mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-07-09 17:19:26 +00:00
139 lines
3.6 KiB
C++
139 lines
3.6 KiB
C++
/**
|
|
* @file unload.cpp
|
|
* @author Sina Karvandi (sina@hyperdbg.org)
|
|
* @brief unload command
|
|
* @details
|
|
* @version 0.1
|
|
* @date 2020-05-27
|
|
*
|
|
* @copyright This project is released under the GNU Public License v3.
|
|
*
|
|
*/
|
|
#include "pch.h"
|
|
|
|
//
|
|
// Global Variables
|
|
//
|
|
extern BOOLEAN g_IsConnectedToHyperDbgLocally;
|
|
extern BOOLEAN g_IsKdModuleLoaded;
|
|
extern BOOLEAN g_IsVmmModuleLoaded;
|
|
extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee;
|
|
extern BOOLEAN g_IsSerialConnectedToRemoteDebugger;
|
|
|
|
/**
|
|
* @brief help of the unload command
|
|
*
|
|
* @return VOID
|
|
*/
|
|
VOID
|
|
CommandUnloadHelp()
|
|
{
|
|
ShowMessages(
|
|
"unload : unloads the kernel modules and uninstalls the drivers.\n\n");
|
|
|
|
ShowMessages("syntax : \tunload [remove] [ModuleName (string)]\n");
|
|
|
|
ShowMessages("\n");
|
|
ShowMessages("\t\te.g : unload vmm\n");
|
|
ShowMessages("\t\te.g : unload vm\n");
|
|
ShowMessages("\t\te.g : unload remove vmm\n");
|
|
}
|
|
|
|
/**
|
|
* @brief unload command handler
|
|
*
|
|
* @param CommandTokens
|
|
* @param Command
|
|
*
|
|
* @return VOID
|
|
*/
|
|
VOID
|
|
CommandUnload(vector<CommandToken> CommandTokens, string Command)
|
|
{
|
|
if (CommandTokens.size() != 2 && CommandTokens.size() != 3)
|
|
{
|
|
ShowMessages("incorrect use of the '%s'\n\n",
|
|
GetCaseSensitiveStringFromCommandToken(CommandTokens.at(0)).c_str());
|
|
CommandUnloadHelp();
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Check for the module
|
|
//
|
|
if ((CommandTokens.size() == 2 && (CompareLowerCaseStrings(CommandTokens.at(1), "vmm") || CompareLowerCaseStrings(CommandTokens.at(1), "vm"))) ||
|
|
(CommandTokens.size() == 3 && (CompareLowerCaseStrings(CommandTokens.at(2), "vmm") || CompareLowerCaseStrings(CommandTokens.at(2), "vm")) &&
|
|
CompareLowerCaseStrings(CommandTokens.at(1), "remove")))
|
|
{
|
|
if (!g_IsConnectedToHyperDbgLocally)
|
|
{
|
|
ShowMessages("you're not connected to any instance of HyperDbg, did you "
|
|
"use '.connect'? \n");
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Check to avoid using this command in debugger-mode
|
|
//
|
|
if (g_IsSerialConnectedToRemoteDebuggee || g_IsSerialConnectedToRemoteDebugger)
|
|
{
|
|
ShowMessages("you're connected to a an instance of HyperDbg, please use "
|
|
"'.debug close' command\n");
|
|
return;
|
|
}
|
|
|
|
if (g_IsVmmModuleLoaded)
|
|
{
|
|
HyperDbgUnloadVmm();
|
|
|
|
HyperDbgUnloadKd(); // Tessssssssssssssssssssssttttttttttt
|
|
}
|
|
else
|
|
{
|
|
ShowMessages("the vmm module is not loadedd\n");
|
|
}
|
|
|
|
//
|
|
// Check to remove the driver
|
|
//
|
|
if (CompareLowerCaseStrings(CommandTokens.at(1), "remove"))
|
|
{
|
|
//
|
|
// Unload the KD module
|
|
//
|
|
|
|
// if (HyperDbgUnloadKd())
|
|
// {
|
|
// ShowMessages("err, failed to unload the kd (kernel debugger) driver\n");
|
|
// return;
|
|
// }
|
|
|
|
//
|
|
// Stop the driver
|
|
//
|
|
if (HyperDbgStopKdDriver())
|
|
{
|
|
ShowMessages("err, failed to stop driver\n");
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Uninstall the driver
|
|
//
|
|
if (HyperDbgUninstallKdDriver())
|
|
{
|
|
ShowMessages("err, failed to uninstall the driver\n");
|
|
return;
|
|
}
|
|
|
|
ShowMessages("the driver is removed\n");
|
|
}
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Module not found
|
|
//
|
|
ShowMessages("err, module not found\n");
|
|
}
|
|
}
|