mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-07-10 01:29:59 +00:00
526 lines
11 KiB
C
526 lines
11 KiB
C
/**
|
|
* @file Keywords.c
|
|
* @author M.H. Gholamrezaei (mh@hyperdbg.org)
|
|
* @author Sina Karvandi (sina@hyperdbg.org)
|
|
* @brief Script engine keywords implementations
|
|
* @details
|
|
* @version 0.2
|
|
* @date 2022-06-29
|
|
*
|
|
* @copyright This project is released under the GNU Public License v3.
|
|
*
|
|
*/
|
|
#include "pch.h"
|
|
|
|
//
|
|
// *** Keywords ***
|
|
//
|
|
|
|
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// For Virtual Memory //
|
|
// //
|
|
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
|
|
/**
|
|
* @brief Implementation of poi keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return UINT64
|
|
*/
|
|
UINT64
|
|
ScriptEngineKeywordPoi(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
UINT64 Result = (UINT64)NULL;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(UINT64)))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return (UINT64)NULL;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
Result = *Address;
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(UINT64));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of hi keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return WORD
|
|
*/
|
|
WORD
|
|
ScriptEngineKeywordHi(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
QWORD Result = NULL64_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(UINT64)))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL64_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
Result = *Address;
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(UINT64));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return HIWORD(Result);
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of low keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return WORD
|
|
*/
|
|
WORD
|
|
ScriptEngineKeywordLow(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
QWORD Result = NULL64_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(UINT64)))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL64_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
Result = *Address;
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(UINT64));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return LOWORD(Result);
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of db keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return BYTE
|
|
*/
|
|
BYTE
|
|
ScriptEngineKeywordDb(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
BYTE Result = NULL_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(BYTE)))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
Result = (BYTE)*Address;
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(BYTE));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of dd keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return DWORD
|
|
*/
|
|
DWORD
|
|
ScriptEngineKeywordDd(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
DWORD Result = NULL_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(DWORD)))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
Result = (DWORD)*Address;
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(DWORD));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of dw keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return WORD
|
|
*/
|
|
WORD
|
|
ScriptEngineKeywordDw(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
WORD Result = NULL_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(WORD)))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
Result = (WORD)*Address;
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(WORD));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of dq keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return QWORD
|
|
*/
|
|
QWORD
|
|
ScriptEngineKeywordDq(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
QWORD Result = (QWORD)NULL;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAccessValidityAndSafety((UINT64)Address, sizeof(DWORD)))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return (QWORD)NULL;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
Result = *Address;
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeOnTargetProcess((UINT64)Address, &Result, sizeof(QWORD));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
// //
|
|
// For Physical Memory //
|
|
// //
|
|
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
|
|
/**
|
|
* @brief Implementation of poi_pa keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return UINT64
|
|
*/
|
|
UINT64
|
|
ScriptEngineKeywordPoiPa(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
UINT64 Result = (UINT64)NULL;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAddressPhysical((UINT64)Address))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return (UINT64)NULL;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
|
|
ShowMessages("err, using physical address keywords (poi_pa) is not possible in user-mode\n");
|
|
return (UINT64)NULL;
|
|
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(UINT64));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of hi keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return WORD
|
|
*/
|
|
WORD
|
|
ScriptEngineKeywordHiPa(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
QWORD Result = NULL64_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAddressPhysical((UINT64)Address))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL64_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
|
|
ShowMessages("err, using physical address keywords (hi_pa) is not possible in user-mode\n");
|
|
return (WORD)NULL;
|
|
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(UINT64));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return HIWORD(Result);
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of low keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return WORD
|
|
*/
|
|
WORD
|
|
ScriptEngineKeywordLowPa(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
QWORD Result = NULL64_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAddressPhysical((UINT64)Address))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL64_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
|
|
ShowMessages("err, using physical address keywords (low_pa) is not possible in user-mode\n");
|
|
return (WORD)NULL;
|
|
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(UINT64));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return LOWORD(Result);
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of db keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return BYTE
|
|
*/
|
|
BYTE
|
|
ScriptEngineKeywordDbPa(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
BYTE Result = NULL_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAddressPhysical((UINT64)Address))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
|
|
ShowMessages("err, using physical address keywords (db_pa) is not possible in user-mode\n");
|
|
return (BYTE)NULL;
|
|
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(BYTE));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of dd keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return DWORD
|
|
*/
|
|
DWORD
|
|
ScriptEngineKeywordDdPa(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
DWORD Result = NULL_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAddressPhysical((UINT64)Address))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
|
|
ShowMessages("err, using physical address keywords (dd_pa) is not possible in user-mode\n");
|
|
return (DWORD)NULL;
|
|
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(DWORD));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of dw keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return WORD
|
|
*/
|
|
WORD
|
|
ScriptEngineKeywordDwPa(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
WORD Result = NULL_ZERO;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAddressPhysical((UINT64)Address))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return NULL_ZERO;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
|
|
ShowMessages("err, using physical address keywords (dw_pa) is not possible in user-mode\n");
|
|
return (WORD)NULL;
|
|
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(WORD));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|
|
|
|
/**
|
|
* @brief Implementation of dq keyword
|
|
*
|
|
* @param Address
|
|
* @param HasError
|
|
* @return QWORD
|
|
*/
|
|
QWORD
|
|
ScriptEngineKeywordDqPa(PUINT64 Address, BOOL * HasError)
|
|
{
|
|
QWORD Result = (QWORD)NULL;
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
if (!CheckAddressPhysical((UINT64)Address))
|
|
{
|
|
*HasError = TRUE;
|
|
|
|
return (QWORD)NULL;
|
|
}
|
|
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_USER_MODE
|
|
|
|
ShowMessages("err, using physical address keywords (dq_pa) is not possible in user-mode\n");
|
|
return (QWORD)NULL;
|
|
|
|
#endif // SCRIPT_ENGINE_USER_MODE
|
|
|
|
#ifdef SCRIPT_ENGINE_KERNEL_MODE
|
|
MemoryMapperReadMemorySafeByPhysicalAddress((UINT64)Address, (UINT64)&Result, sizeof(QWORD));
|
|
#endif // SCRIPT_ENGINE_KERNEL_MODE
|
|
|
|
return Result;
|
|
}
|