mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-08-23 15:34:35 +00:00
103 lines
2.7 KiB
C++
103 lines
2.7 KiB
C++
/**
|
|
* @file vmcall.cpp
|
|
* @author Sina Karvandi (sina@rayanfam.com)
|
|
* @brief !vmcall command
|
|
* @details
|
|
* @version 0.1
|
|
* @date 2020-07-03
|
|
*
|
|
* @copyright This project is released under the GNU Public License v3.
|
|
*
|
|
*/
|
|
#include "pch.h"
|
|
|
|
/**
|
|
* @brief help of !vmcall command
|
|
*
|
|
* @return VOID
|
|
*/
|
|
VOID CommandVmcallHelp() {
|
|
ShowMessages("!vmcall : Monitors execution of VMCALL instruction.\n\n");
|
|
ShowMessages("syntax : \t!vmcall core [core index "
|
|
"(hex value)] pid [process id (hex value)] condition {[assembly "
|
|
"in hex]} code {[assembly in hex]} buffer [pre-require buffer - "
|
|
"(hex value)] \n");
|
|
|
|
ShowMessages("\t\te.g : !vmcall\n");
|
|
ShowMessages("\t\te.g : !vmcall pid 400\n");
|
|
ShowMessages("\t\te.g : !vmcall core 2 pid 400\n");
|
|
}
|
|
|
|
/**
|
|
* @brief !vmcall command handler
|
|
*
|
|
* @param SplittedCommand
|
|
* @return VOID
|
|
*/
|
|
VOID CommandVmcall(vector<string> SplittedCommand) {
|
|
|
|
PDEBUGGER_GENERAL_EVENT_DETAIL Event = NULL;
|
|
PDEBUGGER_GENERAL_ACTION ActionBreakToDebugger = NULL;
|
|
PDEBUGGER_GENERAL_ACTION ActionCustomCode = NULL;
|
|
PDEBUGGER_GENERAL_ACTION ActionScript = NULL;
|
|
UINT32 EventLength;
|
|
UINT32 ActionBreakToDebuggerLength = 0;
|
|
UINT32 ActionCustomCodeLength = 0;
|
|
UINT32 ActionScriptLength = 0;
|
|
|
|
//
|
|
// Interpret and fill the general event and action fields
|
|
//
|
|
//
|
|
if (!InterpretGeneralEventAndActionsFields(
|
|
&SplittedCommand, VMCALL_INSTRUCTION_EXECUTION, &Event, &EventLength,
|
|
&ActionBreakToDebugger, &ActionBreakToDebuggerLength,
|
|
&ActionCustomCode, &ActionCustomCodeLength, &ActionScript,
|
|
&ActionScriptLength)) {
|
|
CommandVmcallHelp();
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Check for size
|
|
//
|
|
if (SplittedCommand.size() > 1) {
|
|
ShowMessages("incorrect use of '!vmcall'\n");
|
|
CommandVmcallHelp();
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Send the ioctl to the kernel for event registeration
|
|
//
|
|
if (!SendEventToKernel(Event, EventLength)) {
|
|
|
|
//
|
|
// There was an error, probably the handle was not initialized
|
|
// we have to free the Action before exit, it is because, we
|
|
// already freed the Event and string buffers
|
|
//
|
|
if (ActionBreakToDebugger != NULL) {
|
|
free(ActionBreakToDebugger);
|
|
}
|
|
if (ActionCustomCode != NULL) {
|
|
free(ActionCustomCode);
|
|
}
|
|
if (ActionScript != NULL) {
|
|
free(ActionScript);
|
|
}
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Add the event to the kernel
|
|
//
|
|
if (!RegisterActionToEvent(ActionBreakToDebugger, ActionBreakToDebuggerLength,
|
|
ActionCustomCode, ActionCustomCodeLength,
|
|
ActionScript, ActionScriptLength)) {
|
|
//
|
|
// There was an error
|
|
//
|
|
return;
|
|
}
|
|
}
|