BreakpointCommands.h File Reference

Commands for setting breakpoints. More...

Go to the source code of this file.

Functions
VOID	BreakpointRemoveAllBreakpoints ()
	Remove all the breakpoints if possible.
BOOLEAN	BreakpointAddNew (PDEBUGGEE_BP_PACKET BpDescriptorArg, BOOLEAN SwitchToTargetMemoryLayout)
	Add new breakpoints.
BOOLEAN	BreakpointListOrModify (PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET ListOrModifyBreakpoints, BOOLEAN SwitchToTargetMemoryLayout)
	List of modify breakpoints.
BOOLEAN	BreakpointHandleBreakpoints (UINT32 CoreId)
	Handle breakpoint vm-exits (#BP).
BOOLEAN	BreakpointCheckAndHandleDebuggerDefinedBreakpoints (PROCESSOR_DEBUGGING_STATE *DbgState, UINT64 GuestRip, DEBUGGEE_PAUSING_REASON Reason, BOOLEAN ChangeMtfState)
	Check if the breakpoint vm-exit relates to 'bp' command or not.
BOOLEAN	BreakpointCheckAndHandleReApplyingBreakpoint (PROCESSOR_DEBUGGING_STATE *DbgState)
	Check and reapply breakpoint.
BOOLEAN	BreakpointCheckAndHandleDebugBreakpoint (UINT32 CoreId)
	Check and handle debug breakpoint exceptions.
BOOLEAN	BreakpointRestoreTheTrapFlagOnceTriggered (UINT32 ProcessId, UINT32 ThreadId)
	This function makes sure to unset the RFLAGS.TF on next trigger of #DB on the target process/thread.

Variables
volatile LONG	BreakpointCommandTrapListLock
	The lock for modifying list of process/thread for unsetting TRAP FLAG.

Detailed Description

Commands for setting breakpoints.

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2021-03-12

Copyright

This project is released under the GNU Public License v3.

Function Documentation

BreakpointAddNew()

BOOLEAN BreakpointAddNew	(	PDEBUGGEE_BP_PACKET	BpDescriptorArg,
		BOOLEAN	SwitchToTargetMemoryLayout )

Add new breakpoints.

Parameters

BpDescriptor
SwitchToTargetMemoryLayout

Returns

BOOLEAN

{
    CR3_TYPE                GuestCr3             = {0};
    PDEBUGGEE_BP_DESCRIPTOR BreakpointDescriptor = NULL;
    BOOLEAN                 IsAddress32Bit       = FALSE;
 
    //
    // Find the current process cr3
    //
    if (SwitchToTargetMemoryLayout)
    {
        //
        // Check if the process id is valid or not
        //
        if (BpDescriptorArg->Pid != DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES &&
            !CommonIsProcessExist(BpDescriptorArg->Pid))
        {
            //
            // Process id is invalid (Set the error)
            //
            BpDescriptorArg->Result = DEBUGGER_ERROR_INVALID_PROCESS_ID;
            return FALSE;
        }
 
        GuestCr3.Flags = LayoutGetCr3ByProcessId(BpDescriptorArg->Pid).Flags;
    }
    else
    {
        GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
    }
 
    //
    // *** Validate arguments ***
    //
 
    //
    // Check if the core number is not invalid
    //
    if (BpDescriptorArg->Core != DEBUGGEE_BP_APPLY_TO_ALL_CORES &&
        !CommonValidateCoreNumber(BpDescriptorArg->Core))
    {
        //
        // Core is invalid (Set the error)
        //
        BpDescriptorArg->Result = DEBUGGER_ERROR_INVALID_CORE_ID;
        return FALSE;
    }
 
    //
    // Check if breakpoint already exists on list or not
    //
    if (BreakpointGetEntryByAddress(BpDescriptorArg->Address) != NULL)
    {
        //
        // Address is already on the list (Set the error)
        //
        BpDescriptorArg->Result = DEBUGGER_ERROR_BREAKPOINT_ALREADY_EXISTS_ON_THE_ADDRESS;
        return FALSE;
    }
 
    //
    // Check if address is safe (only one byte for 0xcc)
    //
    if (SwitchToTargetMemoryLayout)
    {
        if (!CheckAccessValidityAndSafetyByProcessId(BpDescriptorArg->Address, sizeof(BYTE), BpDescriptorArg->Pid))
        {
            BpDescriptorArg->Result = DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_CURRENT_PROCESS;
            return FALSE;
        }
    }
    else
    {
        if (!CheckAccessValidityAndSafety(BpDescriptorArg->Address, sizeof(BYTE)))
        {
            BpDescriptorArg->Result = DEBUGGER_ERROR_EDIT_MEMORY_STATUS_INVALID_ADDRESS_BASED_ON_CURRENT_PROCESS;
            return FALSE;
        }
    }
 
    //
    // On the debugger mode, we won't check for process id and thread id, if these arguments are invalid
    // then the HyperDbg simply ignores the breakpoints but it makes the computer slow
    // it just won't be triggered
    //
 
    //
    // When we reach here means that the arguments are valid and address is
    // safe to access (put 0xcc)
    //
 
    //
    // Get the pre-allocated buffer
    //
    BreakpointDescriptor = (DEBUGGEE_BP_DESCRIPTOR *)
        PoolManagerRequestPool(BREAKPOINT_DEFINITION_STRUCTURE, TRUE, sizeof(DEBUGGEE_BP_DESCRIPTOR));
 
    if (BreakpointDescriptor == NULL)
    {
        //
        // No pool ! Probably the user set more than MAXIMUM_BREAKPOINTS_WITHOUT_CONTINUE
        // pools without IOCTL (continue)
        //
        BpDescriptorArg->Result = DEBUGGER_ERROR_MAXIMUM_BREAKPOINT_WITHOUT_CONTINUE;
        return FALSE;
    }
 
    //
    // Copy details of breakpoint to the descriptor structure
    //
    g_MaximumBreakpointId++;
    BreakpointDescriptor->BreakpointId      = g_MaximumBreakpointId;
    BreakpointDescriptor->Address           = BpDescriptorArg->Address;
    BreakpointDescriptor->PhysAddress       = VirtualAddressToPhysicalAddressByProcessCr3((PVOID)BpDescriptorArg->Address,
                                                                                    GuestCr3);
    BreakpointDescriptor->Core              = BpDescriptorArg->Core;
    BreakpointDescriptor->Pid               = BpDescriptorArg->Pid;
    BreakpointDescriptor->Tid               = BpDescriptorArg->Tid;
    BreakpointDescriptor->RemoveAfterHit    = BpDescriptorArg->RemoveAfterHit;
    BreakpointDescriptor->CheckForCallbacks = BpDescriptorArg->CheckForCallbacks;
 
    //
    // Check whether address is 32-bit or 64-bit
    //
    if (BpDescriptorArg->Address & 0xff00000000000000)
    {
        //
        // This is a kernel-base address and as the kernel is 64-bit, we assume it's a 64-bit address
        //
        IsAddress32Bit = FALSE;
    }
    else
    {
        //
        // The address is not a kernel address, thus, we check whether the debuggee is running on user-mode
        // or not
        //
        if (SwitchToTargetMemoryLayout)
        {
            UserAccessIsWow64Process((HANDLE)BpDescriptorArg->Pid, &IsAddress32Bit);
        }
        else
        {
            IsAddress32Bit = KdIsGuestOnUsermode32Bit();
        }
    }
 
    //
    // Use length disassembler engine to get the instruction length
    //
    if (SwitchToTargetMemoryLayout)
    {
        BreakpointDescriptor->InstructionLength = (UINT16)DisassemblerLengthDisassembleEngineByProcessId(
            (PVOID)BpDescriptorArg->Address,
            IsAddress32Bit,
            BpDescriptorArg->Pid);
    }
    else
    {
        BreakpointDescriptor->InstructionLength = (UINT16)DisassemblerLengthDisassembleEngineInVmxRootOnTargetProcess(
            (PVOID)BpDescriptorArg->Address,
            IsAddress32Bit);
    }
 
    //
    // Breakpoints are enabled by default
    //
    BreakpointDescriptor->Enabled = TRUE;
 
    //
    // Now we should add the breakpoint to the list of breakpoints (LIST_ENTRY)
    //
    InsertHeadList(&g_BreakpointsListHead, &(BreakpointDescriptor->BreakpointsList));
 
    //
    // Apply the breakpoint
    //
    BreakpointWrite(BreakpointDescriptor, SwitchToTargetMemoryLayout);
 
    //
    // Show that operation was successful
    //
    BpDescriptorArg->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
    return TRUE;
}

BreakpointCheckAndHandleDebugBreakpoint()

BOOLEAN BreakpointCheckAndHandleDebugBreakpoint

(

UINT32

CoreId

)

Check and handle debug breakpoint exceptions.

Parameters

CoreId

Returns

BOOLEAN

{
    BOOLEAN                     TrapSetByDebugger;
    PROCESSOR_DEBUGGING_STATE * DbgState                  = &g_DbgState[CoreId];
    BOOLEAN                     HandledByDebuggerRoutines = TRUE;
 
    //
    // *** Check whether anything should be changed with trap-flags
    // and also it indicates whether the debugger itself set this trap
    // flag or it's not supposed to be set by the debugger ***
    //
    if (BreakpointCheckAndPerformActionsOnTrapFlags(HANDLE_TO_UINT32(PsGetCurrentProcessId()),
                                                    HANDLE_TO_UINT32(PsGetCurrentThreadId()),
                                                    &TrapSetByDebugger))
    {
        if (DbgState->ThreadOrProcessTracingDetails.DebugRegisterInterceptionState)
        {
            //
            // This check was to show whether it is because of thread change detection or not
            //
 
            // This way of handling has a problem, if the user set to change
            // the thread and instead of using 'g', it pressed the 'p' to
            // set or a trap happens somewhere then will be ignored
            // it because we don't know the origin of this debug breakpoint
            // and it only happens on '.thread2' command, the correct way
            // to handle it is to find the exact hw debug register that caused
            // this vm-exit, but it's a really rare case, so we left it without
            // handling this case
            //
            ThreadHandleThreadChange(DbgState);
        }
        else if (g_UserDebuggerState == TRUE &&
                 (g_IsWaitingForUserModeProcessEntryToBeCalled || g_IsWaitingForReturnAndRunFromPageFault))
        {
            //
            // Handle for user-mode attaching mechanism
            //
            AttachingHandleEntrypointInterception(DbgState);
        }
        else if (g_KernelDebuggerState == TRUE)
        {
            //
            // Here we added the handler for the kernel because we want
            // stepping routines to work, even if the debugger masks the
            // traps by using 'test trap off', so stepping still works
            //
 
            //
            // Handle debug events (breakpoint, traps, hardware debug register when kernel
            // debugger is attached)
            //
            KdHandleDebugEventsWhenKernelDebuggerIsAttached(DbgState, TrapSetByDebugger);
        }
        else if (g_UserDebuggerState == TRUE &&
                 UdHandleDebugEventsWhenUserDebuggerIsAttached(DbgState, TrapSetByDebugger))
        {
            //
            // if the above function returns true, no need for further action
            // it's handled in the user debugger
            //
        }
        else
        {
            //
            // Here it means that the trap is supposed to be handled by
            // HyperDbg but, we couldn't find any routines that gonna
            // handle it (it's probably an error)
            //
            HandledByDebuggerRoutines = FALSE;
            LogError("Err, trap is supposed to be handled by the debugger, but none of routines handled it");
        }
    }
    else
    {
        //
        // *** it's not supposed to be handled by the debugger routines, the guest
        // or the target debuggee throws a debug break (#DB) ***
        //
 
        //
        // It means that it's not handled by the debugger routines
        // By default HyperDbg intercepts all #DBs and break the debugger if
        // it's attached to the debugger, otherwise injects to the guest VM
        //
        if (g_InterceptDebugBreaks)
        {
            //
            // The user explicitly told the debugger not to intercept any
            // traps (e.g., by using 'test trap off')
            //
            HandledByDebuggerRoutines = FALSE;
        }
        else if (g_KernelDebuggerState == TRUE)
        {
            //
            // Handle debug events (breakpoint, traps, hardware debug register when kernel
            // debugger is attached)
            //
            KdHandleDebugEventsWhenKernelDebuggerIsAttached(DbgState, TrapSetByDebugger);
        }
        else if (g_UserDebuggerState == TRUE &&
                 UdHandleDebugEventsWhenUserDebuggerIsAttached(DbgState, TrapSetByDebugger))
        {
            //
            // if the above function returns true, no need for further action
            // it's handled in the user debugger
            //
        }
        else
        {
            //
            // Inject to back to the guest as it's not either handled by the kernel debugger
            // routines or the user debugger
            //
            HandledByDebuggerRoutines = FALSE;
        }
    }
 
    return HandledByDebuggerRoutines;
}

BreakpointCheckAndHandleDebuggerDefinedBreakpoints()

BOOLEAN BreakpointCheckAndHandleDebuggerDefinedBreakpoints	(	PROCESSOR_DEBUGGING_STATE *	DbgState,
		UINT64	GuestRip,
		DEBUGGEE_PAUSING_REASON	Reason,
		BOOLEAN	ChangeMtfState )

Check if the breakpoint vm-exit relates to 'bp' command or not.

Parameters

DbgState	The state of the debugger on the current core
GuestRip
Reason
ChangeMtfState

Returns

BOOLEAN

{
    CR3_TYPE                         GuestCr3              = {0};
    BOOLEAN                          IsHandledByBpRoutines = FALSE;
    PLIST_ENTRY                      TempList              = 0;
    UINT64                           GuestRipPhysical      = (UINT64)NULL;
    DEBUGGER_TRIGGERED_EVENT_DETAILS TargetContext         = {0};
    BOOLEAN                          AvoidUnsetMtf         = FALSE;
    BOOLEAN                          IgnoreUserHandling    = FALSE;
 
    //
    // ***** Check breakpoint for 'bp' command *****
    //
 
    //
    // Find the current process cr3
    //
    GuestCr3.Flags = LayoutGetCurrentProcessCr3().Flags;
 
    //
    // Convert breakpoint to physical address
    //
    GuestRipPhysical = VirtualAddressToPhysicalAddressByProcessCr3((PVOID)GuestRip, GuestCr3);
 
    //
    // Iterate through the list of breakpoints
    //
    TempList = &g_BreakpointsListHead;
 
    while (&g_BreakpointsListHead != TempList->Flink)
    {
        TempList                                      = TempList->Flink;
        PDEBUGGEE_BP_DESCRIPTOR CurrentBreakpointDesc = CONTAINING_RECORD(TempList, DEBUGGEE_BP_DESCRIPTOR, BreakpointsList);
 
        if (CurrentBreakpointDesc->PhysAddress == GuestRipPhysical)
        {
            //
            // It's a breakpoint by 'bp' command
            //
            IsHandledByBpRoutines = TRUE;
 
            //
            // First, we remove the breakpoint
            //
            MemoryMapperWriteMemorySafeByPhysicalAddress(GuestRipPhysical,
                                                         (UINT64)&CurrentBreakpointDesc->PreviousByte,
                                                         sizeof(BYTE));
 
            //
            // Now, halt the debuggee
            //
            TargetContext.Context = (PVOID)VmFuncGetLastVmexitRip(DbgState->CoreId);
 
            //
            // In breakpoints tag is breakpoint id, not event tag
            //
            if (Reason == DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT)
            {
                TargetContext.Tag = CurrentBreakpointDesc->BreakpointId;
            }
 
            //
            // Hint the debuggee about the length
            //
            DbgState->InstructionLengthHint = CurrentBreakpointDesc->InstructionLength;
 
            //
            // Check constraints
            //
            if ((CurrentBreakpointDesc->Pid == DEBUGGEE_BP_APPLY_TO_ALL_PROCESSES || CurrentBreakpointDesc->Pid == HANDLE_TO_UINT32(PsGetCurrentProcessId())) &&
                (CurrentBreakpointDesc->Tid == DEBUGGEE_BP_APPLY_TO_ALL_THREADS || CurrentBreakpointDesc->Tid == HANDLE_TO_UINT32(PsGetCurrentThreadId())) &&
                (CurrentBreakpointDesc->Core == DEBUGGEE_BP_APPLY_TO_ALL_CORES || CurrentBreakpointDesc->Core == DbgState->CoreId))
            {
                //
                // Check if breakpoint should be removed after this hit or not
                //
                if (CurrentBreakpointDesc->RemoveAfterHit)
                {
                    //
                    // One hit, we have to remove it
                    //
                    BreakpointClearAndDeallocateMemory(CurrentBreakpointDesc);
                }
 
                //
                // Check if it needs to check for callbacks or not
                //
                if (CurrentBreakpointDesc->CheckForCallbacks)
                {
                    //
                    // check callbacks
                    //
                    IgnoreUserHandling = BreakpointTriggerCallbacks(DbgState, HANDLE_TO_UINT32(PsGetCurrentProcessId()), HANDLE_TO_UINT32(PsGetCurrentThreadId()));
                }
 
                //
                // Check if we need to handle the breakpoint by user or just ignore handling it
                //
                if (!IgnoreUserHandling && !g_InterceptBreakpoints && !g_InterceptBreakpointsAndEventsForCommandsInRemoteComputer)
                {
                    //
                    // *** It's not safe to access CurrentBreakpointDesc anymore as the
                    // breakpoint might be removed ***
                    //
                    if (g_KernelDebuggerState)
                    {
                        KdHandleBreakpointAndDebugBreakpoints(DbgState,
                                                              Reason,
                                                              &TargetContext);
                    }
                    else if (g_UserDebuggerState)
                    {
                        UdHandleInstantBreak(DbgState, Reason, NULL);
                    }
                    else
                    {
                        LogInfo("Err, no debugger is attached to handle the breakpoint");
                    }
                }
            }
 
            //
            // Reset hint to instruction length
            //
            DbgState->InstructionLengthHint = 0;
 
            //
            // Check if we should re-apply the breakpoint after this instruction
            // or not (in other words, is breakpoint still valid)
            //
            if (!CurrentBreakpointDesc->AvoidReApplyBreakpoint)
            {
                //
                // We should re-apply the breakpoint on next mtf
                //
                DbgState->SoftwareBreakpointState = CurrentBreakpointDesc;
 
                //
                // As we want to continue debuggee, the MTF might arrive when the
                // host finish executing it's time slice; thus, a clock interrupt
                // or an IPI might be arrived and the next instruction is not what
                // we expect. The following codes are added because we realized if the execution takes long then
                // the execution might be switched to another routines, thus, MTF might conclude on
                // another routine and we might (and will) trigger the same instruction soon
                //
                VmFuncEnableMtfAndChangeExternalInterruptState(DbgState->CoreId);
 
                //
                // Avoid unsetting MTF
                //
                AvoidUnsetMtf = TRUE;
            }
 
            //
            // Do not increment rip
            //
            VmFuncSuppressRipIncrement(DbgState->CoreId);
 
            //
            // No need to iterate anymore
            //
            break;
        }
    }
 
    if (IsHandledByBpRoutines && ChangeMtfState)
    {
        VmFuncChangeMtfUnsettingState(DbgState->CoreId, AvoidUnsetMtf);
    }
 
    return IsHandledByBpRoutines;
}

BreakpointCheckAndHandleReApplyingBreakpoint()

BOOLEAN BreakpointCheckAndHandleReApplyingBreakpoint

(

PROCESSOR_DEBUGGING_STATE *

DbgState

)

Check and reapply breakpoint.

Parameters

DbgState

The state of the debugger on the current core

Returns

BOOLEAN

{
    BOOLEAN Result = FALSE;
 
    if (DbgState->SoftwareBreakpointState != NULL)
    {
        BYTE BreakpointByte = 0xcc;
 
        //
        // MTF is handled
        //
        Result = TRUE;
 
        //
        // Restore previous breakpoint byte
        //
        MemoryMapperWriteMemorySafeByPhysicalAddress(
            DbgState->SoftwareBreakpointState->PhysAddress,
            (UINT64)&BreakpointByte,
            sizeof(BYTE));
 
        DbgState->SoftwareBreakpointState = NULL;
    }
 
    return Result;
}

BreakpointHandleBreakpoints()

BOOLEAN BreakpointHandleBreakpoints

(

UINT32

CoreId

)

Handle breakpoint vm-exits (#BP).

Parameters

CoreId

Returns

BOOLEAN

{
    DEBUGGER_TRIGGERED_EVENT_DETAILS TargetContext = {0};
    UINT64                           GuestRip      = 0;
    PROCESSOR_DEBUGGING_STATE *      DbgState      = &g_DbgState[CoreId];
 
    GuestRip = VmFuncGetRip();
 
    //
    // A breakpoint triggered and two things might be happened,
    // first, a breakpoint is triggered randomly in the computer and
    // we shouldn't do anything on it (won't change the instruction)
    // second, the breakpoint is because of the 'bp' command, we should
    // replace it with exact byte
    //
 
    //
    // Check if the breakpoint is handled by the debugger routines
    //
    if (BreakpointCheckAndHandleDebuggerDefinedBreakpoints(DbgState,
                                                           GuestRip,
                                                           DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT,
                                                           FALSE))
    {
        //
        // The breakpoint is handled by the debugger routines
        // so, we don't need to do anything else
        //
        return TRUE;
    }
 
    //
    // re-inject #BP back to the guest if not handled by the hidden breakpoint
    //
    if (g_KernelDebuggerState)
    {
        //
        // *** Kernel debugger is attached, let's halt everything ***
        //
 
        //
        // To avoid the computer crash situation from the HyperDbg's breakpoint hitting while the interception is on
        // we should always call BreakpointCheckAndHandleDebuggerDefinedBreakpoints first to handle the breakpoint
        //
 
        if (g_InterceptBreakpoints || g_InterceptBreakpointsAndEventsForCommandsInRemoteComputer)
        {
            //
            // re-inject back to the guest as not handled if the interception is on and the breakpoint is not from the Hyperdbg's breakpoints
            //
            return FALSE;
        }
 
        //
        // It's a random breakpoint byte
        //
        TargetContext.Context = (PVOID)GuestRip;
        KdHandleBreakpointAndDebugBreakpoints(DbgState,
                                              DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT,
                                              &TargetContext);
 
        //
        // Increment rip
        //
        VmFuncPerformRipIncrement(DbgState->CoreId);
 
        //
        // By default, we handle the random breakpoints if the kernel debugger is attached
        //
        return TRUE;
    }
    else if (g_UserDebuggerState)
    {
        //
        // *** User debugger is attached, let's halt the process ***
        //
 
        //
        // Check if it's a random breakpoint byte
        //
        if (UdHandleInstantBreak(DbgState,
                                 DEBUGGEE_PAUSING_REASON_DEBUGGEE_SOFTWARE_BREAKPOINT_HIT,
                                 NULL))
        {
            //
            // if the above function returns true, it's handled in the user debugger
            //
 
            //
            // Increment rip
            //
            VmFuncPerformRipIncrement(DbgState->CoreId);
 
            return TRUE;
        }
 
        //
        // By default, we won't handle the random (unrelated) breakpoints in the user debugger
        //
        return FALSE;
    }
 
    //
    // *** re-inject back to the guest as not handled here ***
    //
    return FALSE;
}

BreakpointListOrModify()

BOOLEAN BreakpointListOrModify	(	PDEBUGGEE_BP_LIST_OR_MODIFY_PACKET	ListOrModifyBreakpoints,
		BOOLEAN	SwitchToTargetMemoryLayout )

List of modify breakpoints.

Parameters

ListOrModifyBreakpoints
SwitchToTargetMemoryLayout

Returns

BOOLEAN

{
    PDEBUGGEE_BP_DESCRIPTOR BreakpointDescriptor = NULL;
 
    if (ListOrModifyBreakpoints->Request == DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_LIST_BREAKPOINTS)
    {
        BreakpointListAllBreakpoint();
    }
    else if (ListOrModifyBreakpoints->Request == DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_ENABLE)
    {
        BreakpointDescriptor = BreakpointGetEntryByBreakpointId(ListOrModifyBreakpoints->BreakpointId);
 
        if (BreakpointDescriptor == NULL)
        {
            //
            // Breakpoint id is invalid
            //
            ListOrModifyBreakpoints->Result = DEBUGGER_ERROR_BREAKPOINT_ID_NOT_FOUND;
            return FALSE;
        }
 
        //
        // Check to make sure that breakpoint is not already enabled
        //
        if (BreakpointDescriptor->Enabled)
        {
            ListOrModifyBreakpoints->Result = DEBUGGER_ERROR_BREAKPOINT_ALREADY_ENABLED;
            return FALSE;
        }
 
        //
        // Set the breakpoint (without removing from list)
        //
        BreakpointWrite(BreakpointDescriptor, SwitchToTargetMemoryLayout);
    }
    else if (ListOrModifyBreakpoints->Request == DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_DISABLE)
    {
        BreakpointDescriptor = BreakpointGetEntryByBreakpointId(ListOrModifyBreakpoints->BreakpointId);
 
        if (BreakpointDescriptor == NULL)
        {
            //
            // Breakpoint id is invalid
            //
            ListOrModifyBreakpoints->Result = DEBUGGER_ERROR_BREAKPOINT_ID_NOT_FOUND;
            return FALSE;
        }
 
        //
        // Check to make sure that breakpoint is not already disabled
        //
        if (!BreakpointDescriptor->Enabled)
        {
            ListOrModifyBreakpoints->Result = DEBUGGER_ERROR_BREAKPOINT_ALREADY_DISABLED;
            return FALSE;
        }
 
        //
        // Unset the breakpoint (without removing from list)
        //
        BreakpointClear(BreakpointDescriptor);
    }
    else if (ListOrModifyBreakpoints->Request == DEBUGGEE_BREAKPOINT_MODIFICATION_REQUEST_CLEAR)
    {
        BreakpointDescriptor = BreakpointGetEntryByBreakpointId(ListOrModifyBreakpoints->BreakpointId);
 
        if (BreakpointDescriptor == NULL)
        {
            //
            // Breakpoint id is invalid
            //
            ListOrModifyBreakpoints->Result = DEBUGGER_ERROR_BREAKPOINT_ID_NOT_FOUND;
            return FALSE;
        }
 
        //
        // Clear and deallocate the breakpoint
        //
        BreakpointClearAndDeallocateMemory(BreakpointDescriptor);
    }
 
    //
    // Operation was successful
    //
    ListOrModifyBreakpoints->Result = DEBUGGER_OPERATION_WAS_SUCCESSFUL;
 
    return TRUE;
}

BreakpointRemoveAllBreakpoints()

VOID BreakpointRemoveAllBreakpoints

(

)

Remove all the breakpoints if possible.

Returns

VOID

{
    PLIST_ENTRY TempList = 0;
 
    //
    // Iterate through the list of breakpoints
    //
    TempList = &g_BreakpointsListHead;
 
    while (&g_BreakpointsListHead != TempList->Flink)
    {
        TempList                                      = TempList->Flink;
        PDEBUGGEE_BP_DESCRIPTOR CurrentBreakpointDesc = CONTAINING_RECORD(TempList, DEBUGGEE_BP_DESCRIPTOR, BreakpointsList);
 
        //
        // Clear and deallocate the breakpoint
        //
        BreakpointClearAndDeallocateMemory(CurrentBreakpointDesc);
    }
}

BreakpointRestoreTheTrapFlagOnceTriggered()

BOOLEAN BreakpointRestoreTheTrapFlagOnceTriggered	(	UINT32	ProcessId,
		UINT32	ThreadId )

This function makes sure to unset the RFLAGS.TF on next trigger of #DB on the target process/thread.

Parameters

ProcessId
ThreadId

Returns

BOOLEAN

{
    UINT32                              Index;
    BOOLEAN                             Result;
    BOOLEAN                             SuccessfullyStored;
    DEBUGGER_PROCESS_THREAD_INFORMATION ProcThrdInfo = {0};
 
    //
    // Form the process id and thread id into a 64-bit value
    //
    ProcThrdInfo.Fields.ProcessId = ProcessId;
    ProcThrdInfo.Fields.ThreadId  = ThreadId;
 
    //
    // Make sure, nobody is in the middle of modifying the list
    //
    SpinlockLock(&BreakpointCommandTrapListLock);
 
    //
    // *** Search the list of processes/threads for the current process's trap flag state ***
    //
    Result = BinarySearchPerformSearchItem((UINT64 *)&g_TrapFlagState.ThreadInformation[0],
                                           g_TrapFlagState.NumberOfItems,
                                           &Index,
                                           ProcThrdInfo.AsUInt);
 
    if (Result)
    {
        //
        // It means that we already find this entry in the stored list
        // so, just imply that the addition was successful (no need for extra addition)
        //
        SuccessfullyStored = TRUE;
        goto Return;
    }
    else
    {
        //
        // Insert the thread into the list as the item is not already present
        //
        SuccessfullyStored = InsertionSortInsertItem((UINT64 *)&g_TrapFlagState.ThreadInformation[0],
                                                     &g_TrapFlagState.NumberOfItems,
                                                     MAXIMUM_NUMBER_OF_THREAD_INFORMATION_FOR_TRAPS,
                                                     &Index, // not used
                                                     ProcThrdInfo.AsUInt);
        goto Return;
    }
 
Return:
    //
    // Unlock the list modification lock
    //
    SpinlockUnlock(&BreakpointCommandTrapListLock);
 
    return SuccessfullyStored;
}

Variable Documentation

BreakpointCommandTrapListLock

volatile LONG BreakpointCommandTrapListLock

The lock for modifying list of process/thread for unsetting TRAP FLAG.