munraimix 7436b35fd0 Fix DRIVER_IRQL_NOT_LESS_OR_EQUAL when reading registers on a manually-halted core ... In Debugger Mode, breaking the debuggee and then reading registers (e.g. the 'r' command) could bugcheck the debuggee with DRIVER_IRQL_NOT_LESS_OR_EQUAL (0xD1) at IRQL 0xff. Root cause: DebuggerCommandReadRegisters() copies GUEST_REGS from DbgState->Regs, but the per-core DbgState->Regs is only populated on the event-triggered halt paths. A core halted via a manual break (DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM) or via the NMI broadcast (KdHandleNmi) never had DbgState->Regs set, so it was NULL and the GUEST_REGS memcpy dereferenced address 0. Fix: - Add VmFuncGetGuestRegs(CoreId) returning g_GuestState[CoreId].Regs (the guest GP registers saved on the last vm-exit). - Populate DbgState->Regs from it on the two manual-halt entry points (DEBUGGER_VMCALL_VM_EXIT_HALT_SYSTEM and KdHandleNmi) so register reads on a manually-halted core return the correct values. - Add a defensive NULL check in DebuggerCommandReadRegisters().		2026-07-19 16:53:34 +10:00
..
Callback.c	fix and remove unused VMM callbacks	2026-06-09 15:04:20 +02:00
Configuration.c	intercept the execution when the module loaded on the user debugger	2025-06-28 18:53:35 +02:00
DirectVmcall.c	build based on new libhyperdbg	2024-06-24 18:05:54 +09:00
Dispatch.c	fix and remove unused VMM callbacks	2026-06-09 15:04:20 +02:00
Export.c	Fix DRIVER_IRQL_NOT_LESS_OR_EQUAL when reading registers on a manually-halted core	2026-07-19 16:53:34 +10:00
HyperEvade.c	feat(hide): add transparent evade mask API	2026-06-05 19:01:14 +01:00