DebuggerEvents.c File Reference

Implementation of Debugger events (triggers and enable events) More...

#include "pch.h"

Functions
VOID	DebuggerEventEnableEferOnAllProcessors ()
	routines for !syscall command (enable syscall hook)
VOID	DebuggerEventDisableEferOnAllProcessors ()
	routines for !syscall command (disable syscall hook)
VOID	DebuggerEventEnableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (enable mov-to-cr3 exiting)
VOID	DebuggerEventDisableMovToCr3ExitingOnAllProcessors ()
	routines for debugging threads (disable mov-to-cr3 exiting)
BOOLEAN	DebuggerEventEnableMonitorReadWriteExec (EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *HookingDetails, UINT32 ProcessId, BOOLEAN ApplyDirectlyFromVmxRoot)
	Apply monitor ept hook events for address.
BOOLEAN	DebuggerCheckProcessOrThreadChange (_In_ UINT32 CoreId)
	Handle process or thread switches.

Detailed Description

Implementation of Debugger events (triggers and enable events)

Author

Sina Karvandi (sina@.nosp@m.hype.nosp@m.rdbg..nosp@m.org)

Version

0.1

Date

2020-05-12

Copyright

This project is released under the GNU Public License v3.

Function Documentation

DebuggerCheckProcessOrThreadChange()

BOOLEAN DebuggerCheckProcessOrThreadChange

(

_In_ UINT32

CoreId

)

Handle process or thread switches.

Parameters

CoreId

Returns

BOOLEAN

{
    PROCESSOR_DEBUGGING_STATE * DbgState = &g_DbgState[CoreId];
 
    //
    // Check whether intercepting this process or thread is active or not
    //
    if (DbgState->ThreadOrProcessTracingDetails.InterceptClockInterruptsForThreadChange ||
        DbgState->ThreadOrProcessTracingDetails.InterceptClockInterruptsForProcessChange)
 
    {
        //
        // We only handle interrupts that are related to the clock-timer interrupt
        //
        if (DbgState->ThreadOrProcessTracingDetails.InterceptClockInterruptsForThreadChange)
        {
            return ThreadHandleThreadChange(DbgState);
        }
        else
        {
            return ProcessHandleProcessChange(DbgState);
        }
    }
 
    //
    // Not handled here
    //
    return FALSE;
}

DebuggerEventDisableEferOnAllProcessors()

VOID DebuggerEventDisableEferOnAllProcessors

(

)

routines for !syscall command (disable syscall hook)

Returns

VOID

{
    ConfigureDisableEferSyscallEventsOnAllProcessors();
}

DebuggerEventDisableMovToCr3ExitingOnAllProcessors()

VOID DebuggerEventDisableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (disable mov-to-cr3 exiting)

Returns

VOID

{
    ConfigureDisableMovToCr3ExitingOnAllProcessors();
}

DebuggerEventEnableEferOnAllProcessors()

VOID DebuggerEventEnableEferOnAllProcessors

(

)

routines for !syscall command (enable syscall hook)

Returns

VOID

{
    ConfigureEnableEferSyscallEventsOnAllProcessors();
}

DebuggerEventEnableMonitorReadWriteExec()

BOOLEAN DebuggerEventEnableMonitorReadWriteExec	(	EPT_HOOKS_ADDRESS_DETAILS_FOR_MEMORY_MONITOR *	HookingDetails,
		UINT32	ProcessId,
		BOOLEAN	ApplyDirectlyFromVmxRoot )

Apply monitor ept hook events for address.

Parameters

HookingDetails
ProcessId
ApplyDirectlyFromVmxRoot

Returns

VOID

{
    //
    // Check if the detail is ok for either read or write or both
    //
    if (!HookingDetails->SetHookForRead && !HookingDetails->SetHookForWrite && !HookingDetails->SetHookForExec)
    {
        return FALSE;
    }
 
    //
    // If the read is FALSE and WRITE is TRUE, then the processor doesn't support
    // such a thing, we will enable the Read silently here if, this problem will be
    // solved when the trigger works, the trigger routines won't enable reads
    //
    if (HookingDetails->SetHookForWrite)
    {
        HookingDetails->SetHookForRead = TRUE;
    }
 
    //
    // Perform the EPT Hook
    //
    if (ApplyDirectlyFromVmxRoot)
    {
        return ConfigureEptHookMonitorFromVmxRoot(KeGetCurrentProcessorNumberEx(NULL),
                                                  HookingDetails);
    }
    else
    {
        return ConfigureEptHookMonitor(KeGetCurrentProcessorNumberEx(NULL),
                                       HookingDetails,
                                       ProcessId);
    }
}

DebuggerEventEnableMovToCr3ExitingOnAllProcessors()

VOID DebuggerEventEnableMovToCr3ExitingOnAllProcessors

(

)

routines for debugging threads (enable mov-to-cr3 exiting)

Returns

VOID

{
    ConfigureEnableMovToCr3ExitingOnAllProcessors();
}