/** * @file kd.h * @author Sina Karvandi (sina@hyperdbg.org) * @brief routines for remote kernel debugging * @details * @version 0.1 * @date 2020-12-22 * * @copyright This project is released under the GNU Public License v3. * */ #pragma once ////////////////////////////////////////////////// // Display Windows Details // ////////////////////////////////////////////////// #ifdef _WIN32 // HKEY / RegCloseKey are Windows registry APIs; this RAII helper is Windows-only struct HKeyHolder { private: HKEY m_Key; public: HKeyHolder() : m_Key(nullptr) { } HKeyHolder(const HKeyHolder &) = delete; HKeyHolder & operator=(const HKeyHolder &) = delete; ~HKeyHolder() { if (m_Key != nullptr) RegCloseKey(m_Key); } operator HKEY() const { return m_Key; } HKEY * operator&() { return &m_Key; } }; #endif // _WIN32 ////////////////////////////////////////////////// // enums // ////////////////////////////////////////////////// /** * @brief Type of resync * */ typedef enum _DEBUGGER_PACKET_RESYNC_ENUM { DEBUGGER_PACKET_RESYNC_DEBUGGEE, DEBUGGER_PACKET_RESYNC_DEBUGGER, DEBUGGER_PACKET_RESYNC_LISTENING } DEBUGGER_PACKET_RESYNC_ENUM; ////////////////////////////////////////////////// // Functions // ////////////////////////////////////////////////// BOOLEAN KdCommandPacketToDebuggee( DEBUGGER_REMOTE_PACKET_TYPE PacketType, DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction); BOOLEAN KdCommandPacketAndBufferToDebuggee( DEBUGGER_REMOTE_PACKET_TYPE PacketType, DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction, CHAR * Buffer, UINT32 BufferLength); BOOLEAN KdPrepareSerialConnectionToRemoteSystem(HANDLE SerialHandle, BOOLEAN IsNamedPipe, BOOLEAN PauseAfterConnection); BOOLEAN KdPrepareAndConnectDebugPort(const CHAR * PortName, DWORD Baudrate, UINT32 Port, BOOLEAN IsPreparing, BOOLEAN IsNamedPipe, BOOLEAN PauseAfterConnection); BOOLEAN KdSendPacketToDebuggee(const CHAR * Buffer, UINT32 Length, BOOLEAN SendEndOfBuffer); BOOLEAN KdReceivePacketFromDebuggee(CHAR * BufferToSave, UINT32 * LengthReceived); BOOLEAN KdReceivePacketFromDebugger(CHAR * BufferToSave, UINT32 * LengthReceived); BOOLEAN KdCheckForTheEndOfTheBuffer(PUINT32 CurrentLoopIndex, BYTE * Buffer); BOOLEAN KdSendSwitchCorePacketToDebuggee(UINT32 NewCore); BOOLEAN KdSendShortCircuitingEventToDebuggee(BOOLEAN IsEnabled); BOOLEAN KdSendEventQueryAndModifyPacketToDebuggee( UINT64 Tag, DEBUGGER_MODIFY_EVENTS_TYPE TypeOfAction, BOOLEAN * IsEnabled); BOOLEAN KdSendFlushPacketToDebuggee(); BOOLEAN KdSendUserCpuidPacketToDebuggee(UINT32 FunctionId, UINT32 SubFunctionId); BOOLEAN KdSendUserInPacketToDebuggee(DEBUGGER_USER_IN_REQUEST_RESPONSE InRequest); BOOLEAN KdSendUserOutPacketToDebuggee(DEBUGGER_USER_OUT_REQUEST_RESPONSE OutRequest); BOOLEAN KdSendCallStackPacketToDebuggee(UINT64 BaseAddress, UINT32 Size, DEBUGGER_CALLSTACK_DISPLAY_METHOD DisplayMethod, BOOLEAN Is32Bit); BOOLEAN KdSendTestQueryPacketToDebuggee(DEBUGGER_TEST_QUERY_STATE Type); BOOLEAN KdSendTestQueryPacketWithContextToDebuggee(DEBUGGER_TEST_QUERY_STATE Type, UINT64 Context); BOOLEAN KdSendSymbolReloadPacketToDebuggee(UINT32 ProcessId); BOOLEAN KdSendReadRegisterPacketToDebuggee(PDEBUGGEE_REGISTER_READ_DESCRIPTION RegDes, UINT32 RegBuffSize); BOOLEAN KdSendWriteRegisterPacketToDebuggee(PDEBUGGEE_REGISTER_WRITE_DESCRIPTION RegDes); BOOLEAN KdSendReadMemoryPacketToDebuggee(PDEBUGGER_READ_MEMORY ReadMem, UINT32 RequestSize); BOOLEAN KdSendEditMemoryPacketToDebuggee(PDEBUGGER_EDIT_MEMORY EditMem, UINT32 Size); PDEBUGGER_EVENT_AND_ACTION_RESULT KdSendRegisterEventPacketToDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL Event, UINT32 EventBufferLength); PDEBUGGER_EVENT_AND_ACTION_RESULT KdSendAddActionToEventPacketToDebuggee(PDEBUGGER_GENERAL_ACTION GeneralAction, UINT32 GeneralActionLength); BOOLEAN KdSendSwitchProcessPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_PROCESS_TYPE ActionType, UINT32 NewPid, UINT64 NewProcess, BOOLEAN SetChangeByClockInterrupt, PDEBUGGEE_PROCESS_LIST_NEEDED_DETAILS SymDetailsForProcessList); BOOLEAN KdSendSwitchThreadPacketToDebuggee(DEBUGGEE_DETAILS_AND_SWITCH_THREAD_TYPE ActionType, UINT32 NewTid, UINT64 NewThread, BOOLEAN CheckByClockInterrupt, PDEBUGGEE_THREAD_LIST_NEEDED_DETAILS SymDetailsForThreadList); BOOLEAN KdSendBpPacketToDebuggee(PDEBUGGEE_BP_PACKET BpPacket); BOOLEAN KdSendVa2paAndPa2vaPacketToDebuggee(PDEBUGGER_VA2PA_AND_PA2VA_COMMANDS Va2paAndPa2vaPacket); BOOLEAN KdSendApicActionPacketsToDebuggee(PDEBUGGER_APIC_REQUEST ApicRequest, UINT32 ExpectedRequestSize); BOOLEAN KdSendSmiPacketsToDebuggee(PSMI_OPERATION_PACKETS SmiOperationRequest, UINT32 ExpectedRequestSize); BOOLEAN KdSendHyperTraceLbrdumpPacketsToDebuggee(PHYPERTRACE_LBR_DUMP_PACKETS HyperTraceLbrdumpRequest, UINT32 ExpectedRequestSize); BOOLEAN KdSendHyperTracePtPacketsToDebuggee(PHYPERTRACE_PT_OPERATION_PACKETS HyperTracePtOperationRequest, UINT32 ExpectedRequestSize); BOOLEAN KdSendQueryIdtPacketsToDebuggee(PINTERRUPT_DESCRIPTOR_TABLE_ENTRIES_PACKETS IdtRequest); BOOLEAN KdSendPtePacketToDebuggee(PDEBUGGER_READ_PAGE_TABLE_ENTRIES_DETAILS PtePacket); BOOLEAN KdSendPageinPacketToDebuggee(PDEBUGGER_PAGE_IN_REQUEST PageinPacket); BOOLEAN KdSendListOrModifyPacketToDebuggee( PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET ListOrModifyPacket); BOOLEAN KdSendScriptPacketToDebuggee(UINT64 BufferAddress, UINT32 BufferLength, UINT32 Pointer, BOOLEAN IsFormat); BOOLEAN KdSendUserInputPacketToDebuggee(const CHAR * Sendbuf, INT Len, BOOLEAN IgnoreBreakingAgain); BOOLEAN KdSendSearchRequestPacketToDebuggee(UINT64 * SearchRequestBuffer, UINT32 SearchRequestBufferSize); BOOLEAN KdSendStepPacketToDebuggee(DEBUGGER_REMOTE_STEPPING_REQUEST StepRequestType); BYTE KdComputeDataChecksum(PVOID Buffer, UINT32 Length); BOOLEAN KdRegisterEventInDebuggee(PDEBUGGER_GENERAL_EVENT_DETAIL EventRegBuffer, UINT32 Length); BOOLEAN KdAddActionToEventInDebuggee(PDEBUGGER_GENERAL_ACTION ActionAddingBuffer, UINT32 Length); BOOLEAN KdSendModifyEventInDebuggee(PDEBUGGER_MODIFY_EVENTS ModifyEvent, BOOLEAN SendTheResultBackToDebugger); BOOLEAN KdSendGeneralBuffersFromDebuggeeToDebugger( DEBUGGER_REMOTE_PACKET_REQUESTED_ACTION RequestedAction, PVOID Buffer, UINT32 BufferLength, BOOLEAN PauseDebuggeeWhenSent); BOOLEAN KdCloseConnection(); BOOLEAN KdReloadSymbolsInDebuggee(BOOLEAN PauseDebuggee, UINT32 UserProcessId); BOOLEAN KdSendResponseOfThePingPacket(); BOOLEAN KdSendPcitreePacketToDebuggee(PDEBUGGEE_PCITREE_REQUEST_RESPONSE_PACKET PcitreePacket); BOOLEAN KdSendPcidevinfoPacketToDebuggee(PDEBUGGEE_PCIDEVINFO_REQUEST_RESPONSE_PACKET PcidevinfoPacket); BOOLEAN KdResyncStreamToNextFrame(DEBUGGER_PACKET_RESYNC_ENUM ReSyncType); VOID KdUninitializeConnection(); VOID KdSendUsermodePrints(CHAR * Input, UINT32 Length); VOID KdSendSymbolDetailPacket(PMODULE_SYMBOL_DETAIL SymbolDetailPacket, UINT32 CurrentSymbolInfoIndex, UINT32 TotalSymbols); VOID KdHandleUserInputInDebuggee(DEBUGGEE_USER_INPUT_PACKET * Descriptor); VOID KdTheRemoteSystemIsRunning(); VOID KdBreakControlCheckAndPauseDebugger(BOOLEAN SignalRunningFlag); VOID KdBreakControlCheckAndContinueDebugger(); VOID KdSetStatusAndWaitForPause();