting of core
TEST_QUERY_PREALLOCATED_POOL_STATE = 2, // Query pre-allocated pool state
TEST_QUERY_TRAP_STATE = 3, // Query trap state
TEST_BREAKPOINT_TURN_OFF_BPS = 4, // Turn off the breakpoints (#BP)
TEST_BREAKPOINT_TURN_ON_BPS = 5, // Turn on the breakpoints (#BP)
TEST_BREAKPOINT_TURN_OFF_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 6, // Turn off the breakpoints and events for executing the commands in the remote computer
TEST_BREAKPOINT_TURN_ON_BPS_AND_EVENTS_FOR_COMMANDS_IN_REMOTE_COMPUTER = 7, // Turn on the breakpoints and events for executing the commands in the remote computer
TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_SYNCHRONOUS = 8, // For testing synchronized event
TEST_SETTING_TARGET_TASKS_ON_HALTED_CORES_ASYNCHRONOUS = 9, // For testing unsynchronized event
TEST_SETTING_TARGET_TASKS_ON_TARGET_HALTED_CORES = 10, // Send the task to the halted core
TEST_BREAKPOINT_TURN_OFF_DBS = 11, // Turn off the debug breaks (#DB)
TEST_BREAKPOINT_TURN_ON_DBS = 12, // Turn on the debug breaks (#DB)
} DEBUGGER_TEST_QUERY_STATE;
/**
* @brief request for test query buffers
*
*/
typedef struct _DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER
{
DEBUGGER_TEST_QUERY_STATE RequestType;
UINT64 Context;
UINT32 KernelStatus;
} DEBUGGER_DEBUGGER_TEST_QUERY_BUFFER, *PDEBUGGER_DEBUGGER_TEST_QUERY_BUFFER;
// ==============================================================================================
#define SIZEOF_DEBUGGER_PERFORM_KERNEL_TESTS \
sizeof(DEBUGGER_PERFORM_KERNEL_TESTS)
/**
* @brief request performing kernel tests
*
*/
typedef struct _DEBUGGER_PERFORM_KERNEL_TESTS
{
UINT32 KernelStatus;
} DEBUGGER_PERFORM_KERNEL_TESTS, *PDEBUGGER_PERFORM_KERNEL_TESTS;
// ==============================================================================================
#define SIZEOF_DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL \
sizeof(DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL)
/**
* @brief request for send a signal that command execution finished
*
*/
typedef struct _DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL
{
UINT32 KernelStatus;
} DEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL,
*PDEBUGGER_SEND_COMMAND_EXECUTION_FINISHED_SIGNAL;
// ==============================================================================================
#define SIZEOF_DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER \
sizeof(DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER)
/**
* @brief request for send general packets from debuggee to debugger
*
*/
typedef struct _DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER
{
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction;
UINT32 LengthOfBuffer;
BOOLEAN PauseDebuggeeWhenSent;
UINT32 KernelResult;
//
// The buffer for the general packet is here
//
} DEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER,
*PDEBUGGEE_SEND_GENERAL_PACKET_FROM_DEBUGGEE_TO_DEBUGGER;
// ==============================================================================================
#define SIZEOF_DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER \
sizeof(DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER)
/**
* @brief request for send a user-mode message to debugger
*
*/
typedef struct _DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER
{
UINT32 KernelStatus;
UINT32 Length;
//
// Here is the messages
//
} DEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER,
*PDEBUGGER_SEND_USERMODE_MESSAGES_TO_DEBUGGER;
// ==============================================================================================
#define SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR \
sizeof(DEBUGGER_READ_AND_WRITE_ON_MSR)
/**
* @brief different types of actions on MSRs
*
*/
typedef enum _DEBUGGER_MSR_ACTION_TYPE
{
DEBUGGER_MSR_READ,
DEBUGGER_MSR_WRITE
} DEBUGGER_MSR_ACTION_TYPE;
/**
* @brief request to read or write on MSRs
*
*/
typedef struct _DEBUGGER_READ_AND_WRITE_ON_MSR
{
UINT64 Msr; // It's actually a 32-Bit value but let's not mess with a register
UINT32 CoreNumber; // specifies the core to execute wrmsr or read the msr
// (DEBUGGER_READ_AND_WRITE_ON_MSR_APPLY_ALL_CORES mean all
// the cores)
DEBUGGER_MSR_ACTION_TYPE ActionType; // Detects whether user needs wrmsr or rdmsr
UINT64 Value;
} DEBUGGER_READ_AND_WRITE_ON_MSR, *PDEBUGGER_READ_AND_WRITE_ON_MSR;
#define SIZEOF_DEBUGGER_READ_AND_WRITE_ON_MSR \
sizeof(DEBUGGER_READ_AND_WRITE_ON_MSR)
// ==============================================================================================
#define SIZEOF_DEBUGGER_EDIT_MEMORY sizeof(DEBUGGER_EDIT_MEMORY)
/**
* @brief different type of addresses for editing memory
*
*/
typedef enum _DEBUGGER_EDIT_MEMORY_TYPE
{
EDIT_VIRTUAL_MEMORY,
EDIT_PHYSICAL_MEMORY
} DEBUGGER_EDIT_MEMORY_TYPE;
/**
* @brief size of editing memory
*
*/
typedef enum _DEBUGGER_EDIT_MEMORY_BYTE_SIZE
{
EDIT_BYTE,
EDIT_DWORD,
EDIT_QWORD
} DEBUGGER_EDIT_MEMORY_BYTE_SIZE;
/**
* @brief request for edit virtual and physical memory
*
*/
typedef struct _DEBUGGER_EDIT_MEMORY
{
UINT32 Result;
UINT64 Address; // Target address to modify
UINT32 ProcessId; // specifies the process id
DEBUGGER_EDIT_MEMORY_TYPE MemoryType; // Type of memory
DEBUGGER_EDIT_MEMORY_BYTE_SIZE ByteSize; // Modification size
UINT32 CountOf64Chunks;
UINT32 FinalStructureSize;
} DEBUGGER_EDIT_MEMORY, *PDEBUGGER_EDIT_MEMORY;
// ==============================================================================================
#define SIZEOF_DEBUGGER_SEARCH_MEMORY sizeof(DEBUGGER_SEARCH_MEMORY)
/**
* @brief different types of address for searching on memory
*
*/
typedef enum _DEBUGGER_SEARCH_MEMORY_TYPE
{
SEARCH_PHYSICAL_MEMORY,
SEARCH_VIRTUAL_MEMORY,
SEARCH_PHYSICAL_FROM_VIRTUAL_MEMORY,
} DEBUGGER_SEARCH_MEMORY_TYPE;
/**
* @brief different sizes on searching memory
*
*/
typedef enum _DEBUGGER_SEARCH_MEMORY_BYTE_SIZE
{
SEARCH_BYTE,
SEARCH_DWORD,
SEARCH_QWORD
} DEBUGGER_SEARCH_MEMORY_BYTE_SIZE;
/**
* @brief request for searching memory
*
*/
typedef struct _DEBUGGER_SEARCH_MEMORY
{
UINT64 Address; // Target address to start searching
UINT64 Length; // Length of bytes to search
UINT32 ProcessId; // specifies the process id
DEBUGGER_SEARCH_MEMORY_TYPE MemoryType; // Type of memory
DEBUGGER_SEARCH_MEMORY_BYTE_SIZE ByteSize; // Modification size
UINT32 CountOf64Chunks;
UINT32 FinalStructureSize;
} DEBUGGER_SEARCH_MEMORY, *PDEBUGGER_SEARCH_MEMORY;
// ==============================================================================================
/**
* @brief Windows System call values that are intercepted by transparency mode
*
* NOTE: Windows system calls can change values on each version
* This structure is used to keep track of the system call numbers
* based on the current running Windows version
*
*/
typedef struct _SYSTEM_CALL_NUMBERS_INFORMATION
{
UINT32 SysNtQuerySystemInformation;
UINT32 SysNtQuerySystemInformationEx; // On 24H2, changes on each windows version
UINT32 SysNtSystemDebugControl; // On 24H2, changes on each windows version
UINT32 SysNtQueryAttributesFile;
UINT32 SysNtOpenDirectoryObject;
UINT32 SysNtQueryDirectoryObject; // On 24H2, changes on each windows version
UINT32 SysNtQueryInformationProcess;
UINT32 SysNtSetInformationProcess;
UINT32 SysNtQueryInformationThread;
UINT32 SysNtSetInformationThread;
UINT32 SysNtOpenFile;
UINT32 SysNtOpenKey;
UINT32 SysNtOpenKeyEx; // On 24H2, changes on each windows version
UINT32 SysNtQueryValueKey;
UINT32 SysNtEnumerateKey;
} SYSTEM_CALL_NUMBERS_INFORMATION, *PSYSTEM_CALL_NUMBERS_INFORMATION;
#define SIZEOF_DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE \
sizeof(DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE)
/**
* @brief request for enable or disable transparent-mode
*
*/
typedef struct _DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE
{
BOOLEAN IsHide;
// UINT64 CpuidAverage;
// UINT64 CpuidStandardDeviation;
// UINT64 CpuidMedian;
// UINT64 RdtscAverage;
// UINT64 RdtscStandardDeviation;
// UINT64 RdtscMedian;
BOOLEAN TrueIfProcessIdAndFalseIfProcessName;
UINT32 ProcId;
UINT32 LengthOfProcessName;
SYSTEM_CALL_NUMBERS_INFORMATION SystemCallNumbersInformation; // System call numbers information
UINT32 KernelStatus; /* DEBUGGER_OPERATION_WAS_SUCCESSFUL ,
DEBUGGER_ERROR_UNABLE_TO_HIDE_OR_UNHIDE_DEBUGGER
*/
UINT32 EvadeMask; // zero means TRANSPARENT_EVADE_MASK_DEFAULT
} DEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE,
*PDEBUGGER_HIDE_AND_TRANSPARENT_DEBUGGER_MODE;
// ==============================================================================================
#define SIZEOF_DEBUGGER_PREPARE_DEBUGGEE sizeof(DEBUGGER_PREPARE_DEBUGGEE)
/**
* @brief request to make this computer to a debuggee
*
*/
typedef struct _DEBUGGER_PREPARE_DEBUGGEE
{
UINT32 PortAddress;
UINT32 Baudrate;
UINT64 KernelBaseAddress;
UINT32 Result; // Result from the kernel
CHAR OsName[MAXIMUM_CHARACTER_FOR_OS_NAME];
} DEBUGGER_PREPARE_DEBUGGEE, *PDEBUGGER_PREPARE_DEBUGGEE;
// ==============================================================================================
/**
* @brief The structure of changing core packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_CHANGE_CORE_PACKET
{
UINT32 NewCore;
UINT32 Result;
} DEBUGGEE_CHANGE_CORE_PACKET, *PDEBUGGEE_CHANGE_CORE_PACKET;
// ==============================================================================================
#define SIZEOF_DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS \
sizeof(DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS)
/**
* @brief different actions of switchings
*
*/
typedef enum _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE
{
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH,
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH,
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS,
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS,
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_CONTINUE_PROCESS,
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS,
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD,
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS,
} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE;
/**
* @brief request for attaching user-mode process
*
*/
typedef struct _DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS
{
BOOLEAN IsStartingNewProcess;
UINT32 ProcessId;
UINT32 ThreadId;
BOOLEAN CheckCallbackAtFirstInstruction;
BOOLEAN Is32Bit;
UINT64 Rip; // used in switching threads
BYTE InstructionBytesOnRip[MAXIMUM_INSTR_SIZE]; // used in switching threads
UINT32 SizeOfInstruction; // used in switching threads
BOOLEAN IsPaused; // used in switching to threads
DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_TYPE Action;
UINT32 CountOfActiveDebuggingThreadsAndProcesses; // used in showing the list of active threads/processes
UINT64 Token;
UINT64 Result;
} DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS,
*PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS;
// ==============================================================================================
#define SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS \
sizeof(DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS)
/**
* @brief different type of process or thread queries
*
*/
typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES
{
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_COUNT = 1,
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_COUNT = 2,
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_PROCESS_LIST = 3,
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_THREAD_LIST = 4,
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_PROCESS = 5,
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_QUERY_CURRENT_THREAD = 6,
} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES;
/**
* @brief different actions on showing or querying list of process or threads
*
*/
typedef enum _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS
{
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_SHOW_INSTANTLY = 1,
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_COUNT = 2,
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTION_QUERY_SAVE_DETAILS = 3,
} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS;
/**
* @brief The structure of needed information to get the details
* of the process from nt!_EPROCESS and location of needed variables
*
*/
typedef struct _DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS
{
UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead
ULONG ImageFileNameOffset; // nt!_EPROCESS.ImageFileName
ULONG UniquePidOffset; // nt!_EPROCESS.UniqueProcessId
ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks
} DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS, *PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS;
/**
* @brief The structure of needed information to get the details
* of the thread from nt!_ETHREAD and location of needed variables
*
*/
typedef struct _DEBUGGEE_THREAD_LIST_NEEDED_DETAILS
{
UINT32 ThreadListHeadOffset; // nt!_EPROCESS.ThreadListHead
UINT32 ThreadListEntryOffset; // nt!_ETHREAD.ThreadListEntry
UINT32 CidOffset; // nt!_ETHREAD.Cid
UINT64 PsActiveProcessHead; // nt!PsActiveProcessHead
ULONG ActiveProcessLinksOffset; // nt!_EPROCESS.ActiveProcessLinks
UINT64 Process;
} DEBUGGEE_THREAD_LIST_NEEDED_DETAILS, *PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS;
/**
* @brief The structure showing list of processes (details of each
* entry)
*
*/
typedef struct _DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY
{
UINT64 Eprocess;
UINT32 ProcessId;
UINT64 Cr3;
UCHAR ImageFileName[15 + 1];
} DEBUGGEE_PROCESS_LIST_DETAILS_ENTRY, *PDEBUGGEE_PROCESS_LIST_DETAILS_ENTRY;
/**
* @brief The structure showing list of threads (details of each
* entry)
*
*/
typedef struct _DEBUGGEE_THREAD_LIST_DETAILS_ENTRY
{
UINT64 Eprocess;
UINT64 Ethread;
UINT32 ProcessId;
UINT32 ThreadId;
UCHAR ImageFileName[15 + 1];
} DEBUGGEE_THREAD_LIST_DETAILS_ENTRY, *PDEBUGGEE_THREAD_LIST_DETAILS_ENTRY;
/**
* @brief request for query count of active processes and threads
*
*/
typedef struct _DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS
{
DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListNeededDetails;
DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListNeededDetails;
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_TYPES QueryType;
DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS_ACTIONS QueryAction;
UINT32 Count;
UINT64 Result;
} DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS,
*PDEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS;
#define SIZEOF_DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS \
sizeof(DEBUGGER_QUERY_ACTIVE_PROCESSES_OR_THREADS)
// ==============================================================================================
/**
* @brief The structure for saving the callstack frame of one parameter
*
*/
typedef struct _DEBUGGER_SINGLE_CALLSTACK_FRAME
{
BOOLEAN IsStackAddressValid;
BOOLEAN IsValidAddress;
BOOLEAN IsExecutable;
UINT64 Value;
BYTE InstructionBytesOnRip[MAXIMUM_CALL_INSTR_SIZE];
} DEBUGGER_SINGLE_CALLSTACK_FRAME, *PDEBUGGER_SINGLE_CALLSTACK_FRAME;
#define SIZEOF_DEBUGGER_CALLSTACK_REQUEST \
sizeof(DEBUGGER_CALLSTACK_REQUEST)
/**
* @brief callstack showing method
*
*/
typedef enum _DEBUGGER_CALLSTACK_DISPLAY_METHOD
{
DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITHOUT_PARAMS,
DEBUGGER_CALLSTACK_DISPLAY_METHOD_WITH_PARAMS,
} DEBUGGER_CALLSTACK_DISPLAY_METHOD;
/**
* @brief request for callstack frames
*
*/
typedef struct _DEBUGGER_CALLSTACK_REQUEST
{
BOOLEAN Is32Bit;
UINT32 KernelStatus;
DEBUGGER_CALLSTACK_DISPLAY_METHOD DisplayMethod;
UINT32 Size;
UINT32 FrameCount;
UINT64 BaseAddress;
UINT64 BufferSize;
//
// Here is the size of stack frames
//
} DEBUGGER_CALLSTACK_REQUEST, *PDEBUGGER_CALLSTACK_REQUEST;
// ==============================================================================================
#define SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS \
sizeof(USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS)
typedef struct _USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS
{
UINT32 ProcessId;
UINT32 ThreadId;
UINT64 NumberOfBlockedContextSwitches;
BOOLEAN IsProcess;
} USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS, *PUSERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS;
// ==============================================================================================
/**
* @brief Used for run the script
*
*/
typedef struct _DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION
{
UINT64 ScriptBuffer;
UINT32 ScriptLength;
UINT32 ScriptPointer;
UINT32 OptionalRequestedBufferSize;
} DEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION,
*PDEBUGGER_EVENT_ACTION_RUN_SCRIPT_CONFIGURATION;
/**
* @brief used in the case of requesting a "request buffer"
*
*/
typedef struct _DEBUGGER_EVENT_REQUEST_BUFFER
{
BOOLEAN EnabledRequestBuffer;
UINT32 RequestBufferSize;
UINT64 RequstBufferAddress;
} DEBUGGER_EVENT_REQUEST_BUFFER, *PDEBUGGER_EVENT_REQUEST_BUFFER;
/**
* @brief used in the case of custom code requests to the debugger
*
*/
typedef struct _DEBUGGER_EVENT_REQUEST_CUSTOM_CODE
{
UINT32 CustomCodeBufferSize;
PVOID CustomCodeBufferAddress;
UINT32 OptionalRequestedBufferSize;
} DEBUGGER_EVENT_REQUEST_CUSTOM_CODE, *PDEBUGGER_EVENT_REQUEST_CUSTOM_CODE;
// ==============================================================================================
/**
* @brief User-mode debugging actions
*
*/
typedef enum _DEBUGGER_UD_COMMAND_ACTION_TYPE
{
DEBUGGER_UD_COMMAND_ACTION_TYPE_NONE = 0,
DEBUGGER_UD_COMMAND_ACTION_TYPE_PAUSE,
DEBUGGER_UD_COMMAND_ACTION_TYPE_REGULAR_STEP,
DEBUGGER_UD_COMMAND_ACTION_TYPE_READ_REGISTERS,
DEBUGGER_UD_COMMAND_ACTION_TYPE_EXECUTE_SCRIPT_BUFFER,
} DEBUGGER_UD_COMMAND_ACTION_TYPE;
/**
* @brief Description of user-mode debugging actions
*
*/
typedef struct _DEBUGGER_UD_COMMAND_ACTION
{
DEBUGGER_UD_COMMAND_ACTION_TYPE ActionType;
UINT64 OptionalParam1;
UINT64 OptionalParam2;
UINT64 OptionalParam3;
UINT64 OptionalParam4;
} DEBUGGER_UD_COMMAND_ACTION, *PDEBUGGER_UD_COMMAND_ACTION;
/**
* @brief The structure of command packet in uHyperDbg
*
*/
typedef struct _DEBUGGER_UD_COMMAND_PACKET
{
DEBUGGER_UD_COMMAND_ACTION UdAction;
UINT64 ProcessDebuggingDetailToken;
UINT32 TargetThreadId;
BOOLEAN ApplyToAllPausedThreads;
BOOLEAN WaitForEventCompletion;
UINT32 Result;
} DEBUGGER_UD_COMMAND_PACKET, *PDEBUGGER_UD_COMMAND_PACKET;
#define SIZEOF_DEBUGGER_UD_COMMAND_PACKET sizeof(DEBUGGER_UD_COMMAND_PACKET)
// ==============================================================================================
/**
* @brief Debugger process switch and process details
*
*/
typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE
{
DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_DETAILS,
DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_GET_PROCESS_LIST,
DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PERFORM_SWITCH,
} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE;
/**
* @brief The structure of changing process and show process
* packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET
{
DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE ActionType;
UINT32 ProcessId;
UINT64 Process;
BOOLEAN IsSwitchByClkIntr;
UCHAR ProcessName[16];
DEBUGGEE_PROCESS_LIST_NEEDED_DETAILS ProcessListSymDetails;
UINT32 Result;
} DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET;
// ==============================================================================================
/**
* @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET
*
*/
#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET \
sizeof(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_PACKET)
/**
* @brief Debugger thread switch and thread details
*
*/
typedef enum _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE
{
DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PERFORM_SWITCH,
DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_DETAILS,
DEBUGGEE_DETAILS_AND_SWITCH_THREAD_GET_THREAD_LIST,
} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE;
/**
* @brief The structure of changing thead and show thread
* packet in HyperDbg
*/
typedef struct _DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET
{
DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE ActionType;
UINT32 ThreadId;
UINT32 ProcessId;
UINT64 Thread;
UINT64 Process;
BOOLEAN CheckByClockInterrupt;
UCHAR ProcessName[16];
DEBUGGEE_THREAD_LIST_NEEDED_DETAILS ThreadListSymDetails;
UINT32 Result;
} DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET, *PDEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET;
/**
* @brief Debugger size of DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET
*
*/
#define SIZEOF_DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET \
sizeof(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_PACKET)
// ==============================================================================================
/**
* @brief stepping and tracking types
*
*/
typedef enum _DEBUGGER_REMOTE_STEPPING_REQUEST
{
DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_IN,
DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN,
DEBUGGER_REMOTE_STEPPING_REQUEST_INSTRUMENTATION_STEP_IN_FOR_TRACKING,
DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER,
DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU,
DEBUGGER_REMOTE_STEPPING_REQUEST_STEP_OVER_FOR_GU_LAST_INSTRUCTION,
} DEBUGGER_REMOTE_STEPPING_REQUEST;
/**
* @brief The structure of stepping packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_STEP_PACKET
{
DEBUGGER_REMOTE_STEPPING_REQUEST StepType;
//
// Only in the case of call instructions
// the 'p' command
//
BOOLEAN IsCurrentInstructionACall;
UINT32 CallLength;
} DEBUGGEE_STEP_PACKET, *PDEBUGGEE_STEP_PACKET;
/**
* @brief default number of instructions used in tracking and stepping
*
*/
#define DEBUGGER_REMOTE_TRACKING_DEFAULT_COUNT_OF_STEPPING 0xffffffff
// ==============================================================================================
/**
* @brief Perform actions related to APIC
*
*/
typedef enum _DEBUGGER_APIC_REQUEST_TYPE
{
DEBUGGER_APIC_REQUEST_TYPE_READ_LOCAL_APIC,
DEBUGGER_APIC_REQUEST_TYPE_READ_IO_APIC,
} DEBUGGER_APIC_REQUEST_TYPE;
/**
* @brief The structure of actions for APIC
*
*/
typedef struct _DEBUGGER_APIC_REQUEST
{
DEBUGGER_APIC_REQUEST_TYPE ApicType;
BOOLEAN IsUsingX2APIC;
UINT32 KernelStatus;
} DEBUGGER_APIC_REQUEST, *PDEBUGGER_APIC_REQUEST;
/**
* @brief Debugger size of DEBUGGER_APIC_REQUEST
*
*/
#define SIZEOF_DEBUGGER_APIC_REQUEST \
sizeof(DEBUGGER_APIC_REQUEST)
/**
* @brief LAPIC structure size
*/
#define LAPIC_SIZE 0x400
#define LAPIC_LVT_FLAG_ENTRY_MASKED (1UL << 16)
#define LAPIC_LVT_DELIVERY_MODE_EXT_INT (7UL << 8)
#define LAPIC_SVR_FLAG_SW_ENABLE (1UL << 8)
/**
* @brief LAPIC structure and offsets
*/
typedef struct _LAPIC_PAGE
{
UINT8 Reserved000[0x10];
UINT8 Reserved010[0x10];
UINT32 Id; // offset 0x020
UINT8 Reserved024[0x0C];
UINT32 Version; // offset 0x030
UINT8 Reserved034[0x0C];
UINT8 Reserved040[0x40];
UINT32 TPR; // offset 0x080
UINT8 Reserved084[0x0C];
UINT32 ArbitrationPriority; // offset 0x090
UINT8 Reserved094[0x0C];
UINT32 ProcessorPriority; // offset 0x0A0
UINT8 Reserved0A4[0x0C];
UINT32 EOI; // offset 0x0B0
UINT8 Reserved0B4[0x0C];
UINT32 RemoteRead; // offset 0x0C0
UINT8 Reserved0C4[0x0C];
UINT32 LogicalDestination; // offset 0x0D0
UINT8 Reserved0D4[0x0C];
UINT32 DestinationFormat; // offset 0x0E0
UINT8 Reserved0E4[0x0C];
UINT32 SpuriousInterruptVector; // offset 0x0F0
UINT8 Reserved0F4[0x0C];
UINT32 ISR[32]; // offset 0x100
UINT32 TMR[32]; // offset 0x180
UINT32 IRR[32]; // offset 0x200
UINT32 ErrorStatus; // offset 0x280
UINT8 Reserved284[0x0C];
UINT8 Reserved290[0x60];
UINT32 LvtCmci; // offset 0x2F0
UINT8 Reserved2F4[0x0C];
UINT32 IcrLow; // offset 0x300
UINT8 Reserved304[0x0C];
UINT32 IcrHigh; // offset 0x310
UINT8 Reserved314[0x0C];
UINT32 LvtTimer; // offset 0x320
UINT8 Reserved324[0x0C];
UINT32 LvtThermalSensor; // offset 0x330
UINT8 Reserved334[0x0C];
UINT32 LvtPerfMonCounters; // offset 0x340
UINT8 Reserved344[0x0C];
UINT32 LvtLINT0; // offset 0x350
UINT8 Reserved354[0x0C];
UINT32 LvtLINT1; // offset 0x360
UINT8 Reserved364[0x0C];
UINT32 LvtError; // offset 0x370
UINT8 Reserved374[0x0C];
UINT32 InitialCount; // offset 0x380
UINT8 Reserved384[0x0C];
UINT32 CurrentCount; // offset 0x390
UINT8 Reserved394[0x0C];
UINT8 Reserved3A0[0x40]; // offset 0x3A0
UINT32 DivideConfiguration; // offset 0x3E0
UINT8 Reserved3E4[0x0C];
UINT32 SelfIpi; // offset 0x3F0
UINT8 Reserved3F4[0x0C]; // valid only for X2APIC
} LAPIC_PAGE, *PLAPIC_PAGE;
// ==============================================================================================
/**
* @brief Maximum number of I/O APIC entries
* @details Usually 256 entries are enough (but we allocate 400 for systems with more
* I/O APIC entries)
* We're not gonna make the packet bigger than it's needed
*
*/
#define MAX_NUMBER_OF_IO_APIC_ENTRIES 400
/**
* @brief The structure of I/O APIC result packet in HyperDbg
*
*/
typedef struct _IO_APIC_ENTRY_PACKETS
{
UINT64 ApicBasePa;
UINT64 ApicBaseVa;
UINT32 IoIdReg;
UINT32 IoLl;
UINT32 IoArbIdReg;
UINT64 LlLhData[MAX_NUMBER_OF_IO_APIC_ENTRIES];
} IO_APIC_ENTRY_PACKETS, *PIO_APIC_ENTRY_PACKETS;
/**
* @brief check so the IO_APIC_ENTRY_PACKETS should be smaller than packet size
*
*/
static_assert(sizeof(IO_APIC_ENTRY_PACKETS) < PacketChunkSize,
"err (static_assert), size of PacketChunkSize should be bigger than IO_APIC_ENTRY_PACKETS");
// ==============================================================================================
/**
* @brief Perform actions related to SMIs
*
*/
typedef enum _SMI_OPERATION_REQUEST_TYPE
{
SMI_OPERATION_REQUEST_TYPE_READ_COUNT,
SMI_OPERATION_REQUEST_TYPE_TRIGGER_POWER_SMI,
} SMI_OPERATION_REQUEST_TYPE;
/**
* @brief The structure of I/O APIC result packet in HyperDbg
*
*/
typedef struct _SMI_OPERATION_PACKETS
{
SMI_OPERATION_REQUEST_TYPE SmiOperationType;
UINT64 SmiCount;
UINT32 KernelStatus;
} SMI_OPERATION_PACKETS, *PSMI_OPERATION_PACKETS;
/**
* @brief Debugger size of SMI_OPERATION_PACKETS
*
*/
#define SIZEOF_SMI_OPERATION_PACKETS \
sizeof(SMI_OPERATION_PACKETS)
// ==============================================================================================
/**
* @brief Perform actions related to HyperTrace for LBR
*
*/
typedef enum _HYPERTRACE_LBR_OPERATION_REQUEST_TYPE
{
HYPERTRACE_LBR_OPERATION_REQUEST_TYPE_ENABLE,
HYPERTRACE_LBR_OPERATION_REQUEST_TYPE_DISABLE,
HYPERTRACE_LBR_OPERATION_REQUEST_TYPE_FLUSH,
HYPERTRACE_LBR_OPERATION_REQUEST_TYPE_FILTER,
// HYPERTRACE_LBR_OPERATION_REQUEST_TYPE_QUERY,
// HYPERTRACE_LBR_OPERATION_REQUEST_TYPE_DUMP,
} HYPERTRACE_LBR_OPERATION_REQUEST_TYPE;
/**
* @brief The structure of HyperTrace LBR result packet in HyperDbg
*
*/
typedef struct _HYPERTRACE_LBR_OPERATION_PACKETS
{
HYPERTRACE_LBR_OPERATION_REQUEST_TYPE LbrOperationType;
UINT32 LbrFilterOptions;
UINT32 KernelStatus;
} HYPERTRACE_LBR_OPERATION_PACKETS, *PHYPERTRACE_LBR_OPERATION_PACKETS;
/**
* @brief Debugger size of HYPERTRACE_LBR_OPERATION_PACKETS
*
*/
#define SIZEOF_HYPERTRACE_LBR_OPERATION_PACKETS \
sizeof(HYPERTRACE_LBR_OPERATION_PACKETS)
// ==============================================================================================
/**
* @brief The structure of HyperTrace LBR dump result packet in HyperDbg
*
*/
typedef struct _HYPERTRACE_LBR_DUMP_PACKETS
{
UINT32 CoreId;
BOOLEAN NextCoreIsValid; // In the case of dumping all cores, this flag indicates whether the next core number is valid
BOOLEAN ArchBasedLBR; // Whether the LBR is architecture-based
LBR_STACK_ENTRY LbrStack;
UINT8 CurrentLbrCapacity;
UINT32 KernelStatus;
} HYPERTRACE_LBR_DUMP_PACKETS, *PHYPERTRACE_LBR_DUMP_PACKETS;
/**
* @brief In the case of dumping all cores, this value is used to specify that all cores should be dumped
*
*/
#define HYPERTRACE_LBR_DUMP_ALL_CORES 0xffffffff
/**
* @brief Debugger size of HYPERTRACE_LBR_DUMP_PACKETS
*
*/
#define SIZEOF_HYPERTRACE_LBR_DUMP_PACKETS \
sizeof(HYPERTRACE_LBR_DUMP_PACKETS)
// ==============================================================================================
/**
* @brief Perform actions related to HyperTrace for PT
*
*/
typedef enum _HYPERTRACE_PT_OPERATION_REQUEST_TYPE
{
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_ENABLE,
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_DISABLE,
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_PAUSE,
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_RESUME,
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_SIZE,
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FLUSH,
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_DUMP,
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_FILTER,
HYPERTRACE_PT_OPERATION_REQUEST_TYPE_PACKET,
} HYPERTRACE_PT_OPERATION_REQUEST_TYPE;
/**
* @brief The maximum buffer size for PT
*
*/
#define PT_DEFAULT_BUFFER_SIZE 0x200000 // 2 MB
/**
* @brief PT enable options structure
*
*/
typedef struct _PT_ENABLE_OPTIONS
{
UINT32 EnableByCr3 : 1; // Enable by CR3
UINT32 EnableByPid : 1; // Enable by PID
UINT32 EnableByTid : 1; // Enable by TID
UINT32 EnableByPname : 1; // Enable by process name
UINT32 Pid;
UINT32 Tid;
UINT64 Cr3;
CHAR ProcessName[256];
} PT_ENABLE_OPTIONS, *PPT_ENABLE_OPTIONS;
/**
* @brief PT filter options structure
*
*/
typedef struct _PT_FILTER_OPTIONS
{
UINT32 TraceUser : 1; // Trace user mode
UINT32 TraceKernel : 1; // Trace kernel mode
UINT8 NumAddrRanges; /* Number of valid AddrRanges entries */
PT_ADDR_RANGE AddrRanges[PT_MAX_ADDR_RANGES]; // Address ranges to filter by
} PT_FILTER_OPTIONS, *PPT_FILTER_OPTIONS;
/**
* @brief PT packet options structure
*
*/
typedef struct _PT_PACKET_OPTIONS
{
UINT32 PSB : 1; // PSB packet
UINT32 PIP : 1; // PIP packet
UINT32 TSC : 1; // TSC packet
UINT32 MTC : 1; // MTC packet
UINT32 CYC : 1; // CYC packet
UINT32 TNT : 1; // TNT packet
UINT32 TIP : 1; // TIP packet
UINT32 FUP : 1; // FUP packet
UINT32 MODE : 1; // MODE packet
} PT_PACKET_OPTIONS, *PPT_PACKET_OPTIONS;
/**
* @brief The structure of HyperTrace PT result packet in HyperDbg
*
*/
typedef struct _HYPERTRACE_PT_OPERATION_PACKETS
{
HYPERTRACE_PT_OPERATION_REQUEST_TYPE PtOperationType;
UINT32 KernelStatus;
//
// Enable
//
UINT64 BufferSize; /* Output buffer size (0 = default / PT_DEFAULT_BUFFER_SIZE) */
PT_ENABLE_OPTIONS EnableOptions; /* Options for enabling PT (CPL, CR3, PID, TID, Pname) */
//
// Filter
//
PT_FILTER_OPTIONS FilterOptions; /* Options for filtering PT (CPL, AddrRanges) */
//
// Packet
//
PT_PACKET_OPTIONS PacketOptions; /* Options for PT packets */
//
// Size
//
UINT32 NumCpus; /* CPUs populated in BytesPerCpu */
UINT64 BytesPerCpu[PT_MAX_CPUS_FOR_MMAP];
} HYPERTRACE_PT_OPERATION_PACKETS, *PHYPERTRACE_PT_OPERATION_PACKETS;
/**
* @brief Debugger size of HYPERTRACE_PT_OPERATION_PACKETS
*
*/
#define SIZEOF_HYPERTRACE_PT_OPERATION_PACKETS \
sizeof(HYPERTRACE_PT_OPERATION_PACKETS)
// ==============================================================================================
/**
* @brief Result packet for the HyperTrace PT mmap surface.
*
* On success KernelStatus is DEBUGGER_OPERATION_WAS_SUCCESSFUL,
* NumCpus gives the number of CPUs that were mapped, and
* Cpus[0..NumCpus) hand back a single { UserVa, Size } per CPU.
* Each Size covers the main output buffer immediately followed
* by the 4 KB overflow page as one contiguous byte stream.
*
* Mapping contract (cooperative single-process):
* - The IOCTL maps into the address space of the process that
* calls DeviceIoControl. The returned user VAs are not
* portable across processes.
* - Mapping is tied to the PT enable cycle. PT disable / flush
* tears the mapping down; the caller must not touch the
* user VAs afterwards.
* - Calling the IOCTL twice within the same enable cycle
* returns the existing mapping (idempotent).
*/
typedef struct _HYPERTRACE_PT_MMAP_PACKETS
{
UINT32 KernelStatus;
UINT32 NumCpus;
PT_USER_BUFFER_DESC Cpus[PT_MAX_CPUS_FOR_MMAP];
} HYPERTRACE_PT_MMAP_PACKETS, *PHYPERTRACE_PT_MMAP_PACKETS;
/**
* @brief Debugger size of HYPERTRACE_PT_MMAP_PACKETS
*
*/
#define SIZEOF_HYPERTRACE_PT_MMAP_PACKETS \
sizeof(HYPERTRACE_PT_MMAP_PACKETS)
// ==============================================================================================
/**
* @brief Maximum number of IDT entries
*
*/
#define MAX_NUMBER_OF_IDT_ENTRIES 256
/**
* @brief The structure of IDT entries result packet in HyperDbg
*
*/
typedef struct _INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS
{
UINT32 KernelStatus;
UINT64 IdtEntry[MAX_NUMBER_OF_IDT_ENTRIES];
} INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS, *PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS;
/**
* @brief Debugger size of INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS
*
*/
#define SIZEOF_INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS \
sizeof(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS)
/**
* @brief check so the INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS should be smaller than packet size
*
*/
static_assert(sizeof(INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS) < PacketChunkSize,
"err (static_assert), size of PacketChunkSize should be bigger than INTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS");
// ==============================================================================================
/**
* @brief The structure of .formats result packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_FORMATS_PACKET
{
UINT64 Value;
UINT32 Result;
} DEBUGGEE_FORMATS_PACKET, *PDEBUGGEE_FORMATS_PACKET;
// ==============================================================================================
/**
* @brief The structure of .sym reload packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_SYMBOL_REQUEST_PACKET
{
UINT32 ProcessId;
} DEBUGGEE_SYMBOL_REQUEST_PACKET, *PDEBUGGEE_SYMBOL_REQUEST_PACKET;
// ==============================================================================================
/**
* @brief The structure of bp command packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_BP_PACKET
{
UINT64 Address;
UINT32 Pid;
UINT32 Tid;
UINT32 Core;
BOOLEAN RemoveAfterHit;
BOOLEAN CheckForCallbacks;
UINT32 Result;
} DEBUGGEE_BP_PACKET, *PDEBUGGEE_BP_PACKET;
/**
* @brief Debugger size of DEBUGGEE_BP_PACKET
*
*/
#define SIZEOF_DEBUGGEE_BP_PACKET \
sizeof(DEBUGGEE_BP_PACKET)
/**
* @brief breakpoint modification types
*
*/
typedef enum _DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST
{
DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_LIST_BREAKPOINTS,
DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_ENABLE,
DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_DISABLE,
DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_CLEAR,
} DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST;
/**
* @brief The structure of breakpoint modification requests packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_BP_LIST_OR_MODIFY_PACKET
{
UINT64 BreakpointId;
DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST Request;
UINT32 Result;
} DEBUGGEE_BP_LIST_OR_MODIFY_PACKET, *PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET;
// ==============================================================================================
/**
* @brief Whether a jump is taken or not taken
*
*/
typedef enum _DEBUGGER_CONDITIONAL_JUMP_STATUS
{
DEBUGGER_CONDITIONAL_JUMP_STATUS_ERROR = 0,
DEBUGGER_CONDITIONAL_JUMP_STATUS_NOT_CONDITIONAL_JUMP,
DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_TAKEN,
DEBUGGER_CONDITIONAL_JUMP_STATUS_JUMP_IS_NOT_TAKEN,
} DEBUGGER_CONDITIONAL_JUMP_STATUS;
// ==============================================================================================
/**
* @brief The structure of script packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_SCRIPT_PACKET
{
UINT32 ScriptBufferSize;
UINT32 ScriptBufferPointer;
BOOLEAN IsFormat;
UINT64 FormatValue;
UINT32 Result;
//
// The script buffer is here
//
} DEBUGGEE_SCRIPT_PACKET, *PDEBUGGEE_SCRIPT_PACKET;
// ==============================================================================================
/**
* @brief The structure of result of search packet in HyperDbg
*
*/
typedef struct _DEBUGGEE_RESULT_OF_SEARCH_PACKET
{
UINT32 CountOfResults;
UINT32 Result;
} DEBUGGEE_RESULT_OF_SEARCH_PACKET, *PDEBUGGEE_RESULT_OF_SEARCH_PACKET;
// ==============================================================================================
/**
* @brief Register Descriptor Structure to use in r command.
*
*/
typedef struct _DEBUGGEE_REGISTER_READ_DESCRIPTION
{
UINT32 RegisterId;
UINT64 Value;
UINT32 KernelStatus;
} DEBUGGEE_REGISTER_READ_DESCRIPTION, *PDEBUGGEE_REGISTER_READ_DESCRIPTION;
// ==============================================================================================
/**
* @brief Register Descriptor Structure to write on registers.
*
*/
typedef struct _DEBUGGEE_REGISTER_WRITE_DESCRIPTION
{
UINT32 RegisterId;
UINT64 Value;
UINT32 KernelStatus;
} DEBUGGEE_REGISTER_WRITE_DESCRIPTION, *PDEBUGGEE_REGISTER_WRITE_DESCRIPTION;
// ==============================================================================================
#define SIZEOF_DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET \
sizeof(DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET)
/**
* @brief Pcitree Request-Response Packet. Represents PCI device tree.
*
*/
typedef struct _DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET
{
UINT32 KernelStatus;
UINT8 DeviceInfoListNum;
PCI_DEV_MINIMAL DeviceInfoList[DEV_MAX_NUM];
} DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET, *PDEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET;
/**
* @brief check so the DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET should be smaller than packet size
*
*/
static_assert(sizeof(DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET) < PacketChunkSize,
"err (static_assert), size of PacketChunkSize should be bigger than DEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET");
// ==============================================================================================
#define SIZEOF_DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET \
sizeof(DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET)
/**
* @brief PCI device info Request-Response Packet, used by !pcicam and future PCI-related commands. Represents a PCI device.
*
*/
typedef struct _DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET
{
UINT32 KernelStatus;
BOOL PrintRaw;
PCI_DEV DeviceInfo;
} DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET, *PDEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET;
/**
* @brief check so the DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET should be smaller than packet size
*
*/
static_assert(sizeof(DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET) < PacketChunkSize,
"err (static_assert), size of PacketChunkSize should be bigger than DEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET");
// ==============================================================================================
Reference in a new issue View git blame Copy permalink