change the SDK examples

This commit is contained in:
Sinaei 2023-09-12 11:45:50 +09:00
parent 3860ecc0fd
commit 7fe2be3f7d
29 changed files with 280 additions and 367 deletions

View file

@ -510,40 +510,6 @@ HyperDbgInstallVmmDriver()
return 0;
}
/**
* @brief Install Reversing Machine driver
*
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int
HyperDbgInstallReversingMachineDriver()
{
//
// The driver is not started yet so let us the install driver
// First setup full path to driver name
//
if (!SetupDriverName(KERNEL_REVERSING_MACHINE_DRIVER_NAME, g_DriverLocation, sizeof(g_DriverLocation)))
{
return 1;
}
if (!ManageDriver(KERNEL_REVERSING_MACHINE_DRIVER_NAME, g_DriverLocation, DRIVER_FUNC_INSTALL))
{
ShowMessages("unable to install reversing machine's driver\n");
//
// Error - remove driver
//
ManageDriver(KERNEL_REVERSING_MACHINE_DRIVER_NAME, g_DriverLocation, DRIVER_FUNC_REMOVE);
return 1;
}
return 0;
}
/**
* @brief Stop the driver
*
@ -578,18 +544,6 @@ HyperDbgStopVmmDriver()
return HyperDbgStopDriver(KERNEL_DEBUGGER_DRIVER_NAME);
}
/**
* @brief Stop reversing machine driver
*
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int
HyperDbgStopReversingMachineDriver()
{
return HyperDbgStopDriver(KERNEL_REVERSING_MACHINE_DRIVER_NAME);
}
/**
* @brief Remove the driver
*
@ -624,18 +578,6 @@ HyperDbgUninstallVmmDriver()
return HyperDbgUninstallDriver(KERNEL_DEBUGGER_DRIVER_NAME);
}
/**
* @brief Remove the reversing machine driver
*
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int
HyperDbgUninstallReversingMachineDriver()
{
return HyperDbgUninstallDriver(KERNEL_REVERSING_MACHINE_DRIVER_NAME);
}
/**
* @brief Load the VMM driver
*
@ -645,9 +587,9 @@ HyperDbgUninstallReversingMachineDriver()
HPRDBGCTRL_API int
HyperDbgLoadVmm()
{
string CpuID;
DWORD ErrorNum;
DWORD ThreadId;
char CpuId[13] = {0};
DWORD ErrorNum;
DWORD ThreadId;
if (g_DeviceHandle)
{
@ -656,11 +598,14 @@ HyperDbgLoadVmm()
return 1;
}
CpuID = ReadVendorString();
//
// Read the vendor string
//
HyperDbgReadVendorString(CpuId);
ShowMessages("current processor vendor is : %s\n", CpuID.c_str());
ShowMessages("current processor vendor is : %s\n", CpuId);
if (CpuID == "GenuineIntel")
if (strcmp(CpuId, "GenuineIntel") == 0)
{
ShowMessages("virtualization technology is vt-x\n");
}
@ -671,7 +616,7 @@ HyperDbgLoadVmm()
return 1;
}
if (VmxSupportDetection())
if (HyperDbgVmxSupportDetection())
{
ShowMessages("vmx operation is supported by your processor\n");
}
@ -739,57 +684,6 @@ HyperDbgLoadVmm()
return 0;
}
/**
* @brief Load the reversing machine driver
*
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int
HyperDbgLoadReversingMachine()
{
string CpuID;
if (g_DeviceHandle || g_IsReversingMachineModulesLoaded)
{
ShowMessages("handle of the driver found, if you use 'load' before, please "
"unload it using 'unload'\n");
return 1;
}
CpuID = ReadVendorString();
ShowMessages("current processor vendor is : %s\n", CpuID.c_str());
if (CpuID == "GenuineIntel")
{
ShowMessages("virtualization technology is vt-x\n");
}
else
{
ShowMessages("this program is not designed to run in a non-VT-x "
"environemnt !\n");
return 1;
}
if (VmxSupportDetection())
{
ShowMessages("vmx operation is supported by your processor\n");
}
else
{
ShowMessages("vmx operation is not supported by your processor\n");
return 1;
}
//
// Call hprdbgrev start function
//
ReversingMachineStart();
return 0;
}
/**
* @brief Unload VMM driver
*
@ -895,28 +789,3 @@ HyperDbgUnloadVmm()
return 0;
}
/**
* @brief Unload the reversing machine driver
*
* @return int return zero if it was successful or non-zero if there
* was error
*/
HPRDBGCTRL_API int
HyperDbgUnloadReversingMachine()
{
BOOL Status;
AssertShowMessageReturnStmt(g_IsReversingMachineModulesLoaded, ASSERT_MESSAGE_DRIVER_NOT_LOADED, AssertReturnOne);
ShowMessages("start terminating...\n");
//
// Call the unloader of the hprdbgrev module
//
ReversingMachineStop();
ShowMessages("you're not on reversing machine's hypervisor anymore!\n");
return 0;
}

View file

@ -501,8 +501,8 @@ ValidateIP(const string & ip)
* @return true if vmx is supported
* @return false if vmx is not supported
*/
BOOLEAN
VmxSupportDetection()
HPRDBGCTRL_API bool
HyperDbgVmxSupportDetection()
{
//
// Call asm function

View file

@ -240,15 +240,23 @@ private:
//
const InstructionSet::InstructionSet_Internal InstructionSet::CPU_Rep;
string
ReadVendorString()
/**
* @brief Reads the CPU vendor string
*
* @return char *
*/
HPRDBGCTRL_API VOID
HyperDbgReadVendorString(char * Result)
{
return InstructionSet::Vendor();
std::string VendorString = InstructionSet::Vendor();
strcpy(Result, VendorString.c_str());
}
//
// Print out supported instruction set extensions
//
/**
* @brief Print out supported instruction set extensions
*
* @return int
*/
int
ReadCpuDetails()
{

View file

@ -18,7 +18,6 @@ extern HANDLE g_IsDriverLoadedSuccessfully;
extern HANDLE g_DeviceHandle;
extern BOOLEAN g_IsConnectedToHyperDbgLocally;
extern BOOLEAN g_IsDebuggerModulesLoaded;
extern BOOLEAN g_IsReversingMachineModulesLoaded;
/**
* @brief help of the load command
@ -36,60 +35,6 @@ CommandLoadHelp()
ShowMessages("\t\te.g : load vmm\n");
}
/**
* @brief load reversing machine module
*
* @return BOOLEAN
*/
BOOLEAN
CommandLoadReversingMachineModule()
{
BOOL Status;
HANDLE hToken;
//
// Enable Debug privilege
//
Status = OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);
if (!Status)
{
ShowMessages("err, OpenProcessToken failed (%x)\n", GetLastError());
return FALSE;
}
Status = SetPrivilege(hToken, SE_DEBUG_NAME, TRUE);
if (!Status)
{
CloseHandle(hToken);
return FALSE;
}
//
// Install RM driver
//
if (HyperDbgInstallReversingMachineDriver() == 1)
{
return FALSE;
}
if (HyperDbgLoadReversingMachine() == 1)
{
//
// No need to handle anymore
//
return FALSE;
}
//
// If we reach here so the module are loaded
//
g_IsReversingMachineModulesLoaded = TRUE;
ShowMessages("reversing machine module is running...\n");
return TRUE;
}
/**
* @brief load vmm module
*
@ -225,29 +170,6 @@ CommandLoad(vector<string> SplittedCommand, string Command)
//
SymbolLocalReload(GetCurrentProcessId());
}
else if (!SplittedCommand.at(1).compare("rev"))
{
//
// Check to make sure that the driver is not already loaded
//
if (g_DeviceHandle || g_IsDebuggerModulesLoaded)
{
ShowMessages("handle of the driver found, if you use 'load' before, please "
"first unload it then call 'unload'\n");
return;
}
//
// Load Reversing Machine Module
//
ShowMessages("loading the reversing machine's driver\n");
if (!CommandLoadReversingMachineModule())
{
ShowMessages("failed to install or load the driver\n");
return;
}
}
else
{
//

View file

@ -16,7 +16,6 @@
//
extern BOOLEAN g_IsConnectedToHyperDbgLocally;
extern BOOLEAN g_IsDebuggerModulesLoaded;
extern BOOLEAN g_IsReversingMachineModulesLoaded;
extern BOOLEAN g_IsSerialConnectedToRemoteDebuggee;
extern BOOLEAN g_IsSerialConnectedToRemoteDebugger;
@ -112,61 +111,6 @@ CommandUnload(vector<string> SplittedCommand, string Command)
ShowMessages("the driver is removed\n");
}
}
else if ((SplittedCommand.size() == 2 && !SplittedCommand.at(1).compare("rev")) || (SplittedCommand.size() == 3 && !SplittedCommand.at(2).compare("rev") && !SplittedCommand.at(1).compare("remove")))
{
if (!g_IsConnectedToHyperDbgLocally)
{
ShowMessages("you're not connected to any instance of HyperDbg, did you "
"use '.connect'? \n");
return;
}
//
// Check to avoid using this command in debugger-mode
//
if (g_IsSerialConnectedToRemoteDebuggee || g_IsSerialConnectedToRemoteDebugger)
{
ShowMessages("you're connected to a an instance of HyperDbg, you can not "
"use the reversing machine in this execution-mode, make sure "
"to use it in VMI mode\n");
return;
}
if (g_IsReversingMachineModulesLoaded)
{
HyperDbgUnloadReversingMachine();
}
else
{
ShowMessages("there is nothing to unload\n");
}
//
// Check to remove the driver
//
if (!SplittedCommand.at(1).compare("remove"))
{
//
// Stop the driver
//
if (HyperDbgStopReversingMachineDriver())
{
ShowMessages("err, failed to stop driver\n");
return;
}
//
// Uninstall the driver
//
if (HyperDbgUninstallReversingMachineDriver())
{
ShowMessages("err, failed to uninstall the driver\n");
return;
}
ShowMessages("the driver is removed\n");
}
}
else
{
//

View file

@ -40,9 +40,6 @@ CommandSettingsGetValueFromConfigFile(std::string OptionName, std::string & Opti
int
ReadCpuDetails();
string
ReadVendorString();
VOID
ShowMessages(const char * Fmt, ...);

View file

@ -22,6 +22,12 @@ extern "C" {
extern bool inline AsmVmxSupportDetection();
//
// Support Detection
//
__declspec(dllexport) bool HyperDbgVmxSupportDetection();
__declspec(dllexport) void HyperDbgReadVendorString(char *);
//
// VMM Module
//

View file

@ -355,14 +355,6 @@ BOOLEAN g_IsCommandListInitialized = FALSE;
*/
BOOLEAN g_IsDebuggerModulesLoaded = FALSE;
/**
* @brief this variable is used to indicate that modules
* are loaded so we make sure to later use a trace of
* loading in 'unload' command (used in reversing machine)
*
*/
BOOLEAN g_IsReversingMachineModulesLoaded = FALSE;
/**
* @brief State of active debugging thread
*

View file

@ -76,7 +76,7 @@
<SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<EnableUAC>false</EnableUAC>
<AdditionalDependencies>$(SolutionDir)libraries\zydis\user\Zycore.lib;$(SolutionDir)libraries\zydis\user\Zydis.lib;$(SolutionDir)build\bin\$(Configuration)\script-engine.lib;$(SolutionDir)build\bin\$(Configuration)\hprdbgrev.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalDependencies>$(SolutionDir)libraries\zydis\user\Zycore.lib;$(SolutionDir)libraries\zydis\user\Zydis.lib;$(SolutionDir)build\bin\$(Configuration)\script-engine.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
</Link>
<PostBuildEvent>
@ -108,7 +108,7 @@
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<EnableUAC>false</EnableUAC>
<AdditionalDependencies>$(SolutionDir)libraries\zydis\user\Zycore.lib;$(SolutionDir)libraries\zydis\user\Zydis.lib;$(SolutionDir)build\bin\$(Configuration)\script-engine.lib;$(SolutionDir)build\bin\$(Configuration)\hprdbgrev.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalDependencies>$(SolutionDir)libraries\zydis\user\Zycore.lib;$(SolutionDir)libraries\zydis\user\Zydis.lib;$(SolutionDir)build\bin\$(Configuration)\script-engine.lib;%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
</Link>
<PostBuildEvent>

View file

@ -161,11 +161,10 @@ typedef const wchar_t *LPCWCHAR, *PCWCHAR;
#include "..\script-eval\header\ScriptEngineHeader.h"
//
// Imports
// Imports/Exports
//
#include "SDK/Imports/HyperDbgRevImports.h"
#include "SDK/Imports/HyperDbgScriptImports.h"
#include "header/exports.h"
//
// General

View file

@ -26,7 +26,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "include", "include", "{1997
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hprdbgctrl", "hprdbgctrl\hprdbgctrl.vcxproj", "{809C3AD5-3211-4992-A472-9D81D124C5FA}"
ProjectSection(ProjectDependencies) = postProject
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4} = {991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA} = {AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}
{C2D44C60-3F23-4972-8F60-21083B9FB112} = {C2D44C60-3F23-4972-8F60-21083B9FB112}
EndProjectSection
@ -132,14 +131,6 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{D7284E
include\components\spinlock\header\Spinlock.h = include\components\spinlock\header\Spinlock.h
EndProjectSection
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hprdbgrm", "hprdbgrm\hprdbgrm.vcxproj", "{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}"
ProjectSection(ProjectDependencies) = postProject
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D} = {AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}
{BB17323A-2460-4AE1-8AFE-B367400B934F} = {BB17323A-2460-4AE1-8AFE-B367400B934F}
EndProjectSection
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hprdbgrev", "hprdbgrev\hprdbgrev.vcxproj", "{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}"
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "optimizations", "optimizations", "{165C089B-6860-4AEA-9F88-67559156C2E7}"
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "code", "code", "{FCB5111C-C7D9-4E65-8EF7-E9BB80E54B7D}"
@ -158,58 +149,164 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "header", "header", "{D82074
include\components\optimizations\header\OptimizationsExamples.h = include\components\optimizations\header\OptimizationsExamples.h
EndProjectSection
EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Examples", "Examples", "{9749520E-64FF-4633-855B-54BC541CDBB6}"
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hyperdbg_app", "include\SDK\Examples\hyperdbg_app\hprdbgrev.vcxproj", "{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}"
ProjectSection(ProjectDependencies) = postProject
{809C3AD5-3211-4992-A472-9D81D124C5FA} = {809C3AD5-3211-4992-A472-9D81D124C5FA}
{C2D44C60-3F23-4972-8F60-21083B9FB112} = {C2D44C60-3F23-4972-8F60-21083B9FB112}
EndProjectSection
EndProject
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "hyperdbg_driver", "include\SDK\Examples\hyperdbg_driver\hyperdbg_driver.vcxproj", "{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
debug|ARM64 = debug|ARM64
debug|x64 = debug|x64
debug|x86 = debug|x86
release|ARM64 = release|ARM64
release|x64 = release|x64
release|x86 = release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.debug|ARM64.ActiveCfg = debug|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.debug|ARM64.Build.0 = debug|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.debug|x64.ActiveCfg = debug|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.debug|x64.Build.0 = debug|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.debug|x86.ActiveCfg = debug|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.debug|x86.Build.0 = debug|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.release|ARM64.ActiveCfg = release|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.release|ARM64.Build.0 = release|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.release|x64.ActiveCfg = release|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.release|x64.Build.0 = release|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.release|x86.ActiveCfg = release|x64
{FBCBBBAD-4EAE-469E-827F-F59FE9E7375B}.release|x86.Build.0 = release|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.debug|ARM64.ActiveCfg = debug|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.debug|ARM64.Build.0 = debug|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.debug|x64.ActiveCfg = debug|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.debug|x64.Build.0 = debug|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.debug|x86.ActiveCfg = debug|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.debug|x86.Build.0 = debug|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.release|ARM64.ActiveCfg = release|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.release|ARM64.Build.0 = release|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.release|x64.ActiveCfg = release|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.release|x64.Build.0 = release|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.release|x86.ActiveCfg = release|x64
{BB17323A-2460-4AE1-8AFE-B367400B934F}.release|x86.Build.0 = release|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.debug|ARM64.ActiveCfg = debug|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.debug|ARM64.Build.0 = debug|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.debug|x64.ActiveCfg = debug|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.debug|x64.Build.0 = debug|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.debug|x86.ActiveCfg = debug|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.debug|x86.Build.0 = debug|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.release|ARM64.ActiveCfg = release|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.release|ARM64.Build.0 = release|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.release|x64.ActiveCfg = release|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.release|x64.Build.0 = release|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.release|x86.ActiveCfg = release|x64
{809C3AD5-3211-4992-A472-9D81D124C5FA}.release|x86.Build.0 = release|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.debug|ARM64.ActiveCfg = debug|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.debug|ARM64.Build.0 = debug|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.debug|x64.ActiveCfg = debug|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.debug|x86.ActiveCfg = debug|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.debug|x86.Build.0 = debug|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.release|ARM64.ActiveCfg = release|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.release|ARM64.Build.0 = release|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.release|x64.ActiveCfg = release|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.release|x86.ActiveCfg = release|x64
{C3DC85E1-0559-4B58-9792-DE421472DFE9}.release|x86.Build.0 = release|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.debug|ARM64.ActiveCfg = debug|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.debug|ARM64.Build.0 = debug|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.debug|x64.ActiveCfg = debug|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.debug|x64.Build.0 = debug|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.debug|x86.ActiveCfg = debug|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.debug|x86.Build.0 = debug|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.release|ARM64.ActiveCfg = release|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.release|ARM64.Build.0 = release|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.release|x64.ActiveCfg = release|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.release|x64.Build.0 = release|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.release|x86.ActiveCfg = release|x64
{C2D44C60-3F23-4972-8F60-21083B9FB112}.release|x86.Build.0 = release|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.debug|ARM64.ActiveCfg = debug|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.debug|ARM64.Build.0 = debug|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.debug|x64.ActiveCfg = debug|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.debug|x64.Build.0 = debug|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.debug|x86.ActiveCfg = debug|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.debug|x86.Build.0 = debug|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.release|ARM64.ActiveCfg = release|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.release|ARM64.Build.0 = release|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.release|x64.ActiveCfg = release|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.release|x64.Build.0 = release|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.release|x86.ActiveCfg = release|x64
{2D988267-CC53-41E3-936A-48CEF9049DF5}.release|x86.Build.0 = release|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.debug|ARM64.ActiveCfg = debug|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.debug|ARM64.Build.0 = debug|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.debug|x64.ActiveCfg = debug|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.debug|x64.Build.0 = debug|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.debug|x86.ActiveCfg = debug|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.debug|x86.Build.0 = debug|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.release|ARM64.ActiveCfg = release|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.release|ARM64.Build.0 = release|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.release|x64.ActiveCfg = release|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.release|x64.Build.0 = release|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.release|x86.ActiveCfg = release|x64
{9CA3E213-C43F-4C1D-A6ED-C6FC568D691B}.release|x86.Build.0 = release|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.debug|ARM64.ActiveCfg = debug|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.debug|ARM64.Build.0 = debug|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.debug|x64.ActiveCfg = debug|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.debug|x64.Build.0 = debug|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.debug|x86.ActiveCfg = debug|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.debug|x86.Build.0 = debug|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.release|ARM64.ActiveCfg = release|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.release|ARM64.Build.0 = release|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.release|x64.ActiveCfg = release|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.release|x64.Build.0 = release|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.release|x86.ActiveCfg = release|x64
{06FB1AF7-647C-4BA4-860A-4533763440F9}.release|x86.Build.0 = release|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.debug|ARM64.ActiveCfg = debug|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.debug|ARM64.Build.0 = debug|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.debug|x64.ActiveCfg = debug|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.debug|x64.Build.0 = debug|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.debug|x86.ActiveCfg = debug|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.debug|x86.Build.0 = debug|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.release|ARM64.ActiveCfg = release|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.release|ARM64.Build.0 = release|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.release|x64.ActiveCfg = release|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.release|x64.Build.0 = release|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.release|x86.ActiveCfg = release|x64
{AFDD7028-1ED9-442E-8A3D-01CFA3AA1CAA}.release|x86.Build.0 = release|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.debug|ARM64.ActiveCfg = debug|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.debug|ARM64.Build.0 = debug|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.debug|x64.ActiveCfg = debug|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.debug|x64.Build.0 = debug|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.debug|x86.ActiveCfg = debug|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.debug|x86.Build.0 = debug|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.release|ARM64.ActiveCfg = release|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.release|ARM64.Build.0 = release|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.release|x64.ActiveCfg = release|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.release|x64.Build.0 = release|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.debug|x64.ActiveCfg = debug|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.debug|x64.Build.0 = debug|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.release|x64.ActiveCfg = release|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.release|x64.Build.0 = release|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.release|x86.ActiveCfg = release|x64
{AFDE69E9-EE3D-470E-8407-C1F0D98F9E3D}.release|x86.Build.0 = release|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.debug|ARM64.ActiveCfg = debug|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.debug|ARM64.Build.0 = debug|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.debug|x64.ActiveCfg = debug|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.debug|x64.Build.0 = debug|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.debug|x86.ActiveCfg = debug|Win32
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.debug|x86.Build.0 = debug|Win32
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.release|ARM64.ActiveCfg = release|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.release|ARM64.Build.0 = release|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.release|x64.ActiveCfg = release|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.release|x64.Build.0 = release|x64
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.release|x86.ActiveCfg = release|Win32
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4}.release|x86.Build.0 = release|Win32
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.debug|ARM64.ActiveCfg = debug|ARM64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.debug|ARM64.Build.0 = debug|ARM64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.debug|x64.ActiveCfg = debug|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.debug|x86.ActiveCfg = debug|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.debug|x86.Build.0 = debug|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.release|ARM64.ActiveCfg = release|ARM64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.release|ARM64.Build.0 = release|ARM64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.release|x64.ActiveCfg = release|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.release|x86.ActiveCfg = release|x64
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5}.release|x86.Build.0 = release|x64
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
@ -230,6 +327,9 @@ Global
{165C089B-6860-4AEA-9F88-67559156C2E7} = {DF15E9D4-976B-4E1D-B68F-9B67F93654BF}
{FCB5111C-C7D9-4E65-8EF7-E9BB80E54B7D} = {165C089B-6860-4AEA-9F88-67559156C2E7}
{D8207406-263E-4831-A8E9-20C4ECE5CA15} = {165C089B-6860-4AEA-9F88-67559156C2E7}
{9749520E-64FF-4633-855B-54BC541CDBB6} = {1997E4B6-FE49-4358-ADF1-CDDB5739508E}
{991B8FA7-F75E-4D8A-A0BD-636FE68B6AF4} = {9749520E-64FF-4633-855B-54BC541CDBB6}
{79AB8BD3-03A4-4B65-ABF6-313C10A00CC5} = {9749520E-64FF-4633-855B-54BC541CDBB6}
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {1444BEC7-11CE-4CA6-B77C-5F98AC9BFAEB}

View file

@ -39,12 +39,6 @@
*/
#define KERNEL_DEBUGGER_DRIVER_NAME "hprdbgkd"
/**
* @brief name of HyperDbg's Reversing Machine driver
*
*/
#define KERNEL_REVERSING_MACHINE_DRIVER_NAME "hprdbgrm"
//////////////////////////////////////////////////
// Test Cases //
//////////////////////////////////////////////////

View file

@ -1,23 +0,0 @@
import ctypes
# Load HyperDbg CTRL into memory
hllDll = ctypes.WinDLL ("build\\bin\\release\\..\\..\\..\\HPRDBGCTRL.dll")
# Set up prototype and parameters for the desired function call
# HLLAPI
ApiProto = ctypes.WINFUNCTYPE (
ctypes.c_int, # Return type.
)
hllApiParams = (1, "p1", 0), (1, "p2", 0), (1, "p3",0), (1, "p4",0),
# Actually map the call ("HLLAPI(...)") to a Python name
hllApi = ApiProto (("HyperDbgInstallVmmDriver", hllDll), hllApiParams)
# This is how you can actually call the DLL function
# Set up the variables and call the Python name with them
p1 = ctypes.c_int (1)
hllApi (ctypes.byref (p1), p2, ctypes.byref (p3), ctypes.byref (p4))

View file

@ -1,5 +1,5 @@
/**
* @file hprdbgrmctrl.h
* @file hyperdbg-app.cpp
* @author Sina Karvandi (sina@hyperdbg.org)
* @brief Controller of the reversing machine's module
* @details
@ -48,6 +48,7 @@ BOOLEAN g_IsReversingMachineModulesLoaded;
*/
BOOLEAN g_IsVmxOffProcessStart;
/*
#ifdef __cplusplus
extern "C" {
#endif
@ -58,6 +59,7 @@ __declspec(dllexport) int ReversingMachineStop();
#ifdef __cplusplus
}
#endif
*/
/**
* @brief Show messages
@ -360,3 +362,110 @@ ReversingMachineStart()
//
return 0;
}
/**
* @brief Unload the reversing machine driver
*
* @return int return zero if it was successful or non-zero if there
* was error
*/
int
HyperDbgUnloadReversingMachine()
{
BOOL Status;
//
// Check if driver is loaded
//
if (!g_IsReversingMachineModulesLoaded)
{
ShowMessages("handle of the driver not found, probably the driver is not loaded. Did you use 'load' command?\n");
return 1;
}
ShowMessages("start terminating...\n");
//
// Call the unloader of the hprdbgrev module
//
ReversingMachineStop();
ShowMessages("you're not on reversing machine's hypervisor anymore!\n");
return 0;
}
/**
* @brief Load the reversing machine driver
*
* @return int return zero if it was successful or non-zero if there
* was error
*/
int
HyperDbgLoadReversingMachine()
{
char CpuId[13] = {0};
if (g_DeviceHandle)
{
ShowMessages("handle of the driver found, if you use 'load' before, please "
"unload it using 'unload'\n");
return 1;
}
//
// Read the vendor string
//
HyperDbgReadVendorString(CpuId);
ShowMessages("current processor vendor is : %s\n", CpuId);
if (strcmp(CpuId, "GenuineIntel") == 0)
{
ShowMessages("virtualization technology is vt-x\n");
}
else
{
ShowMessages("this program is not designed to run in a non-VT-x "
"environemnt !\n");
return 1;
}
if (HyperDbgVmxSupportDetection())
{
ShowMessages("vmx operation is supported by your processor\n");
}
else
{
ShowMessages("vmx operation is not supported by your processor\n");
return 1;
}
//
// Call hprdbgrev start function
//
ReversingMachineStart();
return 0;
}
/**
* @brief main function
*
* @return int
*/
int
main()
{
if (HyperDbgLoadReversingMachine() == 0)
{
//
// HyperDbg driver loaded successfully
//
HyperDbgUnloadReversingMachine();
}
else
{
ShowMessages("err, in loading HyperDbg\n");
}
}

View file

@ -31,9 +31,11 @@
#include <iostream>
#include <stdio.h>
#include <string>
//
// HyperDbg SDK headers
//
#include "Definition.h"
#include "SDK/HyperDbgSdk.h"
#include "../../../../../hprdbgctrl/header/exports.h"

View file

@ -19,17 +19,18 @@
</ProjectConfiguration>
</ItemGroup>
<ItemGroup>
<ClCompile Include="code\hprdbgrev.cpp" />
<ClInclude Include="header\pch.h" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="header\pch.h" />
<ClCompile Include="code\hyperdbg-app.cpp" />
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{991b8fa7-f75e-4d8a-a0bd-636fe68b6af4}</ProjectGuid>
<RootNamespace>hprdbgrev</RootNamespace>
<RootNamespace>hyperdbg_app</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
<ProjectName>hyperdbg_app</ProjectName>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='debug|Win32'" Label="Configuration">
@ -46,13 +47,13 @@
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='debug|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='release|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
@ -126,6 +127,7 @@
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>$(SolutionDir)build\bin\$(Configuration)\hprdbgctrl.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='release|x64'">
@ -146,6 +148,7 @@
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>$(SolutionDir)build\bin\$(Configuration)\hprdbgctrl.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

View file

@ -8,14 +8,14 @@
<UniqueIdentifier>{c40916c8-414b-486b-bfd1-13bcbafd8fa1}</UniqueIdentifier>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="code\hprdbgrev.cpp">
<Filter>code</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="header\pch.h">
<Filter>header</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<ClCompile Include="code\hyperdbg-app.cpp">
<Filter>code</Filter>
</ClCompile>
</ItemGroup>
</Project>

View file

@ -25,7 +25,7 @@
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
<Configuration>Debug</Configuration>
<Platform Condition="'$(Platform)' == ''">x64</Platform>
<RootNamespace>hprdbgrm</RootNamespace>
<RootNamespace>hyperdbg_driver</RootNamespace>
<WindowsTargetPlatformVersion>$(LatestTargetPlatformVersion)</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />

View file

@ -27,24 +27,15 @@ __declspec(dllimport) int HyperDbgInstallVmmDriver();
__declspec(dllimport) int HyperDbgUninstallVmmDriver();
__declspec(dllimport) int HyperDbgStopVmmDriver();
//
// Reversing Machine Module
//
__declspec(dllimport) int HyperDbgLoadReversingMachine();
__declspec(dllimport) int HyperDbgUnloadReversingMachine();
__declspec(dllimport) int HyperDbgInstallReversingMachineDriver();
__declspec(dllimport) int HyperDbgUninstallReversingMachineDriver();
__declspec(dllimport) int HyperDbgStopReversingMachineDriver();
//
// General imports
//
__declspec(dllimport) int HyperDbgInterpreter(char* Command);
__declspec(dllimport) int HyperDbgInterpreter(char * Command);
__declspec(dllimport) void HyperDbgShowSignature();
__declspec(dllimport) void HyperDbgSetTextMessageCallback(Callback handler);
__declspec(dllimport) int HyperDbgScriptReadFileAndExecuteCommandline(int argc, char* argv[]);
__declspec(dllimport) int HyperDbgScriptReadFileAndExecuteCommandline(int argc, char * argv[]);
__declspec(dllimport) bool HyperDbgContinuePreviousCommand();
__declspec(dllimport) bool HyperDbgCheckMultilineCommand(char* CurrentCommand, bool Reset);
__declspec(dllimport) bool HyperDbgCheckMultilineCommand(char * CurrentCommand, bool Reset);
#ifdef __cplusplus
}