Attaching.c File Reference

Attaching and detaching for debugging user-mode processes. More...

#include "pch.h"

Functions
BOOLEAN	AttachingInitialize ()
	Initialize the attaching mechanism.
UINT64	AttachingCreateProcessDebuggingDetails (UINT32 ProcessId, BOOLEAN Enabled, BOOLEAN Is32Bit, BOOLEAN CheckCallbackAtFirstInstruction, PEPROCESS Eprocess, UINT64 PebAddressToMonitor)
	Create user-mode debugging details for threads.
PUSERMODE_DEBUGGING_PROCESS_DETAILS	AttachingFindProcessDebuggingDetailsByToken (UINT64 Token)
	Find user-mode debugging details for threads by token.
PUSERMODE_DEBUGGING_PROCESS_DETAILS	AttachingFindProcessDebuggingDetailsByProcessId (UINT32 ProcessId)
	Find user-mode debugging details for threads by process Id.
PUSERMODE_DEBUGGING_PROCESS_DETAILS	AttachingFindProcessDebuggingDetailsInStartingPhase ()
	Find user-mode debugging details for threads that is in the start-up phase.
VOID	AttachingRemoveAndFreeAllProcessDebuggingDetails ()
	Remove and deallocate all thread debuggig details.
BOOLEAN	AttachingRemoveProcessDebuggingDetailsByToken (UINT64 Token)
	Remove user-mode debugging details for threads by its token.
BOOLEAN	AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken (BOOLEAN Set, UINT64 Token)
	Set the start up phase of a debugging thread buffer by its token.
BOOLEAN	AttachingReachedToValidLoadedModule (PROCESSOR_DEBUGGING_STATE *DbgState, PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail)
	Handle cases where we reached to the valid loaded module The main module should be loaded once we reach to this function.
VOID	AttachingHandleEntrypointInterception (PROCESSOR_DEBUGGING_STATE *DbgState)
	Handle the interception of finding the entrypoint on attaching to user-mode process.
BOOLEAN	AttachingAdjustNopSledBuffer (UINT64 ReservedBuffAddress, UINT32 ProcessId)
	Allocate a nop-sled buffer.
BOOLEAN	AttachingCheckThreadInterceptionWithUserDebugger (UINT32 CoreId)
	Check thread interceptions with user-mode debugger.
BOOLEAN	AttachingConfigureInterceptingThreads (UINT64 ProcessDebuggingToken, BOOLEAN Enable)
	Enable or disable the thread intercepting phase.
BOOLEAN	AttachingCheckForSafeCallbackRequestedInitializations (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS AttachRequest, UINT64 ProcessDebuggingToken)
	This function checks whether any special initialization is needed while attaching to a process that requests a callback.
BOOLEAN	AttachingPerformAttachToProcess (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS AttachRequest, BOOLEAN IsAttachingToEntrypoint)
	Attach to the target process.
BOOLEAN	AttachingCheckUnhandledEptViolation (UINT32 CoreId, UINT64 ViolationQualification, UINT64 GuestPhysicalAddr)
	handling unhandled EPT violations
BOOLEAN	AttachingRemoveHooks (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS AttachRequest)
	Clearing hooks after resuming the process.
BOOLEAN	AttachingPauseProcess (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS PauseRequest)
	Pauses the target process.
BOOLEAN	AttachingContinueProcess (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS ContinueRequest)
	Continues the target process.
BOOLEAN	AttachingKillProcess (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS KillRequest)
	Kill the target process from kernel-mode.
BOOLEAN	AttachingPerformDetach (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS DetachRequest)
	Clearing hooks after resuming the process.
BOOLEAN	AttachingSwitchProcess (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS SwitchRequest)
	Switch to the target thread.
BOOLEAN	AttachingQueryCountOfActiveDebuggingThreadsAndProcesses (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS QueryCountOfDebugThreadsRequest)
	Query count of active debugging threads.
BOOLEAN	AttachingQueryDetailsOfActiveDebuggingThreadsAndProcesses (PVOID BufferToStoreDetails, UINT32 BufferSize)
	Query details of active debugging threads.
VOID	AttachingTargetProcess (PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS Request)
	Dispatch and perform attaching tasks.

Detailed Description

Attaching and detaching for debugging user-mode processes.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-12-28

Copyright

This project is released under the GNU Public License v3.

Function Documentation

AttachingAdjustNopSledBuffer()

BOOLEAN AttachingAdjustNopSledBuffer	(	UINT64	ReservedBuffAddress,
		UINT32	ProcessId )

Allocate a nop-sled buffer.

Parameters

ReservedBuffAddress
ProcessId

Returns

BOOLEAN

{
    PEPROCESS  SourceProcess;
    KAPC_STATE State = {0};
 
    if (PsLookupProcessByProcessId((HANDLE)ProcessId, &SourceProcess) != STATUS_SUCCESS)
    {
        //
        // if the process not found
        //
        return FALSE;
    }
 
    __try
    {
        KeStackAttachProcess(SourceProcess, &State);
 
        //
        // Fill the memory with nops
        //
        memset((PVOID)ReservedBuffAddress, 0x90, PAGE_SIZE);
 
        //
        // Set jmps to form a loop (little endians)
        //
        // Disassembly of section .text:
        // 0000000000000000 <NopLoop>:
        // 0:  90                      nop
        // 1:  90                      nop
        // 2:  90                      nop
        // 3:  90                      nop
        // 4:  90                      nop
        // 5:  90                      nop
        // 6:  90                      nop
        // 7:  90                      nop
        // 8:  0f a2                   cpuid
        // a:  eb f4                   jmp    0 <NopLoop>
        //
        *(UINT16 *)(ReservedBuffAddress + PAGE_SIZE - 4) = 0xa20f;
        *(UINT16 *)(ReservedBuffAddress + PAGE_SIZE - 2) = 0xf4eb;
 
        KeUnstackDetachProcess(&State);
 
        ObDereferenceObject(SourceProcess);
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        KeUnstackDetachProcess(&State);
 
        return FALSE;
    }
 
    return TRUE;
}

AttachingCheckForSafeCallbackRequestedInitializations()

BOOLEAN AttachingCheckForSafeCallbackRequestedInitializations	(	PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS	AttachRequest,
		UINT64	ProcessDebuggingToken )

This function checks whether any special initialization is needed while attaching to a process that requests a callback.

this function should not be called in vmx-root

Parameters

AttachRequest
ProcessDebuggingToken

Returns

BOOLEAN

{
    UNREFERENCED_PARAMETER(AttachRequest);
    UNREFERENCED_PARAMETER(ProcessDebuggingToken);
 
    //
    // Enable the memory access logging
    //
    ConfigureInitializeExecTrapOnAllProcessors();
 
    return TRUE;
}

AttachingCheckThreadInterceptionWithUserDebugger()

BOOLEAN AttachingCheckThreadInterceptionWithUserDebugger

(

UINT32

CoreId

)

Check thread interceptions with user-mode debugger.

Parameters

CoreId

Returns

BOOLEAN if TRUE show that the thread interceptin is handled otherwise FALSE

{
    PROCESSOR_DEBUGGING_STATE *         DbgState = &g_DbgState[CoreId];
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
 
    //
    // Check whether user-debugger is initialized or not
    //
    if (!g_UserDebuggerState)
    {
        return FALSE;
    }
 
    ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(HANDLE_TO_UINT32(PsGetCurrentProcessId()));
 
    //
    // Check if the process debugging detail is found
    //
    if (!ProcessDebuggingDetail)
    {
        //
        // not related to user debugger
        //
        return FALSE;
    }
 
    //
    // Check if thread is in the intercepting phase
    //
    if (ProcessDebuggingDetail->IsOnThreadInterceptingPhase)
    {
        //
        // Handling state through the user-mode debugger
        //
        if (UdCheckAndHandleBreakpointsAndDebugBreaks(DbgState,
                                                      DEBUGGEE_PAUSING_REASON_DEBUGGEE_GENERAL_THREAD_INTERCEPTED,
                                                      NULL))
        {
            //
            // Check for possible commands that need to be executed
            //
            UdCheckForCommand(DbgState, ProcessDebuggingDetail);
 
            return TRUE;
        }
    }
 
    //
    // this thread is not in intercepting phase
    //
    return FALSE;
}

AttachingCheckUnhandledEptViolation()

BOOLEAN AttachingCheckUnhandledEptViolation	(	UINT32	CoreId,
		UINT64	ViolationQualification,
		UINT64	GuestPhysicalAddr )

handling unhandled EPT violations

Parameters

CoreId
ViolationQualification
GuestPhysicalAddr

Returns

BOOLEAN

{
    UNREFERENCED_PARAMETER(CoreId);
    UNREFERENCED_PARAMETER(ViolationQualification);
    UNREFERENCED_PARAMETER(GuestPhysicalAddr);
 
    //
    // Not handled here
    //
    return FALSE;
}

AttachingConfigureInterceptingThreads()

BOOLEAN AttachingConfigureInterceptingThreads	(	UINT64	ProcessDebuggingToken,
		BOOLEAN	Enable )

Enable or disable the thread intercepting phase.

this function should be called in vmx non-root

Parameters

ProcessDebuggingToken
Enable

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
 
    //
    // Get the current process debugging detail
    //
    ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByToken(ProcessDebuggingToken);
 
    if (!ProcessDebuggingDetail)
    {
        return FALSE;
    }
 
    //
    // If the thread is already in intercepting phase, we should return,
    //
    if (Enable && ProcessDebuggingDetail->IsOnThreadInterceptingPhase)
    {
        LogError("Err, thread is already in intercepting phase");
        return FALSE;
    }
 
    //
    // We're or we're not in thread intercepting phase now
    //
    ProcessDebuggingDetail->IsOnThreadInterceptingPhase = Enable;
 
    //
    // Intercepting threads is enabled
    //
    if (Enable)
    {
        //
        // Add the process to the watching list to be able to intercept the threads
        //
        ConfigureExecTrapAddProcessToWatchingList(ProcessDebuggingDetail->ProcessId);
    }
    else
    {
        //
        // Unpause the threads of the target process
        //
        ThreadHolderUnpauseAllThreadsInProcess(ProcessDebuggingDetail);
 
        //
        // Remove the process from the watching list
        //
        ConfigureExecTrapRemoveProcessFromWatchingList(ProcessDebuggingDetail->ProcessId);
    }
 
    return TRUE;
}

AttachingContinueProcess()

BOOLEAN AttachingContinueProcess

(

PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS

ContinueRequest

)

Continues the target process.

this function should not be called in vmx-root

Parameters

ContinueRequest

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails;
 
    //
    // Get the thread debugging detail
    //
    ProcessDebuggingDetails = AttachingFindProcessDebuggingDetailsByToken(ContinueRequest->Token);
 
    //
    // Check if token is valid or not
    //
    if (!ProcessDebuggingDetails)
    {
        ContinueRequest->Result = DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN;
        return FALSE;
    }
 
    //
    // Configure the intercepting threads to be disabled
    //
    if (AttachingConfigureInterceptingThreads(ContinueRequest->Token, FALSE))
    {
        //
        // The continuing operation was successful
        //
        ContinueRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
        return TRUE;
    }
    else
    {
        ContinueRequest->Result = DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS;
        return FALSE;
    }
}

AttachingCreateProcessDebuggingDetails()

UINT64 AttachingCreateProcessDebuggingDetails	(	UINT32	ProcessId,
		BOOLEAN	Enabled,
		BOOLEAN	Is32Bit,
		BOOLEAN	CheckCallbackAtFirstInstruction,
		PEPROCESS	Eprocess,
		UINT64	PebAddressToMonitor )

Create user-mode debugging details for threads.

Parameters

ProcessId
Is32Bit
Eprocess
PebAddressToMonitor

Returns

UINT64 returns the unique token

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
 
    //
    // Allocate the buffer
    //
    ProcessDebuggingDetail = (USERMODE_DEBUGGING_PROCESS_DETAILS *)
        PlatformMemAllocateZeroedNonPagedPool(sizeof(USERMODE_DEBUGGING_PROCESS_DETAILS));
 
    if (!ProcessDebuggingDetail)
    {
        return (UINT64)NULL;
    }
 
    //
    // Set the unique tag and increment it
    //
    ProcessDebuggingDetail->Token = g_SeedOfUserDebuggingDetails++;
 
    //
    // Set the details of the created buffer
    //
    ProcessDebuggingDetail->ProcessId                                    = ProcessId;
    ProcessDebuggingDetail->Enabled                                      = Enabled;
    ProcessDebuggingDetail->Is32Bit                                      = Is32Bit;
    ProcessDebuggingDetail->CheckCallBackForInterceptingFirstInstruction = CheckCallbackAtFirstInstruction;
    ProcessDebuggingDetail->Eprocess                                     = Eprocess;
    ProcessDebuggingDetail->PebAddressToMonitor                          = (PVOID)PebAddressToMonitor;
 
    //
    // Allocate a thread holder buffer for this process
    //
    if (!ThreadHolderAssignThreadHolderToProcessDebuggingDetails(ProcessDebuggingDetail))
    {
        PlatformMemFreePool(ProcessDebuggingDetail);
        return (UINT64)NULL;
    }
 
    //
    // Attach it to the list of active thread (LIST_ENTRY)
    //
    InsertHeadList(&g_ProcessDebuggingDetailsListHead, &(ProcessDebuggingDetail->AttachedProcessList));
 
    //
    // return the token
    //
    return ProcessDebuggingDetail->Token;
}

AttachingFindProcessDebuggingDetailsByProcessId()

PUSERMODE_DEBUGGING_PROCESS_DETAILS AttachingFindProcessDebuggingDetailsByProcessId

(

UINT32

ProcessId

)

Find user-mode debugging details for threads by process Id.

Parameters

ProcessId

Returns

PUSERMODE_DEBUGGING_PROCESS_DETAILS

{
    LIST_FOR_EACH_LINK(g_ProcessDebuggingDetailsListHead, USERMODE_DEBUGGING_PROCESS_DETAILS, AttachedProcessList, ProcessDebuggingDetails)
    {
        //
        // Check if we found the target thread and if it's enabled
        //
        if (ProcessDebuggingDetails->ProcessId == ProcessId && ProcessDebuggingDetails->Enabled)
        {
            return ProcessDebuggingDetails;
        }
    }
 
    return NULL;
}

AttachingFindProcessDebuggingDetailsByToken()

PUSERMODE_DEBUGGING_PROCESS_DETAILS AttachingFindProcessDebuggingDetailsByToken

(

UINT64

Token

)

Find user-mode debugging details for threads by token.

Parameters

Token

Returns

PUSERMODE_DEBUGGING_PROCESS_DETAILS

{
    LIST_FOR_EACH_LINK(g_ProcessDebuggingDetailsListHead, USERMODE_DEBUGGING_PROCESS_DETAILS, AttachedProcessList, ProcessDebuggingDetails)
    {
        //
        // Check if we found the target thread and if it's enabled
        //
        if (ProcessDebuggingDetails->Token == Token && ProcessDebuggingDetails->Enabled)
        {
            return ProcessDebuggingDetails;
        }
    }
 
    return NULL;
}

AttachingFindProcessDebuggingDetailsInStartingPhase()

PUSERMODE_DEBUGGING_PROCESS_DETAILS AttachingFindProcessDebuggingDetailsInStartingPhase

(

)

Find user-mode debugging details for threads that is in the start-up phase.

Returns

PUSERMODE_DEBUGGING_PROCESS_DETAILS

{
    LIST_FOR_EACH_LINK(g_ProcessDebuggingDetailsListHead, USERMODE_DEBUGGING_PROCESS_DETAILS, AttachedProcessList, ProcessDebuggingDetails)
    {
        if (ProcessDebuggingDetails->IsOnTheStartingPhase)
        {
            return ProcessDebuggingDetails;
        }
    }
 
    return NULL;
}

AttachingHandleEntrypointInterception()

VOID AttachingHandleEntrypointInterception

(

PROCESSOR_DEBUGGING_STATE *

DbgState

)

Handle the interception of finding the entrypoint on attaching to user-mode process.

Parameters

DbgState

The state of the debugger on the current core

Returns

VOID

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail = NULL;
    PAGE_FAULT_EXCEPTION                PageFaultErrorCode     = {0};
 
    //
    // Not increment the RIP register as no instruction is intended to go
    //
    VmFuncSuppressRipIncrement(DbgState->CoreId);
 
    ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(HANDLE_TO_UINT32(PsGetCurrentProcessId()));
 
    //
    // Check to only break on the target process id and thread id and when
    // the entrypoint is not called, if the thread debugging detail is found
    //
    if (ProcessDebuggingDetail != NULL)
    {
        if (g_IsWaitingForUserModeProcessEntryToBeCalled)
        {
            //
            // Show a message that we reached to the entrypoint
            //
            // Log("Reached to the main module entrypoint (%016llx)\n", VmFuncGetLastVmexitRip(DbgState->CoreId));
 
            //
            // Not waiting for these event anymore
            //
            g_IsWaitingForUserModeProcessEntryToBeCalled = FALSE;
 
            //
            // Whenever Windows calls the start entrypoint of the target PE, initially,
            // the module is not loaded in the memory, thus a page-fault will happen and
            // the page-fault handler will bring the module content to the memory and after
            // that, the start entrypoint of PE is called again
            // It's not possible for us to handle everything here without checking for the
            // possible page-fault, it is because the first instruction is not available to be
            // read from the memory, thus, it shows a wrong instruction and the user might not
            // use the instrumentation step-in from the start up of the entrypoint.
            // Because if the user uses the instrumentation step-in command then it should go
            // the page-fault handler routine in the kernel and it's not what the user expects
            // we inject a #PF here and let the Windows handle the page-fault. Meanwhile, we
            // set the hardware debug breakpoint again at the start of the entrypoint, so, the
            // next time that the instruction is about to be fetched, a vm-exit happens as a
            // result of intercepting #DBs
            // In some cases, there is no need to inject #PF to the guest. One example is when
            // the target page is already available in the memory like the same process is also
            // open in the debuggee. In these cases, we handle the break directly without injecting
            // any page-fault
            //
 
            if (!CheckAccessValidityAndSafety(ProcessDebuggingDetail->EntrypointOfMainModule, sizeof(CHAR)))
            {
                // LogInfo("Injecting #PF for entrypoint at : %llx", ProcessDebuggingDetail->EntrypointOfMainModule);
 
                //
                // We're waiting for this pointer to be called again after handling page-fault
                //
                g_IsWaitingForReturnAndRunFromPageFault = TRUE;
 
                //
                // Create page-fault error code (user, fetch #PF)
                //
                PageFaultErrorCode.AsUInt = 0x14;
 
                //
                // Inject the page-fault
                //
                VmFuncEventInjectPageFaultWithCr2(DbgState->CoreId,
                                                  ProcessDebuggingDetail->EntrypointOfMainModule,
                                                  PageFaultErrorCode.AsUInt);
 
                //
                // Also, set the RFLAGS.TF to intercept the process (thread) again after inject #PF
                //
                VmFuncSetRflagTrapFlag(TRUE);
 
                //
                // Indicate that we should set the trap flag to the FALSE next time on
                // the same process/thread
                //
                if (!BreakpointRestoreTheTrapFlagOnceTriggered(HANDLE_TO_UINT32(PsGetCurrentProcessId()), HANDLE_TO_UINT32(PsGetCurrentThreadId())))
                {
                    LogWarning("Warning, it is currently not possible to add the current process/thread to the list of processes "
                               "where the trap flag should be masked. Please ensure that you manually unset the trap flag");
                }
            }
            else
            {
                //
                // Address is valid, probably the module is previously loaded
                // or another process with same image is currently running
                // Thus, there is no need to inject #PF, we'll handle it in debugger
                //
                AttachingReachedToValidLoadedModule(DbgState, ProcessDebuggingDetail);
            }
        }
        else if (g_IsWaitingForReturnAndRunFromPageFault)
        {
            //
            // not waiting for a break after the page-fault anymore
            //
            g_IsWaitingForReturnAndRunFromPageFault = FALSE;
 
            //
            // We reached here as a result of setting the trap flag after
            // injecting a page-fault
            //
            AttachingReachedToValidLoadedModule(DbgState, ProcessDebuggingDetail);
        }
    }
}

AttachingInitialize()

BOOLEAN AttachingInitialize

(

)

Initialize the attaching mechanism.

as we use the functionalities for these functions, we initialize them from the debugger at start up of debugger (not initialization of user-debugger)

Returns

BOOLEAN

{
    UNICODE_STRING FunctionName;
 
    //
    // Find address of PsGetProcessPeb
    //
    if (g_PsGetProcessPeb == NULL)
    {
        RtlInitUnicodeString(&FunctionName, L"PsGetProcessPeb");
        g_PsGetProcessPeb = (PsGetProcessPeb)MmGetSystemRoutineAddress(&FunctionName);
 
        if (g_PsGetProcessPeb == NULL)
        {
            LogError("Err, cannot resolve PsGetProcessPeb");
 
            //
            // Won't fail the entire debugger for not finding this
            //
            // return FALSE;
        }
    }
 
    //
    // Find address of PsGetProcessWow64Process
    //
    if (g_PsGetProcessWow64Process == NULL)
    {
        RtlInitUnicodeString(&FunctionName, L"PsGetProcessWow64Process");
        g_PsGetProcessWow64Process = (PsGetProcessWow64Process)MmGetSystemRoutineAddress(&FunctionName);
 
        if (g_PsGetProcessWow64Process == NULL)
        {
            LogError("Err, cannot resolve PsGetProcessPeb");
 
            //
            // Won't fail the entire debugger for not finding this
            //
            // return FALSE;
        }
    }
 
    //
    // Find address of ZwQueryInformationProcess
    //
    if (g_ZwQueryInformationProcess == NULL)
    {
        UNICODE_STRING RoutineName;
 
        RtlInitUnicodeString(&RoutineName, L"ZwQueryInformationProcess");
 
        g_ZwQueryInformationProcess = (ZwQueryInformationProcess)MmGetSystemRoutineAddress(&RoutineName);
 
        if (g_ZwQueryInformationProcess == NULL)
        {
            LogError("Err, cannot resolve ZwQueryInformationProcess");
 
            //
            // Won't fail the entire debugger for not finding this
            //
            // return FALSE;
        }
    }
 
    return TRUE;
}

AttachingKillProcess()

BOOLEAN AttachingKillProcess

(

PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS

KillRequest

)

Kill the target process from kernel-mode.

this function should not be called in vmx-root

Parameters

KillRequest

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
    BOOLEAN                             WasKilled = FALSE;
 
    ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(KillRequest->ProcessId);
 
    //
    // Check if process is valid in process debugging details
    //
    if (!ProcessDebuggingDetail)
    {
        //
        // not found
        //
        KillRequest->Result = DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS;
        return FALSE;
    }
 
    //
    // Check if process exists or not
    //
    if (!CommonIsProcessExist(ProcessDebuggingDetail->ProcessId))
    {
        //
        // Process was killed before killing it here (not exists)
        //
 
        //
        // Remove the entry from the process debugging details list
        //
        AttachingRemoveProcessDebuggingDetailsByToken(ProcessDebuggingDetail->Token);
 
        KillRequest->Result = DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS_DOES_NOT_EXISTS;
        return FALSE;
    }
 
    //
    // Check if we can kill it using the first method
    //
    WasKilled = CommonKillProcess(KillRequest->ProcessId, PROCESS_KILL_METHOD_1);
 
    if (WasKilled)
    {
        goto Success;
    }
 
    //
    // Check if we can kill it using the second method
    //
    WasKilled = CommonKillProcess(KillRequest->ProcessId, PROCESS_KILL_METHOD_2);
 
    if (WasKilled)
    {
        goto Success;
    }
 
    //
    // Check if we can kill it using the third method
    //
    WasKilled = CommonKillProcess(KillRequest->ProcessId, PROCESS_KILL_METHOD_3);
 
    if (WasKilled)
    {
        goto Success;
    }
 
    //
    // No way we can kill the shit :(
    //
    KillRequest->Result = DEBUGGER_ERROR_UNABLE_TO_KILL_THE_PROCESS;
    return FALSE;
 
Success:
 
    //
    // Remove the entry from the process debugging details list
    //
    AttachingRemoveProcessDebuggingDetailsByToken(ProcessDebuggingDetail->Token);
 
    KillRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
    return TRUE;
}

AttachingPauseProcess()

BOOLEAN AttachingPauseProcess

(

PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS

PauseRequest

)

Pauses the target process.

this function should not be called in vmx-root

Parameters

PauseRequest

Returns

BOOLEAN

{
    if (AttachingConfigureInterceptingThreads(PauseRequest->Token, TRUE))
    {
        //
        // The pausing operation was successful
        //
        PauseRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
        return TRUE;
    }
    else
    {
        PauseRequest->Result = DEBUGGER_ERROR_UNABLE_TO_PAUSE_THE_PROCESS_THREADS;
        return FALSE;
    }
}

AttachingPerformAttachToProcess()

BOOLEAN AttachingPerformAttachToProcess	(	PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS	AttachRequest,
		BOOLEAN	IsAttachingToEntrypoint )

Attach to the target process.

this function should not be called in vmx-root

Parameters

AttachRequest
IsAttachingToEntrypoint

Returns

BOOLEAN

{
    PEPROCESS                                    SourceProcess;
    UINT64                                       ProcessDebuggingToken;
    UINT64                                       PebAddressToMonitor;
    BOOLEAN                                      ResultOfApplyingEvent;
    BOOLEAN                                      Is32Bit;
    PUSERMODE_DEBUGGING_PROCESS_DETAILS          TempProcessDebuggingDetail;
    EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR EptHookDetails = {0};
 
    if (g_PsGetProcessWow64Process == NULL || g_PsGetProcessPeb == NULL)
    {
        AttachRequest->Result = DEBUGGER_ERROR_FUNCTIONS_FOR_INITIALIZING_PEB_ADDRESSES_ARE_NOT_INITIALIZED;
        return FALSE;
    }
 
    if (PsLookupProcessByProcessId((HANDLE)AttachRequest->ProcessId, &SourceProcess) != STATUS_SUCCESS)
    {
        //
        // if the process not found
        //
        AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS;
        return FALSE;
    }
 
    ObDereferenceObject(SourceProcess);
 
    //
    // Check to avoid double attaching to a process
    //
    TempProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(AttachRequest->ProcessId);
 
    if (TempProcessDebuggingDetail != NULL && TempProcessDebuggingDetail->Eprocess == SourceProcess)
    {
        //
        // The user already attached to this process
        //
        AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_AN_ALREADY_ATTACHED_PROCESS;
        return FALSE;
    }
 
    //
    // check whether the target process is 32-bit or 64-bit
    //
    if (!UserAccessIsWow64Process((HANDLE)AttachRequest->ProcessId, &Is32Bit))
    {
        //
        // Unable to detect whether it's 32-bit or 64-bit
        //
        AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_DETECT_32_BIT_OR_64_BIT_PROCESS;
        return FALSE;
    }
 
    //
    // Set the Is32Bit flag of attach request
    //
    AttachRequest->Is32Bit = Is32Bit;
 
    //
    // Get 32-bit or 64-bit PEB
    //
    if (Is32Bit)
    {
        PebAddressToMonitor = (UINT64)((PPEB32)g_PsGetProcessWow64Process(SourceProcess));
    }
    else
    {
        PebAddressToMonitor = (UINT64)((PPEB)g_PsGetProcessPeb(SourceProcess));
    }
 
    if (PebAddressToMonitor == (UINT64)NULL)
    {
        AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS;
        return FALSE;
    }
 
    //
    // Create the debugging detail for process
    //
    ProcessDebuggingToken = AttachingCreateProcessDebuggingDetails(AttachRequest->ProcessId,
                                                                   TRUE,
                                                                   Is32Bit,
                                                                   AttachRequest->CheckCallbackAtFirstInstruction,
                                                                   SourceProcess,
                                                                   PebAddressToMonitor);
 
    //
    // Check if we successfully get the token
    //
    if (ProcessDebuggingToken == (UINT64)NULL)
    {
        AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS;
        return FALSE;
    }
 
    //
    // Check if it's attaching at entrypoint or attaching to a previously running process
    //
    if (IsAttachingToEntrypoint)
    {
        //
        // *** attaching to the entrypoint of the process ***
        //
 
        //
        // Check whether any special initialization for thread safe features
        // is needed or not
        //
        if (AttachRequest->CheckCallbackAtFirstInstruction)
        {
            AttachingCheckForSafeCallbackRequestedInitializations(AttachRequest, ProcessDebuggingToken);
        }
 
        //
        // Waiting for #DB to be triggered
        //
        g_IsWaitingForUserModeProcessEntryToBeCalled = TRUE;
 
        //
        // Set the starting point of the thread
        //
        if (!AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken(TRUE, ProcessDebuggingToken))
        {
            //
            // Remove the created thread debugging detail
            //
            AttachingRemoveProcessDebuggingDetailsByToken(ProcessDebuggingToken);
 
            g_IsWaitingForUserModeProcessEntryToBeCalled = FALSE;
            AttachRequest->Result                        = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS;
            return FALSE;
        }
 
        //
        // Apply monitor memory range to the PEB address
        //
 
        EptHookDetails.StartAddress = PebAddressToMonitor;
 
        //
        // both start and the end are at the same address
        // because it hooks an entire page anyway
        //
        EptHookDetails.EndAddress      = PebAddressToMonitor;
        EptHookDetails.SetHookForRead  = TRUE;
        EptHookDetails.SetHookForWrite = TRUE;
        EptHookDetails.SetHookForExec  = FALSE;
 
        ResultOfApplyingEvent = DebuggerEventEnableMonitorReadWriteExec(
            &EptHookDetails,
            AttachRequest->ProcessId,
            FALSE // Applied from VMX non-root mode
        );
 
        if (!ResultOfApplyingEvent)
        {
            //
            // Remove the created thread debugging detail
            //
            AttachingRemoveProcessDebuggingDetailsByToken(ProcessDebuggingToken);
 
            g_IsWaitingForUserModeProcessEntryToBeCalled = FALSE;
            AttachRequest->Result                        = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS;
            return FALSE;
        }
    }
    else
    {
        //
        // *** attaching to previously running process ***
        //
        if (!AttachingConfigureInterceptingThreads(ProcessDebuggingToken, TRUE))
        {
            //
            // Remove the created thread debugging details
            //
            AttachingRemoveProcessDebuggingDetailsByToken(ProcessDebuggingToken);
 
            AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_ATTACH_TO_TARGET_USER_MODE_PROCESS;
            return FALSE;
        }
    }
 
    //
    // Operation was successful
    //
    AttachRequest->Token  = ProcessDebuggingToken;
    AttachRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
    return TRUE;
}

AttachingPerformDetach()

BOOLEAN AttachingPerformDetach

(

PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS

DetachRequest

)

Clearing hooks after resuming the process.

this function should not be called in vmx-root

Parameters

DetachRequest

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
 
    ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(DetachRequest->ProcessId);
 
    //
    // Check if process is valid in process debugging details
    //
    if (!ProcessDebuggingDetail)
    {
        //
        // not found
        //
        DetachRequest->Result = DEBUGGER_ERROR_THE_USER_DEBUGGER_NOT_ATTACHED_TO_THE_PROCESS;
        return FALSE;
    }
 
    //
    // If the threads are paused, we can't detach from the target process
    // before sending this request, the debugger should continued all the
    // threads by sending a continue packet
    //
    if (ThreadHolderIsAnyPausedThreadInProcess(ProcessDebuggingDetail))
    {
        //
        // We found a thread that is still pause
        //
        DetachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_DETACH_AS_THERE_ARE_PAUSED_THREADS;
        return FALSE;
    }
 
    //
    // Remove the process from interception mechanisms
    //
    AttachingConfigureInterceptingThreads(ProcessDebuggingDetail->Token, FALSE);
 
    //
    // Remove the entry from the process debugging details list
    //
    AttachingRemoveProcessDebuggingDetailsByToken(ProcessDebuggingDetail->Token);
 
    DetachRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
    return TRUE;
}

AttachingQueryCountOfActiveDebuggingThreadsAndProcesses()

BOOLEAN AttachingQueryCountOfActiveDebuggingThreadsAndProcesses

(

PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS

QueryCountOfDebugThreadsRequest

)

Query count of active debugging threads.

Parameters

QueryCountOfDebugThreadsRequest

Returns

BOOLEAN

{
    UINT32 CountOfProcessesAndThreads;
 
    //
    // Count the result
    //
    CountOfProcessesAndThreads = ThreadHolderQueryCountOfActiveDebuggingThreadsAndProcesses();
 
    //
    // Set the results
    //
    QueryCountOfDebugThreadsRequest->CountOfActiveDebuggingThreadsAndProcesses = CountOfProcessesAndThreads;
    QueryCountOfDebugThreadsRequest->Result                                    = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
    return TRUE;
}

AttachingQueryDetailsOfActiveDebuggingThreadsAndProcesses()

BOOLEAN AttachingQueryDetailsOfActiveDebuggingThreadsAndProcesses	(	PVOID	BufferToStoreDetails,
		UINT32	BufferSize )

Query details of active debugging threads.

Parameters

BufferToStoreDetails
BufferSize

Returns

BOOLEAN

{
    UINT32 CountOfProcessesAndThreadsToStore;
 
    CountOfProcessesAndThreadsToStore = BufferSize / SIZEOF_USERMODE_DEBUGGING_THREAD_OR_PROCESS_STATE_DETAILS;
 
    if (CountOfProcessesAndThreadsToStore == 0)
    {
        //
        // No active thread or process
        //
        return FALSE;
    }
 
    // LogInfo("Count of active process and threads : %x", CountOfProcessesAndThreadsToStore);
 
    //
    // Get the results
    //
    ThreadHolderQueryDetailsOfActiveDebuggingThreadsAndProcesses(BufferToStoreDetails, CountOfProcessesAndThreadsToStore);
 
    return TRUE;
}

AttachingReachedToValidLoadedModule()

BOOLEAN AttachingReachedToValidLoadedModule	(	PROCESSOR_DEBUGGING_STATE *	DbgState,
		PUSERMODE_DEBUGGING_PROCESS_DETAILS	ProcessDebuggingDetail )

Handle cases where we reached to the valid loaded module The main module should be loaded once we reach to this function.

Parameters

DbgState	The state of the debugger on the current core
ProcessDebuggingDetail

Returns

BOOLEAN

{
    DEBUGGEE_BP_PACKET BpRequest = {0};
 
    //
    // Double check to make sure the main module is loaded
    //
    if (!CheckAccessValidityAndSafety(ProcessDebuggingDetail->EntrypointOfMainModule, sizeof(CHAR)))
    {
        LogError("Err, the main module is not loaded or the main entrypoint is not valid");
        return FALSE;
    }
 
    //
    // Setting a breakpoint to the main entrypoint of the module
    //
    BpRequest.Address = ProcessDebuggingDetail->EntrypointOfMainModule;
    BpRequest.Core    = DEBUGGEE_BP_APPLY_TO_ALL_CORES;
    BpRequest.Pid     = DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES;
    BpRequest.Tid     = DEBUGGEE_BP_APPLY_TO_ALL_THREADS;
 
    //
    // Remove the breakpoint after hit
    //
    BpRequest.RemoveAfterHit = TRUE;
 
    //
    // Check if the process needs to check for callbacks for the very first instruction
    //
    if (ProcessDebuggingDetail->CheckCallBackForInterceptingFirstInstruction)
    {
        //
        // This breakpoint should check for callbacks
        //
        BpRequest.CheckForCallbacks = TRUE;
    }
 
    //
    // Register the breakpoint
    // Note that, even though it's a user-mode breakpoint, we are currently
    // in the memory layout of the target process, thus, no switching memory
    // layout is needed
    //
    if (!BreakpointAddNew(&BpRequest, FALSE))
    {
        LogError("Err, unable to set breakpoint on the entrypoint module");
        return FALSE;
    }
 
    //
    // Finish the starting point of the thread
    //
    AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken(FALSE, ProcessDebuggingDetail->Token);
 
    //
    // Check if we're connect to the kHyperDbg or uHyperDbg
    //
    if (g_KernelDebuggerState)
    {
        //
        // Handling state through the kernel-mode debugger
        //
        KdHandleBreakpointAndDebugBreakpoints(DbgState,
                                              DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED,
                                              NULL);
    }
    else if (g_UserDebuggerState)
    {
        //
        // Handling state through the user-mode debugger
        //
        UdHandleInstantBreak(DbgState,
                             DEBUGGEE_PAUSING_REASON_DEBUGGEE_STARTING_MODULE_LOADED,
                             ProcessDebuggingDetail);
    }
    else
    {
        LogError("Err, no debugger is attached to handle the entrypoint interception");
        return FALSE;
    }
 
    //
    // Handled successfully
    //
    return TRUE;
}

AttachingRemoveAndFreeAllProcessDebuggingDetails()

VOID AttachingRemoveAndFreeAllProcessDebuggingDetails

(

)

Remove and deallocate all thread debuggig details.

Returns

VOID

{
    LIST_FOR_EACH_LINK(g_ProcessDebuggingDetailsListHead, USERMODE_DEBUGGING_PROCESS_DETAILS, AttachedProcessList, ProcessDebuggingDetails)
    {
        //
        // Free the thread holding structure(s)
        //
        ThreadHolderFreeHoldingStructures(ProcessDebuggingDetails);
 
        //
        // Remove thread debugging detail from the list active threads
        //
        RemoveEntryList(&ProcessDebuggingDetails->AttachedProcessList);
 
        //
        // Unallocate the pool
        //
        PlatformMemFreePool(ProcessDebuggingDetails);
    }
}

AttachingRemoveHooks()

BOOLEAN AttachingRemoveHooks

(

PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS

AttachRequest

)

Clearing hooks after resuming the process.

this function should not be called in vmx-root

Parameters

AttachRequest

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails;
 
    //
    // Get the thread debugging detail
    //
    ProcessDebuggingDetails = AttachingFindProcessDebuggingDetailsByToken(AttachRequest->Token);
 
    //
    // Check if token is valid or not
    //
    if (!ProcessDebuggingDetails)
    {
        AttachRequest->Result = DEBUGGER_ERROR_INVALID_THREAD_DEBUGGING_TOKEN;
        return FALSE;
    }
 
    //
    // Check if the entrypoint is reached or not,
    // if it's not reached then we won't remove the hooks
    //
    if (!g_IsWaitingForUserModeProcessEntryToBeCalled)
    {
        //
        // The entrypoint is called, we should remove the hook
        //
        if (!ConfigureEptHookUnHookSingleAddress((UINT64)ProcessDebuggingDetails->PebAddressToMonitor,
                                                 (UINT64)NULL,
                                                 ProcessDebuggingDetails->ProcessId))
        {
            AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS;
            return FALSE;
        }
        else
        {
            //
            // The unhooking operation was successful
            //
            AttachRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
            return TRUE;
        }
    }
    else
    {
        //
        // The entrypoint is not called, we shouldn't remove the hook
        //
        AttachRequest->Result = DEBUGGER_ERROR_UNABLE_TO_REMOVE_HOOKS_ENTRYPOINT_NOT_REACHED;
        return FALSE;
    }
}

AttachingRemoveProcessDebuggingDetailsByToken()

BOOLEAN AttachingRemoveProcessDebuggingDetailsByToken

(

UINT64

Token

)

Remove user-mode debugging details for threads by its token.

Parameters

Token

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails;
 
    //
    // Find the entry
    //
    ProcessDebuggingDetails = AttachingFindProcessDebuggingDetailsByToken(Token);
 
    if (!ProcessDebuggingDetails)
    {
        //
        // Token not found!
        //
        return FALSE;
    }
 
    //
    // Free the thread holding structure(s)
    //
    ThreadHolderFreeHoldingStructures(ProcessDebuggingDetails);
 
    //
    // Remove thread debugging detail from the list active threads
    //
    RemoveEntryList(&ProcessDebuggingDetails->AttachedProcessList);
 
    //
    // Unallocate the pool
    //
    PlatformMemFreePool(ProcessDebuggingDetails);
 
    return TRUE;
}

AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken()

BOOLEAN AttachingSetStartingPhaseOfProcessDebuggingDetailsByToken	(	BOOLEAN	Set,
		UINT64	Token )

Set the start up phase of a debugging thread buffer by its token.

Parameters

Set
Token

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetails;
 
    //
    // If it's set to TRUE, then we check to only put 1 thread at the time
    // to the starting phase
    //
    ProcessDebuggingDetails = AttachingFindProcessDebuggingDetailsInStartingPhase();
 
    if (Set && ProcessDebuggingDetails != NULL)
    {
        //
        // There is another thread in starting phase!
        //
        return FALSE;
    }
 
    //
    // Find the entry
    //
    ProcessDebuggingDetails = AttachingFindProcessDebuggingDetailsByToken(Token);
 
    if (!ProcessDebuggingDetails)
    {
        //
        // Token not found!
        //
        return FALSE;
    }
 
    //
    // Set the starting phase
    //
    ProcessDebuggingDetails->IsOnTheStartingPhase = Set;
 
    return TRUE;
}

AttachingSwitchProcess()

BOOLEAN AttachingSwitchProcess

(

PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS

SwitchRequest

)

Switch to the target thread.

Parameters

SwitchRequest

Returns

BOOLEAN

{
    PUSERMODE_DEBUGGING_PROCESS_DETAILS ProcessDebuggingDetail;
    PUSERMODE_DEBUGGING_THREAD_DETAILS  ThreadDebuggingDetail;
 
    if (SwitchRequest->ProcessId != NULL_ZERO)
    {
        //
        // Switch by process id
        //
        ProcessDebuggingDetail = AttachingFindProcessDebuggingDetailsByProcessId(SwitchRequest->ProcessId);
    }
    else if (SwitchRequest->ThreadId != NULL_ZERO)
    {
        //
        // Switch by thread id
        //
        ProcessDebuggingDetail = ThreadHolderGetProcessDebuggingDetailsByThreadId(SwitchRequest->ThreadId);
    }
    else
    {
        SwitchRequest->Result = DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID;
        return FALSE;
    }
 
    //
    // Check if process is valid in process debugging details
    //
    if (!ProcessDebuggingDetail)
    {
        //
        // not found
        //
        SwitchRequest->Result = DEBUGGER_ERROR_UNABLE_TO_SWITCH_PROCESS_ID_OR_THREAD_ID_IS_INVALID;
        return FALSE;
    }
 
    //
    // Set the IsPaused field
    //
    if (SwitchRequest->ThreadId != NULL_ZERO)
    {
        //
        // Find the thread's state
        //
        ThreadDebuggingDetail = ThreadHolderGetProcessThreadDetailsByProcessIdAndThreadId(ProcessDebuggingDetail->ProcessId,
                                                                                          SwitchRequest->ThreadId);
    }
    else
    {
        //
        // Find the first thread in the process
        //
        ThreadDebuggingDetail = ThreadHolderGetProcessFirstThreadDetailsByProcessId(ProcessDebuggingDetail->ProcessId);
    }
 
    //
    // Check if we find the target thread
    //
    if (!ThreadDebuggingDetail)
    {
        //
        // not found
        //
        SwitchRequest->Result = DEBUGGER_ERROR_UNABLE_TO_SWITCH_THERE_IS_NO_THREAD_ON_THE_PROCESS;
        return FALSE;
    }
 
    //
    // Fill the needed details by user mode
    //
    SwitchRequest->Token             = ProcessDebuggingDetail->Token;
    SwitchRequest->ProcessId         = ProcessDebuggingDetail->ProcessId;
    SwitchRequest->ThreadId          = ThreadDebuggingDetail->ThreadId;
    SwitchRequest->Is32Bit           = ProcessDebuggingDetail->Is32Bit;
    SwitchRequest->Rip               = ThreadDebuggingDetail->ThreadRip;
    SwitchRequest->IsPaused          = ThreadDebuggingDetail->IsPaused;
    SwitchRequest->SizeOfInstruction = ThreadDebuggingDetail->SizeOfInstruction;
 
    memcpy(&SwitchRequest->InstructionBytesOnRip[0],
           &ThreadDebuggingDetail->InstructionBytesOnRip[0],
           ThreadDebuggingDetail->SizeOfInstruction);
 
    SwitchRequest->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
    return TRUE;
}

AttachingTargetProcess()

VOID AttachingTargetProcess

(

PDEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS

Request

)

Dispatch and perform attaching tasks.

this function should not be called in vmx-root

Parameters

AttachRequest

Returns

VOID

{
    //
    // As we're here, we need to initialize the user-mode debugger
    //
    if (!UdInitializeUserDebugger())
    {
        Request->Result = DEBUGGER_ERROR_DEBUGGER_NOT_INITIALIZED;
        return;
    }
 
    switch (Request->Action)
    {
    case DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_ATTACH:
 
        AttachingPerformAttachToProcess(Request, Request->IsStartingNewProcess);
 
        break;
 
    case DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_DETACH:
 
        AttachingPerformDetach(Request);
 
        break;
 
    case DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_REMOVE_HOOKS:
 
        AttachingRemoveHooks(Request);
 
        break;
 
    case DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_KILL_PROCESS:
 
        AttachingKillProcess(Request);
 
        break;
 
    case DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_CONTINUE_PROCESS:
 
        AttachingContinueProcess(Request);
 
        break;
 
    case DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_PAUSE_PROCESS:
 
        AttachingPauseProcess(Request);
 
        break;
 
    case DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_SWITCH_BY_PROCESS_OR_THREAD:
 
        AttachingSwitchProcess(Request);
 
        break;
 
    case DEBUGGER_ATTACH_DETACH_USER_MODE_PROCESS_ACTION_QUERY_COUNT_OF_ACTIVE_DEBUGGING_THREADS:
 
        AttachingQueryCountOfActiveDebuggingThreadsAndProcesses(Request);
 
        break;
 
    default:
 
        Request->Result = DEBUGGER_ERROR_INVALID_ACTION_TYPE;
 
        break;
    }
}