HyperDbg Debugger
|
Implementation of exported functions from hypervisor. More...
#include "pch.h"
Functions | |
VOID | VmFuncPerformRipIncrement (UINT32 CoreId) |
Perform the incrementation of RIP. | |
VOID | VmFuncSuppressRipIncrement (UINT32 CoreId) |
Suppress the incrementation of RIP. | |
VOID | VmFuncChangeMtfUnsettingState (UINT32 CoreId, BOOLEAN Set) |
Suppress unsetting MTF. | |
VOID | VmFuncChangeIgnoreOneMtfState (UINT32 CoreId, BOOLEAN Set) |
Change ignore one MTF state. | |
VOID | VmFuncRegisterMtfBreak (UINT32 CoreId) |
Register for break in the case of an MTF. | |
VOID | VmFuncUnRegisterMtfBreak (UINT32 CoreId) |
Unregister for break in the case of an MTF. | |
VOID | VmFuncSetMonitorTrapFlag (BOOLEAN Set) |
Set the monitor trap flag. | |
VOID | VmFuncSetRflagTrapFlag (BOOLEAN Set) |
Set Rflag's trap flag. | |
VOID | VmFuncSetLoadDebugControls (BOOLEAN Set) |
Set LOAD DEBUG CONTROLS on Vm-entry controls. | |
VOID | VmFuncSetSaveDebugControls (BOOLEAN Set) |
Set SAVE DEBUG CONTROLS on Vm-exit controls. | |
VOID | VmFuncSetPmcVmexit (BOOLEAN Set) |
Set vm-exit for rdpmc instructions. | |
VOID | VmFuncSetMovControlRegsExiting (BOOLEAN Set, UINT64 ControlRegister, UINT64 MaskRegister) |
Set vm-exit for mov-to-cr0/4. | |
VOID | VmFuncSetMovToCr3Vmexit (UINT32 CoreId, BOOLEAN Set) |
Set vm-exit for mov-to-cr3. | |
VOID | VmFuncWriteExceptionBitmap (UINT32 BitmapMask) |
Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap. | |
UINT32 | VmFuncReadExceptionBitmap () |
Read exception bitmap in VMCS. | |
VOID | VmFuncSetInterruptWindowExiting (BOOLEAN Set) |
Set Interrupt-window exiting. | |
VOID | VmFuncSetNmiWindowExiting (BOOLEAN Set) |
Set NMI-window exiting. | |
VOID | VmFuncSetNmiExiting (BOOLEAN Set) |
Set the NMI Exiting. | |
VOID | VmFuncSetExceptionBitmap (UINT32 CoreId, UINT32 IdtIndex) |
Set exception bitmap in VMCS. | |
VOID | VmFuncUnsetExceptionBitmap (UINT32 CoreId, UINT32 IdtIndex) |
Unset exception bitmap in VMCS. | |
VOID | VmFuncSetExternalInterruptExiting (UINT32 CoreId, BOOLEAN Set) |
Set the External Interrupt Exiting. | |
VOID | VmFuncSetRdtscExiting (UINT32 CoreId, BOOLEAN Set) |
Set the RDTSC/P Exiting. | |
VOID | VmFuncSetMovDebugRegsExiting (UINT32 CoreId, BOOLEAN Set) |
Set or unset the Mov to Debug Registers Exiting. | |
UINT64 | VmFuncGetLastVmexitRip (UINT32 CoreId) |
get the last vm-exit RIP | |
VOID | VmFuncInjectPendingExternalInterrupts (UINT32 CoreId) |
Inject pending external interrupts. | |
UINT16 | VmFuncGetCsSelector () |
Read CS selector. | |
UINT64 | VmFuncGetRflags () |
Read guest's RFLAGS. | |
VOID | VmFuncSetRflags (UINT64 Rflags) |
Set guest's RFLAGS. | |
UINT64 | VmFuncGetRip () |
Read guest's RIP. | |
VOID | VmFuncSetRip (UINT64 Rip) |
Set guest's RIP. | |
UINT64 | VmFuncGetInterruptibilityState () |
Read guest's interruptibility state. | |
UINT64 | VmFuncClearSteppingBits (UINT64 Interruptibility) |
Clear STI and MOV SS bits. | |
VOID | VmFuncSetInterruptibilityState (UINT64 InterruptibilityState) |
Set guest's interruptibility state. | |
BOOLEAN | VmFuncNmiBroadcastRequest (UINT32 CoreId) |
Broadcast NMI requests. | |
BOOLEAN | VmFuncNmiBroadcastInvalidateEptSingleContext (UINT32 CoreId) |
Broadcast NMI requests for single-context EPT invalidation. | |
BOOLEAN | VmFuncNmiBroadcastInvalidateEptAllContexts (UINT32 CoreId) |
Broadcast NMI requests for all contexts EPT invalidation. | |
VOID | VmFuncInvalidateEptSingleContext (UINT32 CoreId) |
Requests for single-context EPT invalidation. | |
VOID | VmFuncInvalidateEptAllContexts () |
Requests for all contexts EPT invalidation. | |
VOID | VmFuncCheckAndEnableExternalInterrupts (UINT32 CoreId) |
Check and enable external interrupts. | |
VOID | VmFuncDisableExternalInterruptsAndInterruptWindow (UINT32 CoreId) |
Disable external-interrupts and interrupt window. | |
BOOLEAN | VmFuncInitVmm (VMM_CALLBACKS *VmmCallbacks) |
Initializes hypervisor. | |
VOID | VmFuncUninitVmm () |
Uninitialize Terminate Vmx on all logical cores. | |
BOOLEAN | VmFuncVmxGetCurrentExecutionMode () |
Get the current VMX operation state. | |
BOOLEAN | VmFuncQueryModeExecTrap () |
Get the current state of mode exec trap mechanism. | |
VOID | VmFuncSetTriggerEventForVmcalls (BOOLEAN Set) |
Set triggering events for VMCALLs. | |
VOID | VmFuncSetTriggerEventForCpuids (BOOLEAN Set) |
Set triggering events for CPUIDs. | |
UINT32 | VmFuncVmxCompatibleStrlen (const CHAR *s) |
VMX-root compatible strlen. | |
UINT32 | VmFuncVmxCompatibleWcslen (const wchar_t *s) |
VMX-root compatible strlen. | |
VOID | VmFuncEventInjectPageFaultWithCr2 (UINT32 CoreId, UINT64 Address, UINT32 PageFaultCode) |
Inject #PF and configure CR2 register. | |
VOID | VmFuncEventInjectPageFaultRangeAddress (UINT32 CoreId, UINT64 AddressFrom, UINT64 AddressTo, UINT32 PageFaultCode) |
Inject a range of page-faults. | |
VOID | VmFuncEventInjectInterruption (UINT32 InterruptionType, UINT32 Vector, BOOLEAN DeliverErrorCode, UINT32 ErrorCode) |
Inject interrupt/faults/exceptions. | |
NTSTATUS | VmFuncVmxVmcall (unsigned long long VmcallNumber, unsigned long long OptionalParam1, unsigned long long OptionalParam2, unsigned long long OptionalParam3) |
Export for running VMX VMCALLs. | |
VOID | VmFuncVmxBroadcastInitialize () |
Export for initialize the VMX Broadcast mechanism. | |
VOID | VmFuncVmxBroadcastUninitialize () |
Export for uninitialize the VMX Broadcast mechanism. | |
VOID | VmFuncEventInjectBreakpoint () |
Inject #BP to the guest (Event Injection) | |
INT32 | VmFuncVmxCompatibleStrcmp (const CHAR *Address1, const CHAR *Address2) |
VMX-root compatible strcmp. | |
INT32 | VmFuncVmxCompatibleStrncmp (const CHAR *Address1, const CHAR *Address2, SIZE_T Num) |
VMX-root compatible strncmp. | |
INT32 | VmFuncVmxCompatibleWcscmp (const wchar_t *Address1, const wchar_t *Address2) |
VMX-root compatible wcscmp. | |
INT32 | VmFuncVmxCompatibleWcsncmp (const wchar_t *Address1, const wchar_t *Address2, SIZE_T Num) |
VMX-root compatible wcsncmp. | |
INT32 | VmFuncVmxCompatibleMemcmp (const CHAR *Address1, const CHAR *Address2, size_t Count) |
VMX-root compatible memcmp. | |
VOID | VmFuncEnableMtfAndChangeExternalInterruptState (UINT32 CoreId) |
Enables MTF and adjust external interrupt state. | |
VOID | VmFuncEnableAndCheckForPreviousExternalInterrupts (UINT32 CoreId) |
Checks to enable and reinject previous interrupts. | |
Implementation of exported functions from hypervisor.
Change ignore one MTF state.
CoreId | Target core's ID |
Set | State of setting or unsetting |
Suppress unsetting MTF.
CoreId | Target core's ID |
Set | State of setting or unsetting |
Check and enable external interrupts.
CoreId | Target core's ID |
Clear STI and MOV SS bits.
Disable external-interrupts and interrupt window.
CoreId |
Checks to enable and reinject previous interrupts.
UINT32 | CoreId |
Enables MTF and adjust external interrupt state.
UINT32 | CoreId |
VOID VmFuncEventInjectBreakpoint | ( | ) |
Inject #BP to the guest (Event Injection)
VOID VmFuncEventInjectInterruption | ( | UINT32 | InterruptionType, |
UINT32 | Vector, | ||
BOOLEAN | DeliverErrorCode, | ||
UINT32 | ErrorCode ) |
Inject interrupt/faults/exceptions.
InterruptionType | |
Vector | |
DeliverErrorCode | |
ErrorCode |
VOID VmFuncEventInjectPageFaultRangeAddress | ( | UINT32 | CoreId, |
UINT64 | AddressFrom, | ||
UINT64 | AddressTo, | ||
UINT32 | PageFaultCode ) |
Inject a range of page-faults.
CoreId | Target core's ID |
AddressFrom | Page-fault address (from) |
AddressTo | Page-fault address (to) |
Address | Page-fault address |
PageFaultCode | Page-fault error code |
Inject #PF and configure CR2 register.
CoreId | Target core's ID |
Address | Page-fault address |
PageFaultCode | Page-fault error code |
UINT16 VmFuncGetCsSelector | ( | ) |
Read CS selector.
UINT64 VmFuncGetInterruptibilityState | ( | ) |
Read guest's interruptibility state.
get the last vm-exit RIP
CoreId | Target core's ID |
UINT64 VmFuncGetRflags | ( | ) |
Read guest's RFLAGS.
UINT64 VmFuncGetRip | ( | ) |
BOOLEAN VmFuncInitVmm | ( | VMM_CALLBACKS * | VmmCallbacks | ) |
Inject pending external interrupts.
CoreId | Target core's ID |
VOID VmFuncInvalidateEptAllContexts | ( | ) |
Requests for all contexts EPT invalidation.
Requests for single-context EPT invalidation.
CoreId | Target core's ID |
Broadcast NMI requests for all contexts EPT invalidation.
CoreId | Target core's ID |
Broadcast NMI requests for single-context EPT invalidation.
CoreId | Target core's ID |
Broadcast NMI requests.
CoreId | Target core's ID |
Perform the incrementation of RIP.
CoreId | Target core's ID |
BOOLEAN VmFuncQueryModeExecTrap | ( | ) |
Get the current state of mode exec trap mechanism.
UINT32 VmFuncReadExceptionBitmap | ( | ) |
Read exception bitmap in VMCS.
Should be called in vmx-root
Register for break in the case of an MTF.
CoreId | Target core's ID |
Set exception bitmap in VMCS.
Should be called in vmx-root
CoreId | Target core's ID |
IdtIndex | Interrupt Descriptor Table index of exception |
Set the External Interrupt Exiting.
CoreId | Target core's ID |
Set | Set or unset the External Interrupt Exiting |
Set guest's interruptibility state.
InterruptibilityState |
Set Interrupt-window exiting.
Set | Set or unset the Interrupt-window exiting |
Set LOAD DEBUG CONTROLS on Vm-entry controls.
Set | Set or unset |
Set the monitor trap flag.
Set | Set or unset the MTFs |
Set vm-exit for mov-to-cr0/4.
Should be called in vmx-root
Set | or unset the vm-exits |
Control | Register |
Mask | Register |
Set or unset the Mov to Debug Registers Exiting.
CoreId | Target core's ID |
Set | Set or unset the Mov to Debug Registers Exiting |
Set vm-exit for mov-to-cr3.
Should be called in vmx-root
CoreId | target core id |
Set | Set or unset the vm-exits |
Set the NMI Exiting.
Set | Set or unset the NMI Exiting |
Set NMI-window exiting.
Set | Set or unset the NMI-window exiting |
Set vm-exit for rdpmc instructions.
Should be called in vmx-root
Set | Set or unset the vm-exits |
Set the RDTSC/P Exiting.
CoreId | Target core's ID |
Set | Set or unset the RDTSC/P Exiting |
Set Rflag's trap flag.
Set | Set or unset the TF |
Set SAVE DEBUG CONTROLS on Vm-exit controls.
Set | Set or unset |
Set triggering events for CPUIDs.
Set | Set or unset the trigger |
Set triggering events for VMCALLs.
Set | Set or unset the trigger |
Suppress the incrementation of RIP.
CoreId | Target core's ID |
VOID VmFuncUninitVmm | ( | ) |
Uninitialize Terminate Vmx on all logical cores.
Unregister for break in the case of an MTF.
CoreId | Target core's ID |
Unset exception bitmap in VMCS.
Should be called in vmx-root
CoreId | Target core's ID |
IdtIndex | Interrupt Descriptor Table index of exception |
VOID VmFuncVmxBroadcastInitialize | ( | ) |
Export for initialize the VMX Broadcast mechanism.
VOID VmFuncVmxBroadcastUninitialize | ( | ) |
Export for uninitialize the VMX Broadcast mechanism.
VMX-root compatible memcmp.
Address1 | |
Address2 | |
Count |
VMX-root compatible strcmp.
Address1 | |
Address2 |
VMX-root compatible strlen.
s | A pointer to the string |
VMX-root compatible strncmp.
Address1 | |
Address2 | |
Num |
INT32 VmFuncVmxCompatibleWcscmp | ( | const wchar_t * | Address1, |
const wchar_t * | Address2 ) |
VMX-root compatible wcscmp.
Address1 | |
Address2 |
UINT32 VmFuncVmxCompatibleWcslen | ( | const wchar_t * | s | ) |
VMX-root compatible strlen.
s | A pointer to the string |
INT32 VmFuncVmxCompatibleWcsncmp | ( | const wchar_t * | Address1, |
const wchar_t * | Address2, | ||
SIZE_T | Num ) |
VMX-root compatible wcsncmp.
Address1 | |
Address2 | |
Num |
BOOLEAN VmFuncVmxGetCurrentExecutionMode | ( | ) |
Get the current VMX operation state.
NTSTATUS VmFuncVmxVmcall | ( | unsigned long long | VmcallNumber, |
unsigned long long | OptionalParam1, | ||
unsigned long long | OptionalParam2, | ||
unsigned long long | OptionalParam3 ) |
Export for running VMX VMCALLs.
VmcallNumber | |
OptionalParam1 | |
OptionalParam2 | |
OptionalParam3 |
Write on exception bitmap in VMCS DO NOT CALL IT DIRECTLY, instead use HvSetExceptionBitmap.
Should be called in vmx-root
BitmapMask | The content to write on exception bitmap |