HyperDbg Debugger
Loading...
Searching...
No Matches
Callback.h File Reference

Header for VMM callback interface routines. More...

Go to the source code of this file.

Functions

VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE VmmCallbackTriggerEvents (VMM_EVENT_TYPE_ENUM EventType, VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE CallingStage, PVOID Context, BOOLEAN *PostEventRequired, GUEST_REGS *Regs)
 routines callback to trigger events
BOOLEAN VmmCallbackVmcallHandler (UINT32 CoreId, UINT64 VmcallNumber, UINT64 OptionalParam1, UINT64 OptionalParam2, UINT64 OptionalParam3)
 routine callback to handle external VMCALLs
BOOLEAN VmmCallbackQueryTerminateProtectedResource (UINT32 CoreId, PROTECTED_HV_RESOURCES_TYPE ResourceType, PVOID Context, PROTECTED_HV_RESOURCES_PASSING_OVERS PassOver)
 routine callback to query for termination of protected resources
BOOLEAN VmmCallbackRestoreEptState (UINT32 CoreId)
 routine callback to restore EPT state
BOOLEAN VmmCallbackUnhandledEptViolation (UINT32 CoreId, UINT64 ViolationQualification, UINT64 GuestPhysicalAddr)
 routine callback to handle unhandled EPT violations
BOOLEAN VmmCallbackHandleMtfCallback (UINT32 CoreId)
 routine callback to handle MTF callback
VOID VmmCallbackSetLastError (UINT32 LastError)
 routine callback to set last error
VOID VmmCallbackNmiBroadcastRequestHandler (UINT32 CoreId, BOOLEAN IsOnVmxNmiHandler)
 routine callback to handle NMI requests
BOOLEAN HyperTraceCallbackLbrIsSupported (UINT32 *Capacity, BOOLEAN *IsArchLbr)
 routine callback to check if LBR is supported and get the LBR capacity if supported
BOOLEAN DebuggingCallbackHandleBreakpointException (UINT32 CoreId)
 routine callback to handle breakpoint exception
BOOLEAN DebuggingCallbackHandleDebugBreakpointException (UINT32 CoreId)
 routine callback to handle debug breakpoint exception
BOOLEAN DebuggingCallbackCheckThreadInterception (UINT32 CoreId)
 routine callback to handle thread interception
BOOLEAN DebuggingCallbackTriggerOnClockAndIpiEvents (UINT32 CoreId)
 routine callback to trigger on clock and IPI events for checking process or thread change
BOOLEAN DebuggingCallbackIgnoreHandlingMov2DebugRegs (UINT32 CoreId)
 routine callback to ignore handling mov 2 debug registers
BOOLEAN PoolManagerCallbackRequestAllocation (SIZE_T Size, UINT32 Count, POOL_ALLOCATION_INTENTION Intention)
 routine callback to request pool allocation
UINT64 PoolManagerCallbackRequestPool (POOL_ALLOCATION_INTENTION Intention, BOOLEAN RequestNewPool, UINT32 Size)
 routine callback to request pool
BOOLEAN PoolManagerCallbackFreePool (UINT64 AddressToFree)
 routine callback to free pool
VOID InterceptionCallbackTriggerCr3ProcessChange (UINT32 CoreId)
 routine callback to handle cr3 process change

Detailed Description

Header for VMM callback interface routines.

Author
Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)
Version
0.2
Date
2023-01-29
Copyright
This project is released under the GNU Public License v3.

Function Documentation

◆ DebuggingCallbackCheckThreadInterception()

BOOLEAN DebuggingCallbackCheckThreadInterception ( UINT32 CoreId)

routine callback to handle thread interception

Parameters
CoreId
Returns
BOOLEAN
274{
275 if (g_Callbacks.DebuggingCallbackCheckThreadInterception == NULL)
276 {
277 //
278 // not handled by user debugger
279 //
280 return FALSE;
281 }
282
283 return g_Callbacks.DebuggingCallbackCheckThreadInterception(CoreId);
284}
FALSE
#define FALSE
Definition BasicTypes.h:113
g_Callbacks
HYPEREVADE_CALLBACKS g_Callbacks
List of callbacks.
Definition Transparency.h:23

◆ DebuggingCallbackHandleBreakpointException()

BOOLEAN DebuggingCallbackHandleBreakpointException ( UINT32 CoreId)

routine callback to handle breakpoint exception

Parameters
CoreId
Returns
BOOLEAN
232{
233 if (g_Callbacks.DebuggingCallbackHandleBreakpointException == NULL)
234 {
235 //
236 // re-inject it to not disrupt system normal execution
237 //
238 return FALSE;
239 }
240
241 return g_Callbacks.DebuggingCallbackHandleBreakpointException(CoreId);
242}

◆ DebuggingCallbackHandleDebugBreakpointException()

BOOLEAN DebuggingCallbackHandleDebugBreakpointException ( UINT32 CoreId)

routine callback to handle debug breakpoint exception

Parameters
CoreId
Returns
BOOLEAN
253{
254 if (g_Callbacks.DebuggingCallbackHandleDebugBreakpointException == NULL)
255 {
256 //
257 // re-inject it to not disrupt system normal execution
258 //
259 return FALSE;
260 }
261
262 return g_Callbacks.DebuggingCallbackHandleDebugBreakpointException(CoreId);
263}

◆ DebuggingCallbackIgnoreHandlingMov2DebugRegs()

BOOLEAN DebuggingCallbackIgnoreHandlingMov2DebugRegs ( UINT32 CoreId)

routine callback to ignore handling mov 2 debug registers

Parameters
CoreId
Returns
BOOLEAN
314{
315 if (g_Callbacks.DebuggingCallbackIgnoreHandlingMov2DebugRegs == NULL)
316 {
317 //
318 // not handled by user debugger
319 //
320 return FALSE;
321 }
322 return g_Callbacks.DebuggingCallbackIgnoreHandlingMov2DebugRegs(CoreId);
323}

◆ DebuggingCallbackTriggerOnClockAndIpiEvents()

BOOLEAN DebuggingCallbackTriggerOnClockAndIpiEvents ( UINT32 CoreId)

routine callback to trigger on clock and IPI events for checking process or thread change

Parameters
CoreId
Returns
BOOLEAN
295{
296 if (g_Callbacks.DebuggingCallbackTriggerOnClockAndIpiEvents == NULL)
297 {
298 //
299 // not handled by user debugger
300 //
301 return FALSE;
302 }
303 return g_Callbacks.DebuggingCallbackTriggerOnClockAndIpiEvents(CoreId);
304}

◆ HyperTraceCallbackLbrIsSupported()

BOOLEAN HyperTraceCallbackLbrIsSupported ( UINT32 * Capacity,
BOOLEAN * IsArchLbr )

routine callback to check if LBR is supported and get the LBR capacity if supported

Parameters
Capacity
IsArchLbr
Returns
BOOLEAN
212{
213 if (g_Callbacks.HyperTraceCallbackLbrIsSupported == NULL)
214 {
215 //
216 // ignore it as it's not handled
217 //
218 return FALSE;
219 }
220 return g_Callbacks.HyperTraceCallbackLbrIsSupported(Capacity, IsArchLbr);
221}

◆ InterceptionCallbackTriggerCr3ProcessChange()

VOID InterceptionCallbackTriggerCr3ProcessChange ( UINT32 CoreId)

routine callback to handle cr3 process change

Parameters
CoreId
Returns
VOID
399{
400 if (g_Callbacks.InterceptionCallbackTriggerCr3ProcessChange == NULL)
401 {
402 //
403 // ignore it
404 //
405 return;
406 }
407
408 g_Callbacks.InterceptionCallbackTriggerCr3ProcessChange(CoreId);
409}

◆ PoolManagerCallbackFreePool()

BOOLEAN PoolManagerCallbackFreePool ( UINT64 AddressToFree)

routine callback to free pool

Parameters
AddressToFree
Returns
BOOLEAN
379{
380 if (g_Callbacks.PoolManagerCallbackFreePool == NULL)
381 {
382 //
383 // ignore it as it's not handled
384 //
385 return FALSE;
386 }
387 return g_Callbacks.PoolManagerCallbackFreePool(AddressToFree);
388}

◆ PoolManagerCallbackRequestAllocation()

BOOLEAN PoolManagerCallbackRequestAllocation ( SIZE_T Size,
UINT32 Count,
POOL_ALLOCATION_INTENTION Intention )

routine callback to request pool allocation

Parameters
Size
Count
IntentionThe intention of the buffer (buffer tag)
Returns
BOOLEAN
336{
337 if (g_Callbacks.PoolManagerCallbackRequestAllocation == NULL)
338 {
339 //
340 // ignore it as it's not handled
341 //
342 return FALSE;
343 }
344 return g_Callbacks.PoolManagerCallbackRequestAllocation(Size, Count, Intention);
345}

◆ PoolManagerCallbackRequestPool()

UINT64 PoolManagerCallbackRequestPool ( POOL_ALLOCATION_INTENTION Intention,
BOOLEAN RequestNewPool,
UINT32 Size )

routine callback to request pool

Parameters
IntentionThe intention why we need this pool for (buffer tag)
RequestNewPoolCreate a request to allocate a new pool with the same size, next time that it's safe to allocate (this way we never ran out of pools for this "Intention")
SizeIf the RequestNewPool is true the we should specify a size for the new pool
Returns
UINT64 Returns a pool address or returns null if there was an error
359{
360 if (g_Callbacks.PoolManagerCallbackRequestPool == NULL)
361 {
362 //
363 // ignore it as it's not handled
364 //
365 return 0;
366 }
367 return g_Callbacks.PoolManagerCallbackRequestPool(Intention, RequestNewPool, Size);
368}

◆ VmmCallbackHandleMtfCallback()

BOOLEAN VmmCallbackHandleMtfCallback ( UINT32 CoreId)

routine callback to handle MTF callback

Parameters
CoreId
Returns
BOOLEAN
190{
191 if (g_Callbacks.VmmCallbackHandleMtfCallback == NULL)
192 {
193 //
194 // ignore it as it's not handled
195 //
196 return FALSE;
197 }
198
199 return g_Callbacks.VmmCallbackHandleMtfCallback(CoreId);
200}

◆ VmmCallbackNmiBroadcastRequestHandler()

VOID VmmCallbackNmiBroadcastRequestHandler ( UINT32 CoreId,
BOOLEAN IsOnVmxNmiHandler )

routine callback to handle NMI requests

Parameters
CoreId
IsOnVmxNmiHandler
Returns
VOID
99{
100 if (g_Callbacks.VmmCallbackNmiBroadcastRequestHandler == NULL)
101 {
102 //
103 // ignore it
104 //
105 return;
106 }
107
108 g_Callbacks.VmmCallbackNmiBroadcastRequestHandler(CoreId, IsOnVmxNmiHandler);
109}

◆ VmmCallbackQueryTerminateProtectedResource()

BOOLEAN VmmCallbackQueryTerminateProtectedResource ( UINT32 CoreId,
PROTECTED_HV_RESOURCES_TYPE ResourceType,
PVOID Context,
PROTECTED_HV_RESOURCES_PASSING_OVERS PassOver )

routine callback to query for termination of protected resources

Parameters
CoreId
ResourceType
Context
PassOver
Returns
BOOLEAN
126{
127 if (g_Callbacks.VmmCallbackQueryTerminateProtectedResource == NULL)
128 {
129 //
130 // ignore it
131 //
132 return FALSE;
133 }
134
135 return g_Callbacks.VmmCallbackQueryTerminateProtectedResource(CoreId, ResourceType, Context, PassOver);
136}

◆ VmmCallbackRestoreEptState()

BOOLEAN VmmCallbackRestoreEptState ( UINT32 CoreId)

routine callback to restore EPT state

Parameters
CoreId
Returns
BOOLEAN
146{
147 if (g_Callbacks.VmmCallbackRestoreEptState == NULL)
148 {
149 //
150 // ignore it as it's not handled
151 //
152 return FALSE;
153 }
154
155 return g_Callbacks.VmmCallbackRestoreEptState(CoreId);
156}

◆ VmmCallbackSetLastError()

VOID VmmCallbackSetLastError ( UINT32 LastError)

routine callback to set last error

Parameters
LastError
Returns
VOID
48{
49 if (g_Callbacks.VmmCallbackSetLastError == NULL)
50 {
51 //
52 // Ignore setting the last error
53 //
54 return;
55 }
56
57 g_Callbacks.VmmCallbackSetLastError(LastError);
58}

◆ VmmCallbackTriggerEvents()

VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE VmmCallbackTriggerEvents ( VMM_EVENT_TYPE_ENUM EventType,
VMM_CALLBACK_EVENT_CALLING_STAGE_TYPE CallingStage,
PVOID Context,
BOOLEAN * PostEventRequired,
GUEST_REGS * Regs )

routines callback to trigger events

Parameters
EventType
CallingStage
Context
PostEventRequired
Regs
Returns
VMM_CALLBACK_TRIGGERING_EVENT_STATUS_TYPE
31{
32 if (g_Callbacks.VmmCallbackTriggerEvents == NULL)
33 {
34 return VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_NO_INITIALIZED;
35 }
36
37 return g_Callbacks.VmmCallbackTriggerEvents(EventType, CallingStage, Context, PostEventRequired, Regs);
38}
VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_NO_INITIALIZED
@ VMM_CALLBACK_TRIGGERING_EVENT_STATUS_SUCCESSFUL_NO_INITIALIZED
Definition Events.h:78

◆ VmmCallbackUnhandledEptViolation()

BOOLEAN VmmCallbackUnhandledEptViolation ( UINT32 CoreId,
UINT64 ViolationQualification,
UINT64 GuestPhysicalAddr )

routine callback to handle unhandled EPT violations

Parameters
CoreId
ViolationQualification
GuestPhysicalAddr
Returns
BOOLEAN
170{
171 if (g_Callbacks.VmmCallbackCheckUnhandledEptViolations == NULL)
172 {
173 //
174 // ignore it as it's not handled
175 //
176 return FALSE;
177 }
178
179 return g_Callbacks.VmmCallbackCheckUnhandledEptViolations(CoreId, ViolationQualification, GuestPhysicalAddr);
180}

◆ VmmCallbackVmcallHandler()

BOOLEAN VmmCallbackVmcallHandler ( UINT32 CoreId,
UINT64 VmcallNumber,
UINT64 OptionalParam1,
UINT64 OptionalParam2,
UINT64 OptionalParam3 )

routine callback to handle external VMCALLs

Parameters
CoreId
VmcallNumber
OptionalParam1
OptionalParam2
OptionalParam3
Returns
BOOLEAN
77{
78 if (g_Callbacks.VmmCallbackVmcallHandler == NULL)
79 {
80 //
81 // Ignore handling external VMCALLs
82 //
83 return FALSE;
84 }
85
86 return g_Callbacks.VmmCallbackVmcallHandler(CoreId, VmcallNumber, OptionalParam1, OptionalParam2, OptionalParam3);
87}