mirror of
https://github.com/HyperDbg/HyperDbg.git
synced 2026-07-10 01:29:59 +00:00
252 lines
7.9 KiB
C++
252 lines
7.9 KiB
C++
/**
|
|
* @file kd.h
|
|
* @author Sina Karvandi (sina@hyperdbg.org)
|
|
* @brief routines for remote kernel debugging
|
|
* @details
|
|
* @version 0.1
|
|
* @date 2020-12-22
|
|
*
|
|
* @copyright This project is released under the GNU Public License v3.
|
|
*
|
|
*/
|
|
#pragma once
|
|
|
|
//////////////////////////////////////////////////
|
|
// Display Windows Details //
|
|
//////////////////////////////////////////////////
|
|
|
|
#ifdef _WIN32
|
|
// HKEY / RegCloseKey are Windows registry APIs; this RAII helper is Windows-only
|
|
struct HKeyHolder
|
|
{
|
|
private:
|
|
HKEY m_Key;
|
|
|
|
public:
|
|
HKeyHolder() :
|
|
m_Key(nullptr) { }
|
|
|
|
HKeyHolder(const HKeyHolder &) = delete;
|
|
HKeyHolder & operator=(const HKeyHolder &) = delete;
|
|
|
|
~HKeyHolder()
|
|
{
|
|
if (m_Key != nullptr)
|
|
RegCloseKey(m_Key);
|
|
}
|
|
|
|
operator HKEY() const { return m_Key; }
|
|
|
|
HKEY * operator&() { return &m_Key; }
|
|
};
|
|
#endif // _WIN32
|
|
|
|
//////////////////////////////////////////////////
|
|
// Functions //
|
|
//////////////////////////////////////////////////
|
|
|
|
BOOLEAN
|
|
KdCommandPacketToDebuggee(
|
|
DEBUGGER_REMOTE_PACKET_TYPE PacketType,
|
|
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction);
|
|
|
|
BOOLEAN
|
|
KdCommandPacketAndBufferToDebuggee(
|
|
DEBUGGER_REMOTE_PACKET_TYPE PacketType,
|
|
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction,
|
|
CHAR * Buffer,
|
|
UINT32 BufferLength);
|
|
|
|
BOOLEAN
|
|
KdPrepareSerialConnectionToRemoteSystem(HANDLE SerialHandle,
|
|
BOOLEAN IsNamedPipe,
|
|
BOOLEAN PauseAfterConnection);
|
|
|
|
BOOLEAN
|
|
KdPrepareAndConnectDebugPort(const CHAR * PortName,
|
|
DWORD Baudrate,
|
|
UINT32 Port,
|
|
BOOLEAN IsPreparing,
|
|
BOOLEAN IsNamedPipe,
|
|
BOOLEAN PauseAfterConnection);
|
|
|
|
BOOLEAN
|
|
KdSendPacketToDebuggee(const CHAR * Buffer, UINT32 Length, BOOLEAN SendEndOfBuffer);
|
|
|
|
BOOLEAN
|
|
KdReceivePacketFromDebuggee(CHAR * BufferToSave, UINT32 * LengthReceived);
|
|
|
|
BOOLEAN
|
|
KdReceivePacketFromDebugger(CHAR * BufferToSave, UINT32 * LengthReceived);
|
|
|
|
BOOLEAN
|
|
KdCheckForTheEndOfTheBuffer(PUINT32 CurrentLoopIndex, BYTE * Buffer);
|
|
|
|
BOOLEAN
|
|
KdSendSwitchCorePacketToDebuggee(UINT32 NewCore);
|
|
|
|
BOOLEAN
|
|
KdSendShortCircuitingEventToDebuggee(BOOLEAN IsEnabled);
|
|
|
|
BOOLEAN
|
|
KdSendEventQueryAndModifyPacketToDebuggee(
|
|
UINT64 Tag,
|
|
DEBUGGER_MODIFY_EVENTS_TYPE TypeOfAction,
|
|
BOOLEAN * IsEnabled);
|
|
|
|
BOOLEAN
|
|
KdSendFlushPacketToDebuggee();
|
|
|
|
BOOLEAN
|
|
KdSendCallStackPacketToDebuggee(UINT64 BaseAddress,
|
|
UINT32 Size,
|
|
DEBUGGER_CALLSTACK_DISPLAY_METHOD DisplayMethod,
|
|
BOOLEAN Is32Bit);
|
|
|
|
BOOLEAN
|
|
KdSendTestQueryPacketToDebuggee(DEBUGGER_TEST_QUERY_STATE Type);
|
|
|
|
BOOLEAN
|
|
KdSendTestQueryPacketWithContextToDebuggee(DEBUGGER_TEST_QUERY_STATE Type, UINT64 Context);
|
|
|
|
BOOLEAN
|
|
KdSendSymbolReloadPacketToDebuggee(UINT32 ProcessId);
|
|
|
|
BOOLEAN
|
|
KdSendReadRegisterPacketToDebuggee(PDEBUGGEE_REGISTER_READ_DESCRIPTION RegDes, UINT32 RegBuffSize);
|
|
|
|
BOOLEAN
|
|
KdSendWriteRegisterPacketToDebuggee(PDEBUGGEE_REGISTER_WRITE_DESCRIPTION RegDes);
|
|
|
|
BOOLEAN
|
|
KdSendReadMemoryPacketToDebuggee(PDEBUGGER_READ_MEMORY ReadMem, UINT32 RequestSize);
|
|
|
|
BOOLEAN
|
|
KdSendEditMemoryPacketToDebuggee(PDEBUGGER_EDIT_MEMORY EditMem, UINT32 Size);
|
|
|
|
PDEBUGGER_EVENT_AND_ACTION_RESULT
|
|
KdSendRegisterEventPacketToDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL Event,
|
|
UINT32 EventBufferLength);
|
|
|
|
PDEBUGGER_EVENT_AND_ACTION_RESULT
|
|
KdSendAddActionToEventPacketToDebuggee(PDEBUGGER_GENERAL_ACTION GeneralAction,
|
|
UINT32 GeneralActionLength);
|
|
|
|
BOOLEAN
|
|
KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE ActionType,
|
|
UINT32 NewPid,
|
|
UINT64 NewProcess,
|
|
BOOLEAN SetChangeByClockInterrupt,
|
|
PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS SymDetailsForProcessList);
|
|
|
|
BOOLEAN
|
|
KdSendSwitchThreadPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE ActionType,
|
|
UINT32 NewTid,
|
|
UINT64 NewThread,
|
|
BOOLEAN CheckByClockInterrupt,
|
|
PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS SymDetailsForThreadList);
|
|
|
|
BOOLEAN
|
|
KdSendBpPacketToDebuggee(PDEBUGGEE_BP_PACKET BpPacket);
|
|
|
|
BOOLEAN
|
|
KdSendVa2paAndPa2vaPacketToDebuggee(PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS Va2paAndPa2vaPacket);
|
|
|
|
BOOLEAN
|
|
KdSendApicActionPacketsToDebuggee(PDEBUGGER_APIC_REQUEST ApicRequest, UINT32 ExpectedRequestSize);
|
|
|
|
BOOLEAN
|
|
KdSendSmiPacketsToDebuggee(PSMI_OPERATION_PACKETS SmiOperationRequest, UINT32 ExpectedRequestSize);
|
|
|
|
BOOLEAN
|
|
KdSendHyperTraceLbrdumpPacketsToDebuggee(PHYPERTRACE_LBR_DUMP_PACKETS HyperTraceLbrdumpRequest, UINT32 ExpectedRequestSize);
|
|
|
|
BOOLEAN
|
|
KdSendHyperTracePtPacketsToDebuggee(PHYPERTRACE_PT_OPERATION_PACKETS HyperTracePtOperationRequest, UINT32 ExpectedRequestSize);
|
|
|
|
BOOLEAN
|
|
KdSendQueryIdtPacketsToDebuggee(PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtRequest);
|
|
|
|
BOOLEAN
|
|
KdSendPtePacketToDebuggee(PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PtePacket);
|
|
|
|
BOOLEAN
|
|
KdSendPageinPacketToDebuggee(PDEBUGGER_PAGE_IN_REQUEST PageinPacket);
|
|
|
|
BOOLEAN
|
|
KdSendListOrModifyPacketToDebuggee(
|
|
PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET ListOrModifyPacket);
|
|
|
|
BOOLEAN
|
|
KdSendScriptPacketToDebuggee(UINT64 BufferAddress, UINT32 BufferLength, UINT32 Pointer, BOOLEAN IsFormat);
|
|
|
|
BOOLEAN
|
|
KdSendUserInputPacketToDebuggee(const CHAR * Sendbuf, INT Len, BOOLEAN IgnoreBreakingAgain);
|
|
|
|
BOOLEAN
|
|
KdSendSearchRequestPacketToDebuggee(UINT64 * SearchRequestBuffer, UINT32 SearchRequestBufferSize);
|
|
|
|
BOOLEAN
|
|
KdSendStepPacketToDebuggee(DEBUGGER_REMOTE_STEPPING_REQUEST StepRequestType);
|
|
|
|
BYTE
|
|
KdComputeDataChecksum(PVOID Buffer, UINT32 Length);
|
|
|
|
BOOLEAN
|
|
KdRegisterEventInDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL EventRegBuffer,
|
|
UINT32 Length);
|
|
|
|
BOOLEAN
|
|
KdAddActionToEventInDebuggee(PDEBUGGER_GENERAL_ACTION ActionAddingBuffer,
|
|
UINT32 Length);
|
|
|
|
BOOLEAN
|
|
KdSendModifyEventInDebuggee(PDEBUGGER_MODIFY_EVENTS ModifyEvent, BOOLEAN SendTheResultBackToDebugger);
|
|
|
|
BOOLEAN
|
|
KdSendGeneralBuffersFromDebuggeeToDebugger(
|
|
DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction,
|
|
PVOID Buffer,
|
|
UINT32 BufferLength,
|
|
BOOLEAN PauseDebuggeeWhenSent);
|
|
|
|
BOOLEAN
|
|
KdCloseConnection();
|
|
|
|
BOOLEAN
|
|
KdReloadSymbolsInDebuggee(BOOLEAN PauseDebuggee, UINT32 UserProcessId);
|
|
|
|
BOOLEAN
|
|
KdSendResponseOfThePingPacket();
|
|
|
|
BOOLEAN
|
|
KdSendPcitreePacketToDebuggee(PDEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET PcitreePacket);
|
|
|
|
BOOLEAN
|
|
KdSendPcidevinfoPacketToDebuggee(PDEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET PcidevinfoPacket);
|
|
|
|
VOID
|
|
KdUninitializeConnection();
|
|
|
|
VOID
|
|
KdSendUsermodePrints(CHAR * Input, UINT32 Length);
|
|
|
|
VOID
|
|
KdSendSymbolDetailPacket(PMODULE_SYMBOL_DETAIL SymbolDetailPacket,
|
|
UINT32 CurrentSymbolInfoIndex,
|
|
UINT32 TotalSymbols);
|
|
|
|
VOID
|
|
KdHandleUserInputInDebuggee(DEBUGGEE_USER_INPUT_PACKET * Descriptor);
|
|
|
|
VOID
|
|
KdTheRemoteSystemIsRunning();
|
|
|
|
VOID
|
|
KdBreakControlCheckAndPauseDebugger(BOOLEAN SignalRunningFlag);
|
|
|
|
VOID
|
|
KdBreakControlCheckAndContinueDebugger();
|
|
|
|
VOID
|
|
KdSetStatusAndWaitForPause();
|