mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-08-29 10:22:57 +00:00
95389e46df
Created a lot of new platform wrappers for windows only functions also removed hyperevade from the linux module build and added a empty stub for the transparent functions they provide which can be filled in later.
123 lines
3.1 KiB
C
123 lines
3.1 KiB
C
/**
|
|
* @file ScriptEngine.c
|
|
* @author Sina Karvandi (sina@hyperdbg.org)
|
|
* @author M.H. Gholamrezaei (mh@hyperdbg.org)
|
|
* @brief Script engine parser and wrapper functions
|
|
* @details
|
|
* @version 0.1
|
|
* @date 2020-10-22
|
|
*
|
|
* @copyright This project is released under the GNU Public License v3.
|
|
*
|
|
*/
|
|
#include "pch.h"
|
|
|
|
/**
|
|
* @brief Get current ip from the debugger frame
|
|
*
|
|
* @return UINT64 returns the rip of the current debuggee state frame
|
|
*/
|
|
UINT64
|
|
ScriptEngineWrapperGetInstructionPointer()
|
|
{
|
|
//
|
|
// Check if we are in vmx-root or not
|
|
//
|
|
if (VmFuncVmxGetCurrentExecutionMode() == TRUE)
|
|
{
|
|
return VmFuncGetRip();
|
|
}
|
|
else
|
|
{
|
|
//
|
|
// Otherwise $ip doesn't mean anything
|
|
//
|
|
return (UINT64)NULL;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @brief Get the address of reserved buffer
|
|
*
|
|
* @param Action Corresponding action
|
|
* @return UINT64 returns the requested buffer address from user
|
|
*/
|
|
UINT64
|
|
ScriptEngineWrapperGetAddressOfReservedBuffer(PDEBUGGER_EVENT_ACTION Action)
|
|
{
|
|
return Action->RequestedBuffer.RequstBufferAddress;
|
|
}
|
|
|
|
/**
|
|
* @brief Create and update the target core date and time
|
|
* @param DbgState The processor debugging state
|
|
*
|
|
* @return VOID
|
|
*/
|
|
VOID
|
|
ScriptEngineUpdateTargetCoreDateTime(PROCESSOR_DEBUGGING_STATE * DbgState)
|
|
{
|
|
LARGE_INTEGER SystemTime, LocalTime;
|
|
PlatformTimeQuerySystemTime(&SystemTime);
|
|
PlatformTimeConvertToLocalTime(&SystemTime, &LocalTime);
|
|
PlatformTimeConvertToTimeFields(&LocalTime, &DbgState->DateTimeHolder.TimeFields);
|
|
|
|
PlatformSprintf(DbgState->DateTimeHolder.TimeBuffer,
|
|
RTL_NUMBER_OF(DbgState->DateTimeHolder.TimeBuffer),
|
|
"%02hd:%02hd:%02hd.%03hd",
|
|
DbgState->DateTimeHolder.TimeFields.Hour,
|
|
DbgState->DateTimeHolder.TimeFields.Minute,
|
|
DbgState->DateTimeHolder.TimeFields.Second,
|
|
DbgState->DateTimeHolder.TimeFields.Milliseconds);
|
|
|
|
PlatformSprintf(DbgState->DateTimeHolder.DateBuffer,
|
|
RTL_NUMBER_OF(DbgState->DateTimeHolder.DateBuffer),
|
|
"%04hd-%02hd-%02hd",
|
|
DbgState->DateTimeHolder.TimeFields.Year,
|
|
DbgState->DateTimeHolder.TimeFields.Month,
|
|
DbgState->DateTimeHolder.TimeFields.Day);
|
|
}
|
|
|
|
/**
|
|
* @brief Update core's date time and return time
|
|
*
|
|
* @return UINT64
|
|
*/
|
|
UINT64
|
|
ScriptEngineGetTargetCoreTime()
|
|
{
|
|
ULONG CurrentCore = PlatformCpuGetCurrentProcessorNumber();
|
|
PROCESSOR_DEBUGGING_STATE * DbgState = &g_DbgState[CurrentCore];
|
|
|
|
//
|
|
// Update the core's date time
|
|
//
|
|
ScriptEngineUpdateTargetCoreDateTime(DbgState);
|
|
|
|
//
|
|
// Return the time
|
|
//
|
|
return (UINT64)&DbgState->DateTimeHolder.TimeBuffer;
|
|
}
|
|
|
|
/**
|
|
* @brief Update core's date time and return date
|
|
*
|
|
* @return UINT64
|
|
*/
|
|
UINT64
|
|
ScriptEngineGetTargetCoreDate()
|
|
{
|
|
ULONG CurrentCore = PlatformCpuGetCurrentProcessorNumber();
|
|
PROCESSOR_DEBUGGING_STATE * DbgState = &g_DbgState[CurrentCore];
|
|
|
|
//
|
|
// Update the core's date time
|
|
//
|
|
ScriptEngineUpdateTargetCoreDateTime(DbgState);
|
|
|
|
//
|
|
// Return the date
|
|
//
|
|
return (UINT64)&DbgState->DateTimeHolder.DateBuffer;
|
|
}
|